@gamalan/pi-gateway 1.0.0

package/dist/index.js

@@ -0,0 +1,1275 @@
+/**
+ * pi-gateway - Hermes-style Messaging Gateway
+ *
+ * Architecture:
+ * - Single background process
+ * - Platform adapters (Discord, Telegram, etc.)
+ * - Per-chat session management
+ * - Background task support
+ * - Security (allowlists, pairing)
+ *
+ * Usage:
+ *   /gateway start [port]    - Start the gateway
+ *   /gateway stop           - Stop the gateway
+ *   /gateway status         - Show status
+ *   /gateway pair <code>    - Approve pairing code
+ */
+import { join } from "node:path";
+import { existsSync, readFileSync, copyFileSync, mkdirSync } from "node:fs";
+import { createServer, } from "node:http";
+import { WebSocketServer, WebSocket } from "ws";
+import { randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { Type } from "@sinclair/typebox";
+import { initSessionStore, getOrCreateSession, listSessions, touchSession, } from "./sessions/store.js";
+import { logger } from "./logger.js";
+import { GATEWAY_CONFIG_DIR, GATEWAY_CONFIG_FILE, getPackageRoot, } from "./paths.js";
+import { initSecurityStore, isUserAllowed, approvePairingCode, generatePairingCode, listPendingPairingCodes, addToAllowlist, listAllowlistedUsers, revokeUserAccess, addAdmin, removeAdmin, listAdmins, } from "./security/auth.js";
+import { setToolPolicy, removeToolPolicy, listToolPolicies, resetToolPolicies, getEffectivePolicySummary, buildPolicyGuard, } from "./security/tool-policy.js";
+import { initBackgroundTasks, startBackgroundTask, getPendingResultsForSession, markTaskDelivered, listTasks, } from "./background/manager.js";
+import { DiscordAdapter } from "./adapters/discord.js";
+import { TwitchAdapter } from "./adapters/twitch.js";
+import { TelegramAdapter } from "./adapters/telegram.js";
+import { SlackAdapter } from "./adapters/slack.js";
+import { WhatsAppAdapter } from "./adapters/whatsapp.js";
+const DEFAULT_CONFIG = {
+    port: 3847,
+    host: "localhost",
+    tokens: [],
+    corsOrigins: ["*"],
+    enableWebSocket: true,
+    enableHttp: true,
+    security: {
+        allowAll: true,
+        requirePairing: false,
+        allowedUids: {},
+        adminUids: {},
+        rateLimit: { maxRequests: 60, windowMs: 60000 },
+    },
+    sessions: {
+        resetPolicy: "idle",
+        dailyHour: 4,
+        idleMinutes: 1440,
+    },
+    platforms: {},
+};
+let config;
+let state;
+let server = null;
+let wss = null;
+let globalCtx = null;
+let rpcProcess = null;
+let cronInterval = null;
+const pendingRequests = [];
+const pendingCompletions = [];
+// Load/save config
+function loadConfig() {
+    try {
+        if (existsSync(GATEWAY_CONFIG_FILE)) {
+            return {
+                ...DEFAULT_CONFIG,
+                ...JSON.parse(readFileSync(GATEWAY_CONFIG_FILE, "utf-8")),
+            };
+        }
+        // No config file yet — seed from default template
+        const packageRoot = getPackageRoot(import.meta.url);
+        const defaultConfigPath = join(packageRoot, "config", "config.default.json");
+        if (existsSync(defaultConfigPath)) {
+            if (!existsSync(GATEWAY_CONFIG_DIR)) {
+                mkdirSync(GATEWAY_CONFIG_DIR, { recursive: true });
+            }
+            copyFileSync(defaultConfigPath, GATEWAY_CONFIG_FILE);
+            logger.info("[gateway] Seeded default config at", GATEWAY_CONFIG_FILE);
+            return {
+                ...DEFAULT_CONFIG,
+                ...JSON.parse(readFileSync(GATEWAY_CONFIG_FILE, "utf-8")),
+            };
+        }
+    }
+    catch (err) {
+        logger.error("[gateway] Failed to parse config file — using defaults. Error:", err);
+    }
+    return { ...DEFAULT_CONFIG };
+}
+// Token auth
+function verifyToken(token) {
+    if (config.tokens.length === 0)
+        return true;
+    return config.tokens.includes(token);
+}
+function authenticate(req) {
+    const auth = req.headers.authorization;
+    if (!auth)
+        return verifyToken("");
+    if (auth.startsWith("Bearer "))
+        return verifyToken(auth.slice(7));
+    return false;
+}
+// WebSocket helpers
+function sendWs(ws, msg) {
+    if (ws.readyState === WebSocket.OPEN) {
+        ws.send(JSON.stringify(msg));
+    }
+}
+function broadcastClients(event, data) {
+    for (const ws of state.clients.values()) {
+        sendWs(ws, { type: event, data });
+    }
+}
+// RPC to pi agent
+function createRpcProcess() {
+    const proc = spawn("pi", ["--mode", "rpc"], {
+        stdio: ["pipe", "pipe", "pipe"],
+        env: {
+            ...process.env,
+            OLLAMA_HOST: process.env.OLLAMA_HOST || "localhost:11434",
+        },
+    });
+    proc.stdout?.on("data", (data) => {
+        const lines = data.toString().split("\n").filter(Boolean);
+        for (const line of lines) {
+            try {
+                const msg = JSON.parse(line);
+                if (msg.id) {
+                    const idx = pendingRequests.findIndex((r) => r.id === msg.id);
+                    if (idx !== -1) {
+                        const req = pendingRequests.splice(idx, 1)[0];
+                        req.resolve(msg);
+                    }
+                }
+                // agent_end carries the full response — resolve pending completions
+                if (msg.type === "agent_end") {
+                    const text = extractAgentEndText(msg);
+                    logger.info(`[gateway] agent_end received, text length: ${text.length}`);
+                    const completion = pendingCompletions.shift();
+                    if (completion) {
+                        clearTimeout(completion.timer);
+                        completion.resolve(text);
+                    }
+                }
+                // Broadcast events
+                if (msg.type === "response") {
+                    broadcastClients("response", msg);
+                }
+                else {
+                    broadcastClients("event", msg);
+                }
+            }
+            catch {
+                /* not JSON */
+            }
+        }
+    });
+    proc.stderr?.on("data", (data) => {
+        logger.info("[gateway] pi stderr:", data.toString().trim());
+    });
+    proc.on("exit", (code) => {
+        logger.info("[gateway] pi process exited");
+        // Reject any pending completions so they don't hang forever
+        while (pendingCompletions.length > 0) {
+            const completion = pendingCompletions.shift();
+            clearTimeout(completion.timer);
+            completion.reject(new Error(`pi process exited with code ${code}`));
+        }
+        rpcProcess = null;
+        broadcastClients("agent_disconnected", { code });
+    });
+    return proc;
+}
+async function sendRpc(command, data = {}) {
+    if (!rpcProcess)
+        throw new Error("pi agent not running");
+    const id = randomBytes(8).toString("hex");
+    const payload = { id, type: command, ...data };
