@lensagent/core 0.1.0

package/dist/adapters/revert.js

@@ -0,0 +1,155 @@
+import { fail } from '../core/domain.js';
+import { capabilityManifest } from '../runtime/manifests.js';
+import { pathResource } from './executor.js';
+// Restores files changed by previous write_file/edit_file Calls. terminal_command_run/git_run are
+// not tracked -- see docs/architecture/harness-level3/09-file-snapshot-storage-decision.md.
+//
+// The file history lives in the Executor, which is where the files are, so this adapter is a thin
+// pass-through: Core decides which Calls may be reverted (Policy, Capability assignment, ownership
+// of the Call ids) and the Executor decides what that means on disk. Core holds no file bytes, no
+// object ids and no ordering logic -- the Executor orders by its own per-Workspace sequence and
+// verifies every path still holds what the Call left behind before writing anything.
+//
+// Registered as a model-visible Capability rather than a maintenance-only Route: an Agent decides
+// when undoing its own previous edits is the right move, the same way it decides to make them.
+export class RevertAdapter {
+    store;
+    executor;
+    id = 'revert';
+    constructor(store, executor) {
+        this.store = store;
+        this.executor = executor;
+    }
+    async execute(invocation) {
+        const input = object(invocation.arguments);
+        const callIds = [...new Set(stringArray(input.call_ids))];
+        if (callIds.length === 0)
+            fail('CALL_ARGUMENTS_INVALID', 422, 'call_ids must not be empty.');
+        // The Executor keys history by (workspace_id, call_id) and is only told this Call's Workspace,
+        // so a target from another one would come back as absent history rather than as the mistake it
+        // is. Resolving the ids here also confirms they are Calls in this Project at all.
+        for (const callId of callIds) {
+            const target = this.store.getCall(invocation.projectId, callId);
+            if (target.workspace_id !== invocation.workspaceId)
+                fail('CALL_ARGUMENTS_INVALID', 422, `Call ${callId} belongs to a different Workspace.`);
+        }
+        const response = object(await this.executor.call('revertCall', {
+            workspace_paths: invocation.workspacePaths,
+            workspace_id: invocation.workspaceId,
+            call_ids: callIds,
+            // Reverting over content the recorded Call did not leave behind is refused by default. The
+            // Agent has to ask for it, and the Result says which paths were affected either way.
+            force: input.force === true,
+            full_access: invocation.fullAccess === true,
+            call_id: invocation.callId
+        }, 120000, invocation.signal));
+        const conflicts = array(response.conflicts);
+        if (conflicts.length > 0) {
+            return {
+                content: { reverted_calls: [], conflicts },
+                outcome: 'failed',
+                errorCode: 'REVERT_CONFLICT'
+            };
+        }
+        return { content: { reverted_calls: array(response.calls) } };
+    }
+}
+export function revertCapabilities(store, executor) {
+    const definition = {
+        id: 'revert_call',
+        title: 'Revert Call',
+        description: 'Restore files to their state before one or more previous write_file or edit_file Calls. Refuses if a file no longer holds what that Call wrote, unless force is set. terminal_command_run and git_run changes cannot be reverted.',
+        adapterId: 'revert',
+        effect: 'workspace_write',
+        loadMode: 'deferred',
+        outputLimitBytes: 262144,
+        defaultAssignment: 'none',
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                call_ids: { type: 'array', items: { type: 'string', minLength: 1 }, minItems: 1 },
+                force: { type: 'boolean' }
+            },
+            required: ['call_ids']
+        }
+    };
+    return [{
+            definition,
+            adapter: new RevertAdapter(store, executor),
+            manifest: capabilityManifest(definition),
+            claims: (context) => revertClaims(store, context)
+        }];
+}
+// The paths a revert will touch are already in Core's own Store: every target is a write_file or
+// edit_file Call whose `path` argument is recorded in its input. So the claim can be narrowed to
+// those paths without asking the Executor, which keeps claim computation synchronous -- Claim
+// admission has to stay in the same critical section as the QUEUED -> EXECUTING CAS.
+//
+// The resource names come from the same helper the original write_file/edit_file Calls used, because
+// a claim only detects a conflict if both sides spell the resource identically.
+//
+// Anything unexpected -- a target that is not a file Call, a missing path, a Call from another
+// Workspace -- returns the global write claim instead of a narrower guess. A revert that claims too
+// little would run concurrently with a write to the same file.
