@hyperdrive.bot/paseo-server 0.2.6

package/dist/src/server/persisted-config.js

@@ -0,0 +1,402 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { AgentProviderRuntimeSettingsMapSchema, migrateProviderSettings, ProviderOverridesSchema, } from "./agent/provider-launch-config.js";
+import { ensurePrivateFile, writePrivateFileAtomicSync } from "./private-files.js";
+import { TerminalProfileSchema } from "@hyperdrive.bot/paseo-protocol/messages";
+export const LogLevelSchema = z.enum(["trace", "debug", "info", "warn", "error", "fatal"]);
+export const LogFormatSchema = z.enum(["pretty", "json"]);
+const LogConfigSchema = z
+    .object({
+    // Legacy global log settings (kept for backwards compatibility).
+    level: LogLevelSchema.optional(),
+    format: LogFormatSchema.optional(),
+    console: z
+        .object({
+        level: LogLevelSchema.optional(),
+        format: LogFormatSchema.optional(),
+    })
+        .strict()
+        .optional(),
+    file: z
+        .object({
+        level: LogLevelSchema.optional(),
+        path: z.string().min(1).optional(),
+        rotate: z
+            .object({
+            maxSize: z.string().min(1).optional(),
+            maxFiles: z.number().int().positive().optional(),
+        })
+            .strict()
+            .optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+const OpenAiSpeechEndpointSchema = z
+    .object({
+    apiKey: z.string().trim().min(1).optional(),
+    baseUrl: z.string().trim().min(1).optional(),
+})
+    .strict();
+const OpenAiProviderSchema = z
+    .object({
+    apiKey: z.string().min(1).optional(),
+    baseUrl: z.string().trim().min(1).optional(),
+    stt: OpenAiSpeechEndpointSchema.optional(),
+    tts: OpenAiSpeechEndpointSchema.optional(),
+})
+    .strict();
+const LocalSpeechProviderSchema = z
+    .object({
+    modelsDir: z.string().min(1).optional(),
+})
+    .strict();
+const ProvidersSchema = z
+    .object({
+    openai: OpenAiProviderSchema.optional(),
+    local: LocalSpeechProviderSchema.optional(),
+})
+    .strict();
+const WorktreesConfigSchema = z
+    .object({
+    root: z.string().min(1).optional(),
+})
+    .strict();
+const BcryptHashSchema = z.string().regex(/^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/, {
+    message: "Expected a bcrypt hash",
+});
+const DaemonAuthSchema = z
+    .object({
+    password: BcryptHashSchema.optional(),
+})
+    .strict();
+const SpeechProviderIdSchema = z
+    .string()
+    .trim()
+    .toLowerCase()
+    .pipe(z.enum(["openai", "local"]));
+const FeatureDictationSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    stt: z
+        .object({
+        provider: SpeechProviderIdSchema.optional(),
+        model: z.string().min(1).optional(),
+        language: z.string().trim().min(1).optional(),
+        confidenceThreshold: z.number().optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+const FeatureVoiceModeSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    llm: z
+        .object({
+        provider: z.string().optional(),
+        model: z.string().min(1).optional(),
+    })
+        .strict()
+        .optional(),
+    stt: z
+        .object({
+        provider: SpeechProviderIdSchema.optional(),
+        model: z.string().min(1).optional(),
+        language: z.string().trim().min(1).optional(),
+    })
+        .strict()
+        .optional(),
+    turnDetection: z
+        .object({
+        provider: SpeechProviderIdSchema.optional(),
+    })
+        .strict()
+        .optional(),
+    tts: z
+        .object({
+        provider: SpeechProviderIdSchema.optional(),
+        model: z.string().min(1).optional(),
+        voice: z.enum(["alloy", "echo", "fable", "onyx", "nova", "shimmer"]).optional(),
+        speakerId: z.number().int().optional(),
+        speed: z.number().optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+const FeatureWebUiSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    distDir: z.string().min(1).optional(),
