@opengsd/gsd-pi 1.5.0 → 1.6.0-dev.aa7f94e8

package/packages/daemon/dist/device-flow.d.ts

@@ -0,0 +1,24 @@
+export interface DeviceFlowResult {
+    deviceToken: string;
+    runtimeId: string;
+    /**
+     * Resolved relay/gateway URL: the server-returned `gateway_url` from the approved
+     * token-poll response when present AND valid, else the `gatewayUrl` the caller passed
+     * (D-02 backward-compat — existing single-host `--gateway` users are unaffected).
+     */
+    gatewayUrl: string;
+}
+export interface DeviceFlowParams {
+    gatewayUrl: string;
+    configPath: string;
+    runtimeName?: string;
+    binaryName: string;
+}
+/**
+ * Run the full RFC 8628 device authorization flow.
+ * Requests a device code, displays the verification URL and user code in the terminal,
+ * polls for approval with a spinner, and returns the device token on success.
+ * Calls process.exit(1) on denial (D-12) or timeout (D-11).
+ */
+export declare function runDeviceFlow(params: DeviceFlowParams): Promise<DeviceFlowResult>;
+//# sourceMappingURL=device-flow.d.ts.map

package/packages/daemon/dist/device-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.d.ts","sourceRoot":"","sources":["../src/device-flow.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAKD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+HvF"}

package/packages/daemon/dist/device-flow.js

@@ -0,0 +1,128 @@
+// Device flow handler: code request, terminal display, polling loop, config save.
+// Implements RFC 8628 device authorization grant for the daemon's `gsd cloud login` command.
+import { hostname as osHostname } from "node:os";
+import { cursorTo, clearLine } from "node:readline";
+import { parseCloudGatewayUrl, postJsonToValidatedGateway, validateGatewayNetworkTarget } from "./cloud-config.js";
+const SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+const DEFAULT_POLL_INTERVAL_MS = 5_000;
+const SLOW_DOWN_INCREMENT_MS = 5_000;
+/** Simple sleep helper. */
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+ * Run the full RFC 8628 device authorization flow.
+ * Requests a device code, displays the verification URL and user code in the terminal,
+ * polls for approval with a spinner, and returns the device token on success.
+ * Calls process.exit(1) on denial (D-12) or timeout (D-11).
+ */
+export async function runDeviceFlow(params) {
+    const base = parseCloudGatewayUrl(params.gatewayUrl);
+    // ---- Step 1: Request device code (D-01, DEVF-01) ----
+    const codeUrl = new URL(base.pathname.replace(/\/+$/, "") + "/api/device/code", base);
+    const codeResponse = await postJsonToValidatedGateway(codeUrl, {
+        hostname: osHostname(),
+        os: process.platform,
+        ...(params.runtimeName !== undefined ? { runtimeName: params.runtimeName } : {}),
+    });
+    const userCode = typeof codeResponse["userCode"] === "string" ? codeResponse["userCode"] : "";
+    const deviceCode = typeof codeResponse["deviceCode"] === "string" ? codeResponse["deviceCode"] : "";
+    const verificationUriComplete = typeof codeResponse["verificationUriComplete"] === "string"
+        ? codeResponse["verificationUriComplete"]
+        : "";
+    const expiresIn = typeof codeResponse["expiresIn"] === "number" ? codeResponse["expiresIn"] : 600;
+    if (!userCode || !deviceCode) {
+        throw new Error("Device code response missing userCode or deviceCode");
+    }
+    // ---- Step 2: Display to user (D-02) ----
+    process.stdout.write(`\n${params.binaryName}: Cloud Login\n`);
+    process.stdout.write(`\nTo authorize this machine, open the following URL in your browser:\n`);
+    process.stdout.write(`\n  ${verificationUriComplete}\n`);
+    process.stdout.write(`\nOr visit the gateway and enter the code manually:\n`);
+    process.stdout.write(`\n  ${base.origin}\n`);
+    process.stdout.write(`\nYour code:  ${userCode}\n\n`);
+    // ---- Step 3: Polling loop (D-10, D-11, D-12) ----
+    const tokenUrl = new URL(base.pathname.replace(/\/+$/, "") + "/api/device/token", base);
+    const expiresAt = Date.now() + expiresIn * 1_000;
+    let pollIntervalMs = DEFAULT_POLL_INTERVAL_MS;
+    let spinnerIndex = 0;
+    const spinnerInterval = setInterval(() => {
+        const frame = SPINNER_FRAMES[spinnerIndex % SPINNER_FRAMES.length] ?? "⠋";
+        spinnerIndex++;
+        const remaining = Math.max(0, Math.ceil((expiresAt - Date.now()) / 1_000));
+        cursorTo(process.stdout, 0);
+        clearLine(process.stdout, 0);
+        process.stdout.write(`  ${frame} Waiting for approval... (expires in ${remaining}s)`);
+    }, 100);
+    try {
+        while (Date.now() < expiresAt) {
+            await sleep(pollIntervalMs);
+            if (Date.now() >= expiresAt)
+                break;
+            let tokenResponse;
+            try {
+                tokenResponse = await postJsonToValidatedGateway(tokenUrl, { deviceCode });
+            }
+            catch {
+                // Network errors during polling are transient — keep trying until expiry.
+                continue;
+            }
+            const status = typeof tokenResponse["status"] === "string" ? tokenResponse["status"] : "";
+            if (status === "approved") {
+                clearInterval(spinnerInterval);
+                cursorTo(process.stdout, 0);
+                clearLine(process.stdout, 0);
+                process.stdout.write(`${params.binaryName}: Authorization approved!\n`);
+                const deviceToken = typeof tokenResponse["token"] === "string" ? tokenResponse["token"] : "";
+                const runtimeId = typeof tokenResponse["runtimeId"] === "string" ? tokenResponse["runtimeId"] : "";
+                if (!deviceToken || !runtimeId) {
+                    throw new Error("Approval response missing token or runtimeId");
+                }
+                // Resolve the relay/gateway URL in exactly ONE place (D-02, D-03).
+                // Default to the caller-supplied gateway; if the server sent a valid
+                // `gateway_url`, use that instead. The server value is UNTRUSTED input —
+                // re-validate it through the same SSRF guards applied to `--gateway`.
+                let gatewayUrl = params.gatewayUrl;
+                const serverGatewayUrl = typeof tokenResponse["gateway_url"] === "string"
+                    ? tokenResponse["gateway_url"]
+                    : undefined;
+                if (serverGatewayUrl) {
+                    try {
+                        const parsed = parseCloudGatewayUrl(serverGatewayUrl);
+                        validateGatewayNetworkTarget(parsed);
+                        gatewayUrl = parsed.toString();
+                    }
+                    catch (err) {
+                        // Fail loud-but-non-fatal: a bad server-supplied relay URL must not
+                        // crash login. Warn and fall back to the configured `--gateway`.
+                        const reason = err instanceof Error ? err.message : String(err);
+                        process.stderr.write(`${params.binaryName}: ignoring invalid server-supplied relay URL (${reason}); using configured --gateway instead.\n`);
+                    }
+                }
+                return { deviceToken, runtimeId, gatewayUrl };
+            }
+            if (status === "denied") {
+                clearInterval(spinnerInterval);
+                cursorTo(process.stdout, 0);
+                clearLine(process.stdout, 0);
+                process.stdout.write(`${params.binaryName}: Device request denied by user.\n`);
+                process.exit(1);
+            }
+            if (status === "expired") {
+                break;
+            }
+            if (status === "slow_down") {
+                pollIntervalMs += SLOW_DOWN_INCREMENT_MS;
+                continue;
+            }
+            // status === "pending" or unknown — keep polling
+        }
+    }
+    finally {
+        clearInterval(spinnerInterval);
+    }
+    // Timeout path (D-11)
+    cursorTo(process.stdout, 0);
+    clearLine(process.stdout, 0);
+    process.stdout.write(`${params.binaryName}: Authorization request timed out. Please run login again.\n`);
+    process.exit(1);
+}
+//# sourceMappingURL=device-flow.js.map

