@dmrlzz/davecode 0.3.0 → 0.5.0

package/dist/{chunk-PIIJ3RSI.js → chunk-FYPMA55O.js}

@@ -18,1380 +18,1382 @@ import {
   newId2,
   routeSchema,
   taskIdSchema
-} from "./chunk-C7FDRA3U.js";
+} from "./chunk-HSBJDV3O.js";
 
-// src/sse.ts
-var SSEParser = class {
-  buffer = "";
-  pendingCR = false;
-  data = [];
-  event = "";
-  lastId;
-  retry;
-  /** Feed decoded text; returns the messages completed by it. */
-  push(chunk) {
-    const out = [];
-    let text = chunk;
-    if (this.pendingCR && text.startsWith("\n")) text = text.slice(1);
-    this.pendingCR = false;
-    this.buffer += text;
-    let start = 0;
-    for (let i = 0; i < this.buffer.length; i++) {
-      const ch = this.buffer[i];
-      if (ch !== "\n" && ch !== "\r") continue;
-      const line = this.buffer.slice(start, i);
-      if (ch === "\r") {
-        if (i + 1 < this.buffer.length) {
-          if (this.buffer[i + 1] === "\n") i++;
-        } else {
-          this.pendingCR = true;
-        }
-      }
-      this.processLine(line, out);
-      start = i + 1;
-    }
-    this.buffer = this.buffer.slice(start);
-    return out;
-  }
-  /** End of stream. An unterminated final event is discarded, as the spec requires. */
-  end() {
-    this.buffer = "";
-    this.data = [];
-    this.event = "";
-    return [];
+// src/runtime.ts
+import { existsSync as existsSync3 } from "fs";
+import { access } from "fs/promises";
+import { createRequire } from "module";
+import { dirname, join, resolve as resolve2 } from "path";
+import { fileURLToPath } from "url";
+
+// ../server/dist/index.js
+import { timingSafeEqual } from "crypto";
+import { existsSync } from "fs";
+import { resolve } from "path";
+import cors from "@fastify/cors";
+import fastifyStatic from "@fastify/static";
+import Fastify from "fastify";
+import { z as z4 } from "zod";
+import { z } from "zod";
+import { z as z2 } from "zod";
+import { z as z3 } from "zod";
+import { z as z5 } from "zod";
+import { Readable } from "stream";
+import { z as z6 } from "zod";
+function sendApiError(reply, status, code, message, extra = {}) {
+  return reply.code(status).send({ error: { message, code, ...extra } });
+}
+function sendOpenAIError(reply, status, body) {
+  return reply.code(status).send({ error: body });
+}
+function openAIType(status) {
+  if (status === 401) return "authentication_error";
+  if (status === 404 || status === 400 || status === 422) return "invalid_request_error";
+  if (status === 429) return "rate_limit_error";
+  return "api_error";
+}
+function describeRoutingError(err) {
+  if (err instanceof RouterError) {
+    return {
+      status: err.status,
+      body: { message: err.message, type: openAIType(err.status), code: err.code }
+    };
   }
-  processLine(line, out) {
-    if (line === "") {
-      this.dispatch(out);
-      return;
-    }
-    if (line.startsWith(":")) return;
-    const colon = line.indexOf(":");
-    const field = colon === -1 ? line : line.slice(0, colon);
-    let value = colon === -1 ? "" : line.slice(colon + 1);
-    if (value.startsWith(" ")) value = value.slice(1);
-    switch (field) {
-      case "data":
-        this.data.push(value);
+  if (err instanceof ProviderError) {
+    let status;
+    let code = err.kind;
+    switch (err.kind) {
+      case "bad_request":
+        status = 400;
         break;
-      case "event":
-        this.event = value;
+      case "context_length":
+        status = 400;
+        code = "context_length_exceeded";
         break;
-      case "id":
-        if (!value.includes("\0")) this.lastId = value;
+      case "rate_limit":
+      case "quota_exhausted":
+        status = 429;
         break;
-      case "retry":
-        if (/^\d+$/.test(value)) this.retry = Number(value);
+      case "auth":
+        status = 502;
+        code = "upstream_auth_error";
         break;
       default:
-        break;
-    }
-  }
-  dispatch(out) {
-    if (this.data.length === 0) {
-      this.event = "";
-      return;
+        status = 502;
     }
-    const message = { event: this.event || "message", data: this.data.join("\n") };
-    if (this.lastId !== void 0) message.id = this.lastId;
-    if (this.retry !== void 0) message.retry = this.retry;
-    out.push(message);
-    this.data = [];
-    this.event = "";
-  }
-};
-async function* readSSE(body) {
-  const parser = new SSEParser();
-  const decoder = new TextDecoder();
-  for await (const chunk of body) {
-    const text = typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
-    yield* parser.push(text);
+    return { status, body: { message: err.message, type: openAIType(status), code } };
   }
-  const tail = decoder.decode();
-  if (tail) yield* parser.push(tail);
-  yield* parser.end();
+  return {
+    status: 500,
+    body: { message: "Internal gateway error", type: "api_error", code: "internal_error" }
+  };
 }
-var ChatStreamError = class extends Error {
-  code;
-  constructor(message, code) {
-    super(message);
-    this.name = "ChatStreamError";
-    this.code = code ?? void 0;
-  }
+var providerKind = z.enum(PROVIDER_KINDS);
+var contentPart = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("text"), text: z.string() }),
+  z.object({
+    type: z.literal("image_url"),
+    image_url: z.object({
+      url: z.string(),
+      detail: z.enum(["auto", "low", "high"]).optional()
+    })
+  })
+]);
+var toolCall = z.object({
+  id: z.string(),
+  type: z.literal("function"),
+  function: z.object({ name: z.string(), arguments: z.string() })
+});
+var chatMessage = z.object({
+  role: z.enum(["system", "user", "assistant", "tool"]),
+  content: z.union([z.string(), z.array(contentPart), z.null()]),
+  name: z.string().optional(),
+  tool_call_id: z.string().optional(),
+  tool_calls: z.array(toolCall).optional()
+});
+var chatRequestSchema = z.object({
+  model: z.string().min(1),
+  messages: z.array(chatMessage).min(1),
+  stream: z.boolean().optional(),
+  temperature: z.number().min(0).max(2).optional(),
+  top_p: z.number().min(0).max(1).optional(),
+  max_tokens: z.number().int().positive().optional(),
+  stop: z.union([z.string(), z.array(z.string())]).optional(),
+  tools: z.array(
+    z.object({
+      type: z.literal("function"),
+      function: z.object({
+        name: z.string(),
+        description: z.string().optional(),
+        parameters: z.record(z.string(), z.unknown()).optional()
+      })
+    })
+  ).optional(),
+  tool_choice: z.union([
+    z.enum(["auto", "none", "required"]),
+    z.object({ type: z.literal("function"), function: z.object({ name: z.string() }) })
+  ]).optional(),
+  user: z.string().optional()
+});
+var positiveInt = z.number().int().positive();
+var quotaLimits = z.object({
+  tpm: positiveInt.optional(),
+  rpm: positiveInt.optional(),
+  tokens5h: positiveInt.optional(),
+  requests5h: positiveInt.optional(),
+  tokensDaily: positiveInt.optional(),
+  requestsDaily: positiveInt.optional()
+}).strict();
+var SECRET_KEY = /^(api[-_]?key|secret|client[-_]?secret|(access|refresh|session|auth|bearer)?[-_]?token|password|passwd|cookies?|authorization|credentials?)$/i;
+var accountConfig = z.record(z.string(), z.unknown()).refine((config) => !Object.keys(config).some((key) => SECRET_KEY.test(key)), {
+  message: 'config must not contain credentials; send them in "secret" instead'
+});
+var subscriptionDate = z.string().trim().refine(
+  (value) => /^\d{4}-\d{2}-\d{2}(T[\d:.]+(Z|[+-]\d{2}:?\d{2})?)?$/.test(value) && !Number.isNaN(Date.parse(value)),
+  { message: "expected a date (YYYY-MM-DD) or an ISO timestamp" }
+);
+var subscriptionSchema = z.object({
+  plan: z.string().trim().min(1).max(120).optional(),
+  paidAt: subscriptionDate.optional(),
+  renewsAt: subscriptionDate.optional(),
+  price: z.object({
+    amount: z.number().min(0).max(1e6),
+    currency: z.string().trim().regex(/^[A-Za-z]{3}$/, "expected a 3-letter currency code").transform((c) => c.toUpperCase()),
+    period: z.enum(["month", "year"])
+  }).strict().optional(),
+  notes: z.string().trim().max(1e3).optional()
+}).strict();
+var accountFields = {
+  label: z.string().trim().min(1).max(200),
+  enabled: z.boolean().optional(),
+  priority: z.number().int().min(0).max(1e6).optional(),
+  weight: z.number().min(0).max(1e3).optional(),
+  limits: quotaLimits.optional(),
+  config: accountConfig.optional(),
+  /** API key / token. Encrypted at rest and never returned. */
+  secret: z.string().min(1).max(1e5).optional()
 };
-async function* chatChunks(messages) {
-  for await (const message of messages) {
-    if (message.data === "[DONE]") return;
-    let parsed;
-    try {
-      parsed = JSON.parse(message.data);
-    } catch {
-      continue;
+var accountCreateSchema = z.object({ provider: providerKind, ...accountFields, subscription: subscriptionSchema.optional() }).strict();
+var accountPatchSchema = z.object({
+  ...accountFields,
+  label: accountFields.label.optional(),
+  subscription: subscriptionSchema.nullable().optional()
+}).strict();
+var routesUpdateSchema = z.object({ routes: z.array(routeSchema).max(200), defaultRoute: z.string().min(1).optional() }).strict().superRefine((body, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  body.routes.forEach((route, index) => {
+    if (seen.has(route.name)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["routes", index, "name"],
+        message: `duplicate route name "${route.name}"`
+      });
     }
-    if (!parsed || typeof parsed !== "object") continue;
-    const record = parsed;
-    if (record.error && !record.choices) {
-      throw new ChatStreamError(record.error.message ?? "Upstream error", record.error.code);
-    }
-    if (Array.isArray(record.choices)) yield parsed;
+    seen.add(route.name);
+  });
+  if (body.defaultRoute !== void 0 && !seen.has(body.defaultRoute)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["defaultRoute"],
+      message: `defaultRoute "${body.defaultRoute}" is not one of the routes`
+    });
   }
-}
-async function* daveEvents(messages) {
-  for await (const message of messages) {
+});
+var taskText = {
+  title: z.string().trim().min(1).max(300),
+  description: z.string().max(5e4),
+  acceptance: z.array(z.string().trim().min(1).max(2e3)).max(100),
+  notes: z.string().max(5e4),
+  dependsOn: z.array(z.string().min(1)).max(500),
+  priority: z.number().finite()
+};
+var taskCreateSchema = z.object({
+  id: taskIdSchema,
+  title: taskText.title,
+  description: taskText.description.optional(),
+  dependsOn: taskText.dependsOn.optional(),
+  priority: taskText.priority.optional(),
+  acceptance: taskText.acceptance.optional()
+}).strict();
+var taskPatchSchema = z.object({
+  title: taskText.title.optional(),
+  description: taskText.description.nullable().optional(),
+  dependsOn: taskText.dependsOn.optional(),
+  priority: taskText.priority.nullable().optional(),
+  acceptance: taskText.acceptance.nullable().optional(),
+  notes: taskText.notes.nullable().optional(),
+  status: z.enum(TASK_STATUSES).optional()
+}).strict().refine((patch) => Object.values(patch).some((v) => v !== void 0), {
+  message: "send at least one field to change"
+});
+var runnerStartSchema = z.object({ taskId: z.string().min(1).optional() }).strict();
+var goalStartSchema = z.object({
+  objective: z.string().trim().min(1).max(4e3),
+  maxRounds: z.number().int().min(1).max(20).optional(),
+  maxTasks: z.number().int().min(1).max(100).optional(),
+  maxTokens: z.number().int().min(1e3).optional(),
+  dryRun: z.boolean().optional()
+}).strict();
+var timeseriesQuerySchema = z.object({
+  minutes: z.coerce.number().int().min(1).max(7 * 24 * 60).default(60),
+  bucketSec: z.coerce.number().int().min(1).max(86400).default(60)
+});
+var limitQuerySchema = (fallback, max = 1e3) => z.object({ limit: z.coerce.number().int().min(1).max(max).default(fallback) });
+function registerGoalRoutes(app, engine, options) {
+  const { audit } = engine;
+  const unavailable = (reply) => sendApiError(
+    reply,
+    501,
+    "goals_unavailable",
+    "Goal mode is not available; start the gateway inside a project (davecode init)"
+  );
+  const guarded = async (reply, run) => {
     try {
-      const event = JSON.parse(message.data);
-      if (event && typeof event.type === "string") yield event;
-    } catch {
+      return { ok: true, value: await run() };
+    } catch (error) {
+      const { statusCode, code } = error;
+      if (typeof statusCode === "number" && statusCode < 500 && typeof code === "string") {
+        return {
+          ok: false,
+          reply: sendApiError(reply, statusCode, code, error.message)
+        };
+      }
+      throw error;
     }
-  }
+  };
+  const control = (reply) => {
+    if (!options.goals) unavailable(reply);
+    return options.goals;
+  };
+  app.get("/api/goals", async (_request, reply) => {
