@nanhara/hara 0.131.1 → 0.132.1

package/dist/gateway/weixin.js

@@ -239,16 +239,34 @@ export function weixinKnownPeers(accountId) {
         return [];
     }
 }
-export function loadWeixinCreds() {
+function validWeixinCredentials(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const credentials = value;
+    return [credentials.account_id, credentials.token, credentials.base_url, credentials.user_id]
+        .every((part) => typeof part === "string" && part.trim().length > 0);
+}
+/** Read-only credential probe. The public status mapper exposes only `state`; credentials stay inside the
+ * gateway module and are used solely to derive the already-redacted runtime scope or start the adapter. */
+export function inspectWeixinCredentials() {
     try {
         const binding = weixinStateFile("creds.json");
         const snapshot = readPrivateStateFileSnapshotSync(binding.path, 1024 * 1024);
-        return snapshot ? JSON.parse(snapshot.text) : null;
+        if (!snapshot)
+            return { state: "missing" };
+        const credentials = JSON.parse(snapshot.text);
+        return validWeixinCredentials(credentials)
+            ? { state: "ready", credentials }
+            : { state: "unreadable" };
     }
     catch {
-        return null;
+        return { state: "unreadable" };
     }
 }
+export function loadWeixinCreds() {
+    const inspected = inspectWeixinCredentials();
+    return inspected.state === "ready" ? inspected.credentials : null;
+}
 function saveWeixinCreds(c) {
     writePrivateStateFileSync(weixinStateFile("creds.json"), JSON.stringify(c, null, 2) + "\n");
 }
@@ -664,7 +682,7 @@ export function weixinAdapter(creds) {
             if (!(await sendMediaFile(creds, tokenStore, String(chatId), file)))
                 throw new Error(`weixin file delivery failed: ${file.safeName}`);
         },
-        async start(onMessage, signal, shouldDownload) {
+        async start(onMessage, signal, shouldDownload, runtime) {
             let buf = loadCursor(creds.account_id);
             let pollMs = LONG_POLL_TIMEOUT_MS;
             while (!signal.aborted) {
@@ -676,20 +694,24 @@ export function weixinAdapter(creds) {
                 catch {
                     if (signal.aborted)
                         break;
+                    runtime?.error("network");
                     await sleep(2000, signal); // timeout (normal) or network blip → re-poll
                     continue;
                 }
                 const ret = num(resp.ret);
                 const errcode = num(resp.errcode);
                 if (isSessionExpired(ret, errcode, str(resp.errmsg))) {
+                    runtime?.error("session-expired");
                     console.error("weixin: session expired — re-login with `hara gateway --platform weixin --login`. backing off 600s.");
                     await sleep(600_000, signal);
                     continue;
                 }
                 if (ret !== 0 || errcode !== 0) {
+                    runtime?.error("platform-error");
                     await sleep(2000, signal);
                     continue;
                 }
+                runtime?.poll();
                 buf = str(resp.get_updates_buf) || buf;
                 saveCursor(creds.account_id, buf);
                 for (const msg of Array.isArray(resp.msgs) ? resp.msgs : []) {

package/dist/index.js

@@ -22,7 +22,7 @@ import { notifyDone } from "./notify.js";
 import { startMcpServer, mcpServeToolNames } from "./mcp/server.js";
 import { completionScript } from "./completions.js";
 import { renderSessionMarkdown } from "./export.js";
-import { clearEnrollment, enrollDevice, heartbeat, syncOrgRoles, deviceTokenExpired, deviceTokenExpiryWarning, } from "./org-fleet/enroll.js";
+import { clearEnrollment, enrollDevice, enrollGatewayProfile, gatewayProfileFromEnrollment, enrollmentFromProfile, heartbeatEnrollment, heartbeat, syncOrgRoles, deviceTokenExpired, deviceTokenExpiryWarning, } from "./org-fleet/enroll.js";
 import { loadActiveProfile, listProfiles, useProfile, addProfile, upsertProfile, removeProfile, setModel as setProfileModel, resetModel as resetProfileModel, getProfile, effectiveModel, routingLabel, routeHost, activeId, resolveActive, setFlagOverride, writePin, removePin, pinFilePath, DEFAULT_ORG_ID, PERSONAL_ID, } from "./profile/profile.js";