+    return new Promise((resolve, reject) => {
+        pendingRequests.push({ id, resolve, reject });
+        try {
+            rpcProcess.stdin.write(JSON.stringify(payload) + "\n");
+        }
+        catch (err) {
+            const idx = pendingRequests.findIndex((r) => r.id === id);
+            if (idx !== -1)
+                pendingRequests.splice(idx, 1);
+            reject(err);
+        }
+        setTimeout(() => {
+            const idx = pendingRequests.findIndex((r) => r.id === id);
+            if (idx !== -1) {
+                pendingRequests.splice(idx, 1);
+                reject(new Error("Request timeout"));
+            }
+        }, 30000);
+    });
+}
+// Extract assistant response text from agent_end.messages
+function extractAgentEndText(agentEndMsg) {
+    const messages = agentEndMsg.messages;
+    if (!messages)
+        return "";
+    const parts = [];
+    for (const msg of messages) {
+        if (msg.role === "assistant") {
+            const content = msg.content;
+            if (Array.isArray(content)) {
+                for (const block of content) {
+                    if (block.type === "text" && typeof block.text === "string") {
+                        parts.push(block.text);
+                    }
+                }
+            }
+        }
+    }
+    return parts.join("\n");
+}
+// Send a prompt to pi and wait for agent_end to get the full response text.
+// Unlike sendRpc (which resolves with the ACK), this resolves with the
+// actual assistant response text after the agent finishes processing.
+async function sendPromptRpc(message) {
+    if (!rpcProcess)
+        throw new Error("pi agent not running");
+    // Send the prompt and wait for the ACK (so we know the prompt was accepted)
+    const ackResponse = await sendRpc("prompt", { message });
+    const ack = ackResponse;
+    if (!ack.success) {
+        throw new Error(`Prompt rejected: ${JSON.stringify(ackResponse)}`);
+    }
+    logger.info("[gateway] Prompt ACK received, waiting for agent_end...");
+    // Wait for agent_end to deliver the full response
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            const idx = pendingCompletions.findIndex((c) => c.timer === timer);
+            if (idx !== -1)
+                pendingCompletions.splice(idx, 1);
+            reject(new Error("Prompt completion timeout — no agent_end received within 5 minutes"));
+        }, 300000); // 5 minutes
+        pendingCompletions.push({ resolve, reject, timer });
+    });
+}
+// Extract response text from pi RPC response (kept for backward compat with old sendRpc)
+// pi responds with JSON lines on stdout;
+// the response shape varies but typically contains `text` or `content`
+function extractRpcResponseText(response) {
+    if (typeof response === "string")
+        return response;
+    const r = response;
+    if (r.text && typeof r.text === "string")
+        return r.text;
+    if (r.content) {
+        // OpenAI-style content array: [{ type: "text", text: "..." }]
+        if (Array.isArray(r.content)) {
+            return r.content
+                .filter((c) => c.type === "text" && typeof c.text === "string")
+                .map((c) => c.text)
+                .join("\n");
+        }
+        if (typeof r.content === "string")
+            return r.content;
+    }
+    // Fallback — the response might be something we don't recognise
+    return "";
+}
+// Platform adapter callbacks
+const adapterCallbacks = {
+    onMessage: async (message) => {
+        // Get or create session for this chat
+        const session = getOrCreateSession(message.platform, message.channelId, message.userId, {
+            resetPolicy: config.sessions.resetPolicy,
+            dailyHour: config.sessions.dailyHour,
+            idleMinutes: config.sessions.idleMinutes,
+        });
+        // Check allowlist
+        if (!isUserAllowed(message.platform, message.userId)) {
+            logger.info(`[gateway] User ${message.userId} not in allowlist`);
+            // Could send a DM here about pairing flow
+            return;
+        }
+        // Store session reference
+        state.sessions.set(`${message.platform}:${message.channelId}`, session);
+        // Send to pi agent with tool policy guard
+        if (rpcProcess) {
+            const guard = buildPolicyGuard(message.platform, message.userId);
+            try {
+                logger.info(`[gateway] Sending prompt from ${message.platform}/${message.userId} (session: ${session.id.slice(0, 12)}...)`);
+                // Use sendPromptRpc which waits for agent_end (the real response),
+                // NOT the ACK which has no content
+                const responseText = await sendPromptRpc(`${guard}\n\n${message.content}`);
+                logger.info(`[gateway] Response received, length: ${responseText.length}, sending back to ${message.platform}/${message.channelId}`);
+                if (responseText) {
+                    const adapter = state.adapters.get(message.platform);
+                    if (adapter) {
+                        await adapter.sendMessage(message.channelId, responseText);
+                        logger.info("[gateway] Response sent to platform successfully");
+                    }
+                }
+                else {
+                    logger.warn("[gateway] Response text was empty — nothing to send");
+                    const adapter = state.adapters.get(message.platform);
+                    if (adapter) {
+                        await adapter.sendMessage(message.channelId, "I processed your message but had no text response. Please try again.");
+                    }
+                }
+            }
+            catch (err) {
+                logger.error("[gateway] RPC error processing message:", err);
+                const adapter = state.adapters.get(message.platform);
+                if (adapter) {
+                    try {
+                        await adapter.sendMessage(message.channelId, "Sorry, I encountered an error processing your message. Please try again.");
+                    }
+                    catch (sendErr) {
+                        logger.error("[gateway] Failed to send error message:", sendErr);
+                    }
+                }
+            }
+        }
+        else {
+            logger.warn("[gateway] pi agent not running — cannot process message");
+        }
+    },
+    onDisconnect: () => {
+        logger.info("[gateway] Platform adapter disconnected");
+        updateStatus();
+    },
+};
+// Initialize platform adapters
+async function initializeAdapters() {
+    // Discord
+    if (config.platforms.discord?.enabled && config.platforms.discord.botToken) {
+        try {
+            const discord = new DiscordAdapter({
+                enabled: true,
+                platform: "discord",
+                botToken: config.platforms.discord.botToken,