+})
+    .strict();
+const StructuredGenerationProviderConfigSchema = z
+    .object({
+    provider: z.string().min(1),
+    model: z.string().min(1).optional(),
+    thinkingOptionId: z.string().min(1).optional(),
+})
+    .strict();
+const AgentMetadataGenerationSchema = z
+    .object({
+    providers: z.array(StructuredGenerationProviderConfigSchema).optional(),
+})
+    .strict();
+const BUILTIN_PROVIDER_IDS = ["claude", "codex", "copilot", "opencode", "pi", "omp"];
+function isLegacyProviderEntry(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    const command = value.command;
+    if (!command || typeof command !== "object" || Array.isArray(command)) {
+        return false;
+    }
+    return typeof command.mode === "string";
+}
+function normalizeAgentProviders(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return value;
+    }
+    const rawProviders = value;
+    const hasLegacyEntries = Object.values(rawProviders).some((entry) => isLegacyProviderEntry(entry));
+    if (!hasLegacyEntries) {
+        return value;
+    }
+    const legacyEntries = {};
+    const normalizedEntries = {};
+    for (const [providerId, providerValue] of Object.entries(rawProviders)) {
+        if (isLegacyProviderEntry(providerValue)) {
+            legacyEntries[providerId] = providerValue;
+            continue;
+        }
+        normalizedEntries[providerId] = providerValue;
+    }
+    const parsedLegacyEntries = AgentProviderRuntimeSettingsMapSchema.safeParse(legacyEntries);
+    if (!parsedLegacyEntries.success) {
+        return value;
+    }
+    return {
+        ...normalizedEntries,
+        ...migrateProviderSettings(parsedLegacyEntries.data, [...BUILTIN_PROVIDER_IDS]),
+    };
+}
+export const PersistedConfigSchema = z
+    .object({
+    $schema: z.string().optional(),
+    // v1 schema marker
+    version: z.literal(1).optional(),
+    // v1 config layout
+    daemon: z
+        .object({
+        listen: z.string().optional(),
+        hostnames: z.union([z.literal(true), z.array(z.string())]).optional(),
+        allowedHosts: z.union([z.literal(true), z.array(z.string())]).optional(),
+        trustedProxies: z.union([z.literal(true), z.array(z.string())]).optional(),
+        mcp: z
+            .object({
+            enabled: z.boolean().optional(),
+            injectIntoAgents: z.boolean().optional(),
+        })
+            .passthrough()
+            .optional(),
+        browserTools: z
+            .object({
+            enabled: z.boolean().optional(),
+        })
+            .passthrough()
+            .optional(),
+        autoArchiveAfterMerge: z.boolean().optional(),
+        enableTerminalAgentHooks: z.boolean().optional(),
+        appendSystemPrompt: z.string().optional(),
+        // Per-file upload size cap (story 2.2). Read once at staging-service construction.
+        // Schema allows any int so a nonsensical value (0/negative) parses without failing
+        // the whole config; the staging service applies a runtime positive-int guard and
+        // falls back to DEFAULT_MAX_UPLOAD_BYTES (100 MB) for absent/zero/negative values.
+        uploads: z.object({ maxFileSizeBytes: z.number().int().optional() }).strict().optional(),
+        terminalProfiles: z.array(TerminalProfileSchema).optional(),
+        cors: z
+            .object({
+            allowedOrigins: z.array(z.string()).optional(),
+        })
+            .strict()
+            .optional(),
+        relay: z
+            .object({
+            enabled: z.boolean().optional(),
+            endpoint: z.string().optional(),
+            publicEndpoint: z.string().optional(),
+            useTls: z.boolean().optional(),
+            publicUseTls: z.boolean().optional(),
+        })
+            .strict()
+            .optional(),
+        serviceProxy: z
+            .object({
+            // COMPAT(serviceProxyEnabled): added 2026-06-02, remove after 2026-12-02.