 import { loadPermissionRules, scaffoldPermissions, globalPermissionsPath, projectPermissionsPath } from "./security/permissions.js";
 import { routingProvider } from "./agent/route.js";
@@ -130,6 +130,28 @@ const pkg = {
         })()),
 };
 const maskKey = (v) => (v ? `••••${v.slice(-4)}` : "(unset)");
+const SECRET_CONFIG_KEY = /(?:apiKey|secret|token|password)$/i;
+const maskProxy = (value) => {
+    if (typeof value !== "string" || !value.trim())
+        return "(unset)";
+    try {
+        const url = new URL(value);
+        const authenticated = Boolean(url.username || url.password);
+        url.username = "";
+        url.password = "";
+        return `${url.protocol}//${url.host}${authenticated ? " (credentials redacted)" : ""}`;
+    }
+    catch {
+        return "(configured, invalid URL hidden)";
+    }
+};
+const displayConfigValue = (key, value) => {
+    if (key === "proxy")
+        return maskProxy(value);
+    if (SECRET_CONFIG_KEY.test(key))
+        return maskKey(typeof value === "string" ? value : undefined);
+    return value === undefined ? "(unset)" : String(value);
+};
 async function buildProvider(cfg, targetOverride) {
     // Identity-profile is the source of truth for routing. `cfg` is the *merged* HaraConfig (env +
     // project + global) and still drives non-routing concerns (model overrides, baseURL fallbacks
@@ -268,6 +290,58 @@ function providerSettingsSnapshot(targetCwd) {
         providers: catalog,
     };
 }
+function organizationAccessState(profile, now = Date.now()) {
+    if (!profile.deviceToken || !profile.gatewayUrl)
+        return "invalid";
+    if (!profile.tokenExpiresAt)
+        return "legacy";
+    const expiry = Date.parse(profile.tokenExpiresAt);
+    if (!Number.isFinite(expiry))
+        return "invalid";
+    if (expiry <= now)
+        return "expired";
+    return expiry - now <= 24 * 60 * 60_000 ? "expiring" : "valid";
+}
+function publicGatewayIdentity(value) {
+    try {
+        const url = new URL(value || "");
+        return { gatewayUrl: url.origin, gatewayHost: url.host };
+    }
+    catch {
+        return { gatewayUrl: "", gatewayHost: "invalid endpoint" };
+    }
+}
+function organizationConnectionsSnapshot(targetCwd) {
+    const resolution = resolveActive(targetCwd);
+    const connections = listProfiles()
+        .filter((profile) => profile.kind === "gateway")
+        .map((profile) => {
+        const endpoint = publicGatewayIdentity(profile.gatewayUrl);
+        return {
+            id: profile.id,
+            label: profile.label || profile.id,
+            active: profile.id === resolution.id,
+            ...endpoint,
+            model: effectiveModel(profile) || "",
+            ...(profile.enrolledAt ? { enrolledAt: profile.enrolledAt } : {}),
+            ...(profile.tokenExpiresAt ? { expiresAt: profile.tokenExpiresAt } : {}),
+            accessState: organizationAccessState(profile),
+        };
+    });
+    return {
+        activeId: resolution.id,
+        activeSource: resolution.source,
+        switchLocked: resolution.source === "flag" || resolution.source === "env" || resolution.source === "pin",
+        connections,
+    };
+}
+function assertOrganizationId(value) {
+    const id = value.trim();
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(id) || id === PERSONAL_ID) {
+        throw new Error("invalid organization connection id");
+    }
+    return id;
+}
 async function testProviderSettingsCandidate(input) {
     if (!isProviderId(input.provider) || input.provider === "hara-gateway") {
         throw new Error("provider is not a configurable personal provider");
@@ -1872,28 +1946,16 @@ profileCmd
         if (!opts.code)
             return void out(c.red("gateway profile add needs --code <code> from your hara-control admin\n"));
         try {
-            const e = await enrollDevice(opts.gateway, opts.code);
-            const p = {
+            const { enrollment: e } = await enrollGatewayProfile({
                 id,
-                kind: "gateway",
