@fased/fased 0.1.61 → 0.1.64

package/dist/gateway/server-secrets-runtime.js

@@ -0,0 +1,288 @@
+import { resolveMainSessionKeyFromConfig } from "../config/sessions/main-session.js";
+import "../config/sessions.js";
+import { enqueueSystemEvent } from "../infra/system-events.js";
+import { activateSecretsRuntimeSnapshot, clearSecretsRuntimeSnapshot, getActiveSecretsRuntimeSnapshot, prepareSecretsRuntimeSnapshot } from "../secrets/runtime.js";
+import { buildGatewayReloadPlan, diffConfigPaths, resolveGatewayReloadSettings } from "./config-reload.js";
+import { isDeepStrictEqual } from "node:util";
+
+//#region src/gateway/server-secrets-runtime.ts
+var GatewaySecretsRuntimeError = class extends Error {
+	constructor(code, message, options) {
+		super(message, options);
+		this.name = "GatewaySecretsRuntimeError";
+		this.code = code;
+	}
+};
+function sanitizeGatewaySecretsRuntimeError(error) {
+	if (error instanceof GatewaySecretsRuntimeError) {
+		return {
+			code: error.code,
+			message: error.message
+		};
+	}
+	return {
+		code: "SECRETS_RELOAD_FAILED",
+		message: "Secret reload failed without changing the active runtime snapshot. Run `fased secrets audit --check` for local diagnostics."
+	};
+}
+function runtimeError(code, message, cause) {
+	return new GatewaySecretsRuntimeError(code, message, cause === undefined ? undefined : { cause });
+}
+function normalizeRuntimeError(error, fallbackCode, fallbackMessage) {
+	return error instanceof GatewaySecretsRuntimeError ? error : runtimeError(fallbackCode, fallbackMessage, error);
+}
+function invalidSnapshotError(snapshot) {
+	const paths = [...new Set(snapshot.issues.map((issue) => issue.path.trim() || "<root>"))].slice(0, 8);
+	const suffix = paths.length > 0 ? ` Invalid paths: ${paths.join(", ")}.` : "";
+	return runtimeError("SECRETS_CONFIG_INVALID", `Secret reload refused an invalid Gateway config.${suffix} Run \`fased doctor\` locally before retrying.`);
+}
+function missingSnapshotError() {
+	return runtimeError("SECRETS_CONFIG_MISSING", "Secret reload refused to replace the active snapshot because the Gateway config file is missing.");
+}
+function staleSourceError() {
+	return runtimeError("SECRETS_SOURCE_STALE", "Secret reload discarded a stale config revision; retry after the current config change finishes.");
+}
+function cloneConfig(config) {
+	return structuredClone(config);
+}
+function sameSourceSnapshot(left, right) {
+	if (left.exists !== right.exists || left.valid !== right.valid) {
+		return false;
+	}
+	if (left.hash && right.hash) {
+		return left.hash === right.hash;
+	}
+	return isDeepStrictEqual(left.config, right.config);
+}
+function planNeedsHotApply(plan) {
+	return plan.hotReasons.length > 0 || plan.reloadHooks || plan.restartGmailWatcher || plan.restartBrowserControl || plan.restartCron || plan.restartHeartbeat || plan.restartChannels.size > 0;
+}
+function assertManualSourceChangeAllowed(params) {
+	const changedPaths = diffConfigPaths(params.previous, params.next);
+	if (changedPaths.length === 0) {
+		return;
+	}
+	const plan = buildGatewayReloadPlan(changedPaths);
+	const settings = resolveGatewayReloadSettings(params.next);
+	if (settings.mode === "restart" || plan.restartGateway) {
+		throw runtimeError("SECRETS_SOURCE_RESTART_REQUIRED", "Secret reload refused config changes that require a Gateway restart. Let the config reloader restart the Gateway, then retry.");
+	}
+	if (planNeedsHotApply(plan)) {
+		throw runtimeError("SECRETS_SOURCE_HOT_RELOAD_REQUIRED", "Secret reload refused config changes that require live component reconfiguration. Let the config reloader apply them, then retry.");
