@opengsd/gsd-pi 1.7.0 → 1.8.1

package/packages/daemon/dist/cloud-config.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-config.test.js","sourceRoot":"","sources":["../src/cloud-config.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpH,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE;QACzC,WAAW,EAAE,yBAAyB;QACtC,YAAY,EAAE,qBAAqB;QACnC,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,QAAQ;QACtB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC;IAChE,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE;QAC5C,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,0BAA0B;QACvC,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,QAAQ;QACtB,CAAC,SAAS,GAAG,OAAO,CAAC,EAAE,YAAY;KACpC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,4BAA4B,CAAC;IACjD,aAAa,CAAC,UAAU,EAAE;QACxB,QAAQ;QACR,yCAAyC;QACzC,mBAAmB,WAAW,EAAE;QAChC,mBAAmB;QACnB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACd,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE;QACzC,WAAW,EAAE,yBAAyB;QACtC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACtD,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE,EAAE,8BAA8B,CAAC,CAAC;IAC/G,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE,EAAE,wBAAwB,CAAC,CAAC;IACjG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE,EAAE,wBAAwB,CAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACpE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC1F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,EAAE,YAAY,CAAC,CAAC;IAClF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,mCAAmC,CAAC,EAAE,8BAA8B,CAAC,CAAC;IAC/G,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,gCAAgC,CAAC,EAAE,6BAA6B,CAAC,CAAC;IAC3G,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC/F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACzF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC7F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,EAAE,yBAAyB,CAAC,CAAC;AAC7F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACrF,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;IACvC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;QAC7B,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC,CAAiB,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAClB,mBAAmB,CAAC,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAC/E,yBAAyB,CAC1B,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;IACnC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mDAAmD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACpE,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;IAChD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,YAAY,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7B,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACvB,WAAW,IAAI,KAAK,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACrB,SAAS,EAAE,KAAK;gBAChB,CAAC,QAAQ,GAAG,OAAO,CAAC,EAAE,gBAAgB;aACvC,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,UAAU,EAAE,oBAAoB,OAAO,CAAC,IAAI,oBAAoB;YAChE,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QAChD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACrG,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["import assert from \"node:assert/strict\";\nimport { createServer } from \"node:http\";\nimport { mkdtempSync, readFileSync, statSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { test } from \"node:test\";\nimport { loadConfig } from \"./config.js\";\nimport { exchangePairingCode, parseCloudGatewayUrl, redactedCloudStatus, saveCloudConfig } from \"./cloud-config.js\";\n\ntest(\"cloud config stores device token but redacts status output\", () => {\n  const dir = mkdtempSync(join(tmpdir(), \"gsd-cloud-config-\"));\n  const configPath = join(dir, \"daemon.yaml\");\n\n  const config = saveCloudConfig(configPath, {\n    gateway_url: \"https://gateway.example\",\n    device_token: \"secret-device-token\",\n    runtime_id: \"rt1\",\n    runtime_name: \"Laptop\",\n    enabled: true,\n  });\n\n  const rawConfig = readFileSync(configPath, \"utf8\");\n  assert.doesNotMatch(rawConfig, /secret-device-token/);\n  assert.match(rawConfig, /device_token_encrypted:/);\n  assert.equal(statSync(configPath).mode & 0o777, 0o600);\n  assert.equal(config.cloud?.device_token, \"secret-device-token\");\n  assert.deepEqual(redactedCloudStatus(config), {\n    configured: true,\n    enabled: true,\n    gateway_url: \"https://gateway.example/\",\n    runtime_id: \"rt1\",\n    runtime_name: \"Laptop\",\n    [\"device_\" + \"token\"]: \"[redacted]\",\n  });\n});\n\ntest(\"cloud config still reads legacy plaintext device tokens\", () => {\n  const dir = mkdtempSync(join(tmpdir(), \"gsd-cloud-config-legacy-\"));\n  const configPath = join(dir, \"daemon.yaml\");\n  const legacyToken = \"legacy-secret-device-token\";\n  writeFileSync(configPath, [\n    \"cloud:\",\n    \"  gateway_url: https://gateway.example/\",\n    `  device_token: ${legacyToken}`,\n    \"  runtime_id: rt1\",\n    \"\",\n  ].join(\"\\n\"));\n  