@opengsd/gsd-pi 1.5.0 → 1.6.0-dev.aa7f94e8

package/dist/worktree-cli.js

@@ -22,9 +22,13 @@ import { bannerLines, name as styledName, warn } from './cli-style.js';
 import { createJiti } from '@mariozechner/jiti';
 import { fileURLToPath } from 'node:url';
 import { generateWorktreeName } from './worktree-name-gen.js';
-import { existsSync } from 'node:fs';
 import { resolveBundledGsdExtensionModule } from './bundled-resource-path.js';
 import { getJitiWorkspaceAliases } from './jiti-workspace-aliases.js';
+import { formatMultipleWorktreesPrompt, formatStatus } from './worktree-cli-format.js';
+import { planWorktreeFlag } from './worktree-cli-plan.js';
+import { createAndEnterWorktree } from './worktree-cli-create.js';
+import { enterWorktreeSession } from './worktree-cli-session.js';
+import { getWorktreeStatus as calculateWorktreeStatus, findWorktreesWithChanges, } from './worktree-cli-status.js';
 const jiti = createJiti(fileURLToPath(import.meta.url), {
     interopDefault: true,
     debug: false,
@@ -83,58 +87,18 @@ async function loadMergeModules() {
 }
 // ─── Status Helpers ─────────────────────────────────────────────────────────
 function getWorktreeStatus(ext, basePath, name, wtPath, branch) {
-    const diff = ext.diffWorktreeAll(basePath, name, branch);
-    const numstat = ext.diffWorktreeNumstat(basePath, name, branch);
-    const filesChanged = diff.added.length + diff.modified.length + diff.removed.length;
-    let linesAdded = 0;
-    let linesRemoved = 0;
-    for (const s of numstat) {
-        linesAdded += s.added;
-        linesRemoved += s.removed;
-    }
-    let uncommitted = false;
-    try {
-        uncommitted = existsSync(wtPath) && ext.nativeHasChanges(wtPath);
-    }
-    catch (error) {
-        logDebugFailure('native worktree dirty check', error);
-    }
-    let commits = 0;
-    try {
-        const mainBranch = ext.nativeDetectMainBranch(basePath);
-        commits = ext.nativeCommitCountBetween(basePath, mainBranch, branch);
-    }
-    catch (error) {
-        logDebugFailure('native commit count', error);
-    }
+    return calculateWorktreeStatus(worktreeStatusDependencies(ext), basePath, name, wtPath, branch);
+}
+function worktreeStatusDependencies(ext) {
     return {
-        name,
-        path: wtPath,
-        branch,
-        exists: existsSync(wtPath),
-        filesChanged,
-        linesAdded,
-        linesRemoved,
-        uncommitted,
-        commits,
+        diffWorktreeAll: ext.diffWorktreeAll,
+        diffWorktreeNumstat: ext.diffWorktreeNumstat,
+        nativeHasChanges: ext.nativeHasChanges,
+        nativeDetectMainBranch: ext.nativeDetectMainBranch,
+        nativeCommitCountBetween: ext.nativeCommitCountBetween,
+        onDebugFailure: logDebugFailure,
     };
 }
-// ─── Formatters ─────────────────────────────────────────────────────────────
-function formatStatus(s) {
-    const lines = [];
-    const badge = s.uncommitted
-        ? chalk.yellow(' (uncommitted)')
-        : s.filesChanged > 0
-            ? chalk.cyan(' (unmerged)')
-            : chalk.green(' (clean)');
-    lines.push(`  ${chalk.bold.cyan(s.name)}${badge}`);
-    lines.push(`    ${chalk.dim('branch')}  ${chalk.magenta(s.branch)}`);
-    lines.push(`    ${chalk.dim('path')}    ${chalk.dim(s.path)}`);
-    if (s.filesChanged > 0) {
-        lines.push(`    ${chalk.dim('diff')}    ${s.filesChanged} files, ${chalk.green(`+${s.linesAdded}`)} ${chalk.red(`-${s.linesRemoved}`)}, ${s.commits} commit${s.commits === 1 ? '' : 's'}`);
-    }
-    return lines.join('\n');
-}
 // ─── Subcommand: list ───────────────────────────────────────────────────────
 async function handleList(basePath) {
     const ext = await loadExtensionModules();
@@ -272,16 +236,7 @@ async function handleStatusBanner(basePath) {
     const worktrees = ext.listWorktrees(basePath);
     if (worktrees.length === 0)
         return;
-    const withChanges = worktrees.filter(wt => {
-        try {
-            const diff = ext.diffWorktreeAll(basePath, wt.name, wt.branch);
-            return diff.added.length + diff.modified.length + diff.removed.length > 0;
-        }
-        catch (error) {
-            logDebugFailure(`status scan for ${wt.name}`, error);
-            return false;
-        }
-    });
+    const withChanges = findWorktreesWithChanges(worktreeStatusDependencies(ext), basePath, worktrees, 'status scan');
     if (withChanges.length === 0)
         return;
     const names = withChanges.map(w => styledName(w.name)).join(', ');
@@ -291,74 +246,25 @@ async function handleStatusBanner(basePath) {
 async function handleWorktreeFlag(worktreeFlag) {
     const ext = await loadExtensionModules();
     const basePath = ext.resolveWorktreeProjectRoot(process.cwd());
-    // gsd -w (no name) — resume most recent worktree with changes, or create new
-    if (worktreeFlag === true) {
-        const existing = ext.listWorktrees(basePath);
-        const withChanges = existing.filter(wt => {
-            try {
-                const diff = ext.diffWorktreeAll(basePath, wt.name, wt.branch);
-                return diff.added.length + diff.modified.length + diff.removed.length > 0;
-            }
-            catch (error) {
-                logDebugFailure(`worktree -w scan for ${wt.name}`, error);
-                return false;
-            }
-        });
-        if (withChanges.length === 1) {
-            // Single active worktree — resume it
-            const wt = withChanges[0];
-            process.chdir(wt.path);
-            process.env.GSD_CLI_WORKTREE = wt.name;
-            process.env.GSD_CLI_WORKTREE_BASE = basePath;
-            process.stderr.write(chalk.green(`✓ Resumed worktree ${chalk.bold(wt.name)}\n`));
-            process.stderr.write(chalk.dim(`  path   ${wt.path}\n`));
-            process.stderr.write(chalk.dim(`  branch ${wt.branch}\n\n`));
-            return;
-        }
-        if (withChanges.length > 1) {
-            // Multiple active worktrees — show them and ask user to pick
-            process.stderr.write(chalk.yellow(`${withChanges.length} worktrees have unmerged changes:\n\n`));
-            for (const wt of withChanges) {
-                const status = getWorktreeStatus(ext, basePath, wt.name, wt.path, wt.branch);
-                process.stderr.write(formatStatus(status) + '\n\n');
-            }
-            process.stderr.write(chalk.dim('Specify which one: gsd -w <name>\n'));
-            process.exit(0);
-        }
-        // No active worktrees — create a new one
-        const name = generateWorktreeName();
-        await createAndEnter(ext, basePath, name);
-        return;
-    }
-    // gsd -w <name> — create or resume named worktree
-    const name = worktreeFlag;
     const existing = ext.listWorktrees(basePath);
-    const found = existing.find(wt => wt.name === name);
-    if (found) {
-        process.chdir(found.path);
-        process.env.GSD_CLI_WORKTREE = name;
-        process.env.GSD_CLI_WORKTREE_BASE = basePath;
-        process.stderr.write(chalk.green(`✓ Resumed worktree ${chalk.bold(name)}\n`));
-        process.stderr.write(chalk.dim(`  path   ${found.path}\n`));
-        process.stderr.write(chalk.dim(`  branch ${found.branch}\n\n`));
+    const withChanges = worktreeFlag === true
+        ? findWorktreesWithChanges(worktreeStatusDependencies(ext), basePath, existing, 'worktree -w scan')
+        : [];
+    const plan = planWorktreeFlag(worktreeFlag, existing, withChanges, generateWorktreeName);
+    if (plan.action === 'resume') {
+        enterWorktreeSession(plan.worktree, basePath, 'Resumed');
+        return;
     }
-    else {
-        await createAndEnter(ext, basePath, name);
+    if (plan.action === 'show-multiple') {
+        const statuses = plan.worktrees.map((wt) => getWorktreeStatus(ext, basePath, wt.name, wt.path, wt.branch));
+        process.stderr.write(formatMultipleWorktreesPrompt(statuses));
+        process.exit(0);
     }
+    await createAndEnter(ext, basePath, plan.name);
 }
 async function createAndEnter(ext, basePath, name) {
     try {
-        const info = ext.createWorktree(basePath, name);
-        const hookError = ext.runWorktreePostCreateHook(basePath, info.path);
-        if (hookError) {
-            process.stderr.write(chalk.yellow(`[gsd] ${hookError}\n`));
-        }
-        process.chdir(info.path);
-        process.env.GSD_CLI_WORKTREE = name;
-        process.env.GSD_CLI_WORKTREE_BASE = basePath;
-        process.stderr.write(chalk.green(`✓ Created worktree ${chalk.bold(name)}\n`));
-        process.stderr.write(chalk.dim(`  path   ${info.path}\n`));
-        process.stderr.write(chalk.dim(`  branch ${info.branch}\n\n`));
+        createAndEnterWorktree(ext, basePath, name);
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);

