@event4u/agent-config 2.26.0 → 3.1.0

package/dist/server/app.js

@@ -0,0 +1,125 @@
+/**
+ * Fastify app factory for the local server.
+ *
+ * Security stance — council security-engineer mandate:
+ *
+ *   1. Bind to 127.0.0.1 only (enforced by the caller in
+ *      `src/cli/commands/uiServe.ts`).
+ *   2. `Host` header must be `127.0.0.1:<port>` or
+ *      `localhost:<port>`. Rejected with HTTP 421 otherwise.
+ *   3. `Origin` header (when present) must be the same origin as
+ *      the server. Rejected with HTTP 403 otherwise.
+ *   4. `/api/*` routes require `Authorization: Bearer <token>` or
+ *      a `token=<token>` query parameter. Rejected with HTTP 401
+ *      otherwise. The token is minted per process by
+ *      `src/server/token.ts`.
+ *
+ * Static files under `/` (the Vite UI bundle) are served without
+ * auth so the browser can bootstrap. The UI then includes the token
+ * on every API call.
+ */
+import Fastify from 'fastify';
+import fastifyStatic from '@fastify/static';
+import { tokensMatch } from './token.js';
+import { pingRoute } from './routes/ping.js';
+import { discoveryRoute } from './routes/discovery.js';
+import { schemaRoute } from './routes/schema.js';
+import { settingsRoute } from './routes/settings.js';
+import { userMdRoute } from './routes/userMd.js';
+import { wizardRoute } from './routes/wizard.js';
+import { replayPendingCommits } from './io/atomicMultiWrite.js';
+import { PACKAGE_ROOT } from '../cli/paths.js';
+const ALLOWED_HOSTS = (port) => new Set([`127.0.0.1:${port}`, `localhost:${port}`]);
+const ALLOWED_ORIGINS = (port) => new Set([`http://127.0.0.1:${port}`, `http://localhost:${port}`]);
+function extractToken(authHeader, queryToken) {
+    if (typeof authHeader === 'string' && authHeader.startsWith('Bearer ')) {
+        return authHeader.slice('Bearer '.length).trim();
+    }
+    if (typeof queryToken === 'string' && queryToken.length > 0)
+        return queryToken;
+    return null;
+}
+export async function createApp(opts) {
+    const app = Fastify({
+        logger: { level: opts.logLevel ?? (process.env.AGENT_CONFIG_LOG ?? 'warn') },
+    });
+    const allowedHosts = ALLOWED_HOSTS(opts.expectedPort);
+    const allowedOrigins = ALLOWED_ORIGINS(opts.expectedPort);
+    // Host-header guard (CSRF defence-in-depth — runs on every request).
+    app.addHook('onRequest', async (request, reply) => {
+        const host = request.headers.host;
+        if (typeof host !== 'string' || !allowedHosts.has(host)) {
+            await reply.code(421).send({ error: 'Misdirected Request: invalid Host header' });
+            return reply;
+        }
+        return undefined;
+    });
+    // Origin allow-list (browser-issued requests only — server-to-server
+    // skips this header).
+    app.addHook('onRequest', async (request, reply) => {
+        const origin = request.headers.origin;
+        if (typeof origin === 'string' && !allowedOrigins.has(origin)) {
+            await reply.code(403).send({ error: 'Forbidden: origin not allowed' });
+            return reply;
+        }
+        return undefined;
+    });
+    // Bearer-token gate for /api/*. Static UI files are NOT gated so
+    // the browser can bootstrap and read the token from the page URL.
+    app.addHook('onRequest', async (request, reply) => {
+        if (!request.url.startsWith('/api/'))
+            return undefined;
+        const query = request.query;
+        const queryToken = typeof query?.['token'] === 'string' ? query['token'] : undefined;
+        const provided = extractToken(request.headers.authorization, queryToken);
+        if (provided === null || !tokensMatch(provided, opts.token)) {
+            await reply.code(401).send({ error: 'Unauthorized: missing or invalid token' });
+            return reply;
+        }
+        return undefined;
+    });
+    await app.register(fastifyStatic, {
+        root: opts.uiDistDir,
+        prefix: '/',
+        decorateReply: false,
+    });
+    const packageRoot = opts.packageRoot ?? PACKAGE_ROOT;
+    const dryRun = opts.dryRun === true;
+    const writeRoot = opts.writeRoot ?? opts.projectRoot;
+    if (writeRoot === undefined) {
+        throw new Error('createApp: writeRoot (or projectRoot) is required');
+    }
+    const legacyReadRoot = opts.legacyReadRoot ?? null;
+    const projectScopeRoot = opts.projectScopeRoot ?? null;
+    const mode = opts.mode ?? 'global';
+    await app.register(pingRoute({ writeRoot, projectScopeRoot, mode, dryRun }));
+    await app.register(discoveryRoute(opts.discoveryManifestPath ? { manifestPath: opts.discoveryManifestPath } : {}));
+    await app.register(schemaRoute());
+    await app.register(settingsRoute({ writeRoot, legacyReadRoot, packageRoot, dryRun }));
+    await app.register(userMdRoute({ writeRoot, legacyReadRoot, dryRun }));
+    await app.register(wizardRoute({
+        writeRoot,
+        legacyReadRoot,
+        projectScopeRoot,
+        packageRoot,
+        dryRun,
+        extendedSteps: opts.extendedSteps === true,
+    }));
+    // Boot-time 2PC replay — finishes or aborts any wizard commit that
+    // crashed mid-rename. Idempotent; failures are logged and ignored so
+    // a corrupt marker never blocks server start. Skipped in dry-run: a
+    // crashed real run must not be auto-finished by a maintainer preview.
+    if (opts.skipReplay !== true && !dryRun) {
+        try {
+            const result = await replayPendingCommits(writeRoot);
+            if (result.completed.length > 0 || result.aborted.length > 0) {
+                app.log.warn({ completed: result.completed, aborted: result.aborted }, '2PC replay: pending wizard commits resolved');
+            }
+        }
+        catch (err) {
+            app.log.error({ err }, '2PC replay: unexpected error (ignored)');
+        }
+    }
+    return app;
+}
+//# sourceMappingURL=app.js.map

