@jungjaehoon/mama-os 0.13.3 → 0.14.2

package/dist/auth/oauth-manager.js

@@ -14,6 +14,7 @@ const promises_1 = require("node:fs/promises");
 const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
+const node_crypto_1 = require("node:crypto");
 const types_js_1 = require("./types.js");
 /**
  * Anthropic OAuth constants (from OpenClaw analysis)
@@ -223,7 +224,21 @@ class OAuthManager {
                 refreshToken: token.refreshToken,
                 expiresAt: token.expiresAt,
             };
-            await (0, promises_1.writeFile)(this.credentialsPath, JSON.stringify(data, null, 2), 'utf-8');
+            // Atomic write: write to temp file, then rename to prevent corruption on crash
+            const tmpPath = `${this.credentialsPath}.${(0, node_crypto_1.randomBytes)(4).toString('hex')}.tmp`;
+            await (0, promises_1.writeFile)(tmpPath, JSON.stringify(data, null, 2), 'utf-8');
+            try {
+                await (0, promises_1.rename)(tmpPath, this.credentialsPath);
+            }
+            catch (renameError) {
+                try {
+                    await (0, promises_1.unlink)(tmpPath);
+                }
+                catch {
+                    // Ignore cleanup failure and rethrow original rename error below.
+                }
+                throw renameError;
+            }
         }
         catch (error) {
             if (error instanceof types_js_1.OAuthError) {

package/dist/auth/oauth-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-manager.js","sourceRoot":"","sources":["../../src/auth/oauth-manager.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,+CAAuD;AACvD,qCAAqC;AACrC,qCAAkC;AAClC,yCAAiC;AAYjC,yCAAwC;AAExC;;GAEG;AACH,MAAM,SAAS,GAAG,8CAA8C,CAAC;AACjE,MAAM,SAAS,GAAG,kDAAkD,CAAC;AAErE;;GAEG;AACH,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAC7D,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,WAAW;AAChD,MAAM,yBAAyB,GAAG,OAAO,CAAC,CAAC,aAAa;AACxD,MAAM,gBAAgB,GAAG,OAAO,CAAC,CAAC,2CAA2C;AAE7E,MAAa,YAAY;IACN,eAAe,CAAS;IACxB,UAAU,CAAS;IACnB,eAAe,CAAS;IACxB,OAAO,CAAe;IAE/B,KAAK,GAAuB,IAAI,CAAC;IAEzC,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,wBAAwB,CAAC,CAAC;QAC5F,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,oBAAoB,CAAC;QAC7D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;QAC5E,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,oBAAoB;QACpB,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9D,mDAAmD;YACnD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC;YACtC,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAEjD,6BAA6B;QAC7B,IAAI,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YACzE,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAE5C,IAAI,CAAC,KAAK,GAAG;gBACX,KAAK,EAAE,cAAc;gBACrB,QAAQ,EAAE,GAAG;gBACb,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;gBAC9C,aAAa,EAAE,WAAW,CAAC,aAAa;aACzC,CAAC;YAEF,OAAO,cAAc,CAAC,WAAW,CAAC;QACpC,CAAC;QAED,iCAAiC;QACjC,IAAI,CAAC,KAAK,GAAG;YACX,KAAK,EAAE;gBACL,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,SAAS,EAAE,WAAW,CAAC,SAAS;aACjC;YACD,QAAQ,EAAE,GAAG;YACb,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;YAC9C,aAAa,EAAE,WAAW,CAAC,aAAa;SACzC,CAAC;QAEF,OAAO,WAAW,CAAC,WAAW,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS;QACb,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAEnE,OAAO;gBACL,KAAK,EAAE,WAAW,CAAC,SAAS,GAAG,GAAG;gBAClC,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,SAAS,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACxC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC;gBACtD,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;gBAC9C,aAAa,EAAE,WAAW,CAAC,aAAa;aACzC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAU,EAAE,CAAC;gBAChC,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,IAAI;oBACf,SAAS,EAAE,IAAI;oBACf,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,KAAK,CAAC,OAAO;iBACrB,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAE5C,IAAI,CAAC,KAAK,GAAG;YACX,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;YAC9C,aAAa,EAAE,WAAW,CAAC,aAAa;SACzC,CAAC;QAEF,OAAO,cAAc,CAAC,WAAW,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,SAAiB;QACpC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC;IACxD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe;QAC3B,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,qBAAU,CAClB,mGAAmG,IAAI,CAAC,eAAe,EAAE,EACzH,uBAAuB,CACxB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAC9D,MAAM,IAAI,GAA0B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAExD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxB,MAAM,IAAI,qBAAU,CAClB,yFAAyF,EACzF,qBAAqB,CACtB,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC;YAEjC,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBAClE,MAAM,IAAI,qBAAU,CAClB,qFAAqF,EACrF,qBAAqB,CACtB,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAU,EAAE,CAAC;gBAChC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,qBAAU,CAClB,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC5F,qBAAqB,EACrB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY,CAAC,YAAoB;QAC7C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,UAAU,EAAE,eAAe;oBAC3B,SAAS,EAAE,SAAS;oBACpB,aAAa,EAAE,YAAY;iBAC5B,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,IAAI,qBAAU,CAClB,yBAAyB,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,EACzD,gBAAgB,CACjB,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;YAE7D,qEAAqE;YACrE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,gBAAgB,CAAC;YAEzE,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,SAAS;aACV,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAU,EAAE,CAAC;gBAChC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,qBAAU,CAClB,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC/F,eAAe,EACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,KAAiB;QAC9C,IAAI,CAAC;YACH,8CAA8C;YAC9C,MAAM,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAC9D,MAAM,IAAI,GAA0B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAExD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxB,MAAM,IAAI,qBAAU,CAClB,0DAA0D,EAC1D,kBAAkB,CACnB,CAAC;YACJ,CAAC;YAED,+BAA+B;YAC/B,IAAI,CAAC,aAAa,GAAG;gBACnB,GAAG,IAAI,CAAC,aAAa;gBACrB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;YAEF,MAAM,IAAA,oBAAS,EAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAU,EAAE,CAAC;gBAChC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,qBAAU,CAClB,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC7F,kBAAkB,EAClB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AApQD,oCAoQC"}
+{"version":3,"file":"oauth-manager.js","sourceRoot":"","sources":["../../src/auth/oauth-manager.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,+CAAuE;AACvE,qCAAqC;AACrC,qCAAkC;AAClC,yCAAiC;AACjC,6CAA0C;AAY1C,yCAAwC;AAExC;;GAEG;AACH,MAAM,SAAS,GAAG,8CAA8C,CAAC;AACjE,MAAM,SAAS,GAAG,kDAAkD,CAAC;AAErE;;GAEG;AACH,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAC7D,MAAM,oBAAoB,GAAG,MAAM,CAAC,CAAC,WAAW;AAChD,MAAM,yBAAyB,GAAG,OAAO,CAAC,CAAC,aAAa;AACxD,MAAM,gBAAgB,GAAG,OAAO,CAAC,CAAC,2CAA2C;AAE7E,MAAa,YAAY;IACN,eAAe,CAAS;IACxB,UAAU,CAAS;IACnB,eAAe,CAAS;IACxB,OAAO,CAAe;IAE/B,KAAK,GAAuB,IAAI,CAAC;IAEzC,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,wBAAwB,CAAC,CAAC;QAC5F,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,oBAAoB,CAAC;QAC7D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,yBAAyB,CAAC;QAC5E,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,oBAAoB;QACpB,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9D,mDAAmD;YACnD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC;YACtC,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAEjD,6BAA6B;QAC7B,IAAI,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YACzE,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;YAE5C,IAAI,CAAC,KAAK,GAAG;gBACX,KAAK,EAAE,cAAc;gBACrB,QAAQ,EAAE,GAAG;gBACb,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;gBAC9C,aAAa,EAAE,WAAW,CAAC,aAAa;aACzC,CAAC;YAEF,OAAO,cAAc,CAAC,WAAW,CAAC;QACpC,CAAC;QAED,iCAAiC;QACjC,IAAI,CAAC,KAAK,GAAG;YACX,KAAK,EAAE;gBACL,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,SAAS,EAAE,WAAW,CAAC,SAAS;aACjC;YACD,QAAQ,EAAE,GAAG;YACb,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;YAC9C,aAAa,EAAE,WAAW,CAAC,aAAa;SACzC,CAAC;QAEF,OAAO,WAAW,CAAC,WAAW,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS;QACb,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAEnE,OAAO;gBACL,KAAK,EAAE,WAAW,CAAC,SAAS,GAAG,GAAG;gBAClC,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,SAAS,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBACxC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC;gBACtD,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;gBAC9C,aAAa,EAAE,WAAW,CAAC,aAAa;aACzC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAU,EAAE,CAAC;gBAChC,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,IAAI;oBACf,SAAS,EAAE,IAAI;oBACf,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,KAAK,CAAC,OAAO;iBACrB,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACzE,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QAE5C,IAAI,CAAC,KAAK,GAAG;YACX,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;YAC9C,aAAa,EAAE,WAAW,CAAC,aAAa;SACzC,CAAC;QAEF,OAAO,cAAc,CAAC,WAAW,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,SAAiB;QACpC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC;IACxD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe;QAC3B,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,qBAAU,CAClB,mGAAmG,IAAI,CAAC,eAAe,EAAE,EACzH,uBAAuB,CACxB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAC9D,MAAM,IAAI,GAA0B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAExD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxB,MAAM,IAAI,qBAAU,CAClB,yFAAyF,EACzF,qBAAqB,CACtB,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC;YAEjC,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBAClE,MAAM,IAAI,qBAAU,CAClB,qFAAqF,EACrF,qBAAqB,CACtB,CAAC;YACJ,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAU,EAAE,CAAC;gBAChC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,qBAAU,CAClB,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC5F,qBAAqB,EACrB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY,CAAC,YAAoB;QAC7C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;gBAC7C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,UAAU,EAAE,eAAe;oBAC3B,SAAS,EAAE,SAAS;oBACpB,aAAa,EAAE,YAAY;iBAC5B,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,IAAI,qBAAU,CAClB,yBAAyB,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,EACzD,gBAAgB,CACjB,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;YAE7D,qEAAqE;YACrE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,gBAAgB,CAAC;YAEzE,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,SAAS;aACV,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAU,EAAE,CAAC;gBAChC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,qBAAU,CAClB,uCAAuC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC/F,eAAe,EACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAAC,KAAiB;QAC9C,IAAI,CAAC;YACH,8CAA8C;YAC9C,MAAM,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAC9D,MAAM,IAAI,GAA0B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAExD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxB,MAAM,IAAI,qBAAU,CAClB,0DAA0D,EAC1D,kBAAkB,CACnB,CAAC;YACJ,CAAC;YAED,+BAA+B;YAC/B,IAAI,CAAC,aAAa,GAAG;gBACnB,GAAG,IAAI,CAAC,aAAa;gBACrB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;YAEF,+EAA+E;YAC/E,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,IAAA,yBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YAChF,MAAM,IAAA,oBAAS,EAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,IAAA,iBAAM,EAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,MAAM,IAAA,iBAAM,EAAC,OAAO,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,kEAAkE;gBACpE,CAAC;gBACD,MAAM,WAAW,CAAC;YACpB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,qBAAU,EAAE,CAAC;gBAChC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,qBAAU,CAClB,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC7F,kBAAkB,EAClB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAhRD,oCAgRC"}

package/dist/cli/commands/start.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/start.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAyBH,OAAO,EACL,UAAU,EAKX,MAAM,6BAA6B,CAAC;AA2crC;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwG5E;AAuQD;;GAEG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,EAC9C,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,OAAO,CAAC,IAAI,CAAC,CAi2Df"}
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/start.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwBH,OAAO,EACL,UAAU,EAKX,MAAM,6BAA6B,CAAC;AAihBrC;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwG5E;AAuQD;;GAEG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,EAC9C,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,OAAO,CAAC,IAAI,CAAC,CAkjEf"}

package/dist/cli/commands/start.js

@@ -47,7 +47,6 @@ const node_child_process_1 = require("node:child_process");
 const node_events_1 = require("node:events");
 const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
-const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
 const express_1 = __importDefault(require("express"));
 const node_path_1 = __importStar(require("node:path"));
 const ws_1 = require("ws");
@@ -67,6 +66,8 @@ const metrics_cleanup_js_1 = require("../../observability/metrics-cleanup.js");
 const health_score_js_1 = require("../../observability/health-score.js");
 const health_check_js_1 = require("../../observability/health-check.js");
 const upload_handler_js_1 = require("../../api/upload-handler.js");
+const auth_middleware_js_1 = require("../../api/auth-middleware.js");
