@computesdk/loops 0.1.0 → 0.1.1

package/dist/server.mjs

@@ -1,10 +1,10 @@
 // server/index.ts
-import fs7 from "node:fs";
+import fs8 from "node:fs";
 import { randomBytes } from "node:crypto";
 import http from "node:http";
-import path7 from "node:path";
+import path8 from "node:path";
 import { fileURLToPath } from "node:url";
-import { execFile, execFileSync as execFileSync2, spawn as spawn5 } from "node:child_process";
+import { execFile, execFileSync as execFileSync2, spawn as spawn6 } from "node:child_process";
 
 // ../../node_modules/.pnpm/hono@4.13.14/node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
@@ -79,26 +79,26 @@ var throwNestingLimitExceeded = () => {
 };
 
 // ../../node_modules/.pnpm/hono@4.13.14/node_modules/hono/dist/utils/url.js
-var splitPath = (path8) => {
-  const paths = path8.split("/");
+var splitPath = (path9) => {
+  const paths = path9.split("/");
   if (paths[0] === "") paths.shift();
   return paths;
 };
 var splitRoutingPath = (routePath) => {
-  const { groups, path: path8 } = extractGroupsFromPath(routePath);
-  const paths = splitPath(path8);
+  const { groups, path: path9 } = extractGroupsFromPath(routePath);
+  const paths = splitPath(path9);
   return replaceGroupMarks(paths, groups);
 };
-var extractGroupsFromPath = (path8) => {
+var extractGroupsFromPath = (path9) => {
   const groups = [];
-  path8 = path8.replace(/\{[^}]+\}/g, (match2, index) => {
+  path9 = path9.replace(/\{[^}]+\}/g, (match2, index) => {
     const mark = `@${index}`;
     groups.push([mark, match2]);
     return mark;
   });
   return {
     groups,
-    path: path8
+    path: path9
   };
 };
 var replaceGroupMarks = (paths, groups) => {
@@ -161,8 +161,8 @@ var getPath = (request) => {
       const queryIndex = url.indexOf("?", i);
       const hashIndex = url.indexOf("#", i);
       const end = queryIndex === -1 ? hashIndex === -1 ? void 0 : hashIndex : hashIndex === -1 ? queryIndex : Math.min(queryIndex, hashIndex);
-      const path8 = url.slice(start, end);
-      return tryDecodeURI(path8.includes("%25") ? path8.replace(/%25/g, "%2525") : path8);
+      const path9 = url.slice(start, end);
+      return tryDecodeURI(path9.includes("%25") ? path9.replace(/%25/g, "%2525") : path9);
     } else if (charCode === 63 || charCode === 35) break;
   }
   return url.slice(start, i);
@@ -175,9 +175,9 @@ var mergePath = (base, sub, ...rest) => {
   if (rest.length) sub = mergePath(sub, ...rest);
   return `${base?.[0] === "/" ? "" : "/"}${base}${sub === "/" ? "" : `${base?.at(-1) === "/" ? "" : "/"}${sub?.[0] === "/" ? sub.slice(1) : sub}`}`;
 };
-var checkOptionalParameter = (path8) => {
-  if (path8.charCodeAt(path8.length - 1) !== 63 || !path8.includes(":")) return null;
-  const segments = path8.split("/");
+var checkOptionalParameter = (path9) => {
+  if (path9.charCodeAt(path9.length - 1) !== 63 || !path9.includes(":")) return null;
+  const segments = path9.split("/");
   const results = [];
   let basePath = "";
   segments.forEach((segment) => {
@@ -288,9 +288,9 @@ var HonoRequest = class {
   */
   path;
   bodyCache = {};
-  constructor(request, path8 = "/", matchResult = [[]]) {
+  constructor(request, path9 = "/", matchResult = [[]]) {
     this.raw = request;
-    this.path = path8;
+    this.path = path9;
     this.#matchResult = matchResult;
   }
   param(key) {
@@ -1020,8 +1020,8 @@ var Hono = class Hono2 {
         return this;
       };
     });
-    this.on = (method, path8, ...handlers) => {
-      for (const p of [path8].flat()) {
+    this.on = (method, path9, ...handlers) => {
+      for (const p of [path9].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
           const methodName = m.toUpperCase();
@@ -1075,8 +1075,8 @@ var Hono = class Hono2 {
   * app.route("/api", app2) // GET /api/user
   * ```
   */
-  route(path8, app2) {
-    const subApp = this.basePath(path8);
+  route(path9, app2) {
+    const subApp = this.basePath(path9);
     app2.routes.map((r) => {
       let handler;
       if (app2.errorHandler === errorHandler) handler = r.handler;
@@ -1101,9 +1101,9 @@ var Hono = class Hono2 {
   * const api = new Hono().basePath('/api')
   * ```
   */
-  basePath(path8) {
+  basePath(path9) {
     const subApp = this.#clone();
-    subApp._basePath = mergePath(this._basePath, path8);
+    subApp._basePath = mergePath(this._basePath, path9);
     return subApp;
   }
   /**
@@ -1179,7 +1179,7 @@ var Hono = class Hono2 {
   * })
   * ```
   */
-  mount(path8, applicationHandler, options) {
+  mount(path9, applicationHandler, options) {
     let replaceRequest;
     let optionHandler;
     if (options) {
@@ -1202,7 +1202,7 @@ var Hono = class Hono2 {
       return [c.env, executionContext];
     };
     replaceRequest ||= (() => {
-      const mergedPath = mergePath(this._basePath, path8);
+      const mergedPath = mergePath(this._basePath, path9);
       const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
       return (request) => {