+	}
+}
+function createGatewaySecretsRuntimeController(params) {
+	const prepareSnapshot = params.prepareSnapshot ?? prepareSecretsRuntimeSnapshot;
+	const activateSnapshot = params.activateSnapshot ?? activateSecretsRuntimeSnapshot;
+	const getActiveSnapshot = params.getActiveSnapshot ?? getActiveSecretsRuntimeSnapshot;
+	const clearSnapshot = params.clearSnapshot ?? clearSecretsRuntimeSnapshot;
+	let activeSourceConfig = null;
+	let degraded = false;
+	let closed = false;
+	let latestGeneration = 0;
+	let operationTail = Promise.resolve();
+	let shutdownPromise = null;
+	const runExclusive = (operation) => {
+		const result = operationTail.then(operation, operation);
+		operationTail = result.then(() => undefined, () => undefined);
+		return result;
+	};
+	const runTracked = (operation) => {
+		const generation = ++latestGeneration;
+		return runExclusive(async () => await operation(generation));
+	};
+	const assertCurrent = (generation) => {
+		if (closed) {
+			throw runtimeError("SECRETS_RUNTIME_CLOSED", "Secret reload was cancelled because the Gateway is shutting down.");
+		}
+		if (generation !== latestGeneration) {
+			throw staleSourceError();
+		}
+	};
+	const emitTransition = (code) => {
+		if (params.emitTransition) {
+			params.emitTransition(code);
+			return;
+		}
+		const text = code === "SECRETS_RELOADER_DEGRADED" ? `[${code}] Secret reload failed; the Gateway kept its last-known-good runtime snapshot.` : `[${code}] Secret references recovered and the Gateway activated a new runtime snapshot.`;
+		enqueueSystemEvent(text, {
+			sessionKey: resolveMainSessionKeyFromConfig(),
+			contextKey: "gateway-secrets-runtime",
+			trusted: true
+		});
+	};
+	const recordReloadFailure = (error) => {
+		const safe = sanitizeGatewaySecretsRuntimeError(error);
+		params.log.warn(`[SECRETS_RELOADER_DEGRADED] secret reload failed; keeping last-known-good runtime snapshot (${safe.code}): ${safe.message}`);
+		if (degraded || closed) {
+			return;
+		}
+		degraded = true;
+		emitTransition("SECRETS_RELOADER_DEGRADED");
+	};
+	const recordReloadSuccess = () => {
+		if (!degraded) {
+			return;
+		}
+		degraded = false;
+		params.log.info("[SECRETS_RELOADER_RECOVERED] secret runtime snapshot recovered");
+		emitTransition("SECRETS_RELOADER_RECOVERED");
+	};
+	const logWarnings = (prepared) => {
+		for (const warning of prepared.warnings) {
+			params.log.warn(`[${warning.code}] ${warning.message}`);
+		}
+	};
+	const prepareSafely = async (config) => {
+		try {
+			return await prepareSnapshot({ config });
+		} catch (error) {
+			throw normalizeRuntimeError(error, "SECRETS_RESOLUTION_FAILED", "One or more required secret references could not be resolved. Run `fased secrets audit --check` locally before retrying.");
+		}
+	};
+	const requireReloadableSnapshot = (snapshot) => {
+		if (!snapshot.exists) {
+			throw missingSnapshotError();
+		}
+		if (!snapshot.valid) {
+			throw invalidSnapshotError(snapshot);
+		}
+	};
+	const assertSnapshotStillCurrent = async (expected) => {
+		const current = await params.readConfigSnapshot();
+		requireReloadableSnapshot(current);
+		if (!sameSourceSnapshot(expected, current)) {
+			throw staleSourceError();
+		}
+	};
+	const restoreSnapshot = (previous) => {
+		try {
+			if (previous) {
+				activateSnapshot(previous);
+			} else {
+				clearSnapshot();
+			}
+		} catch {
+			clearSnapshot();
+		}
+	};
+	const activateStartup = (snapshot) => runTracked(async (generation) => {
+		if (!snapshot.valid) {
+			throw invalidSnapshotError(snapshot);
+		}
+		assertCurrent(generation);
+		const prepared = await prepareSafely(snapshot.config);