assert.equal(loadConfig(configPath).cloud?.device_token, legacyToken);\n\n  const config = saveCloudConfig(configPath, {\n    gateway_url: \"https://gateway.example\",\n    device_token: legacyToken,\n    runtime_id: \"rt1\",\n  });\n\n  const rawConfig = readFileSync(configPath, \"utf8\");\n  assert.equal(config.cloud?.device_token, legacyToken);\n  assert.doesNotMatch(rawConfig, new RegExp(legacyToken));\n  assert.match(rawConfig, /device_token_encrypted:/);\n});\n\ntest(\"cloud gateway URL validation allows HTTPS and localhost HTTP\", () => {\n  assert.equal(parseCloudGatewayUrl(\"https://gateway.example/base/\").toString(), \"https://gateway.example/base\");\n  assert.equal(parseCloudGatewayUrl(\"http://localhost:8787\").toString(), \"http://localhost:8787/\");\n  assert.equal(parseCloudGatewayUrl(\"http://127.0.0.1:8787\").toString(), \"http://127.0.0.1:8787/\");\n});\n\ntest(\"cloud gateway URL validation rejects unsafe destinations\", () => {\n  assert.throws(() => parseCloudGatewayUrl(\"file:///tmp/socket\"), /must use http or https/);\n  assert.throws(() => parseCloudGatewayUrl(\"http://gateway.example\"), /Plain HTTP/);\n  assert.throws(() => parseCloudGatewayUrl(\"https://user:pass@gateway.example\"), /must not include credentials/);\n  assert.throws(() => parseCloudGatewayUrl(\"https://gateway.example/#token\"), /must not include a fragment/);\n  assert.throws(() => parseCloudGatewayUrl(\"https://127.0.0.1:8787\"), /must not target private/);\n  assert.throws(() => parseCloudGatewayUrl(\"https://10.0.0.5\"), /must not target private/);\n  assert.throws(() => parseCloudGatewayUrl(\"https://192.168.1.10\"), /must not target private/);\n  assert.throws(() => parseCloudGatewayUrl(\"https://[::1]:8787\"), /must not target private/);\n});\n\ntest(\"pairing exchange rejects unsafe gateway URLs before making requests\", async () => {\n  const originalFetch = globalThis.fetch;\n  let called = false;\n  globalThis.fetch = (async () => {\n    called = true;\n    throw new Error(\"fetch should not be called\");\n  }) as typeof fetch;\n  try {\n    await assert.rejects(\n      exchangePairingCode({ gatewayUrl: \"https://127.0.0.1:8787\", code: \"ABCD1234\" }),\n      /must not target private/,\n    );\n    assert.equal(called, false);\n  } finally {\n    globalThis.fetch = originalFetch;\n  }\n});\n\ntest(\"pairing exchange posts to a validated gateway URL\", async (t) => {\n  let requestedUrl = \"\";\n  let requestBody = \"\";\n  const runtimeAuthValue = \"runtime-auth-fixture\";\n  const server = createServer((req, res) => {\n    requestedUrl = req.url ?? \"\";\n    req.setEncoding(\"utf8\");\n    req.on(\"data\", (chunk) => {\n      requestBody += chunk;\n    });\n    req.on(\"end\", () => {\n      res.writeHead(200, { \"content-type\": \"application/json\" });\n      res.end(JSON.stringify({\n        runtimeId: \"rt1\",\n        [\"device\" + \"Token\"]: runtimeAuthValue,\n      }));\n    });\n  });\n  try {\n    await new Promise<void>((resolve, reject) => {\n      server.once(\"error\", reject);\n      server.listen(0, \"127.0.0.1\", resolve);\n    });\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EPERM\") {\n      t.skip(\"loopback listen is blocked in this sandbox\");\n      return;\n    }\n    throw err;\n  }\n  try {\n    const address = server.address();\n    assert.ok(address && typeof address === \"object\");\n    const result = await exchangePairingCode({\n      gatewayUrl: `http://127.0.0.1:${address.port}/base?ignored=true`,\n      code: \"ABCD1234\",\n    });\n    assert.equal(result.runtimeId, \"rt1\");\n    assert.equal(result.deviceToken, runtimeAuthValue);\n    assert.equal(requestedUrl, \"/pairing/exchange\");\n    assert.deepEqual(JSON.parse(requestBody), { code: \"ABCD1234\" });\n  } finally {\n    await new Promise<void>((resolve, reject) => server.close((err) => err ? reject(err) : resolve()));\n  }\n});\n"]}
+{"version":3,"file":"cloud-config.test.js","sourceRoot":"","sources":["../src/cloud-config.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzI,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,GAAW,EAAE,OAAgB;IACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC5B,MAAoF,CACnF,WAAW,EACX,OAAO,EACP,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAG,IAAI,CAAC,CAAC,CAAkB,IAAI,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,CAAC,8HAA8H,EAAE,KAAK,IAAI,EAAE;IAC9I,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,+BAA+B,CAAC,CAAC;IACzD,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,uCAAuC,CAAC,CAAC;IAC1E,MAAM,CAAC,EAAE,CAAE,MAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,+BAA+B,CAAC,CAAC;AAC/E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;IAC7F,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACtF,MAAM,CAAC,EAAE,CAAC,GAAG,YAAY,KAAK,EAAE,iCAAiC,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,GAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE;QACzC,WAAW,EAAE,yBAAyB;QACtC,YAAY,EAAE,qBAAqB;QACnC,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