@dinoxx/dinox-cli 2.3.0 → 2.5.2

package/dist/gateway/deviceHost.js

@@ -0,0 +1,641 @@
+import os from 'node:os';
+import { credsAuthenticator, wsconnect, } from '@nats-io/nats-core';
+import { toAuthorizationHeaderValue } from '../utils/authToken.js';
+import { REMOTE_DEVICE_PRESENCE_INTERVAL_MS, REMOTE_DEVICE_PROTOCOL_NAME, REMOTE_DEVICE_PROTOCOL_VERSION, remoteDeviceSubject, remoteDiscoverSubject, remotePresenceSubject, remoteRunStreamSubject, } from '../vendor/electron/shared/remote-device-agent.js';
+import { projectPendingApprovals } from './assistantProjection.js';
+import { isAgentConfigQuery, isAgentFoldersQuery, isAgentSettingsQuery, isCancelRequest, isRunStatusRequest, readAgentSettingsUpdate, reconnectDelayMs, validateApprovalRequest, validateRunRequest, } from './protocol.js';
+import { GatewayRunExecutor, MAX_QUEUED_TURNS, QueueFullError } from './runExecutor.js';
+import { RunStreamPublisher } from './streamPublisher.js';
+import { findRun, readRecentSessionFolders, resolveTrustedResource, TERMINAL_RUN_STATUSES, threadExists, } from './threadStore.js';
+import { agentHomeFolder, ensureAgentHomeFolder, existingWorkspaceFolders, listWorkspaceFolders, resolveWorkspaceFolder, WorkspaceFolderError, } from './workspaceFolders.js';
+export const DEFAULT_NATS_CREDENTIALS_URL = 'https://aisdk.chatgo.pro/api/nats/credentials';
+const CREDENTIALS_TIMEOUT_MS = 10_000;
+const CREDENTIALS_REFRESH_LEAD_MS = 60_000;
+const ACK_CACHE_TTL_MS = 10 * 60 * 1000;
+const ACK_CACHE_MAX = 1000;
+const DRAIN_TIMEOUT_MS = 3_000;
+class CredentialsHttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+const encoder = new TextEncoder();
+function encode(value) {
+    return encoder.encode(JSON.stringify(value));
+}
+function decode(msg) {
+    try {
+        return { value: msg.json(), byteLength: msg.data.byteLength };
+    }
+    catch {
+        return { value: null, byteLength: msg.data.byteLength };
+    }
+}
+/**
+ * Hosts one gateway as a `dinox.remote-device.v2` device over NATS, the same
+ * contract Dinox desktop serves, so the app drives it with no client changes.
+ * Each gateway is its own device id (the credential service scopes a desktop
+ * credential to a single device subtree).
+ */
+export class GatewayDeviceHost {
+    deps;
+    executor;
+    connection = null;
+    subscriptions = [];
+    userNo = null;
+    state = 'idle';
+    connectedAt = null;
+    lastError = null;
+    generation = 0;
+    attempt = 0;
+    presenceSequence = 0;
+    presenceTimer = null;
+    refreshTimer = null;
+    reconnectTimer = null;
+    stopped = false;
+    retryBlocked = false;
+    ackCache = new Map();
+    /** Latest event per run while offline; the snapshot model makes older ones redundant. */
+    pendingEvents = new Map();
+    constructor(deps) {
+        this.deps = deps;
+        this.executor = new GatewayRunExecutor({
+            db: deps.db,
+            userId: deps.userId,
+            gateway: deps.gateway,
+            adapter: deps.adapter,
+            log: deps.log,
+            keepAwake: deps.keepAwake,
+        });
+    }
+    start() {
+        this.stopped = false;
+        void this.connect();
+    }
+    async stop() {
+        this.stopped = true;
+        this.executor.cancelAll();
+        await this.disconnect({ publishOffline: true });
+        await this.deps.adapter.dispose();
+        this.state = 'idle';
+    }
+    status() {
+        return {
+            gatewayId: this.deps.gateway.id,
+            name: this.deps.gateway.name,
+            deviceId: this.deps.gateway.deviceId,
+            kind: this.deps.gateway.kind,
+            state: this.state,
+            connectedAt: this.connectedAt,
+            lastError: this.lastError,
+            busyThreadIds: this.executor.busyThreadIds(),
+            agentName: this.deps.adapter.info().agentName,
+        };
+    }
+    // ---- connection lifecycle -------------------------------------------------
+    async connect() {
+        if (this.stopped || this.retryBlocked)
