@dmrlzz/davecode 0.5.0 → 0.5.2

package/dist/{chunk-FYPMA55O.js → chunk-KUY3QHGS.js}

@@ -1,3 +1,6 @@
+import {
+  openBrowser
+} from "./chunk-732GIHRQ.js";
 import {
   ConfigError,
   PROVIDER_KINDS,
@@ -9,16 +12,20 @@ import {
   TaskGraphError,
   VERSION,
   WorkspaceLock,
+  apiConfigIssues,
   connectionMethod,
+  createAccountControl,
   createEngine,
   createGoalService,
   createRunner,
+  endpointRebindIssue,
   loginCommandFor,
   loginFromEnv,
+  mergeApiConfig,
   newId2,
   routeSchema,
   taskIdSchema
-} from "./chunk-HSBJDV3O.js";
+} from "./chunk-QKY3OKVG.js";
 
 // src/runtime.ts
 import { existsSync as existsSync3 } from "fs";
@@ -34,13 +41,14 @@ import { resolve } from "path";
 import cors from "@fastify/cors";
 import fastifyStatic from "@fastify/static";
 import Fastify from "fastify";
-import { z as z4 } from "zod";
 import { z } from "zod";
+import { z as z5 } from "zod";
 import { z as z2 } from "zod";
 import { z as z3 } from "zod";
-import { z as z5 } from "zod";
-import { Readable } from "stream";
+import { z as z4 } from "zod";
 import { z as z6 } from "zod";
+import { Readable } from "stream";
+import { z as z7 } from "zod";
 function sendApiError(reply, status, code, message, extra = {}) {
   return reply.code(status).send({ error: { message, code, ...extra } });
 }
@@ -89,55 +97,81 @@ function describeRoutingError(err) {
     body: { message: "Internal gateway error", type: "api_error", code: "internal_error" }
   };
 }
-var providerKind = z.enum(PROVIDER_KINDS);
-var contentPart = z.discriminatedUnion("type", [
-  z.object({ type: z.literal("text"), text: z.string() }),
-  z.object({
-    type: z.literal("image_url"),
-    image_url: z.object({
-      url: z.string(),
-      detail: z.enum(["auto", "low", "high"]).optional()
+var loginSchema = z.object({ provider: z.enum(["google", "github"]).optional() });
+function registerAccountRoutes(app, account) {
+  if (!account) return;
+  app.get("/api/account", async (_request, reply) => {
+    reply.header("Cache-Control", "no-store");
+    return account.state();
+  });
+  app.post("/api/account/login", async (request, reply) => {
+    const parsed = loginSchema.safeParse(request.body ?? {});
+    if (!parsed.success)
+      return sendApiError(reply, 400, "invalid_body", "Unknown sign-in provider.");
+    try {
+      return reply.code(202).send(await account.login(parsed.data.provider));
+    } catch {
+      return sendApiError(reply, 502, "account_unavailable", "Could not start the sign-in.");
+    }
+  });
+  app.post("/api/account/cancel", async (_request, reply) => {
+    await account.cancel();
+    return reply.code(204).send();
+  });
+  app.post("/api/account/logout", async (_request, reply) => {
+    await account.logout();
+    return reply.code(204).send();
+  });
+}
+var providerKind = z2.enum(PROVIDER_KINDS);
+var contentPart = z2.discriminatedUnion("type", [
+  z2.object({ type: z2.literal("text"), text: z2.string() }),
+  z2.object({
+    type: z2.literal("image_url"),
+    image_url: z2.object({
+      url: z2.string(),
+      detail: z2.enum(["auto", "low", "high"]).optional()
     })
   })
 ]);
-var toolCall = z.object({
-  id: z.string(),
-  type: z.literal("function"),
-  function: z.object({ name: z.string(), arguments: z.string() })
+var toolCall = z2.object({
+  id: z2.string(),
+  type: z2.literal("function"),
+  function: z2.object({ name: z2.string(), arguments: z2.string() })
 });
-var chatMessage = z.object({
-  role: z.enum(["system", "user", "assistant", "tool"]),
-  content: z.union([z.string(), z.array(contentPart), z.null()]),
-  name: z.string().optional(),
-  tool_call_id: z.string().optional(),
-  tool_calls: z.array(toolCall).optional()
+var chatMessage = z2.object({
+  role: z2.enum(["system", "user", "assistant", "tool"]),
+  content: z2.union([z2.string(), z2.array(contentPart), z2.null()]),
+  name: z2.string().optional(),
+  tool_call_id: z2.string().optional(),
+  tool_calls: z2.array(toolCall).optional()