package/integrations/hermes/open_gsd_hermes/gsd_client.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import json
 import os
+import shutil
 import subprocess
 import threading
 import time
@@ -62,7 +63,12 @@ class GsdMcpClient:
 
     def _env(self) -> dict[str, str]:
         env = os.environ.copy()
-        env["GSD_CLI_PATH"] = self._config.cli_path
+        # Resolve cli_path to an absolute path so the MCP server's
+        # resolveCLIPath() does not resolve a bare command name (e.g. "gsd")
+        # against the project directory, producing a non-existent
+        # project-relative path that hangs gsd_execute until timeout.
+        resolved = shutil.which(self._config.cli_path) or self._config.cli_path
+        env["GSD_CLI_PATH"] = resolved
         return env
 
     def ensure_version(self) -> None:
@@ -134,9 +140,11 @@ class GsdMcpClient:
     def _send(self, payload: dict[str, Any], *, project_dir: str | None = None) -> None:
         proc = self._ensure_process(project_dir)
         assert proc.stdin is not None
-        body = json.dumps(payload).encode("utf-8")
-        header = f"Content-Length: {len(body)}\r\n\r\n".encode("ascii")
-        proc.stdin.write(header + body)
+        # gsd-mcp-server uses the @modelcontextprotocol/sdk stdio transport,
+        # which is newline-delimited JSON (NDJSON), not the Content-Length
+        # framing from the LSP-style MCP spec. Emit one JSON object per line.
+        data = json.dumps(payload, ensure_ascii=False).encode("utf-8") + b"\n"
+        proc.stdin.write(data)
         proc.stdin.flush()
 
     def _read_stdout_chunk(self, deadline: float) -> None:
@@ -179,42 +187,23 @@ class GsdMcpClient:
             f"{self._config.mcp_read_timeout_seconds:g}s"
         )
 
-    def _read_header(self, deadline: float) -> bytes:
+    def _read_line(self, deadline: float) -> bytes:
         while True:
-            crlf_idx = self._stdout_buffer.find(b"\r\n\r\n")
-            lf_idx = self._stdout_buffer.find(b"\n\n")
-            candidates = [
-                (idx, sep_len)
-                for idx, sep_len in ((crlf_idx, 4), (lf_idx, 2))
-                if idx >= 0
-            ]
-            if candidates:
-                idx, sep_len = min(candidates)
-                header = self._stdout_buffer[:idx]
-                self._stdout_buffer = self._stdout_buffer[idx + sep_len :]
-                return header
+            idx = self._stdout_buffer.find(b"\n")
+            if idx >= 0:
+                raw = self._stdout_buffer[:idx]
+                self._stdout_buffer = self._stdout_buffer[idx + 1 :]
+                return raw.rstrip(b"\r")
             self._read_stdout_chunk(deadline)
 
-    def _read_exact(self, length: int, deadline: float) -> bytes:
-        while len(self._stdout_buffer) < length:
-            self._read_stdout_chunk(deadline)
-        body = self._stdout_buffer[:length]
-        self._stdout_buffer = self._stdout_buffer[length:]
-        return body
-
     def _read_message(self) -> dict[str, Any]:
         deadline = time.monotonic() + self._config.mcp_read_timeout_seconds
-        header = self._read_header(deadline)
-        headers: dict[str, str] = {}
-        for raw_line in header.splitlines():
-            decoded = raw_line.decode("utf-8").strip()
-            if not decoded:
-                continue
-            key, _, val = decoded.partition(":")
-            headers[key.strip().lower()] = val.strip()
-        length = int(headers.get("content-length", "0"))
-        body = self._read_exact(length, deadline)
-        return json.loads(body.decode("utf-8"))
+        # gsd-mcp-server emits newline-delimited JSON (NDJSON); each line is a
+        # complete JSON-RPC message. Skip blank keep-alive lines.
+        while True:
+            line = self._read_line(deadline)
+            if line.strip():
+                return json.loads(line.decode("utf-8"))
 
     def _initialize(self) -> None:
         self._request_id += 1
@@ -226,7 +215,7 @@ class GsdMcpClient:
                 "params": {
                     "protocolVersion": "2024-11-05",
                     "capabilities": {},
-                    "clientInfo": {"name": "open-gsd-hermes", "version": "1.2.0"},
+                    "clientInfo": {"name": "open-gsd-hermes", "version": "1.6.0"},
                 },
             }
         )

package/integrations/hermes/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "open-gsd-hermes"
-version = "1.2.0"
+version = "1.6.0"
 description = "Hermes Agent plugin — GSD structured delivery engine integration"
 readme = "README.md"
 license = { text = "MIT" }

package/integrations/hermes/tests/test_gsd_client_timeout.py

@@ -31,7 +31,7 @@ def test_read_message_times_out_waiting_for_headers() -> None:
         proc.kill()
 
