@fased/fased 0.1.62 → 0.1.65

package/dist/gateway/server.impl.js

@@ -17,7 +17,8 @@ import { startDiagnosticHeartbeat, stopDiagnosticHeartbeat } from "../logging/di
 import { getTotalQueueSize } from "../process/command-queue.js";
 import { clearAgentRunContext, onAgentEvent } from "../infra/agent-events.js";
 import { initSubagentRegistry } from "../agents/subagent-registry.js";
-import { resolveLocalSignerMaterialRootDir, resolveWalletRuntimeConfig } from "../wallet/wallet-runtime-config.js";
+import { resolveWalletRuntimeConfig } from "../wallet/wallet-runtime-config.js";
+import { readWalletProviderRegistry } from "../wallet/wallet-provider-registry.js";
 import { createWalletProviderAdapter, resolveWalletProviderId } from "../wallet/wallet-provider-resolver.js";
 import { getTotalPendingReplies } from "../auto-reply/reply/dispatcher-registry.js";
 import { applyPluginAutoEnable } from "../config/plugin-auto-enable.js";
@@ -38,6 +39,7 @@ import { createDefaultDeps } from "../cli/deps.js";
 import { ensureFasedAgentCliOnPath } from "../infra/path-env.js";
 import { createExecApprovalForwarder } from "../infra/exec-approval-forwarder.js";
 import { scheduleGatewayUpdateCheck } from "../infra/update-startup.js";
+import { clearSecretsRuntimeSnapshot } from "../secrets/runtime.js";
 import { runOnboardingWizard } from "../wizard/onboarding.js";
 import { startGatewayConfigReloader } from "./config-reload.js";
 import { ExecApprovalManager } from "./exec-approval-manager.js";
@@ -54,6 +56,8 @@ import { startGatewayMaintenanceTimers } from "./server-maintenance.js";
 import { GATEWAY_EVENTS, listGatewayMethods } from "./server-methods-list.js";
 import { coreGatewayHandlers } from "./server-methods.js";
 import { createExecApprovalHandlers } from "./server-methods/exec-approval.js";
+import { createGatewaySecretsRuntimeController, sanitizeGatewaySecretsRuntimeError } from "./server-secrets-runtime.js";
+import { createSecretsHandlers } from "./server-methods/secrets.js";
 import { hasConnectedMobileNode } from "./server-mobile-nodes.js";
 import { createNodeSubscriptionManager } from "./server-node-subscriptions.js";
 import { loadGatewayPlugins } from "./server-plugins.js";
@@ -68,7 +72,6 @@ import { createWizardSessionTracker } from "./server-wizard-sessions.js";
 import { attachGatewayWsHandlers } from "./server-ws-runtime.js";
 import { loadGatewayTlsRuntime } from "./server/tls.js";
 import { createSessionEventSubscriberRegistry, createSessionMessageSubscriberRegistry } from "./session-event-subscribers.js";
-import syncFs from "node:fs";
 import path from "node:path";
 