 });
-var chatRequestSchema = z.object({
-  model: z.string().min(1),
-  messages: z.array(chatMessage).min(1),
-  stream: z.boolean().optional(),
-  temperature: z.number().min(0).max(2).optional(),
-  top_p: z.number().min(0).max(1).optional(),
-  max_tokens: z.number().int().positive().optional(),
-  stop: z.union([z.string(), z.array(z.string())]).optional(),
-  tools: z.array(
-    z.object({
-      type: z.literal("function"),
-      function: z.object({
-        name: z.string(),
-        description: z.string().optional(),
-        parameters: z.record(z.string(), z.unknown()).optional()
+var chatRequestSchema = z2.object({
+  model: z2.string().min(1),
+  messages: z2.array(chatMessage).min(1),
+  stream: z2.boolean().optional(),
+  temperature: z2.number().min(0).max(2).optional(),
+  top_p: z2.number().min(0).max(1).optional(),
+  max_tokens: z2.number().int().positive().optional(),
+  stop: z2.union([z2.string(), z2.array(z2.string())]).optional(),
+  tools: z2.array(
+    z2.object({
+      type: z2.literal("function"),
+      function: z2.object({
+        name: z2.string(),
+        description: z2.string().optional(),
+        parameters: z2.record(z2.string(), z2.unknown()).optional()
       })
     })
   ).optional(),
-  tool_choice: z.union([
-    z.enum(["auto", "none", "required"]),
-    z.object({ type: z.literal("function"), function: z.object({ name: z.string() }) })
+  tool_choice: z2.union([
+    z2.enum(["auto", "none", "required"]),
+    z2.object({ type: z2.literal("function"), function: z2.object({ name: z2.string() }) })
   ]).optional(),
-  user: z.string().optional()
+  user: z2.string().optional()
 });
-var positiveInt = z.number().int().positive();
-var quotaLimits = z.object({
+var positiveInt = z2.number().int().positive();
+var quotaLimits = z2.object({
   tpm: positiveInt.optional(),
   rpm: positiveInt.optional(),
   tokens5h: positiveInt.optional(),
@@ -146,41 +180,41 @@ var quotaLimits = z.object({
   requestsDaily: positiveInt.optional()
 }).strict();
 var SECRET_KEY = /^(api[-_]?key|secret|client[-_]?secret|(access|refresh|session|auth|bearer)?[-_]?token|password|passwd|cookies?|authorization|credentials?)$/i;
-var accountConfig = z.record(z.string(), z.unknown()).refine((config) => !Object.keys(config).some((key) => SECRET_KEY.test(key)), {
+var accountConfig = z2.record(z2.string(), z2.unknown()).refine((config) => !Object.keys(config).some((key) => SECRET_KEY.test(key)), {
   message: 'config must not contain credentials; send them in "secret" instead'
 });
-var subscriptionDate = z.string().trim().refine(
+var subscriptionDate = z2.string().trim().refine(
   (value) => /^\d{4}-\d{2}-\d{2}(T[\d:.]+(Z|[+-]\d{2}:?\d{2})?)?$/.test(value) && !Number.isNaN(Date.parse(value)),
   { message: "expected a date (YYYY-MM-DD) or an ISO timestamp" }
 );
-var subscriptionSchema = z.object({
-  plan: z.string().trim().min(1).max(120).optional(),
+var subscriptionSchema = z2.object({
+  plan: z2.string().trim().min(1).max(120).optional(),
   paidAt: subscriptionDate.optional(),
   renewsAt: subscriptionDate.optional(),
-  price: z.object({
-    amount: z.number().min(0).max(1e6),
-    currency: z.string().trim().regex(/^[A-Za-z]{3}$/, "expected a 3-letter currency code").transform((c) => c.toUpperCase()),
-    period: z.enum(["month", "year"])
+  price: z2.object({
+    amount: z2.number().min(0).max(1e6),
+    currency: z2.string().trim().regex(/^[A-Za-z]{3}$/, "expected a 3-letter currency code").transform((c) => c.toUpperCase()),
+    period: z2.enum(["month", "year"])
   }).strict().optional(),
-  notes: z.string().trim().max(1e3).optional()
+  notes: z2.string().trim().max(1e3).optional()
 }).strict();
 var accountFields = {
-  label: z.string().trim().min(1).max(200),
-  enabled: z.boolean().optional(),
-  priority: z.number().int().min(0).max(1e6).optional(),
-  weight: z.number().min(0).max(1e3).optional(),
+  label: z2.string().trim().min(1).max(200),
+  enabled: z2.boolean().optional(),