+            return;
+        const generation = ++this.generation;
+        this.state = this.attempt > 0 ? 'reconnecting' : 'connecting';
+        try {
+            const credentials = await this.fetchCredentials();
+            if (generation !== this.generation || this.stopped)
+                return;
+            const connection = await (this.deps.connect ?? wsconnect)({
+                servers: credentials.url,
+                authenticator: credsAuthenticator(encoder.encode(credentials.credentials)),
+                inboxPrefix: credentials.inboxPrefix,
+                name: `dinox-gateway-${this.deps.gateway.deviceId}`,
+                noEcho: true,
+                maxReconnectAttempts: -1,
+                reconnectDelayHandler: () => reconnectDelayMs(this.attempt++),
+                timeout: CREDENTIALS_TIMEOUT_MS,
+            });
+            if (generation !== this.generation || this.stopped) {
+                await connection.close();
+                return;
+            }
+            this.connection = connection;
+            this.userNo = credentials.userNo;
+            this.attempt = 0;
+            this.state = 'connected';
+            this.connectedAt = new Date().toISOString();
+            this.lastError = null;
+            this.subscribe(connection, credentials.userNo);
+            this.publishPresence('online');
+            this.flushPendingEvents();
+            this.presenceTimer = setInterval(() => this.publishPresence('online'), REMOTE_DEVICE_PRESENCE_INTERVAL_MS);
+            this.scheduleCredentialRefresh(credentials.expiresAt, generation);
+            void this.watchConnection(connection, generation);
+            this.deps.log('gateway device online', { gateway: this.deps.gateway.name, deviceId: this.deps.gateway.deviceId });
+        }
+        catch (error) {
+            if (generation !== this.generation)
+                return;
+            this.state = 'error';
+            this.lastError = error instanceof Error ? error.message : String(error);
+            if (error instanceof CredentialsHttpError && error.status !== 429 && error.status < 500) {
+                // Auth or request errors will not heal on retry; wait for a reload.
+                this.retryBlocked = true;
+                this.deps.log('gateway credentials rejected', { status: error.status, error: this.lastError });
+                return;
+            }
+            this.scheduleReconnect();
+        }
+    }
+    async watchConnection(connection, generation) {
+        const error = await connection.closed();
+        if (generation !== this.generation || this.stopped)
+            return;
+        this.lastError = error instanceof Error ? error.message : 'connection closed';
+        await this.disconnect({ publishOffline: false });
+        this.scheduleReconnect();
+    }
+    scheduleReconnect() {
+        if (this.stopped || this.reconnectTimer)
+            return;
+        this.state = 'reconnecting';
+        this.reconnectTimer = setTimeout(() => {
+            this.reconnectTimer = null;
+            void this.connect();
+        }, reconnectDelayMs(this.attempt++));
+    }
+    /** Short-lived credentials: reconnect with fresh ones before they expire (runs keep going). */
+    scheduleCredentialRefresh(expiresAt, generation) {
+        const expiresAtMs = Date.parse(expiresAt);
+        const delay = Number.isFinite(expiresAtMs) ? Math.max(1_000, expiresAtMs - Date.now() - CREDENTIALS_REFRESH_LEAD_MS) : 60_000;
+        this.refreshTimer = setTimeout(() => {
+            if (generation !== this.generation || this.stopped)
+                return;
+            void this.disconnect({ publishOffline: false }).then(() => this.connect());
+        }, delay);
+    }
+    async disconnect(options) {
+        this.generation += 1;
+        for (const timer of [this.presenceTimer, this.refreshTimer, this.reconnectTimer]) {
+            if (timer)
+                clearTimeout(timer);
+        }
