@cloudcli-ai/cloudcli 1.36.3 → 1.37.1

package/dist-server/server/modules/user/user.service.js

@@ -0,0 +1,59 @@
+import { AppError } from '../../shared/utils.js';
+/** Creates user-profile workflows with explicit repository and Git adapters. */
+export function createUserService(dependencies) {
+    return {
+        async getGitConfig(userId) {
+            let gitConfig = dependencies.users.getGitConfig(userId);
+            if (!gitConfig || (!gitConfig.git_name && !gitConfig.git_email)) {
+                const systemConfig = await dependencies.readSystemGitConfig();
+                if (systemConfig.git_name || systemConfig.git_email) {
+                    dependencies.users.updateGitConfig(userId, systemConfig.git_name, systemConfig.git_email);
+                    gitConfig = systemConfig;
+                    dependencies.logInfo(`Auto-populated Git config for user ${userId}`);
+                }
+            }
+            return {
+                success: true,
+                gitName: gitConfig?.git_name ?? null,
+                gitEmail: gitConfig?.git_email ?? null,
+            };
+        },
+        async updateGitConfig(userId, gitNameInput, gitEmailInput) {
+            const gitName = typeof gitNameInput === 'string' ? gitNameInput.trim() : '';
+            const gitEmail = typeof gitEmailInput === 'string' ? gitEmailInput.trim() : '';
+            if (!gitName || !gitEmail) {
+                throw new AppError('Git name and email are required', {
+                    code: 'GIT_CONFIG_REQUIRED',
+                    statusCode: 400,
+                });
+            }
+            if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(gitEmail)) {
+                throw new AppError('Invalid email format', {
+                    code: 'INVALID_GIT_EMAIL',
+                    statusCode: 400,
+                });
+            }
+            dependencies.users.updateGitConfig(userId, gitName, gitEmail);
+            try {
+                await dependencies.applyGlobalGitConfig(gitName, gitEmail);
+            }
+            catch (error) {
+                // Persisted user settings remain authoritative even if the host Git
+                // installation cannot be updated (matching the previous behavior).
+                dependencies.logError('Failed to apply global Git config', error);
+            }
+            return { success: true, gitName, gitEmail };
+        },
+        completeOnboarding(userId) {
+            dependencies.users.completeOnboarding(userId);
+            return { success: true, message: 'Onboarding completed successfully' };
+        },
+        getOnboardingStatus(userId) {
+            return {
+                success: true,
+                hasCompletedOnboarding: dependencies.users.hasCompletedOnboarding(userId),
+            };
+        },
+    };
+}
+//# sourceMappingURL=user.service.js.map

package/dist-server/server/modules/user/user.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.service.js","sourceRoot":"","sources":["../../../../server/modules/user/user.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAoB7C,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,YAA8B;IAC9D,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,MAAc;YAC/B,IAAI,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChE,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,mBAAmB,EAAE,CAAC;gBAC9D,IAAI,YAAY,CAAC,QAAQ,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;oBACpD,YAAY,CAAC,KAAK,CAAC,eAAe,CAChC,MAAM,EACN,YAAY,CAAC,QAAQ,EACrB,YAAY,CAAC,SAAS,CACvB,CAAC;oBACF,SAAS,GAAG,YAAY,CAAC;oBACzB,YAAY,CAAC,OAAO,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI,IAAI;gBACpC,QAAQ,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI;aACvC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,YAAqB,EAAE,aAAsB;YACjF,MAAM,OAAO,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,QAAQ,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,QAAQ,CAAC,iCAAiC,EAAE;oBACpD,IAAI,EAAE,qBAAqB;oBAC3B,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE;oBACzC,IAAI,EAAE,mBAAmB;oBACzB,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,MAAM,YAAY,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,oEAAoE;gBACpE,mEAAmE;gBACnE,YAAY,CAAC,QAAQ,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC9C,CAAC;QAED,kBAAkB,CAAC,MAAc;YAC/B,YAAY,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;QACzE,CAAC;QAED,mBAAmB,CAAC,MAAc;YAChC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,sBAAsB,EAAE,YAAY,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC;aAC1E,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist-server/server/modules/voice/index.js