+		assertCurrent(generation);
+		activateSnapshot(prepared);
+		activeSourceConfig = cloneConfig(snapshot.config);
+		logWarnings(prepared);
+		return prepared;
+	});
+	const activateHotReload = (snapshot, transaction) => runTracked(async (generation) => {
+		try {
+			requireReloadableSnapshot(snapshot);
+			assertCurrent(generation);
+			await assertSnapshotStillCurrent(snapshot);
+			assertCurrent(generation);
+			const prepared = await prepareSafely(snapshot.config);
+			assertCurrent(generation);
+			await assertSnapshotStillCurrent(snapshot);
+			assertCurrent(generation);
+			const previous = getActiveSnapshot();
+			activateSnapshot(prepared);
+			try {
+				await transaction.apply(prepared.config);
+				assertCurrent(generation);
+				await assertSnapshotStillCurrent(snapshot);
+				assertCurrent(generation);
+			} catch (error) {
+				restoreSnapshot(previous);
+				if (previous) {
+					try {
+						await transaction.rollback(previous.config);
+					} catch (rollbackError) {
+						throw runtimeError("SECRETS_HOT_APPLY_FAILED", "Gateway hot reload failed. The last-known-good secret snapshot was restored, but one or more live components could not be restored and remain stopped.", rollbackError);
+					}
+				}
+				throw normalizeRuntimeError(error, "SECRETS_HOT_APPLY_FAILED", "Gateway hot reload failed; the last-known-good secret snapshot and live component state were restored.");
+			}
+			activeSourceConfig = cloneConfig(snapshot.config);
+			logWarnings(prepared);
+			recordReloadSuccess();
+			return prepared;
+		} catch (error) {
+			const safe = normalizeRuntimeError(error, "SECRETS_RELOAD_FAILED", "Secret reload failed without changing the active runtime snapshot.");
+			recordReloadFailure(safe);
+			throw safe;
+		}
+	});
+	const validateRestart = (snapshot) => runTracked(async (generation) => {
+		try {
+			requireReloadableSnapshot(snapshot);
+			assertCurrent(generation);
+			await assertSnapshotStillCurrent(snapshot);
+			assertCurrent(generation);
+			const prepared = await prepareSafely(snapshot.config);
+			assertCurrent(generation);
+			await assertSnapshotStillCurrent(snapshot);
+			assertCurrent(generation);
+			logWarnings(prepared);
+			return { warningCount: prepared.warnings.length };
+		} catch (error) {
+			const safe = normalizeRuntimeError(error, "SECRETS_RELOAD_FAILED", "Secret validation failed; the Gateway restart was not scheduled.");
+			recordReloadFailure(safe);
+			throw safe;
+		}
+	});
+	const reloadFromConfig = () => runTracked(async (generation) => {
+		try {
+			assertCurrent(generation);
+			const snapshot = await params.readConfigSnapshot();
+			requireReloadableSnapshot(snapshot);
+			if (!activeSourceConfig) {
+				throw runtimeError("SECRETS_RELOAD_FAILED", "Secret reload is unavailable before the startup snapshot is active.");
+			}
+			assertManualSourceChangeAllowed({
+				previous: activeSourceConfig,
+				next: snapshot.config
+			});
+			const prepared = await prepareSafely(snapshot.config);
+			assertCurrent(generation);
+			await assertSnapshotStillCurrent(snapshot);
+			assertCurrent(generation);
+			activateSnapshot(prepared);
+			activeSourceConfig = cloneConfig(snapshot.config);
+			logWarnings(prepared);
+			recordReloadSuccess();
+			return { warningCount: prepared.warnings.length };
+		} catch (error) {
+			const safe = normalizeRuntimeError(error, "SECRETS_RELOAD_FAILED", "Secret reload failed without changing the active runtime snapshot.");
+			recordReloadFailure(safe);
+			throw safe;
+		}
+	});
+	const shutdown = () => {
+		if (shutdownPromise) {
+			return shutdownPromise;
+		}
+		closed = true;
+		latestGeneration += 1;