+            // Parsed only to suppress optional public/listen layers for old configs;
+            // localhost service proxying remains always enabled.
+            enabled: z.boolean().optional(),
+            listen: z.string().optional(),
+            publicBaseUrl: z.url().optional(),
+        })
+            .strict()
+            .optional(),
+        auth: DaemonAuthSchema.optional(),
+    })
+        .strict()
+        .transform(({ allowedHosts, ...daemon }) => {
+        const hostnames = daemon.hostnames ?? allowedHosts;
+        return hostnames === undefined ? daemon : { ...daemon, hostnames };
+    })
+        .optional(),
+    app: z
+        .object({
+        baseUrl: z.string().optional(),
+    })
+        .strict()
+        .optional(),
+    providers: ProvidersSchema.optional(),
+    worktrees: WorktreesConfigSchema.optional(),
+    agents: z
+        .object({
+        providers: z.preprocess(normalizeAgentProviders, ProviderOverridesSchema).optional(),
+        metadataGeneration: AgentMetadataGenerationSchema.optional(),
+    })
+        .strict()
+        .optional(),
+    features: z
+        .object({
+        dictation: FeatureDictationSchema.optional(),
+        voiceMode: FeatureVoiceModeSchema.optional(),
+        webUi: FeatureWebUiSchema.optional(),
+    })
+        .strict()
+        .optional(),
+    log: LogConfigSchema.optional(),
+})
+    .strict();
+const CONFIG_FILENAME = "config.json";
+const DEFAULT_PERSISTED_CONFIG = PersistedConfigSchema.parse({
+    version: 1,
+    daemon: {
+        listen: "127.0.0.1:6767",
+        cors: {
+            allowedOrigins: ["https://app.paseo.sh"],
+        },
+        relay: {
+            enabled: true,
+        },
+    },
+    app: {
+        baseUrl: "https://app.paseo.sh",
+    },
+});
+function getConfigPath(paseoHome) {
+    return path.join(paseoHome, CONFIG_FILENAME);
+}
+function getLogger(logger) {
+    return logger?.child({ module: "config" });
+}
+// Removed config fields are stripped before parsing so the strict schema does not
+// reject a config written by an older release. The stripped values are discarded,
+// not migrated — there is no back-compat for the removed `providers.openai.voice`
+// block (use `providers.openai.stt` / `providers.openai.tts`).
+function stripRemovedConfigFields(parsed) {
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return parsed;
+    }
+    const root = { ...parsed };
+    const providers = root.providers;
+    if (!providers || typeof providers !== "object" || Array.isArray(providers)) {
+        return root;
+    }
+    const providersRecord = { ...providers };
+    const local = providersRecord.local;
+    if (local && typeof local === "object" && !Array.isArray(local)) {
+        const localRecord = { ...local };
+        delete localRecord.autoDownload;
+        providersRecord.local = localRecord;
+    }
+    const openai = providersRecord.openai;
+    if (openai && typeof openai === "object" && !Array.isArray(openai)) {
+        const openaiRecord = { ...openai };
+        // COMPAT(openaiVoiceConfig): added 2026-06-30, remove after 2026-12-30.
+        // Drop a `providers.openai.voice` block left by an older release so the strict
+        // schema doesn't reject it. The value is discarded, not migrated — there is no
+        // back-compat; configure `providers.openai.stt` / `providers.openai.tts` instead.