 //#region src/gateway/server.impl.ts
@@ -88,25 +91,6 @@ const logWsControl = log.child("ws");
 const gatewayRuntime = runtimeForLogger(log);
 const canvasRuntime = runtimeForLogger(logCanvas);
 const LOCAL_SIGNER_STARTUP_RECOVERY_TIMEOUT_MS = 2e3;
-function hasConfiguredLocalSignerKeystoreMaterial(env) {
-	for (const [key, rawValue] of Object.entries(env)) {
-		if (typeof rawValue !== "string" || rawValue.trim().length === 0) {
-			continue;
-		}
-		if (key === "FASED_WALLET_SOLANA_KEYSTORE_PATH" || key.startsWith("FASED_WALLET_SOLANA_KEYSTORE_PATH__")) {
-			return true;
-		}
-	}
-	try {
-		const materialDir = resolveLocalSignerMaterialRootDir(env);
-		if (!syncFs.existsSync(materialDir)) {
-			return false;
-		}
-		return syncFs.readdirSync(materialDir, { withFileTypes: true }).some((entry) => entry.isFile() && /^keystore-solana(?:-.+)?\.v1\.enc$/i.test(entry.name));
-	} catch {
-		return false;
-	}
-}
 async function ensureLocalSignerReadyAtGatewayStart(cfg) {
 	const effectiveEnv = {
 		...process.env,
@@ -116,8 +100,8 @@ async function ensureLocalSignerReadyAtGatewayStart(cfg) {
 	if (providerId !== "local-socket-signer") {
 		return;
 	}
-	if (!hasConfiguredLocalSignerKeystoreMaterial(effectiveEnv)) {
-		log.debug("local signer startup check skipped: no self-hosted signer keystore material found");
+	if (!readWalletProviderRegistry(effectiveEnv).wallets.some((wallet) => wallet.providerId === "local-socket-signer")) {
+		log.debug("local signer startup check skipped: no signer-owned wallet is registered");
 		return;
 	}
 	const wallet = resolveWalletRuntimeConfig(cfg, effectiveEnv);
@@ -152,6 +136,14 @@ async function ensureLocalSignerReadyAtGatewayStart(cfg) {
 	}
 }
 async function startGatewayServer(port = 18789, opts = {}) {
+	try {
+		return await startGatewayServerInternal(port, opts);
+	} catch (error) {
+		clearSecretsRuntimeSnapshot();
+		throw error;
+	}
+}
+async function startGatewayServerInternal(port, opts) {
 	const minimalTestGateway = process.env.VITEST === "1" && process.env.FASED_TEST_MINIMAL_GATEWAY === "1";
 	process.env.FASED_GATEWAY_PORT = String(port);
 	logAcceptedEnvOption({
@@ -197,6 +189,19 @@ async function startGatewayServer(port = 18789, opts = {}) {
 			log.warn(`gateway: failed to persist plugin auto-enable changes: ${String(err)}`);
 		}
 	}
+	configSnapshot = await startupTrace.measure("config.secrets-source", () => readConfigFileSnapshot());
+	if (configSnapshot.exists && !configSnapshot.valid) {
+		const issues = configSnapshot.issues.map((issue) => `${issue.path || "<root>"}: ${issue.message}`).join("\n");
+		throw new Error(`Invalid config at ${configSnapshot.path}.\n${issues || "Unknown validation issue."}\nRun "${formatCliCommand("fased doctor")}" to repair, then retry.`);
+	}
+	const secretsRuntime = createGatewaySecretsRuntimeController({
+		readConfigSnapshot: readConfigFileSnapshot,
+		log: logReload
+	});
+	const startupSecretsSnapshot = await startupTrace.measure("secrets.activate", () => secretsRuntime.activateStartup(configSnapshot)).catch((error) => {
+		const safe = sanitizeGatewaySecretsRuntimeError(error);
+		throw new Error(`Startup failed: required secrets are unavailable (${safe.code}). ${safe.message}`);
+	});
 	const cfgAtStart = startupTrace.measureSync("config.load", () => loadConfig());
 	const diagnosticsEnabled = isDiagnosticsEnabled(cfgAtStart);
 	if (diagnosticsEnabled) {
@@ -534,6 +539,7 @@ async function startGatewayServer(port = 18789, opts = {}) {
 	const execApprovalForwarder = createExecApprovalForwarder();
 	const execApprovalHandlers = createExecApprovalHandlers(execApprovalManager, { forwarder: execApprovalForwarder });
 	Object.assign(extraGatewayHandlers, execApprovalHandlers);
+	Object.assign(extraGatewayHandlers, createSecretsHandlers({ reloadSecrets: secretsRuntime.reloadFromConfig }));
 	const canvasHostServerPort = canvasHostServer?.port;
 	startupTrace.measureSync("ws.attach", () => {
 		attachGatewayWsHandlers({
@@ -653,7 +659,7 @@ async function startGatewayServer(port = 18789, opts = {}) {
 		}
 	}
 	const configReloader = minimalTestGateway ? { stop: async () => {} } : startupTrace.measureSync("config-reload.start", () => {
-		const { applyHotReload, requestGatewayRestart } = createGatewayReloadHandlers({
+		const { cancelPendingGatewayRestart, createHotReloadTransaction, requestGatewayRestart } = createGatewayReloadHandlers({
 			deps,
 			broadcast,
 			getState: () => ({
@@ -679,10 +685,29 @@ async function startGatewayServer(port = 18789, opts = {}) {
 			logReload
 		});
 		return startGatewayConfigReloader({
-			initialConfig: cfgAtStart,
+			initialConfig: startupSecretsSnapshot.sourceConfig,
 			readSnapshot: readConfigFileSnapshot,
-			onHotReload: applyHotReload,
-			onRestart: requestGatewayRestart,
+			onSourceRevision: () => {
+				cancelPendingGatewayRestart();
+			},
+			onStop: () => {
+				cancelPendingGatewayRestart();
+			},
+			onHotReload: async (plan, _nextConfig, snapshot) => {
+				const transaction = createHotReloadTransaction(plan);
+				await secretsRuntime.activateHotReload(snapshot, {
+					apply: async (preparedConfig) => {
+						await transaction.apply(preparedConfig);
+					},
+					rollback: async (previousConfig) => {
+						await transaction.rollback(previousConfig);
+					}
+				});
+			},
+			onRestart: async (plan, nextConfig, snapshot) => {
+				await secretsRuntime.validateRestart(snapshot);
+				requestGatewayRestart(plan, nextConfig);
+			},
 			log: {
 				info: (msg) => logReload.info(msg),
 				warn: (msg) => logReload.warn(msg),
@@ -722,22 +747,28 @@ async function startGatewayServer(port = 18789, opts = {}) {
 		}]
 	});
 	return { close: async (opts) => {
-		await runGlobalGatewayStopSafely({
-			event: { reason: opts?.reason ?? "gateway stopping" },
-			ctx: { port },
-			onError: (err) => log.warn(`gateway_stop hook failed: ${String(err)}`)
-		});
-		if (diagnosticsEnabled) {
-			stopDiagnosticHeartbeat();
-			stopDiagnosticStabilityRecorder();
-		}
-		if (skillsRefreshTimer) {
-			clearTimeout(skillsRefreshTimer);
-			skillsRefreshTimer = null;
+		try {
+			await runGlobalGatewayStopSafely({
+				event: { reason: opts?.reason ?? "gateway stopping" },
+				ctx: { port },
+				onError: (err) => log.warn(`gateway_stop hook failed: ${String(err)}`)
+			});
+			await configReloader.stop().catch(() => {});
+			await secretsRuntime.shutdown();
+			if (diagnosticsEnabled) {
+				stopDiagnosticHeartbeat();
+				stopDiagnosticStabilityRecorder();
+			}
+			if (skillsRefreshTimer) {
+				clearTimeout(skillsRefreshTimer);
+				skillsRefreshTimer = null;
+			}
+			skillsChangeUnsub();
+			authRateLimiter?.dispose();
+			await close(opts);
+		} finally {
+			await secretsRuntime.shutdown();
 		}
-		skillsChangeUnsub();
-		authRateLimiter?.dispose();
-		await close(opts);
 	} };
 }
 

