@opengsd/gsd-pi 1.7.0 → 1.8.1-dev.897b3c90

package/packages/gsd-cloud/dist/cloud-gateway-lookup.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-gateway-lookup.test.d.ts","sourceRoot":"","sources":["../src/cloud-gateway-lookup.test.ts"],"names":[],"mappings":""}

package/packages/gsd-cloud/dist/cloud-gateway-lookup.test.js

@@ -0,0 +1,37 @@
+// Project/App: Open GSD
+// File Purpose: Regression tests for createGatewayLookup — the custom DNS lookup
+// must honor Node's `all: true` (autoSelectFamily/Happy Eyeballs) array form and
+// still enforce the SSRF guard on every resolved address.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createGatewayLookup } from "./cloud-config.js";
+// Invoke the lookup and capture (err, result) from its Node-style callback.
+function run(url, options) {
+    const lookup = createGatewayLookup(new URL(url));
+    return new Promise((resolve) => {
+        lookup("localhost", options, (...args) => resolve({ err: args[0] ?? null, result: args[1] }));
+    });
+}
+test("all:true resolves to an ARRAY for a http loopback URL (regression: was scalar → 'Invalid IP address')", async () => {
+    const { err, result } = await run("http://localhost", { all: true, family: 0 });
+    assert.equal(err, null, "loopback allowed for http URL");
+    assert.ok(Array.isArray(result), "all:true must call back with an array");
+    assert.ok(result.length > 0, "expected at least one address");
+    for (const entry of result) {
+        assert.equal(typeof entry.address, "string");
+        assert.ok(entry.family === 4 || entry.family === 6);
+    }
+});
+test("all:true REJECTS when a resolved address is private/loopback (SSRF guard, https URL)", async () => {
+    const { err } = await run("https://localhost", { all: true, family: 0 });
+    assert.ok(err instanceof Error, "expected rejection");
+    assert.match(err.message, /private or loopback/);
+});
+test("scalar (all:false) path still guards: https loopback rejected, http loopback allowed", async () => {
+    const rejected = await run("https://localhost", { all: false, family: 0 });
+    assert.ok(rejected.err instanceof Error, "https loopback rejected in scalar path");
+    const allowed = await run("http://localhost", { all: false, family: 0 });
+    assert.equal(allowed.err, null, "http loopback allowed in scalar path");
+    assert.equal(typeof allowed.result, "string", "scalar path returns a single address");
+});
+//# sourceMappingURL=cloud-gateway-lookup.test.js.map

package/packages/gsd-cloud/dist/cloud-gateway-lookup.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-gateway-lookup.test.js","sourceRoot":"","sources":["../src/cloud-gateway-lookup.test.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,iFAAiF;AACjF,iFAAiF;AACjF,0DAA0D;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD,4EAA4E;AAC5E,SAAS,GAAG,CAAC,GAAW,EAAE,OAAgB;IACxC,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC5B,MAAoF,CACnF,WAAW,EACX,OAAO,EACP,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAG,IAAI,CAAC,CAAC,CAAkB,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,CAAC,uGAAuG,EAAE,KAAK,IAAI,EAAE;IACvH,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;IACzD,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,uCAAuC,CAAC,CAAC;IAC1E,MAAM,CAAC,EAAE,CAAE,MAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,+BAA+B,CAAC,CAAC;IAC7E,KAAK,MAAM,KAAK,IAAI,MAAoD,EAAE,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;IACtG,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY,KAAK,EAAE,oBAAoB,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,GAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;IACtG,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,YAAY,KAAK,EAAE,wCAAwC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,sCAAsC,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,sCAAsC,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC","sourcesContent":["// Project/App: Open GSD\n// File Purpose: Regression tests for createGatewayLookup — the custom DNS lookup\n// must honor Node's `all: true` (autoSelectFamily/Happy Eyeballs) array form and\n// still enforce the SSRF guard on every resolved address.\nimport { test } from \"node:test\";\nimport assert from \"node:assert/strict\";\nimport { createGatewayLookup } from \"./cloud-config.js\";\n\n// Invoke the lookup and capture (err, result) from its Node-style callback.\nfunction run(url: string, options: unknown): Promise<{ err: Error | null; result: unknown }> {\n  const lookup = createGatewayLookup(new URL(url));\n  return new Promise((resolve) => {\n    (lookup as unknown as (h: string, o: unknown, cb: (...a: unknown[]) => void) => void)(\n      \"localhost\",\n      options,\n      (...args: unknown[]) => resolve({ err: (args[0] as Error | null) ?? null, result: args[1] }),\n    );\n  });\n}\n\ntest(\"all:true resolves to an ARRAY for a http loopback URL (regression: was scalar → 'Invalid IP address')\", async () => {\n  const { err, result } = await run(\"http://localhost\", { all: true, family: 0 });\n  assert.equal(err, null, \"loopback allowed for http URL\");\n  assert.ok(Array.isArray(result), \"all:true must call back with an array\");\n  assert.ok((result as unknown[]).length > 0, \"expected at least one address\");\n  for (const entry of result as Array<{ address: string; family: number }>) {\n    assert.equal(typeof entry.address, \"string\");\n    assert.ok(entry.family === 4 || entry.family === 6);\n  }\n});\n\ntest(\"all:true REJECTS when a resolved address is private/loopback (SSRF guard, https URL)\", async () => {\n  const { err } = await run(\"https://localhost\", { all: true, family: 0 });\n  assert.ok(err instanceof Error, \"expected rejection\");\n  assert.match(err!.message, /private or loopback/);\n});\n\ntest(\"scalar (all:false) path still guards: https loopback rejected, http loopback allowed\", async () => {\n  const rejected = await run(\"https://localhost\", { all: false, family: 0 });\n  assert.ok(rejected.err instanceof Error, \"https loopback rejected in scalar path\");\n  const allowed = await run(\"http://localhost\", { all: false, family: 0 });\n  assert.equal(allowed.err, null, \"http loopback allowed in scalar path\");\n  assert.equal(typeof allowed.result, \"string\", \"scalar path returns a single address\");\n});\n"]}