 
-def test_read_message_times_out_waiting_for_body() -> None:
+def test_read_message_times_out_waiting_for_newline() -> None:
     client = GsdMcpClient(GsdConfig(mcp_read_timeout_seconds=0.05))
     proc = subprocess.Popen(
         [
@@ -39,7 +39,7 @@ def test_read_message_times_out_waiting_for_body() -> None:
             "-c",
             (
                 "import sys, time; "
-                "sys.stdout.buffer.write(b'Content-Length: 2\\r\\n\\r\\n{'); "
+                "sys.stdout.buffer.write(b'{\"jsonrpc\":\"2.0\"'); "
                 "sys.stdout.flush(); "
                 "time.sleep(10)"
             ),
@@ -59,7 +59,7 @@ def test_read_message_times_out_waiting_for_body() -> None:
         proc.kill()
 
 
-def test_read_message_fails_without_respawning_when_stdout_closes_mid_body(
+def test_read_message_fails_without_respawning_when_stdout_closes_mid_line(
     tmp_path,
 ) -> None:
     client = GsdMcpClient(GsdConfig(mcp_read_timeout_seconds=1))
@@ -69,7 +69,7 @@ def test_read_message_fails_without_respawning_when_stdout_closes_mid_body(
             "-c",
             (
                 "import sys; "
-                "sys.stdout.buffer.write(b'Content-Length: 20\\r\\n\\r\\n{'); "
+                "sys.stdout.buffer.write(b'{\"jsonrpc\":\"2.0\"'); "
                 "sys.stdout.flush()"
             ),
         ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/gsd-pi",
-  "version": "1.5.0",
+  "version": "1.6.0-dev.aa7f94e8",
   "description": "GSD Pi local-first coding agent",
   "license": "MIT",
   "repository": {
@@ -210,11 +210,11 @@
   },
   "optionalDependencies": {
     "@mariozechner/clipboard": "0.3.6",
-    "@opengsd/engine-darwin-arm64": "1.5.0",
-    "@opengsd/engine-darwin-x64": "1.5.0",
-    "@opengsd/engine-linux-arm64-gnu": "1.5.0",
-    "@opengsd/engine-linux-x64-gnu": "1.5.0",
-    "@opengsd/engine-win32-x64-msvc": "1.5.0",
+    "@opengsd/engine-darwin-arm64": "1.6.0",
+    "@opengsd/engine-darwin-x64": "1.6.0",
+    "@opengsd/engine-linux-arm64-gnu": "1.6.0",
+    "@opengsd/engine-linux-x64-gnu": "1.6.0",
+    "@opengsd/engine-win32-x64-msvc": "1.6.0",
     "fsevents": "~2.3.3",
     "koffi": "^2.9.0"
   },

package/packages/cloud-mcp-gateway/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/cloud-mcp-gateway",
-  "version": "1.5.0",
+  "version": "1.6.0-dev.aa7f94e8",
   "description": "Cloud MCP gateway for brokering remote MCP clients to local GSD runtimes",
   "license": "MIT",
   "repository": {
@@ -29,7 +29,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
-    "@opengsd/mcp-server": "^1.5.0",
+    "@opengsd/mcp-server": "^1.6.0-dev.aa7f94e8",
     "ws": "^8.20.0",
     "zod": "^4.0.0"
   },

package/packages/contracts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/contracts",
-  "version": "1.5.0",
+  "version": "1.6.0-dev.aa7f94e8",
   "description": "Shared public contracts for GSD workspace boundaries",
   "license": "MIT",
   "gsd": {

package/packages/daemon/dist/cloud-cli.d.ts

@@ -1,4 +1,4 @@
-export declare const CLOUD_COMMAND_USAGE = "Commands:\n  status [--config <path>]\n  pair --gateway <url> --code <code> [--runtime-name <name>] [--config <path>]\n  connect [--config <path>] [--verbose]\n  disconnect [--config <path>]\n";
+export declare const CLOUD_COMMAND_USAGE = "Commands:\n  login --gateway <url> [--runtime-name <name>] [--config <path>]\n  status [--config <path>]\n  pair --gateway <url> --code <code> [--runtime-name <name>] [--config <path>]\n  connect [--config <path>] [--verbose]\n  disconnect [--config <path>]\n";
 export declare function handleCloudRuntimeCommand(argv: string[], opts: {
     binaryName: string;
     nestedCommandName?: string;

package/packages/daemon/dist/cloud-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-cli.d.ts","sourceRoot":"","sources":["../src/cloud-cli.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,mBAAmB,qMAK/B,CAAC;AAEF,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EhB;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAe9F"}
+{"version":3,"file":"cloud-cli.d.ts","sourceRoot":"","sources":["../src/cloud-cli.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,mBAAmB,wQAM/B,CAAC;AAEF,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAuGhB;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAyB9F"}

package/packages/daemon/dist/cloud-cli.js

@@ -3,7 +3,9 @@ import { resolveConfigPath, loadConfig } from "./config.js";
 import { Logger } from "./logger.js";
 import { Daemon } from "./daemon.js";
 import { clearCloudConfig, exchangePairingCode, redactedCloudStatus, saveCloudConfig } from "./cloud-config.js";
+import { runDeviceFlow } from "./device-flow.js";
 export const CLOUD_COMMAND_USAGE = `Commands:
+  login --gateway <url> [--runtime-name <name>] [--config <path>]
   status [--config <path>]
   pair --gateway <url> --code <code> [--runtime-name <name>] [--config <path>]
   connect [--config <path>] [--verbose]
@@ -41,6 +43,34 @@ export async function handleCloudRuntimeCommand(argv, opts) {
         process.stdout.write(`${opts.binaryName}: cloud runtime disconnected locally.\n`);
         return;
     }
+    if (command === "login") {
+        if (!values.gateway) {
+            throw new Error("login requires --gateway");
+        }
+        const runtimeName = values["runtime-name"];
+        const { deviceToken, runtimeId, gatewayUrl } = await runDeviceFlow({
+            gatewayUrl: values.gateway,
+            configPath,
+            runtimeName,
+            binaryName: opts.binaryName,
+        });
+        const config = saveCloudConfig(configPath, {
+            gateway_url: gatewayUrl,
+            device_token: deviceToken,
+            runtime_id: runtimeId,
+            ...(runtimeName ? { runtime_name: runtimeName } : {}),
+            enabled: true,
+        });
+        process.stdout.write(`${opts.binaryName}: cloud runtime ${runtimeId} paired — connecting...\n`);
+        const logger = new Logger({
+            filePath: config.log.file,
+            level: config.log.level,
+            verbose: values.verbose,
+        });
+        const daemon = new Daemon(config, logger);
+        await daemon.start();
+        return;
+    }
     if (command === "pair") {
         if (!values.gateway || !values.code) {
             throw new Error("pair requires --gateway and --code");
@@ -79,15 +109,25 @@ export async function handleCloudRuntimeCommand(argv, opts) {
 }
 export function formatCloudRuntimeUsage(binaryName, nestedCommandName) {
     const prefix = nestedCommandName ? `${binaryName} ${nestedCommandName}` : binaryName;
-    return `Usage: ${prefix} status [--config <path>]
+    return `Usage: ${prefix} login --gateway <url> [--runtime-name <name>] [--config <path>]
+       ${prefix} status [--config <path>]
        ${prefix} pair --gateway <url> --code <code> [--runtime-name <name>] [--config <path>]
        ${prefix} connect [--config <path>] [--verbose]
        ${prefix} disconnect [--config <path>]
 