package/packages/daemon/dist/device-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.js","sourceRoot":"","sources":["../src/device-flow.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,6FAA6F;AAC7F,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAEnH,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAC1E,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAoBrC,2BAA2B;AAC3B,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAwB;IAC1D,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAErD,wDAAwD;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,kBAAkB,EAAE,IAAI,CAAC,CAAC;IACtF,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE;QAC7D,QAAQ,EAAE,UAAU,EAAE;QACtB,EAAE,EAAE,OAAO,CAAC,QAAQ;QACpB,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,OAAO,YAAY,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,MAAM,UAAU,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpG,MAAM,uBAAuB,GAAG,OAAO,YAAY,CAAC,yBAAyB,CAAC,KAAK,QAAQ;QACzF,CAAC,CAAC,YAAY,CAAC,yBAAyB,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,SAAS,GAAG,OAAO,YAAY,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAElG,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,2CAA2C;IAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,UAAU,iBAAiB,CAAC,CAAC;IAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC/F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,uBAAuB,IAAI,CAAC,CAAC;IACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,QAAQ,MAAM,CAAC,CAAC;IAEtD,oDAAoD;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,mBAAmB,EAAE,IAAI,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,CAAC;IACjD,IAAI,cAAc,GAAG,wBAAwB,CAAC;IAC9C,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;QACvC,MAAM,KAAK,GAAG,cAAc,CAAC,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;QAC1E,YAAY,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,wCAAwC,SAAS,IAAI,CAAC,CAAC;IACxF,CAAC,EAAE,GAAG,CAAC,CAAC;IAER,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;YAE5B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS;gBAAE,MAAM;YAEnC,IAAI,aAAsC,CAAC;YAC3C,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,0BAA0B,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,0EAA0E;gBAC1E,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAE1F,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC1B,aAAa,CAAC,eAAe,CAAC,CAAC;gBAC/B,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC5B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,6BAA6B,CAAC,CAAC;gBAExE,MAAM,WAAW,GAAG,OAAO,aAAa,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7F,MAAM,SAAS,GAAG,OAAO,aAAa,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnG,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAClE,CAAC;gBAED,mEAAmE;gBACnE,qEAAqE;gBACrE,yEAAyE;gBACzE,sEAAsE;gBACtE,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBACnC,MAAM,gBAAgB,GAAG,OAAO,aAAa,CAAC,aAAa,CAAC,KAAK,QAAQ;oBACvE,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC;oBAC9B,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,gBAAgB,EAAE,CAAC;oBACrB,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;wBACtD,4BAA4B,CAAC,MAAM,CAAC,CAAC;wBACrC,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACjC,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,oEAAoE;wBACpE,iEAAiE;wBACjE,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,MAAM,CAAC,UAAU,iDAAiD,MAAM,0CAA0C,CACtH,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;YAChD,CAAC;YAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,aAAa,CAAC,eAAe,CAAC,CAAC;gBAC/B,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC5B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,oCAAoC,CAAC,CAAC;gBAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM;YACR,CAAC;YAED,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC3B,cAAc,IAAI,sBAAsB,CAAC;gBACzC,SAAS;YACX,CAAC;YAED,iDAAiD;QACnD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,eAAe,CAAC,CAAC;IACjC,CAAC;IAED,sBAAsB;IACtB,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5B,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,8DAA8D,CAAC,CAAC;IACzG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC","sourcesContent":["// Device flow handler: code request, terminal display, polling loop, config save.\n// Implements RFC 8628 device authorization grant for the daemon's `gsd cloud login` command.\nimport { hostname as osHostname } from \"node:os\";\nimport { cursorTo, clearLine } from \"node:readline\";\nimport { parseCloudGatewayUrl, postJsonToValidatedGateway, validateGatewayNetworkTarget } from \"./cloud-config.js\";\n\nconst SPINNER_FRAMES = [\"⠋\", \"⠙\", \"⠹\", \"⠸\", \"⠼\", \"⠴\", \"⠦\", \"⠧\", \"⠇\", \"⠏\"];\nconst DEFAULT_POLL_INTERVAL_MS = 5_000;\nconst SLOW_DOWN_INCREMENT_MS = 5_000;\n\nexport interface DeviceFlowResult {\n  deviceToken: string;\n  runtimeId: string;\n  /**\n   * Resolved relay/gateway URL: the server-returned `gateway_url` from the approved\n   * token-poll response when present AND valid, else the `gatewayUrl` the caller passed\n   * (D-02 backward-compat — existing single-host `--gateway` users are unaffected).\n   */\n  gatewayUrl: string;\n}\n\nexport interface DeviceFlowParams {\n  gatewayUrl: string;\n  configPath: string;\n  runtimeName?: string;\n  binaryName: string;\n}\n\n/** Simple sleep helper. */\nconst sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));\n\n/**\n * Run the full RFC 8628 device authorization flow.\n * Requests a device code, displays the verification URL and user code in the terminal,\n * polls for approval with a spinner, and returns the device token on success.