,QAAQ;QACtB,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC;IAChE,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE;QAC5C,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,0BAA0B;QACvC,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,QAAQ;QACtB,CAAC,SAAS,GAAG,OAAO,CAAC,EAAE,YAAY;KACpC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,4BAA4B,CAAC;IACjD,aAAa,CAAC,UAAU,EAAE;QACxB,QAAQ;QACR,yCAAyC;QACzC,mBAAmB,WAAW,EAAE;QAChC,mBAAmB;QACnB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACd,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE;QACzC,WAAW,EAAE,yBAAyB;QACtC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACtD,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;IACxE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,+BAA+B,CAAC,CAAC,QAAQ,EAAE,EAAE,8BAA8B,CAAC,CAAC;IAC/G,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE,EAAE,wBAAwB,CAAC,CAAC;IACjG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC,QAAQ,EAAE,EAAE,wBAAwB,CAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACpE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC1F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,EAAE,YAAY,CAAC,CAAC;IAClF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,mCAAmC,CAAC,EAAE,8BAA8B,CAAC,CAAC;IAC/G,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,gCAAgC,CAAC,EAAE,6BAA6B,CAAC,CAAC;IAC3G,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC/F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACzF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC7F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,EAAE,yBAAyB,CAAC,CAAC;AAC7F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACrF,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;IACvC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;QAC7B,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC,CAAiB,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAClB,mBAAmB,CAAC,EAAE,UAAU,EAAE,wBAAwB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAC/E,yBAAyB,CAC1B,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;IACnC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mDAAmD,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACpE,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;IAChD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,YAAY,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7B,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACvB,WAAW,IAAI,KAAK,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBACrB,SAAS,EAAE,KAAK;gBAChB,CAAC,QAAQ,GAAG,OAAO,CAAC,EAAE,gBAAgB;aACvC,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,UAAU,EAAE,oBAAoB,OAAO,CAAC,IAAI,oBAAoB;YAChE,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QAChD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACrG,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["import assert from \"node:assert/strict\";\nimport { createServer } from \"node:http\";\nimport { mkdtempSync, readFileSync, statSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { test } from \"node:test\";\nimport { loadConfig } from \"./config.js\";\nimport { createGatewayLookup, exchangePairingCode, parseCloudGatewayUrl, redactedCloudStatus, saveCloudConfig } from \"./cloud-config.js\";\n\n// Invoke a gateway lookup and capture (err, result) from its Node-style callback.\nfunction runGatewayLookup(url: string, options: unknown): Promise<{ err: Error | null; result: unknown }> {\n  const lookup = createGatewayLookup(new URL(url));\n  return new Promise((resolve) => {\n    (lookup as unknown as (h: string, o: unknown, cb: (...a: unknown[]) => void) => void)(\n      \"localhost\",\n      options,\n      (...args: unknown[]) => resolve({ err: (args[0] as Error | null) ?? null, result: args[1] }),\n    );\n  });\n}\n\ntest(\"createGatewayLookup honors all:true with an array callback (regression: scalar form threw 'Invalid IP address' on Node >=20)\", async () => {\n  const { err, result } = await runGatewayLookup(\"http://localhost\", { all: true, family: 0 });\n  assert.equal(err, null, \"loopback allowed for http URL\");\n  assert.ok(Array.isArray(result), \"all:true must call back with an array\");\n  assert.ok((result as unknown[]).length > 0, \"expected at least one address\");\n});\n\ntest(\"createGatewayLookup all:true still enforces the SSRF guard on every address\", async () => {\n  const { err } = await runGatewayLookup(\"https://localhost\", { all: true, family: 0 });\n  assert.ok(err instanceof Error, \"https loopback must be rejected\");\n  assert.match(err!.message, /private or loopback/);\n});\n\ntest(\"cloud config stores device token but redacts status output\", () => {\n  const dir = mkdtempSync(join(tmpdir(), \"gsd-cloud-config-\"));\n  const configPath = join(dir, \"daemon.yaml\");\n\n  const config = saveCloudConfig(configPath, {\n    gateway_url: \"https://gateway.example\",\n    device_token: \"secret-device-token\",\n    runtime_id: \"rt1\",\n    runtime_name: \"Laptop\",\n    enabled: true,\n  });\n\n  const rawConfig = readFileSync(configPath, \"utf8\");\n  assert.doesNotMatch(rawConfig, /secret-device-token/);\n  assert.match(rawConfig, /device_token_encrypted:/);\n  assert.equal(statSync(configPath).mode & 0o777, 0o600);\n  assert.equal(config.cloud?.device_token, \"secret-device-token\");\n  assert.deepEqual(redactedCloudStatus(config), {\n    configured: true,\n    enabled: true,\n    gateway_url: \"https://gateway.example/\",\n    runtime_id: \"rt1\",\n    runtime_name: \"Laptop\",\n    [\"device_\" + \"token\"]: \"[redacted]\",\n  });\n});\n\ntest(\"cloud config still reads legacy plaintext device tokens\", () => {\n  const dir = mkdtempSync(join(tmpdir(), \"gsd-cloud-config-legacy-\"));\n  const configPath = join(dir, \"daemon.yaml\");\n  const legacyToken = \"legacy-secret-device-token\";\n  writeFileSync(configPath, [\n    \"cloud:\",\n    \"  gateway_url: https://gateway.example/\",\n    `  device_token: ${legacyToken}`,\n    \"  runtime_id: rt1\",\n    \"\",\n  ].join(\"\\n\"));\n  assert.equal(loadConfig(configPath).cloud?.device_token, legacyToken);\n\n  const config = saveCloudConfig(configPath, {\n    gateway_url: \"https://gateway.example\",\n    device_token: legacyToken,\n    runtime_id: \"rt1\",\n  });\n\n  const rawConfig = readFileSync(configPath, \"utf8\");\n  assert.equal(config.cloud?.device_token, legacyToken);\n  assert.doesNotMatch(rawConfig, new RegExp(legacyToken));\n  assert.match(rawConfig, /device_token_encrypted:/);\n});\n\ntest(\"cloud gateway URL validation allows HTTPS and localhost HTTP\", () => {\n  assert.equal(parseCloudGatewayUrl(\"https://gateway.example/base/\").toString(), \"https://gateway.example/base\");\n  assert.equal(parseCloudGatewayUrl(\"http://localhost:8787\").toString(), \"http://localhost:8787/\");\n  assert.equal(parseCloudGatewayUrl(\"http://127.0.0.1:8787\").toString(), \"http://127.0.0.1:8787/\");\n});\n\ntest(\"cloud gateway URL validation rejects unsafe destinations\", () => {\n  assert.throws(() => parseCloudGatewayUrl(\"file:///tmp/socket\"), /must use http or https/);\n  assert.throws(() => parseCloudGatewayUrl(\"http://gateway.example\"), /Plain HTTP/);\n  assert.throws(() => parseCloudGatewayUrl(\"https://user:pass@gateway.example\"), /must not include credentials/);\n  assert.throws(() => parseCloudGatewayUrl(\"https://gateway.example/#token\"), /must not include a fragment/);\n  assert.throws(() => parseCloudGatewayUrl(\"https://127.0.0.1:8787\"), /must not target private/);\n  assert.throws(() => parseCloudGatewayUrl(\"https://10.0.0.5\"), /must not target private/);\n  assert.throws(() => parseCloudGatewayUrl(\"https://192.168.1.10\"), /must not target private/);\n  assert.throws(() => parseCloudGatewayUrl(\"https://[::1]:8787\"), /must not target private/);\n});\n\ntest(\"pairing exchange rejects unsafe gateway URLs before making requests\", async () => {\n  const originalFetch = globalThis.fetch;\n  let called = false;\n  globalThis.fetch = (async () => {\n    called = true;\n    throw new Error(\"fetch should not be called\");\n  }) as typeof fetch;\n  try {\n    await assert.rejects(\n      exchangePairingCode({ gatewayUrl: \"https://127.0.0.1:8787\", code: \"ABCD1234\" }),\n      /must not target private/,\n    );\n    assert.equal(called, false);\n  } finally {\n    globalThis.fetch = originalFetch;\n  }\n});\n\ntest(\"pairing exchange posts to a validated gateway URL\", async (t) => {\n  let requestedUrl = \"\";\n  let requestBody = \"\";\n  const runtimeAuthValue = \"runtime-auth-fixture\";\n  const server = createServer((req, res) => {\n    requestedUrl = req.url ?? \"\";\n    req.setEncoding(\"utf8\");\n    req.on(\"data\", (chunk) => {\n      requestBody += chunk;\n    });\n    req.on(\"end\", () => {\n      res.writeHead(200, { \"content-type\": \"application/json\" });\n      res.end(JSON.stringify({\n        runtimeId: \"rt1\",\n        [\"device\" + \"Token\"]: runtimeAuthValue,\n      }));\n    });\n  });\n  try {\n    await new Promise<void>((resolve, reject) => {\n      server.once(\"error\", reject);\n      server.listen(0, \"127.0.0.1\", resolve);\n    });\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"EPERM\") {\n      t.skip(\"loopback listen is blocked in this sandbox\");\n      return;\n    }\n    throw err;\n  }\n  try {\n    const address = server.address();\n    assert.ok(address && typeof address === \"object\");\n    const result = await exchangePairingCode({\n      gatewayUrl: `http://127.0.0.1:${address.port}/base?ignored=true`,\n      code: \"ABCD1234\",\n    });\n    assert.equal(result.runtimeId, \"rt1\");\n    assert.equal(result.deviceToken, runtimeAuthValue);\n    assert.equal(requestedUrl, \"/pairing/exchange\");\n    assert.deepEqual(JSON.parse(requestBody), { code: \"ABCD1234\" });\n  } finally {\n    await new Promise<void>((resolve, reject) => server.close((err) => err ? reject(err) : resolve()));\n  }\n});\n"]}