+Commands:
+  login      (Recommended) Browser-based pairing — opens approval URL in terminal,
+             polls for authorization, then auto-connects the daemon. Use this instead
+             of pair + connect for interactive environments.
+  status     Show current cloud runtime configuration and connection status.
+  pair       Exchange a pairing code for a device token (headless/CI environments).
+  connect    Start the daemon using a previously paired device token.
+  disconnect Remove cloud runtime configuration from the local config file.
+
 Options:
   --config <path>        Path to YAML config file (default: ~/.gsd/daemon.yaml)
   --gateway <url>        Cloud MCP Gateway URL
-  --code <code>          Pairing code from the Cloud MCP Gateway
+  --code <code>          Pairing code from the Cloud MCP Gateway (pair only)
   --runtime-name <name>  Friendly name for this Local GSD Runtime
   --verbose              Print log entries to stderr in addition to the log file
   --help                 Show this help message and exit

package/packages/daemon/dist/cloud-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-cli.js","sourceRoot":"","sources":["../src/cloud-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEhH,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;CAKlC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAAc,EAAE,IAG/D;IACC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC3B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACnB,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;YACxD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;SACtD;QACD,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,yCAAyC,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,UAAU,EAAE,MAAM,CAAC,OAAO;YAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW;SACZ,CAAC,CAAC;QACH,eAAe,CAAC,UAAU,EAAE;YAC1B,WAAW,EAAE,MAAM,CAAC,OAAO;YAC3B,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,0BAA0B,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC;QACxF,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;YACxB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI;YACzB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAAkB,EAAE,iBAA0B;IACpF,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,iBAAiB,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACrF,OAAO,UAAU,MAAM;SAChB,MAAM;SACN,MAAM;SACN,MAAM;;;;;;;;;CASd,CAAC;AACF,CAAC","sourcesContent":["import { parseArgs } from \"node:util\";\nimport { resolveConfigPath, loadConfig } from \"./config.js\";\nimport { Logger } from \"./logger.js\";\nimport { Daemon } from \"./daemon.js\";\nimport { clearCloudConfig, exchangePairingCode, redactedCloudStatus, saveCloudConfig } from \"./cloud-config.js\";\n\nexport const CLOUD_COMMAND_USAGE = `Commands:\n  status [--config <path>]\n  pair --gateway <url> --code <code> [--runtime-name <name>] [--config <path>]\n  connect [--config <path>] [--verbose]\n  disconnect [--config <path>]\n`;\n\nexport async function handleCloudRuntimeCommand(argv: string[], opts: {\n  binaryName: string;\n  nestedCommandName?: string;\n}): Promise<void> {\n  if (argv[0] === \"--help\" || argv[0] === \"-h\") {\n    process.stdout.write(formatCloudRuntimeUsage(opts.binaryName, opts.nestedCommandName));\n    process.exit(0);\n  }\n\n  const command = argv[0];\n  const { values } = parseArgs({\n    args: argv.slice(1),\n    options: {\n      config: { type: \"string\", short: \"c\" },\n      gateway: { type: \"string\" },\n      code: { type: \"string\" },\n      \"runtime-name\": { type: \"string\" },\n      verbose: { type: \"boolean\", short: \"v\", default: false },\n      help: { type: \"boolean\", short: \"h\", default: false },\n    },\n    strict: true,\n  });\n\n  if (values.help || !command) {\n    process.stdout.write(formatCloudRuntimeUsage(opts.binaryName, opts.nestedCommandName));\n    process.exit(0);\n  }\n\n  const configPath = resolveConfigPath(values.config);\n  if (command === \"status\") {\n    process.stdout.write(`${JSON.stringify(redactedCloudStatus(loadConfig(configPath)), null, 2)}\\n`);\n    return;\n  }\n\n  if (command === \"disconnect\") {\n    clearCloudConfig(configPath);\n    process.stdout.write(`${opts.binaryName}: cloud runtime disconnected locally.\\n`);\n    return;\n  }\n\n  if (command === \"pair\") {\n    if (!values.gateway || !values.code) {\n      throw new Error(\"pair requires --gateway and --code\");\n    }\n    const runtimeName = values[\"runtime-name\"];\n    const result = await exchangePairingCode({\n      gatewayUrl: values.gateway,\n      code: values.code,\n      runtimeName,\n    });\n    saveCloudConfig(configPath, {\n      gateway_url: values.gateway,\n      device_token: result.deviceToken,\n      runtime_id: result.runtimeId,\n      ...(runtimeName ? { runtime_name: runtimeName } : {}),\n      enabled: true,\n    });\n    process.stdout.write(`${opts.binaryName}: paired cloud runtime ${result.runtimeId}.\\n`);\n    return;\n  }\n\n  if (command === \"connect\") {\n    const config = loadConfig(configPath);\n    if (!config.cloud?.device_token || !config.cloud.runtime_id) {\n      throw new Error(\"cloud runtime is not paired; run `pair` first\");\n    }\n    const logger = new Logger({\n      filePath: config.log.file,\n      level: config.log.level,\n      verbose: values.verbose,\n    });\n    const daemon = new Daemon(config, logger);\n    await daemon.start();\n    return;\n  }\n\n  throw new Error(`Unknown cloud runtime command: ${command}`);\n}\n\nexport function formatCloudRuntimeUsage(binaryName: string, nestedCommandName?: string): string {\n  const prefix = nestedCommandName ? `${binaryName} ${nestedCommandName}` : binaryName;\n  return `Usage: ${prefix} status [--config <path>]\n       ${prefix} pair --gateway <url> --code <code> [--runtime-name <name>] [--config <path>]\n       ${prefix} connect [--config <path>] [--verbose]\n       ${prefix} disconnect [--config <path>]\n\nOptions:\n  --config <path>        Path to YAML config file (default: ~/.gsd/daemon.yaml)\n  --gateway <url>        Cloud MCP Gateway URL\n  --code <code>          Pairing code from the Cloud MCP Gateway\n  --runtime-name <name>  Friendly name for this Local GSD Runtime\n  --verbose              Print log entries to stderr in addition to the log file\n  --help                 Show this help message and exit\n`;\n}\n"]}