@@ -0,0 +1,3 @@
+// voiceRoutes: used by the server entrypoint to mount authenticated STT/TTS endpoints.
+export { voiceRoutes } from './voice.module.js';
+//# sourceMappingURL=index.js.map

package/dist-server/server/modules/voice/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../server/modules/voice/index.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC"}

package/dist-server/server/modules/voice/tests/voice.service.test.js

@@ -0,0 +1,86 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createVoiceService } from '../voice.service.js';
+const defaults = {
+    baseUrl: 'https://voice.example/v1',
+    apiKey: 'server-key',
+    sttModel: 'whisper-1',
+    ttsModel: 'tts-1',
+    ttsVoice: 'alloy',
+};
+test('reports whether the server-controlled backend is configured', () => {
+    const service = createVoiceService({
+        defaults: { ...defaults, baseUrl: '' },
+        timeoutMs: 1_000,
+        fetchBackend: async () => {
+            throw new Error('fetch should not run');
+        },
+    });
+    assert.deepEqual(service.getHealth(), { configured: false });
+});
+test('transcribes with injected fetch and request-level credential/model overrides', async () => {
+    let requestedUrl = '';
+    let requestedOptions;
+    const service = createVoiceService({
+        defaults,
+        timeoutMs: 1_000,
+        fetchBackend: async (url, options) => {
+            requestedUrl = url;
+            requestedOptions = options;
+            return new Response(JSON.stringify({ text: 'hello' }), { status: 200 });
+        },
+    });
+    const result = await service.transcribe({
+        audio: {
+            bytes: Buffer.from('audio'),
+            mimeType: 'audio/webm',
+            fileName: 'recording.webm',
+        },
+        overrides: { apiKey: 'request-key', sttModel: 'custom-whisper' },
+    });
+    assert.deepEqual(result, { ok: true, value: { text: 'hello' } });
+    assert.equal(requestedUrl, 'https://voice.example/v1/audio/transcriptions');
+    assert.equal((requestedOptions?.headers).Authorization, 'Bearer request-key');
+    assert.equal((requestedOptions?.body).get('model'), 'custom-whisper');
+});
+test('forwards the explicit TTS format and maps backend authentication failures', async () => {
+    let requestBody = '';
+    const service = createVoiceService({
+        defaults,
+        timeoutMs: 1_000,
+        fetchBackend: async (_url, options) => {
+            requestBody = String(options.body);
+            return new Response('unauthorized', { status: 401 });
+        },
+    });
+    const result = await service.synthesizeSpeech({
+        text: 'Read this',
+        overrides: { ttsFormat: 'wav' },
+    });
+    assert.deepEqual(JSON.parse(requestBody), {
+        model: 'tts-1',
+        voice: 'alloy',
+        input: 'Read this',
+        response_format: 'wav',
+    });
+    assert.deepEqual(result, {
+        ok: false,
+        status: 502,
+        error: 'Voice backend rejected the request (check the API key).',
+    });
+});
+test('blocks link-local metadata destinations before calling the fetch adapter', async () => {
+    let fetchCalls = 0;
+    const service = createVoiceService({
+        defaults: { ...defaults, baseUrl: 'http://169.254.169.254/latest' },
+        timeoutMs: 1_000,
+        fetchBackend: async () => {
+            fetchCalls += 1;
+            return new Response();
+        },
+    });
+    const result = await service.synthesizeSpeech({ text: 'hello', overrides: {} });
+    assert.deepEqual(result, { ok: false, status: 400, error: 'Invalid voice backend URL.' });
+    assert.equal(fetchCalls, 0);
+});
+//# sourceMappingURL=voice.service.test.js.map