package/dist/server/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/server/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,OAAiC,MAAM,SAAS,CAAC;AACxD,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAwE/C,MAAM,aAAa,GAAG,CAAC,IAAY,EAAuB,EAAE,CACxD,IAAI,GAAG,CAAC,CAAC,aAAa,IAAI,EAAE,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;AAExD,MAAM,eAAe,GAAG,CAAC,IAAY,EAAuB,EAAE,CAC1D,IAAI,GAAG,CAAC,CAAC,oBAAoB,IAAI,EAAE,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC,CAAC;AAEtE,SAAS,YAAY,CAAC,UAA8B,EAAE,UAA8B;IAChF,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrE,OAAO,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAC/E,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC;QAChB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC,EAAE;KAC/E,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAE1D,qEAAqE;IACrE,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,sBAAsB;IACtB,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,kEAAkE;IAClE,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAA4C,CAAC;QACnE,MAAM,UAAU,GAAG,OAAO,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAK,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACzE,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;YAChF,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE;QAC9B,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,MAAM,EAAE,GAAG;QACX,aAAa,EAAE,KAAK;KACvB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC;IACrD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC;IACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC;IACvD,MAAM,IAAI,GAAgB,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;IAEhD,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,CAAC,QAAQ,CACd,cAAc,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACjG,CAAC;IACF,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAClC,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC3B,SAAS;QACT,cAAc;QACd,gBAAgB;QAChB,WAAW;QACX,MAAM;QACN,aAAa,EAAE,IAAI,CAAC,aAAa,KAAK,IAAI;KAC7C,CAAC,CAAC,CAAC;IAEJ,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,sEAAsE;IACtE,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CACR,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EACxD,6CAA6C,CAChD,CAAC;YACN,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,wCAAwC,CAAC,CAAC;QACrE,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/server/io/atomicMultiWrite.js