+    const goals = control(reply);
+    if (!goals) return reply;
+    return { goals: await goals.list() };
+  });
+  app.get("/api/goals/:id", async (request, reply) => {
+    const goals = control(reply);
+    if (!goals) return reply;
+    const goal = await goals.get(request.params.id);
+    if (!goal) return sendApiError(reply, 404, "not_found", `unknown goal "${request.params.id}"`);
+    return { goal };
+  });
+  app.post("/api/goals", async (request, reply) => {
+    const parsed = goalStartSchema.safeParse(request.body);
+    if (!parsed.success) {
+      return sendApiError(reply, 400, "invalid_body", z2.prettifyError(parsed.error));
+    }
+    const goals = control(reply);
+    if (!goals) return reply;
+    const input = parsed.data;
+    const result = await guarded(reply, () => goals.start(input));
+    if (!result.ok) return result.reply;
+    audit.record({
+      actor: "api",
+      action: "goal.start",
+      target: result.value.id,
+      details: { dryRun: input.dryRun === true }
+    });
+    return reply.code(202).send({ goal: result.value });
+  });
+  app.post("/api/goals/:id/execute", async (request, reply) => {
+    const goals = control(reply);
+    if (!goals) return reply;
+    if (!goals.execute) return unavailable(reply);
+    const execute = goals.execute.bind(goals);
+    const result = await guarded(reply, () => execute(request.params.id));
+    if (!result.ok) return result.reply;
+    audit.record({ actor: "api", action: "goal.execute", target: request.params.id });
+    return reply.code(202).send({ goal: result.value });
+  });
+  app.get(
+    "/api/goals/:id/artifacts/:taskId",
+    async (request, reply) => {
+      const goals = control(reply);
+      if (!goals) return reply;
+      if (!goals.readArtifact) return unavailable(reply);
+      const readArtifact = goals.readArtifact.bind(goals);
+      const result = await guarded(
+        reply,
+        () => readArtifact(request.params.id, request.params.taskId)
+      );
+      if (!result.ok) return result.reply;
+      return { artifact: result.value };
+    }
+  );
+  app.post("/api/goals/:id/cancel", async (request, reply) => {
+    const goals = control(reply);
+    if (!goals) return reply;
+    const result = await guarded(reply, () => goals.cancel(request.params.id));
+    if (!result.ok) return result.reply;
+    audit.record({ actor: "api", action: "goal.cancel", target: request.params.id });
+    return { goal: result.value };
+  });
 }
-
-// src/client.ts
-var GatewayError = class extends Error {
-  status;
-  code;
-  constructor(status, code, message) {
-    super(message);
-    this.name = "GatewayError";
-    this.status = status;
-    this.code = code;
+function describeIssue(issue) {
+  switch (issue.code) {
+    case "unknown_task":
+      return { status: 404, code: "not_found", extra: {} };
+    case "duplicate_id":
+    case "invalid_transition":
+    case "task_in_progress":
+      return { status: 409, code: issue.code, extra: {} };
+    case "has_dependents":
+      return { status: 409, code: "has_dependents", extra: { dependents: issue.dependents ?? [] } };
+    case "cycle":
+      return { status: 400, code: "cycle", extra: { cycle: issue.cycle ?? [] } };
+    case "unknown_dependency":
+    case "self_dependency":
+      return { status: 400, code: issue.code, extra: {} };
+    default:
+      return { status: 409, code: "invalid_graph", extra: {} };
   }
-};
-var WILDCARD_HOSTS = /* @__PURE__ */ new Set(["0.0.0.0", "::", "[::]", ""]);
-function connectHost(host) {
-  if (WILDCARD_HOSTS.has(host)) return "127.0.0.1";
-  if (host.includes(":") && !host.startsWith("[")) return `[${host}]`;
-  return host;
-}
-function targetFor(config, port = config.server.port) {
-  const target = { baseUrl: `http://${connectHost(config.server.host)}:${port}` };
-  if (config.server.authToken) target.token = config.server.authToken;
-  return target;
 }
-async function errorFrom(res) {
-  let code = `http_${res.status}`;
-  let message = `${res.status} ${res.statusText}`.trim();
-  try {
-    const body = await res.json();
-    if (body.error?.message) message = body.error.message;
-    if (body.error?.code) code = body.error.code;
-  } catch {
-  }
-  return new GatewayError(res.status, code, message);
+function sendGraphError(reply, error) {
+  const issue = error.issues.find((i) => i.code === "cycle") ?? error.issues[0];
+  if (!issue) return sendApiError(reply, 400, "invalid_graph", error.message);
+  const { status, code, extra } = describeIssue(issue);
+  return sendApiError(reply, status, code, issue.message, extra);
 }
-var GatewayClient = class {
-  baseUrl;
-  token;
-  fetchImpl;
-  constructor(target, fetchImpl = fetch) {
-    this.baseUrl = target.baseUrl.replace(/\/+$/, "");
-    this.token = target.token;
-    this.fetchImpl = fetchImpl;
-  }
-  headers(extra = {}) {
-    return this.token ? { authorization: `Bearer ${this.token}`, ...extra } : extra;
-  }
-  /** Low-level fetch with auth, an optional timeout and transport errors as `GatewayError`. */
-  async fetch(path2, init = {}, options = {}) {
-    const signals = [];
-    if (options.signal) signals.push(options.signal);
-    if (options.timeoutMs !== void 0) signals.push(AbortSignal.timeout(options.timeoutMs));
-    const signal = signals.length > 1 ? AbortSignal.any(signals) : signals[0];
-    try {
-      return await this.fetchImpl(`${this.baseUrl}${path2}`, {
-        ...init,
-        headers: this.headers(init.headers ?? {}),
-        ...signal ? { signal } : {}
-      });
-    } catch (err) {
-      if (options.signal?.aborted) throw err;
-      const reason = err instanceof Error ? err.message : String(err);
-      throw new GatewayError(
-        0,
-        "unreachable",
-        `Cannot reach the gateway at ${this.baseUrl} (${reason})`
+function registerTaskRoutes(app, engine, options) {
+  const { audit } = engine;
+  const writable = (reply) => {
+    const { brain } = options;
+    if (!brain) {
+      return sendApiError(
+        reply,
+        409,
+        "no_brain",
+        "No project brain is loaded; start the gateway inside a project (davecode init)"
       );
     }
-  }
-  async request(method, path2, body, options = {}) {
-    const init = { method };
-    if (body !== void 0) {
-      init.body = JSON.stringify(body);
-      init.headers = { "content-type": "application/json" };
-    }
-    const res = await this.fetch(path2, init, { timeoutMs: 1e4, ...options });
-    if (!res.ok) throw await errorFrom(res);
-    if (res.status === 204) return void 0;
-    return await res.json();
-  }
-  get(path2, options) {
-    return this.request("GET", path2, void 0, options);
-  }
-  post(path2, body, options) {
-    return this.request("POST", path2, body, options);
-  }
-  patch(path2, body, options) {
-    return this.request("PATCH", path2, body, options);
-  }
-  delete(path2, options) {
-    return this.request("DELETE", path2, void 0, options);
-  }
-  /**
-   * `GET /api/health`, or `undefined` when nothing (or something that is not DaveCode) answers.
-   * Throws `GatewayError` 401 when a gateway is running but rejects our bearer token.
-   */
-  async health(timeoutMs = 800) {
-    let res;
-    try {
-      res = await this.fetch("/api/health", {}, { timeoutMs });
-    } catch {
-      return void 0;
-    }
-    if (res.status === 401) {
-      throw new GatewayError(
-        401,
-        "unauthorized",
-        `The gateway at ${this.baseUrl} requires a bearer token`
-      );
-    }
-    if (!res.ok) return void 0;
-    try {
-      const body = await res.json();
-      return body.status === "ok" && typeof body.version === "string" ? body : void 0;
-    } catch {
-      return void 0;
-    }
-  }
-  /**
-   * `POST /v1/chat/completions` with `stream: true`. Resolves once the gateway answered (after
-   * routing and any failover), so `meta` already names the serving account.
-   */
-  async chatStream(request, signal) {
-    const res = await this.fetch(
-      "/v1/chat/completions",
-      {
-        method: "POST",
-        headers: { "content-type": "application/json", accept: "text/event-stream" },
-        body: JSON.stringify({ ...request, stream: true })
-      },
-      signal ? { signal } : {}
-    );
-    if (!res.ok) throw await errorFrom(res);
-    return { meta: streamMeta(res.headers), chunks: chatChunks(readSSE(bodyOf(res))) };
-  }
-  /** Live `/api/events` (the server replays its recent buffer first). */
-  async *events(signal) {
-    const res = await this.fetch(
-      "/api/events",
-      { headers: { accept: "text/event-stream" } },
-      signal ? { signal } : {}
-    );
-    if (!res.ok) throw await errorFrom(res);
-    yield* daveEvents(readSSE(bodyOf(res)));
-  }
-};
-function streamMeta(headers) {
-  const meta = { failovers: Number(headers.get("x-davecode-failovers") ?? 0) || 0 };
-  const requestId = headers.get("x-davecode-request-id");
-  const accountId = headers.get("x-davecode-account");
-  const provider = headers.get("x-davecode-provider");
-  if (requestId) meta.requestId = requestId;
-  if (accountId) meta.accountId = accountId;
-  if (provider) meta.provider = provider;
-  return meta;
-}
-function bodyOf(res) {
-  if (!res.body) throw new GatewayError(res.status, "empty_body", "The gateway sent no body");
-  return res.body;
-}
-async function findGateway(config, options = {}) {
-  const client = new GatewayClient(targetFor(config, options.port), options.fetch);
-  const health = await client.health(options.timeoutMs);
-  return health ? { client, health } : void 0;
-}
-
-// src/lib/proc.ts
-import { spawn as nodeSpawn } from "child_process";
-import { existsSync, statSync } from "fs";
-import path from "path";
-function splitPathEnv(pathEnv, delimiter) {
-  if (delimiter === ";") return pathEnv.split(";").filter(Boolean);
-  const dirs = [];
-  let pendingDrive;
-  for (const piece of pathEnv.split(":")) {
-    if (pendingDrive !== void 0) {
-      dirs.push(`${pendingDrive}:${piece}`);
-      pendingDrive = void 0;
-      continue;
-    }
-    if (/^[A-Za-z]$/.test(piece)) {
-      pendingDrive = piece;
-      continue;
-    }
-    if (piece) dirs.push(piece);
-  }
-  if (pendingDrive !== void 0) dirs.push(pendingDrive);
-  return dirs;
-}
-function which(command, env = process.env, platform = process.platform) {
-  const isFile = (p) => {
+    return brain;
+  };
+  const guarded = async (reply, run) => {
     try {
-      return existsSync(p) && statSync(p).isFile();
-    } catch {
-      return false;
+      return await run();
+    } catch (error) {
+      if (error instanceof TaskGraphError) return sendGraphError(reply, error);
+      const { statusCode, code } = error;
+      if (typeof statusCode === "number" && statusCode < 500 && typeof code === "string") {
+        return sendApiError(reply, statusCode, code, error.message);
+      }
+      throw error;
     }
   };
-  if (command.includes("/") || command.includes("\\") || path.isAbsolute(command)) {
-    return isFile(command) ? command : void 0;
-  }
-  const win = platform === "win32";
-  const delimiter = win ? ";" : ":";
-  const dirs = splitPathEnv(env.PATH ?? env.Path ?? "", delimiter);
-  const exts = win ? [
-    ".exe",
-    ".com",
-    "",
-    ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").map((e) => e.toLowerCase()).filter((e) => e && e !== ".exe" && e !== ".com")
-  ] : [""];
-  for (const dir of dirs) {
-    for (const ext of exts) {
-      const candidate = path.join(dir, command + ext);
-      if (isFile(candidate)) return candidate;
+  const readOnly = (reply) => sendApiError(reply, 501, "brain_read_only", "The project brain of this gateway is read-only");
+  app.post("/api/tasks", async (request, reply) => {
+    const parsed = taskCreateSchema.safeParse(request.body);
+    if (!parsed.success) {
+      return sendApiError(reply, 400, "invalid_body", z3.prettifyError(parsed.error));
     }
-  }
-  return void 0;
-}
-var SHELL_SAFE = /^[\w.:=@+\-/\\[\]]+$/;
-function spawnInteractive(command, args, options) {
-  const spawn = options.spawn ?? nodeSpawn;
-  const platform = options.platform ?? process.platform;
-  const shim = platform === "win32" && /\.(cmd|bat)$/i.test(command);
-  if (shim) {
-    const unsafe = args.find((a) => !SHELL_SAFE.test(a));
-    if (unsafe !== void 0) {
-      return Promise.reject(
-        new Error(`Argument ${JSON.stringify(unsafe)} cannot be passed safely to ${command}`)
-      );
+    const brain = writable(reply);
+    if (isReply(brain)) return brain;
+    if (!brain.createTask) return readOnly(reply);
+    const input = parsed.data;
+    const create = brain.createTask.bind(brain);
+    const result = await guarded(reply, () => create(input));
+    if (isReply(result)) return result;
+    audit.record({ actor: "api", action: "task.create", target: input.id });