+  priority: z2.number().int().min(0).max(1e6).optional(),
+  weight: z2.number().min(0).max(1e3).optional(),
   limits: quotaLimits.optional(),
   config: accountConfig.optional(),
   /** API key / token. Encrypted at rest and never returned. */
-  secret: z.string().min(1).max(1e5).optional()
+  secret: z2.string().min(1).max(1e5).optional()
 };
-var accountCreateSchema = z.object({ provider: providerKind, ...accountFields, subscription: subscriptionSchema.optional() }).strict();
-var accountPatchSchema = z.object({
+var accountCreateSchema = z2.object({ provider: providerKind, ...accountFields, subscription: subscriptionSchema.optional() }).strict();
+var accountPatchSchema = z2.object({
   ...accountFields,
   label: accountFields.label.optional(),
   subscription: subscriptionSchema.nullable().optional()
 }).strict();
-var routesUpdateSchema = z.object({ routes: z.array(routeSchema).max(200), defaultRoute: z.string().min(1).optional() }).strict().superRefine((body, ctx) => {
+var routesUpdateSchema = z2.object({ routes: z2.array(routeSchema).max(200), defaultRoute: z2.string().min(1).optional() }).strict().superRefine((body, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   body.routes.forEach((route, index) => {
     if (seen.has(route.name)) {
@@ -201,14 +235,14 @@ var routesUpdateSchema = z.object({ routes: z.array(routeSchema).max(200), defau
   }
 });
 var taskText = {
-  title: z.string().trim().min(1).max(300),
-  description: z.string().max(5e4),
-  acceptance: z.array(z.string().trim().min(1).max(2e3)).max(100),
-  notes: z.string().max(5e4),
-  dependsOn: z.array(z.string().min(1)).max(500),
-  priority: z.number().finite()
+  title: z2.string().trim().min(1).max(300),
+  description: z2.string().max(5e4),
+  acceptance: z2.array(z2.string().trim().min(1).max(2e3)).max(100),
+  notes: z2.string().max(5e4),
+  dependsOn: z2.array(z2.string().min(1)).max(500),
+  priority: z2.number().finite()
 };
-var taskCreateSchema = z.object({
+var taskCreateSchema = z2.object({
   id: taskIdSchema,
   title: taskText.title,
   description: taskText.description.optional(),
@@ -216,30 +250,30 @@ var taskCreateSchema = z.object({
   priority: taskText.priority.optional(),
   acceptance: taskText.acceptance.optional()
 }).strict();
-var taskPatchSchema = z.object({
+var taskPatchSchema = z2.object({
   title: taskText.title.optional(),
   description: taskText.description.nullable().optional(),
   dependsOn: taskText.dependsOn.optional(),
   priority: taskText.priority.nullable().optional(),
   acceptance: taskText.acceptance.nullable().optional(),
   notes: taskText.notes.nullable().optional(),
-  status: z.enum(TASK_STATUSES).optional()
+  status: z2.enum(TASK_STATUSES).optional()
 }).strict().refine((patch) => Object.values(patch).some((v) => v !== void 0), {
   message: "send at least one field to change"
 });
-var runnerStartSchema = z.object({ taskId: z.string().min(1).optional() }).strict();
-var goalStartSchema = z.object({
-  objective: z.string().trim().min(1).max(4e3),
-  maxRounds: z.number().int().min(1).max(20).optional(),
-  maxTasks: z.number().int().min(1).max(100).optional(),
-  maxTokens: z.number().int().min(1e3).optional(),
-  dryRun: z.boolean().optional()
+var runnerStartSchema = z2.object({ taskId: z2.string().min(1).optional() }).strict();
+var goalStartSchema = z2.object({
+  objective: z2.string().trim().min(1).max(4e3),
+  maxRounds: z2.number().int().min(1).max(20).optional(),
+  maxTasks: z2.number().int().min(1).max(100).optional(),
+  maxTokens: z2.number().int().min(1e3).optional(),
+  dryRun: z2.boolean().optional()
 }).strict();
-var timeseriesQuerySchema = z.object({
-  minutes: z.coerce.number().int().min(1).max(7 * 24 * 60).default(60),
-  bucketSec: z.coerce.number().int().min(1).max(86400).default(60)
+var timeseriesQuerySchema = z2.object({
+  minutes: z2.coerce.number().int().min(1).max(7 * 24 * 60).default(60),
+  bucketSec: z2.coerce.number().int().min(1).max(86400).default(60)
 });