package/packages/gsd-cloud/dist/cloud-runtime.d.ts

@@ -0,0 +1,35 @@
+import type { Logger } from "./logger.js";
+import type { DaemonConfig } from "./types.js";
+import type { Executor } from "./executors/executor.js";
+export declare class CloudRuntime {
+    private readonly cloud;
+    private readonly executor;
+    private readonly logger;
+    private static readonly MAX_OUTBOX;
+    private static readonly RECONNECT_DELAY_MS;
+    private static readonly MAX_INITIAL_CONNECT_ATTEMPTS;
+    private static readonly INITIAL_CONNECT_HANDSHAKE_TIMEOUT_MS;
+    private socket;
+    private heartbeat;
+    private reconnect;
+    private readonly inFlight;
+    private outbox;
+    private stopped;
+    private firstConnectDeferred;
+    private initialConnectAttempts;
+    constructor(cloud: NonNullable<DaemonConfig["cloud"]>, executor: Executor, logger: Logger);
+    start(): Promise<void>;
+    stop(): void;
+    private connect;
+    private handleSocketOpen;
+    private handleSocketMessage;
+    private handleSocketClose;
+    private handleSocketError;
+    private advertiseProjects;
+    private handleMessage;
+    private cancelInFlight;
+    private resolveFirstConnect;
+    private rejectFirstConnect;
+    private send;
+}
+//# sourceMappingURL=cloud-runtime.d.ts.map

package/packages/gsd-cloud/dist/cloud-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-runtime.d.ts","sourceRoot":"","sources":["../src/cloud-runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAWxD,qBAAa,YAAY;IAoBrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IArBzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAO;IACzC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAMnD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAK;IACzD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oCAAoC,CAAU;IACtE,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,SAAS,CAA6C;IAC9D,OAAO,CAAC,SAAS,CAA4C;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAC9D,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,oBAAoB,CAAyC;IACrE,OAAO,CAAC,sBAAsB,CAAK;gBAGhB,KAAK,EAAE,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EACzC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM;IAGjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtB,IAAI,IAAI,IAAI;IAcZ,OAAO,CAAC,OAAO;IAkDf,OAAO,CAAC,gBAAgB;YAmBV,mBAAmB;IAKjC,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,iBAAiB;YAKX,iBAAiB;YAUjB,aAAa;YA6Bb,cAAc;IAqB5B,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,IAAI;CAcb"}