+		shutdownPromise = (async () => {
+			await operationTail;
+			activeSourceConfig = null;
+			degraded = false;
+			clearSnapshot();
+		})();
+		return shutdownPromise;
+	};
+	return {
+		activateStartup,
+		activateHotReload,
+		validateRestart,
+		reloadFromConfig,
+		shutdown
+	};
+}
+
+//#endregion
+export { createGatewaySecretsRuntimeController, sanitizeGatewaySecretsRuntimeError };

package/dist/gateway/server.impl.js

@@ -17,7 +17,8 @@ import { startDiagnosticHeartbeat, stopDiagnosticHeartbeat } from "../logging/di
 import { getTotalQueueSize } from "../process/command-queue.js";
 import { clearAgentRunContext, onAgentEvent } from "../infra/agent-events.js";
 import { initSubagentRegistry } from "../agents/subagent-registry.js";
-import { resolveLocalSignerMaterialRootDir, resolveWalletRuntimeConfig } from "../wallet/wallet-runtime-config.js";
+import { resolveWalletRuntimeConfig } from "../wallet/wallet-runtime-config.js";
+import { readWalletProviderRegistry } from "../wallet/wallet-provider-registry.js";
 import { createWalletProviderAdapter, resolveWalletProviderId } from "../wallet/wallet-provider-resolver.js";
 import { getTotalPendingReplies } from "../auto-reply/reply/dispatcher-registry.js";
 import { applyPluginAutoEnable } from "../config/plugin-auto-enable.js";
@@ -38,6 +39,7 @@ import { createDefaultDeps } from "../cli/deps.js";
 import { ensureFasedAgentCliOnPath } from "../infra/path-env.js";
 import { createExecApprovalForwarder } from "../infra/exec-approval-forwarder.js";
 import { scheduleGatewayUpdateCheck } from "../infra/update-startup.js";
+import { clearSecretsRuntimeSnapshot } from "../secrets/runtime.js";
 import { runOnboardingWizard } from "../wizard/onboarding.js";
 import { startGatewayConfigReloader } from "./config-reload.js";
 import { ExecApprovalManager } from "./exec-approval-manager.js";
@@ -54,6 +56,8 @@ import { startGatewayMaintenanceTimers } from "./server-maintenance.js";
 import { GATEWAY_EVENTS, listGatewayMethods } from "./server-methods-list.js";
 import { coreGatewayHandlers } from "./server-methods.js";
 import { createExecApprovalHandlers } from "./server-methods/exec-approval.js";
+import { createGatewaySecretsRuntimeController, sanitizeGatewaySecretsRuntimeError } from "./server-secrets-runtime.js";
+import { createSecretsHandlers } from "./server-methods/secrets.js";
 import { hasConnectedMobileNode } from "./server-mobile-nodes.js";
 import { createNodeSubscriptionManager } from "./server-node-subscriptions.js";
 import { loadGatewayPlugins } from "./server-plugins.js";
@@ -68,7 +72,6 @@ import { createWizardSessionTracker } from "./server-wizard-sessions.js";
 import { attachGatewayWsHandlers } from "./server-ws-runtime.js";
 import { loadGatewayTlsRuntime } from "./server/tls.js";
 import { createSessionEventSubscriberRegistry, createSessionMessageSubscriberRegistry } from "./session-event-subscribers.js";
-import fs from "node:fs";
 import path from "node:path";
 
 //#region src/gateway/server.impl.ts
@@ -88,25 +91,6 @@ const logWsControl = log.child("ws");
 const gatewayRuntime = runtimeForLogger(log);
 const canvasRuntime = runtimeForLogger(logCanvas);
 const LOCAL_SIGNER_STARTUP_RECOVERY_TIMEOUT_MS = 2e3;
-function hasConfiguredLocalSignerKeystoreMaterial(env) {
-	for (const [key, rawValue] of Object.entries(env)) {
-		if (typeof rawValue !== "string" || rawValue.trim().length === 0) {
-			continue;
-		}
-		if (key === "FASED_WALLET_SOLANA_KEYSTORE_PATH" || key.startsWith("FASED_WALLET_SOLANA_KEYSTORE_PATH__")) {
-			return true;
-		}
-	}
-	try {
-		const materialDir = resolveLocalSignerMaterialRootDir(env);