+        this.presenceTimer = this.refreshTimer = this.reconnectTimer = null;
+        const connection = this.connection;
+        this.connection = null;
+        for (const subscription of this.subscriptions)
+            subscription.unsubscribe();
+        this.subscriptions = [];
+        if (!connection)
+            return;
+        if (options.publishOffline)
+            this.publishPresence('offline', connection);
+        await Promise.race([
+            connection.drain().catch(() => undefined),
+            new Promise((resolve) => setTimeout(resolve, DRAIN_TIMEOUT_MS)),
+        ]);
+        await connection.close().catch(() => undefined);
+    }
+    async fetchCredentials() {
+        const fetchImpl = this.deps.fetchImpl ?? fetch;
+        const response = await fetchImpl(this.deps.credentialsUrl ?? DEFAULT_NATS_CREDENTIALS_URL, {
+            method: 'POST',
+            headers: {
+                Authorization: toAuthorizationHeaderValue(this.deps.authorization),
+                'Content-Type': 'application/json',
+                Accept: 'application/json',
+            },
+            body: JSON.stringify({ deviceId: this.deps.gateway.deviceId, role: 'desktop' }),
+            signal: AbortSignal.timeout(CREDENTIALS_TIMEOUT_MS),
+        });
+        const envelope = (await response.json().catch(() => null));
+        if (!response.ok || envelope?.code !== '000000' || !envelope.data) {
+            throw new CredentialsHttpError(response.status, envelope?.msg ?? `credentials request failed (${response.status})`);
+        }
+        const data = envelope.data;
+        if (data.role !== 'desktop' || data.deviceId !== this.deps.gateway.deviceId) {
+            throw new Error('credentials do not match this gateway device');
+        }
+        if (data.userNo !== this.deps.userId.trim().toLowerCase()) {
+            throw new CredentialsHttpError(403, 'credentials belong to another account');
+        }
+        return data;
+    }
+    // ---- protocol ---------------------------------------------------------------
+    deviceInfo() {
+        const adapterInfo = this.deps.adapter.info();
+        const info = {
+            protocolVersion: REMOTE_DEVICE_PROTOCOL_VERSION,
+            protocol: REMOTE_DEVICE_PROTOCOL_NAME,
+            deviceId: this.deps.gateway.deviceId,
+            deviceName: `${this.deps.gateway.name} · ${os.hostname()}`.slice(0, 64),
+            platform: process.platform,
+            appVersion: this.deps.appVersion,
+            connectedAt: this.connectedAt ?? new Date().toISOString(),
+            busyThreadIds: this.executor.busyThreadIds(),
+            capabilities: {
+                threadRun: true,
+                cancel: true,
+                stream: 'assistant-snapshot',
+                toolApproval: 'desktop',
+                remoteToolApproval: { respond: true, decisions: ['approve_once', 'deny'], recovery: 'run-status' },
+            },
+        };
+        // Additive v2 extension: tells clients this device is an external agent
+        // (the agent owns context; Dinox model/tool settings do not apply).
+        info.capabilities.executor = {
+            kind: 'gateway',
+            gatewayId: this.deps.gateway.id,
+            runtime: this.deps.gateway.kind,
+            agentName: adapterInfo.agentName,
+            agentVersion: adapterInfo.agentVersion,
+            context: 'agent-session',
+            // Gateway extension: `agent.config.get` lists the agent's models and modes.
+            config: Boolean(this.deps.adapter.describeConfig),
+            // Gateway extension: a busy thread queues turns instead of refusing them;
+            // waiting turns run together as one, and cancelling a waiting turn withdraws it.
+            queue: { maxQueued: MAX_QUEUED_TURNS, merge: true },
+            // Gateway extension: `agent.settings.get/set` and `agent.folders.list`.
+            settings: Boolean(this.deps.updateSettings),
+            // Online but refusing new turns until resumed from the app.