package/dist/gateway/sessions-patch.js

@@ -3,8 +3,7 @@ import { normalizeElevatedLevel, normalizeReasoningLevel, normalizeUsageDisplay
 import { isSubagentSessionKey, parseAgentSessionKey } from "../sessions/session-key-utils.js";
 import { normalizeAgentId } from "../routing/session-key.js";
 import { resolveDefaultAgentId } from "../agents/agent-scope.js";
-import { isStandardProviderModelRef } from "../providers/registry.js";
-import { modelKey, resolveAllowedModelRef, resolveDefaultModelForAgent, resolveSubagentConfiguredModelSelection } from "../agents/model-selection.js";
+import { normalizeProviderId, resolveAllowedModelRef, resolveDefaultModelForAgent, resolveSubagentConfiguredModelSelection } from "../agents/model-selection.js";
 import { parseSessionLabel } from "../sessions/session-label.js";
 import { ErrorCodes, errorShape } from "./protocol/schema/error-codes.js";
 import "./protocol/index.js";
@@ -272,13 +271,12 @@ async function applySessionsPatchToStore(params) {
 				catalog,
 				raw: trimmed,
 				defaultProvider: resolvedDefault.provider,
-				defaultModel: subagentModelHint ?? resolvedDefault.model,
-				additionalAllowedProviders: params.additionalAllowedModelProviders
+				defaultModel: subagentModelHint ?? resolvedDefault.model
 			});
 			if ("error" in resolved) {
 				return invalid(resolved.error);
 			}
-			if (params.additionalAllowedModelProviders && !catalog.some((entry) => modelKey(entry.provider, entry.id) === modelKey(resolved.ref.provider, resolved.ref.model)) && !isStandardProviderModelRef(resolved.key)) {
+			if (params.additionalAllowedModelProviders && !new Set([...params.additionalAllowedModelProviders].map((provider) => normalizeProviderId(provider)).filter(Boolean)).has(normalizeProviderId(resolved.ref.provider))) {
 				return invalid(`Model "${resolved.key}" is not available for signed-in providers.`);
 			}
 			const isDefault = resolved.ref.provider === resolvedDefault.provider && resolved.ref.model === resolvedDefault.model;