package/packages/gsd-cloud/dist/cloud-runtime.js

@@ -0,0 +1,258 @@
+import WebSocket from "ws";
+import { createGatewayLookup, parseCloudGatewayUrl, validateGatewayNetworkTarget } from "./cloud-config.js";
+export class CloudRuntime {
+    cloud;
+    executor;
+    logger;
+    static MAX_OUTBOX = 200;
+    static RECONNECT_DELAY_MS = 5_000;
+    // How many times to retry the initial connect before rejecting start(). A
+    // transient handshake failure (gateway briefly unreachable, DNS hiccup) should
+    // retry like the daemon's reconnect loop rather than kill the runtime; a
+    // persistent failure (gateway down, session rejected) must eventually reject so
+    // the CLI reports an error instead of hanging or exiting silently.
+    static MAX_INITIAL_CONNECT_ATTEMPTS = 5;
+    static INITIAL_CONNECT_HANDSHAKE_TIMEOUT_MS = 30_000;
+    socket;
+    heartbeat;
+    reconnect;
+    inFlight = new Map();
+    outbox = [];
+    stopped = false;
+    firstConnectDeferred;
+    initialConnectAttempts = 0;
+    constructor(cloud, executor, logger) {
+        this.cloud = cloud;
+        this.executor = executor;
+        this.logger = logger;
+    }
+    start() {
+        this.stopped = false;
+        this.initialConnectAttempts = 0;
+        this.firstConnectDeferred = Promise.withResolvers();
+        this.connect();
+        return this.firstConnectDeferred.promise;
+    }
+    stop() {
+        this.stopped = true;
+        this.rejectFirstConnect(new Error("cloud runtime stopped"));
+        if (this.reconnect)
+            clearTimeout(this.reconnect);
+        this.reconnect = undefined;
+        if (this.heartbeat)
+            clearInterval(this.heartbeat);
+        this.heartbeat = undefined;
+        this.inFlight.clear();
+        this.outbox = [];
+        const socket = this.socket;
+        this.socket = undefined;
+        socket?.close();
+    }
+    connect() {
+        if (this.reconnect)
+            clearTimeout(this.reconnect);
+        this.reconnect = undefined;
+        if (!this.cloud.device_token || !this.cloud.runtime_id) {
+            this.logger.warn("cloud runtime skipped — missing device token or runtime id");
+            this.rejectFirstConnect(new Error("cloud runtime missing device token or runtime id"));
+            return;
+        }
+        const gatewayUrl = parseCloudGatewayUrl(this.cloud.gateway_url);
+        try {
+            validateGatewayNetworkTarget(gatewayUrl);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            this.logger.warn("cloud runtime skipped unsafe gateway URL", { error: message });
+            this.rejectFirstConnect(new Error(`cloud runtime unsafe gateway URL: ${message}`));
+            return;
+        }
+        const url = new URL("/runtime/connect", gatewayUrl);
+        url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+        const socket = new WebSocket(url, {
+            headers: { Authorization: `Bearer ${this.cloud.device_token}` },
+            lookup: createGatewayLookup(gatewayUrl),
+            handshakeTimeout: CloudRuntime.INITIAL_CONNECT_HANDSHAKE_TIMEOUT_MS,
+        });
+        const previousSocket = this.socket;
+        this.socket = socket;
+        if (previousSocket) {
+            // Detach the old socket's handlers before closing so its listeners don't
+            // linger on a socket we've already replaced (handlers also guard on
+            // identity, but this releases them eagerly for GC).
+            previousSocket.removeAllListeners();
+            if (previousSocket.readyState !== WebSocket.CLOSING && previousSocket.readyState !== WebSocket.CLOSED) {
+                previousSocket.close();
+            }
+        }
+        socket.on("open", () => {
+            this.handleSocketOpen(socket);
+        });
+        socket.on("message", (data) => {
+            void this.handleSocketMessage(socket, data.toString("utf8"));
+        });
+        socket.on("close", () => {
+            this.handleSocketClose(socket);
+        });
+        socket.on("error", (err) => {
+            this.handleSocketError(socket, err);
+        });
+    }
+    handleSocketOpen(socket) {
+        if (socket !== this.socket)
+            return;
+        this.resolveFirstConnect();
+        this.logger.info("cloud runtime connected", { gateway_url: this.cloud.gateway_url, runtime_id: this.cloud.runtime_id });
+        // Re-advertise projects (async: the hello is sent on a later microtask), then
+        // drain any messages buffered while disconnected. tool_results route by
+        // requestId on the authenticated connection, so drain order vs the hello is
+        // not significant.
+        void this.advertiseProjects();
+        const pending = this.outbox;
+        this.outbox = [];
+        for (const text of pending) {
+            if (this.socket?.readyState === WebSocket.OPEN)
+                this.socket.send(text);
+            else
+                this.outbox.push(text);
+        }
+        if (this.heartbeat)
+            clearInterval(this.heartbeat);
+        this.heartbeat = setInterval(() => this.send({ type: "heartbeat", at: Date.now() }), 30_000);
+    }
+    async handleSocketMessage(socket, text) {
+        if (socket !== this.socket)
+            return;
+        await this.handleMessage(text);
+    }
+    handleSocketClose(socket) {
+        if (socket !== this.socket)
+            return;
+        if (this.heartbeat)
+            clearInterval(this.heartbeat);
+        this.heartbeat = undefined;
+        this.socket = undefined;
+        if (this.stopped)
+            return;
+        if (this.firstConnectDeferred) {
+            // Still trying to establish the first connection: retry transient
+            // handshake failures (like the daemon's reconnect loop) and only reject
+            // start() once the bounded attempts are exhausted, so a brief blip does
+            // not kill the runtime while a persistent outage still surfaces an error.
+            this.initialConnectAttempts += 1;
+            if (this.initialConnectAttempts >= CloudRuntime.MAX_INITIAL_CONNECT_ATTEMPTS) {
+                this.rejectFirstConnect(new Error(`cloud runtime connection failed after ${this.initialConnectAttempts} attempt(s)`));
+                return;
+            }
+            this.logger.warn("cloud runtime initial connect failed; retrying", {
+                attempt: this.initialConnectAttempts,
+                max: CloudRuntime.MAX_INITIAL_CONNECT_ATTEMPTS,
+            });
+        }
+        else {
+            this.logger.warn("cloud runtime disconnected; reconnecting");
+        }
+        if (this.reconnect)
+            clearTimeout(this.reconnect);
+        this.reconnect = setTimeout(() => this.connect(), CloudRuntime.RECONNECT_DELAY_MS);
+    }
+    handleSocketError(socket, err) {
+        if (socket !== this.socket)
+            return;
+        this.logger.warn("cloud runtime socket error", { error: err.message });
+    }
+    async advertiseProjects() {
+        const projects = await this.executor.advertisedProjects();
+        this.send({
+            type: "hello",
+            runtimeId: this.cloud.runtime_id,
+            runtimeName: this.cloud.runtime_name,
+            projects,
+        });
+    }
+    async handleMessage(text) {
+        let message;
+        try {
+            message = JSON.parse(text);
+        }
+        catch {
+            return;
+        }
+        if (message.type === "cancel" && message.requestId) {
+            void this.cancelInFlight(message.requestId);
+            return;
+        }
+        if (message.type !== "tool_call" || !message.requestId || !message.toolName)
+            return;
+        this.inFlight.set(message.requestId, message);
+        try {
+            const result = await this.executor.execute(message.toolName, message.args ?? {}, message.projectAlias);
+            if (!this.inFlight.has(message.requestId))
+                return;
+            this.send({ type: "tool_result", requestId: message.requestId, result });
+        }
+        catch (err) {
+            if (!this.inFlight.has(message.requestId))
+                return;
+            this.send({
+                type: "tool_result",
+                requestId: message.requestId,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+        finally {
+            this.inFlight.delete(message.requestId);
+        }
+    }
+    async cancelInFlight(requestId) {
+        const pending = this.inFlight.get(requestId);
+        if (!pending)
+            return;
+        this.inFlight.delete(requestId);
+        try {
+            if (typeof pending.args?.sessionId === "string") {
+                await this.executor.execute("gsd_cancel", { sessionId: pending.args.sessionId }, pending.projectAlias);
+                return;
+            }
+            const projectDir = typeof pending.args?.projectDir === "string" ? pending.args.projectDir : pending.projectAlias;
+            if (projectDir) {
+                await this.executor.execute("gsd_cancel", { projectDir });
+            }
+        }
+        catch (err) {
+            this.logger.warn("cloud runtime cancel failed", {
+                requestId,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    resolveFirstConnect() {
+        const deferred = this.firstConnectDeferred;
+        if (!deferred)
+            return;
+        this.firstConnectDeferred = undefined;
+        deferred.resolve();
+    }
+    rejectFirstConnect(err) {
+        const deferred = this.firstConnectDeferred;
+        if (!deferred)
+            return;
+        this.firstConnectDeferred = undefined;
+        deferred.reject(err);
+    }
+    send(message) {
+        const text = JSON.stringify(message);
+        if (this.socket?.readyState === WebSocket.OPEN) {
+            this.socket.send(text);
+            return;
+        }
+        // Buffer while disconnected; flushed on reconnect in handleSocketOpen. Bounded
+        // so a long outage cannot grow memory without limit — a stale heartbeat is
+        // worth less than a fresh tool_result, so drop oldest first.
+        this.outbox.push(text);
+        if (this.outbox.length > CloudRuntime.MAX_OUTBOX) {
+            this.outbox.shift();
+        }
+    }
+}
+//# sourceMappingURL=cloud-runtime.js.map