+        delete openaiRecord.voice;
+        providersRecord.openai = openaiRecord;
+    }
+    root.providers = providersRecord;
+    return root;
+}
+export function loadPersistedConfig(paseoHome, logger) {
+    const log = getLogger(logger);
+    const configPath = getConfigPath(paseoHome);
+    if (!existsSync(configPath)) {
+        try {
+            writePrivateFileAtomicSync(configPath, JSON.stringify(DEFAULT_PERSISTED_CONFIG, null, 2) + "\n");
+            log?.info(`Initialized config file at ${configPath}`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`[Config] Failed to initialize ${configPath}: ${message}`, { cause: err });
+        }
+    }
+    let raw;
+    try {
+        ensurePrivateFile(configPath);
+        raw = readFileSync(configPath, "utf-8");
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`[Config] Failed to read ${configPath}: ${message}`, {
+            cause: err,
+        });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`[Config] Invalid JSON in ${configPath}: ${message}`, {
+            cause: err,
+        });
+    }
+    const migrated = stripRemovedConfigFields(parsed);
+    const result = PersistedConfigSchema.safeParse(migrated);
+    if (!result.success) {
+        const issues = result.error.issues
+            .map((i) => `  - ${i.path.join(".")}: ${i.message}`)
+            .join("\n");
+        throw new Error(`[Config] Invalid config in ${configPath}:\n${issues}`);
+    }
+    log?.info(`Loaded from ${configPath}`);
+    return result.data;
+}
+export function savePersistedConfig(paseoHome, config, logger) {
+    const log = getLogger(logger);
+    const configPath = getConfigPath(paseoHome);
+    const result = PersistedConfigSchema.safeParse(config);
+    if (!result.success) {
+        const issues = result.error.issues
+            .map((i) => `  - ${i.path.join(".")}: ${i.message}`)
+            .join("\n");
+        throw new Error(`[Config] Invalid config to save:\n${issues}`);
+    }
+    try {
+        writePrivateFileAtomicSync(configPath, JSON.stringify(result.data, null, 2) + "\n");
+        log?.info(`Saved to ${configPath}`);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`[Config] Failed to write ${configPath}: ${message}`, {
+            cause: err,
+        });
+    }
+}
+//# sourceMappingURL=persisted-config.js.map

package/dist/src/server/pid-lock.js

@@ -0,0 +1,170 @@
+import { open, readFile, unlink, mkdir } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { hostname } from "node:os";
+import { z } from "zod";
+export const pidLockInfoSchema = z.object({
+    pid: z.number(),
+    startedAt: z.string(),
+    hostname: z.string(),
+    uid: z.number(),
+    listen: z.string().nullable(),
+    desktopManaged: z.boolean().optional(),
+});
+function parsePidLockInfo(raw) {
+    const result = pidLockInfoSchema.safeParse(raw);
+    return result.success ? result.data : null;
+}
+function isErrnoException(err) {
+    return err instanceof Error && "code" in err;
+}
+export class PidLockError extends Error {
+    constructor(message, existingLock) {
+        super(message);
+        this.existingLock = existingLock;
+        this.name = "PidLockError";
+    }
+}
+function isPidRunning(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function getPidFilePath(paseoHome) {
+    return join(paseoHome, "paseo.pid");
+}
+function resolveOwnerPid(ownerPid) {
+    if (typeof ownerPid === "number" && Number.isInteger(ownerPid) && ownerPid > 0) {
+        return ownerPid;
+    }
+    return process.pid;
+}
+export async function acquirePidLock(paseoHome, listen, options) {
+    const pidPath = getPidFilePath(paseoHome);
+    // Ensure paseoHome directory exists
+    if (!existsSync(paseoHome)) {
+        await mkdir(paseoHome, { recursive: true });
+    }
+    // Try to read existing lock
+    let existingLock = null;
+    try {
+        const content = await readFile(pidPath, "utf-8");
+        existingLock = parsePidLockInfo(JSON.parse(content));
+    }
+    catch {
+        // No existing lock or invalid JSON - that's fine
+    }
+    // Check if existing lock is stale
+    const lockOwnerPid = resolveOwnerPid(options?.ownerPid);
+    if (existingLock) {