                 label: opts.label || id,
-                gatewayUrl: e.gatewayUrl,
-                deviceId: e.deviceId,
-                deviceToken: e.deviceToken,
-                baseURL: e.baseURL,
-                defaultModel: e.model || "",
-                availableModels: e.model ? [e.model] : [],
-                enrolledAt: e.enrolledAt,
-                tokenExpiresAt: e.expiresAt,
-            };
-            upsertProfile(p); // upsert: re-enrolling the same id rotates the token
-            const r = useProfile(id);
-            if (r.ok) {
-                out(c.green(`✓ enrolled and switched to '${id}' (${e.gatewayUrl})`) + c.dim(` · model ${p.defaultModel || "(gateway default)"}\n`));
-                const nRoles = await syncOrgRoles();
-                if (nRoles > 0)
-                    out(c.dim(`  ↳ synced ${nRoles} org role${nRoles === 1 ? "" : "s"} → ~/.hara/org-roles/\n`));
-            }
+                gatewayUrl: opts.gateway,
+                code: opts.code,
+            });
+            out(c.green(`✓ enrolled and switched to '${id}' (${e.gatewayUrl})`) + c.dim(` · model ${e.model || "(gateway default)"}\n`));
+            const nRoles = await syncOrgRoles();
+            if (nRoles > 0)
+                out(c.dim(`  ↳ synced ${nRoles} org role${nRoles === 1 ? "" : "s"} → ~/.hara/org-roles/\n`));
         }
         catch (err) {
             out(c.red(`Enroll failed: ${err instanceof Error ? err.message : String(err)}\n`));
@@ -2089,19 +2151,7 @@ program
         return void out(c.red("Need --code <code> — ask your hara-control admin to issue an enrollment code.\n"));
     try {
         const e = await enrollDevice(gatewayUrl, opts.code);
-        const p = {
-            id: DEFAULT_ORG_ID,
-            kind: "gateway",
-            label: "Default Org",
-            gatewayUrl: e.gatewayUrl,
-            deviceId: e.deviceId,
-            deviceToken: e.deviceToken,
-            baseURL: e.baseURL,
-            defaultModel: e.model || "",
-            availableModels: e.model ? [e.model] : [],
-            enrolledAt: e.enrolledAt,
-            tokenExpiresAt: e.expiresAt,
-        };
+        const p = gatewayProfileFromEnrollment(DEFAULT_ORG_ID, "Default Org", e);
         upsertProfile(p);
         useProfile(DEFAULT_ORG_ID);
         out(c.green(`✓ enrolled with ${e.gatewayUrl}`) + c.dim(` · device ${e.deviceId || "?"} · model ${e.model || "(gateway default)"} · profile ${DEFAULT_ORG_ID}\n`) + c.dim("hara routes through the gateway now — the real provider key stays server-side.\n"));
@@ -2134,22 +2184,52 @@ program
         `  ${c.red("deny")} : ${r.deny.length ? r.deny.join(", ") : c.dim("(none)")}\n` +
         c.dim("  edit the JSON to customize, or `hara permissions --init` for a starter.\n"));
 });
-program
+const gatewayCommand = program
     .command("gateway")
     .description("run a supported chat gateway so you can drive your local hara from your phone — opt-in daemon")
-    .option("--platform <name>", "chat platform: telegram | weixin | discord | feishu | slack | mattermost | matrix | dingtalk | wecom | signal", "telegram")
+    .option("--platform <name>", "chat platform: telegram | weixin | discord | feishu | slack | mattermost | matrix | dingtalk | wecom | signal")
     .option("--login", "(weixin) scan a QR to log in and save credentials, then exit")
     .option("--recover-outcome <message-id>", "recover exactly one interrupted/terminal run marker by its original platform message id")
     .option("--confirm-recovery <action:message-id>", "required exact confirmation: terminalize:<id> or delete-terminal:<id>")
-    .option("--cwd <dir>", "directory hara operates in per message (default: ~/.hara/workspace)")
-    .action(async (opts) => {
+    .option("--cwd <dir>", "directory hara operates in per message (default: ~/.hara/workspace)");
+gatewayCommand
+    .command("status")
+    .description("show redacted configuration, live process, connection, poll, and error state")
+    .option("--json", "print stable machine-readable JSON")
+    .action(async (opts, command) => {
     const mod = await import("./gateway/serve.js");
+    const platform = command.parent?.opts().platform;