+const security_monitor_js_1 = require("../../security/security-monitor.js");
 const setup_websocket_js_1 = require("../../setup/setup-websocket.js");
 // Onboarding state imports removed — onboarding is handled by Setup Wizard only
 const graph_api_js_1 = require("../../api/graph-api.js");
@@ -76,12 +77,40 @@ const { DebugLogger } = debugLogger;
 const startLogger = new DebugLogger('start');
 const skill_registry_js_1 = require("../../skills/skill-registry.js");
 const node_http_1 = __importDefault(require("node:http"));
+const sqlite_js_1 = __importDefault(require("../../sqlite.js"));
 // Port configuration — single source of truth
 /** Public-facing API server port (REST API, Viewer UI, Setup Wizard) */
 const API_PORT = 3847;
 /** Internal embedding server port (model inference, mobile chat, graph) */
 const EMBEDDING_PORT = 3849;
+function parseSecurityAlertTargets(config) {
+    const rawTargets = process.env.MAMA_SECURITY_ALERT_CHANNELS;
+    if (rawTargets && rawTargets.trim()) {
+        return rawTargets
+            .split(',')
+            .map((entry) => entry.trim())
+            .filter(Boolean)
+            .map((entry) => {
+            const [gateway, channelId] = entry.split(':', 2);
+            if ((gateway === 'discord' || gateway === 'slack') && channelId) {
+                return { gateway, channelId };
+            }
+            return null;
+        })
+            .filter((target) => target !== null);
+    }
+    if (config.discord?.default_channel_id) {
+        return [{ gateway: 'discord', channelId: config.discord.default_channel_id }];
+    }
+    const slackConfig = config.slack;
+    const slackDefaultChannel = slackConfig?.default_channel || slackConfig?.default_channel_id;
+    if (slackDefaultChannel) {
+        return [{ gateway: 'slack', channelId: slackDefaultChannel }];
+    }
+    return [];
+}
 let embeddingServer = null;
+let embeddingShutdownToken = null;
 function normalizeDiscordGuilds(raw) {
     // Reject arrays - they pass typeof 'object' check but get coerced to numeric keys
     if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
@@ -164,7 +193,7 @@ async function waitForPortAvailable(port, maxWaitMs = 5000) {
  * SECURITY P1: Validates health response before reuse
  * SECURITY P1: Uses port polling instead of fixed timeout
  */
-async function checkAndTakeoverExistingServer(port) {
+async function checkAndTakeoverExistingServer(port, shutdownToken) {
     const targetModel = (0, config_loader_1.getModelName)();
     const targetDim = (0, config_loader_1.getEmbeddingDim)();
     return new Promise((resolve) => {
@@ -214,9 +243,14 @@ async function checkAndTakeoverExistingServer(port) {
                             timeout: 2000,
                             // SECURITY P1: Pass shutdown token
                             headers: {
-                                'X-Shutdown-Token': process.env.MAMA_SHUTDOWN_TOKEN || '',
+                                'X-Shutdown-Token': shutdownToken || process.env.MAMA_SHUTDOWN_TOKEN || '',
                             },
-                        }, async () => {
+                        }, async (shutdownRes) => {
+                            if ((shutdownRes.statusCode ?? 0) < 200 || (shutdownRes.statusCode ?? 0) >= 300) {
+                                console.warn(`[EmbeddingServer] Takeover shutdown rejected with HTTP ${shutdownRes.statusCode ?? 0}`);
+                                resolve(false);
+                                return;
+                            }
                             console.log('[EmbeddingServer] MCP server shutdown requested');
                             // SECURITY P1: Use port polling instead of fixed timeout
                             const portAvailable = await waitForPortAvailable(port, 10000);
@@ -260,14 +294,18 @@ sessionStore,
 graphHandler) {
     const port = EMBEDDING_PORT;
     try {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const embeddingServerModule = require('@jungjaehoon/mama-core/embedding-server');
+        embeddingShutdownToken =
+            typeof embeddingServerModule.SHUTDOWN_TOKEN === 'string'
+                ? embeddingServerModule.SHUTDOWN_TOKEN
+                : null;
         // Check if server already running
-        const existingHasChat = await checkAndTakeoverExistingServer(port);
+        const existingHasChat = await checkAndTakeoverExistingServer(port, embeddingShutdownToken);
         if (existingHasChat) {
             // Another Standalone is running with chat, no need to start
             return;
         }