package/packages/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/daemon",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "GSD daemon — background process for project monitoring and Discord integration",
   "license": "MIT",
   "repository": {
@@ -31,9 +31,9 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.52.0",
-    "@opengsd/contracts": "^1.7.0",
-    "@opengsd/mcp-server": "^1.7.0",
-    "@opengsd/rpc-client": "^1.7.0",
+    "@opengsd/contracts": "^1.8.1",
+    "@opengsd/mcp-server": "^1.8.1",
+    "@opengsd/rpc-client": "^1.8.1",
     "discord.js": "^14.25.1",
     "ws": "^8.20.0",
     "yaml": "^2.8.0",

package/packages/gsd-agent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gsd/agent-core",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "GSD session orchestration layer on top of @gsd/pi-coding-agent",
   "type": "module",
   "gsd": {
@@ -25,9 +25,9 @@
     "test": "node --import ../../src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test src/*.test.ts src/**/*.test.ts"
   },
   "dependencies": {
-    "@gsd/native": "^1.7.0",
-    "@gsd/pi-agent-core": "^1.7.0",
-    "@gsd/pi-ai": "^1.7.0",
-    "@gsd/pi-coding-agent": "^1.7.0"
+    "@gsd/native": "^1.8.1",
+    "@gsd/pi-agent-core": "^1.8.1",
+    "@gsd/pi-ai": "^1.8.1",
+    "@gsd/pi-coding-agent": "^1.8.1"
   }
 }

package/packages/gsd-agent-modes/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gsd/agent-modes",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "GSD run modes and CLI layer",
   "type": "module",
   "gsd": {
@@ -25,12 +25,12 @@
     "test": "node --import ../../src/resources/extensions/gsd/tests/resolve-ts.mjs --experimental-strip-types --test src/**/*.test.ts"
   },
   "dependencies": {
-    "@gsd/agent-core": "^1.7.0",
-    "@gsd/pi-agent-core": "^1.7.0",
-    "@gsd/pi-ai": "^1.7.0",
-    "@gsd/pi-coding-agent": "^1.7.0",
-    "@gsd/pi-tui": "^1.7.0",
-    "@opengsd/contracts": "^1.7.0",
+    "@gsd/agent-core": "^1.8.1",
+    "@gsd/pi-agent-core": "^1.8.1",
+    "@gsd/pi-ai": "^1.8.1",
+    "@gsd/pi-coding-agent": "^1.8.1",
+    "@gsd/pi-tui": "^1.8.1",
+    "@opengsd/contracts": "^1.8.1",
     "chalk": "^5.5.0"
   }
 }