+function revertClaims(store, context) {
+    const global = [{ resource: '*', mode: 'write' }];
+    const input = record(context.arguments);
+    if (input === undefined)
+        return global;
+    const callIds = input.call_ids;
+    if (!Array.isArray(callIds) || callIds.length === 0)
+        return global;
+    const resources = new Set();
+    for (const entry of callIds) {
+        if (typeof entry !== 'string' || entry.length === 0)
+            return global;
+        const call = store.getCall(context.projectId, entry);
+        if (call.workspace_id !== context.workspaceId)
+            return global;
+        if (call.capability_id !== 'write_file' && call.capability_id !== 'edit_file')
+            return global;
+        // Prefer the path the Executor reported in the Result: that one is realpath-resolved, so a target
+        // reached through a symlink, junction or alias yields the same resource name as any other spelling
+        // of the same file. The request argument is only a fallback for a Call with no Result, and it is a
+        // naive resolve that cannot see through links.
+        const path = resultPath(call.result) ?? filePath(call.input);
+        if (path === undefined)
+            return global;
+        resources.add(pathResource(path, context.workspacePaths));
+    }
+    return [...resources].map((resource) => ({ resource, mode: 'write' }));
+}
+// The Executor's own resolved absolute path for the file it wrote, as returned in the Result.
+function resultPath(value) {
+    const path = record(record(value)?.content)?.relative_path;
+    return typeof path === 'string' && path.length > 0 ? path : undefined;
+}
+// Mirrors CallRuntime's originalArguments: a Call that went through policy review or user input has
+// its arguments nested under `arguments`.
+function filePath(value) {
+    const outer = record(value);
+    if (outer === undefined)
+        return undefined;
+    const inner = record('arguments' in outer && ('answer' in outer || 'prompt' in outer) ? outer.arguments : outer);
+    const path = inner?.path;
+    return typeof path === 'string' && path.length > 0 ? path : undefined;
+}
+function record(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return undefined;
+    return value;
+}
+function object(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        fail('INVALID_INPUT', 400, 'Revert input must be an object.');
+    return value;
+}
+function array(value) {
+    return Array.isArray(value) ? value : [];
+}
+function stringArray(value) {
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== 'string' || entry.length === 0))
+        fail('INVALID_INPUT', 400, 'call_ids must be a string array.');
+    return value;
+}

package/dist/config/runtime.d.ts

@@ -0,0 +1,55 @@
+import { type Json } from '../core/domain.js';
+import { type HarnessConfig } from './schema.js';
+export interface ConfigSnapshot {
+    readonly config: HarnessConfig;
+    /**
+     * The file's own parse, before restart-only settings are held back.
+     *
+     * `config` is the effective config, which keeps the previous value for anything that needs a
+     * restart. Rendering the document from that made a written-but-pending change invisible: a client
+     * could not see the setting it had just saved, and -- worse -- read/modify/write through the
+     * document would have written the file back without it.
+     */
+    readonly fileConfig: HarnessConfig;
+    readonly digest: string;
+    readonly fileDigest: string;
+    readonly metadataRevision: number;
+    readonly pendingRestart: readonly string[];
+    readonly appliedHot: readonly string[];
+    readonly error: string | null;
+}
+export interface ConfigDocument {
+    readonly content: string | null;
+    readonly content_omitted: boolean;
+    readonly file_size_bytes: string;
+    readonly file_digest: string;
+    readonly active_config_digest: string;
+    readonly file_valid: boolean;
+    readonly validation_errors: readonly Json[];
+    readonly applied_hot: readonly string[];
+    readonly pending_restart: readonly string[];
+}
+export declare class ConfigRuntime {
+    #private;
+    readonly path: string;
+    constructor(root: string, path?: string);
+    get current(): ConfigSnapshot;
+    load(): Promise<ConfigSnapshot>;
+    parse(source: string): HarnessConfig;
+    validate(source: string): {
+        readonly valid: boolean;
+        readonly normalized_digest: string | null;
+        readonly errors: readonly Json[];
+    };
+    replace(source: string, expectedFileDigest: string): Promise<ConfigSnapshot>;
+    start(onChange: (snapshot: ConfigSnapshot) => void): void;
+    close(): void;
+    publicConfig(): Json;
+    /** The file as a client should see it: every saved setting, with secrets redacted. */
+    publicFileConfig(): Json;
+    document(): ConfigDocument;
+}
+export declare function resolveSecret(value: string | {
+    readonly env: string;
+    readonly optional?: boolean;
+} | undefined): string | undefined;

package/dist/config/runtime.js

@@ -0,0 +1,371 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { watch } from 'node:fs';
+import { readFile, rename, writeFile } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, normalize, resolve } from 'node:path';
+import { Ajv } from 'ajv';