+                guildId: config.platforms.discord.guildId,
+            });
+            await discord.initialize();
+            await discord.start(adapterCallbacks);
+            state.adapters.set("discord", discord);
+            logger.info("[gateway] Discord adapter started");
+        }
+        catch (err) {
+            logger.error("[gateway] Failed to start Discord adapter:", err);
+        }
+    }
+    // Twitch
+    if (config.platforms.twitch?.enabled &&
+        config.platforms.twitch.clientId &&
+        config.platforms.twitch.clientSecret) {
+        try {
+            const twitch = new TwitchAdapter({
+                enabled: true,
+                platform: "twitch",
+                clientId: config.platforms.twitch.clientId,
+                clientSecret: config.platforms.twitch.clientSecret,
+                channels: config.platforms.twitch.channels,
+            });
+            await twitch.initialize();
+            await twitch.start(adapterCallbacks);
+            state.adapters.set("twitch", twitch);
+            logger.info("[gateway] Twitch adapter started");
+        }
+        catch (err) {
+            logger.error("[gateway] Failed to start Twitch adapter:", err);
+        }
+    }
+    // Telegram
+    if (config.platforms.telegram?.enabled && config.platforms.telegram.token) {
+        try {
+            const telegram = new TelegramAdapter({
+                enabled: true,
+                platform: "telegram",
+                token: config.platforms.telegram.token,
+                webhookUrl: config.platforms.telegram.webhookUrl,
+            });
+            await telegram.initialize();
+            await telegram.start(adapterCallbacks);
+            state.adapters.set("telegram", telegram);
+            logger.info("[gateway] Telegram adapter started");
+        }
+        catch (err) {
+            logger.error("[gateway] Failed to start Telegram adapter:", err);
+        }
+    }
+    // Slack
+    if (config.platforms.slack?.enabled &&
+        (config.platforms.slack.webhookUrl || config.platforms.slack.botToken)) {
+        try {
+            const slack = new SlackAdapter({
+                enabled: true,
+                platform: "slack",
+                webhookUrl: config.platforms.slack.webhookUrl,
+                botToken: config.platforms.slack.botToken,
+            });
+            await slack.initialize();
+            await slack.start(adapterCallbacks);
+            state.adapters.set("slack", slack);
+            logger.info("[gateway] Slack adapter started");
+        }
+        catch (err) {
+            logger.error("[gateway] Failed to start Slack adapter:", err);
+        }
+    }
+    // WhatsApp
+    if (config.platforms.whatsapp?.enabled) {
+        try {
+            const whatsapp = new WhatsAppAdapter({
+                enabled: true,
+                platform: "whatsapp",
+                sessionPath: config.platforms.whatsapp.sessionPath,
+                printQr: config.platforms.whatsapp.printQr,
+            });
+            await whatsapp.initialize();
+            await whatsapp.start(adapterCallbacks);
+            state.adapters.set("whatsapp", whatsapp);
+            logger.info("[gateway] WhatsApp adapter started");
+        }
+        catch (err) {
+            logger.error("[gateway] Failed to start WhatsApp adapter:", err);
+        }
+    }
+}
+// Cron job for background tasks and session cleanup
+function startCron() {
+    cronInterval = setInterval(async () => {
+        // Check for pending background results
+        for (const session of state.sessions.values()) {
+            const pending = getPendingResultsForSession(session.id);
+            for (const task of pending) {
+                // Deliver result to user via their platform
+                const adapter = state.adapters.get(session.platform);
+                if (adapter) {
+                    const resultText = task.status === "completed"
+                        ? `✅ Background task completed:\n\`\`\`\n${JSON.stringify(task.result, null, 2)}\n\`\`\``
+                        : `❌ Background task failed:\n\`\`\`\n${task.error}\n\`\`\``;
+                    await adapter.sendMessage(session.channelId, resultText);
+                    markTaskDelivered(task.id);
+                }
+            }
+        }
+        // Touch active sessions
+        for (const session of state.sessions.values()) {
+            touchSession(session.id);
+        }
+    }, 60000); // Every 60 seconds (Hermes-style)
+}
+function stopCron() {
+    if (cronInterval) {
+        clearInterval(cronInterval);
+        cronInterval = null;
+    }
+}
+// HTTP handlers
+async function handleHttpRequest(req, res) {
+    res.setHeader("Access-Control-Allow-Origin", config.corsOrigins.join(",") || "*");
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+    if (req.method === "OPTIONS") {
+        res.writeHead(204);
+        res.end();
+        return;
+    }
+    // ── Telegram webhook (unauthenticated — called by Telegram) ──
+    const url = new URL(req.url || "/", `http://${req.headers.host}`);
+    if (url.pathname === "/webhook/telegram" && req.method === "POST") {
+        const chunks = [];
+        req.on("data", (chunk) => chunks.push(chunk));
+        req.on("end", async () => {
+            try {
+                const body = JSON.parse(Buffer.concat(chunks).toString());
+                const telegram = state.adapters.get("telegram");
+                if (telegram?.handleWebhookUpdate) {
+                    await telegram.handleWebhookUpdate(body);
+                    res.writeHead(200);
+                    res.end("ok");
+                }
+                else {
+                    res.writeHead(503);
+                    res.end("Telegram adapter not running");
+                }
+            }
+            catch {
+                res.writeHead(400);
+                res.end("Invalid request");
+            }
+        });
+        return;
+    }
+    if (!authenticate(req)) {
+        res.writeHead(401);
+        res.end(JSON.stringify({ error: "Unauthorized" }));
+        return;
+    }
+    // API endpoints
+    if (url.pathname === "/api/status" && req.method === "GET") {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({
+            running: state.running,
+            adapters: Array.from(state.adapters.keys()),
+            clients: state.clients.size,
+            sessions: state.sessions.size,
+            agent: rpcProcess !== null,
+        }));
+        return;
+    }
+    if (url.pathname === "/api/sessions" && req.method === "GET") {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(listSessions()));
+        return;
+    }
+    if (url.pathname === "/api/background" && req.method === "GET") {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(listTasks()));
+        return;
+    }