package/dist-server/server/modules/voice/tests/voice.service.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"voice.service.test.js","sourceRoot":"","sources":["../../../../../server/modules/voice/tests/voice.service.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE,0BAA0B;IACnC,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,OAAO;IACjB,QAAQ,EAAE,OAAO;CAClB,CAAC;AAEF,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,MAAM,OAAO,GAAG,kBAAkB,CAAC;QACjC,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE;QACtC,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,KAAK,IAAI,EAAE;YACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;IAC9F,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,gBAAyC,CAAC;IAC9C,MAAM,OAAO,GAAG,kBAAkB,CAAC;QACjC,QAAQ;QACR,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;YACnC,YAAY,GAAG,GAAG,CAAC;YACnB,gBAAgB,GAAG,OAAO,CAAC;YAC3B,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;QACtC,KAAK,EAAE;YACL,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YAC3B,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,gBAAgB;SAC3B;QACD,SAAS,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE;KACjE,CAAC,CAAC;IAEH,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,+CAA+C,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,CAAC,gBAAgB,EAAE,OAAkC,CAAA,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;IACxG,MAAM,CAAC,KAAK,CAAC,CAAC,gBAAgB,EAAE,IAAiB,CAAA,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACpF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;IAC3F,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,MAAM,OAAO,GAAG,kBAAkB,CAAC;QACjC,QAAQ;QACR,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;YACpC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC;QAC5C,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;KAChC,CAAC,CAAC;IAEH,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QACxC,KAAK,EAAE,OAAO;QACd,KAAK,EAAE,OAAO;QACd,KAAK,EAAE,WAAW;QAClB,eAAe,EAAE,KAAK;KACvB,CAAC,CAAC;IACH,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE;QACvB,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,KAAK,EAAE,yDAAyD;KACjE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,OAAO,GAAG,kBAAkB,CAAC;QACjC,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,+BAA+B,EAAE;QACnE,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,KAAK,IAAI,EAAE;YACvB,UAAU,IAAI,CAAC,CAAC;YAChB,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAEhF,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC1F,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC"}

package/dist-server/server/modules/voice/voice.module.js

@@ -0,0 +1,44 @@
+import multer from 'multer';
+import { createVoiceRouter } from './voice.routes.js';
+import { createVoiceService } from './voice.service.js';
+const DEFAULT_VOICE_TIMEOUT_MS = 300_000;
+const parsedTimeoutMs = Number(process.env.VOICE_TIMEOUT_MS);
+const voiceTimeoutMs = Number.isFinite(parsedTimeoutMs) && parsedTimeoutMs > 0
+    ? parsedTimeoutMs
+    : DEFAULT_VOICE_TIMEOUT_MS;
+const voiceService = createVoiceService({
+    defaults: {
+        // The server-controlled URL is intentional: frontend-configured custom
+        // backends are called directly by the browser and never become SSRF input.
+        baseUrl: (process.env.VOICE_API_BASE_URL || '').replace(/\/$/, ''),
+        apiKey: process.env.VOICE_API_KEY || '',
+        sttModel: process.env.VOICE_STT_MODEL || 'whisper-1',
+        ttsModel: process.env.VOICE_TTS_MODEL || 'tts-1',
+        ttsVoice: process.env.VOICE_TTS_VOICE || 'alloy',
+    },
+    timeoutMs: voiceTimeoutMs,
+    fetchBackend: async (url, options) => {
+        const abortController = new AbortController();
+        const timeoutHandle = setTimeout(() => abortController.abort(), voiceTimeoutMs);
+        try {
+            return await fetch(url, {
+                redirect: 'manual',
+                ...options,
+                signal: abortController.signal,
+            });
+        }
+        finally {
+            clearTimeout(timeoutHandle);
+        }
+    },
+});
+const audioUpload = multer({
+    storage: multer.memoryStorage(),
+    limits: { fileSize: 25 * 1024 * 1024 },
+});
+/** Voice router assembled for the server entrypoint. */
+export const voiceRoutes = createVoiceRouter({
+    voiceService,
+    parseAudioUpload: audioUpload.single('audio'),
+});
+//# sourceMappingURL=voice.module.js.map

package/dist-server/server/modules/voice/voice.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"voice.module.js","sourceRoot":"","sources":["../../../../server/modules/voice/voice.module.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,MAAM,wBAAwB,GAAG,OAAO,CAAC;AACzC,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAC7D,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,eAAe,GAAG,CAAC;IAC5E,CAAC,CAAC,eAAe;IACjB,CAAC,CAAC,wBAAwB,CAAC;AAE7B,MAAM,YAAY,GAAG,kBAAkB,CAAC;IACtC,QAAQ,EAAE;QACR,uEAAuE;QACvE,2EAA2E;QAC3E,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAClE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE;QACvC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,WAAW;QACpD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO;QAChD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO;KACjD;IACD,SAAS,EAAE,cAAc;IACzB,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QACnC,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,cAAc,CAAC,CAAC;QAChF,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,QAAQ,EAAE,QAAQ;gBAClB,GAAG,OAAO;gBACV,MAAM,EAAE,eAAe,CAAC,MAAM;aAC/B,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,aAAa,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE;IAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE;CACvC,CAAC,CAAC;AAEH,wDAAwD;AACxD,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;IAC3C,YAAY;IACZ,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;CAC9C,CAAC,CAAC"}