+    return reply.code(201).send({ task: result });
+  });
+  app.patch("/api/tasks/:id", async (request, reply) => {
+    const parsed = taskPatchSchema.safeParse(request.body);
+    if (!parsed.success) {
+      return sendApiError(reply, 400, "invalid_body", z3.prettifyError(parsed.error));
     }
-  }
-  return new Promise((resolve3, reject) => {
-    const child = shim ? spawn(`"${command}"`, args, {
-      stdio: "inherit",
-      env: options.env,
-      shell: true,
-      ...options.cwd ? { cwd: options.cwd } : {}
-    }) : spawn(command, args, {
-      stdio: "inherit",
-      env: options.env,
-      ...options.cwd ? { cwd: options.cwd } : {}
+    const brain = writable(reply);
+    if (isReply(brain)) return brain;
+    if (!brain.updateTask) return readOnly(reply);
+    const { description, priority, acceptance, notes, ...rest } = parsed.data;
+    const patch = { ...rest };
+    const clear = [];
+    const optional = { description, priority, acceptance, notes };
+    for (const [key, value] of Object.entries(optional)) {
+      if (value === null) clear.push(key);
+      else if (value !== void 0) patch[key] = value;
+    }
+    const { id } = request.params;
+    const update = brain.updateTask.bind(brain);
+    const result = await guarded(reply, () => update(id, patch, { clear }));
+    if (isReply(result)) return result;
+    audit.record({
+      actor: "api",
+      action: "task.update",
+      target: id,
+      details: { fields: Object.keys(parsed.data) }
     });
-    child.on("error", reject);
-    child.on("exit", (code, signal) => resolve3(code ?? (signal ? 130 : 1)));
+    return { task: result };
+  });
+  app.delete("/api/tasks/:id", async (request, reply) => {
+    const brain = writable(reply);
+    if (isReply(brain)) return brain;
+    if (!brain.removeTask) return readOnly(reply);
+    const { id } = request.params;
+    const remove = brain.removeTask.bind(brain);
+    const result = await guarded(reply, () => remove(id));
+    if (isReply(result)) return result;
+    audit.record({ actor: "api", action: "task.delete", target: id });
+    return reply.code(204).send();
   });
 }
-
-// src/runtime.ts
-import { existsSync as existsSync3 } from "fs";
-import { access } from "fs/promises";
-import { createRequire } from "module";
-import { dirname, join, resolve as resolve2 } from "path";
-import { fileURLToPath } from "url";
-
-// ../server/dist/index.js
-import { timingSafeEqual } from "crypto";
-import { existsSync as existsSync2 } from "fs";
-import { resolve } from "path";
-import cors from "@fastify/cors";
-import fastifyStatic from "@fastify/static";
-import Fastify from "fastify";
-import { z as z4 } from "zod";
-import { z } from "zod";
-import { z as z2 } from "zod";
-import { z as z3 } from "zod";
-import { z as z5 } from "zod";
-import { Readable } from "stream";
-import { z as z6 } from "zod";
-function sendApiError(reply, status, code, message, extra = {}) {
-  return reply.code(status).send({ error: { message, code, ...extra } });
-}
-function sendOpenAIError(reply, status, body) {
-  return reply.code(status).send({ error: body });
+function isReply(value) {
+  return typeof value === "object" && value !== null && "sent" in value && typeof value.code === "function";
 }
-function openAIType(status) {
-  if (status === 401) return "authentication_error";
-  if (status === 404 || status === 400 || status === 422) return "invalid_request_error";
-  if (status === 429) return "rate_limit_error";
-  return "api_error";
+var EMPTY_GRAPH = { version: 1, tasks: [] };
+var IDLE = { state: "idle" };
+function invalid(reply, error) {
+  return sendApiError(reply, 400, "invalid_body", z4.prettifyError(error));
 }
-function describeRoutingError(err) {
-  if (err instanceof RouterError) {
-    return {
-      status: err.status,
-      body: { message: err.message, type: openAIType(err.status), code: err.code }
-    };
-  }
-  if (err instanceof ProviderError) {
-    let status;
-    let code = err.kind;
-    switch (err.kind) {
-      case "bad_request":
-        status = 400;
-        break;
-      case "context_length":
-        status = 400;
-        code = "context_length_exceeded";
-        break;
-      case "rate_limit":
-      case "quota_exhausted":
-        status = 429;
-        break;
-      case "auth":
-        status = 502;
-        code = "upstream_auth_error";
-        break;
-      default:
-        status = 502;
+function registerApiRoutes(app, engine, options) {
+  const { accounts, events, audit, quota, keyring } = engine;
+  const now = () => quota.clock();
+  const emitAccount = (account) => events.emit({ type: "account.updated", account });
+  app.get("/api/health", async () => ({
+    status: "ok",
+    version: VERSION,
+    uptimeSec: Math.max(0, Math.floor((now() - engine.startedAt) / 1e3)),
+    experimental: { ...engine.config.experimental }
+  }));
+  app.get("/api/accounts", async () => ({ accounts: accounts.list() }));
+  app.post("/api/accounts", async (request, reply) => {
+    const parsed = accountCreateSchema.safeParse(request.body);
+    if (!parsed.success) return invalid(reply, parsed.error);
+    const { secret, ...input } = parsed.data;
+    if (input.provider === "gemini-web" && !engine.config.experimental.geminiWeb) {
+      return sendApiError(
+        reply,
+        400,
+        "experimental_disabled",
+        "gemini-web is experimental and may violate Google\u2019s Terms of Service. Set experimental.geminiWeb to true to opt in."
+      );
     }
-    return { status, body: { message: err.message, type: openAIType(status), code } };
-  }
-  return {
-    status: 500,
-    body: { message: "Internal gateway error", type: "api_error", code: "internal_error" }
-  };
-}
-var providerKind = z.enum(PROVIDER_KINDS);
-var contentPart = z.discriminatedUnion("type", [
-  z.object({ type: z.literal("text"), text: z.string() }),
-  z.object({
-    type: z.literal("image_url"),
-    image_url: z.object({
-      url: z.string(),
-      detail: z.enum(["auto", "low", "high"]).optional()
-    })
-  })
-]);
-var toolCall = z.object({
-  id: z.string(),
-  type: z.literal("function"),
-  function: z.object({ name: z.string(), arguments: z.string() })
-});
-var chatMessage = z.object({
-  role: z.enum(["system", "user", "assistant", "tool"]),
-  content: z.union([z.string(), z.array(contentPart), z.null()]),
-  name: z.string().optional(),
-  tool_call_id: z.string().optional(),
-  tool_calls: z.array(toolCall).optional()
-});
-var chatRequestSchema = z.object({
-  model: z.string().min(1),
-  messages: z.array(chatMessage).min(1),
-  stream: z.boolean().optional(),
-  temperature: z.number().min(0).max(2).optional(),
-  top_p: z.number().min(0).max(1).optional(),
-  max_tokens: z.number().int().positive().optional(),
-  stop: z.union([z.string(), z.array(z.string())]).optional(),
-  tools: z.array(
-    z.object({
-      type: z.literal("function"),
-      function: z.object({
-        name: z.string(),
-        description: z.string().optional(),
-        parameters: z.record(z.string(), z.unknown()).optional()
-      })
-    })
-  ).optional(),
-  tool_choice: z.union([
-    z.enum(["auto", "none", "required"]),
-    z.object({ type: z.literal("function"), function: z.object({ name: z.string() }) })
-  ]).optional(),
-  user: z.string().optional()
-});
-var positiveInt = z.number().int().positive();
-var quotaLimits = z.object({
-  tpm: positiveInt.optional(),
-  rpm: positiveInt.optional(),
-  tokens5h: positiveInt.optional(),
-  requests5h: positiveInt.optional(),
-  tokensDaily: positiveInt.optional(),
-  requestsDaily: positiveInt.optional()
-}).strict();
-var SECRET_KEY = /^(api[-_]?key|secret|client[-_]?secret|(access|refresh|session|auth|bearer)?[-_]?token|password|passwd|cookies?|authorization|credentials?)$/i;
-var accountConfig = z.record(z.string(), z.unknown()).refine((config) => !Object.keys(config).some((key) => SECRET_KEY.test(key)), {
-  message: 'config must not contain credentials; send them in "secret" instead'
-});
-var subscriptionDate = z.string().trim().refine(
-  (value) => /^\d{4}-\d{2}-\d{2}(T[\d:.]+(Z|[+-]\d{2}:?\d{2})?)?$/.test(value) && !Number.isNaN(Date.parse(value)),
-  { message: "expected a date (YYYY-MM-DD) or an ISO timestamp" }
-);
-var subscriptionSchema = z.object({
-  plan: z.string().trim().min(1).max(120).optional(),
-  paidAt: subscriptionDate.optional(),
-  renewsAt: subscriptionDate.optional(),
-  price: z.object({
-    amount: z.number().min(0).max(1e6),
-    currency: z.string().trim().regex(/^[A-Za-z]{3}$/, "expected a 3-letter currency code").transform((c) => c.toUpperCase()),
-    period: z.enum(["month", "year"])
-  }).strict().optional(),
-  notes: z.string().trim().max(1e3).optional()
-}).strict();
-var accountFields = {
-  label: z.string().trim().min(1).max(200),
-  enabled: z.boolean().optional(),
-  priority: z.number().int().min(0).max(1e6).optional(),
-  weight: z.number().min(0).max(1e3).optional(),
-  limits: quotaLimits.optional(),
-  config: accountConfig.optional(),
-  /** API key / token. Encrypted at rest and never returned. */
-  secret: z.string().min(1).max(1e5).optional()
-};
-var accountCreateSchema = z.object({ provider: providerKind, ...accountFields, subscription: subscriptionSchema.optional() }).strict();
-var accountPatchSchema = z.object({
-  ...accountFields,
-  label: accountFields.label.optional(),
-  subscription: subscriptionSchema.nullable().optional()
-}).strict();
-var routesUpdateSchema = z.object({ routes: z.array(routeSchema).max(200), defaultRoute: z.string().min(1).optional() }).strict().superRefine((body, ctx) => {
-  const seen = /* @__PURE__ */ new Set();
-  body.routes.forEach((route, index) => {
-    if (seen.has(route.name)) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["routes", index, "name"],
-        message: `duplicate route name "${route.name}"`
+    const account = engine.db.transaction(() => {
+      const created = accounts.create(input);
+      if (secret !== void 0) keyring.set(created.id, secret);
+      audit.record({
+        actor: "api",
+        action: "account.create",
+        target: created.id,
+        details: { provider: created.provider, label: created.label, hasSecret: !!secret }
       });
+      return accounts.get(created.id) ?? created;
+    })();
+    emitAccount(account);
+    return reply.code(201).send({ account });
+  });
+  app.patch("/api/accounts/:id", async (request, reply) => {
+    const parsed = accountPatchSchema.safeParse(request.body);
+    if (!parsed.success) return invalid(reply, parsed.error);
+    const existing = accounts.get(request.params.id);
+    if (!existing) return sendApiError(reply, 404, "not_found", "Account not found");
+    const { secret, ...fields } = parsed.data;
+    const patch = { ...fields };
+    const enabled = fields.enabled ?? existing.enabled;
+    if (!enabled) {
+      patch.status = "disabled";
+    } else if (fields.enabled === true || secret !== void 0) {
+      patch.status = "active";
+      patch.cooldownUntil = null;
+      patch.lastError = null;
+      engine.router.breaker.reset(existing.id);
+      engine.reported.forget(existing.id);
     }
-    seen.add(route.name);
+    const account = engine.db.transaction(() => {
+      if (secret !== void 0) keyring.set(existing.id, secret);
+      const updated = accounts.update(existing.id, patch);
+      audit.record({
+        actor: "api",
+        action: "account.update",
+        target: existing.id,
+        details: { fields: Object.keys(fields), secretChanged: secret !== void 0 }
+      });
+      return updated;
+    })();
+    emitAccount(account);
+    return { account };
   });
-  if (body.defaultRoute !== void 0 && !seen.has(body.defaultRoute)) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["defaultRoute"],
-      message: `defaultRoute "${body.defaultRoute}" is not one of the routes`
-    });
-  }
-});
-var taskText = {
-  title: z.string().trim().min(1).max(300),
-  description: z.string().max(5e4),
-  acceptance: z.array(z.string().trim().min(1).max(2e3)).max(100),
-  notes: z.string().max(5e4),
-  dependsOn: z.array(z.string().min(1)).max(500),
-  priority: z.number().finite()
-};
-var taskCreateSchema = z.object({
-  id: taskIdSchema,
-  title: taskText.title,
-  description: taskText.description.optional(),
-  dependsOn: taskText.dependsOn.optional(),
-  priority: taskText.priority.optional(),
-  acceptance: taskText.acceptance.optional()
-}).strict();
-var taskPatchSchema = z.object({
-  title: taskText.title.optional(),
-  description: taskText.description.nullable().optional(),
-  dependsOn: taskText.dependsOn.optional(),
-  priority: taskText.priority.nullable().optional(),
-  acceptance: taskText.acceptance.nullable().optional(),
-  notes: taskText.notes.nullable().optional(),