-		if (!fs.existsSync(materialDir)) {
-			return false;
-		}
-		return fs.readdirSync(materialDir, { withFileTypes: true }).some((entry) => entry.isFile() && /^keystore-solana(?:-.+)?\.v1\.enc$/i.test(entry.name));
-	} catch {
-		return false;
-	}
-}
 async function ensureLocalSignerReadyAtGatewayStart(cfg) {
 	const effectiveEnv = {
 		...process.env,
@@ -116,8 +100,8 @@ async function ensureLocalSignerReadyAtGatewayStart(cfg) {
 	if (providerId !== "local-socket-signer") {
 		return;
 	}
-	if (!hasConfiguredLocalSignerKeystoreMaterial(effectiveEnv)) {
-		log.debug("local signer startup check skipped: no self-hosted signer keystore material found");
+	if (!readWalletProviderRegistry(effectiveEnv).wallets.some((wallet) => wallet.providerId === "local-socket-signer")) {
+		log.debug("local signer startup check skipped: no signer-owned wallet is registered");
 		return;
 	}
 	const wallet = resolveWalletRuntimeConfig(cfg, effectiveEnv);
@@ -152,6 +136,14 @@ async function ensureLocalSignerReadyAtGatewayStart(cfg) {
 	}
 }
 async function startGatewayServer(port = 18789, opts = {}) {
+	try {
+		return await startGatewayServerInternal(port, opts);
+	} catch (error) {
+		clearSecretsRuntimeSnapshot();
+		throw error;
+	}
+}
+async function startGatewayServerInternal(port, opts) {
 	const minimalTestGateway = process.env.VITEST === "1" && process.env.FASED_TEST_MINIMAL_GATEWAY === "1";
 	process.env.FASED_GATEWAY_PORT = String(port);
 	logAcceptedEnvOption({
@@ -197,6 +189,19 @@ async function startGatewayServer(port = 18789, opts = {}) {
 			log.warn(`gateway: failed to persist plugin auto-enable changes: ${String(err)}`);
 		}
 	}
+	configSnapshot = await startupTrace.measure("config.secrets-source", () => readConfigFileSnapshot());
+	if (configSnapshot.exists && !configSnapshot.valid) {
+		const issues = configSnapshot.issues.map((issue) => `${issue.path || "<root>"}: ${issue.message}`).join("\n");
+		throw new Error(`Invalid config at ${configSnapshot.path}.\n${issues || "Unknown validation issue."}\nRun "${formatCliCommand("fased doctor")}" to repair, then retry.`);
+	}
+	const secretsRuntime = createGatewaySecretsRuntimeController({
+		readConfigSnapshot: readConfigFileSnapshot,
+		log: logReload
+	});
+	const startupSecretsSnapshot = await startupTrace.measure("secrets.activate", () => secretsRuntime.activateStartup(configSnapshot)).catch((error) => {
+		const safe = sanitizeGatewaySecretsRuntimeError(error);
+		throw new Error(`Startup failed: required secrets are unavailable (${safe.code}). ${safe.message}`);
+	});
 	const cfgAtStart = startupTrace.measureSync("config.load", () => loadConfig());
 	const diagnosticsEnabled = isDiagnosticsEnabled(cfgAtStart);
 	if (diagnosticsEnabled) {
@@ -534,6 +539,7 @@ async function startGatewayServer(port = 18789, opts = {}) {
 	const execApprovalForwarder = createExecApprovalForwarder();
 	const execApprovalHandlers = createExecApprovalHandlers(execApprovalManager, { forwarder: execApprovalForwarder });
 	Object.assign(extraGatewayHandlers, execApprovalHandlers);
+	Object.assign(extraGatewayHandlers, createSecretsHandlers({ reloadSecrets: secretsRuntime.reloadFromConfig }));
 	const canvasHostServerPort = canvasHostServer?.port;
 	startupTrace.measureSync("ws.attach", () => {
 		attachGatewayWsHandlers({
@@ -653,7 +659,7 @@ async function startGatewayServer(port = 18789, opts = {}) {
 		}
 	}
 	const configReloader = minimalTestGateway ? { stop: async () => {} } : startupTrace.measureSync("config-reload.start", () => {
-		const { applyHotReload, requestGatewayRestart } = createGatewayReloadHandlers({