package/dist-server/server/modules/voice/voice.routes.js

@@ -0,0 +1,87 @@
+import { Readable } from 'node:stream';
+import express from 'express';
+import { asyncHandler } from '../../shared/utils.js';
+function readHeaderValue(value) {
+    const normalizedValue = Array.isArray(value) ? value[0] : value;
+    const trimmedValue = normalizedValue?.trim();
+    return trimmedValue || undefined;
+}
+function parseVoiceOverrides(request) {
+    return {
+        apiKey: readHeaderValue(request.headers['x-voice-api-key']),
+        sttModel: readHeaderValue(request.headers['x-voice-stt-model']),
+        ttsModel: readHeaderValue(request.headers['x-voice-tts-model']),
+        ttsVoice: readHeaderValue(request.headers['x-voice-tts-voice']),
+        ttsFormat: readHeaderValue(request.headers['x-voice-tts-format']),
+    };
+}
+function sendFailure(response, result) {
+    if (result.ok) {
+        return false;
+    }
+    response.status(result.status).json({ error: result.error });
+    return true;
+}
+/**
+ * Creates the transport-only router used by the Voice composition root. It is
+ * exported for Voice route tests; other modules consume only the composed
+ * router exposed from the Voice barrel.
+ */
+export function createVoiceRouter(dependencies) {
+    const router = express.Router();
+    router.get('/health', (_request, response) => {
+        response.json(dependencies.voiceService.getHealth());
+    });
+    router.post('/transcribe', (request, response, next) => {
+        dependencies.parseAudioUpload(request, response, (uploadError) => {
+            if (uploadError) {
+                const message = uploadError instanceof Error ? uploadError.message : String(uploadError);
+                response.status(400).json({ error: message });
+                return;
+            }
+            // Multer uses a callback API, so bridge its parsed request into the async
+            // service call and forward unexpected rejections to Express middleware.
+            void (async () => {
+                if (!request.file) {
+                    response.status(400).json({ error: 'No audio uploaded' });
+                    return;
+                }
+                const result = await dependencies.voiceService.transcribe({
+                    audio: {
+                        bytes: request.file.buffer,
+                        mimeType: request.file.mimetype || 'audio/webm',
+                        fileName: request.file.originalname || 'recording.webm',
+                    },
+                    overrides: parseVoiceOverrides(request),
+                });
+                if (sendFailure(response, result)) {
+                    return;
+                }
+                response.json(result.value);
+            })().catch(next);
+        });
+    });
+    router.post('/tts', asyncHandler(async (request, response) => {
+        const text = request.body?.text;
+        if (typeof text !== 'string' || !text.trim()) {
+            response.status(400).json({ error: 'text required' });
+            return;
+        }
+        const result = await dependencies.voiceService.synthesizeSpeech({
+            text,
+            overrides: parseVoiceOverrides(request),
+        });
+        if (sendFailure(response, result)) {
+            return;
+        }
+        response.setHeader('Content-Type', result.value.contentType);
+        response.setHeader('Cache-Control', 'no-store');
+        if (!result.value.body) {
+            response.end();
+            return;
+        }
+        Readable.fromWeb(result.value.body).on('error', (error) => response.destroy(error)).pipe(response);
+    }));
+    return router;
+}
+//# sourceMappingURL=voice.routes.js.map