+import { canonicalize } from 'json-canonicalize';
+import { parse } from 'jsonc-parser';
+import { fail } from '../core/domain.js';
+import { ConfigSchema } from './schema.js';
+export class ConfigRuntime {
+    path;
+    #validate;
+    #snapshot;
+    #watcher;
+    #reloadTail = Promise.resolve();
+    constructor(root, path = 'config/lens.jsonc') {
+        this.path = resolve(root, path);
+        this.#validate = new Ajv({ allErrors: true, strict: false }).compile(ConfigSchema);
+    }
+    get current() {
+        if (this.#snapshot === undefined)
+            fail('CONFIG_UNAVAILABLE', 503, 'Configuration has not been loaded.');
+        return this.#snapshot;
+    }
+    async load() {
+        let source;
+        try {
+            source = await readFile(this.path, 'utf8');
+        }
+        catch (error) {
+            fail('CONFIG_INVALID', 503, 'The configuration file could not be read.', { reason: message(error) });
+        }
+        const previous = this.#snapshot;
+        const fileDigest = hash(source);
+        if (previous?.fileDigest === fileDigest)
+            return previous;
+        const candidate = this.parse(source);
+        const config = previous === undefined ? candidate : effective(previous.config, candidate);
+        const next = {
+            config,
+            fileConfig: candidate,
+            digest: hash(canonicalize(config)),
+            fileDigest,
+            metadataRevision: (previous?.metadataRevision ?? 0) + 1,
+            pendingRestart: previous === undefined ? [] : restartPending(previous.config, candidate),
+            appliedHot: previous === undefined ? [] : appliedHot(previous.config, candidate),
+            error: null
+        };
+        this.#snapshot = next;
+        return next;
+    }
+    parse(source) {
+        const errors = [];
+        const document = parse(source, errors, { allowTrailingComma: true });
+        if (errors.length > 0 || !this.#validate(document)) {
+            fail('CONFIG_INVALID', 400, 'The configuration is invalid.', { issues: issues(errors, this.#validate.errors) });
+        }
+        const semantic = semanticIssues(document);
+        if (semantic.length > 0)
+            fail('CONFIG_INVALID', 400, 'The configuration is invalid.', { issues: semantic });
+        return document;
+    }
+    validate(source) {
+        try {
+            const config = this.parse(source);
+            return { valid: true, normalized_digest: hash(canonicalize(config)), errors: [] };
+        }
+        catch (error) {
+            return { valid: false, normalized_digest: null, errors: validationDetails(error) };
+        }
+    }
+    replace(source, expectedFileDigest) {
+        if (expectedFileDigest !== this.current.fileDigest)
+            fail('CONFIG_CONFLICT', 409, 'The configuration file changed.');
+        // Resolved against the file, because the document the client edited was rendered from the file.
+        // Using the effective config would fail to restore a secret belonging to a restart-only setting
+        // that has been saved but not yet applied -- the placeholder would be written as the value.
+        const persisted = restoreSecrets(source, this.current.fileConfig);
+        this.parse(persisted);
+        const operation = this.#reloadTail.then(async () => {
+            const temporary = `${this.path}.${process.pid}.${randomUUID()}.tmp`;
+            await writeFile(temporary, persisted, 'utf8');
+            await rename(temporary, this.path);
+            return this.load();
+        });
+        this.#reloadTail = operation.then(() => undefined, () => undefined);
+        return operation;
+    }
+    start(onChange) {
+        this.#watcher = watch(dirname(this.path), (_event, filename) => {
+            if (filename !== null && filename !== basename(this.path))
+                return;
+            this.#reloadTail = this.#reloadTail.then(async () => {
+                try {
+                    const previous = this.current;
+                    const next = await this.load();
+                    if (next !== previous)
+                        onChange(next);
+                }
+                catch (error) {
+                    const current = this.current;
+                    const source = await readFile(this.path, 'utf8').catch(() => '');
+                    const next = {
+                        ...current,
+                        fileDigest: hash(source),
+                        metadataRevision: current.metadataRevision + 1,
+                        error: message(error)
+                    };
+                    this.#snapshot = next;
+                    onChange(next);
+                }
+            });
+        });
+    }
+    close() {
+        this.#watcher?.close();
+        this.#watcher = undefined;
+    }
+    publicConfig() {
+        return redact(this.current.config);
+    }
+    /** The file as a client should see it: every saved setting, with secrets redacted. */
+    publicFileConfig() {
+        return redact(this.current.fileConfig);
+    }
+    document() {
+        const snapshot = this.current;
+        // Rendered from the file, not the effective config, so a restart-only setting that has been
+        // saved is visible and survives the next read/modify/write.