package/packages/gsd-cloud/dist/cloud-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-runtime.js","sourceRoot":"","sources":["../src/cloud-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,IAAI,CAAC;AAI3B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAU5G,MAAM,OAAO,YAAY;IAoBJ;IACA;IACA;IArBX,MAAM,CAAU,UAAU,GAAG,GAAG,CAAC;IACjC,MAAM,CAAU,kBAAkB,GAAG,KAAK,CAAC;IACnD,0EAA0E;IAC1E,+EAA+E;IAC/E,yEAAyE;IACzE,gFAAgF;IAChF,mEAAmE;IAC3D,MAAM,CAAU,4BAA4B,GAAG,CAAC,CAAC;IACjD,MAAM,CAAU,oCAAoC,GAAG,MAAM,CAAC;IAC9D,MAAM,CAAwB;IAC9B,SAAS,CAA6C;IACtD,SAAS,CAA4C;IAC5C,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACtD,MAAM,GAAa,EAAE,CAAC;IACtB,OAAO,GAAG,KAAK,CAAC;IAChB,oBAAoB,CAAyC;IAC7D,sBAAsB,GAAG,CAAC,CAAC;IAEnC,YACmB,KAAyC,EACzC,QAAkB,EAClB,MAAc;QAFd,UAAK,GAAL,KAAK,CAAoC;QACzC,aAAQ,GAAR,QAAQ,CAAU;QAClB,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,sBAAsB,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;IAC3C,CAAC;IAED,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,IAAI,CAAC,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,MAAM,EAAE,KAAK,EAAE,CAAC;IAClB,CAAC;IAEO,OAAO;QACb,IAAI,IAAI,CAAC,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;YAC/E,IAAI,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACjF,IAAI,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QACpD,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE;YAC/D,MAAM,EAAE,mBAAmB,CAAC,UAAU,CAAC;YACvC,gBAAgB,EAAE,YAAY,CAAC,oCAAoC;SACpE,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,cAAc,EAAE,CAAC;YACnB,yEAAyE;YACzE,oEAAoE;YACpE,oDAAoD;YACpD,cAAc,CAAC,kBAAkB,EAAE,CAAC;YACpC,IAAI,cAAc,CAAC,UAAU,KAAK,SAAS,CAAC,OAAO,IAAI,cAAc,CAAC,UAAU,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;gBACtG,cAAc,CAAC,KAAK,EAAE,CAAC;YACzB,CAAC;QACH,CAAC;QAED,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACrB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5B,KAAK,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,MAAiB;QACxC,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QACnC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QACxH,8EAA8E;QAC9E,wEAAwE;QACxE,4EAA4E;QAC5E,mBAAmB;QACnB,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,IAAI,CAAC,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/F,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,MAAiB,EAAE,IAAY;QAC/D,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QACnC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAEO,iBAAiB,CAAC,MAAiB;QACzC,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QACnC,IAAI,IAAI,CAAC,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,kEAAkE;YAClE,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E;YAC1E,IAAI,CAAC,sBAAsB,IAAI,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,sBAAsB,IAAI,YAAY,CAAC,4BAA4B,EAAE,CAAC;gBAC7E,IAAI,CAAC,kBAAkB,CACrB,IAAI,KAAK,CACP,yCAAyC,IAAI,CAAC,sBAAsB,aAAa,CAClF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gBACjE,OAAO,EAAE,IAAI,CAAC,sBAAsB;gBACpC,GAAG,EAAE,YAAY,CAAC,4BAA4B;aAC/C,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,IAAI,CAAC,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,kBAAkB,CAAC,CAAC;IACrF,CAAC;IAEO,iBAAiB,CAAC,MAAiB,EAAE,GAAU;QACrD,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;YAChC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACpC,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAY;QACtC,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACnD,KAAK,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO;QACpF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YACvG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,OAAO;YAClD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,OAAO;YAClD,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,aAAa;gBACnB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,SAAiB;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAChD,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;gBACvG,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,OAAO,OAAO,CAAC,IAAI,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;YACjH,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBAC9C,SAAS;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,mBAAmB;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,oBAAoB,GAAG,SAAS,CAAC;QACtC,QAAQ,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;IAEO,kBAAkB,CAAC,GAAU;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,oBAAoB,GAAG,SAAS,CAAC;QACtC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAEO,IAAI,CAAC,OAAgB;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,+EAA+E;QAC/E,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;IACH,CAAC","sourcesContent":["import WebSocket from \"ws\";\nimport type { Logger } from \"./logger.js\";\nimport type { DaemonConfig } from \"./types.js\";\nimport type { Executor } from \"./executors/executor.js\";\nimport { createGatewayLookup, parseCloudGatewayUrl, validateGatewayNetworkTarget } from \"./cloud-config.js\";\n\ninterface GatewayMessage {\n  type: string;\n  requestId?: string;\n  toolName?: string;\n  args?: Record<string, unknown>;\n  projectAlias?: string;\n}\n\nexport class CloudRuntime {\n  private static readonly MAX_OUTBOX = 200;\n  private static readonly RECONNECT_DELAY_MS = 5_000;\n  // How many times to retry the initial connect before rejecting start(). A\n  // transient handshake failure (gateway briefly unreachable, DNS hiccup) should\n  // retry like the daemon's reconnect loop rather than kill the runtime; a\n  // persistent failure (gateway down, session rejected) must eventually reject so\n  // the CLI reports an error instead of hanging or exiting silently.\n  private static readonly MAX_INITIAL_CONNECT_ATTEMPTS = 5;\n  private static readonly INITIAL_CONNECT_HANDSHAKE_TIMEOUT_MS = 30_000;\n  private socket: WebSocket | undefined;\n  private heartbeat: ReturnType<typeof setInterval> | undefined;\n  private reconnect: ReturnType<typeof setTimeout> | undefined;\n  private readonly inFlight = new Map<string, GatewayMessage>();\n  private outbox: string[] = [];\n  private stopped = false;\n  private firstConnectDeferred: PromiseWithResolvers<void> | undefined;\n  private initialConnectAttempts = 0;\n\n  constructor(\n    private readonly cloud: NonNullable<DaemonConfig[\"cloud\"]>,\n    private readonly executor: Executor,\n    private readonly logger: Logger,\n  ) {}\n\n  start(): Promise<void> {\n    this.stopped = false;\n    this.initialConnectAttempts = 0;\n    this.firstConnectDeferred = Promise.withResolvers<void>();\n    this.connect();\n    return this.firstConnectDeferred.promise;\n  }\n\n  stop(): void {\n    this.stopped = true;\n    this.rejectFirstConnect(new Error(\"cloud runtime stopped\"));\n    if (this.reconnect) clearTimeout(this.reconnect);\n    this.reconnect = undefined;\n    if (this.heartbeat) clearInterval(this.heartbeat);\n    this.heartbeat = undefined;\n    this.inFlight.clear();\n    this.outbox = [];\n    const socket = this.socket;\n    this.socket = undefined;\n    socket?.close();\n  }\n\n  private connect(): void {\n    if (this.reconnect) clearTimeout(this.reconnect);\n    this.reconnect = undefined;\n    if (!this.cloud.device_token || !this.cloud.runtime_id) {\n      this.logger.warn(\"cloud runtime skipped — missing device token or runtime id\");\n      this.rejectFirstConnect(new Error(\"cloud runtime missing device token or runtime id\"));\n      return;\n    }\n    const gatewayUrl = parseCloudGatewayUrl(this.cloud.gateway_url);\n    try {\n      validateGatewayNetworkTarget(gatewayUrl);\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      this.logger.warn(\"cloud runtime skipped unsafe gateway URL\", { error: message });\n      this.rejectFirstConnect(new Error(`cloud runtime unsafe gateway URL: ${message}`));\n      return;\n    }\n    const url = new URL(\"/runtime/connect\", gatewayUrl);\n    url.protocol = url.protocol === \"https:\" ? \"wss:\" : \"ws:\";\n    const socket = new WebSocket(url, {\n      headers: { Authorization: `Bearer ${this.cloud.device_token}` },\n      lookup: createGatewayLookup(gatewayUrl),\n      handshakeTimeout: CloudRuntime.INITIAL_CONNECT_HANDSHAKE_TIMEOUT_MS,\n    });\n    const previousSocket = this.socket;\n    this.socket = socket;\n    if (previousSocket) {\n      // Detach the old socket's handlers before closing so its listeners don't\n      // linger on a socket we've already replaced (handlers also guard on\n      // identity, but this releases them eagerly for GC).