package/dist-server/server/modules/voice/voice.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"voice.routes.js","sourceRoot":"","sources":["../../../../server/modules/voice/voice.routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAOjD,SAAS,eAAe,CAAC,KAAoC;IAC3D,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChE,MAAM,YAAY,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,YAAY,IAAI,SAAS,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAwB;IACnD,OAAO;QACL,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3D,QAAQ,EAAE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC/D,QAAQ,EAAE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC/D,QAAQ,EAAE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC/D,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,QAA0B,EAC1B,MAAkC;IAElC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAqC;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAC3C,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACrD,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,WAAqB,EAAE,EAAE;YACzE,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACzF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC9C,OAAO;YACT,CAAC;YAED,0EAA0E;YAC1E,wEAAwE;YACxE,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBAClB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,UAAU,CAAC;oBACxD,KAAK,EAAE;wBACL,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;wBAC1B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,YAAY;wBAC/C,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,gBAAgB;qBACxD;oBACD,SAAS,EAAE,mBAAmB,CAAC,OAAO,CAAC;iBACxC,CAAC,CAAC;gBAEH,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;oBAClC,OAAO;gBACT,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;QAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,gBAAgB,CAAC;YAC9D,IAAI;YACJ,SAAS,EAAE,mBAAmB,CAAC,OAAO,CAAC;SACxC,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC7D,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC,CAAC;IAEJ,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist-server/server/modules/voice/voice.service.js

@@ -0,0 +1,148 @@
+function resolveVoiceConfig(defaults, overrides) {
+    return {
+        baseUrl: defaults.baseUrl,
+        apiKey: overrides.apiKey || defaults.apiKey,
+        sttModel: overrides.sttModel || defaults.sttModel,
+        ttsModel: overrides.ttsModel || defaults.ttsModel,
+        ttsVoice: overrides.ttsVoice || defaults.ttsVoice,
+        ttsFormat: overrides.ttsFormat?.trim() ?? '',
+    };
+}
+function validateBackendBaseUrl(baseUrl) {
+    try {
+        const parsedUrl = new URL(baseUrl);
+        if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+            return false;
+        }
+        // Local and private backends are supported intentionally. Only link-local
+        // metadata addresses remain blocked as a defense in depth measure.
+        return parsedUrl.hostname !== '169.254.169.254'
+            && !parsedUrl.hostname.startsWith('169.254.');
+    }
+    catch {
+        return false;
+    }
+}
+function authorizationHeader(apiKey) {
+    return apiKey ? { Authorization: `Bearer ${apiKey}` } : {};
+}
+function backendFailure(status, responseText) {
+    if (status === 401 || status === 403) {
+        return {
+            ok: false,
+            status: 502,
+            error: 'Voice backend rejected the request (check the API key).',
+        };
+    }
+    return {
+        ok: false,
+        status,
+        error: responseText || 'voice backend error',
+    };
+}
+function unreachableBackendFailure(error, timeoutMs) {
+    if (error instanceof Error && error.name === 'AbortError') {
+        return {
+            ok: false,
+            status: 504,
+            error: `Voice backend timed out after ${Math.round(timeoutMs / 1000)}s. Check your voice backend.`,
+        };
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+        ok: false,
+        status: 502,
+        error: `Voice backend unreachable: ${message}`,
+    };
+}
+function validateConfiguredBackend(config) {
+    if (!config.baseUrl) {
+        return { ok: false, status: 503, error: 'No voice backend configured' };
+    }
+    if (!validateBackendBaseUrl(config.baseUrl)) {
+        return { ok: false, status: 400, error: 'Invalid voice backend URL.' };
+    }
+    return null;
+}
+function createTranscriptionFormData(audio, sttModel) {
+    const formData = new FormData();
+    formData.append('file', new Blob([audio.bytes], { type: audio.mimeType }), audio.fileName);
+    formData.append('model', sttModel);
+    return formData;
+}
+/**
+ * Creates the Voice application service used by the Voice composition root and
+ * its unit tests. The outbound request function and server configuration are
+ * required so the service never reads globals or creates production defaults.
+ */
+export function createVoiceService(dependencies) {
+    return {
+        getHealth: () => ({ configured: Boolean(dependencies.defaults.baseUrl) }),
+        async transcribe(input) {
+            const config = resolveVoiceConfig(dependencies.defaults, input.overrides);
+            const configurationFailure = validateConfiguredBackend(config);
+            if (configurationFailure) {
+                return configurationFailure;
+            }
+            try {
+                const response = await dependencies.fetchBackend(`${config.baseUrl}/audio/transcriptions`, {
+                    method: 'POST',
+                    headers: authorizationHeader(config.apiKey),
+                    body: createTranscriptionFormData(input.audio, config.sttModel),
+                });
+                const responseText = await response.text();
+                if (!response.ok) {
+                    return backendFailure(response.status, responseText);
+                }
+                try {
+                    const parsed = JSON.parse(responseText);
+                    return {
+                        ok: true,
+                        value: { text: typeof parsed.text === 'string' ? parsed.text : '' },
+                    };
+                }
+                catch {
+                    return { ok: true, value: { text: responseText } };
+                }
+            }
+            catch (error) {
+                return unreachableBackendFailure(error, dependencies.timeoutMs);
+            }
+        },
+        async synthesizeSpeech(input) {
+            const config = resolveVoiceConfig(dependencies.defaults, input.overrides);
+            const configurationFailure = validateConfiguredBackend(config);
+            if (configurationFailure) {
+                return configurationFailure;
+            }
+            try {
+                const response = await dependencies.fetchBackend(`${config.baseUrl}/audio/speech`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        ...authorizationHeader(config.apiKey),
+                    },
+                    body: JSON.stringify({
+                        model: config.ttsModel,
+                        voice: config.ttsVoice,
+                        input: input.text,
+                        ...(config.ttsFormat ? { response_format: config.ttsFormat } : {}),
+                    }),
+                });
+                if (!response.ok) {
+                    const responseText = await response.text().catch(() => 'tts failed');
+                    return backendFailure(response.status, responseText);
+                }
+                const value = {
+                    contentType: response.headers.get('content-type') || 'audio/mpeg',
+                    body: response.body,
+                };
+                return { ok: true, value };
+            }
+            catch (error) {
+                return unreachableBackendFailure(error, dependencies.timeoutMs);
+            }
+        },
+    };
+}
+//# sourceMappingURL=voice.service.js.map