+    if (url.pathname === "/api/allowlist" && req.method === "GET") {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(listAllowlistedUsers()));
+        return;
+    }
+    if (url.pathname === "/api/pairing" && req.method === "GET") {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(listPendingPairingCodes()));
+        return;
+    }
+    res.writeHead(404);
+    res.end(JSON.stringify({ error: "Not found" }));
+}
+// WebSocket handler
+function handleWebSocket(ws, req) {
+    if (!authenticate(req)) {
+        ws.close(1008, "Unauthorized");
+        return;
+    }
+    const clientId = randomBytes(8).toString("hex");
+    state.clients.set(clientId, ws);
+    logger.info(`[gateway] WebSocket client connected: ${clientId}`);
+    sendWs(ws, { type: "connected", data: { clientId } });
+    ws.on("message", async (data) => {
+        try {
+            const msg = JSON.parse(data.toString());
+            switch (msg.type) {
+                case "prompt": {
+                    const result = await sendRpc("prompt", {
+                        message: msg.data?.message || "",
+                    });
+                    sendWs(ws, { type: "response", id: msg.id, data: result });
+                    break;
+                }
+                case "background": {
+                    const task = startBackgroundTask(msg.data?.sessionId || "default", msg.data?.command || "");
+                    sendWs(ws, { type: "background_started", data: task });
+                    break;
+                }
+                case "ping": {
+                    sendWs(ws, { type: "pong", data: { time: Date.now() } });
+                    break;
+                }
+            }
+        }
+        catch (err) {
+            sendWs(ws, { type: "error", data: { error: String(err) } });
+        }
+    });
+    ws.on("close", () => {
+        state.clients.delete(clientId);
+        logger.info(`[gateway] WebSocket client disconnected: ${clientId}`);
+    });
+}
+// Status update
+function updateStatus() {
+    if (!globalCtx)
+        return;
+    const adapterCount = state.adapters.size;
+    const statusText = state.running
+        ? adapterCount > 0
+            ? `🟢 Gateway (${adapterCount} platform${adapterCount !== 1 ? "s" : ""})`
+            : `🟡 Gateway (waiting)`
+        : "🔴 Gateway";
+    globalCtx.ui.setStatus("gateway", statusText);
+}
+export default function (pi) {
+    config = loadConfig();
+    state = {
+        running: false,
+        adapters: new Map(),
+        clients: new Map(),
+        sessions: new Map(),
+    };
+    // Initialize stores
+    initSessionStore();
+    initSecurityStore();
+    initBackgroundTasks();
+    // Register commands
+    pi.registerCommand("gateway", {
+        description: "Manage Hermes-style messaging gateway",
+        getArgumentCompletions: (prefix) => {
+            const cmds = [
+                "start",
+                "stop",
+                "status",
+                "restart",
+                "pair",
+                "allow",
+                "revoke",
+                "admin",
+                "sessions",
+                "tasks",
+                "config",
+                "tool-policy",
+            ];
+            return cmds
+                .filter((c) => c.startsWith(prefix))
+                .map((c) => ({ value: c, label: c }));
+        },
+        handler: async (args, ctx) => {
+            const parts = args.split(/\s+/).filter(Boolean);
+            const subcmd = parts[0]?.toLowerCase();
+            switch (subcmd) {
+                case "start": {
+                    if (state.running) {
+                        ctx.ui.notify("Gateway already running", "info");
+                        return;
+                    }
+                    // Reload config fresh on every start so users can edit
+                    // ~/.pi/gateway/config.json without restarting pi
+                    config = loadConfig();
+                    const port = parseInt(parts[1]) || config.port;
+                    // Start HTTP server
+                    server = createServer(handleHttpRequest);
+                    if (config.enableWebSocket) {
+                        wss = new WebSocketServer({ server });
+                        wss.on("connection", handleWebSocket);
+                    }
+                    server.listen(port, config.host, () => {
+                        logger.info(`[gateway] HTTP server started on ${config.host}:${port}`);
+                    });
+                    // Start pi agent
+                    rpcProcess = createRpcProcess();
+                    // Initialize platform adapters
+                    await initializeAdapters();
+                    // Start cron
+                    startCron();
+                    state.running = true;
+                    updateStatus();
+                    ctx.ui.notify(`✅ Gateway started on http://${config.host}:${port}\n\n` +
+                        `Platforms: ${state.adapters.size > 0 ? Array.from(state.adapters.keys()).join(", ") : "none"}\n` +
+                        `Sessions: Idle reset every ${config.sessions.idleMinutes} min`, "info");
+                    return;
+                }
+                case "stop": {
+                    if (!state.running) {
+                        ctx.ui.notify("Gateway not running", "info");
+                        return;
+                    }
+                    // Stop adapters
+                    for (const adapter of state.adapters.values()) {
+                        await adapter.stop();
+                    }
+                    state.adapters.clear();
+                    // Stop cron
+                    stopCron();
+                    // Close WebSocket clients
+                    for (const ws of state.clients.values()) {
+                        ws.close(1000, "Server shutting down");
+                    }
+                    state.clients.clear();
+                    // Stop HTTP server
+                    server?.close();
+                    server = null;
+                    wss = null;
+                    // Kill pi process
+                    if (rpcProcess) {
+                        rpcProcess.kill();
+                        rpcProcess = null;
+                    }
+                    state.running = false;
+                    updateStatus();
+                    ctx.ui.notify("Gateway stopped", "info");
+                    return;
+                }
+                case "restart": {
+                    if (state.running) {
+                        // Stop
+                        for (const adapter of state.adapters.values()) {
+                            await adapter.stop();
+                        }
+                        state.adapters.clear();
+                        stopCron();
+                        for (const ws of state.clients.values()) {
+                            ws.close(1000, "Server restart");