\n * Calls process.exit(1) on denial (D-12) or timeout (D-11).\n */\nexport async function runDeviceFlow(params: DeviceFlowParams): Promise<DeviceFlowResult> {\n  const base = parseCloudGatewayUrl(params.gatewayUrl);\n\n  // ---- Step 1: Request device code (D-01, DEVF-01) ----\n  const codeUrl = new URL(base.pathname.replace(/\\/+$/, \"\") + \"/api/device/code\", base);\n  const codeResponse = await postJsonToValidatedGateway(codeUrl, {\n    hostname: osHostname(),\n    os: process.platform,\n    ...(params.runtimeName !== undefined ? { runtimeName: params.runtimeName } : {}),\n  });\n\n  const userCode = typeof codeResponse[\"userCode\"] === \"string\" ? codeResponse[\"userCode\"] : \"\";\n  const deviceCode = typeof codeResponse[\"deviceCode\"] === \"string\" ? codeResponse[\"deviceCode\"] : \"\";\n  const verificationUriComplete = typeof codeResponse[\"verificationUriComplete\"] === \"string\"\n    ? codeResponse[\"verificationUriComplete\"]\n    : \"\";\n  const expiresIn = typeof codeResponse[\"expiresIn\"] === \"number\" ? codeResponse[\"expiresIn\"] : 600;\n\n  if (!userCode || !deviceCode) {\n    throw new Error(\"Device code response missing userCode or deviceCode\");\n  }\n\n  // ---- Step 2: Display to user (D-02) ----\n  process.stdout.write(`\\n${params.binaryName}: Cloud Login\\n`);\n  process.stdout.write(`\\nTo authorize this machine, open the following URL in your browser:\\n`);\n  process.stdout.write(`\\n  ${verificationUriComplete}\\n`);\n  process.stdout.write(`\\nOr visit the gateway and enter the code manually:\\n`);\n  process.stdout.write(`\\n  ${base.origin}\\n`);\n  process.stdout.write(`\\nYour code:  ${userCode}\\n\\n`);\n\n  // ---- Step 3: Polling loop (D-10, D-11, D-12) ----\n  const tokenUrl = new URL(base.pathname.replace(/\\/+$/, \"\") + \"/api/device/token\", base);\n  const expiresAt = Date.now() + expiresIn * 1_000;\n  let pollIntervalMs = DEFAULT_POLL_INTERVAL_MS;\n  let spinnerIndex = 0;\n\n  const spinnerInterval = setInterval(() => {\n    const frame = SPINNER_FRAMES[spinnerIndex % SPINNER_FRAMES.length] ?? \"⠋\";\n    spinnerIndex++;\n    const remaining = Math.max(0, Math.ceil((expiresAt - Date.now()) / 1_000));\n    cursorTo(process.stdout, 0);\n    clearLine(process.stdout, 0);\n    process.stdout.write(`  ${frame} Waiting for approval... (expires in ${remaining}s)`);\n  }, 100);\n\n  try {\n    while (Date.now() < expiresAt) {\n      await sleep(pollIntervalMs);\n\n      if (Date.now() >= expiresAt) break;\n\n      let tokenResponse: Record<string, unknown>;\n      try {\n        tokenResponse = await postJsonToValidatedGateway(tokenUrl, { deviceCode });\n      } catch {\n        // Network errors during polling are transient — keep trying until expiry.\n        continue;\n      }\n\n      const status = typeof tokenResponse[\"status\"] === \"string\" ? tokenResponse[\"status\"] : \"\";\n\n      if (status === \"approved\") {\n        clearInterval(spinnerInterval);\n        cursorTo(process.stdout, 0);\n        clearLine(process.stdout, 0);\n        process.stdout.write(`${params.binaryName}: Authorization approved!\\n`);\n\n        const deviceToken = typeof tokenResponse[\"token\"] === \"string\" ? tokenResponse[\"token\"] : \"\";\n        const runtimeId = typeof tokenResponse[\"runtimeId\"] === \"string\" ? tokenResponse[\"runtimeId\"] : \"\";\n        if (!deviceToken || !runtimeId) {\n          throw new Error(\"Approval response missing token or runtimeId\");\n        }\n\n        // Resolve the relay/gateway URL in exactly ONE place (D-02, D-03).\n        // Default to the caller-supplied gateway; if the server sent a valid\n        // `gateway_url`, use that instead. The server value is UNTRUSTED input —\n        // re-validate it through the same SSRF guards applied to `--gateway`.\n        let gatewayUrl = params.gatewayUrl;\n        const serverGatewayUrl = typeof tokenResponse[\"gateway_url\"] === \"string\"\n          ? tokenResponse[\"gateway_url\"]\n          : undefined;\n        if (serverGatewayUrl) {\n          try {\n            const parsed = parseCloudGatewayUrl(serverGatewayUrl);\n            validateGatewayNetworkTarget(parsed);\n            gatewayUrl = parsed.toString();\n          } catch (err) {\n            // Fail loud-but-non-fatal: a bad server-supplied relay URL must not\n            // crash login. Warn and fall back to the configured `--gateway`.\n            const reason = err instanceof Error ? err.message : String(err);\n            process.stderr.write(\n              `${params.binaryName}: ignoring invalid server-supplied relay URL (${reason}); using configured --gateway instead.\\n`,\n            );\n          }\n        }\n\n        return { deviceToken, runtimeId, gatewayUrl };\n      }\n\n      if (status === \"denied\") {\n        clearInterval(spinnerInterval);\n        cursorTo(process.stdout, 0);\n        clearLine(process.stdout, 0);\n        process.stdout.write(`${params.binaryName}: Device request denied by user.\\n`);\n        process.exit(1);\n      }\n\n      if (status === \"expired\") {\n        break;\n      }\n\n      if (status === \"slow_down\") {\n        pollIntervalMs += SLOW_DOWN_INCREMENT_MS;\n        continue;\n      }\n\n      // status === \"pending\" or unknown — keep polling\n    }\n  } finally {\n    clearInterval(spinnerInterval);\n  }\n\n  // Timeout path (D-11)\n  cursorTo(process.stdout, 0);\n  clearLine(process.stdout, 0);\n  process.stdout.write(`${params.binaryName}: Authorization request timed out. Please run login again.\\n`);\n  process.exit(1);\n}\n"]}

