@hyperdrive.bot/fleet-server 0.3.99

package/dist/server/server/persisted-config.js

@@ -0,0 +1,424 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { AgentProviderRuntimeSettingsMapSchema, migrateProviderSettings, ProviderOverridesSchema, } from "./agent/provider-launch-config.js";
+import { ensurePrivateFile, writePrivateFileAtomicSync } from "./private-files.js";
+import { KanbanBoardConfigSchema, TerminalProfileSchema, } from "@hyperdrive.bot/fleet-protocol/messages";
+export const LogLevelSchema = z.enum(["trace", "debug", "info", "warn", "error", "fatal"]);
+export const LogFormatSchema = z.enum(["pretty", "json"]);
+const LogConfigSchema = z
+    .object({
+    // Legacy global log settings (kept for backwards compatibility).
+    level: LogLevelSchema.optional(),
+    format: LogFormatSchema.optional(),
+    console: z
+        .object({
+        level: LogLevelSchema.optional(),
+        format: LogFormatSchema.optional(),
+    })
+        .strict()
+        .optional(),
+    file: z
+        .object({
+        level: LogLevelSchema.optional(),
+        path: z.string().min(1).optional(),
+        rotate: z
+            .object({
+            maxSize: z.string().min(1).optional(),
+            maxFiles: z.number().int().positive().optional(),
+        })
+            .strict()
+            .optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+const OpenAiSpeechEndpointSchema = z
+    .object({
+    apiKey: z.string().trim().min(1).optional(),
+    baseUrl: z.string().trim().min(1).optional(),
+})
+    .strict();
+const OpenAiProviderSchema = z
+    .object({
+    apiKey: z.string().min(1).optional(),
+    baseUrl: z.string().trim().min(1).optional(),
+    stt: OpenAiSpeechEndpointSchema.optional(),
+    tts: OpenAiSpeechEndpointSchema.optional(),
+})
+    .strict();
+const LocalSpeechProviderSchema = z
+    .object({
+    modelsDir: z.string().min(1).optional(),
+})
+    .strict();
+const ProvidersSchema = z
+    .object({
+    openai: OpenAiProviderSchema.optional(),
+    local: LocalSpeechProviderSchema.optional(),
+})
+    .strict();
+const WorktreesConfigSchema = z
+    .object({
+    root: z.string().min(1).optional(),
+})
+    .strict();
+const BcryptHashSchema = z.string().regex(/^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/, {
+    message: "Expected a bcrypt hash",
+});
+const TenantAuthSchema = z
+    .object({
+    userPoolId: z.string().min(1),
+    region: z.string().min(1),
+    clientId: z.string().min(1).optional(),
+    allowedGroups: z.array(z.string().min(1)).optional(),
+})
+    .strict();
+const DaemonAuthSchema = z
+    .object({
+    password: BcryptHashSchema.optional(),
+    // When set, the daemon verifies the tenant's Cognito JWT itself instead of
+    // trusting that the client did it. See tenant-token-verifier.ts.
+    tenant: TenantAuthSchema.optional(),
+})
+    .strict();
+const SpeechProviderIdSchema = z
+    .string()
+    .trim()
+    .toLowerCase()
+    .pipe(z.enum(["openai", "local"]));
+const FeatureDictationSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    stt: z
+        .object({
+        provider: SpeechProviderIdSchema.optional(),
+        model: z.string().min(1).optional(),
+        language: z.string().trim().min(1).optional(),
+        confidenceThreshold: z.number().optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+const FeatureVoiceModeSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    llm: z
+        .object({
+        provider: z.string().optional(),
+        model: z.string().min(1).optional(),
+    })
+        .strict()
+        .optional(),
+    stt: z
+        .object({
+        provider: SpeechProviderIdSchema.optional(),
+        model: z.string().min(1).optional(),
+        language: z.string().trim().min(1).optional(),
+    })
+        .strict()
+        .optional(),
+    turnDetection: z
+        .object({
+        provider: SpeechProviderIdSchema.optional(),
+    })
+        .strict()
+        .optional(),
+    tts: z
+        .object({
+        provider: SpeechProviderIdSchema.optional(),
+        model: z.string().min(1).optional(),
+        voice: z.enum(["alloy", "echo", "fable", "onyx", "nova", "shimmer"]).optional(),
+        speakerId: z.number().int().optional(),
+        speed: z.number().optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+const FeatureWebUiSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    distDir: z.string().min(1).optional(),
+})
+    .strict();
+const StructuredGenerationProviderConfigSchema = z
+    .object({
+    provider: z.string().min(1),