+    const statuses = platform
+        ? [await mod.gatewayStatus(platform)]
+        : await mod.listGatewayStatuses();
+    if (opts.json) {
+        out(`${JSON.stringify(platform ? statuses[0] : { gateways: statuses }, null, 2)}\n`);
+        return;
+    }
+    const timestamp = (value) => value ? new Date(value).toISOString() : "never";
+    for (const [index, status] of statuses.entries()) {
+        if (index)
+            out("\n");
+        out(`${c.bold(`${status.label} (${status.platform})`)}\n` +
+            `  configuration: ${status.configuration}\n` +
+            `  process: ${status.running ? `running${status.pid ? ` (pid ${status.pid})` : ""}` : "stopped"}` +
+            `${status.runningInstances > 1 ? ` · ${status.runningInstances} credential-scoped instances` : ""}\n` +
+            `  transport: ${status.runtimeState}\n` +
+            `  started: ${timestamp(status.startedAt)}\n` +
+            `  last connected/poll/message: ${timestamp(status.lastConnectedAt)} / ${timestamp(status.lastPollAt)} / ${timestamp(status.lastMessageAt)}\n` +
+            `  last error: ${status.lastErrorCode ?? "none"}${status.lastErrorAt ? ` at ${timestamp(status.lastErrorAt)}` : ""}\n` +
+            `  action: ${status.recommendation}\n`);
+    }
+});
+gatewayCommand.action(async (opts) => {
+    const mod = await import("./gateway/serve.js");
+    const platform = opts.platform || "telegram";
     if (opts.recoverOutcome !== undefined || opts.confirmRecovery !== undefined) {
         if (typeof opts.recoverOutcome !== "string" || typeof opts.confirmRecovery !== "string") {
             throw new Error("gateway outcome recovery requires both --recover-outcome <message-id> and --confirm-recovery <action:message-id>");
         }
         const result = await mod.recoverGatewayRunOutcome({
-            platform: opts.platform,
+            platform,
             messageId: opts.recoverOutcome,
             confirmation: opts.confirmRecovery,
         });
@@ -2166,12 +2246,12 @@ program
         }
         return;
     }
-    if (opts.platform === "weixin" && opts.login) {
+    if (platform === "weixin" && opts.login) {
         await mod.weixinLogin();
         return;
     }
     const cwd = opts.cwd ? (await import("node:path")).resolve(opts.cwd) : undefined; // undefined → ~/.hara/workspace
-    await mod.runGateway({ cwd, platform: opts.platform });
+    await mod.runGateway({ cwd, platform });
 });
 program
     .command("serve")
@@ -2218,6 +2298,55 @@ program
             return listModels(target.baseURL, target.apiKey ?? "");
         },
         providerSettings: (targetCwd) => providerSettingsSnapshot(targetCwd ?? cwd),
+        gatewayStatuses: async () => {
+            const gateway = await import("./gateway/serve.js");
+            return gateway.listGatewayStatuses(["weixin", "feishu"]);
+        },
+        organizationConnections: (targetCwd) => organizationConnectionsSnapshot(targetCwd ?? cwd),
+        enrollOrganizationConnection: async (input, targetCwd) => {
+            const settingsCwd = targetCwd ?? cwd;
+            const resolution = resolveActive(settingsCwd);
+            if (input.activate !== false && (resolution.source === "flag" || resolution.source === "env" || resolution.source === "pin")) {
+                throw new Error("the active profile is locked by a flag, environment variable, or project pin; remove that override before activating an organization connection");
+            }
+            await enrollGatewayProfile(input, AbortSignal.timeout(30_000));
+            return organizationConnectionsSnapshot(settingsCwd);
+        },
+        useOrganizationConnection: (inputId, targetCwd) => {
+            const settingsCwd = targetCwd ?? cwd;
+            const id = assertOrganizationId(inputId);
+            const target = getProfile(id);
+            if (!target || target.kind !== "gateway")
+                throw new Error("organization connection was not found");
+            const resolution = resolveActive(settingsCwd);
+            if (resolution.source === "flag" || resolution.source === "env" || resolution.source === "pin") {