package/packages/daemon/dist/device-flow.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=device-flow.test.d.ts.map

package/packages/daemon/dist/device-flow.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.test.d.ts","sourceRoot":"","sources":["../src/device-flow.test.ts"],"names":[],"mappings":""}

package/packages/daemon/dist/device-flow.test.js

@@ -0,0 +1,172 @@
+// Device-flow gateway_url resolution tests: server-valid-wins, absent-falls-back,
+// invalid-falls-back-no-throw. Drives runDeviceFlow against a local loopback HTTP server.
+import assert from "node:assert/strict";
+import { createServer } from "node:http";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { test } from "node:test";
+import { runDeviceFlow } from "./device-flow.js";
+/**
+ * Stand up a loopback HTTP server implementing both device-flow endpoints.
+ * `/api/device/code` returns a code payload; `/api/device/token` returns an
+ * approved response whose `gateway_url` field is shaped per `gatewayCase`.
+ */
+function startDeviceServer(gatewayCase) {
+    const server = createServer((req, res) => {
+        let body = "";
+        req.setEncoding("utf8");
+        req.on("data", (chunk) => {
+            body += chunk;
+        });
+        req.on("end", () => {
+            if (req.url === "/api/device/code") {
+                res.writeHead(200, { "content-type": "application/json" });
+                res.end(JSON.stringify({
+                    userCode: "ABCD-1234",
+                    deviceCode: "device-code-fixture",
+                    verificationUriComplete: "https://example.test/verify?code=ABCD-1234",
+                    expiresIn: 600,
+                }));
+                return;
+            }
+            if (req.url === "/api/device/token") {
+                const approved = {
+                    status: "approved",
+                    token: "device-token-fixture",
+                    runtimeId: "rt-fixture",
+                };
+                if (gatewayCase.kind === "value") {
+                    approved["gateway_url"] = gatewayCase.value;
+                }
+                res.writeHead(200, { "content-type": "application/json" });
+                res.end(JSON.stringify(approved));
+                return;
+            }
+            res.writeHead(404, { "content-type": "application/json" });
+            res.end(JSON.stringify({ error: "not found" }));
+        });
+    });
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            const address = server.address();
+            if (!address || typeof address !== "object") {
+                reject(new Error("failed to bind loopback test server"));
+                return;
+            }
+            resolve({ server, baseUrl: `http://127.0.0.1:${address.port}` });
+        });
+    });
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => server.close((err) => (err ? reject(err) : resolve())));
+}
+/** Capture stderr writes so the invalid-URL warning can be asserted. */
+function captureStderr() {
+    const original = process.stderr.write.bind(process.stderr);
+    let captured = "";
+    process.stderr.write = ((chunk) => {
+        captured += typeof chunk === "string" ? chunk : String(chunk);
+        return true;
+    });
+    return {
+        restore: () => {
+            process.stderr.write = original;
+        },
+        output: () => captured,
+    };
+}
+function configPathFixture() {
+    return join(mkdtempSync(join(tmpdir(), "gsd-device-flow-")), "daemon.yaml");
+}
+test("device flow uses a valid server gateway_url over the passed --gateway", async (t) => {
+    let started;
+    try {
+        // A different, valid loopback URL than the login base — server value should win.
+        const serverGateway = "https://relay.example/gateway";
+        started = await startDeviceServer({ kind: "value", value: serverGateway });
+    }
+    catch (err) {
+        if (err.code === "EPERM") {
+            t.skip("loopback listen is blocked in this sandbox");
+            return;
+        }
+        throw err;
+    }
+    try {
+        const result = await runDeviceFlow({
+            gatewayUrl: started.baseUrl,
+            configPath: configPathFixture(),
+            binaryName: "gsd",
+        });
+        // Server-returned value wins, normalized (trailing slash stripped from path).
+        assert.equal(result.gatewayUrl, "https://relay.example/gateway");
+        assert.notEqual(result.gatewayUrl, started.baseUrl);
+        assert.equal(result.deviceToken, "device-token-fixture");
+        assert.equal(result.runtimeId, "rt-fixture");
+    }
+    finally {
+        await closeServer(started.server);
+    }
+});
+test("device flow falls back to --gateway when server omits gateway_url (backward-compat)", async (t) => {
+    let started;
+    try {
+        started = await startDeviceServer({ kind: "absent" });
+    }
+    catch (err) {
+        if (err.code === "EPERM") {
+            t.skip("loopback listen is blocked in this sandbox");
+            return;
+        }
+        throw err;
+    }
+    try {
+        const result = await runDeviceFlow({
+            gatewayUrl: started.baseUrl,
+            configPath: configPathFixture(),
+            binaryName: "gsd",
+        });
+        // Load-bearing invariant: with no server gateway_url, the passed --gateway is preserved.
+        assert.equal(result.gatewayUrl, started.baseUrl);
+        assert.equal(result.deviceToken, "device-token-fixture");
+        assert.equal(result.runtimeId, "rt-fixture");
+    }
+    finally {
+        await closeServer(started.server);
+    }
+});
+test("device flow falls back to --gateway when server gateway_url is invalid (no throw)", async (t) => {
+    let started;
+    try {
+        // A private-IP https URL fails validateGatewayNetworkTarget — must fall back, not crash.
+        started = await startDeviceServer({ kind: "value", value: "https://10.0.0.5/gateway" });
+    }
+    catch (err) {
+        if (err.code === "EPERM") {
+            t.skip("loopback listen is blocked in this sandbox");
+            return;
+        }
+        throw err;
+    }
+    const stderr = captureStderr();
+    let capturedWarning = "";
+    try {
+        const result = await runDeviceFlow({
+            gatewayUrl: started.baseUrl,
+            configPath: configPathFixture(),
+            binaryName: "gsd",
+        });
+        capturedWarning = stderr.output();
+        stderr.restore();
+        // Invalid server value is ignored; passed --gateway is used; login does not throw.
+        assert.equal(result.gatewayUrl, started.baseUrl);
+        assert.match(capturedWarning, /ignoring invalid server-supplied relay URL/);
+    }
+    finally {
+        stderr.restore();
+        await closeServer(started.server);
+    }
+});
+//# sourceMappingURL=device-flow.test.js.map