+{"version":3,"file":"cloud-cli.js","sourceRoot":"","sources":["../src/cloud-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAChH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;CAMlC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAAc,EAAE,IAG/D;IACC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC3B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACnB,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;YACxD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE;SACtD;QACD,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAClG,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,yCAAyC,CAAC,CAAC;QAClF,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,aAAa,CAAC;YACjE,UAAU,EAAE,MAAM,CAAC,OAAO;YAC1B,UAAU;YACV,WAAW;YACX,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE;YACzC,WAAW,EAAE,UAAU;YACvB,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,SAAS;YACrB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,mBAAmB,SAAS,2BAA2B,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;YACxB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI;YACzB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,UAAU,EAAE,MAAM,CAAC,OAAO;YAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW;SACZ,CAAC,CAAC;QACH,eAAe,CAAC,UAAU,EAAE;YAC1B,WAAW,EAAE,MAAM,CAAC,OAAO;YAC3B,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,0BAA0B,MAAM,CAAC,SAAS,KAAK,CAAC,CAAC;QACxF,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;YACxB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI;YACzB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAAkB,EAAE,iBAA0B;IACpF,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,iBAAiB,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;IACrF,OAAO,UAAU,MAAM;SAChB,MAAM;SACN,MAAM;SACN,MAAM;SACN,MAAM;;;;;;;;;;;;;;;;;;CAkBd,CAAC;AACF,CAAC","sourcesContent":["import { parseArgs } from \"node:util\";\nimport { resolveConfigPath, loadConfig } from \"./config.js\";\nimport { Logger } from \"./logger.js\";\nimport { Daemon } from \"./daemon.js\";\nimport { clearCloudConfig, exchangePairingCode, redactedCloudStatus, saveCloudConfig } from \"./cloud-config.js\";\nimport { runDeviceFlow } from \"./device-flow.js\";\n\nexport const CLOUD_COMMAND_USAGE = `Commands:\n  login --gateway <url> [--runtime-name <name>] [--config <path>]\n  status [--config <path>]\n  pair --gateway <url> --code <code> [--runtime-name <name>] [--config <path>]\n  connect [--config <path>] [--verbose]\n  disconnect [--config <path>]\n`;\n\nexport async function handleCloudRuntimeCommand(argv: string[], opts: {\n  binaryName: string;\n  nestedCommandName?: string;\n}): Promise<void> {\n  if (argv[0] === \"--help\" || argv[0] === \"-h\") {\n    process.stdout.write(formatCloudRuntimeUsage(opts.binaryName, opts.nestedCommandName));\n    process.exit(0);\n  }\n\n  const command = argv[0];\n  const { values } = parseArgs({\n    args: argv.slice(1),\n    options: {\n      config: { type: \"string\", short: \"c\" },\n      gateway: { type: \"string\" },\n      code: { type: \"string\" },\n      \"runtime-name\": { type: \"string\" },\n      verbose: { type: \"boolean\", short: \"v\", default: false },\n      help: { type: \"boolean\", short: \"h\", default: false },\n    },\n    strict: true,\n  });\n\n  if (values.help || !command) {\n    process.stdout.write(formatCloudRuntimeUsage(opts.binaryName, opts.nestedCommandName));\n    process.exit(0);\n  }\n\n  const configPath = resolveConfigPath(values.config);\n  if (command === \"status\") {\n    process.stdout.write(`${JSON.stringify(redactedCloudStatus(loadConfig(configPath)), null, 2)}\\n`);\n    return;\n  }\n\n  if (command === \"disconnect\") {\n    clearCloudConfig(configPath);\n    process.stdout.write(`${opts.binaryName}: cloud runtime disconnected locally.\\n`);\n    return;\n  }\n\n  if (command === \"login\") {\n    if (!values.gateway) {\n      throw new Error(\"login requires --gateway\");\n    }\n    const runtimeName = values[\"runtime-name\"];\n    const { deviceToken, runtimeId, gatewayUrl } = await runDeviceFlow({\n      gatewayUrl: values.gateway,\n      configPath,\n      runtimeName,\n      binaryName: opts.binaryName,\n    });\n    const config = saveCloudConfig(configPath, {\n      gateway_url: gatewayUrl,\n      device_token: deviceToken,\n      runtime_id: runtimeId,\n      ...(runtimeName ? { runtime_name: runtimeName } : {}),\n      enabled: true,\n    });\n    process.stdout.write(`${opts.binaryName}: cloud runtime ${runtimeId} paired — connecting...\\n`);\n    const logger = new Logger({\n      filePath: config.log.file,\n      level: config.log.level,\n      verbose: values.verbose,\n    });\n    const daemon = new Daemon(config, logger);\n    await daemon.start();\n    return;\n  }\n\n  if (command === \"pair\") {\n    if (!values.gateway || !values.code) {\n      throw new Error(\"pair requires --gateway and --code\");\n    }\n    const runtimeName = values[\"runtime-name\"];\n    const result = await exchangePairingCode({\n      gatewayUrl: values.gateway,\n      code: values.code,\n      runtimeName,\n    });\n    saveCloudConfig(configPath, {\n      gateway_url: values.gateway,\n      device_token: result.deviceToken,\n      runtime_id: result.runtimeId,\n      ...(runtimeName ? { runtime_name: runtimeName } : {}),\n      enabled: true,\n    });\n    process.stdout.write(`${opts.binaryName}: paired cloud runtime ${result.runtimeId}.\\n`);\n    return;\n  }\n\n  if (command === \"connect\") {\n    const config = loadConfig(configPath);\n    if (!config.cloud?.device_token || !config.cloud.runtime_id) {\n      throw new Error(\"cloud runtime is not paired; run `pair` first\");\n    }\n    const logger = new Logger({\n      filePath: config.log.file,\n      level: config.log.level,\n      verbose: values.verbose,\n    });\n    const daemon = new Daemon(config, logger);\n    await daemon.start();\n    return;\n  }\n\n  throw new Error(`Unknown cloud runtime command: ${command}`);\n}\n\nexport function formatCloudRuntimeUsage(binaryName: string, nestedCommandName?: string): string {\n  const prefix = nestedCommandName ? `${binaryName} ${nestedCommandName}` : binaryName;\n  return `Usage: ${prefix} login --gateway <url> [--runtime-name <name>] [--config <path>]\n       ${prefix} status [--config <path>]\n       ${prefix} pair --gateway <url> --code <code> [--runtime-name <name>] [--config <path>]\n       ${prefix} connect [--config <path>] [--verbose]\n       ${prefix} disconnect [--config <path>]\n\nCommands:\n  login      (Recommended) Browser-based pairing — opens approval URL in terminal,\n             polls for authorization, then auto-connects the daemon. Use this instead\n             of pair + connect for interactive environments.\n  status     Show current cloud runtime configuration and connection status.\n  pair       Exchange a pairing code for a device token (headless/CI environments).\n  connect    Start the daemon using a previously paired device token.\n  disconnect Remove cloud runtime configuration from the local config file.\n\nOptions:\n  --config <path>        Path to YAML config file (default: ~/.gsd/daemon.yaml)\n  --gateway <url>        Cloud MCP Gateway URL\n  --code <code>          Pairing code from the Cloud MCP Gateway (pair only)\n  --runtime-name <name>  Friendly name for this Local GSD Runtime\n  --verbose              Print log entries to stderr in addition to the log file\n  --help                 Show this help message and exit\n`;\n}\n"]}

package/packages/daemon/dist/cloud-config.d.ts

@@ -15,4 +15,5 @@ export declare function clearCloudConfig(configPath: string): DaemonConfig;
 export declare function redactedCloudStatus(config: DaemonConfig): Record<string, unknown>;
 export declare function validateGatewayNetworkTarget(url: URL): void;
 export declare function createGatewayLookup(url: URL): LookupFunction;
+export declare function postJsonToValidatedGateway(url: URL, payload: Record<string, unknown>): Promise<Record<string, unknown>>;
 //# sourceMappingURL=cloud-config.d.ts.map