+        const content = snapshot.error === null ? `${JSON.stringify(this.publicFileConfig(), null, 2)}\n` : null;
+        return {
+            content,
+            content_omitted: content === null,
+            // Documented as a decimal string, like the revisions, so a client never has to guess
+            // whether a large size arrived as a number.
+            file_size_bytes: String(content === null ? 0 : Buffer.byteLength(content)),
+            file_digest: snapshot.fileDigest,
+            active_config_digest: snapshot.digest,
+            file_valid: snapshot.error === null,
+            // `SchemaIssue` carries a path and a stable code beside the message.
+            validation_errors: snapshot.error === null
+                ? []
+                : [{ path: '/', code: 'CONFIG_INVALID', message: snapshot.error }],
+            applied_hot: snapshot.appliedHot,
+            pending_restart: snapshot.pendingRestart
+        };
+    }
+}
+export function resolveSecret(value) {
+    if (typeof value === 'string')
+        return value;
+    if (value === undefined)
+        return undefined;
+    const secret = process.env[value.env];
+    if ((secret === undefined || secret.length === 0) && value.optional !== true) {
+        fail('MODEL_CREDENTIAL_MISSING', 503, `Environment variable ${value.env} is required.`);
+    }
+    return secret;
+}
+function redact(value, key = '', headerValue = false) {
+    if (typeof value === 'string' && (key === 'apiKey' || headerValue))
+        return '[redacted]';
+    if (Array.isArray(value))
+        return value.map((entry) => redact(entry, '', headerValue));
+    if (typeof value !== 'object' || value === null)
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([entryKey, entry]) => [
+        entryKey,
+        redact(entry, entryKey, headerValue || key === 'headers')
+    ]));
+}
+function restoreSecrets(source, current) {
+    const candidate = parse(source);
+    if (typeof candidate !== 'object' || candidate === null || Array.isArray(candidate))
+        return source;
+    let changed = false;
+    const document = candidate;
+    const providers = record(document.providers);
+    for (const [providerId, provider] of Object.entries(providers ?? {})) {
+        const options = record(record(provider)?.options);
+        if (options?.apiKey !== '[redacted]')
+            continue;
+        const existing = current.providers[providerId]?.options.apiKey;
+        if (existing !== undefined) {
+            options.apiKey = existing;
+            changed = true;
+        }
+    }
+    const servers = record(document.mcpServers);
+    for (const [serverId, server] of Object.entries(servers ?? {})) {
+        const headers = record(record(server)?.headers);
+        if (headers === null)
+            continue;
+        for (const [name, value] of Object.entries(headers)) {
+            if (value !== '[redacted]')
+                continue;
+            const existing = current.mcpServers?.[serverId]?.headers?.[name];
+            if (existing !== undefined) {
+                headers[name] = existing;
+                changed = true;
+            }
+        }
+    }
+    return changed ? `${JSON.stringify(document, null, 2)}\n` : source;
+}
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value) ? value : null;
+}
+function hash(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function issues(parseErrors, validationErrors) {
+    return [
+        ...parseErrors.map((error) => ({ kind: 'parse', offset: error.offset, length: error.length })),
+        ...(validationErrors ?? []).map((error) => ({ kind: 'schema', path: error.instancePath, message: error.message ?? 'invalid' }))
+    ];
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function validationDetails(error) {
+    if (typeof error === 'object' && error !== null && 'details' in error) {
+        const details = error.details;
+        if (typeof details === 'object' && details !== null && !Array.isArray(details) && 'issues' in details && Array.isArray(details.issues))
+            return details.issues;
+    }
+    return [{ message: message(error) }];
+}
+function semanticIssues(config) {
+    const result = [];
+    const issue = (path, messageValue) => { result.push({ kind: 'semantic', path, message: messageValue }); };
+    const profiles = new Set(Object.keys(config.modelHarnessProfiles ?? {}));