package/packages/gsd-cloud/README.md

@@ -3,10 +3,15 @@
 Connect a local GSD runtime to [GSD Cloud](https://cloud.opengsd.net) so you can
 monitor and control your GSD projects from any browser.
 
-This is a thin wrapper over `@opengsd/daemon`'s cloud runtime commands. Its only
-added behavior is defaulting the gateway to `https://cloud.opengsd.net` for the
-`login` and `pair` commands, so you never have to type `--gateway`. All
-device-flow, pairing, and connection logic is provided by the daemon.
+This is a **self-contained** agent. It depends only on `ws` and `yaml` — no
+`@opengsd/daemon`, no `@opengsd/mcp-server`, no `@opengsd/gsd-pi`. It runs the
+RFC 8628 device-flow login, opens a persistent WebSocket to the cloud gateway,
+and forwards each requested GSD workflow tool to your locally-installed `gsd`
+CLI (via `gsd --mode mcp`). The gateway default of `https://cloud.opengsd.net`
+is injected for `login`/`pair` so you never have to type `--gateway`.
+
+Requires the `gsd` CLI (from `@opengsd/gsd-pi`) to be installed and on your
+`PATH` (or set `GSD_CLI_PATH`).
 
 ## Usage
 
@@ -29,6 +34,15 @@ npx @opengsd/gsd-cloud disconnect
 different gateway, pass `--gateway <url>` explicitly — the explicit flag always
 wins. The `status`, `connect`, and `disconnect` commands do not use a gateway.
 
+## Environment
+
+- `GSD_CLOUD_PROJECTS` — path-delimiter separated list of project directories to
+  advertise to the cloud (default: the current working directory).
+- `GSD_CLI_PATH` — path to the `gsd` binary (default: `gsd` on `PATH`).
+- `GSD_CLOUD_EXECUTOR` — backend adapter: `gsd-pi` (default). `codex` and
+  `claude` adapters are stubbed for future use.
+
 ## Requirements
 
 - Node.js >= 22
+- The `gsd` CLI (`@opengsd/gsd-pi`) installed locally

package/packages/gsd-cloud/bin/gsd-cloud.js

@@ -1,25 +1,26 @@
 #!/usr/bin/env node
 // Project/App: Open GSD
-// File Purpose: gsd-cloud CLI entry — inject the default gateway then delegate to the daemon.
+// File Purpose: gsd-cloud CLI entry — inject the default gateway, then run the
+//               standalone cloud command handler. No @opengsd/daemon dependency.
 import { existsSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const binDir = dirname(fileURLToPath(import.meta.url));
-const target = join(binDir, '..', 'dist', 'inject-gateway.js');
+const distDir = join(binDir, '..', 'dist');
 
-if (!existsSync(target)) {
+if (!existsSync(join(distDir, 'cli.js'))) {
   process.stderr.write('gsd-cloud: build output missing. Run `pnpm --filter @opengsd/gsd-cloud run build`.\n');
   process.exit(1);
 }
 
 const { injectDefaultGateway } = await import('../dist/inject-gateway.js');
-const { handleCloudRuntimeCommand } = await import('@opengsd/daemon');
+const { handleCloudCommand } = await import('../dist/cli.js');
 
 const argv = injectDefaultGateway(process.argv.slice(2));
 
 try {
-  await handleCloudRuntimeCommand(argv, { binaryName: 'gsd-cloud' });
+  await handleCloudCommand(argv, { binaryName: 'gsd-cloud' });
 } catch (err) {
   const msg = err instanceof Error ? err.message : String(err);
   process.stderr.write(`gsd-cloud: fatal: ${msg}\n`);