+        if (isPidRunning(existingLock.pid)) {
+            if (existingLock.pid === lockOwnerPid) {
+                return;
+            }
+            throw new PidLockError(`Another Paseo daemon is already running (PID ${existingLock.pid}, started ${existingLock.startedAt})`, existingLock);
+        }
+        // Stale lock - remove it
+        await unlink(pidPath).catch(() => { });
+    }
+    // Create new lock with exclusive flag
+    const lockInfo = {
+        pid: lockOwnerPid,
+        startedAt: new Date().toISOString(),
+        hostname: hostname(),
+        uid: process.getuid?.() ?? 0,
+        listen,
+        ...(process.env.PASEO_DESKTOP_MANAGED === "1" ? { desktopManaged: true } : {}),
+    };
+    let fd;
+    try {
+        fd = await open(pidPath, "wx");
+        await fd.write(JSON.stringify(lockInfo));
+    }
+    catch (err) {
+        if (isErrnoException(err) && err.code === "EEXIST") {
+            // Race condition - another process created the file
+            // Re-read and check
+            try {
+                const content = await readFile(pidPath, "utf-8");
+                const raceLock = parsePidLockInfo(JSON.parse(content));
+                if (raceLock) {
+                    throw new PidLockError(`Another Paseo daemon is already running (PID ${raceLock.pid})`, raceLock);
+                }
+                throw new PidLockError("Failed to acquire PID lock due to race condition");
+            }
+            catch (innerErr) {
+                if (innerErr instanceof PidLockError)
+                    throw innerErr;
+                throw new PidLockError("Failed to acquire PID lock due to race condition");
+            }
+        }
+        throw err;
+    }
+    finally {
+        await fd?.close();
+    }
+}
+export async function updatePidLock(paseoHome, patch, options) {
+    const pidPath = getPidFilePath(paseoHome);
+    const lockOwnerPid = resolveOwnerPid(options?.ownerPid);
+    const content = await readFile(pidPath, "utf-8");
+    const existingLock = parsePidLockInfo(JSON.parse(content));
+    if (!existingLock) {
+        throw new PidLockError("Cannot update PID lock: invalid lock file");
+    }
+    if (existingLock.pid !== lockOwnerPid) {
+        throw new PidLockError(`Cannot update PID lock owned by PID ${existingLock.pid}`, existingLock);
+    }
+    const updatedLock = {
+        ...existingLock,
+        ...patch,
+    };
+    const fd = await open(pidPath, "r+");
+    try {
+        await fd.truncate(0);
+        await fd.writeFile(JSON.stringify(updatedLock));
+    }
+    finally {
+        await fd.close();
+    }
+}
+export async function releasePidLock(paseoHome, options) {
+    const pidPath = getPidFilePath(paseoHome);
+    const lockOwnerPid = resolveOwnerPid(options?.ownerPid);
+    try {
+        // Only remove if it's our lock
+        const content = await readFile(pidPath, "utf-8");
+        const lock = parsePidLockInfo(JSON.parse(content));
+        if (lock?.pid === lockOwnerPid) {
+            await unlink(pidPath);
+        }
+    }
+    catch {
+        // Ignore errors - lock may already be gone
+    }
+}
+export async function getPidLockInfo(paseoHome) {
+    const pidPath = getPidFilePath(paseoHome);
+    try {
+        const content = await readFile(pidPath, "utf-8");
+        return parsePidLockInfo(JSON.parse(content));
+    }
+    catch {
+        return null;
+    }
+}
+export async function isLocked(paseoHome) {
+    const info = await getPidLockInfo(paseoHome);
+    if (!info) {
+        return { locked: false };
+    }
+    if (!isPidRunning(info.pid)) {
+        return { locked: false, info };
+    }
+    return { locked: true, info };
+}
+//# sourceMappingURL=pid-lock.js.map

package/dist/src/server/private-files.js

@@ -0,0 +1,37 @@
+import { chmodSync, mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+export const PRIVATE_DIRECTORY_MODE = 0o700;
+export const PRIVATE_FILE_MODE = 0o600;
+function chmodBestEffort(targetPath, mode) {
+    if (process.platform === "win32") {
+        return;
+    }
+    try {
+        chmodSync(targetPath, mode);
+    }
+    catch {
+        // Keep startup resilient if the filesystem does not support POSIX modes.