+            paused: this.deps.gateway.paused === true,
+        };
+        return info;
+    }
+    subscribe(connection, userNo) {
+        const deviceId = this.deps.gateway.deviceId;
+        const route = (subject, handler) => {
+            const subscription = connection.subscribe(subject);
+            this.subscriptions.push(subscription);
+            void (async () => {
+                for await (const msg of subscription) {
+                    try {
+                        await handler(msg);
+                    }
+                    catch (error) {
+                        this.deps.log('gateway handler failed', { subject, error: String(error) });
+                    }
+                }
+            })();
+        };
+        route(remoteDiscoverSubject(userNo), (msg) => this.handleDiscover(msg));
+        route(remoteDeviceSubject(userNo, deviceId, 'info'), (msg) => this.handleInfo(msg));
+        route(remoteDeviceSubject(userNo, deviceId, 'request'), (msg) => this.handleRunRequest(msg));
+        route(remoteDeviceSubject(userNo, deviceId, 'cancel'), (msg) => this.handleCancel(msg));
+        route(remoteDeviceSubject(userNo, deviceId, 'approve'), (msg) => this.handleApprove(msg));
+        route(remoteDeviceSubject(userNo, deviceId, 'query'), (msg) => this.handleQuery(msg));
+    }
+    publishPresence(status, connection = this.connection) {
+        if (!connection || !this.userNo)
+            return;
+        this.presenceSequence += 1;
+        try {
+            connection.publish(remotePresenceSubject(this.userNo, this.deps.gateway.deviceId), encode({
+                protocolVersion: REMOTE_DEVICE_PROTOCOL_VERSION,
+                type: 'device.presence',
+                status,
+                sequence: this.presenceSequence,
+                emittedAt: new Date().toISOString(),
+                device: this.deviceInfo(),
+            }));
+        }
+        catch (error) {
+            this.deps.log('presence publish failed', { error: String(error) });
+        }
+    }
+    publishRunEvent(subject, event) {
+        if (!this.connection) {
+            this.pendingEvents.set(event.runId, { subject, event });
+            return;
+        }
+        try {
+            this.connection.publish(subject, encode(event));
+        }
+        catch {
+            this.pendingEvents.set(event.runId, { subject, event });
+        }
+    }
+    flushPendingEvents() {
+        const pending = [...this.pendingEvents.values()];
+        this.pendingEvents.clear();
+        for (const { subject, event } of pending)
+            this.publishRunEvent(subject, event);
+    }
+    handleDiscover(msg) {
+        const { value } = decode(msg);
+        const requestId = value?.requestId;
+        if (typeof requestId !== 'string' || !msg.reply)
+            return;
+        msg.respond(encode({ protocolVersion: REMOTE_DEVICE_PROTOCOL_VERSION, type: 'device.discovered', requestId, device: this.deviceInfo() }));
+    }
+    /** Only the gateway's own queries are served; desktop queries (skills, workspace) are not advertised. */
+    async handleQuery(msg) {
+        const { value, byteLength } = decode(msg);
+        if (!msg.reply)
+            return;
+        if (isAgentConfigQuery(value)) {
+            msg.respond(encode(await this.agentConfig(value)));
+            return;
+        }
+        if (isAgentSettingsQuery(value)) {
+            msg.respond(encode(this.settingsResult(value.requestId)));
+            return;
+        }
+        if (isAgentFoldersQuery(value)) {
+            msg.respond(encode(await this.listFolders(value)));
+            return;
+        }
+        const update = readAgentSettingsUpdate(value, byteLength);
+        if (update) {
+            const requestId = String(value.requestId);
+            msg.respond(encode('error' in update
+                ? this.settingsResult(requestId, { code: 'invalid_request', message: update.error })
+                : await this.changeSettings(update.update)));
+        }
+    }
+    settingsResult(requestId, error) {
+        const gateway = this.deps.gateway;
+        return {
+            protocolVersion: REMOTE_DEVICE_PROTOCOL_VERSION,
+            type: 'agent.settings.result',
+            requestId,
+            ok: !error,
+            settings: {
+                cwd: gateway.cwd ?? null,
+                approval: gateway.approval ?? 'ask',
+                paused: gateway.paused === true,
+                dinoxTools: gateway.dinoxTools !== false,
+            },