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
-        const embeddingServerModule = require('@jungjaehoon/mama-core/embedding-server');
         embeddingServer = await embeddingServerModule.startEmbeddingServer(port, {
             messageRouter,
             sessionStore,
@@ -782,7 +820,7 @@ async function runAgentLoop(config, options = {}) {
     const oauthManager = new index_js_1.OAuthManager();
     // Initialize database for session storage
     const dbPath = (0, config_manager_js_1.expandPath)(config.database.path).replace('mama-memory.db', 'mama-sessions.db');
-    const db = new better_sqlite3_1.default(dbPath);
+    const db = new sqlite_js_1.default(dbPath);
     // Initialize metrics store (respects config.metrics.enabled)
     const metricsEnabled = config.metrics?.enabled !== false;
     let metricsStore = null;
@@ -928,9 +966,8 @@ async function runAgentLoop(config, options = {}) {
         //   - config.yaml roles.definitions.*.allowedTools / blockedTools / allowedPaths
         //   - Multi-agent ToolPermissionManager (tier-based tool access)
         //   - Source-based role mapping (viewer=os_agent, discord=chat_bot, etc.)
-        // Claude CLI's interactive permission system is bypassed because it cannot work without a TTY.
-        // This is controlled solely by config.yaml (multi_agent.dangerouslySkipPermissions, default: true).
-        // DO NOT add env-var gates here — MAMA manages its own security via config.yaml roles.
+        // Headless daemon — no TTY for interactive permission prompts.
+        // Security is enforced at the API/network layer (auth-middleware), not Claude CLI permissions.
         dangerouslySkipPermissions: config.multi_agent?.dangerouslySkipPermissions ?? true,
         sessionKey: 'default', // Will be updated per message
         systemPrompt: systemPrompt + (osCapabilities ? '\n\n---\n\n' + osCapabilities : ''),
@@ -1330,6 +1367,40 @@ async function runAgentLoop(config, options = {}) {
     if (slackGateway) {
         healthCheckService.addGateway('slack', slackGateway);
     }
+    const securityAlertTargets = parseSecurityAlertTargets(config).filter((target) => {
+        if (target.gateway === 'discord') {
+            return !!discordGateway;
+        }
+        return !!slackGateway;
+    });
+    if (securityAlertTargets.length > 0) {
+        (0, security_monitor_js_1.setSecurityAlertSender)(async (event) => {
+            const message = (0, security_monitor_js_1.formatSecurityAlert)(event);
+            const results = await Promise.allSettled(securityAlertTargets.map(async (target) => {
+                if (target.gateway === 'discord' && discordGateway) {
+                    await discordGateway.sendMessage(target.channelId, message);
+                    return;
+                }
+                if (target.gateway === 'slack' && slackGateway) {
+                    await slackGateway.sendMessage(target.channelId, message);
+                }
+            }));
+            results.forEach((result, index) => {
+                if (result.status === 'rejected') {
+                    const target = securityAlertTargets[index];
+                    startLogger.warn('[SECURITY] Failed to deliver security alert to target', {
+                        gateway: target?.gateway || 'unknown',
+                        channelId: target?.channelId || 'unknown',
+                        error: result.reason instanceof Error ? result.reason.message : String(result.reason),
+                    });
+                }
+            });
+        });
+    }
+    else {
+        (0, security_monitor_js_1.setSecurityAlertSender)(null);
+        startLogger.warn('[SECURITY] No active security alert target configured. Set MAMA_SECURITY_ALERT_CHANNELS or configure an active Discord/Slack default channel.');
+    }
     // Wire cron results directly to gateways (bypasses OS agent entirely)
     // Instantiated for side effects: subscribes to cronEmitter events
     new index_js_4.CronResultRouter({
@@ -1612,7 +1683,7 @@ async function runAgentLoop(config, options = {}) {
         }
     });
     // Add Discord message sending endpoint
-    apiServer.app.post('/api/discord/send', async (req, res) => {
+    apiServer.app.post('/api/discord/send', auth_middleware_js_1.requireAuth, async (req, res) => {
         try {
             const { channelId, message } = req.body;
             if (!channelId || !message) {
@@ -1634,7 +1705,7 @@ async function runAgentLoop(config, options = {}) {
         }
     });