\n      previousSocket.removeAllListeners();\n      if (previousSocket.readyState !== WebSocket.CLOSING && previousSocket.readyState !== WebSocket.CLOSED) {\n        previousSocket.close();\n      }\n    }\n\n    socket.on(\"open\", () => {\n      this.handleSocketOpen(socket);\n    });\n    socket.on(\"message\", (data) => {\n      void this.handleSocketMessage(socket, data.toString(\"utf8\"));\n    });\n    socket.on(\"close\", () => {\n      this.handleSocketClose(socket);\n    });\n    socket.on(\"error\", (err) => {\n      this.handleSocketError(socket, err);\n    });\n  }\n\n  private handleSocketOpen(socket: WebSocket): void {\n    if (socket !== this.socket) return;\n    this.resolveFirstConnect();\n    this.logger.info(\"cloud runtime connected\", { gateway_url: this.cloud.gateway_url, runtime_id: this.cloud.runtime_id });\n    // Re-advertise projects (async: the hello is sent on a later microtask), then\n    // drain any messages buffered while disconnected. tool_results route by\n    // requestId on the authenticated connection, so drain order vs the hello is\n    // not significant.\n    void this.advertiseProjects();\n    const pending = this.outbox;\n    this.outbox = [];\n    for (const text of pending) {\n      if (this.socket?.readyState === WebSocket.OPEN) this.socket.send(text);\n      else this.outbox.push(text);\n    }\n    if (this.heartbeat) clearInterval(this.heartbeat);\n    this.heartbeat = setInterval(() => this.send({ type: \"heartbeat\", at: Date.now() }), 30_000);\n  }\n\n  private async handleSocketMessage(socket: WebSocket, text: string): Promise<void> {\n    if (socket !== this.socket) return;\n    await this.handleMessage(text);\n  }\n\n  private handleSocketClose(socket: WebSocket): void {\n    if (socket !== this.socket) return;\n    if (this.heartbeat) clearInterval(this.heartbeat);\n    this.heartbeat = undefined;\n    this.socket = undefined;\n    if (this.stopped) return;\n    if (this.firstConnectDeferred) {\n      // Still trying to establish the first connection: retry transient\n      // handshake failures (like the daemon's reconnect loop) and only reject\n      // start() once the bounded attempts are exhausted, so a brief blip does\n      // not kill the runtime while a persistent outage still surfaces an error.\n      this.initialConnectAttempts += 1;\n      if (this.initialConnectAttempts >= CloudRuntime.MAX_INITIAL_CONNECT_ATTEMPTS) {\n        this.rejectFirstConnect(\n          new Error(\n            `cloud runtime connection failed after ${this.initialConnectAttempts} attempt(s)`,\n          ),\n        );\n        return;\n      }\n      this.logger.warn(\"cloud runtime initial connect failed; retrying\", {\n        attempt: this.initialConnectAttempts,\n        max: CloudRuntime.MAX_INITIAL_CONNECT_ATTEMPTS,\n      });\n    } else {\n      this.logger.warn(\"cloud runtime disconnected; reconnecting\");\n    }\n    if (this.reconnect) clearTimeout(this.reconnect);\n    this.reconnect = setTimeout(() => this.connect(), CloudRuntime.RECONNECT_DELAY_MS);\n  }\n\n  private handleSocketError(socket: WebSocket, err: Error): void {\n    if (socket !== this.socket) return;\n    this.logger.warn(\"cloud runtime socket error\", { error: err.message });\n  }\n\n  private async advertiseProjects(): Promise<void> {\n    const projects = await this.executor.advertisedProjects();\n    this.send({\n      type: \"hello\",\n      runtimeId: this.cloud.runtime_id,\n      runtimeName: this.cloud.runtime_name,\n      projects,\n    });\n  }\n\n  private async handleMessage(text: string): Promise<void> {\n    let message: GatewayMessage;\n    try {\n      message = JSON.parse(text) as GatewayMessage;\n    } catch {\n      return;\n    }\n    if (message.type === \"cancel\" && message.requestId) {\n      void this.cancelInFlight(message.requestId);\n      return;\n    }\n    if (message.type !== \"tool_call\" || !message.requestId || !message.toolName) return;\n    this.inFlight.set(message.requestId, message);\n    try {\n      const result = await this.executor.execute(message.toolName, message.args ?? {}, message.projectAlias);\n      if (!this.inFlight.has(message.requestId)) return;\n      this.send({ type: \"tool_result\", requestId: message.requestId, result });\n    } catch (err) {\n      if (!this.inFlight.has(message.requestId)) return;\n      this.send({\n        type: \"tool_result\",\n        requestId: message.requestId,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    } finally {\n      this.inFlight.delete(message.requestId);\n    }\n  }\n\n  private async cancelInFlight(requestId: string): Promise<void> {\n    const pending = this.inFlight.get(requestId);\n    if (!pending) return;\n    this.inFlight.delete(requestId);\n    try {\n      if (typeof pending.args?.sessionId === \"string\") {\n        await this.executor.execute(\"gsd_cancel\", { sessionId: pending.args.sessionId }, pending.projectAlias);\n        return;\n      }\n      const projectDir = typeof pending.args?.projectDir === \"string\" ? pending.args.projectDir : pending.projectAlias;\n      if (projectDir) {\n        await this.executor.execute(\"gsd_cancel\", { projectDir });\n      }\n    } catch (err) {\n      this.logger.warn(\"cloud runtime cancel failed\", {\n        requestId,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  private resolveFirstConnect(): void {\n    const deferred = this.firstConnectDeferred;\n    if (!deferred) return;\n    this.firstConnectDeferred = undefined;\n    deferred.resolve();\n  }\n\n  private rejectFirstConnect(err: Error): void {\n    const deferred = this.firstConnectDeferred;\n    if (!deferred) return;\n    this.firstConnectDeferred = undefined;\n    deferred.reject(err);\n  }\n\n  private send(message: unknown): void {\n    const text = JSON.stringify(message);\n    if (this.socket?.readyState === WebSocket.OPEN) {\n      this.socket.send(text);\n      return;\n    }\n    // Buffer while disconnected; flushed on reconnect in handleSocketOpen. Bounded\n    // so a long outage cannot grow memory without limit — a stale heartbeat is\n    // worth less than a fresh tool_result, so drop oldest first.\n    this.outbox.push(text);\n    if (this.outbox.length > CloudRuntime.MAX_OUTBOX) {\n      this.outbox.shift();\n    }\n  }\n}\n"]}