-  status: z.enum(TASK_STATUSES).optional()
-}).strict().refine((patch) => Object.values(patch).some((v) => v !== void 0), {
-  message: "send at least one field to change"
-});
-var runnerStartSchema = z.object({ taskId: z.string().min(1).optional() }).strict();
-var goalStartSchema = z.object({
-  objective: z.string().trim().min(1).max(4e3),
-  maxRounds: z.number().int().min(1).max(20).optional(),
-  maxTasks: z.number().int().min(1).max(100).optional(),
-  maxTokens: z.number().int().min(1e3).optional(),
-  dryRun: z.boolean().optional()
-}).strict();
-var timeseriesQuerySchema = z.object({
-  minutes: z.coerce.number().int().min(1).max(7 * 24 * 60).default(60),
-  bucketSec: z.coerce.number().int().min(1).max(86400).default(60)
-});
-var limitQuerySchema = (fallback, max = 1e3) => z.object({ limit: z.coerce.number().int().min(1).max(max).default(fallback) });
-function registerGoalRoutes(app, engine, options) {
-  const { audit } = engine;
-  const unavailable = (reply) => sendApiError(
-    reply,
-    501,
-    "goals_unavailable",
-    "Goal mode is not available; start the gateway inside a project (davecode init)"
-  );
-  const guarded = async (reply, run) => {
-    try {
-      return { ok: true, value: await run() };
-    } catch (error) {
-      const { statusCode, code } = error;
-      if (typeof statusCode === "number" && statusCode < 500 && typeof code === "string") {
-        return {
-          ok: false,
-          reply: sendApiError(reply, statusCode, code, error.message)
-        };
+  app.delete("/api/accounts/:id", async (request, reply) => {
+    const { id } = request.params;
+    if (!accounts.delete(id)) return sendApiError(reply, 404, "not_found", "Account not found");
+    for (const cleanup of [() => engine.sandboxes.remove(id), () => engine.chromium.remove(id)]) {
+      try {
+        cleanup();
+      } catch (err) {
+        request.log.warn({ err, accountId: id }, "failed to remove account directory");
       }
-      throw error;
     }
-  };
-  const control = (reply) => {
-    if (!options.goals) unavailable(reply);
-    return options.goals;
-  };
-  app.get("/api/goals", async (_request, reply) => {
-    const goals = control(reply);
-    if (!goals) return reply;
-    return { goals: await goals.list() };
+    quota.forget(id);
+    engine.reported.forget(id);
+    engine.router.breaker.reset(id);
+    audit.record({ actor: "api", action: "account.delete", target: id });
+    events.emit({ type: "account.removed", accountId: id });
+    return reply.code(204).send();
   });
-  app.get("/api/goals/:id", async (request, reply) => {
-    const goals = control(reply);
-    if (!goals) return reply;
-    const goal = await goals.get(request.params.id);
-    if (!goal) return sendApiError(reply, 404, "not_found", `unknown goal "${request.params.id}"`);
-    return { goal };
+  app.get("/api/accounts/:id/connection", async (request, reply) => {
+    const account = accounts.get(request.params.id);
+    if (!account) return sendApiError(reply, 404, "not_found", "Account not found");
+    return { connection: await engine.connections.check(account) };
   });
-  app.post("/api/goals", async (request, reply) => {
-    const parsed = goalStartSchema.safeParse(request.body);
-    if (!parsed.success) {
-      return sendApiError(reply, 400, "invalid_body", z2.prettifyError(parsed.error));
+  app.post("/api/accounts/:id/connect", async (request, reply) => {
+    if (!request.headers["content-type"]?.toLowerCase().startsWith("application/json")) {
+      return sendApiError(reply, 415, "json_required", "Send Content-Type: application/json");
     }
-    const goals = control(reply);
-    if (!goals) return reply;
-    const input = parsed.data;
-    const result = await guarded(reply, () => goals.start(input));
-    if (!result.ok) return result.reply;
+    const account = accounts.get(request.params.id);
+    if (!account) return sendApiError(reply, 404, "not_found", "Account not found");
+    if (connectionMethod(account.provider) !== "cli-login") {
+      return sendApiError(
+        reply,
+        400,
+        "not_cli_login",
+        account.provider === "gemini-web" ? "gemini-web signs in through its own browser profile, not a CLI login" : "This account connects with an API key: set it in the account settings"
+      );
+    }
+    const command = loginCommandFor(account.id);
+    const { launched } = options.loginLauncher ? await options.loginLauncher.launch(account) : { launched: false };
     audit.record({
       actor: "api",
-      action: "goal.start",
-      target: result.value.id,
-      details: { dryRun: input.dryRun === true }
+      action: "account.connect",
+      target: account.id,
+      details: { launched }
     });
-    return reply.code(202).send({ goal: result.value });
+    const result = {
+      connection: await engine.connections.check(account),
+      launched,
+      command,
+      message: launched ? "A terminal opened on the gateway machine with the official sign-in. Finish it there; this page updates when the login is detected." : `Run this in a terminal on the machine running the gateway: ${command}`
+    };
+    return { connect: result };
   });
-  app.post("/api/goals/:id/execute", async (request, reply) => {
-    const goals = control(reply);
-    if (!goals) return reply;
-    if (!goals.execute) return unavailable(reply);
-    const execute = goals.execute.bind(goals);
-    const result = await guarded(reply, () => execute(request.params.id));
-    if (!result.ok) return result.reply;
-    audit.record({ actor: "api", action: "goal.execute", target: request.params.id });
-    return reply.code(202).send({ goal: result.value });
+  app.get("/api/usage", async () => ({
+    usage: accounts.list().map((account) => quota.usage(account))
+  }));
+  app.get("/api/budget", async () => ({ budget: engine.budget.snapshot() }));
+  app.get("/api/usage/timeseries", async (request, reply) => {
+    const parsed = timeseriesQuerySchema.safeParse(request.query);
+    if (!parsed.success) return invalid(reply, parsed.error);
+    const { minutes, bucketSec } = parsed.data;
+    const until = now() + 1;
+    const buckets = engine.usage.timeseries({
+      since: until - minutes * 6e4,
+      until,
+      bucketMs: bucketSec * 1e3
+    });
+    return { buckets };
   });
-  app.get(
-    "/api/goals/:id/artifacts/:taskId",
-    async (request, reply) => {
-      const goals = control(reply);
-      if (!goals) return reply;
-      if (!goals.readArtifact) return unavailable(reply);
-      const readArtifact = goals.readArtifact.bind(goals);
-      const result = await guarded(
-        reply,
-        () => readArtifact(request.params.id, request.params.taskId)
-      );
-      if (!result.ok) return result.reply;
-      return { artifact: result.value };
+  app.get("/api/requests", async (request, reply) => {
+    const parsed = limitQuerySchema(100).safeParse(request.query);
+    if (!parsed.success) return invalid(reply, parsed.error);
+    return { requests: engine.usage.recent(parsed.data.limit) };
+  });
+  app.get("/api/logs", async (request, reply) => {
+    const parsed = limitQuerySchema(200).safeParse(request.query);
+    if (!parsed.success) return invalid(reply, parsed.error);
+    return { events: events.recent(parsed.data.limit) };
+  });
+  app.get("/api/routes", async () => ({
+    defaultRoute: engine.config.routing.defaultRoute,
+    routes: engine.config.routing.routes
+  }));
+  app.put("/api/routes", async (request, reply) => {
+    const parsed = routesUpdateSchema.safeParse(request.body);
+    if (!parsed.success) return invalid(reply, parsed.error);
+    const { routes, defaultRoute } = parsed.data;
+    for (const route of routes) {
+      for (const target of route.targets) {
+        if (target.accountId !== void 0 && !accounts.get(target.accountId)) {
+          return sendApiError(
+            reply,
+            400,
+            "unknown_account",
+            `route "${route.name}" pins unknown account "${target.accountId}"`
+          );
+        }
+      }
     }
-  );
-  app.post("/api/goals/:id/cancel", async (request, reply) => {
-    const goals = control(reply);
-    if (!goals) return reply;
-    const result = await guarded(reply, () => goals.cancel(request.params.id));
-    if (!result.ok) return result.reply;
-    audit.record({ actor: "api", action: "goal.cancel", target: request.params.id });
-    return { goal: result.value };
+    let result;
+    try {
+      result = await engine.updateRouting({
+        routes,
+        ...defaultRoute !== void 0 ? { defaultRoute } : {}
+      });
+    } catch (error) {
+      if (error instanceof ConfigError) {
+        return sendApiError(reply, 409, "config_invalid", error.message);
+      }
+      throw error;
+    }
+    audit.record({
+      actor: "api",
+      action: "routes.update",
+      details: {
+        routes: routes.map((r) => r.name),
+        defaultRoute: engine.config.routing.defaultRoute
+      }
+    });
+    return {
+      defaultRoute: engine.config.routing.defaultRoute,
+      routes: engine.config.routing.routes,
+      shadowedByProject: result.shadowedByProject
+    };
   });
-}
-function describeIssue(issue) {
-  switch (issue.code) {
-    case "unknown_task":
-      return { status: 404, code: "not_found", extra: {} };
-    case "duplicate_id":
-    case "invalid_transition":
-    case "task_in_progress":
-      return { status: 409, code: issue.code, extra: {} };
-    case "has_dependents":
-      return { status: 409, code: "has_dependents", extra: { dependents: issue.dependents ?? [] } };
-    case "cycle":
-      return { status: 400, code: "cycle", extra: { cycle: issue.cycle ?? [] } };
-    case "unknown_dependency":
-    case "self_dependency":
-      return { status: 400, code: issue.code, extra: {} };
-    default:
-      return { status: 409, code: "invalid_graph", extra: {} };
-  }
-}
-function sendGraphError(reply, error) {
-  const issue = error.issues.find((i) => i.code === "cycle") ?? error.issues[0];
-  if (!issue) return sendApiError(reply, 400, "invalid_graph", error.message);
-  const { status, code, extra } = describeIssue(issue);
-  return sendApiError(reply, status, code, issue.message, extra);
-}
-function registerTaskRoutes(app, engine, options) {
-  const { audit } = engine;
-  const writable = (reply) => {
+  app.get("/api/tasks", async () => {
+    const { brain } = options;
+    if (!brain) return { project: null, graph: EMPTY_GRAPH };
+    return { project: brain.project(), graph: await brain.graph() };
+  });
+  registerTaskRoutes(app, engine, options);
+  registerGoalRoutes(app, engine, options);
+  app.get("/api/brain", async () => {
     const { brain } = options;
-    if (!brain) {
+    if (!brain) return { state: "", architecture: "" };
+    const [state, architecture] = await Promise.all([brain.state(), brain.architecture()]);
+    return { state, architecture };
+  });
+  app.get("/api/runner", async () => ({ status: options.runner?.status() ?? IDLE }));
+  const control = (action) => async function handler(request, reply) {
+    const { runner } = options;
+    if (!runner) {
       return sendApiError(
         reply,
-        409,
-        "no_brain",
-        "No project brain is loaded; start the gateway inside a project (davecode init)"
+        501,
+        "runner_unavailable",
+        "The autonomous runner is not available"
       );
     }
-    return brain;
-  };
-  const guarded = async (reply, run) => {
+    let taskId;
+    if (action === "start" && request.body !== void 0 && request.body !== null) {
+      const parsed = runnerStartSchema.safeParse(request.body);
+      if (!parsed.success) return invalid(reply, parsed.error);
+      taskId = parsed.data.taskId;
+    }
     try {
-      return await run();
+      if (action === "start") await runner.start(taskId === void 0 ? {} : { taskId });
+      else await runner[action]();
     } catch (error) {
-      if (error instanceof TaskGraphError) return sendGraphError(reply, error);
       const { statusCode, code } = error;
       if (typeof statusCode === "number" && statusCode < 500 && typeof code === "string") {
         return sendApiError(reply, statusCode, code, error.message);
       }
       throw error;
     }
-  };
-  const readOnly = (reply) => sendApiError(reply, 501, "brain_read_only", "The project brain of this gateway is read-only");
-  app.post("/api/tasks", async (request, reply) => {
-    const parsed = taskCreateSchema.safeParse(request.body);
-    if (!parsed.success) {
-      return sendApiError(reply, 400, "invalid_body", z3.prettifyError(parsed.error));
-    }
-    const brain = writable(reply);
-    if (isReply(brain)) return brain;
-    if (!brain.createTask) return readOnly(reply);