package/packages/daemon/dist/device-flow.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-flow.test.js","sourceRoot":"","sources":["../src/device-flow.test.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,0FAA0F;AAC1F,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAOjD;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,WAAwB;IACjD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACvB,IAAI,IAAI,KAAK,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,GAAG,CAAC,GAAG,KAAK,kBAAkB,EAAE,CAAC;gBACnC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;oBACrB,QAAQ,EAAE,WAAW;oBACrB,UAAU,EAAE,qBAAqB;oBACjC,uBAAuB,EAAE,4CAA4C;oBACrE,SAAS,EAAE,GAAG;iBACf,CAAC,CAAC,CAAC;gBACJ,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,GAAG,KAAK,mBAAmB,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAA4B;oBACxC,MAAM,EAAE,UAAU;oBAClB,KAAK,EAAE,sBAAsB;oBAC7B,SAAS,EAAE,YAAY;iBACxB,CAAC;gBACF,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACjC,QAAQ,CAAC,aAAa,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC;gBAC9C,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa;IACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,QAAQ,GAAG,EAAE,CAAC;IACjB,OAAO,CAAC,MAA4D,CAAC,KAAK,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE;QAChG,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC,CAAgC,CAAC;IAClC,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACX,OAAO,CAAC,MAA4D,CAAC,KAAK,GAAG,QAAQ,CAAC;QACzF,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AAC9E,CAAC;AAED,IAAI,CAAC,uEAAuE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxF,IAAI,OAA4C,CAAC;IACjD,IAAI,CAAC;QACH,iFAAiF;QACjF,MAAM,aAAa,GAAG,+BAA+B,CAAC;QACtD,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;YACjC,UAAU,EAAE,OAAO,CAAC,OAAO;YAC3B,UAAU,EAAE,iBAAiB,EAAE;YAC/B,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QACH,8EAA8E;QAC9E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAAC;QACjE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC/C,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACtG,IAAI,OAA4C,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;YACjC,UAAU,EAAE,OAAO,CAAC,OAAO;YAC3B,UAAU,EAAE,iBAAiB,EAAE;YAC/B,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QACH,yFAAyF;QACzF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC/C,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mFAAmF,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACpG,IAAI,OAA4C,CAAC;IACjD,IAAI,CAAC;QACH,yFAAyF;QACzF,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,eAAe,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;YACjC,UAAU,EAAE,OAAO,CAAC,OAAO;YAC3B,UAAU,EAAE,iBAAiB,EAAE;YAC/B,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QACH,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,mFAAmF;QACnF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,4CAA4C,CAAC,CAAC;IAC9E,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["// Device-flow gateway_url resolution tests: server-valid-wins, absent-falls-back,\n// invalid-falls-back-no-throw. Drives runDeviceFlow against a local loopback HTTP server.\nimport assert from \"node:assert/strict\";\nimport { createServer, type Server } from \"node:http\";\nimport { mkdtempSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { test } from \"node:test\";\nimport { runDeviceFlow } from \"./device-flow.js\";\n\n/** Server-side gateway_url behaviour for a single test case. */\ntype GatewayCase =\n  | { kind: \"value\"; value: string }\n  | { kind: \"absent\" };\n\n/**\n * Stand up a loopback HTTP server implementing both device-flow endpoints.\n * `/api/device/code` returns a code payload; `/api/device/token` returns an\n * approved response whose `gateway_url` field is shaped per `gatewayCase`.\n */\nfunction startDeviceServer(gatewayCase: GatewayCase): Promise<{ server: Server; baseUrl: string }> {\n  const server = createServer((req, res) => {\n    let body = \"\";\n    req.setEncoding(\"utf8\");\n    req.on(\"data\", (chunk) => {\n      body += chunk;\n    });\n    req.on(\"end\", () => {\n      if (req.url === \"/api/device/code\") {\n        res.writeHead(200, { \"content-type\": \"application/json\" });\n        res.end(JSON.stringify({\n          userCode: \"ABCD-1234\",\n          deviceCode: \"device-code-fixture\",\n          verificationUriComplete: \"https://example.test/verify?code=ABCD-1234\",\n          expiresIn: 600,\n        }));\n        return;\n      }\n      if (req.url === \"/api/device/token\") {\n        const approved: Record<string, unknown> = {\n          status: \"approved\",\n          token: \"device-token-fixture\",\n          runtimeId: \"rt-fixture\",\n        };\n        if (gatewayCase.kind === \"value\") {\n          approved[\"gateway_url\"] = gatewayCase.value;\n        }\n        res.writeHead(200, { \"content-type\": \"application/json\" });\n        res.end(JSON.stringify(approved));\n        return;\n      }\n      res.writeHead(404, { \"content-type\": \"application/json\" });\n      res.end(JSON.stringify({ error: \"not found\" }));\n    });\n  });\n\n  return new Promise((resolve, reject) => {\n    server.once(\"error\", reject);\n    server.listen(0, \"127.0.0.1\", () => {\n      const address = server.address();\n      if (!address || typeof address !== \"object\") {\n        reject(new Error(\"failed to bind loopback test server\"));\n        return;\n      }\n      resolve({ server, baseUrl: `http://127.0.0.1:${address.port}` });\n    });\n  });\n}\n\nfunction closeServer(server: Server): Promise<void> {\n  return new Promise((resolve, reject) => server.close((err) => (err ? reject(err) : resolve())));\n}\n\n/** Capture stderr writes so the invalid-URL warning can be asserted. */\nfunction captureStderr(): { restore: () => void; output: () => string } {\n  const original = process.stderr.write.bind(process.stderr);\n  let captured = \"\";\n  (process.stderr as unknown as { write: typeof process.stderr.write }).write = ((chunk: unknown) => {\n    captured += typeof chunk === \"string\" ? chunk : String(chunk);\n    return true;\n  }) as typeof process.stderr.write;\n  return {\n    restore: () => {\n      (process.stderr as unknown as { write: typeof process.stderr.write }).write = original;\n    },\n    output: () => captured,\n  };\n}\n\nfunction configPathFixture(): string {\n  return join(mkdtempSync(join(tmpdir(), \"gsd-device-flow-\")), \"daemon.yaml\");\n}\n\ntest(\"device flow uses a valid server gateway_url over the passed --gateway\", async (t) => {\n  let started: { server: Server; baseUrl: string };\n  try {\n    // A different, valid loopback URL than the login base — server value should win.\n    const serverGateway = \"https://relay.example/gateway\";\n    started = await startDeviceServer({ kind: \"value\", value: serverGateway });\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EPERM\") {\n      t.skip(\"loopback listen is blocked in this sandbox\");\n      return;\n    }\n    throw err;\n  }\n  try {\n    const result = await runDeviceFlow({\n      gatewayUrl: started.baseUrl,\n      configPath: configPathFixture(),\n      binaryName: \"gsd\",\n    });\n    // Server-returned value wins, normalized (trailing slash stripped from path).\n    assert.equal(result.gatewayUrl, \"https://relay.example/gateway\");\n    assert.notEqual(result.gatewayUrl, started.baseUrl);\n    assert.equal(result.deviceToken, \"device-token-fixture\");\n    assert.equal(result.runtimeId, \"rt-fixture\");\n  } finally {\n    await closeServer(started.server);\n  }\n});\n\ntest(\"device flow falls back to --gateway when server omits gateway_url (backward-compat)\", async (t) => {\n  let started: { server: Server; baseUrl: string };\n  try {\n    started = await startDeviceServer({ kind: \"absent\" });\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EPERM\") {\n      t.skip(\"loopback listen is blocked in this sandbox\");\n      return;\n    }\n    throw err;\n  }\n  try {\n    const result = await runDeviceFlow({\n      gatewayUrl: started.baseUrl,\n      configPath: configPathFixture(),\n      binaryName: \"gsd\",\n    });\n    // Load-bearing invariant: with no server gateway_url, the passed --gateway is preserved.\n    assert.equal(result.gatewayUrl, started.baseUrl);\n    assert.equal(result.deviceToken, \"device-token-fixture\");\n    assert.equal(result.runtimeId, \"rt-fixture\");\n  } finally {\n    await closeServer(started.server);\n  }\n});\n\ntest(\"device flow falls back to --gateway when server gateway_url is invalid (no throw)\", async (t) => {\n  let started: { server: Server; baseUrl: string };\n  try {\n    // A private-IP https URL fails validateGatewayNetworkTarget — must fall back, not crash.\n    started = await startDeviceServer({ kind: \"value\", value: \"https://10.0.0.5/gateway\" });\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EPERM\") {\n      t.skip(\"loopback listen is blocked in this sandbox\");\n      return;\n    }\n    throw err;\n  }\n  const stderr = captureStderr();\n  let capturedWarning = \"\";\n  try {\n    const result = await runDeviceFlow({\n      gatewayUrl: started.baseUrl,\n      configPath: configPathFixture(),\n      binaryName: \"gsd\",\n    });\n    capturedWarning = stderr.output();\n    stderr.restore();\n    // Invalid server value is ignored; passed --gateway is used; login does not throw.\n    assert.equal(result.gatewayUrl, started.baseUrl);\n    assert.match(capturedWarning, /ignoring invalid server-supplied relay URL/);\n  } finally {\n    stderr.restore();\n    await closeServer(started.server);\n  }\n});\n"]}