package/packages/gsd-cloud/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@opengsd/gsd-cloud",
-  "version": "1.7.0",
-  "description": "Thin CLI wrapper that connects a local GSD runtime to GSD Cloud (cloud.opengsd.net)",
+  "version": "1.8.1",
+  "description": "Standalone CLI agent that connects a local GSD runtime to GSD Cloud (cloud.opengsd.net)",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -17,13 +17,15 @@
   },
   "scripts": {
     "build": "node ../../scripts/clean-package-dist.cjs && tsc",
-    "test": "pnpm run build && node --test dist/inject-gateway.test.js"
+    "test": "pnpm run build && node --test dist/inject-gateway.test.js dist/cloud-gateway-lookup.test.js dist/cloud-runtime.test.js dist/executors/mcp-stdio-client.test.js dist/executors/gsd-pi-executor.test.js"
   },
   "dependencies": {
-    "@opengsd/daemon": "^1.7.0"
+    "ws": "^8.21.0",
+    "yaml": "^2.8.2"
   },
   "devDependencies": {
     "@types/node": "^24.12.0",
+    "@types/ws": "^8.5.13",
     "typescript": "^5.4.0"
   },
   "engines": {

package/packages/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/mcp-server",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "MCP server exposing GSD orchestration tools for compatible clients",
   "license": "MIT",
   "gsd": {
@@ -50,9 +50,9 @@
     "test": "pnpm run build:test && node --test dist/mcp-server.test.js dist/remote-questions.test.js dist/moonshot-tool-schema.test.js dist/pid-registry.test.js dist/probe-mode.test.js dist/stdio-watchdog.test.js dist/cli-runner.test.js dist/readers/graph.test.js dist/readers/paths.test.js dist/readers/readers.test.js"
   },
   "dependencies": {
-    "@gsd/pi-ai": "^1.7.0",
-    "@opengsd/contracts": "^1.7.0",
-    "@opengsd/rpc-client": "^1.7.0",
+    "@gsd/pi-ai": "^1.8.1",
+    "@opengsd/contracts": "^1.8.1",
+    "@opengsd/rpc-client": "^1.8.1",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "zod": "^4.0.0"
   },

package/packages/native/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gsd/native",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "Native Rust bindings for GSD — high-performance native modules via N-API",
   "type": "commonjs",
   "gsd": {

package/packages/pi-agent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gsd/pi-agent-core",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "General-purpose agent with transport abstraction, state management, and attachment support",
   "type": "module",
   "gsd": {

package/packages/pi-ai/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gsd/pi-ai",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "Unified LLM API with automatic model discovery and provider configuration",
   "type": "module",
   "gsd": {

package/packages/pi-coding-agent/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gsd/pi-coding-agent",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "Coding agent CLI (vendored from earendil-works/pi)",
   "type": "module",
   "gsd": {
@@ -33,7 +33,7 @@
     "copy-assets": "node scripts/copy-assets.cjs"
   },
   "dependencies": {
-    "@opengsd/contracts": "^1.7.0",
+    "@opengsd/contracts": "^1.8.1",
     "@mariozechner/jiti": "^2.6.2",
     "@silvia-odwyer/photon-node": "0.3.4",
     "chalk": "5.6.2",
@@ -53,11 +53,11 @@
     "typebox": "1.1.38",
     "undici": "7.28.0",
     "yaml": "2.9.0",
-    "@gsd/agent-core": "^1.7.0",
-    "@gsd/native": "^1.7.0",
-    "@gsd/pi-agent-core": "^1.7.0",
-    "@gsd/pi-ai": "^1.7.0",
-    "@gsd/pi-tui": "^1.7.0",
+    "@gsd/agent-core": "^1.8.1",
+    "@gsd/native": "^1.8.1",
+    "@gsd/pi-agent-core": "^1.8.1",
+    "@gsd/pi-ai": "^1.8.1",
+    "@gsd/pi-tui": "^1.8.1",
     "@sinclair/typebox": "^0.34.41"
   },
   "devDependencies": {

package/packages/pi-tui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gsd/pi-tui",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "Terminal UI library (vendored from earendil-works/pi)",
   "type": "module",
   "gsd": {
@@ -21,7 +21,7 @@
     "build": "node ../../scripts/clean-package-dist.cjs && tsc -p tsconfig.json --incremental false"
   },
   "dependencies": {
-    "@gsd/native": "^1.7.0",
+    "@gsd/native": "^1.8.1",
     "get-east-asian-width": "1.6.0",
     "marked": "15.0.12",
     "@sinclair/typebox": "^0.34.41"