         const url = new URL(request.url);
@@ -1215,18 +1215,18 @@ var Hono = class Hono2 {
       if (res) return res;
       await next();
     };
-    this.#addRoute("ALL", mergePath(path8, "*"), handler);
+    this.#addRoute("ALL", mergePath(path9, "*"), handler);
     return this;
   }
-  #addRoute(method, path8, handler, baseRoutePath) {
-    path8 = mergePath(this._basePath, path8);
+  #addRoute(method, path9, handler, baseRoutePath) {
+    path9 = mergePath(this._basePath, path9);
     const r = {
       basePath: baseRoutePath !== void 0 ? mergePath(this._basePath, baseRoutePath) : this._basePath,
-      path: path8,
+      path: path9,
       method,
       handler
     };
-    this.router.add(method, path8, [handler, r]);
+    this.router.add(method, path9, [handler, r]);
     this.routes.push(r);
   }
   #handleError(err, c) {
@@ -1235,10 +1235,10 @@ var Hono = class Hono2 {
   }
   #dispatch(request, executionCtx, env, method) {
     if (method === "HEAD") return (async () => new Response(null, await this.#dispatch(request, executionCtx, env, "GET")))();
-    const path8 = this.getPath(request, { env });
-    const matchResult = this.router.match(method, path8);
+    const path9 = this.getPath(request, { env });
+    const matchResult = this.router.match(method, path9);
     const c = new Context(request, {
-      path: path8,
+      path: path9,
       matchResult,
       env,
       executionCtx,
@@ -1326,19 +1326,19 @@ var createNullObject = () => /* @__PURE__ */ Object.create(null);
 
 // ../../node_modules/.pnpm/hono@4.13.14/node_modules/hono/dist/router/reg-exp-router/matcher.js
 var emptyParam = [];
-function match(method, path8) {
+function match(method, path9) {
   const matchers = this.buildAllMatchers();
-  const match2 = ((method2, path9) => {
+  const match2 = ((method2, path10) => {
     const matcher = matchers[method2] || matchers["ALL"];
-    const staticMatch = matcher[2][path9];
+    const staticMatch = matcher[2][path10];
     if (staticMatch) return staticMatch;
-    const match3 = path9.match(matcher[0]);
+    const match3 = path10.match(matcher[0]);
     if (!match3) return [[], emptyParam];
     const index = match3.indexOf("", 1);
     return [matcher[1][index], match3];
   });
   this.match = match2;
-  return match2(method, path8);
+  return match2(method, path9);
 }
 
 // ../../node_modules/.pnpm/hono@4.13.14/node_modules/hono/dist/router/reg-exp-router/node.js
@@ -1428,14 +1428,14 @@ var Trie = class {
   #root = new Node();
   #index = 0;
   paths = createNullObject();
-  insert(path8, isStatic) {
+  insert(path9, isStatic) {
     if (isStatic) {
-      this.#root.insert(path8.split(""), 0, [], this.#context, true);
+      this.#root.insert(path9.split(""), 0, [], this.#context, true);
       return;
     }
     const paramAssoc = [];
     const groups = [];
-    let markedPath = path8;
+    let markedPath = path9;
     for (let i = 0; ; ) {
       let replaced = false;
       markedPath = markedPath.replace(/\{[^}]+\}/g, (m) => {
@@ -1456,7 +1456,7 @@ var Trie = class {
       }
     }
     this.#root.insert(tokens, this.#index, paramAssoc, this.#context, false);
-    this.paths[path8] = [this.#index++, paramAssoc];
+    this.paths[path9] = [this.#index++, paramAssoc];
   }
   buildRegExp() {
     let regexp = this.#root.buildRegExpStr();
@@ -1489,11 +1489,11 @@ var Trie = class {
 
 // ../../node_modules/.pnpm/hono@4.13.14/node_modules/hono/dist/router/reg-exp-router/router.js
 var wildcardRegExpCache = createNullObject();
-function buildWildcardRegExp(path8) {
-  return wildcardRegExpCache[path8] ??= new RegExp(`^${path8.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g, (match2, metaChar) => metaChar ? `\\${metaChar}` : match2 === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match2 === "*" ? ".*" : `/:${LABEL_REG_EXP_STR}`)}$`);
+function buildWildcardRegExp(path9) {
+  return wildcardRegExpCache[path9] ??= new RegExp(`^${path9.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g, (match2, metaChar) => metaChar ? `\\${metaChar}` : match2 === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match2 === "*" ? ".*" : `/:${LABEL_REG_EXP_STR}`)}$`);
 }
-function findMiddleware(middleware, path8) {
-  for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) if (buildWildcardRegExp(k).test(path8)) return [...middleware[k]];
+function findMiddleware(middleware, path9) {
+  for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) if (buildWildcardRegExp(k).test(path9)) return [...middleware[k]];
 }
 var RegExpRouter = class {
   name = "RegExpRouter";
@@ -1505,14 +1505,14 @@ var RegExpRouter = class {
     this.#routes = { ["ALL"]: createNullObject() };
     this.#tries = { ["ALL"]: new Trie() };
   }
-  #insertPath(method, path8) {
+  #insertPath(method, path9) {
     try {
-      this.#tries[method].insert(path8, !/\*|\/:/.test(path8));
+      this.#tries[method].insert(path9, !/\*|\/:/.test(path9));
     } catch (e) {