-    const input = parsed.data;
-    const create = brain.createTask.bind(brain);
-    const result = await guarded(reply, () => create(input));
-    if (isReply(result)) return result;
-    audit.record({ actor: "api", action: "task.create", target: input.id });
-    return reply.code(201).send({ task: result });
-  });
-  app.patch("/api/tasks/:id", async (request, reply) => {
-    const parsed = taskPatchSchema.safeParse(request.body);
-    if (!parsed.success) {
-      return sendApiError(reply, 400, "invalid_body", z3.prettifyError(parsed.error));
-    }
-    const brain = writable(reply);
-    if (isReply(brain)) return brain;
-    if (!brain.updateTask) return readOnly(reply);
-    const { description, priority, acceptance, notes, ...rest } = parsed.data;
-    const patch = { ...rest };
-    const clear = [];
-    const optional = { description, priority, acceptance, notes };
-    for (const [key, value] of Object.entries(optional)) {
-      if (value === null) clear.push(key);
-      else if (value !== void 0) patch[key] = value;
-    }
-    const { id } = request.params;
-    const update = brain.updateTask.bind(brain);
-    const result = await guarded(reply, () => update(id, patch, { clear }));
-    if (isReply(result)) return result;
     audit.record({
       actor: "api",
-      action: "task.update",
-      target: id,
-      details: { fields: Object.keys(parsed.data) }
+      action: `runner.${action}`,
+      ...taskId !== void 0 ? { details: { taskId } } : {}
     });
-    return { task: result };
-  });
-  app.delete("/api/tasks/:id", async (request, reply) => {
-    const brain = writable(reply);
-    if (isReply(brain)) return brain;
-    if (!brain.removeTask) return readOnly(reply);
-    const { id } = request.params;
-    const remove = brain.removeTask.bind(brain);
-    const result = await guarded(reply, () => remove(id));
-    if (isReply(result)) return result;
-    audit.record({ actor: "api", action: "task.delete", target: id });
-    return reply.code(204).send();
-  });
+    return { status: runner.status() };
+  };
+  app.post("/api/runner/start", control("start"));
+  app.post("/api/runner/pause", control("pause"));
+  app.post("/api/runner/stop", control("stop"));
 }
-function isReply(value) {
-  return typeof value === "object" && value !== null && "sent" in value && typeof value.code === "function";
+function authCookie(request, name) {
+  return request.headers.cookie?.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${name}=`))?.slice(name.length + 1);
 }
-var EMPTY_GRAPH = { version: 1, tasks: [] };
-var IDLE = { state: "idle" };
-function invalid(reply, error) {
-  return sendApiError(reply, 400, "invalid_body", z4.prettifyError(error));
+function cookie(name, value, seconds, secure) {
+  return `${name}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${seconds}${secure ? "; Secure" : ""}`;
 }
-function registerApiRoutes(app, engine, options) {
-  const { accounts, events, audit, quota, keyring } = engine;
-  const now = () => quota.clock();
-  const emitAccount = (account) => events.emit({ type: "account.updated", account });
-  app.get("/api/health", async () => ({
-    status: "ok",
-    version: VERSION,
-    uptimeSec: Math.max(0, Math.floor((now() - engine.startedAt) / 1e3)),
-    experimental: { ...engine.config.experimental }
-  }));
-  app.get("/api/accounts", async () => ({ accounts: accounts.list() }));
-  app.post("/api/accounts", async (request, reply) => {
-    const parsed = accountCreateSchema.safeParse(request.body);
-    if (!parsed.success) return invalid(reply, parsed.error);
-    const { secret, ...input } = parsed.data;
-    if (input.provider === "gemini-web" && !engine.config.experimental.geminiWeb) {
+function registerAuthRoutes(app, login) {
+  const secure = login?.options.origin.startsWith("https:") ?? false;
+  app.get("/api/auth/session", async (request, reply) => {
+    reply.header("Cache-Control", "no-store");
+    return login?.status(authCookie(request, "dc_session")) ?? {
+      required: false,
+      providers: [],
+      user: null
+    };
+  });
+  app.post("/api/auth/logout", async (request, reply) => {
+    if (login && request.headers.origin !== login.options.origin)
       return sendApiError(
         reply,
-        400,
-        "experimental_disabled",
-        "gemini-web is experimental and may violate Google\u2019s Terms of Service. Set experimental.geminiWeb to true to opt in."
+        403,
+        "invalid_origin",
+        "Open DaveCode from its configured origin."
       );
+    login?.logout(authCookie(request, "dc_session"));
+    return reply.header("Cache-Control", "no-store").header("Set-Cookie", cookie("dc_session", "", 0, secure)).code(204).send();
+  });
+  for (const provider of ["google", "github"]) {
+    app.get(`/api/auth/${provider}/start`, async (_request, reply) => {
+      if (!login?.options.providers[provider])
+        return sendApiError(
+          reply,
+          503,
+          "login_not_configured",
+          "This sign-in provider is not configured."
+        );
+      try {
+        const flow = login.begin(provider);
+        return reply.header("Cache-Control", "no-store").header("Referrer-Policy", "no-referrer").header("Set-Cookie", cookie("dc_login", flow.binding, 600, secure)).redirect(flow.url);
+      } catch {
+        return sendApiError(reply, 429, "login_busy", "Sign-in is busy. Try again shortly.");
+      }
+    });
+    app.get(`/api/auth/${provider}/callback`, async (request, reply) => {
+      reply.header("Cache-Control", "no-store").header("Referrer-Policy", "no-referrer");
+      if (!login)
+        return sendApiError(reply, 503, "login_not_configured", "Sign-in is not configured.");
+      const parsed = z5.object({ state: z5.string().min(1).max(200), code: z5.string().min(1).max(4096) }).safeParse(request.query);
+      const binding = authCookie(request, "dc_login");
+      if (!parsed.success || !binding)
+        return reply.redirect(`${login.options.origin}/#/login?error=signin_failed`);
+      try {
+        const session = await login.finish(provider, parsed.data.state, parsed.data.code, binding);
+        login.logout(authCookie(request, "dc_session"));
+        return reply.header("Set-Cookie", [
+          cookie("dc_session", session, 8 * 60 * 60, secure),
+          cookie("dc_login", "", 0, secure)
+        ]).redirect(`${login.options.origin}/`);
+      } catch {
+        return reply.header("Set-Cookie", cookie("dc_login", "", 0, secure)).redirect(`${login.options.origin}/#/login?error=signin_failed`);
+      }
+    });
+  }
+}
+function frame(event, seq) {
+  return `id: ${seq}
+event: ${event.type}
+data: ${JSON.stringify(event)}
+
+`;
+}
+function resumeCursor(headers, query) {
+  const fromQuery = typeof query === "object" && query !== null && "lastEventId" in query ? query.lastEventId : void 0;
+  const raw = headers["last-event-id"] ?? fromQuery;
+  const value = Number(Array.isArray(raw) ? raw[0] : raw);
+  return Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+function registerEventRoutes(app, engine, heartbeatMs) {
+  const clients = /* @__PURE__ */ new Set();
+  app.addHook("preClose", async () => {
+    for (const res of clients) res.end();
+    clients.clear();
+  });
+  app.get("/api/events", (request, reply) => {
+    const cursor = resumeCursor(request.headers, request.query);
+    reply.hijack();
+    const res = reply.raw;
+    const inherited = {};
+    for (const [name, value] of Object.entries(reply.getHeaders())) {
+      if (value !== void 0) inherited[name] = value;
     }
-    const account = engine.db.transaction(() => {
-      const created = accounts.create(input);
-      if (secret !== void 0) keyring.set(created.id, secret);
-      audit.record({
-        actor: "api",
-        action: "account.create",
-        target: created.id,
-        details: { provider: created.provider, label: created.label, hasSecret: !!secret }
+    res.writeHead(200, {
+      ...inherited,
+      "content-type": "text/event-stream; charset=utf-8",
+      "cache-control": "no-cache, no-transform",
+      connection: "keep-alive",
+      "x-accel-buffering": "no"
+    });
+    res.write("retry: 3000\n\n");
+    clients.add(res);
+    for (const { seq, event } of engine.events.since(cursor)) res.write(frame(event, seq));
+    const unsubscribe = engine.events.subscribe((event, seq) => {
+      res.write(frame(event, seq));
+    });
+    const heartbeat = setInterval(() => res.write(": ping\n\n"), heartbeatMs);
+    heartbeat.unref();
+    let closed = false;
+    const cleanup = () => {
+      if (closed) return;
+      closed = true;
+      clearInterval(heartbeat);
+      unsubscribe();
+      clients.delete(res);
+    };
+    res.on("close", cleanup);
+    res.on("error", cleanup);
+  });
+}
+function setRoutingHeaders(reply, meta) {
+  reply.header("x-davecode-request-id", meta.requestId).header("x-davecode-account", meta.accountId).header("x-davecode-provider", meta.provider).header("x-davecode-failovers", String(meta.failovers));
+}
+function sendRoutingError(reply, err) {
+  const { status, body } = describeRoutingError(err);
+  if (status === 500) reply.log.error({ err }, "chat completion failed");
+  if (err instanceof Error && "failovers" in err && typeof err.failovers === "number") {
+    reply.header("x-davecode-failovers", String(err.failovers));
+  }
+  return sendOpenAIError(reply, status, body);
+}
+async function* sseFrames(chunks) {
+  try {
+    for await (const chunk of chunks) yield `data: ${JSON.stringify(chunk)}
+
+`;
+  } catch (err) {
+    yield `data: ${JSON.stringify({ error: describeRoutingError(err).body })}
+
+`;
+  }
+  yield "data: [DONE]\n\n";
+}
+function registerV1Routes(app, engine) {
+  app.get("/v1/models", async () => ({ object: "list", data: await engine.router.listModels() }));
+  app.post("/v1/chat/completions", async (request, reply) => {
+    const parsed = chatRequestSchema.safeParse(request.body);
+    if (!parsed.success) {
+      return sendOpenAIError(reply, 400, {
+        message: z6.prettifyError(parsed.error),
+        type: "invalid_request_error",
+        code: "invalid_body"
       });
-      return accounts.get(created.id) ?? created;
-    })();
-    emitAccount(account);
-    return reply.code(201).send({ account });
-  });
-  app.patch("/api/accounts/:id", async (request, reply) => {
-    const parsed = accountPatchSchema.safeParse(request.body);
-    if (!parsed.success) return invalid(reply, parsed.error);
-    const existing = accounts.get(request.params.id);
-    if (!existing) return sendApiError(reply, 404, "not_found", "Account not found");
-    const { secret, ...fields } = parsed.data;
-    const patch = { ...fields };
-    const enabled = fields.enabled ?? existing.enabled;
-    if (!enabled) {
-      patch.status = "disabled";
-    } else if (fields.enabled === true || secret !== void 0) {
-      patch.status = "active";
-      patch.cooldownUntil = null;
-      patch.lastError = null;
-      engine.router.breaker.reset(existing.id);
-      engine.reported.forget(existing.id);
     }
-    const account = engine.db.transaction(() => {
-      if (secret !== void 0) keyring.set(existing.id, secret);
-      const updated = accounts.update(existing.id, patch);
-      audit.record({
-        actor: "api",
-        action: "account.update",
-        target: existing.id,
-        details: { fields: Object.keys(fields), secretChanged: secret !== void 0 }
-      });
-      return updated;
-    })();
-    emitAccount(account);
-    return { account };
-  });
-  app.delete("/api/accounts/:id", async (request, reply) => {
-    const { id } = request.params;
-    if (!accounts.delete(id)) return sendApiError(reply, 404, "not_found", "Account not found");
-    for (const cleanup of [() => engine.sandboxes.remove(id), () => engine.chromium.remove(id)]) {
+    const body = parsed.data;
+    const requestId = newId2("req");
+    reply.header("x-davecode-request-id", requestId);
+    const abort = new AbortController();
+    reply.raw.on("close", () => {
+      if (!reply.raw.writableFinished) abort.abort();
+    });
+    const routeOptions = { requestId, signal: abort.signal };
+    if (!body.stream) {
       try {
-        cleanup();
+        const { completion, meta } = await engine.router.complete(body, routeOptions);
+        setRoutingHeaders(reply, meta);
+        return completion;
       } catch (err) {
-        request.log.warn({ err, accountId: id }, "failed to remove account directory");
+        return sendRoutingError(reply, err);
       }
     }
-    quota.forget(id);
-    engine.reported.forget(id);
-    engine.router.breaker.reset(id);
-    audit.record({ actor: "api", action: "account.delete", target: id });
-    events.emit({ type: "account.removed", accountId: id });