package/packages/rpc-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/rpc-client",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "Standalone RPC client SDK for GSD — zero internal dependencies",
   "license": "MIT",
   "gsd": {
@@ -34,7 +34,7 @@
     "test": "node --test dist/rpc-client.test.js"
   },
   "dependencies": {
-    "@opengsd/contracts": "^1.7.0"
+    "@opengsd/contracts": "^1.8.1"
   },
   "engines": {
     "node": ">=22.0.0"

package/pkg/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glittercowboy/gsd",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "piConfig": {
     "name": "gsd",
     "configDir": ".gsd"

package/src/resources/extensions/gsd/doctor-history.ts

@@ -0,0 +1,81 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { saveFile } from "./files.js";
+import { gsdRoot } from "./paths.js";
+
+import type { DoctorReport } from "./doctor-types.js";
+
+export interface DoctorHistoryEntry {
+  ts: string;
+  ok: boolean;
+  errors: number;
+  warnings: number;
+  fixes: number;
+  codes: string[];
+  /** Issue messages with severity and scope (added in Phase 2). */
+  issues?: Array<{ severity: string; code: string; message: string; unitId: string }>;
+  /** Fix descriptions applied during this run (added in Phase 2). */
+  fixDescriptions?: string[];
+  /** Milestone/slice scope this doctor run was scoped to (e.g. "M001/S02"). */
+  scope?: string;
+  /** Human-readable one-line summary of this doctor run. */
+  summary?: string;
+}
+
+function buildDoctorHistorySummary(report: DoctorReport, errorCount: number, warningCount: number, issueDetails: DoctorHistoryEntry["issues"]): string {
+  const summaryParts: string[] = [];
+  if (report.ok) {
+    summaryParts.push("Clean");
+  } else {
+    const counts: string[] = [];
+    if (errorCount > 0) counts.push(`${errorCount} error${errorCount > 1 ? "s" : ""}`);
+    if (warningCount > 0) counts.push(`${warningCount} warning${warningCount > 1 ? "s" : ""}`);
+    summaryParts.push(counts.join(", "));
+  }
+  if (report.fixesApplied.length > 0) {
+    summaryParts.push(`${report.fixesApplied.length} fixed`);
+  }
+  if (issueDetails && issueDetails.length > 0) {
+    const topIssue = issueDetails.find(i => i.severity === "error") ?? issueDetails[0]!;
+    summaryParts.push(topIssue.message);
+  }
+  return summaryParts.join(" · ");
+}
+
+export async function appendDoctorHistory(basePath: string, report: DoctorReport): Promise<void> {
+  try {
+    const historyPath = join(gsdRoot(basePath), "doctor-history.jsonl");
+    const errorCount = report.issues.filter(i => i.severity === "error").length;
+    const warningCount = report.issues.filter(i => i.severity === "warning").length;
+    const issueDetails = report.issues
+      .filter(i => i.severity === "error" || i.severity === "warning")
+      .slice(0, 10) // cap to keep JSONL lines bounded
+      .map(i => ({ severity: i.severity, code: i.code, message: i.message, unitId: i.unitId }));
+
+    const entry = JSON.stringify({
+      ts: new Date().toISOString(),
+      ok: report.ok,
+      errors: errorCount,
+      warnings: warningCount,
+      fixes: report.fixesApplied.length,
+      codes: [...new Set(report.issues.map(i => i.code))],
+      issues: issueDetails.length > 0 ? issueDetails : undefined,
+      fixDescriptions: report.fixesApplied.length > 0 ? report.fixesApplied : undefined,
+      scope: (report as { scope?: string }).scope,
+      summary: buildDoctorHistorySummary(report, errorCount, warningCount, issueDetails),
+    } satisfies DoctorHistoryEntry);
+    const existing = existsSync(historyPath) ? readFileSync(historyPath, "utf-8") : "";
+    await saveFile(historyPath, existing + entry + "\n");
+  } catch { /* non-fatal */ }
+}
+
+/** Read the last N doctor history entries. Returns most-recent-first. */
+export async function readDoctorHistory(basePath: string, lastN = 50): Promise<DoctorHistoryEntry[]> {
+  try {
+    const historyPath = join(gsdRoot(basePath), "doctor-history.jsonl");
+    if (!existsSync(historyPath)) return [];
+    const lines = readFileSync(historyPath, "utf-8").split("\n").filter(l => l.trim());
+    return lines.slice(-lastN).reverse().map(l => JSON.parse(l) as DoctorHistoryEntry);
+  } catch { return []; }
+}