+                        }
+                        state.clients.clear();
+                        server?.close();
+                        server = null;
+                        wss = null;
+                        if (rpcProcess) {
+                            rpcProcess.kill();
+                            rpcProcess = null;
+                        }
+                        state.running = false;
+                    }
+                    // Reload config and start
+                    config = loadConfig();
+                    const port = parseInt(parts[1]) || config.port;
+                    server = createServer(handleHttpRequest);
+                    if (config.enableWebSocket) {
+                        wss = new WebSocketServer({ server });
+                        wss.on("connection", handleWebSocket);
+                    }
+                    server.listen(port, config.host, () => {
+                        logger.info(`[gateway] HTTP server started on ${config.host}:${port}`);
+                    });
+                    rpcProcess = createRpcProcess();
+                    await initializeAdapters();
+                    startCron();
+                    state.running = true;
+                    updateStatus();
+                    ctx.ui.notify(`✅ Gateway restarted on http://${config.host}:${port}\n\n` +
+                        `Platforms: ${state.adapters.size > 0 ? Array.from(state.adapters.keys()).join(", ") : "none"}\n` +
+                        `Sessions: Idle reset every ${config.sessions.idleMinutes} min`, "info");
+                    return;
+                }
+                case "status": {
+                    const lines = [];
+                    lines.push(`Status: ${state.running ? "🟢 Running" : "🔴 Stopped"}`);
+                    lines.push(`Port: ${config.port}`);
+                    lines.push(`Adapters: ${state.adapters.size}`);
+                    lines.push(`Clients: ${state.clients.size}`);
+                    lines.push(`Sessions: ${state.sessions.size}`);
+                    lines.push(`Agent: ${rpcProcess ? "✅ Connected" : "❌ Disconnected"}`);
+                    lines.push("");
+                    lines.push(`Session Reset: ${config.sessions.resetPolicy}`);
+                    lines.push(`  - Daily at ${config.sessions.dailyHour}:00`);
+                    lines.push(`  - Idle after ${config.sessions.idleMinutes} min`);
+                    lines.push("");
+                    const adminCount = listAdmins().length +
+                        Object.values(config.security.adminUids ?? {}).reduce((sum, uids) => sum + uids.length, 0);
+                    lines.push(`Security: ${config.security.allowAll ? "Allow all" : "Allowlist only"}${Object.values(config.security.allowedUids ?? {}).reduce((sum, uids) => sum + uids.length, 0) > 0 ? ` (+${Object.values(config.security.allowedUids ?? {}).reduce((sum, uids) => sum + uids.length, 0)} config UIDs)` : ""}`);
+                    lines.push(`Admins: ${adminCount}`);
+                    ctx.ui.setWidget("gateway-status", lines, {
+                        placement: "belowEditor",
+                    });
+                    setTimeout(() => ctx.ui.setWidget("gateway-status", undefined), 15000);
+                    return;
+                }
+                case "pair": {
+                    const code = parts[1]?.toUpperCase();
+                    const pending = code ? null : listPendingPairingCodes();
+                    if (pending) {
+                        ctx.ui.notify("Pending pairing codes:\n" +
+                            (pending.length > 0
+                                ? pending
+                                    .map((p) => `${p.code} - ${p.platform} (${Math.round(p.expiresIn / 60000)}min)`)
+                                    .join("\n")
+                                : "None"), "info");
+                        return;
+                    }
+                    if (approvePairingCode(code)) {
+                        ctx.ui.notify("Pairing code approved", "info");
+                    }
+                    else {
+                        ctx.ui.notify(`❌ Invalid or expired pairing code`, "error");
+                    }
+                    return;
+                }
+                case "allow": {
+                    const platform = parts[1];
+                    const userId = parts[2];
+                    const list = listAllowlistedUsers();
+                    const configUids = config.security.allowedUids ?? {};
+                    const configLines = [];
+                    for (const [plat, uids] of Object.entries(configUids)) {
+                        for (const uid of uids) {
+                            configLines.push(`${plat}:${uid} (config)`);
+                        }
+                    }
+                    if (!platform || !userId) {
+                        ctx.ui.notify("Allowlisted users:\n" +
+                            (list.length > 0 || configLines.length > 0
+                                ? [
+                                    ...list.map((u) => `${u.platform}:${u.userId}`),
+                                    ...configLines,
+                                ].join("\n")
+                                : "None"), "info");
+                        return;
+                    }
+                    addToAllowlist(platform, userId);
+                    ctx.ui.notify(`Added ${userId} to allowlist`, "info");
+                    return;
+                }
+                case "revoke": {
+                    const platform = parts[1];
+                    const userId = parts[2];
+                    if (!platform || !userId) {
+                        ctx.ui.notify("Usage: /gateway revoke <platform> <userId>\n" +
+                            "Removes a user from the DB allowlist.", "info");
+                        return;
+                    }
+                    const removed = revokeUserAccess(platform, userId);
+                    ctx.ui.notify(removed
+                        ? `Removed ${userId} from allowlist`
+                        : `${userId} was not in the allowlist`, removed ? "info" : "error");
+                    return;
+                }
+                case "admin": {
+                    const action = parts[1]?.toLowerCase();
+                    switch (action) {
+                        case "list": {
+                            const dbAdmins = listAdmins();
+                            const configAdmins = config.security.adminUids ?? {};
+                            const configLines = [];
+                            for (const [plat, uids] of Object.entries(configAdmins)) {
+                                for (const uid of uids) {
+                                    configLines.push(`${plat}:${uid} (config)`);
+                                }
+                            }