+    model: z.string().min(1).optional(),
+    thinkingOptionId: z.string().min(1).optional(),
+})
+    .strict();
+const AgentMetadataGenerationSchema = z
+    .object({
+    providers: z.array(StructuredGenerationProviderConfigSchema).optional(),
+})
+    .strict();
+const BUILTIN_PROVIDER_IDS = ["claude", "codex", "copilot", "opencode", "pi", "omp"];
+function isLegacyProviderEntry(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    const command = value.command;
+    if (!command || typeof command !== "object" || Array.isArray(command)) {
+        return false;
+    }
+    return typeof command.mode === "string";
+}
+function normalizeAgentProviders(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return value;
+    }
+    const rawProviders = value;
+    const hasLegacyEntries = Object.values(rawProviders).some((entry) => isLegacyProviderEntry(entry));
+    if (!hasLegacyEntries) {
+        return value;
+    }
+    const legacyEntries = {};
+    const normalizedEntries = {};
+    for (const [providerId, providerValue] of Object.entries(rawProviders)) {
+        if (isLegacyProviderEntry(providerValue)) {
+            legacyEntries[providerId] = providerValue;
+            continue;
+        }
+        normalizedEntries[providerId] = providerValue;
+    }
+    const parsedLegacyEntries = AgentProviderRuntimeSettingsMapSchema.safeParse(legacyEntries);
+    if (!parsedLegacyEntries.success) {
+        return value;
+    }
+    return {
+        ...normalizedEntries,
+        ...migrateProviderSettings(parsedLegacyEntries.data, [...BUILTIN_PROVIDER_IDS]),
+    };
+}
+export const PersistedConfigSchema = z
+    .object({
+    $schema: z.string().optional(),
+    // v1 schema marker
+    version: z.literal(1).optional(),
+    // v1 config layout
+    daemon: z
+        .object({
+        listen: z.string().optional(),
+        hostnames: z.union([z.literal(true), z.array(z.string())]).optional(),
+        allowedHosts: z.union([z.literal(true), z.array(z.string())]).optional(),
+        trustedProxies: z.union([z.literal(true), z.array(z.string())]).optional(),
+        mcp: z
+            .object({
+            enabled: z.boolean().optional(),
+            injectIntoAgents: z.boolean().optional(),
+        })
+            .passthrough()
+            .optional(),
+        browserTools: z
+            .object({
+            enabled: z.boolean().optional(),
+        })
+            .passthrough()
+            .optional(),
+        autoArchiveAfterMerge: z.boolean().optional(),
+        // Epic 6. Both optional so an existing config parses unchanged, and both
+        // deliberately loose about VALUE: a nonsensical staleness window parses
+        // here and is corrected at read time, because the daemon must start even
+        // when reconciliation is misconfigured. `.positive()` would fail the
+        // whole config file over a typo in one tunable.
+        ingestionReconcileEnabled: z.boolean().optional(),
+        ingestionReconcileStaleMs: z.number().optional(),
+        enableTerminalAgentHooks: z.boolean().optional(),
+        appendSystemPrompt: z.string().optional(),
+        // Per-file upload size cap (story 2.2). Read once at staging-service construction.
+        // Schema allows any int so a nonsensical value (0/negative) parses without failing
+        // the whole config; the staging service applies a runtime positive-int guard and
+        // falls back to DEFAULT_MAX_UPLOAD_BYTES (100 MB) for absent/zero/negative values.
+        uploads: z.object({ maxFileSizeBytes: z.number().int().optional() }).strict().optional(),
+        terminalProfiles: z.array(TerminalProfileSchema).optional(),
+        // Kanban column registry + WIP limits. Optional: absent means this daemon
+        // has never been told about a board, which is the signal the client uses
+        // to seed it from whichever device connects first.
+        kanbanBoard: KanbanBoardConfigSchema.optional(),
+        cors: z
+            .object({
+            allowedOrigins: z.array(z.string()).optional(),
+        })
+            .strict()
+            .optional(),
+        relay: z
+            .object({
+            enabled: z.boolean().optional(),
+            endpoint: z.string().optional(),
+            publicEndpoint: z.string().optional(),
+            useTls: z.boolean().optional(),
+            publicUseTls: z.boolean().optional(),
+        })
+            .strict()
+            .optional(),
+        serviceProxy: z
+            .object({
+            // COMPAT(serviceProxyEnabled): added 2026-06-02, remove after 2026-12-02.