package/packages/daemon/dist/orchestrator-agent.d.ts

@@ -0,0 +1,21 @@
+import type Anthropic from '@anthropic-ai/sdk';
+import type { MessageParam } from '@anthropic-ai/sdk/resources/messages/messages';
+import { type OrchestratorToolContext } from './orchestrator-tools.js';
+export interface OrchestratorAgentConfig {
+    model: string;
+    max_tokens: number;
+}
+export declare class OrchestratorAgent {
+    private readonly config;
+    private readonly toolContext;
+    private client;
+    private history;
+    constructor(config: OrchestratorAgentConfig, toolContext: OrchestratorToolContext, client?: Anthropic);
+    run(content: string): Promise<string>;
+    getHistory(): MessageParam[];
+    stop(): void;
+    private getClient;
+    private runToolLoop;
+    private trimHistory;
+}
+//# sourceMappingURL=orchestrator-agent.d.ts.map

package/packages/daemon/dist/orchestrator-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator-agent.d.ts","sourceRoot":"","sources":["../src/orchestrator-agent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EACV,YAAY,EAKb,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAqCD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0B;IACtD,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,OAAO,CAAsB;gBAGnC,MAAM,EAAE,uBAAuB,EAC/B,WAAW,EAAE,uBAAuB,EACpC,MAAM,CAAC,EAAE,SAAS;IAOd,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmB3C,UAAU,IAAI,YAAY,EAAE;IAI5B,IAAI,IAAI,IAAI;YAKE,SAAS;YAQT,WAAW;IAkDzB,OAAO,CAAC,WAAW;CAKpB"}