package/dist-server/server/modules/voice/voice.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"voice.service.js","sourceRoot":"","sources":["../../../../server/modules/voice/voice.service.ts"],"names":[],"mappings":"AAwBA,SAAS,kBAAkB,CACzB,QAA8C,EAC9C,SAAgC;IAEhC,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;QAC3C,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;QACjD,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;QACjD,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;QACjD,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,0EAA0E;QAC1E,mEAAmE;QACnE,OAAO,SAAS,CAAC,QAAQ,KAAK,iBAAiB;eAC1C,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,YAAqB;IAC3D,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,yDAAyD;SACjE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM;QACN,KAAK,EAAE,YAAY,IAAI,qBAAqB;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc,EAAE,SAAiB;IAClE,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,iCAAiC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,8BAA8B;SACnG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,KAAK,EAAE,8BAA8B,OAAO,EAAE;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,MAA2B;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAC1E,CAAC;IAED,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IACzE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAuB,EAAE,QAAgB;IAC5E,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3F,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,YAAsC;IACvE,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAEzE,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC1E,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;YAC/D,IAAI,oBAAoB,EAAE,CAAC;gBACzB,OAAO,oBAAoB,CAAC;YAC9B,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAC9C,GAAG,MAAM,CAAC,OAAO,uBAAuB,EACxC;oBACE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC3C,IAAI,EAAE,2BAA2B,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC;iBAChE,CACF,CAAC;gBACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;gBACvD,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAuB,CAAC;oBAC9D,OAAO;wBACL,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;qBACpE,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;gBACrD,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAyB,CAAC,KAAK,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,KAAK;YAC1B,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC1E,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;YAC/D,IAAI,oBAAoB,EAAE,CAAC;gBACzB,OAAO,oBAAoB,CAAC;YAC9B,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,OAAO,eAAe,EAAE;oBACjF,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC;qBACtC;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,KAAK,EAAE,MAAM,CAAC,QAAQ;wBACtB,KAAK,EAAE,MAAM,CAAC,QAAQ;wBACtB,KAAK,EAAE,KAAK,CAAC,IAAI;wBACjB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACnE,CAAC;iBACH,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;oBACrE,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;gBACvD,CAAC;gBAED,MAAM,KAAK,GAAuB;oBAChC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,YAAY;oBACjE,IAAI,EAAE,QAAQ,CAAC,IAAI;iBACpB,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAyB,CAAC,KAAK,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist-server/server/modules/websocket/services/chat-session-writer.service.js