-var limitQuerySchema = (fallback, max = 1e3) => z.object({ limit: z.coerce.number().int().min(1).max(max).default(fallback) });
+var limitQuerySchema = (fallback, max = 1e3) => z2.object({ limit: z2.coerce.number().int().min(1).max(max).default(fallback) });
 function registerGoalRoutes(app, engine, options) {
   const { audit } = engine;
   const unavailable = (reply) => sendApiError(
@@ -281,7 +315,7 @@ function registerGoalRoutes(app, engine, options) {
   app.post("/api/goals", async (request, reply) => {
     const parsed = goalStartSchema.safeParse(request.body);
     if (!parsed.success) {
-      return sendApiError(reply, 400, "invalid_body", z2.prettifyError(parsed.error));
+      return sendApiError(reply, 400, "invalid_body", z3.prettifyError(parsed.error));
     }
     const goals = control(reply);
     if (!goals) return reply;
@@ -385,7 +419,7 @@ function registerTaskRoutes(app, engine, options) {
   app.post("/api/tasks", async (request, reply) => {
     const parsed = taskCreateSchema.safeParse(request.body);
     if (!parsed.success) {
-      return sendApiError(reply, 400, "invalid_body", z3.prettifyError(parsed.error));
+      return sendApiError(reply, 400, "invalid_body", z4.prettifyError(parsed.error));
     }
     const brain = writable(reply);
     if (isReply(brain)) return brain;
@@ -400,7 +434,7 @@ function registerTaskRoutes(app, engine, options) {
   app.patch("/api/tasks/:id", async (request, reply) => {
     const parsed = taskPatchSchema.safeParse(request.body);
     if (!parsed.success) {
-      return sendApiError(reply, 400, "invalid_body", z3.prettifyError(parsed.error));
+      return sendApiError(reply, 400, "invalid_body", z4.prettifyError(parsed.error));
     }
     const brain = writable(reply);
     if (isReply(brain)) return brain;
@@ -443,7 +477,7 @@ function isReply(value) {
 var EMPTY_GRAPH = { version: 1, tasks: [] };
 var IDLE = { state: "idle" };
 function invalid(reply, error) {
-  return sendApiError(reply, 400, "invalid_body", z4.prettifyError(error));
+  return sendApiError(reply, 400, "invalid_body", z5.prettifyError(error));
 }
 function registerApiRoutes(app, engine, options) {
   const { accounts, events, audit, quota, keyring } = engine;
@@ -460,6 +494,10 @@ function registerApiRoutes(app, engine, options) {
     const parsed = accountCreateSchema.safeParse(request.body);
     if (!parsed.success) return invalid(reply, parsed.error);
     const { secret, ...input } = parsed.data;
+    const configIssues = input.config ? apiConfigIssues(input.provider, input.config) : [];
+    if (configIssues.length > 0) {
+      return sendApiError(reply, 400, "invalid_body", configIssues.join("; "));
+    }
     if (input.provider === "gemini-web" && !engine.config.experimental.geminiWeb) {
       return sendApiError(
         reply,
@@ -489,6 +527,15 @@ function registerApiRoutes(app, engine, options) {
     if (!existing) return sendApiError(reply, 404, "not_found", "Account not found");
     const { secret, ...fields } = parsed.data;
     const patch = { ...fields };
+    if (fields.config) {
+      const configIssues = apiConfigIssues(existing.provider, fields.config, existing.config);
+      if (configIssues.length > 0) {
+        return sendApiError(reply, 400, "invalid_body", configIssues.join("; "));
+      }
+      patch.config = mergeApiConfig(existing.provider, existing.config, fields.config);
+      const rebind = endpointRebindIssue(existing, patch.config, secret !== void 0);
+      if (rebind) return sendApiError(reply, 400, "secret_required", rebind);
+    }
     const enabled = fields.enabled ?? existing.enabled;
     if (!enabled) {
       patch.status = "disabled";
@@ -536,9 +583,6 @@ function registerApiRoutes(app, engine, options) {
     return { connection: await engine.connections.check(account) };
   });
   app.post("/api/accounts/:id/connect", async (request, reply) => {
-    if (!request.headers["content-type"]?.toLowerCase().startsWith("application/json")) {