package/packages/gsd-cloud/dist/cloud-runtime.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cloud-runtime.test.d.ts.map

package/packages/gsd-cloud/dist/cloud-runtime.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-runtime.test.d.ts","sourceRoot":"","sources":["../src/cloud-runtime.test.ts"],"names":[],"mappings":""}

package/packages/gsd-cloud/dist/cloud-runtime.test.js

@@ -0,0 +1,88 @@
+// Project/App: Open GSD
+// File Purpose: Regression tests for CloudRuntime.start()'s first-connect promise
+// — it must resolve only once the relay is actually up and reject on connect
+// failure, so the CLI never reports "connected" for a socket that never opened.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import WebSocket from "ws";
+import { CloudRuntime } from "./cloud-runtime.js";
+const noopLogger = { info: () => undefined, warn: () => undefined, error: () => undefined, debug: () => undefined };
+const noopExecutor = { execute: async () => ({}), advertisedProjects: async () => [] };
+function makeRuntime(cloud = {}) {
+    return new CloudRuntime({ gateway_url: "wss://cloud.example.net", device_token: "fixture", runtime_id: "runtime", ...cloud }, noopExecutor, noopLogger);
+}
+function fakeSocket(readyState = WebSocket.OPEN) {
+    const sent = [];
+    return { readyState, sent, send: (t) => sent.push(t), close: () => undefined };
+}
+test("start()'s first-connect promise resolves only when the relay socket opens", async () => {
+    const runtime = makeRuntime();
+    const internals = runtime;
+    try {
+        const deferred = Promise.withResolvers();
+        internals.firstConnectDeferred = deferred;
+        const socket = fakeSocket();
+        internals.socket = socket;
+        let settled = false;
+        void deferred.promise.then(() => (settled = true));
+        await Promise.resolve(); // let any premature settle flush
+        assert.equal(settled, false, "promise must not resolve before the socket opens");
+        internals.handleSocketOpen(socket);
+        await deferred.promise; // resolves — otherwise this hangs/throws
+    }
+    finally {
+        runtime.stop();
+    }
+});
+test("an early socket close retries instead of rejecting while attempts remain", async () => {
+    const runtime = makeRuntime();
+    const internals = runtime;
+    try {
+        const deferred = Promise.withResolvers();
+        internals.firstConnectDeferred = deferred;
+        const socket = fakeSocket();
+        internals.socket = socket;
+        let settled = false;
+        void deferred.promise.then(() => (settled = true), () => (settled = true));
+        internals.handleSocketClose(socket); // first transient failure
+        await Promise.resolve();
+        assert.equal(settled, false, "a single early close must not settle start()");
+        assert.equal(internals.initialConnectAttempts, 1);
+        assert.notEqual(internals.reconnect, undefined, "a reconnect must be scheduled");
+    }
+    finally {
+        runtime.stop();
+    }
+});
+test("start()'s first-connect promise rejects once the initial connect attempts are exhausted", async () => {
+    const runtime = makeRuntime();
+    const internals = runtime;
+    try {
+        const deferred = Promise.withResolvers();
+        internals.firstConnectDeferred = deferred;
+        // Simulate having already burned every retry but the last so the next close
+        // is the one that must give up and reject.
+        internals.initialConnectAttempts = 4;
+        const socket = fakeSocket();
+        internals.socket = socket;
+        internals.handleSocketClose(socket);
+        await assert.rejects(deferred.promise, /connection failed/);
+    }
+    finally {
+        runtime.stop();
+    }
+});
+test("connect() rejects the first-connect promise when the device token is missing", async () => {
+    const runtime = makeRuntime({ device_token: "" });
+    const internals = runtime;
+    try {
+        const deferred = Promise.withResolvers();
+        internals.firstConnectDeferred = deferred;
+        internals.connect();
+        await assert.rejects(deferred.promise, /missing device token/);
+    }
+    finally {
+        runtime.stop();
+    }
+});
+//# sourceMappingURL=cloud-runtime.test.js.map