package/packages/daemon/dist/cloud-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-config.d.ts","sourceRoot":"","sources":["../src/cloud-config.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAK/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAUjC;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CA2BvD;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,YAAY,CAgB/G;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAWjE;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWjF;AAeD,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAK3D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,cAAc,CAc5D"}
+{"version":3,"file":"cloud-config.d.ts","sourceRoot":"","sources":["../src/cloud-config.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAK/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAUjC;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CA2BvD;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,GAAG,YAAY,CAgB/G;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAWjE;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWjF;AAeD,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAK3D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,cAAc,CAc5D;AA+BD,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmCvH"}

package/packages/daemon/dist/cloud-config.js

@@ -161,7 +161,7 @@ function writeConfigFile(configPath, contents) {
     writeFileSync(configPath, contents, { encoding: "utf-8", mode: 0o600 });
     chmodSync(configPath, 0o600);
 }
-function postJsonToValidatedGateway(url, payload) {
+export function postJsonToValidatedGateway(url, payload) {
     validateGatewayNetworkTarget(url);
     const body = JSON.stringify(payload);
     const requestImpl = url.protocol === "https:" ? httpsRequest : httpRequest;

package/packages/daemon/dist/cloud-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-config.js","sourceRoot":"","sources":["../src/cloud-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAQ3D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAIzC;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE;QACxD,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,SAA6C;IAC/F,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,IAAI,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,CAAC;IAC1D,GAAG,CAAC,KAAK,GAAG;QACV,GAAG,KAAK;QACR,WAAW,EAAE,oBAAoB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;QACnE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC;IACF,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,IAAI,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC;IACjB,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAoB;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACzC,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,CAAC,SAAS,GAAG,OAAO,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;AAC5F,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAQ;IACnD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACrE,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAQ;IAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/E,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrC,MAAM,aAAa,GAAqB,OAAO,OAAO,KAAK,QAAQ;YACjE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE;YACjC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACvD,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,aAAa,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC7D,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7G,CAAC;YACD,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjH,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IACtB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,KAAK,IAAI;WACf,IAAI,KAAK,KAAK;WACd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;WACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;WACrB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;WACxB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB,EAAE,QAAgB;IAC3D,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAQ,EAAE,OAAgC;IAC5E,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IAE3E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,WAAW,CAAC;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;aAC1C;YACD,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;SACjC,EAAE,CAAC,GAAG,EAAE,EAAE;YACT,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACvC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5F,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC7D,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;gBAC7C,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC,CAAC;oBAC9G,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QAC5C,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAC,MAAiC;YACnC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { chmodSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { lookup } from \"node:dns\";\nimport type { LookupOneOptions } from \"node:dns\";\nimport { request as httpRequest } from \"node:http\";\nimport { request as httpsRequest } from \"node:https\";\nimport { isIP } from \"node:net\";\nimport type { LookupFunction } from \"node:net\";\nimport { dirname } from \"node:path\";\nimport { parse as parseYaml, stringify as stringifyYaml } from \"yaml\";\nimport { loadConfig } from \"./config.js\";\nimport { protectCloudDeviceToken } from \"./cloud-token.js\";\nimport type { DaemonConfig } from \"./types.js\";\n\nexport interface PairingExchangeResult {\n  runtimeId: string;\n  deviceToken: string;\n}\n\nexport async function exchangePairingCode(params: {\n  gatewayUrl: string;\n  code: string;\n  runtimeName?: string;\n}): Promise<PairingExchangeResult> {\n  const pairingUrl = new URL(\"/pairing/exchange\", parseCloudGatewayUrl(params.gatewayUrl));\n  const body = await postJsonToValidatedGateway(pairingUrl, {\n    code: params.code,\n    runtimeName: params.runtimeName,\n  });\n  if (typeof body.runtimeId !== \"string\" || typeof body.deviceToken !== \"string\") {\n    throw new Error(\"Pairing response did not include runtimeId and deviceToken\");\n  }\n  return { runtimeId: body.runtimeId, deviceToken: body.deviceToken };\n}\n\nexport function parseCloudGatewayUrl(value: string): URL {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(\"Cloud gateway URL must be an absolute HTTP(S) URL\");\n  }\n\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"Cloud gateway URL must use http or https\");\n  }\n  if (url.username || url.password) {\n    throw new Error(\"Cloud gateway URL must not include credentials\");\n  }\n  if (url.hash) {\n    throw new Error(\"Cloud gateway URL must not include a fragment\");\n  }\n  if (url.protocol === \"http:\" && !isLoopbackHost(url.hostname)) {\n    throw new Error(\"Plain HTTP cloud gateway URLs are only allowed for localhost\");\n  }\n  if (url.protocol === \"https:\" && isPrivateIpHost(url.hostname)) {\n    throw new Error(\"Cloud gateway URL must not target private or loopback IP addresses\");\n  }\n\n  url.pathname = url.pathname.replace(/\\/+$/, \"\");\n  url.search = \"\";\n  return url;\n}\n\nexport function saveCloudConfig(configPath: string, nextCloud: NonNullable<DaemonConfig[\"cloud\"]>): DaemonConfig {\n  let raw: Record<string, unknown> = {};\n  try {\n    raw = parseYaml(readFileSync(configPath, \"utf-8\")) as Record<string, unknown> ?? {};\n  } catch {\n    raw = {};\n  }\n  const { device_token: deviceToken, ...cloud } = nextCloud;\n  raw.cloud = {\n    ...cloud,\n    gateway_url: parseCloudGatewayUrl(nextCloud.gateway_url).toString(),\n    ...