-      return sendApiError(reply, 415, "json_required", "Send Content-Type: application/json");
-    }
     const account = accounts.get(request.params.id);
     if (!account) return sendApiError(reply, 404, "not_found", "Account not found");
     if (connectionMethod(account.provider) !== "cli-login") {
@@ -716,7 +760,7 @@ function registerAuthRoutes(app, login) {
     return reply.header("Cache-Control", "no-store").header("Set-Cookie", cookie("dc_session", "", 0, secure)).code(204).send();
   });
   for (const provider of ["google", "github"]) {
-    app.get(`/api/auth/${provider}/start`, async (_request, reply) => {
+    app.get(`/api/auth/${provider}/start`, async (request, reply) => {
       if (!login?.options.providers[provider])
         return sendApiError(
           reply,
@@ -725,7 +769,7 @@ function registerAuthRoutes(app, login) {
           "This sign-in provider is not configured."
         );
       try {
-        const flow = login.begin(provider);
+        const flow = login.begin(provider, request.ip);
         return reply.header("Cache-Control", "no-store").header("Referrer-Policy", "no-referrer").header("Set-Cookie", cookie("dc_login", flow.binding, 600, secure)).redirect(flow.url);
       } catch {
         return sendApiError(reply, 429, "login_busy", "Sign-in is busy. Try again shortly.");
@@ -735,7 +779,7 @@ function registerAuthRoutes(app, login) {
       reply.header("Cache-Control", "no-store").header("Referrer-Policy", "no-referrer");
       if (!login)
         return sendApiError(reply, 503, "login_not_configured", "Sign-in is not configured.");
-      const parsed = z5.object({ state: z5.string().min(1).max(200), code: z5.string().min(1).max(4096) }).safeParse(request.query);
+      const parsed = z6.object({ state: z6.string().min(1).max(200), code: z6.string().min(1).max(4096) }).safeParse(request.query);
       const binding = authCookie(request, "dc_login");
       if (!parsed.success || !binding)
         return reply.redirect(`${login.options.origin}/#/login?error=signin_failed`);
@@ -835,7 +879,7 @@ function registerV1Routes(app, engine) {
     const parsed = chatRequestSchema.safeParse(request.body);
     if (!parsed.success) {
       return sendOpenAIError(reply, 400, {
-        message: z6.prettifyError(parsed.error),
+        message: z7.prettifyError(parsed.error),
         type: "invalid_request_error",
         code: "invalid_body"
       });
@@ -879,12 +923,43 @@ function pathOf(url) {
   const q = url.indexOf("?");
   return q === -1 ? url : url.slice(0, q);
 }
-function surfaceOf(url) {
+function normalisedPath(url) {
   const path2 = pathOf(url);
+  try {
+    return decodeURIComponent(path2).toLowerCase();
+  } catch {
+    return path2.toLowerCase();
+  }
+}
+function surfaceOf(url) {
+  const path2 = normalisedPath(url);
   if (path2 === "/v1" || path2.startsWith("/v1/")) return "v1";
   if (path2 === "/api" || path2.startsWith("/api/")) return "api";
   return "other";
 }
+var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
+  "/api/auth/session",
+  "/api/auth/logout",
+  "/api/auth/google/start",
+  "/api/auth/google/callback",
+  "/api/auth/github/start",
+  "/api/auth/github/callback"
+]);
+var STATIC_ROUTES = /* @__PURE__ */ new Set(["/", "/*"]);
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function splitHost(header) {
+  const match = /^(\[[0-9a-f:.]+\]|[^:/\\@\s]+)(?::(\d{1,5}))?$/i.exec(header.trim());
+  if (!match?.[1]) return void 0;
+  return { name: match[1].toLowerCase(), port: match[2] ?? "" };
+}
+function originOf(value) {
+  try {
+    const url = new URL(value);
+    return url.origin === "null" ? void 0 : url.origin;
+  } catch {
+    return void 0;
+  }
+}
 function redactUrl(url) {
   return url.replace(/([?&](?:token|code|state|error_description)=)[^&]*/gi, "$1[redacted]");
 }
@@ -914,9 +989,53 @@ async function buildGateway(engine, options = {}) {
   const app = Fastify({ logger: loggerOption(options.logger), bodyLimit: 10 * 1024 * 1024 });