+                throw new Error("the active profile is locked by a flag, environment variable, or project pin; remove that override before switching");
+            }
+            const switched = useProfile(id);
+            if (!switched.ok)
+                throw new Error("organization connection could not be activated");
+            return organizationConnectionsSnapshot(settingsCwd);
+        },
+        removeOrganizationConnection: (inputId, targetCwd) => {
+            const settingsCwd = targetCwd ?? cwd;
+            const id = assertOrganizationId(inputId);
+            const target = getProfile(id);
+            if (!target || target.kind !== "gateway")
+                throw new Error("organization connection was not found");
+            const removed = removeProfile(id);
+            if (!removed.ok)
+                throw new Error("organization connection could not be removed");
+            return organizationConnectionsSnapshot(settingsCwd);
+        },
+        checkOrganizationConnection: async (inputId) => {
+            const id = assertOrganizationId(inputId);
+            const profile = getProfile(id);
+            if (!profile || profile.kind !== "gateway")
+                throw new Error("organization connection was not found");
+            const enrollment = enrollmentFromProfile(profile);
+            const ok = !!enrollment && !deviceTokenExpired(enrollment.expiresAt) && await heartbeatEnrollment(enrollment, AbortSignal.timeout(15_000));
+            return { id, ok, checkedAt: Date.now() };
+        },
         testProviderSettings: (input) => testProviderSettingsCandidate(input),
         saveProviderSettings: async (input, targetCwd) => {
             const settingsCwd = targetCwd ?? cwd;
@@ -3032,6 +3161,18 @@ config
         out(c.red(`Invalid reasoning effort. One of: ${REASONING_EFFORTS.join(", ")}.\n`));
         process.exit(1);
     }
+    if (key === "proxy") {
+        try {
+            const parsed = new URL(value);
+            if (!["http:", "https:"].includes(parsed.protocol) || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+                throw new Error("invalid proxy URL");
+            }
+        }
+        catch {
+            out(c.red("Invalid proxy. Use an HTTP(S) proxy URL such as http://127.0.0.1:7890; paths, queries, and fragments are not allowed.\n"));
+            process.exit(1);
+        }
+    }
     if (key === "runTimeoutMs") {
         const parsed = parseAgentRunTimeoutMs(value);
         if (parsed === undefined || parsed < MIN_AGENT_RUN_TIMEOUT_MS || parsed > MAX_AGENT_RUN_TIMEOUT_MS) {
@@ -3051,11 +3192,11 @@ config
 });
 config
     .command("get [key]")
-    .description("show config (apiKey masked)")
+    .description("show config (credentials masked)")
     .action((key) => {
     const raw = readRawConfig();
     if (key) {
-        out((key === "apiKey" ? maskKey(raw.apiKey) : raw[key] ?? "(unset)") + "\n");
+        out(displayConfigValue(key, raw[key]) + "\n");
     }
     else {
         out(`path:     ${configPath()}\n` +
@@ -3066,6 +3207,7 @@ config
             `sandbox:  ${raw.sandbox ?? "(default off)"}\n` +
             `timeout:  ${raw.runTimeoutMs ?? "(default 30m)"}\n` +
             `rounds:   ${raw.maxAgentRounds ?? "(default 64)"}\n` +
+            `proxy:    ${maskProxy(raw.proxy)}\n` +
             `apiKey:   ${maskKey(raw.apiKey)}\n`);
     }
 });

package/dist/org-fleet/enroll.js

@@ -13,9 +13,67 @@ import { homedir, hostname, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { writeFileSync, mkdirSync, rmSync } from "node:fs";
 import { orgRolesDir } from "../org/roles.js";
-import { loadActiveProfile } from "../profile/profile.js";
+import { loadActiveProfile, upsertProfile, useProfile, getProfile, } from "../profile/profile.js";
 import { bindPrivateHaraStateFile, readPrivateStateFileSnapshotSync, removePrivateStateFile, writePrivateStateFileSync, } from "../security/private-state.js";
+const MAX_ENROLL_RESPONSE_BYTES = 1024 * 1024;
+const PROFILE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+const loopbackHostname = (hostname) => hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
 const deviceInfo = () => ({ name: hostname(), os: platform(), hara_version: process.env.HARA_BUILD_VERSION ?? "dev" });