+		const { cancelPendingGatewayRestart, createHotReloadTransaction, requestGatewayRestart } = createGatewayReloadHandlers({
 			deps,
 			broadcast,
 			getState: () => ({
@@ -679,10 +685,29 @@ async function startGatewayServer(port = 18789, opts = {}) {
 			logReload
 		});
 		return startGatewayConfigReloader({
-			initialConfig: cfgAtStart,
+			initialConfig: startupSecretsSnapshot.sourceConfig,
 			readSnapshot: readConfigFileSnapshot,
-			onHotReload: applyHotReload,
-			onRestart: requestGatewayRestart,
+			onSourceRevision: () => {
+				cancelPendingGatewayRestart();
+			},
+			onStop: () => {
+				cancelPendingGatewayRestart();
+			},
+			onHotReload: async (plan, _nextConfig, snapshot) => {
+				const transaction = createHotReloadTransaction(plan);
+				await secretsRuntime.activateHotReload(snapshot, {
+					apply: async (preparedConfig) => {
+						await transaction.apply(preparedConfig);
+					},
+					rollback: async (previousConfig) => {
+						await transaction.rollback(previousConfig);
+					}
+				});
+			},
+			onRestart: async (plan, nextConfig, snapshot) => {
+				await secretsRuntime.validateRestart(snapshot);
+				requestGatewayRestart(plan, nextConfig);
+			},
 			log: {
 				info: (msg) => logReload.info(msg),
 				warn: (msg) => logReload.warn(msg),
@@ -722,22 +747,28 @@ async function startGatewayServer(port = 18789, opts = {}) {
 		}]
 	});
 	return { close: async (opts) => {
-		await runGlobalGatewayStopSafely({
-			event: { reason: opts?.reason ?? "gateway stopping" },
-			ctx: { port },
-			onError: (err) => log.warn(`gateway_stop hook failed: ${String(err)}`)
-		});
-		if (diagnosticsEnabled) {
-			stopDiagnosticHeartbeat();
-			stopDiagnosticStabilityRecorder();
-		}
-		if (skillsRefreshTimer) {
-			clearTimeout(skillsRefreshTimer);
-			skillsRefreshTimer = null;
+		try {
+			await runGlobalGatewayStopSafely({
+				event: { reason: opts?.reason ?? "gateway stopping" },
+				ctx: { port },
+				onError: (err) => log.warn(`gateway_stop hook failed: ${String(err)}`)
+			});
+			await configReloader.stop().catch(() => {});
+			await secretsRuntime.shutdown();
+			if (diagnosticsEnabled) {
+				stopDiagnosticHeartbeat();
+				stopDiagnosticStabilityRecorder();
+			}
+			if (skillsRefreshTimer) {
+				clearTimeout(skillsRefreshTimer);
+				skillsRefreshTimer = null;
+			}
+			skillsChangeUnsub();
+			authRateLimiter?.dispose();
+			await close(opts);
+		} finally {
+			await secretsRuntime.shutdown();
 		}
-		skillsChangeUnsub();
-		authRateLimiter?.dispose();
-		await close(opts);
 	} };
 }
 

package/dist/gateway/session-compaction-checkpoints.js

@@ -1,6 +1,6 @@
 import { isSessionCompactionCheckpointArtifactName } from "../config/sessions/artifacts.js";
 import "../config/sessions.js";
-import fs from "node:fs";
+import syncFs from "node:fs";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
 
@@ -88,7 +88,7 @@ function deleteCheckpointSnapshotIfSafe(filePath, expectedDir) {
 		return;
 	}
 	try {
-		fs.unlinkSync(resolved);
+		syncFs.unlinkSync(resolved);
 	} catch {}
 }
 function cleanupSessionCompactionSnapshot(reference) {
@@ -105,7 +105,7 @@ function captureSessionCompactionSnapshot(params) {
 	const resolved = path.resolve(sessionFile);
 	let stat;
 	try {
-		stat = fs.statSync(resolved);
+		stat = syncFs.statSync(resolved);
 	} catch {
 		return null;
 	}
@@ -123,7 +123,7 @@ function captureSessionCompactionSnapshot(params) {
 	const base = path.basename(resolved, ".jsonl");
 	const snapshotFile = path.join(dir, `${base}.checkpoint.${randomUUID()}.jsonl`);
 	try {
-		fs.copyFileSync(resolved, snapshotFile);
+		syncFs.copyFileSync(resolved, snapshotFile);
 	} catch {
 		return null;
 	}