+    for (const [profileId, profile] of Object.entries(config.modelHarnessProfiles ?? {})) {
+        if (!profile.effort.allowed.includes(profile.effort.default))
+            issue(`/modelHarnessProfiles/${profileId}/effort/default`, 'The default effort is not allowed by the profile.');
+    }
+    for (const [providerId, provider] of Object.entries(config.providers)) {
+        if (!/^[a-z0-9][a-z0-9._-]{0,127}$/u.test(providerId))
+            issue(`/providers/${providerId}`, 'Provider ID is invalid.');
+        if (provider.adapter === '@ai-sdk/openai-compatible' && provider.options.baseURL === undefined)
+            issue(`/providers/${providerId}/options/baseURL`, 'OpenAI-compatible providers require baseURL.');
+        for (const [modelId, model] of Object.entries(provider.models)) {
+            if (modelId.length === 0 || modelId.includes('\n'))
+                issue(`/providers/${providerId}/models/${modelId}`, 'Model ID is invalid.');
+            if (model.harnessProfile !== undefined && !profiles.has(model.harnessProfile))
+                issue(`/providers/${providerId}/models/${modelId}/harnessProfile`, 'Model Harness Profile does not exist.');
+        }
+    }
+    for (const [roleName, role] of Object.entries(config.roles)) {
+        const agentRole = roleName === 'agent' || roleName === 'subagent';
+        const model = role.model === null ? undefined : configuredModel(config, role.model);
+        if (model === undefined)
+            issue(`/roles/${roleName}/model`, 'Role model is not configured.');
+        if (role.modelReasoningEffort === null)
+            issue(`/roles/${roleName}/modelReasoningEffort`, 'Role reasoning effort is required.');
+        else {
+            const allowed = model?.harnessProfile === undefined
+                ? ['none', 'minimal', 'low', 'medium', 'high']
+                : config.modelHarnessProfiles?.[model.harnessProfile]?.effort.allowed ?? [];
+            if (!allowed.includes(role.modelReasoningEffort))
+                issue(`/roles/${roleName}/modelReasoningEffort`, 'Role reasoning effort is not allowed by the Model Harness Profile.');
+        }
+        if (agentRole && (role.policyPreset === null || config.policyPresets[role.policyPreset] === undefined))
+            issue(`/roles/${roleName}/policyPreset`, 'Agent roles require an existing Policy preset.');
+        if ((agentRole || roleName === 'compactor') && role.contextStrategy !== 'default')
+            issue(`/roles/${roleName}/contextStrategy`, 'The v1 Context Strategy is default.');
+        if (roleName === 'compactor' && (role.policyPreset !== null || role.capabilities.length > 0))
+            issue(`/roles/${roleName}`, 'Compactor has no Policy or Capabilities.');
+        if (roleName === 'auto-review' && (role.policyPreset !== null || role.capabilities.length > 0 || role.contextStrategy !== null))
+            issue(`/roles/${roleName}`, 'Auto Review has no Policy, Capabilities or Context Strategy.');
+        if (new Set(role.providerRouting.fallback).size !== role.providerRouting.fallback.length)
+            issue(`/roles/${roleName}/providerRouting/fallback`, 'Fallback models must be unique.');
+        for (const reference of role.providerRouting.fallback) {
+            if (configuredModel(config, reference) === undefined)
+                issue(`/roles/${roleName}/providerRouting/fallback`, `Fallback model ${reference} is not configured.`);
+        }
+    }
+    for (const [serverId, server] of Object.entries(config.mcpServers ?? {})) {
+        let endpoint = null;
+        try {
+            endpoint = new URL(server.endpoint);
+        }
+        catch {
+            issue(`/mcpServers/${serverId}/endpoint`, 'MCP endpoint must be an absolute URL.');
+        }
+        if (endpoint !== null && (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.username.length > 0 || endpoint.password.length > 0))
+            issue(`/mcpServers/${serverId}/endpoint`, 'MCP endpoint must be HTTP(S) without URL credentials.');
+        for (const [name, value] of Object.entries(server.headers ?? {})) {
+            const lower = name.toLowerCase();
+            if (!/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/u.test(name) || ['content-type', 'accept', 'mcp-protocol-version'].includes(lower))
+                issue(`/mcpServers/${serverId}/headers/${name}`, 'MCP header name is invalid or reserved.');
+            if (typeof value === 'string' && hasControl(value))