package/packages/daemon/dist/orchestrator-agent.js

@@ -0,0 +1,113 @@
+import { ORCHESTRATOR_TOOLS, executeOrchestratorTool, } from './orchestrator-tools.js';
+const SYSTEM_PROMPT = `You are GSD Control — a concise, capable orchestrator for managing GSD (Git Ship Done) coding agent sessions via Discord.
+
+You have tools to list projects, start sessions, get status, stop sessions, and inspect session details. Use them to fulfill the user's requests.
+
+Response guidelines:
+- Be terse and direct. No filler, no performed enthusiasm.
+- When reporting status, use bullet points with project name, status, duration, and cost.
+- When starting a session, confirm with the project name and session ID.
+- When stopping a session, confirm which session was stopped.
+- If something fails, say what went wrong plainly.
+- Use Discord markdown formatting (bold, code blocks) for readability.
+- Never expose internal error stack traces to the user — summarize the issue.`;
+const MAX_HISTORY = 30;
+const MAX_TOOL_ITERATIONS = 10;
+function resolveAnthropicApiKey() {
+    const apiKey = process.env.ANTHROPIC_API_KEY;
+    if (!apiKey) {
+        throw new Error('ANTHROPIC_API_KEY is required. Set it in your environment or run `gsd config`.');
+    }
+    return apiKey;
+}
+function isAuthError(message) {
+    return (message.includes('authentication') ||
+        message.includes('apiKey') ||
+        message.includes('authToken') ||
+        message.includes('401'));
+}
+export class OrchestratorAgent {
+    config;
+    toolContext;
+    client;
+    history = [];
+    constructor(config, toolContext, client) {
+        this.config = config;
+        this.toolContext = toolContext;
+        this.client = client ?? null;
+    }
+    async run(content) {
+        this.history.push({ role: 'user', content });
+        try {
+            const responseText = await this.runToolLoop();
+            this.history.push({ role: 'assistant', content: responseText });
+            return responseText;
+        }
+        catch (err) {
+            const errorMsg = err instanceof Error ? err.message : String(err);
+            if (isAuthError(errorMsg)) {
+                this.client = null;
+            }
+            this.history.push({ role: 'assistant', content: '[error — see logs]' });
+            throw err;
+        }
+        finally {
+            this.trimHistory();
+        }
+    }
+    getHistory() {
+        return [...this.history];
+    }
+    stop() {
+        this.history = [];
+        this.client = null;
+    }
+    async getClient() {
+        if (this.client)
+            return this.client;
+        const apiKey = resolveAnthropicApiKey();
+        const { default: AnthropicSDK } = await import('@anthropic-ai/sdk');
+        this.client = new AnthropicSDK({ apiKey });
+        return this.client;
+    }
+    async runToolLoop() {
+        const client = await this.getClient();
+        const { model, max_tokens } = this.config;
+        let loopMessages = [...this.history];
+        for (let i = 0; i < MAX_TOOL_ITERATIONS; i++) {
+            const response = await client.messages.create({
+                model,
+                max_tokens,
+                system: SYSTEM_PROMPT,
+                tools: ORCHESTRATOR_TOOLS,
+                messages: loopMessages,
+            });
+            if (response.stop_reason !== 'tool_use') {
+                const textBlocks = response.content.filter((b) => b.type === 'text');
+                return textBlocks.map((b) => b.text).join('\n') || '(No response)';
+            }
+            const toolUseBlocks = response.content.filter((b) => b.type === 'tool_use');
+            const toolResults = [];
+            for (const toolUse of toolUseBlocks) {
+                const result = await executeOrchestratorTool(this.toolContext, toolUse.name, toolUse.input);
+                toolResults.push({
+                    type: 'tool_result',
+                    tool_use_id: toolUse.id,
+                    content: result,
+                });
+            }
+            loopMessages = [
+                ...loopMessages,
+                { role: 'assistant', content: response.content },
+                { role: 'user', content: toolResults },
+            ];
+        }
+        return 'I hit the maximum number of tool iterations. Please try a simpler request.';
+    }
+    trimHistory() {
+        while (this.history.length > MAX_HISTORY) {
+            this.history.splice(0, 2);
+        }
+    }
+}
+//# sourceMappingURL=orchestrator-agent.js.map