-      throw e === PATH_ERROR ? new UnsupportedPathError(path8) : e;
+      throw e === PATH_ERROR ? new UnsupportedPathError(path9) : e;
     }
   }
-  add(method, path8, handler) {
+  add(method, path9, handler) {
     const middleware = this.#middleware;
     const routes = this.#routes;
     if (!middleware) throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
@@ -1526,24 +1526,24 @@ var RegExpRouter = class {
         }
       }
     }
-    if (path8 === "/*") path8 = "*";
+    if (path9 === "/*") path9 = "*";
     const methods = method === "ALL" ? Object.keys(middleware) : [method];
-    if (/\*$/.test(path8)) {
-      const re = buildWildcardRegExp(path8);
-      for (const m of methods) if (!middleware[m][path8]) {
-        this.#insertPath(m, path8);
-        middleware[m][path8] = findMiddleware(middleware[m], path8) || findMiddleware(middleware["ALL"], path8) || [];
+    if (/\*$/.test(path9)) {
+      const re = buildWildcardRegExp(path9);
+      for (const m of methods) if (!middleware[m][path9]) {
+        this.#insertPath(m, path9);
+        middleware[m][path9] = findMiddleware(middleware[m], path9) || findMiddleware(middleware["ALL"], path9) || [];
       }
-      for (const handlerMap of [middleware, routes]) for (const m of methods) for (const p in handlerMap[m]) re.test(p) && handlerMap[m][p].push([handler, path8]);
+      for (const handlerMap of [middleware, routes]) for (const m of methods) for (const p in handlerMap[m]) re.test(p) && handlerMap[m][p].push([handler, path9]);
       return;
     }
-    const paths = checkOptionalParameter(path8) || [path8];
-    for (const path9 of paths) for (const m of methods) {
-      if (!routes[m][path9]) {
-        this.#insertPath(m, path9);
-        routes[m][path9] = findMiddleware(middleware[m], path9) || findMiddleware(middleware["ALL"], path9) || [];
+    const paths = checkOptionalParameter(path9) || [path9];
+    for (const path10 of paths) for (const m of methods) {
+      if (!routes[m][path10]) {
+        this.#insertPath(m, path10);
+        routes[m][path10] = findMiddleware(middleware[m], path10) || findMiddleware(middleware["ALL"], path10) || [];
       }
-      routes[m][path9].push([handler, path9]);
+      routes[m][path10].push([handler, path10]);
     }
   }
   match = match;
@@ -1561,11 +1561,11 @@ var RegExpRouter = class {
     const staticMap = createNullObject();
     const handlerData = [];
     const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
-    for (const r of [middleware, routes]) for (const path8 in r) {
-      const handlers = r[path8];
-      const pathData = trie.paths[path8];
+    for (const r of [middleware, routes]) for (const path9 in r) {
+      const handlers = r[path9];
+      const pathData = trie.paths[path9];
       if (!pathData) {
-        staticMap[path8] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
+        staticMap[path9] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
         continue;
       }
       handlerData[pathData[0]] = handlers.map(([h, handlerPath]) => [h, trie.paths[handlerPath][1].reduceRight((map, [key], i) => {
@@ -1589,15 +1589,15 @@ var SmartRouter = class {
   constructor(init) {
     this.#routers = init.routers;
   }
-  add(method, path8, handler) {
+  add(method, path9, handler) {
     if (!this.#routes) throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
     this.#routes.push([
       method,
-      path8,
+      path9,
       handler
     ]);
   }
-  match(method, path8) {
+  match(method, path9) {
     if (!this.#routes) throw new Error("Fatal error");
     const routers = this.#routers;
     const routes = this.#routes;
@@ -1608,7 +1608,7 @@ var SmartRouter = class {
       const router = routers[i];
       try {
         for (let i2 = 0, len2 = routes.length; i2 < len2; i2++) router.add(...routes[i2]);
-        res = router.match(method, path8);
+        res = router.match(method, path9);
       } catch (e) {
         if (e instanceof UnsupportedPathError) continue;
         throw e;
@@ -1637,9 +1637,9 @@ var Node3 = class Node4 {
   #patterns = [];
   #pattern;
   #params = emptyParams;
-  insert(method, path8, handler) {
+  insert(method, path9, handler) {
     let curNode = this;
-    const parts = splitRoutingPath(path8);
+    const parts = splitRoutingPath(path9);
     const possibleKeys = /* @__PURE__ */ new Set();
     let i = 0;
     for (const p of parts) {
@@ -1675,11 +1675,11 @@ var Node3 = class Node4 {
       }
     }
   }
-  search(method, path8) {
+  search(method, path9) {
     const handlerSets = [];
     this.#params = emptyParams;
     let curNodes = [this];
-    const parts = splitPath(path8);
+    const parts = splitPath(path9);
     const curNodesQueue = [];
     const len = parts.length;
     let partOffsets = null;
@@ -1715,13 +1715,13 @@ var Node3 = class Node4 {
           if (matcher !== true) {
             if (!partOffsets) {
               partOffsets = [];
-              let offset = path8[0] === "/" ? 1 : 0;