+            // Parsed only to suppress optional public/listen layers for old configs;
+            // localhost service proxying remains always enabled.
+            enabled: z.boolean().optional(),
+            listen: z.string().optional(),
+            publicBaseUrl: z.url().optional(),
+        })
+            .strict()
+            .optional(),
+        auth: DaemonAuthSchema.optional(),
+    })
+        .strict()
+        .transform(({ allowedHosts, ...daemon }) => {
+        const hostnames = daemon.hostnames ?? allowedHosts;
+        return hostnames === undefined ? daemon : { ...daemon, hostnames };
+    })
+        .optional(),
+    app: z
+        .object({
+        baseUrl: z.string().optional(),
+    })
+        .strict()
+        .optional(),
+    providers: ProvidersSchema.optional(),
+    worktrees: WorktreesConfigSchema.optional(),
+    agents: z
+        .object({
+        providers: z.preprocess(normalizeAgentProviders, ProviderOverridesSchema).optional(),
+        metadataGeneration: AgentMetadataGenerationSchema.optional(),
+    })
+        .strict()
+        .optional(),
+    features: z
+        .object({
+        dictation: FeatureDictationSchema.optional(),
+        voiceMode: FeatureVoiceModeSchema.optional(),
+        webUi: FeatureWebUiSchema.optional(),
+    })
+        .strict()
+        .optional(),
+    log: LogConfigSchema.optional(),
+})
+    .strict();
+const CONFIG_FILENAME = "config.json";
+const DEFAULT_PERSISTED_CONFIG = PersistedConfigSchema.parse({
+    version: 1,
+    daemon: {
+        listen: "127.0.0.1:6767",
+        cors: {
+            allowedOrigins: ["https://app.paseo.sh"],
+        },
+        relay: {
+            enabled: true,
+        },
+    },
+    app: {
+        baseUrl: "https://app.paseo.sh",
+    },
+});
+function getConfigPath(paseoHome) {
+    return path.join(paseoHome, CONFIG_FILENAME);
+}
+function getLogger(logger) {
+    return logger?.child({ module: "config" });
+}
+// Removed config fields are stripped before parsing so the strict schema does not
+// reject a config written by an older release. The stripped values are discarded,
+// not migrated — there is no back-compat for the removed `providers.openai.voice`
+// block (use `providers.openai.stt` / `providers.openai.tts`).
+function stripRemovedConfigFields(parsed) {
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return parsed;
+    }
+    const root = { ...parsed };
+    const providers = root.providers;
+    if (!providers || typeof providers !== "object" || Array.isArray(providers)) {
+        return root;
+    }
+    const providersRecord = { ...providers };
+    const local = providersRecord.local;
+    if (local && typeof local === "object" && !Array.isArray(local)) {
+        const localRecord = { ...local };
+        delete localRecord.autoDownload;
+        providersRecord.local = localRecord;
+    }
+    const openai = providersRecord.openai;
+    if (openai && typeof openai === "object" && !Array.isArray(openai)) {
+        const openaiRecord = { ...openai };
+        // COMPAT(openaiVoiceConfig): added 2026-06-30, remove after 2026-12-30.
+        // Drop a `providers.openai.voice` block left by an older release so the strict
+        // schema doesn't reject it. The value is discarded, not migrated — there is no
+        // back-compat; configure `providers.openai.stt` / `providers.openai.tts` instead.