+/** Enrollment codes are sent to a security-sensitive endpoint. Only HTTPS is accepted outside a
+ * loopback development server, and userinfo/path/query/fragment are rejected so a code cannot be
+ * redirected or accidentally embedded in a URL. */
+export function normalizeGatewayUrl(value) {
+    let url;
+    try {
+        url = new URL(value.trim());
+    }
+    catch {
+        throw new Error("organization URL must be a valid absolute URL");
+    }
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopbackHostname(url.hostname))) {
+        throw new Error("organization URL must use HTTPS (HTTP is allowed only for localhost)");
+    }
+    if (url.username || url.password)
+        throw new Error("organization URL must not contain credentials");
+    if ((url.pathname && url.pathname !== "/") || url.search || url.hash) {
+        throw new Error("organization URL must contain only scheme, host, and optional port");
+    }
+    return url.origin;
+}
+function normalizeGatewayBaseUrl(value) {
+    if (value === undefined || value === null || value === "")
+        return undefined;
+    if (typeof value !== "string")
+        throw new Error("enroll response contains an invalid base_url");
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("enroll response contains an invalid base_url");
+    }
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopbackHostname(url.hostname))) {
+        throw new Error("enroll response contains an insecure base_url");
+    }
+    if (url.username || url.password || url.search || url.hash)
+        throw new Error("enroll response contains an invalid base_url");
+    return `${url.origin}${url.pathname.replace(/\/$/, "")}`;
+}
+function validateGatewayProfileInput(input) {
+    const id = input.id.trim();
+    const label = input.label?.trim();
+    const code = input.code.trim();
+    if (!PROFILE_ID.test(id))
+        throw new Error("connection id must use 1-64 letters, numbers, dots, underscores, or dashes");
+    if (id === "personal")
+        throw new Error("the personal profile id is reserved");
+    if (label && (label.length > 80 || CONTROL_CHARACTERS.test(label)))
+        throw new Error("organization name must be 80 characters or fewer");
+    if (!code || code.length > 256 || CONTROL_CHARACTERS.test(code))
+        throw new Error("registration code must be 1-256 printable characters");
+    return { ...input, id, ...(label ? { label } : {}), gatewayUrl: normalizeGatewayUrl(input.gatewayUrl), code };
+}
 /** The effective OpenAI-compatible base URL for an enrollment (explicit, else <gatewayUrl>/v1). */
 export function gatewayBaseURL(e) {
     return e.baseURL || `${e.gatewayUrl.replace(/\/$/, "")}/v1`;
@@ -68,9 +126,18 @@ export function clearEnrollment() {
 }
 /** Parse a control-plane enroll response (tolerant of snake_case / camelCase) into an Enrollment. */
 export function parseEnrollResponse(gatewayUrl, j, now) {
-    const deviceToken = (j.device_token ?? j.deviceToken);
-    if (!deviceToken)
-        throw new Error("enroll response missing device_token");
+    const deviceToken = j.device_token ?? j.deviceToken;
+    if (typeof deviceToken !== "string" || !deviceToken || deviceToken.length > 16 * 1024 || CONTROL_CHARACTERS.test(deviceToken)) {
+        throw new Error("enroll response missing or contains an invalid device_token");
+    }
+    const rawDeviceId = j.device_id ?? j.deviceId ?? "";
+    const rawModel = j.model ?? "";
+    if (typeof rawDeviceId !== "string" || rawDeviceId.length > 256 || CONTROL_CHARACTERS.test(rawDeviceId)) {
+        throw new Error("enroll response contains an invalid device_id");
+    }
+    if (typeof rawModel !== "string" || rawModel.length > 512 || CONTROL_CHARACTERS.test(rawModel)) {
+        throw new Error("enroll response contains an invalid model");
+    }
     const rawExpiresAt = j.expires_at ?? j.expiresAt;
     let expiresAt;
     if (rawExpiresAt !== undefined && rawExpiresAt !== null) {
@@ -80,11 +147,11 @@ export function parseEnrollResponse(gatewayUrl, j, now) {
         expiresAt = new Date(rawExpiresAt).toISOString();
     }
     return {