+              let offset = path9[0] === "/" ? 1 : 0;
               for (let p = 0; p < len; p++) {
                 partOffsets[p] = offset;
                 offset += parts[p].length + 1;
               }
             }
-            const restPathString = path8.slice(partOffsets[i]);
+            const restPathString = path9.slice(partOffsets[i]);
             const m = matcher.exec(restPathString);
             if (m) {
               if (!Object.hasOwn(params, name)) params[name] = m[0];
@@ -1762,11 +1762,11 @@ var Node3 = class Node4 {
 var TrieRouter = class {
   name = "TrieRouter";
   #node = new Node3();
-  add(method, path8, handler) {
-    for (const result of checkOptionalParameter(path8) || [path8]) this.#node.insert(method, result, handler);
+  add(method, path9, handler) {
+    for (const result of checkOptionalParameter(path9) || [path9]) this.#node.insert(method, result, handler);
   }
-  match(method, path8) {
-    return this.#node.search(method, path8);
+  match(method, path9) {
+    return this.#node.search(method, path9);
   }
 };
 
@@ -3449,8 +3449,8 @@ import path3 from "node:path";
 import { spawn as spawn2 } from "node:child_process";
 var lives = /* @__PURE__ */ new Map();
 var IDLE_MS = 10 * 6e4;
-function serveCommand(cwd, agentDir2 = process.env.PI_AGENT_DIR ?? path3.join(process.env.HOME ?? "", ".pi", "agent")) {
-  for (const f of [path3.join(cwd, ".pi", "loops.json"), path3.join(agentDir2, "loops.json")]) {
+function serveCommand(cwd, agentDir3 = process.env.PI_AGENT_DIR ?? path3.join(process.env.HOME ?? "", ".pi", "agent")) {
+  for (const f of [path3.join(cwd, ".pi", "loops.json"), path3.join(agentDir3, "loops.json")]) {
     try {
       const j = JSON.parse(fs3.readFileSync(f, "utf8"));
       if (typeof j?.serve === "string" && j.serve.trim()) return j.serve.trim();
@@ -4085,11 +4085,101 @@ async function doctor(cwd) {
   return { checks, verdict: fatal ? "will-fail" : checks.every((c) => c.ok) ? "ready" : "incomplete" };
 }
 
-// server/workspaces.ts
+// ../pi-loops/lib/credentials.ts
 import fs6 from "node:fs";
+import os3 from "node:os";
 import path6 from "node:path";
+import { spawn as spawn5 } from "node:child_process";
+var PROVIDERS = [
+  { id: "particle", label: "Particle AI" },
+  { id: "morph", label: "Morph" },
+  { id: "openrouter", label: "OpenRouter" },
+  { id: "anthropic", label: "Anthropic" },
+  { id: "openai", label: "OpenAI" },
+  { id: "deepseek", label: "DeepSeek" }
+];
+var agentDir2 = () => process.env.PI_AGENT_DIR ?? path6.join(os3.homedir(), ".pi", "agent");
+var authFile = (dir = agentDir2()) => path6.join(dir, "auth.json");
+var envVar = (provider) => `${provider.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_API_KEY`;
+function credentialStatus(dir = agentDir2()) {
+  let auth = {};
+  try {
+    const raw2 = fs6.readFileSync(authFile(dir), "utf8");
+    auth = JSON.parse(raw2) ?? {};
+  } catch {
+  }
+  return PROVIDERS.map((p) => {
+    const env = envVar(p.id);
+    const entry = auth?.[p.id];
+    const inAuth = !!(entry && typeof entry === "object" && (entry.key || entry.type === "oauth"));
+    return { id: p.id, label: p.label, env, configured: inAuth || !!process.env[env], source: inAuth ? "auth" : process.env[env] ? "env" : "none" };
+  });
+}
+var chain = Promise.resolve();
+function queued(fn) {
+  const next = chain.then(fn, fn);
+  chain = next.catch(() => {
+  });
+  return next;
+}
+async function writeApiKey(provider, key, dir = agentDir2()) {
+  const trimmed = key.trim();
+  if (!trimmed) throw new Error("a key is required");
+  if (!PROVIDERS.some((p) => p.id === provider)) throw new Error(`unknown provider "${provider}"`);
+  return queued(async () => {
+    const file = authFile(dir);
+    let auth = {};
+    try {
+      const raw2 = fs6.readFileSync(file, "utf8");
+      const parsed = raw2.trim() ? JSON.parse(raw2) : {};
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) auth = parsed;
+    } catch {
+    }
+    auth[provider] = { ...auth[provider] && typeof auth[provider] === "object" ? auth[provider] : {}, type: "api_key", key: trimmed };
+    fs6.mkdirSync(dir, { recursive: true });
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs6.writeFileSync(tmp, JSON.stringify(auth, null, 2) + "\n", { mode: 384 });
+    fs6.renameSync(tmp, file);
+    try {
+      fs6.chmodSync(file, 384);
+    } catch {
+    }
+    return file;
+  });
+}
+async function verifyModel({ pi, model, cwd, timeoutMs = 6e4 }) {
+  const args = ["--print", "--no-session", "--model", model, "Reply with the single word: ok"];
+  return new Promise((resolve) => {
+    let out = "";
+    const child = spawn5(pi, args, { cwd, stdio: ["ignore", "pipe", "ignore"] });
+    const timer = setTimeout(() => {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+      resolve({ ok: false, detail: `no answer in ${Math.round(timeoutMs / 1e3)}s` });
+    }, timeoutMs);
+    child.stdout.on("data", (b) => {
+      out += String(b);
+    });