package/packages/gsd-cloud/dist/cloud-runtime.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-runtime.test.js","sourceRoot":"","sources":["../src/cloud-runtime.test.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,kFAAkF;AAClF,6EAA6E;AAC7E,gFAAgF;AAChF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AACpH,MAAM,YAAY,GAAG,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;AAEvF,SAAS,WAAW,CAAC,QAAiC,EAAE;IACtD,OAAO,IAAI,YAAY,CACrB,EAAE,WAAW,EAAE,yBAAyB,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,KAAK,EAAW,EAC7G,YAAqB,EACrB,UAAmB,CACpB,CAAC;AACJ,CAAC;AAGD,SAAS,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,IAAI;IAC7C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AACzF,CAAC;AAWD,IAAI,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;IAC3F,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAsC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;QAC/C,SAAS,CAAC,oBAAoB,GAAG,QAAQ,CAAC;QAC1C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;QAE1B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,iCAAiC;QAC1D,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,kDAAkD,CAAC,CAAC;QAEjF,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,yCAAyC;IACnE,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,EAAE,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAsC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;QAC/C,SAAS,CAAC,oBAAoB,GAAG,QAAQ,CAAC;QAC1C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;QAE1B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;QAE3E,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B;QAC/D,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,8CAA8C,CAAC,CAAC;QAC7E,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,+BAA+B,CAAC,CAAC;IACnF,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,EAAE,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;IACzG,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAsC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;QAC/C,SAAS,CAAC,oBAAoB,GAAG,QAAQ,CAAC;QAC1C,4EAA4E;QAC5E,2CAA2C;QAC3C,SAAS,CAAC,sBAAsB,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;QAE1B,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,EAAE,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;IAC9F,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAsC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;QAC/C,SAAS,CAAC,oBAAoB,GAAG,QAAQ,CAAC;QAC1C,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,EAAE,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["// Project/App: Open GSD\n// File Purpose: Regression tests for CloudRuntime.start()'s first-connect promise\n// — it must resolve only once the relay is actually up and reject on connect\n// failure, so the CLI never reports \"connected\" for a socket that never opened.\nimport { test } from \"node:test\";\nimport assert from \"node:assert/strict\";\nimport WebSocket from \"ws\";\nimport { CloudRuntime } from \"./cloud-runtime.js\";\n\nconst noopLogger = { info: () => undefined, warn: () => undefined, error: () => undefined, debug: () => undefined };\nconst noopExecutor = { execute: async () => ({}), advertisedProjects: async () => [] };\n\nfunction makeRuntime(cloud: Record<string, unknown> = {}): CloudRuntime {\n  return new CloudRuntime(\n    { gateway_url: \"wss://cloud.example.net\", device_token: \"fixture\", runtime_id: \"runtime\", ...cloud } as never,\n    noopExecutor as never,\n    noopLogger as never,\n  );\n}\n\ntype FakeSocket = { readyState: number; sent: string[]; send: (t: string) => void; close: () => void };\nfunction fakeSocket(readyState = WebSocket.OPEN): FakeSocket {\n  const sent: string[] = [];\n  return { readyState, sent, send: (t: string) => sent.push(t), close: () => undefined };\n}\ntype RuntimeInternals = {\n  socket: FakeSocket | undefined;\n  firstConnectDeferred: PromiseWithResolvers<void> | undefined;\n  initialConnectAttempts: number;\n  reconnect: ReturnType<typeof setTimeout> | undefined;\n  handleSocketOpen: (socket: unknown) => void;\n  handleSocketClose: (socket: unknown) => void;\n  connect: () => void;\n};\n\ntest(\"start()'s first-connect promise resolves only when the relay socket opens\", async () => {\n  const runtime = makeRuntime();\n  const internals = runtime as unknown as RuntimeInternals;\n  try {\n    const deferred = Promise.withResolvers<void>();\n    internals.firstConnectDeferred = deferred;\n    const socket = fakeSocket();\n    internals.socket = socket;\n\n    let settled = false;\n    void deferred.promise.then(() => (settled = true));\n    await Promise.resolve(); // let any premature settle flush\n    assert.equal(settled, false, \"promise must not resolve before the socket opens\");\n\n    internals.handleSocketOpen(socket);\n    await deferred.promise; // resolves — otherwise this hangs/throws\n  } finally {\n    runtime.stop();\n  }\n});\n\ntest(\"an early socket close retries instead of rejecting while attempts remain\", async () => {\n  const runtime = makeRuntime();\n  const internals = runtime as unknown as RuntimeInternals;\n  try {\n    const deferred = Promise.withResolvers<void>();\n    internals.firstConnectDeferred = deferred;\n    const socket = fakeSocket();\n    internals.socket = socket;\n\n    let settled = false;\n    void deferred.promise.then(() => (settled = true), () => (settled = true));\n\n    internals.handleSocketClose(socket); // first transient failure\n    await Promise.resolve();\n    assert.equal(settled, false, \"a single early close must not settle start()\");\n    assert.equal(internals.initialConnectAttempts, 1);\n    assert.notEqual(internals.reconnect, undefined, \"a reconnect must be scheduled\");\n  } finally {\n    runtime.stop();\n  }\n});\n\ntest(\"start()'s first-connect promise rejects once the initial connect attempts are exhausted\", async () => {\n  const runtime = makeRuntime();\n  const internals = runtime as unknown as RuntimeInternals;\n  try {\n    const deferred = Promise.withResolvers<void>();\n    internals.firstConnectDeferred = deferred;\n    // Simulate having already burned every retry but the last so the next close\n    // is the one that must give up and reject.\n    internals.initialConnectAttempts = 4;\n    const socket = fakeSocket();\n    internals.socket = socket;\n\n    internals.handleSocketClose(socket);\n    await assert.rejects(deferred.promise, /connection failed/);\n  } finally {\n    runtime.stop();\n  }\n});\n\ntest(\"connect() rejects the first-connect promise when the device token is missing\", async () => {\n  const runtime = makeRuntime({ device_token: \"\" });\n  const internals = runtime as unknown as RuntimeInternals;\n  try {\n    const deferred = Promise.withResolvers<void>();\n    internals.firstConnectDeferred = deferred;\n    internals.connect();\n    await assert.rejects(deferred.promise, /missing device token/);\n  } finally {\n    runtime.stop();\n  }\n});\n"]}