-        gatewayUrl: gatewayUrl.replace(/\/$/, ""),
+        gatewayUrl: normalizeGatewayUrl(gatewayUrl),
         deviceToken,
-        deviceId: String(j.device_id ?? j.deviceId ?? ""),
-        model: String(j.model ?? ""),
-        baseURL: (j.base_url ?? j.baseURL),
+        deviceId: rawDeviceId,
+        model: rawModel,
+        baseURL: normalizeGatewayBaseUrl(j.base_url ?? j.baseURL),
         enrolledAt: now,
         expiresAt,
     };
@@ -116,29 +183,104 @@ export function deviceTokenExpiryWarning(expiresAt, now = new Date()) {
         : `${Math.ceil(remainingMinutes / 60)}h`;
     return `organization access expires in ${remaining}; ask your admin for a new enrollment code`;
 }
-/** Exchange a one-time code for a device token at the gateway, persist it, and return the Enrollment. */
+/** Exchange a one-time code without persisting it. Redirects are rejected so the credential is sent
+ * only to the exact origin the user entered. Server bodies are never reflected into errors. */
+export async function exchangeEnrollment(gatewayUrl, code, signal) {
+    const base = normalizeGatewayUrl(gatewayUrl);
+    if (!code.trim() || code.length > 256 || CONTROL_CHARACTERS.test(code)) {
+        throw new Error("registration code must be 1-256 printable characters");
+    }
+    let res;
+    try {
+        res = await fetch(`${base}/v1/enroll`, {
+            method: "POST",
+            redirect: "error",
+            signal,
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ code: code.trim(), device: deviceInfo() }),
+        });
+    }
+    catch {
+        throw new Error("organization enrollment request failed");
+    }
+    if (!res.ok) {
+        throw new Error(`HTTP ${res.status}${res.status === 401 || res.status === 403 ? " — bad or expired code" : ""}`);
+    }
+    const declaredLength = Number(res.headers.get("content-length"));
+    if (Number.isFinite(declaredLength) && declaredLength > MAX_ENROLL_RESPONSE_BYTES) {
+        throw new Error("enroll response is too large");
+    }
+    const raw = await res.text();
+    if (Buffer.byteLength(raw, "utf8") > MAX_ENROLL_RESPONSE_BYTES)
+        throw new Error("enroll response is too large");
+    let payload;
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error("invalid");
+        payload = parsed;
+    }
+    catch {
+        throw new Error("enroll response is not valid JSON");
+    }
+    return parseEnrollResponse(base, payload, new Date().toISOString());
+}
+/** Legacy enrollment path: exchange, then persist ~/.hara/org.json for older callers. */
 export async function enrollDevice(gatewayUrl, code, signal) {
-    const base = gatewayUrl.replace(/\/$/, "");
-    const res = await fetch(`${base}/v1/enroll`, {
-        method: "POST",
-        signal,
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ code, device: deviceInfo() }),
-    });
-    if (!res.ok)
-        throw new Error(`HTTP ${res.status}${res.status === 401 || res.status === 403 ? " — bad or expired code" : ""}: ${(await res.text()).slice(0, 200)}`);
-    const e = parseEnrollResponse(base, (await res.json()), new Date().toISOString());
+    const e = await exchangeEnrollment(gatewayUrl, code, signal);
     saveEnrollment(e);
     return e;
 }
-/** Best-effort heartbeat so the control plane shows this device online. Never throws. */
-export async function heartbeat(signal) {
-    const e = loadEnrollment();
-    if (!e)
-        return false;
+export function gatewayProfileFromEnrollment(id, label, e) {
+    return {
+        id,
+        kind: "gateway",
+        label: label || id,
+        gatewayUrl: e.gatewayUrl,
+        deviceId: e.deviceId,
+        deviceToken: e.deviceToken,
+        baseURL: e.baseURL,
+        defaultModel: e.model || "",
+        availableModels: e.model ? [e.model] : [],
+        enrolledAt: e.enrolledAt,
+        tokenExpiresAt: e.expiresAt,
+    };
+}
+/** Desktop/profile-native enrollment: no legacy file is written, and the one-time code is never
+ * stored. An existing id is intentionally replaced so re-enrollment rotates the scoped token. */
+export async function enrollGatewayProfile(input, signal) {
+    const validated = validateGatewayProfileInput(input);