     // Add Slack message/file sending endpoint
-    apiServer.app.post('/api/slack/send', async (req, res) => {
+    apiServer.app.post('/api/slack/send', auth_middleware_js_1.requireAuth, async (req, res) => {
         try {
             const { channelId, message, filePath, caption } = req.body;
             if (!channelId || (!message && !filePath)) {
@@ -1698,7 +1769,7 @@ async function runAgentLoop(config, options = {}) {
         }
     });
     // Add Discord cron job endpoint (run prompt and send result to Discord)
-    apiServer.app.post('/api/discord/cron', async (req, res) => {
+    apiServer.app.post('/api/discord/cron', auth_middleware_js_1.requireAuth, async (req, res) => {
         try {
             const { channelId, prompt } = req.body;
             if (!channelId || !prompt) {
@@ -1720,7 +1791,7 @@ async function runAgentLoop(config, options = {}) {
         }
     });
     // Report endpoint - collect data and generate report (OpenClaw migration)
-    apiServer.app.post('/api/report', async (req, res) => {
+    apiServer.app.post('/api/report', auth_middleware_js_1.requireAuth, async (req, res) => {
         const { exec } = await import('child_process');
         const { promisify } = await import('util');
         const execAsync = promisify(exec);
@@ -1793,7 +1864,7 @@ Keep the report under 2000 characters as it will be sent to Discord.`;
         }
     });
     // Screenshot endpoint - take HTML screenshot and send to Discord
-    apiServer.app.post('/api/screenshot', async (req, res) => {
+    apiServer.app.post('/api/screenshot', auth_middleware_js_1.requireAuth, async (req, res) => {
         const { spawn } = await import('child_process');
         const path = await import('path');
         try {
@@ -1881,7 +1952,7 @@ Keep the report under 2000 characters as it will be sent to Discord.`;
     });
     // Send image endpoint
     // SECURITY P0: Path traversal prevention with 4-layer validation
-    apiServer.app.post('/api/discord/image', async (req, res) => {
+    apiServer.app.post('/api/discord/image', auth_middleware_js_1.requireAuth, async (req, res) => {
         const path = await import('path');
         const fs = await import('fs/promises');
         try {
@@ -1956,6 +2027,20 @@ Keep the report under 2000 characters as it will be sent to Discord.`;
     });
     // Upload/download media endpoints
     apiServer.app.use('/api', (0, upload_handler_js_1.createUploadRouter)());
+    // Auth gate for /graph/* write endpoints (not covered by /api middleware)
+    apiServer.app.use('/graph', (req, res, next) => {
+        const isRead = req.method === 'GET' || req.method === 'HEAD';
+        if (!isRead && !(0, auth_middleware_js_1.isAuthenticated)(req)) {
+            (0, auth_middleware_js_1.logUnauthorizedAttempt)(req);
+            res.status(401).json({
+                error: true,
+                code: 'UNAUTHORIZED',
+                message: 'Authentication required.',
+            });
+            return;
+        }
+        next();
+    });
     apiServer.app.use(async (req, res, next) => {
         const handled = await graphHandler(req, res);
         if (!handled)
@@ -2145,8 +2230,8 @@ Keep the report under 2000 characters as it will be sent to Discord.`;
             res.json([]);
         }
     });
-    apiServer.app.delete('/api/playgrounds/:slug', (req, res) => {
-        const { slug } = req.params;
+    apiServer.app.delete('/api/playgrounds/:slug', auth_middleware_js_1.requireAuth, (req, res) => {
+        const slug = req.params.slug;
         if (!slug || /[^a-z0-9-]/.test(slug)) {
             res.status(400).json({ error: 'Invalid slug' });
             return;
@@ -2252,7 +2337,62 @@ Keep the report under 2000 characters as it will be sent to Discord.`;
         // Handle ALL WebSocket upgrades manually
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         apiServer.server.on('upgrade', (request, socket, head) => {
-            const url = new URL(request.url || '', `http://${request.headers.host}`);
+            let url;
+            try {
+                url = new URL(request.url || '', `http://${request.headers.host || 'localhost'}`);
+            }
+            catch (error) {
+                startLogger.warn('[SECURITY] Malformed WebSocket upgrade URL rejected', {
+                    rawUrl: request.url || null,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                socket.destroy();
+                return;
+            }
+            // WebSocket auth: require token for non-localhost connections.