+    child.on("error", (e) => {
+      clearTimeout(timer);
+      resolve({ ok: false, detail: `could not run ${pi}: ${e.message}` });
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      const said = out.split("\n").map((l) => l.trim()).filter(Boolean).slice(-2).join(" \xB7 ").slice(-160);
+      if (code === 0 && /\bok\b/i.test(said)) return resolve({ ok: true, detail: `answered: ${said}` });
+      resolve({ ok: false, detail: `exit ${code ?? "?"}${said ? ` \u2014 ${said}` : ""}`.trim() });
+    });
+  });
+}
+
+// server/workspaces.ts
+import fs7 from "node:fs";
+import path7 from "node:path";
 import { execFileSync } from "node:child_process";
-var slug = (p) => path6.basename(p).replace(/[^a-z0-9._-]+/gi, "-").toLowerCase() || "repo";
+var slug = (p) => path7.basename(p).replace(/[^a-z0-9._-]+/gi, "-").toLowerCase() || "repo";
 var Workspaces = class {
   /** Where workspaces.json and the per-repo session dirs live. */
   root;
@@ -4099,15 +4189,15 @@ var Workspaces = class {
   chatMap;
   constructor({ root, cwd }) {
     this.root = root;
-    this.file = path6.join(root, "workspaces.json");
-    fs6.mkdirSync(root, { recursive: true });
+    this.file = path7.join(root, "workspaces.json");
+    fs7.mkdirSync(root, { recursive: true });
     let data = { workspaces: [], chats: {} };
-    if (fs6.existsSync(this.file)) {
+    if (fs7.existsSync(this.file)) {
       try {
-        data = JSON.parse(fs6.readFileSync(this.file, "utf8"));
+        data = JSON.parse(fs7.readFileSync(this.file, "utf8"));
       } catch {
         try {
-          fs6.renameSync(this.file, `${this.file}.corrupt-${Date.now()}`);
+          fs7.renameSync(this.file, `${this.file}.corrupt-${Date.now()}`);
         } catch {
         }
         console.error(`[workspaces] could not read ${this.file}; kept a copy and rebuilding from sessions`);
@@ -4124,8 +4214,8 @@ var Workspaces = class {
     this.data.chats = Object.fromEntries(this.chatMap);
     try {
       const tmp = `${this.file}.tmp`;
-      fs6.writeFileSync(tmp, JSON.stringify(this.data, null, 2) + "\n");
-      fs6.renameSync(tmp, this.file);
+      fs7.writeFileSync(tmp, JSON.stringify(this.data, null, 2) + "\n");
+      fs7.renameSync(tmp, this.file);
     } catch {
     }
   }
@@ -4140,18 +4230,18 @@ var Workspaces = class {
   }
   /** Add (or re-find) a repo. `persist: false` is used for the startup cwd. */
   add(dir, { persist = true } = {}) {
-    const abs = path6.resolve(dir);
+    const abs = path7.resolve(dir);
     const existing = [...this.byId.values()].find((w) => w.path === abs);
     if (existing) return existing;
-    if (!fs6.existsSync(abs) || !fs6.statSync(abs).isDirectory()) throw new Error(`${abs} is not a directory`);
-    const st = fs6.statSync(abs);
+    if (!fs7.existsSync(abs) || !fs7.statSync(abs).isDirectory()) throw new Error(`${abs} is not a directory`);
+    const st = fs7.statSync(abs);
     if (!st.isDirectory()) throw new Error(`${abs} is not a directory`);
     let id = slug(abs);
     for (let i = 2; this.byId.has(id); i++) id = `${slug(abs)}-${i}`;
-    const legacy = path6.join(abs, ".pi", "loops-ui", "sessions");
-    const sessionDir = fs6.existsSync(legacy) ? legacy : path6.join(this.root, "workspaces", id, "sessions");
-    const ws = { id, path: abs, sessionDir, title: path6.basename(abs) || abs };
-    fs6.mkdirSync(ws.sessionDir, { recursive: true });
+    const legacy = path7.join(abs, ".pi", "loops-ui", "sessions");
+    const sessionDir = fs7.existsSync(legacy) ? legacy : path7.join(this.root, "workspaces", id, "sessions");
+    const ws = { id, path: abs, sessionDir, title: path7.basename(abs) || abs };
+    fs7.mkdirSync(ws.sessionDir, { recursive: true });
     this.byId.set(id, ws);
     if (persist) {
       this.data.workspaces = [...this.data.workspaces.filter((w) => w.path !== abs), { id, path: abs }];
@@ -4175,25 +4265,25 @@ var Workspaces = class {
    * workspace. This runs on startup, so a lost or stale `workspaces.json` is a cache miss, not lost history.
    */
   recoverSessions() {
-    const root = path6.join(this.root, "workspaces");
+    const root = path7.join(this.root, "workspaces");
     let ids = [];
     try {
-      ids = fs6.readdirSync(root);
+      ids = fs7.readdirSync(root);
     } catch {
       return;
     }
     for (const id of ids) {
-      const dir = path6.join(root, id, "sessions");
+      const dir = path7.join(root, id, "sessions");
       let files = [];
       try {
-        files = fs6.readdirSync(dir).filter((f) => f.endsWith(".jsonl"));
+        files = fs7.readdirSync(dir).filter((f) => f.endsWith(".jsonl"));
       } catch {
         continue;
       }
       let cwd = null;
       for (const f of files) {
         try {
-          const head = JSON.parse(fs6.readFileSync(path6.join(dir, f), "utf8").split("\n")[0]);
+          const head = JSON.parse(fs7.readFileSync(path7.join(dir, f), "utf8").split("\n")[0]);
           if (typeof head?.cwd === "string" && head.cwd) {