   const login = options.login === false ? void 0 : options.login ?? loginFromEnv(process.env);
   if (login) app.addHook("onClose", async () => login.clear());
+  const bindHost = (options.host ?? engine.config.server.host).toLowerCase();
+  const loopbackBind = LOOPBACK.has(bindHost);
+  const extraOrigins = [
+    ...options.dev ? DEFAULT_CORS_ORIGINS : [],
+    ...options.corsOrigins ?? [],
+    ...login ? [login.options.origin] : []
+  ].map(originOf).filter((origin) => origin !== void 0);
+  const allowedOrigins = new Set(extraOrigins);
+  const extraHosts = new Set(
+    [...options.corsOrigins ?? [], ...login ? [login.options.origin] : []].map(originOf).filter((origin) => origin !== void 0).map((origin) => new URL(origin).host.toLowerCase())
+  );
+  function hostAllowed(request) {
+    if (!loopbackBind) return true;
+    const header = request.headers.host;
+    if (!header) return false;
+    if (extraHosts.has(header.toLowerCase())) return true;
+    const parsed = splitHost(header);
+    if (!parsed || !["127.0.0.1", "localhost", "[::1]"].includes(parsed.name)) return false;
+    const actual = request.raw.socket?.localPort;
+    return actual === void 0 || Number(parsed.port || 80) === actual;
+  }
+  function originAllowed(request) {
+    const origin = request.headers.origin;
+    if (origin === void 0) return true;
+    const normalised = originOf(origin);
+    if (!normalised) return false;
+    if (allowedOrigins.has(normalised)) return true;
+    const host = request.headers.host?.toLowerCase();
+    return host !== void 0 && new URL(normalised).host.toLowerCase() === host;
+  }
+  app.addHook("onRequest", async (request, reply) => {
+    const surface = surfaceOf(request.routeOptions.url ?? request.url);
+    const reject = (status, code, message) => surface === "v1" ? sendOpenAIError(reply, status, { message, type: "invalid_request_error", code }) : sendApiError(reply, status, code, message);
+    if (!hostAllowed(request)) return reject(403, "invalid_host", "Unexpected Host header.");
+    if (surface !== "api" || SAFE_METHODS.has(request.method)) return;
+    if (!originAllowed(request)) {
+      return reject(403, "invalid_origin", "Requests from this origin are not allowed.");
+    }
+    if (PUBLIC_ROUTES.has(request.routeOptions.url ?? "")) return;
+    if (request.method !== "POST") return;
+    if (!request.headers["content-type"]?.toLowerCase().startsWith("application/json")) {
+      return reject(415, "json_required", "Send Content-Type: application/json");
+    }
+  });
   await app.register(cors, {
-    origin: [...DEFAULT_CORS_ORIGINS, ...options.corsOrigins ?? []],
-    methods: ["GET", "POST", "PATCH", "DELETE", "OPTIONS"],
+    origin: [...options.dev ? DEFAULT_CORS_ORIGINS : [], ...options.corsOrigins ?? []],
+    methods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
     allowedHeaders: ["content-type", "authorization"],
     exposedHeaders: EXPOSED_HEADERS
   });
@@ -924,16 +1043,21 @@ async function buildGateway(engine, options = {}) {
   if (token || login) {
     app.addHook("onRequest", async (request, reply) => {
       if (request.method === "OPTIONS") return;
+      const route = request.routeOptions.url;
+      if (route !== void 0) {
+        if (PUBLIC_ROUTES.has(route)) return;
+        if (STATIC_ROUTES.has(route) && (request.method === "GET" || request.method === "HEAD"))
+          return;
+      }
       const surface = surfaceOf(request.url);
-      if (surface === "other") return;
-      if (pathOf(request.url).startsWith("/api/auth/")) return;
+      const isV1 = route === "/v1" || route?.startsWith("/v1/") || surface === "v1";
       let provided = bearer(request);
-      if (!provided && pathOf(request.url) === "/api/events") {
+      if (!provided && route === "/api/events") {
         const query = request.query;
         if (typeof query?.token === "string") provided = query.token;
       }
       if (provided && token && safeEqual(provided, token)) return;