+                issue(`/mcpServers/${serverId}/headers/${name}`, 'MCP header value contains control characters.');
+        }
+    }
+    if (config.tls.enabled && (config.tls.certFile === null || config.tls.keyFile === null))
+        issue('/tls', 'TLS requires certFile and keyFile.');
+    const executorTls = config.executor.tls;
+    if (executorTls?.enabled === true && ((executorTls.certFile === undefined) !== (executorTls.keyFile === undefined)))
+        issue('/executor/tls', 'Executor client certificate and key must be configured together.');
+    if (config.historyRetention.purgeMode === 'after_days' && config.historyRetention.purgeArchivedAfterDays === null)
+        issue('/historyRetention', 'Automatic purge requires purgeArchivedAfterDays.');
+    if (config.snapshot.pageSizeMax > 500 || config.snapshot.pageSizeDefault > config.snapshot.pageSizeMax)
+        issue('/snapshot', 'Snapshot page sizes are inconsistent or exceed 500.');
+    const projection = config.contextProjection;
+    if (projection?.snip !== undefined && projection.snip.retainedTokens > projection.snip.triggerTokens)
+        issue('/contextProjection/snip', 'Retained tokens exceed the trigger.');
+    if (projection?.microcompact !== undefined && projection.microcompact.projectedTokens > projection.microcompact.triggerTokens)
+        issue('/contextProjection/microcompact', 'Projected tokens exceed the trigger.');
+    if (projection?.contextCollapse !== undefined && projection.contextCollapse.projectedTokens > projection.contextCollapse.triggerTokens)
+        issue('/contextProjection/contextCollapse', 'Projected tokens exceed the trigger.');
+    const logPath = config.observability?.logs?.path;
+    if (logPath !== undefined && (isAbsolute(logPath) || normalize(logPath).split(/[\\/]/u).includes('..')))
+        issue('/observability/logs/path', 'Log path must stay inside the project root.');
+    const verification = config.executive.verification.map((entry) => entry.id);
+    if (new Set(verification).size !== verification.length)
+        issue('/executive/verification', 'Verification IDs must be unique.');
+    return result;
+}
+function configuredModel(config, reference) {
+    const separator = reference.indexOf('/');
+    if (separator <= 0 || separator === reference.length - 1)
+        return undefined;
+    return config.providers[reference.slice(0, separator)]?.models[reference.slice(separator + 1)];
+}
+function hasControl(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code <= 31 || code === 127)
+            return true;
+    }
+    return false;
+}
+function effective(current, candidate) {
+    const hot = { ...candidate };
+    delete hot.pairPath;
+    delete hot.persistence;
+    delete hot.observability;
+    delete hot.mcpServers;
+    delete hot.lspServers;
+    return {
+        ...hot,
+        listen: current.listen,
+        tls: current.tls,
+        database: current.database,
+        executor: current.executor,
+        artifacts: current.artifacts,
+        ...(current.pairPath === undefined ? {} : { pairPath: current.pairPath }),
+        ...(current.persistence === undefined ? {} : { persistence: current.persistence }),
+        ...(current.observability === undefined ? {} : { observability: current.observability }),
+        ...(current.mcpServers === undefined ? {} : { mcpServers: current.mcpServers }),
+        ...(current.lspServers === undefined ? {} : { lspServers: current.lspServers })
+    };
+}
+/**
+ * The settings whose values only take effect after a restart, as documented by 02A
+ * `pending_restart`. Returns the changed setting names rather than a flag so a client can say
+ * which ones are waiting.
+ */
+const RESTART_SETTINGS = ['listen', 'tls', 'database', 'executor', 'artifacts', 'pairPath', 'persistence', 'observability', 'mcpServers', 'lspServers'];
+function restartPending(current, candidate) {
+    return RESTART_SETTINGS.filter((key) => JSON.stringify(current[key]) !== JSON.stringify(candidate[key]));
+}
+/** Settings that changed and are live now, i.e. the changed settings that are not restart-only. */
+function appliedHot(current, candidate) {
+    const restartOnly = new Set(RESTART_SETTINGS);
+    return [...new Set([...Object.keys(current), ...Object.keys(candidate)])]
+        .filter((key) => !restartOnly.has(key))
+        .filter((key) => JSON.stringify(current[key]) !== JSON.stringify(candidate[key]))
+        .sort();
+}