+                            const dbLines = dbAdmins.map((a) => `${a.platform}:${a.userId}`);
+                            ctx.ui.notify("Admin users:\n" +
+                                ([...dbLines, ...configLines].length > 0
+                                    ? [...dbLines, ...configLines].join("\n")
+                                    : "None"), "info");
+                            return;
+                        }
+                        case "add": {
+                            const plat = parts[2];
+                            const uid = parts[3];
+                            if (!plat || !uid) {
+                                ctx.ui.notify("Usage: /gateway admin add <platform|*> <userId>\n" +
+                                    "Use * for platform to make admin on all platforms.\n" +
+                                    "Admins bypass all tool restrictions and have full access.", "info");
+                                return;
+                            }
+                            addAdmin(plat, uid);
+                            ctx.ui.notify(`✅ ${uid} is now admin on ${plat === "*" ? "all platforms" : plat}`, "info");
+                            return;
+                        }
+                        case "remove": {
+                            const plat = parts[2];
+                            const uid = parts[3];
+                            if (!plat || !uid) {
+                                ctx.ui.notify("Usage: /gateway admin remove <platform|*> <userId>", "info");
+                                return;
+                            }
+                            if (removeAdmin(plat, uid)) {
+                                ctx.ui.notify(`Removed admin: ${plat}:${uid}`, "info");
+                            }
+                            else {
+                                ctx.ui.notify(`${uid} was not an admin on ${plat}`, "error");
+                            }
+                            return;
+                        }
+                        default: {
+                            ctx.ui.notify("/gateway admin commands:\n\n" +
+                                "  list                  - Show all admins (DB + config)\n" +
+                                "  add <platform|*> <uid>  - Grant admin privileges\n" +
+                                "  remove <platform|*> <uid> - Revoke admin privileges\n\n" +
+                                "Admins bypass all tool restrictions and have full access.\n" +
+                                "Use * as platform to grant admin on all platforms.\n" +
+                                "Config-file admins: set adminUids in gateway-security.json", "info");
+                        }
+                    }
+                    return;
+                }
+                case "sessions": {
+                    const sessions = listSessions();
+                    ctx.ui.notify("Active sessions:\n" +
+                        sessions
+                            .slice(0, 10)
+                            .map((s) => `${s.platform}:${s.channelId} (${s.id.slice(0, 8)}...)`)
+                            .join("\n"), "info");
+                    return;
+                }
+                case "tasks": {
+                    const tasks = listTasks();
+                    ctx.ui.notify("Background tasks:\n" +
+                        tasks
+                            .slice(0, 10)
+                            .map((t) => `${t.id.slice(0, 12)}... - ${t.status} (${t.progress}%)`)
+                            .join("\n"), "info");
+                    return;
+                }
+                case "config": {
+                    const configUidCount2 = Object.values(config.security.allowedUids ?? {}).reduce((sum, uids) => sum + uids.length, 0);
+                    ctx.ui.notify(`Gateway Config:\n\n` +
+                        `Port: ${config.port}\n` +
+                        `Sessions: ${config.sessions.resetPolicy}\n` +
+                        `Security: ${config.security.allowAll ? "Allow all" : "Allowlist"}` +
+                        ` (${configUidCount2} config UIDs)\n` +
+                        `Discord: ${config.platforms.discord?.enabled ? "Enabled" : "Disabled"}`, "info");
+                    return;
+                }
+                case "tool-policy": {
+                    const action = parts[1]?.toLowerCase();
+                    switch (action) {
+                        case "list": {
+                            const platform = parts[2];
+                            const userId = parts[3];
+                            const policies = listToolPolicies(platform, userId);
+                            if (policies.length === 0) {
+                                ctx.ui.notify("No explicit tool policies — only defaults active.\n" +
+                                    "Use /gateway tool-policy defaults to see them.", "info");
+                                return;
+                            }
+                            ctx.ui.notify("Tool policies:\n" +
+                                policies
+                                    .map((p) => `#${p.id} ${p.platform ?? "*"}:${p.userId ?? "*"} → ${p.toolName} [${p.action}]`)
+                                    .join("\n"), "info");
+                            return;
+                        }
+                        case "defaults": {
+                            const summary = getEffectivePolicySummary("*", "*");
+                            ctx.ui.notify("Default Tool Policy (all external users):\n\n" +
+                                `✅ ALLOWED:\n  ${summary.allowed.join("\n  ")}\n\n` +
+                                `🚫 DENIED:\n  ${summary.denied.join("\n  ")}\n\n` +
+                                "Use /gateway tool-policy set to override.", "info");
+                            return;
+                        }
+                        case "set": {
+                            const plat = parts[2] || null;
+                            const uid = parts[3] || null;
+                            const tool = parts[4];
+                            const act = parts[5]?.toLowerCase();
+                            if (!tool || (act !== "allow" && act !== "deny")) {
+                                ctx.ui.notify("Usage: /gateway tool-policy set [platform] [userId] <toolName> allow|deny\n\n" +
+                                    "Examples:\n" +
+                                    "  /gateway tool-policy set discord * bash deny\n" +
+                                    "  /gateway tool-policy set discord U123 bash allow\n" +
+                                    "  /gateway tool-policy set * * write allow\n" +
+                                    "  (Use * for platform/userId to mean all)", "info");
+                                return;
+                            }
+                            setToolPolicy({