package/packages/daemon/dist/orchestrator-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator-agent.js","sourceRoot":"","sources":["../src/orchestrator-agent.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,kBAAkB,EAClB,uBAAuB,GAExB,MAAM,yBAAyB,CAAC;AAOjC,MAAM,aAAa,GAAG;;;;;;;;;;;8EAWwD,CAAC;AAE/E,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,SAAS,sBAAsB;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CACxB,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,iBAAiB;IACX,MAAM,CAA0B;IAChC,WAAW,CAA0B;IAC9C,MAAM,CAAmB;IACzB,OAAO,GAAmB,EAAE,CAAC;IAErC,YACE,MAA+B,EAC/B,WAAoC,EACpC,MAAkB;QAElB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,IAAI,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAE7C,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;YAChE,OAAO,YAAY,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClE,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACrB,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACxE,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,UAAU;QACR,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACpC,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAC;QACxC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAE1C,IAAI,YAAY,GAAmB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAErD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC5C,KAAK;gBACL,UAAU;gBACV,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,kBAAkB;gBACzB,QAAQ,EAAE,YAAY;aACvB,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACxC,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CACxC,CAAC,CAAC,EAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CACzC,CAAC;gBACF,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC;YACrE,CAAC;YAED,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAC3C,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAChD,CAAC;YAEF,MAAM,WAAW,GAA2B,EAAE,CAAC;YAC/C,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,IAAI,CAAC,WAAW,EAChB,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,KAAgC,CACzC,CAAC;gBACF,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,aAAa;oBACnB,WAAW,EAAE,OAAO,CAAC,EAAE;oBACvB,OAAO,EAAE,MAAM;iBAChB,CAAC,CAAC;YACL,CAAC;YAED,YAAY,GAAG;gBACb,GAAG,YAAY;gBACf,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAA8B,EAAE;gBACvE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE;aACvC,CAAC;QACJ,CAAC;QAED,OAAO,4EAA4E,CAAC;IACtF,CAAC;IAEO,WAAW;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;CACF","sourcesContent":["import type Anthropic from '@anthropic-ai/sdk';\nimport type {\n  MessageParam,\n  ContentBlockParam,\n  ToolResultBlockParam,\n  ToolUseBlock,\n  TextBlock,\n} from '@anthropic-ai/sdk/resources/messages/messages';\nimport {\n  ORCHESTRATOR_TOOLS,\n  executeOrchestratorTool,\n  type OrchestratorToolContext,\n} from './orchestrator-tools.js';\n\nexport interface OrchestratorAgentConfig {\n  model: string;\n  max_tokens: number;\n}\n\nconst SYSTEM_PROMPT = `You are GSD Control — a concise, capable orchestrator for managing GSD (Git Ship Done) coding agent sessions via Discord.\n\nYou have tools to list projects, start sessions, get status, stop sessions, and inspect session details. Use them to fulfill the user's requests.\n\nResponse guidelines:\n- Be terse and direct. No filler, no performed enthusiasm.\n- When reporting status, use bullet points with project name, status, duration, and cost.\n- When starting a session, confirm with the project name and session ID.\n- When stopping a session, confirm which session was stopped.\n- If something fails, say what went wrong plainly.\n- Use Discord markdown formatting (bold, code blocks) for readability.\n- Never expose internal error stack traces to the user — summarize the issue.`;\n\nconst MAX_HISTORY = 30;\nconst MAX_TOOL_ITERATIONS = 10;\n\nfunction resolveAnthropicApiKey(): string {\n  const apiKey = process.env.ANTHROPIC_API_KEY;\n  if (!apiKey) {\n    throw new Error(\n      'ANTHROPIC_API_KEY is required. Set it in your environment or run `gsd config`.',\n    );\n  }\n  return apiKey;\n}\n\nfunction isAuthError(message: string): boolean {\n  return (\n    message.includes('authentication') ||\n    message.includes('apiKey') ||\n    message.includes('authToken') ||\n    message.includes('401')\n  );\n}\n\nexport class OrchestratorAgent {\n  private readonly config: OrchestratorAgentConfig;\n  private readonly toolContext: OrchestratorToolContext;\n  private client: Anthropic | null;\n  private history: MessageParam[] = [];\n\n  constructor(\n    config: OrchestratorAgentConfig,\n    toolContext: OrchestratorToolContext,\n    client?: Anthropic,\n  ) {\n    this.config = config;\n    this.toolContext = toolContext;\n    this.client = client ?? null;\n  }\n\n  async run(content: string): Promise<string> {\n    this.history.push({ role: 'user', content });\n\n    try {\n      const responseText = await this.runToolLoop();\n      this.history.push({ role: 'assistant', content: responseText });\n      return responseText;\n    } catch (err) {\n      const errorMsg = err instanceof Error ? err.message : String(err);\n      if (isAuthError(errorMsg)) {\n        this.client = null;\n      }\n      this.history.push({ role: 'assistant', content: '[error — see logs]' });\n      throw err;\n    } finally {\n      this.trimHistory();\n    }\n  }\n\n  getHistory(): MessageParam[] {\n    return [...this.history];\n  }\n\n  stop(): void {\n    this.history = [];\n    this.client = null;\n  }\n\n  private async getClient(): Promise<Anthropic> {\n    if (this.client) return this.client;\n    const apiKey = resolveAnthropicApiKey();\n    const { default: AnthropicSDK } = await import('@anthropic-ai/sdk');\n    this.client = new AnthropicSDK({ apiKey });\n    return this.client;\n  }\n\n  private async runToolLoop(): Promise<string> {\n    const client = await this.getClient();\n    const { model, max_tokens } = this.config;\n\n    let loopMessages: MessageParam[] = [...this.history];\n\n    for (let i = 0; i < MAX_TOOL_ITERATIONS; i++) {\n      const response = await client.messages.create({\n        model,\n        max_tokens,\n        system: SYSTEM_PROMPT,\n        tools: ORCHESTRATOR_TOOLS,\n        messages: loopMessages,\n      });\n\n      if (response.stop_reason !== 'tool_use') {\n        const textBlocks = response.content.filter(\n          (b): b is TextBlock => b.type === 'text',\n        );\n        return textBlocks.map((b) => b.text).join('\\n') || '(No response)';\n      }\n\n      const toolUseBlocks = response.content.filter(\n        (b): b is ToolUseBlock => b.type === 'tool_use',\n      );\n\n      const toolResults: ToolResultBlockParam[] = [];\n      for (const toolUse of toolUseBlocks) {\n        const result = await executeOrchestratorTool(\n          this.toolContext,\n          toolUse.name,\n          toolUse.input as Record<string, unknown>,\n        );\n        toolResults.push({\n          type: 'tool_result',\n          tool_use_id: toolUse.id,\n          content: result,\n        });\n      }\n\n      loopMessages = [\n        ...loopMessages,\n        { role: 'assistant', content: response.content as ContentBlockParam[] },\n        { role: 'user', content: toolResults },\n      ];\n    }\n\n    return 'I hit the maximum number of tool iterations. Please try a simpler request.';\n  }\n\n  private trimHistory(): void {\n    while (this.history.length > MAX_HISTORY) {\n      this.history.splice(0, 2);\n    }\n  }\n}\n"]}

package/packages/daemon/dist/orchestrator-tools.d.ts

@@ -0,0 +1,12 @@
+import type { Tool } from '@anthropic-ai/sdk/resources/messages/messages';
+import type { SessionManager } from './session-manager.js';
+import type { ProjectInfo } from './types.js';
+import type { Logger } from './logger.js';
+export interface OrchestratorToolContext {
+    sessionManager: SessionManager;
+    scanProjects: () => Promise<ProjectInfo[]>;
+    logger: Logger;
+}
+export declare const ORCHESTRATOR_TOOLS: Tool[];
+export declare function executeOrchestratorTool(context: OrchestratorToolContext, name: string, input: Record<string, unknown>): Promise<string>;
+//# sourceMappingURL=orchestrator-tools.d.ts.map

package/packages/daemon/dist/orchestrator-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orchestrator-tools.d.ts","sourceRoot":"","sources":["../src/orchestrator-tools.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,+CAA+C,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,EAAE,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,kBAAkB,EAAE,IAAI,EAqDpC,CAAC;AAeF,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,uBAAuB,EAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,MAAM,CAAC,CAqBjB"}