+    }
+}
+export function ensurePrivateDirectory(directoryPath) {
+    mkdirSync(directoryPath, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+    chmodBestEffort(directoryPath, PRIVATE_DIRECTORY_MODE);
+}
+export function ensurePrivateFile(filePath) {
+    chmodBestEffort(filePath, PRIVATE_FILE_MODE);
+}
+export function writePrivateFileAtomicSync(filePath, data) {
+    ensurePrivateDirectory(path.dirname(filePath));
+    const tmpPath = path.join(path.dirname(filePath), `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`);
+    try {
+        writeFileSync(tmpPath, data, { mode: PRIVATE_FILE_MODE });
+        renameSync(tmpPath, filePath);
+        ensurePrivateFile(filePath);
+    }
+    catch (error) {
+        rmSync(tmpPath, { force: true });
+        throw error;
+    }
+}
+//# sourceMappingURL=private-files.js.map

package/dist/src/server/speech/providers/local/sherpa/sherpa-runtime-env.js

@@ -0,0 +1,84 @@
+import { createRequire } from "node:module";
+import path from "node:path";
+export function sherpaPlatformArch(platform = process.platform, arch = process.arch) {
+    const normalizedPlatform = platform === "win32" ? "win" : platform;
+    return `${normalizedPlatform}-${arch}`;
+}
+export function sherpaPlatformPackageName(platform = process.platform, arch = process.arch) {
+    return `sherpa-onnx-${sherpaPlatformArch(platform, arch)}`;
+}
+export function sherpaLoaderEnvKey(platform = process.platform) {
+    if (platform === "linux") {
+        return "LD_LIBRARY_PATH";
+    }
+    if (platform === "darwin") {
+        return "DYLD_LIBRARY_PATH";
+    }
+    if (platform === "win32") {
+        return "PATH";
+    }
+    return null;
+}
+export function prependEnvPath(existing, value) {
+    const parts = (existing ?? "").split(path.delimiter).filter(Boolean);
+    if (parts.includes(value)) {
+        return parts.join(path.delimiter);
+    }
+    return [value, ...parts].join(path.delimiter);
+}
+export function resolveSherpaLoaderEnv(platform = process.platform, arch = process.arch) {
+    const key = sherpaLoaderEnvKey(platform);
+    if (!key) {
+        return null;
+    }
+    const packageName = sherpaPlatformPackageName(platform, arch);
+    const require = createRequire(import.meta.url);
+    try {
+        const pkgJson = require.resolve(`${packageName}/package.json`);
+        return {
+            key,
+            libDir: path.dirname(pkgJson),
+            packageName,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Find the actual case-sensitive key in a plain object that matches the given
+ * key case-insensitively. On Windows, `{...process.env}` produces a plain
+ * (case-sensitive) object where PATH is typically stored as `Path`. Using a
+ * hardcoded `"PATH"` would miss the existing key and create a duplicate,
+ * breaking the child process's PATH.
+ */
+function findEnvKey(env, key) {
+    const lower = key.toLowerCase();
+    for (const k of Object.keys(env)) {
+        if (k.toLowerCase() === lower)
+            return k;
+    }
+    return key;
+}
+export function applySherpaLoaderEnv(env, platform = process.platform, arch = process.arch) {
+    const resolved = resolveSherpaLoaderEnv(platform, arch);
+    if (!resolved) {
+        return {
+            changed: false,
+            key: null,
+            libDir: null,
+            packageName: null,
+        };
+    }
+    const actualKey = findEnvKey(env, resolved.key);
+    const next = prependEnvPath(env[actualKey], resolved.libDir);
+    const changed = next !== (env[actualKey] ?? "");
+    env[actualKey] = next;
+    return {
+        changed,
+        key: resolved.key,
+        libDir: resolved.libDir,
+        packageName: resolved.packageName,
+    };
+}
+//# sourceMappingURL=sherpa-runtime-env.js.map