package/packages/gsd-cloud/dist/cloud-token.d.ts

@@ -0,0 +1,3 @@
+export declare function protectCloudDeviceToken(token: string): string;
+export declare function unprotectCloudDeviceToken(value: string): string | undefined;
+//# sourceMappingURL=cloud-token.d.ts.map

package/packages/gsd-cloud/dist/cloud-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-token.d.ts","sourceRoot":"","sources":["../src/cloud-token.ts"],"names":[],"mappings":"AAMA,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM7D;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAc3E"}

package/packages/gsd-cloud/dist/cloud-token.js

@@ -0,0 +1,37 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { homedir, hostname, userInfo } from "node:os";
+const PREFIX = "v1.";
+const ALGORITHM = "aes-256-gcm";
+export function protectCloudDeviceToken(token) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv(ALGORITHM, cloudTokenKey(), iv);
+    const ciphertext = Buffer.concat([cipher.update(token, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `${PREFIX}${Buffer.concat([iv, tag, ciphertext]).toString("base64url")}`;
+}
+export function unprotectCloudDeviceToken(value) {
+    if (!value.startsWith(PREFIX))
+        return undefined;
+    try {
+        const payload = Buffer.from(value.slice(PREFIX.length), "base64url");
+        if (payload.length <= 28)
+            return undefined;
+        const iv = payload.subarray(0, 12);
+        const tag = payload.subarray(12, 28);
+        const ciphertext = payload.subarray(28);
+        const decipher = createDecipheriv(ALGORITHM, cloudTokenKey(), iv);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+function cloudTokenKey() {
+    const configuredKey = process.env["GSD_CLOUD_TOKEN_KEY"];
+    const material = configuredKey && configuredKey.trim()
+        ? `env:${configuredKey}`
+        : `local:${hostname()}:${userInfo().username}:${homedir()}`;
+    return createHash("sha256").update(material, "utf8").digest();
+}
+//# sourceMappingURL=cloud-token.js.map

package/packages/gsd-cloud/dist/cloud-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-token.js","sourceRoot":"","sources":["../src/cloud-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEtD,MAAM,MAAM,GAAG,KAAK,CAAC;AACrB,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QAClE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,aAAa,IAAI,aAAa,CAAC,IAAI,EAAE;QACpD,CAAC,CAAC,OAAO,aAAa,EAAE;QACxB,CAAC,CAAC,SAAS,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAC,QAAQ,IAAI,OAAO,EAAE,EAAE,CAAC;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAChE,CAAC","sourcesContent":["import { createCipheriv, createDecipheriv, createHash, randomBytes } from \"node:crypto\";\nimport { homedir, hostname, userInfo } from \"node:os\";\n\nconst PREFIX = \"v1.\";\nconst ALGORITHM = \"aes-256-gcm\";\n\nexport function protectCloudDeviceToken(token: string): string {\n  const iv = randomBytes(12);\n  const cipher = createCipheriv(ALGORITHM, cloudTokenKey(), iv);\n  const ciphertext = Buffer.concat([cipher.update(token, \"utf8\"), cipher.final()]);\n  const tag = cipher.getAuthTag();\n  return `${PREFIX}${Buffer.concat([iv, tag, ciphertext]).toString(\"base64url\")}`;\n}\n\nexport function unprotectCloudDeviceToken(value: string): string | undefined {\n  if (!value.startsWith(PREFIX)) return undefined;\n  try {\n    const payload = Buffer.from(value.slice(PREFIX.length), \"base64url\");\n    if (payload.length <= 28) return undefined;\n    const iv = payload.subarray(0, 12);\n    const tag = payload.subarray(12, 28);\n    const ciphertext = payload.subarray(28);\n    const decipher = createDecipheriv(ALGORITHM, cloudTokenKey(), iv);\n    decipher.setAuthTag(tag);\n    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString(\"utf8\");\n  } catch {\n    return undefined;\n  }\n}\n\nfunction cloudTokenKey(): Buffer {\n  const configuredKey = process.env[\"GSD_CLOUD_TOKEN_KEY\"];\n  const material = configuredKey && configuredKey.trim()\n    ? `env:${configuredKey}`\n    : `local:${hostname()}:${userInfo().username}:${homedir()}`;\n  return createHash(\"sha256\").update(material, \"utf8\").digest();\n}\n"]}

package/packages/gsd-cloud/dist/config.d.ts

@@ -0,0 +1,17 @@
+import type { DaemonConfig } from './types.js';
+/**
+ * Resolve the config file path.
+ * Priority: explicit CLI arg → GSD_DAEMON_CONFIG env → ~/.gsd/daemon.yaml
+ */
+export declare function resolveConfigPath(cliPath?: string): string;
+/**
+ * Validate and normalise a raw parsed object into a DaemonConfig.
+ * Missing/invalid fields are filled with defaults. Invalid log level falls back to 'info'.
+ */
+export declare function validateConfig(raw: unknown): DaemonConfig;
+/**
+ * Load and validate a DaemonConfig from a YAML file.
+ * If the file doesn't exist, returns defaults. If the file is malformed YAML, throws.
+ */
+export declare function loadConfig(configPath: string): DaemonConfig;
+//# sourceMappingURL=config.d.ts.map

package/packages/gsd-cloud/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAY,MAAM,YAAY,CAAC;AA0BzD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAK1D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAwFzD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAgB3D"}