+    const existing = getProfile(validated.id);
+    if (existing && existing.kind !== "gateway")
+        throw new Error("connection id already belongs to a personal provider profile");
+    const enrollment = await exchangeEnrollment(validated.gatewayUrl, validated.code, signal);
+    const profile = gatewayProfileFromEnrollment(validated.id, validated.label, enrollment);
+    upsertProfile(profile);
+    if (validated.activate !== false) {
+        const switched = useProfile(validated.id);
+        if (!switched.ok)
+            throw new Error("organization connection was saved but could not be activated");
+    }
+    return { enrollment, heartbeatOk: await heartbeatEnrollment(enrollment, signal) };
+}
+export function enrollmentFromProfile(profile) {
+    if (profile.kind !== "gateway" || !profile.gatewayUrl || !profile.deviceToken)
+        return null;
+    return {
+        gatewayUrl: profile.gatewayUrl,
+        deviceToken: profile.deviceToken,
+        deviceId: profile.deviceId || "",
+        model: profile.defaultModel || "",
+        baseURL: profile.baseURL,
+        enrolledAt: profile.enrolledAt || new Date(0).toISOString(),
+        expiresAt: profile.tokenExpiresAt,
+    };
+}
+export async function heartbeatEnrollment(e, signal) {
     try {
         const res = await fetch(`${e.gatewayUrl}/v1/heartbeat`, {
             method: "POST",
+            redirect: "error",
             signal,
             headers: { "content-type": "application/json", authorization: `Bearer ${e.deviceToken}` },
             body: JSON.stringify({ device_id: e.deviceId, ...deviceInfo() }),
@@ -149,6 +291,13 @@ export async function heartbeat(signal) {
         return false;
     }
 }
+/** Best-effort heartbeat so the control plane shows this device online. Never throws. */
+export async function heartbeat(signal) {
+    const e = loadEnrollment();
+    if (!e)
+        return false;
+    return heartbeatEnrollment(e, signal);
+}
 const SAFE_ORG_ROLE_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
 const WINDOWS_RESERVED_NAME = /^(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])$/i;
 function isSafeBundleRole(value) {

package/dist/security/secrets.js

@@ -124,12 +124,12 @@ function sensitiveFieldName(key) {
 /** Deep-copy a JSON-shaped value while redacting every string. Session history contains secrets not only
  *  in user text but also in assistant tool inputs and tool results, so a top-level content-only pass is
  *  insufficient. The live value is never mutated. */
-export function redactSensitiveValue(value) {
+export function redactSensitiveValue(value, knownSecrets = []) {
     const hits = [];
     const seen = new WeakMap();
     const walk = (v) => {
         if (typeof v === "string") {
-            const r = redactSensitiveText(v);
+            const r = redactKnownSecrets(v, knownSecrets);
             hits.push(...r.redactions);
             return r.text;
         }

package/dist/serve/protocol.js

@@ -24,6 +24,13 @@
 //   settings.providers.list {}                    → redacted provider catalog + current profile state
 //   settings.providers.test {provider,model,…}     → {ok,models,error?} (credential is ephemeral)
 //   settings.providers.save {provider,model,…}     → redacted state (credential is never returned)
+//   settings.gateways.list {}                      → {gateways:[redacted configuration/runtime health]}
+//   settings.organizations.list {cwd?}              → {activeId,activeSource,switchLocked,connections:[redacted]}
+//   settings.organizations.enroll {id,label?,gatewayUrl,code,activate?,cwd?}
+//                                                    → organization state (code/token never returned)
+//   settings.organizations.use {id,cwd?}             → organization state
+//   settings.organizations.remove {id,cwd?}          → organization state (local removal; no remote revoke)
+//   settings.organizations.check {id,cwd?}           → {id,ok,checkedAt}
 //   automation.add    {name,schedule,task,mode?,cwd?,tz?,deliver?,deliverMode?,alertAfter?}
 //                                                               → {id,name,schedule}
 //   automation.toggle {id,enabled}                → {id,enabled}