-      if (surface === "api" && login?.user(authCookie(request, "dc_session"))) {
+      if (!isV1 && login?.user(authCookie(request, "dc_session"))) {
         if (!["GET", "HEAD"].includes(request.method) && request.headers.origin !== login.options.origin) {
           return sendApiError(
             reply,
@@ -945,7 +1069,7 @@ async function buildGateway(engine, options = {}) {
         return;
       }
       const message = "Missing or invalid bearer token";
-      if (surface === "v1") {
+      if (isV1) {
         return sendOpenAIError(reply, 401, {
           message,
           type: "authentication_error",
@@ -1002,14 +1126,15 @@ async function buildGateway(engine, options = {}) {
   });
   registerV1Routes(app, engine);
   registerAuthRoutes(app, login);
+  registerAccountRoutes(app, options.account);
   registerApiRoutes(app, engine, options);
   registerEventRoutes(app, engine, options.heartbeatMs ?? 15e3);
   return app;
 }
 var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost"]);
 async function startGateway(engine, options = {}) {
-  const app = await buildGateway(engine, options);
   const host = options.host ?? engine.config.server.host;
+  const app = await buildGateway(engine, { ...options, host });
   const port = options.port ?? engine.config.server.port;
   if (!engine.config.server.authToken && !LOOPBACK.has(host)) {
     app.log.warn(
@@ -1215,10 +1340,9 @@ var GatewayClient = class {
   }
   async request(method, path2, body, options = {}) {
     const init = { method };
-    if (body !== void 0) {
-      init.body = JSON.stringify(body);
+    if (body !== void 0) init.body = JSON.stringify(body);
+    if (body !== void 0 || method !== "GET")
       init.headers = { "content-type": "application/json" };
-    }
     const res = await this.fetch(path2, init, { timeoutMs: 1e4, ...options });
     if (!res.ok) throw await errorFrom(res);
     if (res.status === 204) return void 0;
@@ -1541,18 +1665,25 @@ async function startRuntime(options) {
     ...projectRoot ? { projectRoot } : {},
     ...options.config ? { config: options.config } : {}
   });
+  let account;
   try {
     const project = projectRoot ? wireProject(engine, projectRoot, { env: options.env }) : void 0;
     const wantDashboard = options.dashboard !== false && engine.config.server.dashboard;
     const dashboardDir = wantDashboard ? resolveDashboardDir(options.env) : void 0;
     const bindHost = options.host ?? engine.config.server.host;
     const loginLauncher = LOOPBACK_HOSTS.has(bindHost) ? {
-      launch: async (account) => ({
-        launched: await launchLoginTerminal(account.id, { env: options.env })
+      launch: async (account2) => ({
+        launched: await launchLoginTerminal(account2.id, { env: options.env })
       })
     } : void 0;
+    account = LOOPBACK_HOSTS.has(bindHost) ? createAccountControl({
+      home: options.home,
+      env: options.env,
+      open: (url) => openBrowser(url)
+    }) : void 0;
     const app = await startGateway(engine, {
       logger: options.logger ?? false,
+      ...account ? { account } : {},
       ...options.loginLauncher ?? loginLauncher ? { loginLauncher: options.loginLauncher ?? loginLauncher } : {},
       ...dashboardDir ? { dashboardDir } : {},
       ...project ? { brain: project.source, runner: project.runner, goals: project.goals } : {},
@@ -1582,6 +1713,7 @@ async function startRuntime(options) {
           const active = goals?.activeGoalId;
           if (active) await goals?.cancel(active);
           await runner?.stop();
+          await account?.close();
           await app.close();
         } finally {
           engine.close();
@@ -1589,6 +1721,7 @@ async function startRuntime(options) {
       }
     };
   } catch (err) {
+    await account?.close();
     engine.close();
     throw err;
   }
@@ -1611,4 +1744,4 @@ export {
   resolveProjectRoot,
   startRuntime
 };
-//# sourceMappingURL=chunk-FYPMA55O.js.map
+//# sourceMappingURL=chunk-KUY3QHGS.js.map