@@ -0,0 +1,204 @@
+/**
+ * Multi-file atomic write with a 2PC intent marker.
+ *
+ * The wizard commits `.agent-settings.yml` and `.agent-user.md` in one
+ * gesture. A crash between the two renames would leave the project in a
+ * mixed state — settings new, user-md stale, or vice versa — which the
+ * council's HIGH-severity finding flagged as the worst case.
+ *
+ * Protocol (write phase):
+ *   1. Write every payload to its `<target>.tmp-<txnId>` sibling, fsync.
+ *   2. Write a `state/wizard-intent-<txnId>.json` marker listing the
+ *      `{tmp,target}` pairs. fsync the marker.
+ *   3. For each pair: rename tmp → target.
+ *   4. Unlink the marker.
+ *
+ * Crash recovery (replay on next boot, `replayPendingCommits`):
+ *   - Marker present + every `tmp` exists → finish the renames, unlink.
+ *   - Marker present + any `tmp` missing → assume aborted mid-prepare:
+ *     unlink the leftover tmps and the marker (target untouched).
+ *
+ * State dir lives under `<writeRoot>/state/` — in package-sandbox mode
+ * `writeRoot` is `<repo>/agents/`, so the marker dir is the gitignored
+ * `agents/runtime/state/` already shipped by the package gitignore template. In
+ * global mode `writeRoot` is `~/.event4u/agent-config/` and the marker
+ * dir lives outside any project tree.
+ */
+import { promises as fs } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { dirname, join } from 'node:path';
+import { tempPathFor } from './atomicWrite.js';
+const DEFAULT_MODE = 0o600;
+const STATE_SUBDIR = 'state';
+function markerPath(writeRoot, txnId) {
+    return join(writeRoot, STATE_SUBDIR, `wizard-intent-${txnId}.json`);
+}
+async function fsyncFile(path) {
+    const handle = await fs.open(path, 'r+');
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function writeJsonFsync(path, body) {
+    await fs.mkdir(dirname(path), { recursive: true });
+    const handle = await fs.open(path, 'w', 0o600);
+    try {
+        await handle.writeFile(JSON.stringify(body, null, 2));
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Commit every payload atomically. Resolves only after the marker has
+ * been unlinked — meaning every rename succeeded. On error, the caller
+ * sees the original files untouched; replay handles any leftover tmps.
+ */
+export async function commitMulti(payloads, opts) {
+    if (payloads.length === 0) {
+        throw new Error('commitMulti: at least one payload required');
+    }
+    const txnId = opts.txnId ?? randomUUID();
+    const entries = payloads.map((p) => ({
+        tmp: tempPathFor(p.target, txnId),
+        target: p.target,
+        mode: p.mode ?? DEFAULT_MODE,
+    }));
+    // Phase 1: write every tmp with fsync. Ensure parent dirs exist
+    // (payloads may target nested subdirs like `settings/.agent-user.yml`).
+    for (let i = 0; i < payloads.length; i++) {
+        const payload = payloads[i];
+        const entry = entries[i];
+        const { contents } = payload;
+        const { tmp, mode } = entry;
+        await fs.mkdir(dirname(entry.target), { recursive: true });
+        const handle = await fs.open(tmp, 'w', mode);
+        try {
+            const buf = typeof contents === 'string' ? Buffer.from(contents, 'utf8') : contents;
+            await handle.writeFile(buf);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    // Phase 2: write intent marker, fsync.
+    const marker = {
+        version: 1,
+        txnId,
+        createdAt: new Date().toISOString(),
+        entries,
+    };
+    const mPath = markerPath(opts.writeRoot, txnId);
+    await writeJsonFsync(mPath, marker);
+    // Phase 3: rename every tmp → target. A crash here is recoverable
+    // because the marker still points at every pending rename.
+    try {
+        for (const entry of entries) {
+            try {
+                await fs.rename(entry.tmp, entry.target);
+            }
+            catch (err) {
+                if (err.code === 'EPERM') {
+                    await fs.unlink(entry.target).catch(() => undefined);
+                    await fs.rename(entry.tmp, entry.target);
+                }
+                else {
+                    throw err;
+                }
+            }
+            await fs.chmod(entry.target, entry.mode).catch(() => undefined);
+        }
+    }
+    catch (err) {
+        // Mid-commit failure: leave the marker for replay, surface the error.
+        throw err;
+    }
+    // Phase 4: marker no longer needed.
+    await fs.unlink(mPath).catch(() => undefined);
+    await fsyncFile(dirname(mPath)).catch(() => undefined);
+    return { txnId };
+}
+/**
+ * Replay pending commit-intent markers at boot. For each marker:
+ *   - Every tmp exists → finish the renames (commit was in-flight).
+ *   - Any tmp missing → assume aborted; unlink leftover tmps and the
+ *     marker (target was never touched).
+ *
+ * Idempotent: safe to call on every server start. Never throws on a
+ * single corrupted marker — that marker is skipped and reported via
+ * the returned arrays so the caller can log and continue.
+ */
+export async function replayPendingCommits(writeRoot) {
+    const stateDir = join(writeRoot, STATE_SUBDIR);
+    let names;
+    try {
+        names = await fs.readdir(stateDir);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return { completed: [], aborted: [] };
+        throw err;
+    }
+    const completed = [];
+    const aborted = [];
+    for (const name of names) {
+        if (!name.startsWith('wizard-intent-') || !name.endsWith('.json'))
+            continue;
+        const mPath = join(stateDir, name);
+        let marker;
+        try {
+            const raw = await fs.readFile(mPath, 'utf8');
+            marker = JSON.parse(raw);
+            if (marker.version !== 1 || !Array.isArray(marker.entries))
+                throw new Error('bad marker');
+        }
+        catch {
+            aborted.push(name);
+            await fs.unlink(mPath).catch(() => undefined);
+            continue;
+        }
+        const presence = await Promise.all(marker.entries.map(async (e) => fs
+            .stat(e.tmp)
+            .then(() => true)
+            .catch(() => false)));
+        const allTmpsPresent = presence.every(Boolean);
+        if (allTmpsPresent) {
+            try {
+                for (const entry of marker.entries) {
+                    try {
+                        await fs.rename(entry.tmp, entry.target);
+                    }
+                    catch (err) {
+                        if (err.code === 'EPERM') {
+                            await fs.unlink(entry.target).catch(() => undefined);
+                            await fs.rename(entry.tmp, entry.target);
+                        }
+                        else {
+                            throw err;
+                        }
+                    }
+                    await fs.chmod(entry.target, entry.mode).catch(() => undefined);
+                }
+                await fs.unlink(mPath).catch(() => undefined);
+                completed.push(marker.txnId);
+            }
+            catch {
+                aborted.push(marker.txnId);
+            }
+        }
+        else {
+            for (const entry of marker.entries) {
+                await fs.unlink(entry.tmp).catch(() => undefined);
+            }
+            await fs.unlink(mPath).catch(() => undefined);
+            aborted.push(marker.txnId);
+        }
+    }
+    return { completed, aborted };
+}
+//# sourceMappingURL=atomicMultiWrite.js.map