             cwd = head.cwd;
             break;
@@ -4248,8 +4338,8 @@ var Workspaces = class {
 };
 
 // server/index.ts
-var HERE = path7.dirname(fileURLToPath(import.meta.url));
-var APP_ROOT = path7.resolve(HERE, "..");
+var HERE = path8.dirname(fileURLToPath(import.meta.url));
+var APP_ROOT = path8.resolve(HERE, "..");
 var arg = (name, fallback) => {
   const i = process.argv.indexOf(`--${name}`);
   return i >= 0 ? process.argv[i + 1] : process.env[`LOOPS_UI_${name.toUpperCase().replace(/-/g, "_")}`] ?? fallback;
@@ -4257,16 +4347,16 @@ var arg = (name, fallback) => {
 var PORT = Number(arg("port", "8001"));
 var HOST = arg("host", "127.0.0.1");
 var LOOPBACK = ["127.0.0.1", "localhost", "::1"].includes(HOST);
-var CWD = path7.resolve(arg("cwd", process.cwd()));
+var CWD = path8.resolve(arg("cwd", process.cwd()));
 var DEV = process.argv.includes("--dev") || process.env.NODE_ENV === "development";
 var VITE = arg("vite", "http://localhost:5173");
 var PI = arg("pi", "pi");
-var DATA = path7.resolve(arg("data", process.env.LOOPS_UI_DATA ?? path7.join(process.env.HOME ?? process.cwd(), ".pi", "loops-ui")));
+var DATA = path8.resolve(arg("data", process.env.LOOPS_UI_DATA ?? path8.join(process.env.HOME ?? process.cwd(), ".pi", "loops-ui")));
 var MODEL = arg("model", void 0) || null;
-var EXTENSIONS = (arg("extensions", path7.resolve(APP_ROOT, "../pi-loops/extensions/loop.ts")) ?? "").split(",").filter(Boolean);
+var EXTENSIONS = (arg("extensions", path8.resolve(APP_ROOT, "../pi-loops/extensions/loop.ts")) ?? "").split(",").filter(Boolean);
 function prerequisites() {
   const out = [];
-  const onPath = PI.includes("/") || /^[A-Za-z]:\\/.test(PI) ? fs7.existsSync(PI) : (() => {
+  const onPath = PI.includes("/") || /^[A-Za-z]:\\/.test(PI) ? fs8.existsSync(PI) : (() => {
     try {
       execFileSync2(process.platform === "win32" ? "where" : "which", [PI], { stdio: ["ignore", "pipe", "ignore"] });
       return true;
@@ -4276,18 +4366,18 @@ function prerequisites() {
   })();
   if (!onPath) out.push({ name: "pi", detail: `\`${PI}\` is not on PATH`, fix: "install Pi, or pass --pi <path to the pi binary>" });
   for (const e of EXTENSIONS) {
-    if (!fs7.existsSync(e)) out.push({ name: "extension", detail: `${e} does not exist`, fix: "pi install npm:@computesdk/pi-loops, or pass --extensions <path to extensions/loop.ts>" });
+    if (!fs8.existsSync(e)) out.push({ name: "extension", detail: `${e} does not exist`, fix: "pi install npm:@computesdk/pi-loops, or pass --extensions <path to extensions/loop.ts>" });
   }
   return out;
 }
 var PROBLEMS = prerequisites();
-fs7.mkdirSync(DATA, { recursive: true });
+fs8.mkdirSync(DATA, { recursive: true });
 var TOKEN = (() => {
   const explicit = arg("token", void 0);
-  const file = path7.join(DATA, "token");
+  const file = path8.join(DATA, "token");
   const stored = (() => {
     try {
-      return fs7.readFileSync(file, "utf8").trim() || null;
+      return fs8.readFileSync(file, "utf8").trim() || null;
     } catch {
       return null;
     }
@@ -4295,7 +4385,7 @@ var TOKEN = (() => {
   if (explicit) {
     if (!LOOPBACK) {
       try {
-        fs7.writeFileSync(file, explicit + "\n", { mode: 384 });
+        fs8.writeFileSync(file, explicit + "\n", { mode: 384 });
       } catch {
       }
     }
@@ -4304,7 +4394,7 @@ var TOKEN = (() => {
   if (stored) return stored;
   if (LOOPBACK) return null;
   const made = randomBytes(24).toString("base64url");
-  fs7.writeFileSync(file, made + "\n", { mode: 384 });
+  fs8.writeFileSync(file, made + "\n", { mode: 384 });
   return made;
 })();
 if (!LOOPBACK && !TOKEN) {
@@ -4324,7 +4414,7 @@ var manager = new ChatManager({
 });
 var wsOf = (chat) => chat ? workspaces.ofChat(chat) : workspaces.get();
 var wsOfRun = (run3) => {
-  const byIndex = workspaces.list().find((w) => fs7.existsSync(path7.join(w.path, STATE_DIR, `${run3}.json`)));
+  const byIndex = workspaces.list().find((w) => fs8.existsSync(path8.join(w.path, STATE_DIR, `${run3}.json`)));
   if (byIndex) return byIndex;
   const chat = manager.findRun(run3);
   return chat ? workspaces.ofChat(chat.id) : workspaces.get();
@@ -4352,7 +4442,7 @@ var watchOf = (wsId) => {
   if (!w) {
     const read = () => {
       try {
-        return JSON.parse(fs7.readFileSync(path7.join(ws.path, ".pi", "loops.json"), "utf8"));
+        return JSON.parse(fs8.readFileSync(path8.join(ws.path, ".pi", "loops.json"), "utf8"));
       } catch {
         return {};
       }
@@ -4360,7 +4450,7 @@ var watchOf = (wsId) => {
     w = { cwd: ws.path, accepted: read() };
     watches.set(ws.id, w);
     try {
-      fs7.watch(path7.join(ws.path, ".pi"), (_e, name) => {
+      fs8.watch(path8.join(ws.path, ".pi"), (_e, name) => {
         if (name && name !== "loops.json") return;
         clearTimeout(watchTimers.get(ws.id));
         watchTimers.set(ws.id, setTimeout(() => checkConfig(ws.id), 120));
@@ -4382,10 +4472,10 @@ function notifyProposals() {