@@ -5,8 +5,8 @@ import { createCompleteMessage, readObjectRecord } from '../../../shared/utils.j
  *
  * It exposes the exact same surface as `WebSocketWriter` (`send`,
  * `setSessionId`, `getSessionId`, `updateWebSocket`, `userId`,
- * `isWebSocketWriter`) so the provider runtimes (`claude-sdk.js`,
- * `cursor-cli.js`, ...) need zero changes — but everything that flows through
+ * `isWebSocketWriter`) so the provider runtime adapters need zero changes —
+ * but everything that flows through
  * it is translated from the provider's world into the app's protocol:
  *
  * - `session_created` events are swallowed and turned into a provider-id

package/dist-server/server/modules/websocket/services/chat-websocket.service.js

@@ -1,8 +1,9 @@
 import path from 'node:path';
 import { sessionsDb } from '../../../modules/database/index.js';
+import { providerModelsService } from '../../../modules/providers/index.js';
 import { chatRunRegistry } from '../../../modules/websocket/services/chat-run-registry.service.js';
 import { connectedClients, WS_OPEN_STATE } from '../../../modules/websocket/services/websocket-state.service.js';
-import { getGlobalImageAssetsDir, normalizeImageDescriptors } from '../../../shared/image-attachments.js';
+import { getGlobalImageAssetsDir, isImageAttachmentDescriptor, normalizeAttachmentDescriptors, } from '../../../shared/image-attachments.js';
 import { parseIncomingJsonObject } from '../../../shared/utils.js';
 /**
  * Trust boundary for client-supplied image attachments: chat.send options come
@@ -14,9 +15,9 @@ import { parseIncomingJsonObject } from '../../../shared/utils.js';
  *
  * Exported for tests; `assetsRootOverride` exists only for them.
  */
-export function filterImagesToUploadStore(images, assetsRootOverride) {
+export function filterAttachmentsToUploadStore(attachments, assetsRootOverride) {
     const assetsRoot = path.resolve(assetsRootOverride ?? getGlobalImageAssetsDir());
-    return normalizeImageDescriptors(images).filter((descriptor) => {
+    return normalizeAttachmentDescriptors(attachments).filter((descriptor) => {
         // Relative paths are anchored in the store; absolute ones must already be in it.
         const resolved = path.resolve(assetsRoot, descriptor.path);
         const relative = path.relative(assetsRoot, resolved);
@@ -26,11 +27,15 @@ export function filterImagesToUploadStore(images, assetsRootOverride) {
             !relative.includes(path.sep) &&
             !relative.includes('/');
         if (!isDirectChild) {
-            console.warn(`[Chat] Dropping image outside the upload store: ${descriptor.path}`);
+            console.warn(`[Chat] Dropping attachment outside the upload store: ${descriptor.path}`);
         }
         return isDirectChild;
     });
 }
+/** Backward-compatible image filter consumed by existing websocket tests. */
+export function filterImagesToUploadStore(images, assetsRootOverride) {
+    return filterAttachmentsToUploadStore(images, assetsRootOverride);
+}
 /**
  * Extracts the authenticated request user id in the formats currently produced
  * by platform and OSS auth code paths.
@@ -90,8 +95,7 @@ async function handleChatSend(ws, userId, data, dependencies) {
         return;
     }
     const provider = session.provider;
-    const spawnFn = dependencies.spawnFns[provider];
-    if (!spawnFn) {
+    if (!dependencies.runtime.hasRuntime(provider)) {
         sendProtocolError(ws, 'UNSUPPORTED_PROVIDER', `Provider "${provider}" is not available.`, sessionId);
         return;
     }
@@ -108,22 +112,41 @@ async function handleChatSend(ws, userId, data, dependencies) {
     }
     const clientOptions = (data.options ?? {});
     const command = typeof data.content === 'string' ? data.content : '';
-    // The provider runtimes receive the provider-native session id (that is the
-    // id their CLI/SDK understands for resume). Brand-new sessions have no
-    // provider id yet, so the runtime starts fresh and announces one, which the
-    // gateway writer captures and maps back to the app session id.
+    // Record what this turn runs with so reopening the session later restores the
+    // same model and reasoning effort, and so the resume path has a
+    // session-scoped model answer to use.
+    if (typeof clientOptions.model === 'string' && clientOptions.model.trim()) {