(deviceToken ? { device_token_encrypted: protectCloudDeviceToken(deviceToken) } : {}),\n  };\n  mkdirSync(dirname(configPath), { recursive: true });\n  writeConfigFile(configPath, stringifyYaml(raw));\n  return loadConfig(configPath);\n}\n\nexport function clearCloudConfig(configPath: string): DaemonConfig {\n  let raw: Record<string, unknown> = {};\n  try {\n    raw = parseYaml(readFileSync(configPath, \"utf-8\")) as Record<string, unknown> ?? {};\n  } catch {\n    raw = {};\n  }\n  delete raw.cloud;\n  mkdirSync(dirname(configPath), { recursive: true });\n  writeConfigFile(configPath, stringifyYaml(raw));\n  return loadConfig(configPath);\n}\n\nexport function redactedCloudStatus(config: DaemonConfig): Record<string, unknown> {\n  const cloud = config.cloud;\n  if (!cloud) return { configured: false };\n  return {\n    configured: true,\n    enabled: cloud.enabled ?? true,\n    gateway_url: cloud.gateway_url,\n    runtime_id: cloud.runtime_id ?? null,\n    runtime_name: cloud.runtime_name ?? null,\n    [\"device_\" + \"token\"]: cloud.device_token ? \"[redacted]\" : null,\n  };\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const host = hostname.toLowerCase();\n  return host === \"localhost\" || host === \"127.0.0.1\" || host === \"::1\" || host === \"[::1]\";\n}\n\nfunction isPrivateIpHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (host === \"localhost\") return true;\n  if (isIP(host) === 4) return isPrivateIpv4(host);\n  if (isIP(host) === 6) return isPrivateIpv6(host);\n  return false;\n}\n\nexport function validateGatewayNetworkTarget(url: URL): void {\n  if (url.protocol === \"http:\" && isLoopbackHost(url.hostname)) return;\n  if (isPrivateIpHost(url.hostname)) {\n    throw new Error(\"Cloud gateway URL must not target private or loopback IP addresses\");\n  }\n}\n\nexport function createGatewayLookup(url: URL): LookupFunction {\n  const allowLoopback = url.protocol === \"http:\" && isLoopbackHost(url.hostname);\n  return (hostname, options, callback) => {\n    const lookupOptions: LookupOneOptions = typeof options === \"number\"\n      ? { family: options, all: false }\n      : { ...options, all: false };\n    lookup(hostname, lookupOptions, (err, address, family) => {\n      if (err) return callback(err, address, family);\n      if (!address || (!allowLoopback && isPrivateIpHost(address))) {\n        return callback(new Error(\"Cloud gateway URL resolved to a private or loopback address\"), address, family);\n      }\n      callback(null, address, family);\n    });\n  };\n}\n\nfunction isPrivateIpv4(host: string): boolean {\n  const octets = host.split(\".\").map((part) => Number(part));\n  if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return true;\n  const [a, b] = octets;\n  if (a === 10 || a === 127 || a === 0) return true;\n  if (a === 169 && b === 254) return true;\n  if (a === 172 && b >= 16 && b <= 31) return true;\n  if (a === 192 && b === 168) return true;\n  if (a === 100 && b >= 64 && b <= 127) return true;\n  if (a === 192 && b === 0) return true;\n  if (a === 198 && (b === 18 || b === 19)) return true;\n  if (a >= 224) return true;\n  return false;\n}\n\nfunction isPrivateIpv6(host: string): boolean {\n  return host === \"::\"\n    || host === \"::1\"\n    || host.startsWith(\"fc\")\n    || host.startsWith(\"fd\")\n    || host.startsWith(\"fe80:\")\n    || host.startsWith(\"2001:db8:\");\n}\n\nfunction writeConfigFile(configPath: string, contents: string): void {\n  writeFileSync(configPath, contents, { encoding: \"utf-8\", mode: 0o600 });\n  chmodSync(configPath, 0o600);\n}\n\nfunction postJsonToValidatedGateway(url: URL, payload: Record<string, unknown>): Promise<Record<string, unknown>> {\n  validateGatewayNetworkTarget(url);\n  const body = JSON.stringify(payload);\n  const requestImpl = url.protocol === \"https:\" ? httpsRequest : httpRequest;\n\n  return new Promise((resolve, reject) => {\n    const req = requestImpl({\n      protocol: url.protocol,\n      hostname: url.hostname,\n      port: url.port,\n      path: `${url.pathname}${url.search}`,\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/json\",\n        \"content-length\": Buffer.byteLength(body),\n      },\n      lookup: createGatewayLookup(url),\n    }, (res) => {\n      const statusCode = res.statusCode ?? 0;\n      const chunks: Buffer[] = [];\n      res.on(\"data\", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));\n      res.on(\"end\", () => {\n        const responseText = Buffer.concat(chunks).toString(\"utf-8\");\n        const parsed = parseJsonObject(responseText);\n        if (statusCode < 200 || statusCode >= 300) {\n          reject(new Error(typeof parsed.error === \"string\" ? parsed.error : `Pairing failed with HTTP ${statusCode}`));\n          return;\n        }\n        resolve(parsed);\n      });\n    });\n\n    req.on(\"error\", reject);\n    req.end(body);\n  });\n}\n\nfunction parseJsonObject(value: string): Record<string, unknown> {\n  try {\n    const parsed = JSON.parse(value) as unknown;\n    return parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n      ? parsed as Record<string, unknown>\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}
+{"version":3,"file":"cloud-config.js","sourceRoot":"","sources":["../src/cloud-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAQ3D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAIzC;IACC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE;QACxD,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAC;IACH,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,SAA6C;IAC/F,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,IAAI,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,CAAC;IAC1D,GAAG,CAAC,KAAK,GAAG;QACV,GAAG,KAAK;QACR,WAAW,EAAE,oBAAoB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;QACnE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC;IACF,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,IAAI,GAAG,GAA4B,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,IAAI,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC;IACjB,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,UAAU,CAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAoB;IACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACzC,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,CAAC,SAAS,GAAG,OAAO,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;AAC5F,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAQ;IACnD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACrE,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAQ;IAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/E,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACrC,MAAM,aAAa,GAAqB,OAAO,OAAO,KAAK,QAAQ;YACjE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE;YACjC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACvD,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,aAAa,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC7D,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7G,CAAC;YACD,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjH,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;IACtB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,KAAK,IAAI;WACf,IAAI,KAAK,KAAK;WACd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;WACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;WACrB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;WACxB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB,EAAE,QAAgB;IAC3D,aAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,GAAQ,EAAE,OAAgC;IACnF,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IAE3E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,WAAW,CAAC;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;aAC1C;YACD,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC;SACjC,EAAE,CAAC,GAAG,EAAE,EAAE;YACT,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACvC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5F,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC7D,MAAM,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;gBAC7C,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC,CAAC;oBAC9G,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;QAC5C,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAC,MAAiC;YACnC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import { chmodSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { lookup } from \"node:dns\";\nimport type { LookupOneOptions } from \"node:dns\";\nimport { request as httpRequest } from \"node:http\";\nimport { request as httpsRequest } from \"node:https\";\nimport { isIP } from \"node:net\";\nimport type { LookupFunction } from \"node:net\";\nimport { dirname } from \"node:path\";\nimport { parse as parseYaml, stringify as stringifyYaml } from \"yaml\";\nimport { loadConfig } from \"./config.js\";\nimport { protectCloudDeviceToken } from \"./cloud-token.js\";\nimport type { DaemonConfig } from \"./types.js\";\n\nexport interface PairingExchangeResult {\n  runtimeId: string;\n  deviceToken: string;\n}\n\nexport async function exchangePairingCode(params: {\n  gatewayUrl: string;\n  code: string;\n  runtimeName?: string;\n}): Promise<PairingExchangeResult> {\n  const pairingUrl = new URL(\"/pairing/exchange\", parseCloudGatewayUrl(params.gatewayUrl));\n  const body = await postJsonToValidatedGateway(pairingUrl, {\n    code: params.code,\n    runtimeName: params.runtimeName,\n  });\n  if (typeof body.runtimeId !