+            // Browsers cannot set Authorization headers on WebSocket upgrades,
+            // so we allow query-string token auth for this path only.
+            const adminToken = process.env.MAMA_AUTH_TOKEN || process.env.MAMA_SERVER_TOKEN;
+            const context = (0, auth_middleware_js_1.getSecurityLogContext)(request);
+            const isTrustedLocalUpgrade = (0, auth_middleware_js_1.isLocalRequest)(request) && !context.viaTunnel;
+            if (adminToken && !(0, auth_middleware_js_1.isAuthenticated)(request, { allowQueryToken: true })) {
+                const details = { hasQueryToken: url.searchParams.has('token') };
+                startLogger.warn('[SECURITY] Unauthorized WebSocket upgrade blocked', {
+                    ...context,
+                    ...details,
+                    path: url.pathname,
+                });
+                (0, security_monitor_js_1.recordSecurityEvent)({
+                    type: 'unauthorized_websocket_upgrade',
+                    severity: 'warn',
+                    message: 'Unauthorized WebSocket upgrade blocked',
+                    ...context,
+                    path: url.pathname,
+                    details,
+                });
+                socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+                socket.destroy();
+                return;
+            }
+            if (!adminToken && !isTrustedLocalUpgrade) {
+                const details = { hasQueryToken: url.searchParams.has('token') };
+                startLogger.warn('[SECURITY] Accepting non-localhost WebSocket upgrade without auth token configured', {
+                    ...context,
+                    ...details,
+                    path: url.pathname,
+                });
+                (0, security_monitor_js_1.recordSecurityEvent)({
+                    type: 'unprotected_websocket_upgrade',
+                    severity: 'critical',
+                    message: 'Non-localhost WebSocket upgrade accepted without auth token configured',
+                    ...context,
+                    path: url.pathname,
+                    details,
+                });
+                socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+                socket.destroy();
+                return;
+            }
             if (url.pathname === '/setup-ws') {
                 // Handle setup WebSocket locally
                 // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -2299,6 +2439,7 @@ Keep the report under 2000 characters as it will be sent to Discord.`;
     gateways.push(apiServer);
     // Handle graceful shutdown with timeout
     let shuttingDown = false;
+    let keepAliveInterval = null;
     const shutdown = async () => {
         if (shuttingDown)
             return; // Prevent double shutdown
@@ -2311,12 +2452,45 @@ Keep the report under 2000 characters as it will be sent to Discord.`;
         if (healthWarningInterval) {
             clearInterval(healthWarningInterval);
         }
+        if (keepAliveInterval) {
+            clearInterval(keepAliveInterval);
+            keepAliveInterval = null;
+        }
+        const getBlockingHandleNames = () => {
+            const processWithHandles = process;
+            const getActiveHandles = processWithHandles._getActiveHandles;
+            if (typeof getActiveHandles !== 'function') {
+                return ['unknown'];
+            }
+            const handles = getActiveHandles.call(processWithHandles);
+            const ignoredHandles = new Set(['WriteStream', 'ReadStream', 'TTY', 'TTYWrap']);
+            return (handles
+                ?.map((handle) => handle.constructor?.name)
+                .filter((name) => typeof name === 'string' && !ignoredHandles.has(name)) ?? []);
+        };
+        const getActiveRequestNames = () => {
+            const processWithRequests = process;
+            const getActiveRequests = processWithRequests._getActiveRequests;
+            if (typeof getActiveRequests !== 'function') {
+                return ['unknown'];
+            }
+            const requests = getActiveRequests.call(processWithRequests);
+            return (requests
+                ?.map((request) => request.constructor?.name)
+                .filter((name) => typeof name === 'string') ?? []);
+        };
         // Force exit after 5 seconds if graceful shutdown hangs
         // exit(0) = intentional stop; systemd Restart=on-failure should NOT restart
-        setTimeout(() => {
+        const forceExitTimer = setTimeout(() => {
+            const blockingHandles = getBlockingHandleNames();