package/dist/server/io/atomicMultiWrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomicMultiWrite.js","sourceRoot":"","sources":["../../../src/server/io/atomicMultiWrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AA+B/C,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,YAAY,GAAG,OAAO,CAAC;AAE7B,SAAS,UAAU,CAAC,SAAiB,EAAE,KAAa;IAChD,OAAO,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC;QACD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACP,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,IAAa;IACrD,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC;QACD,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACP,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC7B,QAAyB,EACzB,IAAmB;IAEnB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC;IACzC,MAAM,OAAO,GAAkB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChD,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,YAAY;KAC/B,CAAC,CAAC,CAAC;IAEJ,gEAAgE;IAChE,wEAAwE;IACxE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC1B,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAC7B,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAC5B,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YACpF,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;gBAAS,CAAC;YACP,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;IACL,CAAC;IAED,uCAAuC;IACvC,MAAM,MAAM,GAAW;QACnB,OAAO,EAAE,CAAC;QACV,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO;KACV,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEpC,kEAAkE;IAClE,2DAA2D;IAC3D,IAAI,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAClD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACrD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7C,CAAC;qBAAM,CAAC;oBACJ,MAAM,GAAG,CAAC;gBACd,CAAC;YACL,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpE,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,sEAAsE;QACtE,MAAM,GAAG,CAAC;IACd,CAAC;IAED,oCAAoC;IACpC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvD,OAAO,EAAE,KAAK,EAAE,CAAC;AACrB,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACD,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5F,MAAM,GAAG,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;YACnC,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9C,SAAS;QACb,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAC3B,EAAE;aACG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aAChB,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAC1B,CACJ,CAAC;QACF,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE/C,IAAI,cAAc,EAAE,CAAC;YACjB,IAAI,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjC,IAAI,CAAC;wBACD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;oBAC7C,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACX,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;4BAClD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;4BACrD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC7C,CAAC;6BAAM,CAAC;4BACJ,MAAM,GAAG,CAAC;wBACd,CAAC;oBACL,CAAC;oBACD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC9C,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC"}