-    return reply.code(204).send();
-  });
-  app.get("/api/accounts/:id/connection", async (request, reply) => {
-    const account = accounts.get(request.params.id);
-    if (!account) return sendApiError(reply, 404, "not_found", "Account not found");
-    return { connection: await engine.connections.check(account) };
-  });
-  app.post("/api/accounts/:id/connect", async (request, reply) => {
-    if (!request.headers["content-type"]?.toLowerCase().startsWith("application/json")) {
-      return sendApiError(reply, 415, "json_required", "Send Content-Type: application/json");
+    let result;
+    try {
+      result = await engine.router.stream(body, routeOptions);
+    } catch (err) {
+      return sendRoutingError(reply, err);
     }
-    const account = accounts.get(request.params.id);
-    if (!account) return sendApiError(reply, 404, "not_found", "Account not found");
-    if (connectionMethod(account.provider) !== "cli-login") {
-      return sendApiError(
-        reply,
-        400,
-        "not_cli_login",
-        account.provider === "gemini-web" ? "gemini-web signs in through its own browser profile, not a CLI login" : "This account connects with an API key: set it in the account settings"
-      );
+    setRoutingHeaders(reply, result.meta);
+    reply.header("content-type", "text/event-stream; charset=utf-8").header("cache-control", "no-cache, no-transform").header("x-accel-buffering", "no");
+    return reply.send(Readable.from(sseFrames(result.chunks)));
+  });
+}
+var DEFAULT_CORS_ORIGINS = ["http://localhost:5173", "http://127.0.0.1:5173"];
+var EXPOSED_HEADERS = [
+  "x-davecode-request-id",
+  "x-davecode-account",
+  "x-davecode-provider",
+  "x-davecode-failovers"
+];
+function pathOf(url) {
+  const q = url.indexOf("?");
+  return q === -1 ? url : url.slice(0, q);
+}
+function surfaceOf(url) {
+  const path2 = pathOf(url);
+  if (path2 === "/v1" || path2.startsWith("/v1/")) return "v1";
+  if (path2 === "/api" || path2.startsWith("/api/")) return "api";
+  return "other";
+}
+function redactUrl(url) {
+  return url.replace(/([?&](?:token|code|state|error_description)=)[^&]*/gi, "$1[redacted]");
+}
+function safeEqual(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+function bearer(request) {
+  const header = request.headers.authorization;
+  if (!header) return void 0;
+  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  return match?.[1];
+}
+function loggerOption(logger) {
+  if (!logger) return false;
+  return {
+    ...typeof logger === "object" ? logger : {},
+    serializers: {
+      req(req) {
+        return { method: req.method, url: redactUrl(req.url), remoteAddress: req.ip };
+      }
     }
-    const command = loginCommandFor(account.id);
-    const { launched } = options.loginLauncher ? await options.loginLauncher.launch(account) : { launched: false };
-    audit.record({
-      actor: "api",
-      action: "account.connect",
-      target: account.id,
-      details: { launched }
-    });
-    const result = {
-      connection: await engine.connections.check(account),
-      launched,
-      command,
-      message: launched ? "A terminal opened on the gateway machine with the official sign-in. Finish it there; this page updates when the login is detected." : `Run this in a terminal on the machine running the gateway: ${command}`
-    };
-    return { connect: result };
+  };
+}
+async function buildGateway(engine, options = {}) {
+  const app = Fastify({ logger: loggerOption(options.logger), bodyLimit: 10 * 1024 * 1024 });
+  const login = options.login === false ? void 0 : options.login ?? loginFromEnv(process.env);
+  if (login) app.addHook("onClose", async () => login.clear());
+  await app.register(cors, {
+    origin: [...DEFAULT_CORS_ORIGINS, ...options.corsOrigins ?? []],
+    methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
+    allowedHeaders: ["content-type", "authorization"],
+    exposedHeaders: EXPOSED_HEADERS
   });
-  app.get("/api/usage", async () => ({
-    usage: accounts.list().map((account) => quota.usage(account))
-  }));
-  app.get("/api/budget", async () => ({ budget: engine.budget.snapshot() }));
-  app.get("/api/usage/timeseries", async (request, reply) => {
-    const parsed = timeseriesQuerySchema.safeParse(request.query);
-    if (!parsed.success) return invalid(reply, parsed.error);
-    const { minutes, bucketSec } = parsed.data;
-    const until = now() + 1;
-    const buckets = engine.usage.timeseries({
-      since: until - minutes * 6e4,
-      until,
-      bucketMs: bucketSec * 1e3
+  const token = engine.config.server.authToken;
+  if (token || login) {
+    app.addHook("onRequest", async (request, reply) => {
+      if (request.method === "OPTIONS") return;
+      const surface = surfaceOf(request.url);
+      if (surface === "other") return;
+      if (pathOf(request.url).startsWith("/api/auth/")) return;
+      let provided = bearer(request);
+      if (!provided && pathOf(request.url) === "/api/events") {
+        const query = request.query;
+        if (typeof query?.token === "string") provided = query.token;
+      }
+      if (provided && token && safeEqual(provided, token)) return;
+      if (surface === "api" && login?.user(authCookie(request, "dc_session"))) {
+        if (!["GET", "HEAD"].includes(request.method) && request.headers.origin !== login.options.origin) {
+          return sendApiError(
+            reply,
+            403,
+            "invalid_origin",
+            "Open DaveCode from its configured origin."
+          );
+        }
+        return;
+      }
+      const message = "Missing or invalid bearer token";
+      if (surface === "v1") {
+        return sendOpenAIError(reply, 401, {
+          message,
+          type: "authentication_error",
+          code: "invalid_api_key"
+        });
+      }
+      return sendApiError(reply, 401, "unauthorized", message);
     });
-    return { buckets };
+  }
+  app.addContentTypeParser("application/json", { parseAs: "string" }, (_request, body, done) => {
+    const text = typeof body === "string" ? body : body.toString("utf8");
+    if (text.trim() === "") return done(null, void 0);
+    try {
+      done(null, JSON.parse(text));
+    } catch (err) {
+      const error = Object.assign(err instanceof Error ? err : new Error("Invalid JSON"), {
+        statusCode: 400
+      });
+      done(error, void 0);
+    }
   });
-  app.get("/api/requests", async (request, reply) => {
-    const parsed = limitQuerySchema(100).safeParse(request.query);
-    if (!parsed.success) return invalid(reply, parsed.error);
-    return { requests: engine.usage.recent(parsed.data.limit) };
+  app.setErrorHandler((error, request, reply) => {
+    const status = typeof error.statusCode === "number" ? error.statusCode : 500;
+    const message = status >= 500 ? "Internal gateway error" : error instanceof Error ? error.message : "Error";
+    if (status >= 500) request.log.error({ err: error }, "request failed");
+    if (surfaceOf(request.url) === "v1") {
+      return sendOpenAIError(reply, status, {
+        message,
+        type: status >= 500 ? "api_error" : "invalid_request_error",
+        code: status >= 500 ? "internal_error" : "bad_request"
+      });
+    }
+    return sendApiError(reply, status, status >= 500 ? "internal_error" : "bad_request", message);
   });
-  app.get("/api/logs", async (request, reply) => {
-    const parsed = limitQuerySchema(200).safeParse(request.query);
-    if (!parsed.success) return invalid(reply, parsed.error);
-    return { events: events.recent(parsed.data.limit) };
+  const dashboardDir = engine.config.server.dashboard && options.dashboardDir && existsSync(options.dashboardDir) ? resolve(options.dashboardDir) : void 0;
+  if (dashboardDir) {
+    await app.register(fastifyStatic, { root: dashboardDir });
+  }
+  app.setNotFoundHandler((request, reply) => {
+    const surface = surfaceOf(request.url);
+    const message = `Unknown endpoint ${request.method} ${pathOf(request.url)}`;
+    if (surface === "v1") {
+      return sendOpenAIError(reply, 404, {
+        message,
+        type: "invalid_request_error",
+        code: "not_found"
+      });
+    }
+    if (surface === "api") return sendApiError(reply, 404, "not_found", message);
+    if (dashboardDir && (request.method === "GET" || request.method === "HEAD")) {
+      return reply.type("text/html; charset=utf-8").sendFile("index.html");
+    }
+    return reply.code(404).send({ error: { message, code: "not_found" } });
   });
-  app.get("/api/routes", async () => ({
-    defaultRoute: engine.config.routing.defaultRoute,
-    routes: engine.config.routing.routes
-  }));
-  app.put("/api/routes", async (request, reply) => {
-    const parsed = routesUpdateSchema.safeParse(request.body);
-    if (!parsed.success) return invalid(reply, parsed.error);
-    const { routes, defaultRoute } = parsed.data;
-    for (const route of routes) {
-      for (const target of route.targets) {
-        if (target.accountId !== void 0 && !accounts.get(target.accountId)) {
-          return sendApiError(
-            reply,
-            400,
-            "unknown_account",
-            `route "${route.name}" pins unknown account "${target.accountId}"`
-          );
+  registerV1Routes(app, engine);
+  registerAuthRoutes(app, login);
+  registerApiRoutes(app, engine, options);
+  registerEventRoutes(app, engine, options.heartbeatMs ?? 15e3);
+  return app;
+}
+var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost"]);
+async function startGateway(engine, options = {}) {
+  const app = await buildGateway(engine, options);
+  const host = options.host ?? engine.config.server.host;
+  const port = options.port ?? engine.config.server.port;
+  if (!engine.config.server.authToken && !LOOPBACK.has(host)) {
+    app.log.warn(
+      `Listening on ${host} without server.authToken: anyone on the network can use your accounts.`
+    );
+  }
+  await app.listen({ host, port });
+  return app;
+}
+
+// src/sse.ts
+var SSEParser = class {
+  buffer = "";
+  pendingCR = false;
+  data = [];
+  event = "";
+  lastId;
+  retry;
+  /** Feed decoded text; returns the messages completed by it. */
+  push(chunk) {
+    const out = [];
+    let text = chunk;
+    if (this.pendingCR && text.startsWith("\n")) text = text.slice(1);
+    this.pendingCR = false;
+    this.buffer += text;
+    let start = 0;
+    for (let i = 0; i < this.buffer.length; i++) {
+      const ch = this.buffer[i];
+      if (ch !== "\n" && ch !== "\r") continue;
+      const line = this.buffer.slice(start, i);
+      if (ch === "\r") {
+        if (i + 1 < this.buffer.length) {
+          if (this.buffer[i + 1] === "\n") i++;
+        } else {
+          this.pendingCR = true;
         }
       }
+      this.processLine(line, out);
+      start = i + 1;
     }
-    let result;
+    this.buffer = this.buffer.slice(start);
+    return out;
+  }
+  /** End of stream. An unterminated final event is discarded, as the spec requires. */
+  end() {
+    this.buffer = "";
+    this.data = [];
+    this.event = "";
+    return [];
+  }
+  processLine(line, out) {
+    if (line === "") {
+      this.dispatch(out);
+      return;
+    }
+    if (line.startsWith(":")) return;
+    const colon = line.indexOf(":");
+    const field = colon === -1 ? line : line.slice(0, colon);
+    let value = colon === -1 ? "" : line.slice(colon + 1);
+    if (value.startsWith(" ")) value = value.slice(1);
+    switch (field) {
+      case "data":
+        this.data.push(value);
+        break;
+      case "event":
+        this.event = value;
+        break;
+      case "id":
+        if (!value.includes("\0")) this.lastId = value;
+        break;
+      case "retry":
+        if (/^\d+$/.test(value)) this.retry = Number(value);
+        break;
+      default:
+        break;
+    }
+  }
+  dispatch(out) {
+    if (this.data.length === 0) {
+      this.event = "";
+      return;
+    }
+    const message = { event: this.event || "message", data: this.data.join("\n") };
+    if (this.lastId !== void 0) message.id = this.lastId;
+    if (this.retry !== void 0) message.retry = this.retry;
+    out.push(message);
+    this.data = [];
+    this.event = "";
+  }
+};
+async function* readSSE(body) {
+  const parser = new SSEParser();
+  const decoder = new TextDecoder();
+  for await (const chunk of body) {
+    const text = typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
+    yield* parser.push(text);
+  }
+  const tail = decoder.decode();
+  if (tail) yield* parser.push(tail);
+  yield* parser.end();
+}
+var ChatStreamError = class extends Error {
+  code;
+  constructor(message, code) {
+    super(message);
+    this.name = "ChatStreamError";
+    this.code = code ?? void 0;
+  }
+};
+async function* chatChunks(messages) {
+  for await (const message of messages) {