 }
 function checkConfig(wsId) {
   const w = watchOf(wsId);
-  const CONFIG = path7.join(w.cwd, ".pi", "loops.json");
+  const CONFIG = path8.join(w.cwd, ".pi", "loops.json");
   const raw2 = (() => {
     try {
-      return fs7.readFileSync(CONFIG, "utf8");
+      return fs8.readFileSync(CONFIG, "utf8");
     } catch {
       return "";
     }
@@ -4406,16 +4496,29 @@ function checkConfig(wsId) {
   notifyProposals();
 }
 var inside = (root, p) => {
-  const abs = path7.resolve(root, p);
-  return abs === root || abs.startsWith(root + path7.sep) ? abs : null;
+  const abs = path8.resolve(root, p);
+  return abs === root || abs.startsWith(root + path8.sep) ? abs : null;
 };
 var stateOf = (run3) => manager.findRun(run3)?.stateFor(run3) ?? readState(wsOfRun(run3).path, run3);
 var app = new Hono3();
+var OWN_HOSTS = /* @__PURE__ */ new Set([`127.0.0.1:${PORT}`, `localhost:${PORT}`, `[::1]:${PORT}`]);
+var OWN_ORIGINS = new Set([...OWN_HOSTS].map((h) => `http://${h}`));
 var ALLOWED_ORIGINS = (arg("allow-origin", "") ?? "").split(",").map((o) => o.trim()).filter(Boolean);
-var originAllowed = (origin) => !ALLOWED_ORIGINS.length || ALLOWED_ORIGINS.includes(origin) || ALLOWED_ORIGINS.includes("*");
+var originAllowed = (origin) => {
+  if (ALLOWED_ORIGINS.includes("*")) return true;
+  if (ALLOWED_ORIGINS.length) return ALLOWED_ORIGINS.includes(origin);
+  return !LOOPBACK || OWN_ORIGINS.has(origin);
+};
 app.use("*", async (c, next) => {
+  const host = c.req.header("host") ?? "";
+  if (LOOPBACK && !OWN_HOSTS.has(host)) {
+    return c.text(`this server answers as ${[...OWN_HOSTS].join(", ")}, not "${host}"`, 403);
+  }
   const origin = c.req.header("origin");
-  if (origin && originAllowed(origin)) {
+  if (origin && !originAllowed(origin)) {
+    return c.json({ error: "origin not allowed", origin }, 403);
+  }
+  if (origin) {
     c.header("access-control-allow-origin", origin);
     c.header("access-control-allow-headers", "authorization, content-type, last-event-id");
     c.header("access-control-allow-methods", "GET, POST, OPTIONS");
@@ -4438,6 +4541,21 @@ app.use("/api/v1/*", async (c, next) => {
 });
 var api = new Hono3();
 api.get("/health", (c) => c.json({ ok: PROBLEMS.length === 0, problems: PROBLEMS, cwd: CWD, data: DATA, pi: PI, extensions: EXTENSIONS, workspaces: workspaces.list() }));
+api.get("/credentials", (c) => c.json({ dir: agentDir2(), providers: credentialStatus() }));
+api.post("/credentials", async (c) => {
+  const body = await c.req.json().catch(() => ({}));
+  const provider = String(body?.provider ?? "");
+  const key = String(body?.key ?? "").trim();
+  if (!PROVIDERS.some((p) => p.id === provider)) return c.json({ error: `unknown provider "${provider}" \u2014 one of ${PROVIDERS.map((p) => p.id).join(", ")}` }, 400);
+  if (!key) return c.json({ error: "a key is required" }, 400);
+  try {
+    const file = await writeApiKey(provider, key);
+    const verified = body?.model ? await verifyModel({ pi: PI, model: String(body.model), cwd: CWD }) : null;
+    return c.json({ ok: true, provider, file, configured: credentialStatus().find((s) => s.id === provider)?.configured ?? true, verified });
+  } catch (e) {
+    return c.json({ error: String(e.message ?? e).slice(0, 200) }, 400);
+  }
+});
 api.get("/chats", (c) => c.json(chatsOf(c.req.query("ws"))));
 api.get("/chats/:id/events", async (c) => {
   const id = c.req.param("id");
@@ -4480,9 +4598,9 @@ api.post("/chat/delete", async (c) => {
   const file = chat?.sessionFile ?? null;
   await manager.close(String(id));
   workspaces.unbindChat(String(id));
-  if (file && fs7.existsSync(file)) {
+  if (file && fs8.existsSync(file)) {
     try {
-      fs7.rmSync(file);
+      fs8.rmSync(file);
     } catch {
     }
   }
@@ -4492,9 +4610,9 @@ api.get("/workspaces", (c) => c.json(workspaces.list()));
 api.post("/workspaces", async (c) => {
   const body = await c.req.json().catch(() => ({}));
   try {
-    const dir = path7.resolve(String(body.path ?? "").replace(/^~(?=\/|$)/, process.env.HOME ?? "~"));
+    const dir = path8.resolve(String(body.path ?? "").replace(/^~(?=\/|$)/, process.env.HOME ?? "~"));
     if (!dir || dir === "/") throw new Error("a path is required");
-    if (!fs7.existsSync(dir) || !fs7.statSync(dir).isDirectory()) throw new Error(`${dir} is not a directory`);
+    if (!fs8.existsSync(dir) || !fs8.statSync(dir).isDirectory()) throw new Error(`${dir} is not a directory`);
     const ws = workspaces.add(dir);
     watchOf(ws.id);
     return c.json({ ok: true, workspace: ws, loopable: Workspaces.loopable(ws.path) });
@@ -4578,7 +4696,7 @@ api.get("/session", async (c) => {
   if (!run3 || !name) return c.json([]);
   const state = stateOf(run3);
   const file = state?.rounds?.flatMap((r) => r.attempts).find((a) => a.label === name)?.session ?? state?.rounds?.flatMap((r) => r.attempts).find((a) => a.label?.toLowerCase() === name.toLowerCase())?.session;
-  if (!file || !fs7.existsSync(file)) return c.json([]);