+        delete openaiRecord.voice;
+        providersRecord.openai = openaiRecord;
+    }
+    root.providers = providersRecord;
+    return root;
+}
+export function loadPersistedConfig(paseoHome, logger) {
+    const log = getLogger(logger);
+    const configPath = getConfigPath(paseoHome);
+    if (!existsSync(configPath)) {
+        try {
+            writePrivateFileAtomicSync(configPath, JSON.stringify(DEFAULT_PERSISTED_CONFIG, null, 2) + "\n");
+            log?.info(`Initialized config file at ${configPath}`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`[Config] Failed to initialize ${configPath}: ${message}`, { cause: err });
+        }
+    }
+    let raw;
+    try {
+        ensurePrivateFile(configPath);
+        raw = readFileSync(configPath, "utf-8");
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`[Config] Failed to read ${configPath}: ${message}`, {
+            cause: err,
+        });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`[Config] Invalid JSON in ${configPath}: ${message}`, {
+            cause: err,
+        });
+    }
+    const migrated = stripRemovedConfigFields(parsed);
+    const result = PersistedConfigSchema.safeParse(migrated);
+    if (!result.success) {
+        const issues = result.error.issues
+            .map((i) => `  - ${i.path.join(".")}: ${i.message}`)
+            .join("\n");
+        throw new Error(`[Config] Invalid config in ${configPath}:\n${issues}`);
+    }
+    log?.info(`Loaded from ${configPath}`);
+    return result.data;
+}
+export function savePersistedConfig(paseoHome, config, logger) {
+    const log = getLogger(logger);
+    const configPath = getConfigPath(paseoHome);
+    const result = PersistedConfigSchema.safeParse(config);
+    if (!result.success) {
+        const issues = result.error.issues
+            .map((i) => `  - ${i.path.join(".")}: ${i.message}`)
+            .join("\n");
+        throw new Error(`[Config] Invalid config to save:\n${issues}`);
+    }
+    try {
+        writePrivateFileAtomicSync(configPath, JSON.stringify(result.data, null, 2) + "\n");
+        log?.info(`Saved to ${configPath}`);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`[Config] Failed to write ${configPath}: ${message}`, {
+            cause: err,
+        });
+    }
+}
+//# sourceMappingURL=persisted-config.js.map

package/dist/server/server/persistence-hooks.d.ts

@@ -0,0 +1,32 @@
+import type { AgentManager } from "./agent/agent-manager.js";
+import type { AgentPersistenceHandle, AgentProvider, AgentSessionConfig } from "./agent/agent-sdk-types.js";
+import type { AgentStorage, StoredAgentRecord } from "./agent/agent-storage.js";
+interface LoggerLike {
+    child(bindings: Record<string, unknown>): LoggerLike;
+    error(...args: unknown[]): void;
+    warn(...args: unknown[]): void;
+}
+type AgentStoragePersistence = Pick<AgentStorage, "applySnapshot" | "list">;
+type AgentManagerStateSource = Pick<AgentManager, "subscribe">;
+interface BuildSessionConfigOptions {
+    validProviders?: Iterable<AgentProvider>;
+}
+/**
+ * Attach AgentStorage persistence to an AgentManager instance so every
+ * agent_state snapshot is flushed to disk.
+ */
+export declare function attachAgentStoragePersistence(logger: LoggerLike, agentManager: AgentManagerStateSource, storage: AgentStoragePersistence): () => void;
+export declare function buildConfigOverrides(record: StoredAgentRecord): Partial<AgentSessionConfig>;
+export declare function buildSessionConfig(record: StoredAgentRecord, options?: BuildSessionConfigOptions): AgentSessionConfig | null;
+export declare function isStoredAgentProviderAvailable(record: StoredAgentRecord, validProviders?: Iterable<AgentProvider>): boolean;
+export declare function extractTimestamps(record: StoredAgentRecord): {
+    createdAt: Date;
+    updatedAt: Date;
+    lastUserMessageAt: Date | null;
+    labels?: Record<string, string>;
+    workspaceId?: string;
+    digest?: StoredAgentRecord["digest"];
+};
+export declare function toAgentPersistenceHandle(registeredProviders: Iterable<AgentProvider>, handle: StoredAgentRecord["persistence"]): AgentPersistenceHandle | null;
+export {};
+//# sourceMappingURL=persistence-hooks.d.ts.map

package/dist/server/server/persistence-hooks.js

@@ -0,0 +1,99 @@
+import { stripInternalPaseoMcpServer } from "./agent/runtime-mcp-config.js";
+function getLogger(logger) {
+    return logger.child({ module: "persistence" });
+}
+function isProviderRegistered(validProviders, provider) {
+    if (!validProviders) {
+        return true;
+    }
+    if (validProviders instanceof Set) {
+        return validProviders.has(provider);
+    }
+    return new Set(validProviders).has(provider);
+}
+/**
+ * Attach AgentStorage persistence to an AgentManager instance so every
+ * agent_state snapshot is flushed to disk.