+    if (message.data === "[DONE]") return;
+    let parsed;
     try {
-      result = await engine.updateRouting({
-        routes,
-        ...defaultRoute !== void 0 ? { defaultRoute } : {}
-      });
-    } catch (error) {
-      if (error instanceof ConfigError) {
-        return sendApiError(reply, 409, "config_invalid", error.message);
-      }
-      throw error;
+      parsed = JSON.parse(message.data);
+    } catch {
+      continue;
     }
-    audit.record({
-      actor: "api",
-      action: "routes.update",
-      details: {
-        routes: routes.map((r) => r.name),
-        defaultRoute: engine.config.routing.defaultRoute
-      }
-    });
-    return {
-      defaultRoute: engine.config.routing.defaultRoute,
-      routes: engine.config.routing.routes,
-      shadowedByProject: result.shadowedByProject
-    };
-  });
-  app.get("/api/tasks", async () => {
-    const { brain } = options;
-    if (!brain) return { project: null, graph: EMPTY_GRAPH };
-    return { project: brain.project(), graph: await brain.graph() };
-  });
-  registerTaskRoutes(app, engine, options);
-  registerGoalRoutes(app, engine, options);
-  app.get("/api/brain", async () => {
-    const { brain } = options;
-    if (!brain) return { state: "", architecture: "" };
-    const [state, architecture] = await Promise.all([brain.state(), brain.architecture()]);
-    return { state, architecture };
-  });
-  app.get("/api/runner", async () => ({ status: options.runner?.status() ?? IDLE }));
-  const control = (action) => async function handler(request, reply) {
-    const { runner } = options;
-    if (!runner) {
-      return sendApiError(
-        reply,
-        501,
-        "runner_unavailable",
-        "The autonomous runner is not available"
+    if (!parsed || typeof parsed !== "object") continue;
+    const record = parsed;
+    if (record.error && !record.choices) {
+      throw new ChatStreamError(record.error.message ?? "Upstream error", record.error.code);
+    }
+    if (Array.isArray(record.choices)) yield parsed;
+  }
+}
+async function* daveEvents(messages) {
+  for await (const message of messages) {
+    try {
+      const event = JSON.parse(message.data);
+      if (event && typeof event.type === "string") yield event;
+    } catch {
+    }
+  }
+}
+
+// src/client.ts
+var GatewayError = class extends Error {
+  status;
+  code;
+  constructor(status, code, message) {
+    super(message);
+    this.name = "GatewayError";
+    this.status = status;
+    this.code = code;
+  }
+};
+var WILDCARD_HOSTS = /* @__PURE__ */ new Set(["0.0.0.0", "::", "[::]", ""]);
+function connectHost(host) {
+  if (WILDCARD_HOSTS.has(host)) return "127.0.0.1";
+  if (host.includes(":") && !host.startsWith("[")) return `[${host}]`;
+  return host;
+}
+function targetFor(config, port = config.server.port) {
+  const target = { baseUrl: `http://${connectHost(config.server.host)}:${port}` };
+  if (config.server.authToken) target.token = config.server.authToken;
+  return target;
+}
+async function errorFrom(res) {
+  let code = `http_${res.status}`;
+  let message = `${res.status} ${res.statusText}`.trim();
+  try {
+    const body = await res.json();
+    if (body.error?.message) message = body.error.message;
+    if (body.error?.code) code = body.error.code;
+  } catch {
+  }
+  return new GatewayError(res.status, code, message);
+}
+var GatewayClient = class {
+  baseUrl;
+  token;
+  fetchImpl;
+  constructor(target, fetchImpl = fetch) {
+    this.baseUrl = target.baseUrl.replace(/\/+$/, "");
+    this.token = target.token;
+    this.fetchImpl = fetchImpl;
+  }
+  headers(extra = {}) {
+    return this.token ? { authorization: `Bearer ${this.token}`, ...extra } : extra;
+  }
+  /** Low-level fetch with auth, an optional timeout and transport errors as `GatewayError`. */
+  async fetch(path2, init = {}, options = {}) {
+    const signals = [];
+    if (options.signal) signals.push(options.signal);
+    if (options.timeoutMs !== void 0) signals.push(AbortSignal.timeout(options.timeoutMs));
+    const signal = signals.length > 1 ? AbortSignal.any(signals) : signals[0];
+    try {
+      return await this.fetchImpl(`${this.baseUrl}${path2}`, {
+        ...init,
+        headers: this.headers(init.headers ?? {}),
+        ...signal ? { signal } : {}
+      });
+    } catch (err) {
+      if (options.signal?.aborted) throw err;
+      const reason = err instanceof Error ? err.message : String(err);
+      throw new GatewayError(
+        0,
+        "unreachable",
+        `Cannot reach the gateway at ${this.baseUrl} (${reason})`
       );
     }
-    let taskId;
-    if (action === "start" && request.body !== void 0 && request.body !== null) {
-      const parsed = runnerStartSchema.safeParse(request.body);
-      if (!parsed.success) return invalid(reply, parsed.error);
-      taskId = parsed.data.taskId;
+  }
+  async request(method, path2, body, options = {}) {
+    const init = { method };
+    if (body !== void 0) {
+      init.body = JSON.stringify(body);
+      init.headers = { "content-type": "application/json" };
     }
+    const res = await this.fetch(path2, init, { timeoutMs: 1e4, ...options });
+    if (!res.ok) throw await errorFrom(res);
+    if (res.status === 204) return void 0;
+    return await res.json();
+  }
+  get(path2, options) {
+    return this.request("GET", path2, void 0, options);
+  }
+  post(path2, body, options) {
+    return this.request("POST", path2, body, options);
+  }
+  patch(path2, body, options) {
+    return this.request("PATCH", path2, body, options);
+  }
+  delete(path2, options) {
+    return this.request("DELETE", path2, void 0, options);
+  }
+  /**
+   * `GET /api/health`, or `undefined` when nothing (or something that is not DaveCode) answers.
+   * Throws `GatewayError` 401 when a gateway is running but rejects our bearer token.
+   */
+  async health(timeoutMs = 800) {
+    let res;
     try {
-      if (action === "start") await runner.start(taskId === void 0 ? {} : { taskId });
-      else await runner[action]();
-    } catch (error) {
-      const { statusCode, code } = error;
-      if (typeof statusCode === "number" && statusCode < 500 && typeof code === "string") {
-        return sendApiError(reply, statusCode, code, error.message);
-      }
-      throw error;
+      res = await this.fetch("/api/health", {}, { timeoutMs });
+    } catch {
+      return void 0;
     }
-    audit.record({
-      actor: "api",
-      action: `runner.${action}`,
-      ...taskId !== void 0 ? { details: { taskId } } : {}
-    });
-    return { status: runner.status() };
-  };
-  app.post("/api/runner/start", control("start"));
-  app.post("/api/runner/pause", control("pause"));
-  app.post("/api/runner/stop", control("stop"));
-}
-function authCookie(request, name) {
-  return request.headers.cookie?.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${name}=`))?.slice(name.length + 1);
-}
-function cookie(name, value, seconds, secure) {
-  return `${name}=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${seconds}${secure ? "; Secure" : ""}`;
-}
-function registerAuthRoutes(app, login) {
-  const secure = login?.options.origin.startsWith("https:") ?? false;
-  app.get("/api/auth/session", async (request, reply) => {
-    reply.header("Cache-Control", "no-store");
-    return login?.status(authCookie(request, "dc_session")) ?? {
-      required: false,
-      providers: [],
-      user: null
-    };
-  });
-  app.post("/api/auth/logout", async (request, reply) => {
-    if (login && request.headers.origin !== login.options.origin)
-      return sendApiError(
-        reply,
-        403,
-        "invalid_origin",
-        "Open DaveCode from its configured origin."
+    if (res.status === 401) {
+      throw new GatewayError(
+        401,
+        "unauthorized",
+        `The gateway at ${this.baseUrl} requires a bearer token`
       );
-    login?.logout(authCookie(request, "dc_session"));
-    return reply.header("Cache-Control", "no-store").header("Set-Cookie", cookie("dc_session", "", 0, secure)).code(204).send();
-  });
-  for (const provider of ["google", "github"]) {
-    app.get(`/api/auth/${provider}/start`, async (_request, reply) => {
-      if (!login?.options.providers[provider])
-        return sendApiError(
-          reply,
-          503,
-          "login_not_configured",
-          "This sign-in provider is not configured."
-        );
-      try {
-        const flow = login.begin(provider);
-        return reply.header("Cache-Control", "no-store").header("Referrer-Policy", "no-referrer").header("Set-Cookie", cookie("dc_login", flow.binding, 600, secure)).redirect(flow.url);
-      } catch {
-        return sendApiError(reply, 429, "login_busy", "Sign-in is busy. Try again shortly.");
-      }
-    });
-    app.get(`/api/auth/${provider}/callback`, async (request, reply) => {
-      reply.header("Cache-Control", "no-store").header("Referrer-Policy", "no-referrer");
-      if (!login)
-        return sendApiError(reply, 503, "login_not_configured", "Sign-in is not configured.");
-      const parsed = z5.object({ state: z5.string().min(1).max(200), code: z5.string().min(1).max(4096) }).safeParse(request.query);
-      const binding = authCookie(request, "dc_login");
-      if (!parsed.success || !binding)
-        return reply.redirect(`${login.options.origin}/#/login?error=signin_failed`);
-      try {
-        const session = await login.finish(provider, parsed.data.state, parsed.data.code, binding);
-        login.logout(authCookie(request, "dc_session"));
-        return reply.header("Set-Cookie", [
-          cookie("dc_session", session, 8 * 60 * 60, secure),
-          cookie("dc_login", "", 0, secure)
-        ]).redirect(`${login.options.origin}/`);
-      } catch {
-        return reply.header("Set-Cookie", cookie("dc_login", "", 0, secure)).redirect(`${login.options.origin}/#/login?error=signin_failed`);
-      }
-    });
-  }
-}
-function frame(event, seq) {
-  return `id: ${seq}
-event: ${event.type}
-data: ${JSON.stringify(event)}
-
-`;
-}
-function resumeCursor(headers, query) {
-  const fromQuery = typeof query === "object" && query !== null && "lastEventId" in query ? query.lastEventId : void 0;
-  const raw = headers["last-event-id"] ?? fromQuery;
-  const value = Number(Array.isArray(raw) ? raw[0] : raw);
-  return Number.isSafeInteger(value) && value >= 0 ? value : 0;
-}
-function registerEventRoutes(app, engine, heartbeatMs) {
-  const clients = /* @__PURE__ */ new Set();
-  app.addHook("preClose", async () => {
-    for (const res of clients) res.end();
-    clients.clear();
-  });
-  app.get("/api/events", (request, reply) => {
-    const cursor = resumeCursor(request.headers, request.query);
-    reply.hijack();
-    const res = reply.raw;
-    const inherited = {};
-    for (const [name, value] of Object.entries(reply.getHeaders())) {
-      if (value !== void 0) inherited[name] = value;
     }
-    res.writeHead(200, {
-      ...inherited,
-      "content-type": "text/event-stream; charset=utf-8",
-      "cache-control": "no-cache, no-transform",
-      connection: "keep-alive",
-      "x-accel-buffering": "no"
-    });
-    res.write("retry: 3000\n\n");
-    clients.add(res);
-    for (const { seq, event } of engine.events.since(cursor)) res.write(frame(event, seq));
-    const unsubscribe = engine.events.subscribe((event, seq) => {
-      res.write(frame(event, seq));
-    });
-    const heartbeat = setInterval(() => res.write(": ping\n\n"), heartbeatMs);
-    heartbeat.unref();
-    let closed = false;
-    const cleanup = () => {
-      if (closed) return;
-      closed = true;
-      clearInterval(heartbeat);
-      unsubscribe();
-      clients.delete(res);
-    };
-    res.on("close", cleanup);
-    res.on("error", cleanup);
-  });
-}
-function setRoutingHeaders(reply, meta) {
-  reply.header("x-davecode-request-id", meta.requestId).header("x-davecode-account", meta.accountId).header("x-davecode-provider", meta.provider).header("x-davecode-failovers", String(meta.failovers));
-}
-function sendRoutingError(reply, err) {
-  const { status, body } = describeRoutingError(err);
-  if (status === 500) reply.log.error({ err }, "chat completion failed");
-  if (err instanceof Error && "failovers" in err && typeof err.failovers === "number") {
-    reply.header("x-davecode-failovers", String(err.failovers));
+    if (!res.ok) return void 0;
+    try {
+      const body = await res.json();
+      return body.status === "ok" && typeof body.version === "string" ? body : void 0;
+    } catch {
+      return void 0;
+    }
   }
-  return sendOpenAIError(reply, status, body);
+  /**
+   * `POST /v1/chat/completions` with `stream: true`. Resolves once the gateway answered (after
+   * routing and any failover), so `meta` already names the serving account.