+                                platform: plat === "*" ? null : plat,
+                                userId: uid === "*" ? null : uid,
+                                toolName: tool,
+                                action: act,
+                                priority: 50, // Explicit policies override default (priority 0)
+                            });
+                            ctx.ui.notify(`Policy set: ${plat ?? "*"}:${uid ?? "*"} → ${tool} [${act}]`, "info");
+                            return;
+                        }
+                        case "remove": {
+                            const id = parseInt(parts[2]);
+                            if (isNaN(id)) {
+                                ctx.ui.notify("Usage: /gateway tool-policy remove <id>\n" +
+                                    "Use /gateway tool-policy list to see IDs.", "info");
+                                return;
+                            }
+                            if (removeToolPolicy(id)) {
+                                ctx.ui.notify(`Removed tool policy #${id}`, "info");
+                            }
+                            else {
+                                ctx.ui.notify(`Policy #${id} not found`, "error");
+                            }
+                            return;
+                        }
+                        case "reset": {
+                            resetToolPolicies();
+                            ctx.ui.notify("All tool policies reset to defaults.", "info");
+                            return;
+                        }
+                        default: {
+                            ctx.ui.notify("/gateway tool-policy commands:\n\n" +
+                                "  list [platform] [userId]  - List explicit policies\n" +
+                                "  defaults                   - Show default policy\n" +
+                                "  set <p> <u> <tool> allow|deny - Add/update policy\n" +
+                                "  remove <id>                - Delete a policy\n" +
+                                "  reset                      - Clear all, back to defaults\n\n" +
+                                "Use * for platform/userId to match all.\n" +
+                                "Tool names support globs: bash, gateway_*, wiki_*", "info");
+                        }
+                    }
+                    return;
+                }
+                default: {
+                    ctx.ui.notify("pi Gateway Commands:\n\n" +
+                        "  /gateway start [port]  - Start gateway\n" +
+                        "  /gateway stop         - Stop gateway\n" +
+                        "  /gateway restart      - Restart gateway\n" +
+                        "  /gateway status       - Show status\n" +
+                        "  /gateway pair <code>  - Approve pairing\n" +
+                        "  /gateway allow <p> <u>- Add user to allowlist\n" +
+                        "  /gateway revoke <p> <u>- Remove user from allowlist\n" +
+                        "  /gateway admin list   - List admin users\n" +
+                        "  /gateway admin add <p|*> <u> - Grant admin\n" +
+                        "  /gateway admin remove <p|*> <u> - Revoke admin\n" +
+                        "  /gateway sessions     - List sessions\n" +
+                        "  /gateway tasks        - List background tasks\n" +
+                        "  /gateway config       - Show config\n" +
+                        "  /gateway tool-policy  - Manage tool policies\n\n" +
+                        "Hermes-style features:\n" +
+                        "  - Per-chat sessions with reset policies\n" +
+                        "  - Platform adapters (Discord, etc.)\n" +
+                        "  - Background task support\n" +
+                        "  - Allowlist security (DB + config UIDs)\n" +
+                        "  - Tool policy (per-user tool allow/deny)", "info");
+                }
+            }
+        },
+    });
+    // Register tools
+    pi.registerTool({
+        name: "gateway_status",
+        label: "Gateway Status",
+        description: "Check Hermes-style gateway status",
+        parameters: Type.Object({}),
+        async execute(_toolCallId, _params, _signal, _onUpdate, _ctx) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Gateway: ${state.running ? "Running" : "Stopped"}\n` +
+                            `Adapters: ${state.adapters.size}\n` +
+                            `Clients: ${state.clients.size}\n` +
+                            `Sessions: ${state.sessions.size}\n` +
+                            `Agent: ${rpcProcess ? "Connected" : "Disconnected"}`,
+                    },
+                ],
+                details: {
+                    running: state.running,
+                    adapters: state.adapters.size,
+                    clients: state.clients.size,
+                    sessions: state.sessions.size,
+                },
+            };
+        },
+    });
+    pi.registerTool({
+        name: "gateway_sessions",
+        label: "Gateway Sessions",
+        description: "List active gateway sessions",
+        parameters: Type.Object({}),
+        async execute(_toolCallId, _params, _signal, _onUpdate, _ctx) {
+            const sessions = listSessions();
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Active sessions: ${sessions.length}\n` +
+                            JSON.stringify(sessions.map((s) => ({
+                                id: s.id.slice(0, 12),
+                                platform: s.platform,
+                                channel: s.channelId,
+                                lastActivity: new Date(s.lastActivity).toISOString(),
+                            })), null, 2),
+                    },
+                ],
+                details: { count: sessions.length },
+            };
+        },
+    });
+    pi.registerTool({
+        name: "gateway_background_tasks",
+        label: "Background Tasks",
+        description: "List and manage background tasks",
+        parameters: Type.Object({
+            status: Type.Optional(Type.String()),
+        }),
+        async execute(_toolCallId, params, _signal, _onUpdate, _ctx) {
+            const tasks = listTasks(params.status);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Background tasks: ${tasks.length}\n` +
+                            JSON.stringify(tasks.map((t) => ({
+                                id: t.id.slice(0, 12),
+                                status: t.status,
+                                progress: t.progress,
+                                command: t.command.slice(0, 50),
+                            })), null, 2),
+                    },
+                ],
+                details: { count: tasks.length },
+            };
+        },
+    });
+    pi.registerTool({
+        name: "gateway_pairing",
+        label: "Gateway Pairing",