package/dist/index.js

@@ -22,8 +22,6 @@ import { createDefaultDeps } from "./cli/deps.js";
 import { getReplyFromConfig } from "./auto-reply/reply/get-reply.js";
 import "./auto-reply/reply.js";
 import { waitForever } from "./cli/wait.js";
-import { monitorWebChannel } from "./web/auto-reply/monitor.js";
-import "./channel-web.js";
 import { isMainModule } from "./infra/is-main.js";
 import { ensureFasedAgentCliOnPath } from "./infra/path-env.js";
 import { buildProgram } from "./cli/program/build-program.js";
@@ -38,6 +36,10 @@ ensureFasedAgentCliOnPath();
 enableConsoleCapture();
 assertSupportedRuntime();
 const program = buildProgram();
+const monitorWebChannel = async (...args) => {
+	const channelWeb = await import("./channel-web.js");
+	return await channelWeb.monitorWebChannel(...args);
+};
 const isMain = isMainModule({ currentFile: fileURLToPath(import.meta.url) });
 if (isMain) {
 	installUnhandledRejectionHandler();

package/dist/infra/fasedhub.js

@@ -7,6 +7,7 @@ import { createHash } from "node:crypto";
 //#region src/infra/fasedhub.ts
 const DEFAULT_CLAWHUB_REGISTRY = "https://clawhub.com";
 const DEFAULT_FETCH_TIMEOUT_MS = 3e4;
+const MAX_SKILL_ARCHIVE_BYTES = 25 * 1024 * 1024;
 var FasedHubRequestError = class extends Error {
 	constructor(params) {
 		super(`ClawHub ${params.path} failed (${params.status}): ${params.body}`);
@@ -123,6 +124,61 @@ function formatSha256Integrity(bytes) {
 	const digest = createHash("sha256").update(bytes).digest("base64");
 	return `sha256-${digest}`;
 }
+function normalizeExpectedSha256(value) {
+	const normalized = value?.trim().toLowerCase();
+	return normalized && /^[a-f0-9]{64}$/u.test(normalized) ? normalized : undefined;
+}
+function sha256HexFromIntegrity(value) {
+	const normalized = value?.trim();
+	if (!normalized?.startsWith("sha256-")) {
+		return undefined;
+	}
+	try {
+		const digest = Buffer.from(normalized.slice("sha256-".length), "base64");
+		return digest.length === 32 ? digest.toString("hex") : undefined;
+	} catch {
+		return undefined;
+	}
+}
+async function readBoundedResponseBytes(response, maxBytes) {
+	const declaredLength = Number(response.headers.get("content-length"));
+	if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+		throw new Error(`ClawHub skill archive exceeds the ${maxBytes}-byte download limit`);
+	}
+	if (!response.body) {
+		const bytes = new Uint8Array(await response.arrayBuffer());
+		if (bytes.byteLength > maxBytes) {
+			throw new Error(`ClawHub skill archive exceeds the ${maxBytes}-byte download limit`);
+		}
+		return bytes;
+	}
+	const chunks = [];
+	const reader = response.body.getReader();
+	let total = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) {
+				break;
+			}
+			total += value.byteLength;
+			if (total > maxBytes) {
+				await reader.cancel();
+				throw new Error(`ClawHub skill archive exceeds the ${maxBytes}-byte download limit`);
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
 function sanitizeTempFileName(fileName) {
 	const base = path.basename(fileName).replace(/[^a-zA-Z0-9._-]+/g, "-");
 	const normalized = base.replace(/^-+|-+$/g, "");
@@ -193,7 +249,12 @@ async function downloadFasedHubSkillArchive(params) {
 			body: await readErrorBody(response)
 		});
 	}
-	const bytes = new Uint8Array(await response.arrayBuffer());
+	const bytes = await readBoundedResponseBytes(response, MAX_SKILL_ARCHIVE_BYTES);
+	const sha256 = createHash("sha256").update(bytes).digest("hex");
+	const expectedSha256 = normalizeExpectedSha256(params.expectedSha256) ?? sha256HexFromIntegrity(params.expectedIntegrity);
+	if (expectedSha256 && expectedSha256 !== sha256) {
+		throw new Error(`ClawHub skill archive digest mismatch: expected ${expectedSha256}, received ${sha256}`);
+	}
 	const target = await createTempDownloadTarget({
 		prefix: "clawhub-skill",
 		fileName: `${params.slug}.zip`
@@ -202,6 +263,8 @@ async function downloadFasedHubSkillArchive(params) {
 	return {
 		archivePath: target.path,
 		integrity: formatSha256Integrity(bytes),
+		sha256,
+		integrityVerified: Boolean(expectedSha256),
 		cleanup: target.cleanup
 	};
 }