+   */
+  async chatStream(request, signal) {
+    const res = await this.fetch(
+      "/v1/chat/completions",
+      {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "text/event-stream" },
+        body: JSON.stringify({ ...request, stream: true })
+      },
+      signal ? { signal } : {}
+    );
+    if (!res.ok) throw await errorFrom(res);
+    return { meta: streamMeta(res.headers), chunks: chatChunks(readSSE(bodyOf(res))) };
+  }
+  /** Live `/api/events` (the server replays its recent buffer first). */
+  async *events(signal) {
+    const res = await this.fetch(
+      "/api/events",
+      { headers: { accept: "text/event-stream" } },
+      signal ? { signal } : {}
+    );
+    if (!res.ok) throw await errorFrom(res);
+    yield* daveEvents(readSSE(bodyOf(res)));
+  }
+};
+function streamMeta(headers) {
+  const meta = { failovers: Number(headers.get("x-davecode-failovers") ?? 0) || 0 };
+  const requestId = headers.get("x-davecode-request-id");
+  const accountId = headers.get("x-davecode-account");
+  const provider = headers.get("x-davecode-provider");
+  if (requestId) meta.requestId = requestId;
+  if (accountId) meta.accountId = accountId;
+  if (provider) meta.provider = provider;
+  return meta;
+}
+function bodyOf(res) {
+  if (!res.body) throw new GatewayError(res.status, "empty_body", "The gateway sent no body");
+  return res.body;
+}
+async function findGateway(config, options = {}) {
+  const client = new GatewayClient(targetFor(config, options.port), options.fetch);
+  const health = await client.health(options.timeoutMs);
+  return health ? { client, health } : void 0;
 }
-async function* sseFrames(chunks) {
-  try {
-    for await (const chunk of chunks) yield `data: ${JSON.stringify(chunk)}
 
-`;
-  } catch (err) {
-    yield `data: ${JSON.stringify({ error: describeRoutingError(err).body })}
+// src/lib/terminal.ts
+import { spawn as nodeSpawn2 } from "child_process";
 
-`;
-  }
-  yield "data: [DONE]\n\n";
-}
-function registerV1Routes(app, engine) {
-  app.get("/v1/models", async () => ({ object: "list", data: await engine.router.listModels() }));
-  app.post("/v1/chat/completions", async (request, reply) => {
-    const parsed = chatRequestSchema.safeParse(request.body);
-    if (!parsed.success) {
-      return sendOpenAIError(reply, 400, {
-        message: z6.prettifyError(parsed.error),
-        type: "invalid_request_error",
-        code: "invalid_body"
-      });
-    }
-    const body = parsed.data;
-    const requestId = newId2("req");
-    reply.header("x-davecode-request-id", requestId);
-    const abort = new AbortController();
-    reply.raw.on("close", () => {
-      if (!reply.raw.writableFinished) abort.abort();
-    });
-    const routeOptions = { requestId, signal: abort.signal };
-    if (!body.stream) {
-      try {
-        const { completion, meta } = await engine.router.complete(body, routeOptions);
-        setRoutingHeaders(reply, meta);
-        return completion;
-      } catch (err) {
-        return sendRoutingError(reply, err);
-      }
+// src/lib/proc.ts
+import { spawn as nodeSpawn } from "child_process";
+import { existsSync as existsSync2, statSync } from "fs";
+import path from "path";
+function splitPathEnv(pathEnv, delimiter) {
+  if (delimiter === ";") return pathEnv.split(";").filter(Boolean);
+  const dirs = [];
+  let pendingDrive;
+  for (const piece of pathEnv.split(":")) {
+    if (pendingDrive !== void 0) {
+      dirs.push(`${pendingDrive}:${piece}`);
+      pendingDrive = void 0;
+      continue;
     }
-    let result;
-    try {
-      result = await engine.router.stream(body, routeOptions);
-    } catch (err) {
-      return sendRoutingError(reply, err);
+    if (/^[A-Za-z]$/.test(piece)) {
+      pendingDrive = piece;
+      continue;
     }
-    setRoutingHeaders(reply, result.meta);
-    reply.header("content-type", "text/event-stream; charset=utf-8").header("cache-control", "no-cache, no-transform").header("x-accel-buffering", "no");
-    return reply.send(Readable.from(sseFrames(result.chunks)));
-  });
-}
-var DEFAULT_CORS_ORIGINS = ["http://localhost:5173", "http://127.0.0.1:5173"];
-var EXPOSED_HEADERS = [
-  "x-davecode-request-id",
-  "x-davecode-account",
-  "x-davecode-provider",
-  "x-davecode-failovers"
-];
-function pathOf(url) {
-  const q = url.indexOf("?");
-  return q === -1 ? url : url.slice(0, q);
-}
-function surfaceOf(url) {
-  const path2 = pathOf(url);
-  if (path2 === "/v1" || path2.startsWith("/v1/")) return "v1";
-  if (path2 === "/api" || path2.startsWith("/api/")) return "api";
-  return "other";
-}
-function redactUrl(url) {
-  return url.replace(/([?&](?:token|code|state|error_description)=)[^&]*/gi, "$1[redacted]");
-}
-function safeEqual(a, b) {
-  const left = Buffer.from(a);
-  const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual(left, right);
-}
-function bearer(request) {
-  const header = request.headers.authorization;
-  if (!header) return void 0;
-  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
-  return match?.[1];
+    if (piece) dirs.push(piece);
+  }
+  if (pendingDrive !== void 0) dirs.push(pendingDrive);
+  return dirs;
 }
-function loggerOption(logger) {
-  if (!logger) return false;
-  return {
-    ...typeof logger === "object" ? logger : {},
-    serializers: {
-      req(req) {
-        return { method: req.method, url: redactUrl(req.url), remoteAddress: req.ip };
-      }
+function which(command, env = process.env, platform = process.platform) {
+  const isFile = (p) => {
+    try {
+      return existsSync2(p) && statSync(p).isFile();
+    } catch {
+      return false;
     }
   };
-}
-async function buildGateway(engine, options = {}) {
-  const app = Fastify({ logger: loggerOption(options.logger), bodyLimit: 10 * 1024 * 1024 });
-  const login = options.login === false ? void 0 : options.login ?? loginFromEnv(process.env);
-  if (login) app.addHook("onClose", async () => login.clear());
-  await app.register(cors, {
-    origin: [...DEFAULT_CORS_ORIGINS, ...options.corsOrigins ?? []],
-    methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
-    allowedHeaders: ["content-type", "authorization"],
-    exposedHeaders: EXPOSED_HEADERS
-  });
-  const token = engine.config.server.authToken;
-  if (token || login) {
-    app.addHook("onRequest", async (request, reply) => {
-      if (request.method === "OPTIONS") return;
-      const surface = surfaceOf(request.url);
-      if (surface === "other") return;
-      if (pathOf(request.url).startsWith("/api/auth/")) return;
-      let provided = bearer(request);
-      if (!provided && pathOf(request.url) === "/api/events") {
-        const query = request.query;
-        if (typeof query?.token === "string") provided = query.token;
-      }
-      if (provided && token && safeEqual(provided, token)) return;
-      if (surface === "api" && login?.user(authCookie(request, "dc_session"))) {
-        if (!["GET", "HEAD"].includes(request.method) && request.headers.origin !== login.options.origin) {
-          return sendApiError(
-            reply,
-            403,
-            "invalid_origin",
-            "Open DaveCode from its configured origin."
-          );
-        }
-        return;
-      }
-      const message = "Missing or invalid bearer token";
-      if (surface === "v1") {
-        return sendOpenAIError(reply, 401, {
-          message,
-          type: "authentication_error",
-          code: "invalid_api_key"
-        });
-      }
-      return sendApiError(reply, 401, "unauthorized", message);
-    });
+  if (command.includes("/") || command.includes("\\") || path.isAbsolute(command)) {
+    return isFile(command) ? command : void 0;
   }
-  app.addContentTypeParser("application/json", { parseAs: "string" }, (_request, body, done) => {
-    const text = typeof body === "string" ? body : body.toString("utf8");
-    if (text.trim() === "") return done(null, void 0);
-    try {
-      done(null, JSON.parse(text));
-    } catch (err) {
-      const error = Object.assign(err instanceof Error ? err : new Error("Invalid JSON"), {
-        statusCode: 400
-      });
-      done(error, void 0);
-    }
-  });
-  app.setErrorHandler((error, request, reply) => {
-    const status = typeof error.statusCode === "number" ? error.statusCode : 500;
-    const message = status >= 500 ? "Internal gateway error" : error instanceof Error ? error.message : "Error";
-    if (status >= 500) request.log.error({ err: error }, "request failed");
-    if (surfaceOf(request.url) === "v1") {
-      return sendOpenAIError(reply, status, {
-        message,
-        type: status >= 500 ? "api_error" : "invalid_request_error",
-        code: status >= 500 ? "internal_error" : "bad_request"
-      });
+  const win = platform === "win32";
+  const delimiter = win ? ";" : ":";
+  const dirs = splitPathEnv(env.PATH ?? env.Path ?? "", delimiter);
+  const exts = win ? [
+    ".exe",
+    ".com",
+    "",
+    ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").map((e) => e.toLowerCase()).filter((e) => e && e !== ".exe" && e !== ".com")
+  ] : [""];
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      const candidate = path.join(dir, command + ext);
+      if (isFile(candidate)) return candidate;
     }
-    return sendApiError(reply, status, status >= 500 ? "internal_error" : "bad_request", message);
-  });
-  const dashboardDir = engine.config.server.dashboard && options.dashboardDir && existsSync2(options.dashboardDir) ? resolve(options.dashboardDir) : void 0;
-  if (dashboardDir) {
-    await app.register(fastifyStatic, { root: dashboardDir });
   }
-  app.setNotFoundHandler((request, reply) => {
-    const surface = surfaceOf(request.url);
-    const message = `Unknown endpoint ${request.method} ${pathOf(request.url)}`;
-    if (surface === "v1") {
-      return sendOpenAIError(reply, 404, {
-        message,
-        type: "invalid_request_error",
-        code: "not_found"
-      });
-    }
-    if (surface === "api") return sendApiError(reply, 404, "not_found", message);
-    if (dashboardDir && (request.method === "GET" || request.method === "HEAD")) {
-      return reply.type("text/html; charset=utf-8").sendFile("index.html");
-    }
-    return reply.code(404).send({ error: { message, code: "not_found" } });
-  });
-  registerV1Routes(app, engine);
-  registerAuthRoutes(app, login);
-  registerApiRoutes(app, engine, options);
-  registerEventRoutes(app, engine, options.heartbeatMs ?? 15e3);
-  return app;
+  return void 0;
 }
-var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost"]);
-async function startGateway(engine, options = {}) {
-  const app = await buildGateway(engine, options);
-  const host = options.host ?? engine.config.server.host;
-  const port = options.port ?? engine.config.server.port;
-  if (!engine.config.server.authToken && !LOOPBACK.has(host)) {
-    app.log.warn(
-      `Listening on ${host} without server.authToken: anyone on the network can use your accounts.`
-    );
+var SHELL_SAFE = /^[\w.:=@+\-/\\[\]]+$/;
+function spawnInteractive(command, args, options) {
+  const spawn = options.spawn ?? nodeSpawn;
+  const platform = options.platform ?? process.platform;
+  const shim = platform === "win32" && /\.(cmd|bat)$/i.test(command);
+  if (shim) {
+    const unsafe = args.find((a) => !SHELL_SAFE.test(a));
+    if (unsafe !== void 0) {
+      return Promise.reject(
+        new Error(`Argument ${JSON.stringify(unsafe)} cannot be passed safely to ${command}`)
+      );
+    }
   }
-  await app.listen({ host, port });
-  return app;
+  return new Promise((resolve3, reject) => {
+    const child = shim ? spawn(`"${command}"`, args, {
+      stdio: "inherit",
+      env: options.env,
+      shell: true,
+      ...options.cwd ? { cwd: options.cwd } : {}
+    }) : spawn(command, args, {
+      stdio: "inherit",
+      env: options.env,
+      ...options.cwd ? { cwd: options.cwd } : {}
+    });
+    child.on("error", reject);
+    child.on("exit", (code, signal) => resolve3(code ?? (signal ? 130 : 1)));
+  });
 }
 
 // src/lib/terminal.ts
-import { spawn as nodeSpawn2 } from "child_process";
 var SAFE_ACCOUNT_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
 function loginInvocation(accountId, argv = process.argv) {
   if (!SAFE_ACCOUNT_ID.test(accountId)) throw new Error("Invalid account id");
@@ -1442,7 +1444,7 @@ function terminalCommand(argv, options = {}) {
 }
 function launchLoginTerminal(accountId, options = {}) {
   const platform = options.platform ?? process.platform;
-  const target = terminalCommand(loginInvocation(accountId), options);
+  const target = terminalCommand(loginInvocation(accountId, options.argv), options);
   if (!target) return Promise.resolve(false);
   const spawn = options.spawn ?? nodeSpawn2;
   return new Promise((resolve3) => {
@@ -1551,7 +1553,7 @@ async function startRuntime(options) {
     } : void 0;
     const app = await startGateway(engine, {
       logger: options.logger ?? false,
-      ...loginLauncher ? { loginLauncher } : {},
+      ...options.loginLauncher ?? loginLauncher ? { loginLauncher: options.loginLauncher ?? loginLauncher } : {},
       ...dashboardDir ? { dashboardDir } : {},
       ...project ? { brain: project.source, runner: project.runner, goals: project.goals } : {},
       ...options.host !== void 0 ? { host: options.host } : {},
@@ -1602,9 +1604,11 @@ export {
   accountPatchSchema,
   which,
   spawnInteractive,
+  launchLoginTerminal,
   detectProjectRoot,
   wireProject,
   resolveDashboardDir,
+  resolveProjectRoot,
   startRuntime
 };
-//# sourceMappingURL=chunk-PIIJ3RSI.js.map
+//# sourceMappingURL=chunk-FYPMA55O.js.map