+        description: "Generate or approve pairing codes",
+        parameters: Type.Object({
+            action: Type.Union([
+                Type.Literal("generate"),
+                Type.Literal("list"),
+                Type.Literal("approve"),
+            ]),
+            platform: Type.Optional(Type.String()),
+            userId: Type.Optional(Type.String()),
+            code: Type.Optional(Type.String()),
+        }),
+        async execute(_toolCallId, params, _signal, _onUpdate, _ctx) {
+            const { action, platform, userId, code } = params;
+            switch (action) {
+                case "generate": {
+                    if (!platform || !userId) {
+                        return {
+                            content: [{ type: "text", text: "platform and userId required" }],
+                            details: { error: true },
+                        };
+                    }
+                    const pairingCode = generatePairingCode(platform, userId);
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Pairing code: ${pairingCode}\n\nShare this code with the user to approve access.`,
+                            },
+                        ],
+                        details: { code: pairingCode },
+                    };
+                }
+                case "approve": {
+                    if (!code) {
+                        return {
+                            content: [{ type: "text", text: "code required" }],
+                            details: { error: true },
+                        };
+                    }
+                    const success = approvePairingCode(code);
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: success ? "✅ Code approved" : "❌ Invalid/expired",
+                            },
+                        ],
+                        details: { success },
+                    };
+                }
+                case "list": {
+                    const pending = listPendingPairingCodes();
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Pending codes: ${pending.length}\n` +
+                                    JSON.stringify(pending, null, 2),
+                            },
+                        ],
+                        details: { count: pending.length },
+                    };
+                }
+            }
+        },
+    });
+    pi.registerTool({
+        name: "gateway_tool_policy",
+        label: "Gateway Tool Policy",
+        description: "Manage tool access policies for external gateway users",
+        parameters: Type.Object({
+            action: Type.Union([
+                Type.Literal("list"),
+                Type.Literal("defaults"),
+                Type.Literal("set"),
+                Type.Literal("remove"),
+                Type.Literal("reset"),
+            ]),
+            platform: Type.Optional(Type.String()),
+            userId: Type.Optional(Type.String()),
+            toolName: Type.Optional(Type.String()),
+            policyAction: Type.Optional(Type.Union([Type.Literal("allow"), Type.Literal("deny")])),
+            policyId: Type.Optional(Type.Number()),
+        }),
+        async execute(_toolCallId, params, _signal, _onUpdate, _ctx) {
+            const { action, platform, userId, toolName, policyAction, policyId } = params;
+            switch (action) {
+                case "list": {
+                    const policies = listToolPolicies(platform, userId);
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: policies.length > 0
+                                    ? JSON.stringify(policies, null, 2)
+                                    : "No explicit policies — only defaults active.",
+                            },
+                        ],
+                        details: { count: policies.length, policies },
+                    };
+                }
+                case "defaults": {
+                    const summary = getEffectivePolicySummary(platform ?? "*", userId ?? "*");
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Default tool policy:\n\n` +
+                                    `ALLOWED: ${summary.allowed.join(", ")}\n` +
+                                    `DENIED: ${summary.denied.join(", ")}`,
+                            },
+                        ],
+                        details: summary,
+                    };
+                }
+                case "set": {
+                    if (!toolName || !policyAction) {
+                        return {
+                            content: [
+                                {
+                                    type: "text",
+                                    text: "toolName and policyAction (allow|deny) are required",
+                                },
+                            ],
+                            details: { error: true },
+                        };
+                    }
+                    setToolPolicy({
+                        platform: platform ?? null,
+                        userId: userId ?? null,
+                        toolName,
+                        action: policyAction,
+                        priority: 50,
+                    });
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Policy set: ${platform ?? "*"}:${userId ?? "*"} → ${toolName} [${policyAction}]`,
+                            },
+                        ],
+                        details: { success: true },
+                    };
+                }
+                case "remove": {
+                    if (policyId == null) {
+                        return {
+                            content: [
+                                { type: "text", text: "policyId (number) is required" },
+                            ],
+                            details: { error: true },
+                        };
+                    }
+                    const removed = removeToolPolicy(policyId);
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: removed
+                                    ? `Removed policy #${policyId}`
+                                    : `Policy #${policyId} not found`,
+                            },
+                        ],
+                        details: { success: removed },
+                    };
+                }
+                case "reset": {
+                    resetToolPolicies();
+                    return {
+                        content: [
+                            { type: "text", text: "All tool policies reset to defaults." },
+                        ],
+                        details: { success: true },
+                    };
+                }
+            }
+        },
+    });
+    // Notify on session start
+    pi.on("session_start", async (_event, ctx) => {
+        globalCtx = ctx;
+        updateStatus();
+    });
+    logger.info("[pi-gateway] Hermes-style gateway extension loaded");
+}
+//# sourceMappingURL=index.js.map