+            const activeRequests = getActiveRequestNames();
+            if (blockingHandles.length === 0 && activeRequests.length === 0) {
+                return;
+            }
             console.error('[MAMA] Graceful shutdown timed out, forcing exit');
-            process.exit(0);
+            process.kill(process.pid, 'SIGKILL');
         }, 5000);
+        forceExitTimer.unref();
         try {
             // Stop schedulers and cron worker first
             scheduler.shutdown();
@@ -2325,8 +2499,38 @@ Keep the report under 2000 characters as it will be sent to Discord.`;
             tokenKeepAlive.stop();
             // Close embedding server (port 3849) - drain connections first
             if (embeddingServer) {
-                embeddingServer.closeAllConnections();
-                embeddingServer.close();
+                await new Promise((resolve) => {
+                    const shutdownReq = node_http_1.default.request({
+                        hostname: '127.0.0.1',
+                        port: EMBEDDING_PORT,
+                        path: '/shutdown',
+                        method: 'POST',
+                        timeout: 2000,
+                        headers: {
+                            'X-Shutdown-Token': embeddingShutdownToken || process.env.MAMA_SHUTDOWN_TOKEN || '',
+                        },
+                    }, async (response) => {
+                        const statusCode = response.statusCode ?? 0;
+                        const released = await waitForPortAvailable(EMBEDDING_PORT, 5000);
+                        if (statusCode >= 200 && statusCode < 300 && released) {
+                            resolve();
+                            return;
+                        }
+                        startLogger.warn(`[EmbeddingServer] Shutdown endpoint did not fully stop server (status=${statusCode}, released=${released})`);
+                        if (embeddingServer) {
+                            embeddingServer.close(() => resolve());
+                            return;
+                        }
+                        resolve();
+                    });
+                    shutdownReq.on('error', () => resolve());
+                    shutdownReq.on('timeout', () => {
+                        shutdownReq.destroy();
+                        resolve();
+                    });
+                    shutdownReq.end();
+                });
+                embeddingServer = null;
             }
             // Stop all gateways with per-gateway 2s timeout
             const withTimeout = (p, ms) => Promise.race([p, new Promise((r) => setTimeout(r, ms))]);
@@ -2334,21 +2538,34 @@ Keep the report under 2000 characters as it will be sent to Discord.`;
             // Stop plugin gateways
             await withTimeout(pluginLoader.stopAll().catch(() => { }), 1000);
             // Stop agent loop
-            agentLoop.stop();
+            await agentLoop.stop();
             // Release all CLI sessions
             (0, session_pool_js_1.getSessionPool)().dispose();
             // Close session database
             sessionStore.close();
             // Stop metrics cleanup
             metricsCleanup?.stop();
+            metricsStore?.close();
+            db.close();
             const { deletePid } = await import('../utils/pid-manager.js');
             await deletePid();
+            const blockingHandles = getBlockingHandleNames();
+            const activeRequests = getActiveRequestNames();
+            if (blockingHandles.length === 0 && activeRequests.length === 0) {
+                clearTimeout(forceExitTimer);
+            }
+            else if (blockingHandles.length === 0 &&
+                activeRequests.length > 0 &&
+                activeRequests.every((name) => name === 'FSReqPromise')) {
+                process.kill(process.pid, 'SIGKILL');
+            }
         }
         catch (error) {
             // Best effort cleanup
             console.warn('[MAMA] Cleanup error during shutdown:', error);
         }
-        process.exit(0);
+        process.exitCode = 0;
+        return;
     };
     process.on('SIGINT', shutdown);
     process.on('SIGTERM', shutdown);
@@ -2368,7 +2585,7 @@ Keep the report under 2000 characters as it will be sent to Discord.`;
     console.log('MAMA agent is waiting...\n');
     // Keep process alive using setInterval
     // This ensures the Node.js event loop stays active
-    setInterval(() => {
+    keepAliveInterval = setInterval(() => {
         // Heartbeat - keeps the process running
     }, 30000); // Every 30 seconds
 }