+            home: os.homedir(),
+            agentFolder: agentHomeFolder(gateway.name),
+            fetchedAt: new Date().toISOString(),
+            ...(error ? { error } : {}),
+        };
+    }
+    async changeSettings(update) {
+        const { updateSettings } = this.deps;
+        if (!updateSettings) {
+            return this.settingsResult(update.requestId, { code: 'failed', message: 'Settings cannot be changed here' });
+        }
+        const change = update.settings;
+        try {
+            const cwd = change.useAgentFolder
+                ? await ensureAgentHomeFolder(this.deps.gateway.name)
+                : change.cwd !== undefined
+                    ? await resolveWorkspaceFolder(change.cwd)
+                    : undefined;
+            await updateSettings({
+                ...(cwd !== undefined ? { cwd } : {}),
+                ...(change.approval !== undefined ? { approval: change.approval } : {}),
+                ...(change.paused !== undefined ? { paused: change.paused } : {}),
+                ...(change.dinoxTools !== undefined ? { dinoxTools: change.dinoxTools } : {}),
+            });
+        }
+        catch (error) {
+            return this.settingsResult(update.requestId, settingsError(error));
+        }
+        // Clients learn about a pause from presence too.
+        this.publishPresence('online');
+        return this.settingsResult(update.requestId);
+    }
+    async listFolders(query) {
+        const home = os.homedir();
+        const base = {
+            protocolVersion: REMOTE_DEVICE_PROTOCOL_VERSION,
+            type: 'agent.folders.result',
+            requestId: query.requestId,
+            home,
+            fetchedAt: new Date().toISOString(),
+        };
+        try {
+            const listing = await listWorkspaceFolders(query.path, home);
+            const suggestions = query.path
+                ? []
+                : await existingWorkspaceFolders([
+                    this.deps.gateway.cwd,
+                    ...(await readRecentSessionFolders(this.deps.db, this.deps.gateway.id).catch(() => [])),
+                    `${home}/Desktop`,
+                    `${home}/Documents`,
+                ], home);
+            return { ...base, ok: true, ...listing, suggestions };
+        }
+        catch (error) {
+            return {
+                ...base,
+                ok: false,
+                path: query.path ?? home,
+                parent: null,
+                folders: [],
+                truncated: false,
+                suggestions: [],
+                error: settingsError(error),
+            };
+        }
+    }
+    async agentConfig(value) {
+        const result = {
+            protocolVersion: REMOTE_DEVICE_PROTOCOL_VERSION,
+            type: 'agent.config.result',
+            requestId: value.requestId,
+            ok: false,
+            options: [],
+            fetchedAt: new Date().toISOString(),
+        };
+        const describe = this.deps.adapter.describeConfig?.bind(this.deps.adapter);
+        if (!describe) {
+            result.error = { code: 'unsupported', message: 'This agent has no session settings' };
+        }
+        else {
+            try {
+                result.options = await describe();
+                result.ok = true;
+            }
+            catch (error) {
+                result.error = { code: 'query_failed', message: error instanceof Error ? error.message : String(error) };
+            }
+        }
+        return result;
+    }
+    async handleInfo(msg) {
+        const { value } = decode(msg);
+        if (!msg.reply)
+            return;
+        if (isRunStatusRequest(value)) {
+            const run = await findRun(this.deps.db, { runId: value.runId, userId: this.deps.userId });
+            const found = Boolean(run && run.threadId === value.threadId);
+            msg.respond(encode({
+                protocolVersion: REMOTE_DEVICE_PROTOCOL_VERSION,
+                type: 'run.status.result',
+                requestId: value.requestId,
+                runId: value.runId,
+                threadId: value.threadId,
+                found,
+                ...(found && run
+                    ? {
+                        status: run.status,
+                        updatedAt: run.updatedAt ?? undefined,
+                        ...(run.assistant ? { assistant: { message: run.assistant } } : {}),
+                        pendingApprovals: run.status === 'waiting_approval'