package/dist/server/io/atomicWrite.js

@@ -0,0 +1,79 @@
+/**
+ * Single-file atomic write.
+ *
+ * Phase 1 of `unified-setup-and-settings-gui` (roadmap step 1.3). The wizard
+ * and settings editor MUST never leave a half-written `.agent-settings.yml`
+ * or `.agent-user.md` on disk. The contract is: after `writeAtomic` resolves,
+ * the target file either holds the new contents in full, or — on any error
+ * — the file is untouched (the prior contents survive).
+ *
+ * Implementation: write to a `<target>.tmp-<pid>-<rand>` sibling, fsync the
+ * file descriptor (so the new bytes hit the platter before the rename),
+ * `fs.rename` over the target (atomic on POSIX, link-then-unlink fallback
+ * on Windows when `rename` raises EPERM), then chmod the final path to the
+ * caller-requested mode (default 0600 — council security mandate).
+ *
+ * Caller is responsible for ensuring the parent directory exists; the
+ * helper does not auto-mkdir to avoid masking misrouted writes.
+ */
+import { promises as fs } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { dirname, join } from 'node:path';
+const DEFAULT_MODE = 0o600;
+function tmpName(target, suffix) {
+    const dir = dirname(target);
+    const base = target.slice(dir.length + 1);
+    const tag = suffix ?? `${process.pid}-${randomBytes(6).toString('hex')}`;
+    return join(dir, `${base}.tmp-${tag}`);
+}
+/**
+ * Write `contents` to `target` atomically. After resolve, the target
+ * file holds the new bytes in full or — on any thrown error — was
+ * never touched. The temp file is best-effort unlinked on failure.
+ */
+export async function writeAtomic(target, contents, opts = {}) {
+    const tmp = tmpName(target, opts.suffix);
+    const mode = opts.mode ?? DEFAULT_MODE;
+    let handle = null;
+    try {
+        handle = await fs.open(tmp, 'w', mode);
+        const buffer = typeof contents === 'string' ? Buffer.from(contents, 'utf8') : contents;
+        await handle.writeFile(buffer);
+        await handle.sync();
+        await handle.close();
+        handle = null;
+        try {
+            await fs.rename(tmp, target);
+        }
+        catch (err) {
+            // Windows: rename over an existing file can raise EPERM; fall
+            // back to link-unlink-rename.
+            if (err.code === 'EPERM') {
+                await fs.unlink(target).catch(() => undefined);
+                await fs.rename(tmp, target);
+            }
+            else {
+                throw err;
+            }
+        }
+        // chmod after rename — on some platforms (Windows, certain mounts)
+        // a non-default umask survives the open(); explicit chmod is the
+        // only portable knob.
+        await fs.chmod(target, mode).catch(() => undefined);
+    }
+    catch (err) {
+        if (handle)
+            await handle.close().catch(() => undefined);
+        await fs.unlink(tmp).catch(() => undefined);
+        throw err;
+    }
+}
+/**
+ * `<target>.tmp-*` sibling name generator — exported for the multi-write
+ * 2PC machinery which needs to write the same temp filename twice (prepare
+ * + commit) under one transaction id.
+ */
+export function tempPathFor(target, txnId) {
+    return tmpName(target, txnId);
+}
+//# sourceMappingURL=atomicWrite.js.map

package/dist/server/io/atomicWrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomicWrite.js","sourceRoot":"","sources":["../../../src/server/io/atomicWrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAS1C,MAAM,YAAY,GAAG,KAAK,CAAC;AAE3B,SAAS,OAAO,CAAC,MAAc,EAAE,MAAe;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACzE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,QAAQ,GAAG,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC7B,MAAc,EACd,QAAyB,EACzB,OAA2B,EAAE;IAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC;IAEvC,IAAI,MAAM,GAAyB,IAAI,CAAC;IACxC,IAAI,CAAC;QACD,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvF,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,IAAI,CAAC;QAEd,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,8DAA8D;YAC9D,8BAA8B;YAC9B,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACJ,MAAM,GAAG,CAAC;YACd,CAAC;QACL,CAAC;QAED,mEAAmE;QACnE,iEAAiE;QACjE,sBAAsB;QACtB,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,GAAG,CAAC;IACd,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,KAAa;IACrD,OAAO,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC"}