+        providerModelsService.setSessionModel(provider, sessionId, clientOptions.model);
+    }
+    if (typeof clientOptions.effort === 'string' && clientOptions.effort.trim()) {
+        providerModelsService.setSessionEffort(provider, sessionId, clientOptions.effort);
+    }
+    const attachmentCandidates = [
+        ...normalizeAttachmentDescriptors(clientOptions.images),
+        ...normalizeAttachmentDescriptors(clientOptions.files),
+        ...normalizeAttachmentDescriptors(clientOptions.attachments),
+    ];
+    const verifiedAttachments = filterAttachmentsToUploadStore(attachmentCandidates);
+    const uniqueAttachments = verifiedAttachments.filter((descriptor, index, all) => all.findIndex((candidate) => candidate.path === descriptor.path) === index);
+    // The provider runtimes receive the stable app session id. When their
+    // CLI/SDK needs the provider-native id for resume, they resolve it from the
+    // session row themselves (sessionsService.resolveProviderSessionId).
+    // Brand-new sessions have no provider id yet, so the runtime starts fresh
+    // and announces one, which the gateway writer captures and maps back to the
+    // app session id.
     const runtimeOptions = {
         ...clientOptions,
-        // Image attachments are re-validated server-side: only files inside the
-        // global upload store may reach the provider runtimes' file reads.
-        images: filterImagesToUploadStore(clientOptions.images),
-        sessionId: session.provider_session_id ?? undefined,
-        resume: Boolean(session.provider_session_id),
+        // Attachments are re-validated server-side: only direct children of the
+        // global upload store may reach provider runtimes or their file tools.
+        attachments: uniqueAttachments,
+        images: uniqueAttachments.filter(isImageAttachmentDescriptor),
+        files: uniqueAttachments.filter((descriptor) => !isImageAttachmentDescriptor(descriptor)),
+        sessionId,
         cwd: clientOptions.cwd ?? session.project_path ?? undefined,
         projectPath: session.project_path ?? clientOptions.projectPath,
     };
     try {
-        await spawnFn(command, runtimeOptions, run.writer);
+        await dependencies.runtime.run(provider, command, runtimeOptions, run.writer);
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
@@ -154,11 +177,7 @@ async function handleChatAbort(ws, data, dependencies) {
         sendProtocolError(ws, 'NO_ACTIVE_RUN', `Session "${sessionId}" has no active run.`, sessionId);
         return;
     }
-    const abortFn = dependencies.abortFns[run.provider];
-    let success = false;
-    if (abortFn && run.providerSessionId) {
-        success = Boolean(await abortFn(run.providerSessionId));
-    }
+    const success = await dependencies.runtime.abort(run.provider, sessionId);
     chatRunRegistry.completeRun(sessionId, {
         exitCode: success ? 0 : 1,
         aborted: true,
@@ -195,13 +214,9 @@ function handleChatSubscribe(ws, data, dependencies) {
         if (isProcessing) {
             chatRunRegistry.attachConnection(sessionId, ws);
         }
-        // Pending approvals are tracked under the provider-native id inside the
-        // Claude runtime; remap their sessionId so the client only sees app ids.
-        const pendingPermissions = (run?.providerSessionId
-            ? dependencies.getPendingApprovalsForSession(run.providerSessionId)
-            : []).map((approval) => approval && typeof approval === 'object'
-            ? { ...approval, sessionId }
-            : approval);
+        // Pending approvals are tracked under the app session id inside the
+        // Claude runtime, so they can be looked up directly.
+        const pendingPermissions = dependencies.runtime.getPendingApprovalsForSession(sessionId);
         sendJson(ws, {
             kind: 'chat_subscribed',
             sessionId,
@@ -230,7 +245,7 @@ function handlePermissionResponse(data, dependencies) {
     if (typeof data.requestId !== 'string' || data.requestId.length === 0) {
         return;
     }
-    dependencies.resolveToolApproval(data.requestId, {
+    dependencies.runtime.resolveToolApproval(data.requestId, {
         allow: Boolean(data.allow),
         updatedInput: data.updatedInput,
         message: typeof data.message === 'string' ? data.message : undefined,