+                            ? projectPendingApprovals(run.assistant, { runId: run.id, threadId: run.threadId })
+                            : [],
+                    }
+                    : {}),
+            }));
+            return;
+        }
+        const requestId = value?.requestId;
+        if (typeof requestId !== 'string')
+            return;
+        msg.respond(encode({ protocolVersion: REMOTE_DEVICE_PROTOCOL_VERSION, type: 'device.info.result', requestId, device: this.deviceInfo() }));
+    }
+    respondAck(msg, request, code, extra = {}) {
+        const ack = {
+            protocolVersion: REMOTE_DEVICE_PROTOCOL_VERSION,
+            type: 'run.ack',
+            requestId: request.requestId,
+            runId: request.runId,
+            threadId: request.threadId,
+            accepted: code === 'accepted',
+            code,
+            ...extra,
+        };
+        if (msg.reply)
+            msg.respond(encode(ack));
+        return ack;
+    }
+    cacheAck(ack) {
+        const now = Date.now();
+        for (const [key, entry] of this.ackCache) {
+            if (entry.expiresAt <= now || this.ackCache.size >= ACK_CACHE_MAX)
+                this.ackCache.delete(key);
+        }
+        this.ackCache.set(ack.requestId, { ack, expiresAt: now + ACK_CACHE_TTL_MS });
+    }
+    async handleRunRequest(msg) {
+        const { value, byteLength } = decode(msg);
+        const invalid = validateRunRequest(value, byteLength);
+        const raw = (value ?? {});
+        const ids = { requestId: String(raw.requestId ?? ''), runId: String(raw.runId ?? ''), threadId: String(raw.threadId ?? '') };
+        if (invalid) {
+            this.respondAck(msg, ids, 'invalid_request', { error: invalid });
+            return;
+        }
+        const request = value;
+        // Idempotent re-delivery: replay the ack, or recover it from the persisted run.
+        const cached = this.ackCache.get(request.requestId);
+        if (cached && cached.expiresAt > Date.now()) {
+            const sameRun = cached.ack.runId === request.runId && cached.ack.threadId === request.threadId;
+            if (msg.reply)
+                msg.respond(encode(sameRun ? cached.ack : { ...cached.ack, accepted: false, code: 'invalid_request' }));
+            return;
+        }
+        const existing = await findRun(this.deps.db, { runId: request.runId, userId: this.deps.userId });
+        if (existing) {
+            if (existing.requestId === request.requestId && existing.threadId === request.threadId) {
+                this.respondAck(msg, request, 'accepted', { status: existing.status });
+            }
+            else {
+                this.respondAck(msg, request, 'invalid_request', { error: 'runId already used by another request' });
+            }
+            return;
+        }
+        if (!this.deps.gateway.enabled || this.deps.gateway.paused) {
+            this.respondAck(msg, request, 'disabled', this.deps.gateway.paused ? { error: 'paused' } : {});
+            return;
+        }
+        if (!request.createThread && !(await threadExists(this.deps.db, request.threadId, this.deps.userId))) {
+            this.respondAck(msg, request, 'thread_not_found');
+            return;
+        }
+        for (const part of request.userMessage.parts) {
+            if (part.type !== 'file')
+                continue;
+            const resourceId = part.providerMetadata?.dinox?.resourceId;
+            const resource = resourceId
+                ? await resolveTrustedResource(this.deps.db, { resourceId, userId: this.deps.userId })
+                : null;
+            if (!resource) {
+                this.respondAck(msg, request, 'attachment_unavailable');
+                return;
+            }
+        }
+        const subject = remoteRunStreamSubject(this.userNo ?? this.deps.userId, request.threadId, request.runId);
+        const publisher = new RunStreamPublisher(request, (event) => this.publishRunEvent(subject, event));
+        try {
+            const { threadCreated, queued } = await this.executor.accept(request, (snapshot) => {
+                publisher.push(snapshot);
+                if (TERMINAL_RUN_STATUSES.has(snapshot.status)) {
+                    publisher.dispose();
+                    this.publishPresence('online');
+                }
+            });
+            const ack = this.respondAck(msg, request, 'accepted', {
+                status: 'queued',
+                // Gateway extension: the turn waits behind the thread's active one.