package/dist/server/io/substituteTemplate.js

@@ -0,0 +1,87 @@
+/**
+ * Render `config/agent-settings.template.yml` for the wizard's "Skip" path.
+ *
+ * Source of truth for placeholder semantics is `scripts/install.py`
+ * (`_render_template`, `_parse_profile_ini`). The wizard's Skip handler
+ * cannot shell out to Python — npm/npx flows ship Node only — so this
+ * helper mirrors the install-time substitution in TypeScript.
+ *
+ * Contract:
+ *   - Reads `config/profiles/<profile>.ini` from `packageRoot`.
+ *   - Each ini key `foo_bar` substitutes the `__FOO_BAR__` placeholder.
+ *   - Injects runtime-only values (`user_type`) from the caller.
+ *   - Fails loudly if any placeholder remains unfilled — catches typos
+ *     and missing profile entries the same way the Python path does.
+ *
+ * No YAML parsing: we treat the template as text and replace tokens.
+ * The schema-↔-template parity test guarantees every placeholder we
+ * touch corresponds to a real schema leaf.
+ */
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+const PLACEHOLDER_RE = /__[A-Z][A-Z0-9_]*__/g;
+/**
+ * Parse a profile `.ini` file the same way `scripts/install.py` does:
+ * `key=value` per line, `;` line comments, blank lines ignored. Whitespace
+ * around `=` is stripped. Duplicate keys: last wins.
+ */
+export function parseProfileIni(body) {
+    const out = {};
+    for (const raw of body.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (line === '' || line.startsWith(';') || line.startsWith('#'))
+            continue;
+        const eq = line.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = line.slice(0, eq).trim();
+        const value = line.slice(eq + 1).trim();
+        if (key === '')
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
+/**
+ * Substitute every `__KEY__` placeholder in `template` using `values`.
+ * `values` is keyed by lowercase ini key; the placeholder is the
+ * uppercased key wrapped in `__`. Throws if any placeholder remains.
+ */
+export function applyPlaceholders(template, values) {
+    let body = template;
+    for (const [key, value] of Object.entries(values)) {
+        const placeholder = `__${key.toUpperCase()}__`;
+        if (body.includes(placeholder)) {
+            body = body.split(placeholder).join(value);
+        }
+    }
+    const leftover = Array.from(new Set(body.match(PLACEHOLDER_RE) ?? [])).sort();
+    if (leftover.length > 0) {
+        throw new Error(`Template has unfilled placeholders after profile render: ${leftover.join(', ')}`);
+    }
+    return body;
+}
+/**
+ * Read `config/profiles/<profile>.ini`, merge runtime values, and return
+ * the rendered template body. Caller writes the body via `writeAtomic`.
+ */
+export async function renderSettingsTemplate(opts) {
+    const templatePath = join(opts.packageRoot, 'config', 'agent-settings.template.yml');
+    const profilePath = join(opts.packageRoot, 'config', 'profiles', `${opts.profile}.ini`);
+    const [template, iniBody] = await Promise.all([
+        readFile(templatePath, 'utf8'),
+        readFile(profilePath, 'utf8'),
+    ]);
+    const profileValues = parseProfileIni(iniBody);
+    if (profileValues.cost_profile !== opts.profile) {
+        throw new Error(`Profile preset ${opts.profile}.ini has cost_profile=` +
+            `${JSON.stringify(profileValues.cost_profile)} but caller asked for ${opts.profile}`);
+    }
+    const merged = {
+        ...profileValues,
+        user_type: opts.userType,
+        ...(opts.overrides ?? {}),
+    };
+    return applyPlaceholders(template, merged);
+}
+//# sourceMappingURL=substituteTemplate.js.map

package/dist/server/io/substituteTemplate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"substituteTemplate.js","sourceRoot":"","sources":["../../../src/server/io/substituteTemplate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAejC,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IACxC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1E,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACzB,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,MAA8B;IAC9E,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,WAAW,GAAG,KAAK,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC;QAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACX,4DAA4D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpF,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAuB;IAChE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,6BAA6B,CAAC,CAAC;IACrF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,MAAM,CAAC,CAAC;IAExF,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAChC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,aAAa,CAAC,YAAY,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACX,kBAAkB,IAAI,CAAC,OAAO,wBAAwB;YAClD,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,CAAC,yBAAyB,IAAI,CAAC,OAAO,EAAE,CAC3F,CAAC;IACN,CAAC;IAED,MAAM,MAAM,GAA2B;QACnC,GAAG,aAAa;QAChB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;KAC5B,CAAC;IAEF,OAAO,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC"}