== \"string\" || typeof body.deviceToken !== \"string\") {\n    throw new Error(\"Pairing response did not include runtimeId and deviceToken\");\n  }\n  return { runtimeId: body.runtimeId, deviceToken: body.deviceToken };\n}\n\nexport function parseCloudGatewayUrl(value: string): URL {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(\"Cloud gateway URL must be an absolute HTTP(S) URL\");\n  }\n\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"Cloud gateway URL must use http or https\");\n  }\n  if (url.username || url.password) {\n    throw new Error(\"Cloud gateway URL must not include credentials\");\n  }\n  if (url.hash) {\n    throw new Error(\"Cloud gateway URL must not include a fragment\");\n  }\n  if (url.protocol === \"http:\" && !isLoopbackHost(url.hostname)) {\n    throw new Error(\"Plain HTTP cloud gateway URLs are only allowed for localhost\");\n  }\n  if (url.protocol === \"https:\" && isPrivateIpHost(url.hostname)) {\n    throw new Error(\"Cloud gateway URL must not target private or loopback IP addresses\");\n  }\n\n  url.pathname = url.pathname.replace(/\\/+$/, \"\");\n  url.search = \"\";\n  return url;\n}\n\nexport function saveCloudConfig(configPath: string, nextCloud: NonNullable<DaemonConfig[\"cloud\"]>): DaemonConfig {\n  let raw: Record<string, unknown> = {};\n  try {\n    raw = parseYaml(readFileSync(configPath, \"utf-8\")) as Record<string, unknown> ?? {};\n  } catch {\n    raw = {};\n  }\n  const { device_token: deviceToken, ...cloud } = nextCloud;\n  raw.cloud = {\n    ...cloud,\n    gateway_url: parseCloudGatewayUrl(nextCloud.gateway_url).toString(),\n    ...(deviceToken ? { device_token_encrypted: protectCloudDeviceToken(deviceToken) } : {}),\n  };\n  mkdirSync(dirname(configPath), { recursive: true });\n  writeConfigFile(configPath, stringifyYaml(raw));\n  return loadConfig(configPath);\n}\n\nexport function clearCloudConfig(configPath: string): DaemonConfig {\n  let raw: Record<string, unknown> = {};\n  try {\n    raw = parseYaml(readFileSync(configPath, \"utf-8\")) as Record<string, unknown> ?? {};\n  } catch {\n    raw = {};\n  }\n  delete raw.cloud;\n  mkdirSync(dirname(configPath), { recursive: true });\n  writeConfigFile(configPath, stringifyYaml(raw));\n  return loadConfig(configPath);\n}\n\nexport function redactedCloudStatus(config: DaemonConfig): Record<string, unknown> {\n  const cloud = config.cloud;\n  if (!cloud) return { configured: false };\n  return {\n    configured: true,\n    enabled: cloud.enabled ?? true,\n    gateway_url: cloud.gateway_url,\n    runtime_id: cloud.runtime_id ?? null,\n    runtime_name: cloud.runtime_name ?? null,\n    [\"device_\" + \"token\"]: cloud.device_token ? \"[redacted]\" : null,\n  };\n}\n\nfunction isLoopbackHost(hostname: string): boolean {\n  const host = hostname.toLowerCase();\n  return host === \"localhost\" || host === \"127.0.0.1\" || host === \"::1\" || host === \"[::1]\";\n}\n\nfunction isPrivateIpHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (host === \"localhost\") return true;\n  if (isIP(host) === 4) return isPrivateIpv4(host);\n  if (isIP(host) === 6) return isPrivateIpv6(host);\n  return false;\n}\n\nexport function validateGatewayNetworkTarget(url: URL): void {\n  if (url.protocol === \"http:\" && isLoopbackHost(url.hostname)) return;\n  if (isPrivateIpHost(url.hostname)) {\n    throw new Error(\"Cloud gateway URL must not target private or loopback IP addresses\");\n  }\n}\n\nexport function createGatewayLookup(url: URL): LookupFunction {\n  const allowLoopback = url.protocol === \"http:\" && isLoopbackHost(url.hostname);\n  return (hostname, options, callback) => {\n    const lookupOptions: LookupOneOptions = typeof options === \"number\"\n      ? { family: options, all: false }\n      : { ...options, all: false };\n    lookup(hostname, lookupOptions, (err, address, family) => {\n      if (err) return callback(err, address, family);\n      if (!address || (!allowLoopback && isPrivateIpHost(address))) {\n        return callback(new Error(\"Cloud gateway URL resolved to a private or loopback address\"), address, family);\n      }\n      callback(null, address, family);\n    });\n  };\n}\n\nfunction isPrivateIpv4(host: string): boolean {\n  const octets = host.split(\".\").map((part) => Number(part));\n  if (octets.length !== 4 || octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return true;\n  const [a, b] = octets;\n  if (a === 10 || a === 127 || a === 0) return true;\n  if (a === 169 && b === 254) return true;\n  if (a === 172 && b >= 16 && b <= 31) return true;\n  if (a === 192 && b === 168) return true;\n  if (a === 100 && b >= 64 && b <= 127) return true;\n  if (a === 192 && b === 0) return true;\n  if (a === 198 && (b === 18 || b === 19)) return true;\n  if (a >= 224) return true;\n  return false;\n}\n\nfunction isPrivateIpv6(host: string): boolean {\n  return host === \"::\"\n    || host === \"::1\"\n    || host.startsWith(\"fc\")\n    || host.startsWith(\"fd\")\n    || host.startsWith(\"fe80:\")\n    || host.startsWith(\"2001:db8:\");\n}\n\nfunction writeConfigFile(configPath: string, contents: string): void {\n  writeFileSync(configPath, contents, { encoding: \"utf-8\", mode: 0o600 });\n  chmodSync(configPath, 0o600);\n}\n\nexport function postJsonToValidatedGateway(url: URL, payload: Record<string, unknown>): Promise<Record<string, unknown>> {\n  validateGatewayNetworkTarget(url);\n  const body = JSON.stringify(payload);\n  const requestImpl = url.protocol === \"https:\" ? httpsRequest : httpRequest;\n\n  return new Promise((resolve, reject) => {\n    const req = requestImpl({\n      protocol: url.protocol,\n      hostname: url.hostname,\n      port: url.port,\n      path: `${url.pathname}${url.search}`,\n      method: \"POST\",\n      headers: {\n        \"content-type\": \"application/json\",\n        \"content-length\": Buffer.byteLength(body),\n      },\n      lookup: createGatewayLookup(url),\n    }, (res) => {\n      const statusCode = res.statusCode ?? 0;\n      const chunks: Buffer[] = [];\n      res.on(\"data\", (chunk) => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));\n      res.on(\"end\", () => {\n        const responseText = Buffer.concat(chunks).toString(\"utf-8\");\n        const parsed = parseJsonObject(responseText);\n        if (statusCode < 200 || statusCode >= 300) {\n          reject(new Error(typeof parsed.error === \"string\" ? parsed.error : `Pairing failed with HTTP ${statusCode}`));\n          return;\n        }\n        resolve(parsed);\n      });\n    });\n\n    req.on(\"error\", reject);\n    req.end(body);\n  });\n}\n\nfunction parseJsonObject(value: string): Record<string, unknown> {\n  try {\n    const parsed = JSON.parse(value) as unknown;\n    return parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n      ? parsed as Record<string, unknown>\n      : {};\n  } catch {\n    return {};\n  }\n}\n"]}