+ */
+export function attachAgentStoragePersistence(logger, agentManager, storage) {
+    const log = getLogger(logger);
+    const unsubscribe = agentManager.subscribe((event) => {
+        if (event.type !== "agent_state") {
+            return;
+        }
+        if (event.agent.lifecycle === "closed") {
+            return;
+        }
+        void storage.applySnapshot(event.agent).catch((error) => {
+            log.error({ err: error, agentId: event.agent.id }, "Failed to persist agent snapshot");
+        });
+    });
+    return unsubscribe;
+}
+export function buildConfigOverrides(record) {
+    return stripInternalPaseoMcpServer({
+        provider: record.provider,
+        cwd: record.cwd,
+        modeId: record.lastModeId ?? record.config?.modeId ?? undefined,
+        model: record.config?.model ?? undefined,
+        thinkingOptionId: record.config?.thinkingOptionId ?? undefined,
+        featureValues: record.config?.featureValues ?? undefined,
+        extra: record.config?.extra ?? undefined,
+        systemPrompt: record.config?.systemPrompt ?? undefined,
+        mcpServers: record.config?.mcpServers ?? undefined,
+        allowedTools: record.config?.allowedTools ?? undefined,
+    });
+}
+export function buildSessionConfig(record, options) {
+    if (!isProviderRegistered(options?.validProviders, record.provider)) {
+        return null;
+    }
+    const overrides = buildConfigOverrides(record);
+    return stripInternalPaseoMcpServer({
+        provider: record.provider,
+        cwd: record.cwd,
+        modeId: overrides.modeId,
+        model: overrides.model,
+        thinkingOptionId: overrides.thinkingOptionId,
+        featureValues: overrides.featureValues,
+        extra: overrides.extra,
+        systemPrompt: overrides.systemPrompt,
+        mcpServers: overrides.mcpServers,
+        allowedTools: overrides.allowedTools,
+    });
+}
+export function isStoredAgentProviderAvailable(record, validProviders) {
+    return isProviderRegistered(validProviders, record.provider);
+}
+export function extractTimestamps(record) {
+    return {
+        createdAt: new Date(record.createdAt),
+        updatedAt: new Date(record.lastActivityAt ?? record.updatedAt),
+        lastUserMessageAt: record.lastUserMessageAt ? new Date(record.lastUserMessageAt) : null,
+        labels: record.labels,
+        workspaceId: record.workspaceId,
+        // Hydrate the session digest on the persistence-resume load path (the
+        // branch real agents take). Without this, digest survives only the
+        // no-persistence createAgent path and is dropped on every normal reload.
+        digest: record.digest,
+    };
+}
+export function toAgentPersistenceHandle(registeredProviders, handle) {
+    if (!handle) {
+        return null;
+    }
+    const provider = handle.provider;
+    if (!isProviderRegistered(registeredProviders, provider)) {
+        return null;
+    }
+    if (!handle.sessionId) {
+        return null;
+    }
+    return {
+        provider,
+        sessionId: handle.sessionId,
+        ...(handle.nativeHandle !== undefined ? { nativeHandle: handle.nativeHandle } : {}),
+        ...(handle.metadata !== undefined ? { metadata: handle.metadata } : {}),
+    };
+}
+//# sourceMappingURL=persistence-hooks.js.map

package/dist/server/server/pid-lock.d.ts

@@ -0,0 +1,32 @@
+import { z } from "zod";
+export declare const pidLockInfoSchema: z.ZodObject<{
+    pid: z.ZodNumber;
+    startedAt: z.ZodString;
+    hostname: z.ZodString;
+    uid: z.ZodNumber;
+    listen: z.ZodNullable<z.ZodString>;
+    desktopManaged: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export interface PidLockInfo extends z.infer<typeof pidLockInfoSchema> {
+}
+export declare class PidLockError extends Error {
+    readonly existingLock?: PidLockInfo | undefined;
+    constructor(message: string, existingLock?: PidLockInfo | undefined);
+}
+export declare function acquirePidLock(paseoHome: string, listen: string | null, options?: {
+    ownerPid?: number;
+}): Promise<void>;
+export declare function updatePidLock(paseoHome: string, patch: {
+    listen: string;
+}, options?: {
+    ownerPid?: number;
+}): Promise<void>;
+export declare function releasePidLock(paseoHome: string, options?: {
+    ownerPid?: number;
+}): Promise<void>;
+export declare function getPidLockInfo(paseoHome: string): Promise<PidLockInfo | null>;
+export declare function isLocked(paseoHome: string): Promise<{
+    locked: boolean;
+    info?: PidLockInfo;
+}>;
+//# sourceMappingURL=pid-lock.d.ts.map