+  if (!file || !fs8.existsSync(file)) return c.json([]);
   const chat = await manager.open(c.req.query("chat") ?? manager.list()[0]?.id ?? "");
   return c.json(chat.sessionItems(file));
 });
@@ -4597,21 +4715,21 @@ api.get("/shot", (c) => {
   const repo = wsOfRun(run3).path;
   if (file.startsWith(STATE_DIR)) {
     const abs2 = inside(repo, file);
-    if (!abs2 || !fs7.existsSync(abs2)) return c.notFound();
-    return new Response(fs7.readFileSync(abs2), { headers: { "content-type": abs2.endsWith(".jpg") || abs2.endsWith(".jpeg") ? "image/jpeg" : "image/png", "cache-control": "no-cache" } });
+    if (!abs2 || !fs8.existsSync(abs2)) return c.notFound();
+    return new Response(fs8.readFileSync(abs2), { headers: { "content-type": abs2.endsWith(".jpg") || abs2.endsWith(".jpeg") ? "image/jpeg" : "image/png", "cache-control": "no-cache" } });
   }
   const dir = attempt === "CURRENT" ? state?.best?.dir ?? null : state?.rounds?.flatMap((r) => r.attempts).find((a) => a.label === attempt || a.label?.toLowerCase() === attempt.toLowerCase())?.dir;
   if (!dir) return c.notFound();
-  const abs = inside(repo, path7.join(dir, file));
-  if (!abs || !fs7.existsSync(abs)) return c.notFound();
-  return new Response(fs7.readFileSync(abs), { headers: { "content-type": abs.endsWith(".jpg") || abs.endsWith(".jpeg") ? "image/jpeg" : "image/png", "cache-control": "no-cache" } });
+  const abs = inside(repo, path8.join(dir, file));
+  if (!abs || !fs8.existsSync(abs)) return c.notFound();
+  return new Response(fs8.readFileSync(abs), { headers: { "content-type": abs.endsWith(".jpg") || abs.endsWith(".jpeg") ? "image/jpeg" : "image/png", "cache-control": "no-cache" } });
 });
 api.get("/sheet", (c) => {
   const file = c.req.query("f") ?? "";
-  const ws = workspaces.list().find((w) => fs7.existsSync(path7.join(w.path, file))) ?? workspaces.get();
+  const ws = workspaces.list().find((w) => fs8.existsSync(path8.join(w.path, file))) ?? workspaces.get();
   const abs = inside(ws.path, file);
-  if (!abs || !abs.includes(STATE_DIR) || !fs7.existsSync(abs)) return c.notFound();
-  return new Response(fs7.readFileSync(abs), { headers: { "content-type": "image/png", "cache-control": "no-cache" } });
+  if (!abs || !abs.includes(STATE_DIR) || !fs8.existsSync(abs)) return c.notFound();
+  return new Response(fs8.readFileSync(abs), { headers: { "content-type": "image/png", "cache-control": "no-cache" } });
 });
 api.get("/diff", async (c) => {
   const run3 = c.req.query("run") ?? "";
@@ -4675,7 +4793,7 @@ api.post("/config", async (c) => {
     writeSetting(ws.path, String(key), value);
     const w = watchOf(ws.id);
     try {
-      w.accepted = JSON.parse(fs7.readFileSync(path7.join(ws.path, ".pi", "loops.json"), "utf8"));
+      w.accepted = JSON.parse(fs8.readFileSync(path8.join(ws.path, ".pi", "loops.json"), "utf8"));
     } catch {
     }
     return c.json({ ok: true });
@@ -4722,7 +4840,7 @@ api.get("/meta", (c) => c.json({
 }));
 app.route("/api", api);
 app.route("/api/v1", api);
-var DIST = path7.join(APP_ROOT, "dist");
+var DIST = path8.join(APP_ROOT, "dist");
 app.get("*", async (c) => {
   const url = c.req.path;
   if (DEV) {
@@ -4731,14 +4849,14 @@ app.get("*", async (c) => {
     return new Response(res.body, { status: res.status, headers: { "content-type": res.headers.get("content-type") ?? "text/html" } });
   }
   const abs = inside(DIST, url === "/" ? "index.html" : url.replace(/^\//, ""));
-  if (abs && fs7.existsSync(abs) && fs7.statSync(abs).isFile()) {
-    const ext = path7.extname(abs);
+  if (abs && fs8.existsSync(abs) && fs8.statSync(abs).isFile()) {
+    const ext = path8.extname(abs);
     const type = ext === ".js" ? "text/javascript" : ext === ".css" ? "text/css" : ext === ".woff2" ? "font/woff2" : ext === ".svg" ? "image/svg+xml" : ext === ".png" ? "image/png" : "text/html";
-    return new Response(fs7.readFileSync(abs), { headers: { "content-type": type } });
+    return new Response(fs8.readFileSync(abs), { headers: { "content-type": type } });
   }
-  const index = path7.join(DIST, "index.html");
-  if (!fs7.existsSync(index)) return c.text("run `npm run build` first", 500);
-  return new Response(fs7.readFileSync(index), { headers: { "content-type": "text/html" } });
+  const index = path8.join(DIST, "index.html");
+  if (!fs8.existsSync(index)) return c.text("run `npm run build` first", 500);
+  return new Response(fs8.readFileSync(index), { headers: { "content-type": "text/html" } });
 });
 var server = http.createServer(getRequestListener(app.fetch));
 setInterval(() => {
@@ -4748,7 +4866,7 @@ function openBrowser(url) {
   if (process.argv.includes("--no-open") || process.env.LOOPS_UI_OPEN === "0") return;
   const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
   try {
-    const p = spawn5(cmd, args, { stdio: "ignore", detached: true });
+    const p = spawn6(cmd, args, { stdio: "ignore", detached: true });
     p.on("error", () => {
     });
     p.unref();