+                ...(queued ? { waiting: true } : {}),
+                ...(request.createThread
+                    ? { threadDisposition: threadCreated ? 'created_desktop_local' : 'already_present_desktop_local' }
+                    : {}),
+            });
+            this.cacheAck(ack);
+            this.publishPresence('online');
+        }
+        catch (error) {
+            publisher.dispose();
+            if (error instanceof QueueFullError) {
+                this.respondAck(msg, request, 'busy', { error: error.message });
+                return;
+            }
+            this.respondAck(msg, request, 'enqueue_failed', { error: error instanceof Error ? error.message : String(error) });
+        }
+    }
+    handleCancel(msg) {
+        const { value } = decode(msg);
+        if (!isCancelRequest(value))
+            return;
+        const cancelled = this.executor.cancel(value.runId, value.threadId);
+        msg.respond(encode({
+            protocolVersion: REMOTE_DEVICE_PROTOCOL_VERSION,
+            type: 'run.cancel.ack',
+            requestId: value.requestId,
+            runId: value.runId,
+            threadId: value.threadId,
+            cancelled,
+            ...(cancelled ? {} : { error: 'run is not active on this gateway' }),
+        }));
+    }
+    async handleApprove(msg) {
+        const { value, byteLength } = decode(msg);
+        const invalid = validateApprovalRequest(value, byteLength);
+        const raw = (value ?? {});
+        const base = {
+            protocolVersion: REMOTE_DEVICE_PROTOCOL_VERSION,
+            type: 'tool.approval.ack',
+            requestId: String(raw.requestId ?? ''),
+            runId: String(raw.runId ?? ''),
+            threadId: String(raw.threadId ?? ''),
+            approvalId: String(raw.approvalId ?? ''),
+        };
+        if (invalid) {
+            msg.respond(encode({ ...base, accepted: false, code: 'invalid_request', error: invalid }));
+            return;
+        }
+        const code = this.executor.respondApproval({
+            runId: base.runId,
+            threadId: base.threadId,
+            approvalId: base.approvalId,
+            approved: raw.approved === true,
+        });
+        const run = await findRun(this.deps.db, { runId: base.runId, userId: this.deps.userId });
+        msg.respond(encode({
+            ...base,
+            accepted: code === 'applied' || code === 'already_applied',
+            code,
+            ...(run ? { status: run.status, pendingApprovals: projectPendingApprovals(run.assistant, base) } : {}),
+        }));
+    }
+}
+function settingsError(error) {
+    if (error instanceof WorkspaceFolderError)
+        return { code: error.code, message: error.message };
+    return { code: 'failed', message: error instanceof Error ? error.message : String(error) };
+}

package/dist/gateway/keepAwake.d.ts

@@ -0,0 +1,24 @@
+import { type ChildProcess } from 'node:child_process';
+type Logger = (message: string, details?: Record<string, unknown>) => void;
+export type KeepAwakeSpawn = (command: string, args: string[]) => ChildProcess;
+/**
+ * Keeps the computer from idle-sleeping while any agent turn runs, so a task
+ * started from the phone is not cut off when the screen locks. macOS only
+ * (`caffeinate -i`, released as soon as the last turn ends); elsewhere a no-op.
+ * It cannot stop sleep from closing a laptop lid on battery.
+ */
+export declare class KeepAwake {
+    private readonly log;
+    private readonly platform;
+    private readonly spawnProcess;
+    private holders;
+    private child;
+    constructor(log?: Logger, platform?: NodeJS.Platform, spawnProcess?: KeepAwakeSpawn);
+    /** Holds the computer awake until the returned release is called (idempotent). */
+    acquire(): () => void;
+    /** Releases everything, e.g. when the daemon stops. */
+    dispose(): void;
+    private start;
+    private stop;
+}
+export {};