@opengsd/gsd-pi 1.8.1 → 1.9.0-dev.97ef11e3

package/packages/gsd-cloud/dist/cloud-runtime.js

@@ -0,0 +1,260 @@
+import WebSocket from "ws";
+import { createGatewayLookup, parseCloudGatewayUrl, validateGatewayNetworkTarget } from "./cloud-config.js";
+const INITIAL_CONNECT_ATTEMPTS = 5;
+const INITIAL_CONNECT_HANDSHAKE_TIMEOUT_MS = 30_000;
+const RECONNECT_DELAY_MS = 5_000;
+export const CLOUD_RUNTIME_INITIAL_CONNECT_WINDOW_MS = INITIAL_CONNECT_ATTEMPTS * INITIAL_CONNECT_HANDSHAKE_TIMEOUT_MS
+    + (INITIAL_CONNECT_ATTEMPTS - 1) * RECONNECT_DELAY_MS;
+export class CloudRuntime {
+    cloud;
+    executor;
+    logger;
+    static MAX_OUTBOX = 200;
+    // How many times to retry the initial connect before rejecting start(). A
+    // transient handshake failure (gateway briefly unreachable, DNS hiccup) should
+    // retry like the daemon's reconnect loop rather than kill the runtime; a
+    // persistent failure (gateway down, session rejected) must eventually reject so
+    // the CLI reports an error instead of hanging or exiting silently.
+    socket;
+    heartbeat;
+    reconnect;
+    inFlight = new Map();
+    outbox = [];
+    stopped = false;
+    firstConnectDeferred;
+    initialConnectAttempts = 0;
+    constructor(cloud, executor, logger) {
+        this.cloud = cloud;
+        this.executor = executor;
+        this.logger = logger;
+    }
+    start() {
+        this.stopped = false;
+        this.initialConnectAttempts = 0;
+        this.firstConnectDeferred = Promise.withResolvers();
+        this.connect();
+        return this.firstConnectDeferred.promise;
+    }
+    stop() {
+        this.stopped = true;
+        this.rejectFirstConnect(new Error("cloud runtime stopped"));
+        if (this.reconnect)
+            clearTimeout(this.reconnect);
+        this.reconnect = undefined;
+        if (this.heartbeat)
+            clearInterval(this.heartbeat);
+        this.heartbeat = undefined;
+        this.inFlight.clear();
+        this.outbox = [];
+        const socket = this.socket;
+        this.socket = undefined;
+        socket?.close();
+    }
+    connect() {
+        if (this.reconnect)
+            clearTimeout(this.reconnect);
+        this.reconnect = undefined;
+        if (!this.cloud.device_token || !this.cloud.runtime_id) {
+            this.logger.warn("cloud runtime skipped — missing device token or runtime id");
+            this.rejectFirstConnect(new Error("cloud runtime missing device token or runtime id"));
+            return;
+        }
+        const gatewayUrl = parseCloudGatewayUrl(this.cloud.gateway_url);
+        try {
+            validateGatewayNetworkTarget(gatewayUrl);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            this.logger.warn("cloud runtime skipped unsafe gateway URL", { error: message });
+            this.rejectFirstConnect(new Error(`cloud runtime unsafe gateway URL: ${message}`));
+            return;
+        }
+        const url = new URL("/runtime/connect", gatewayUrl);
+        url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+        const socket = new WebSocket(url, {
+            headers: { Authorization: `Bearer ${this.cloud.device_token}` },
+            lookup: createGatewayLookup(gatewayUrl),
+            handshakeTimeout: INITIAL_CONNECT_HANDSHAKE_TIMEOUT_MS,
+        });
+        const previousSocket = this.socket;
+        this.socket = socket;
+        if (previousSocket) {
+            // Detach the old socket's handlers before closing so its listeners don't
+            // linger on a socket we've already replaced (handlers also guard on
+            // identity, but this releases them eagerly for GC).
+            previousSocket.removeAllListeners();
+            if (previousSocket.readyState !== WebSocket.CLOSING && previousSocket.readyState !== WebSocket.CLOSED) {
+                previousSocket.close();
+            }
+        }
+        socket.on("open", () => {
+            this.handleSocketOpen(socket);
+        });
+        socket.on("message", (data) => {
+            void this.handleSocketMessage(socket, data.toString("utf8"));
+        });
+        socket.on("close", () => {
+            this.handleSocketClose(socket);
+        });
+        socket.on("error", (err) => {
+            this.handleSocketError(socket, err);
+        });
+    }
+    handleSocketOpen(socket) {
+        if (socket !== this.socket)
+            return;
+        this.resolveFirstConnect();
+        this.logger.info("cloud runtime connected", { gateway_url: this.cloud.gateway_url, runtime_id: this.cloud.runtime_id });
+        // Re-advertise projects (async: the hello is sent on a later microtask), then
+        // drain any messages buffered while disconnected. tool_results route by
+        // requestId on the authenticated connection, so drain order vs the hello is
+        // not significant.
+        void this.advertiseProjects();
+        const pending = this.outbox;
+        this.outbox = [];
+        for (const text of pending) {
+            if (this.socket?.readyState === WebSocket.OPEN)
+                this.socket.send(text);
+            else
+                this.outbox.push(text);
+        }
+        if (this.heartbeat)
+            clearInterval(this.heartbeat);
+        this.heartbeat = setInterval(() => this.send({ type: "heartbeat", at: Date.now() }), 30_000);
+    }
+    async handleSocketMessage(socket, text) {
+        if (socket !== this.socket)
+            return;
+        await this.handleMessage(text);
+    }
+    handleSocketClose(socket) {
+        if (socket !== this.socket)
+            return;
+        if (this.heartbeat)
+            clearInterval(this.heartbeat);
+        this.heartbeat = undefined;
+        this.socket = undefined;
+        if (this.stopped)
+            return;
+        if (this.firstConnectDeferred) {
+            // Still trying to establish the first connection: retry transient
+            // handshake failures (like the daemon's reconnect loop) and only reject
+            // start() once the bounded attempts are exhausted, so a brief blip does
+            // not kill the runtime while a persistent outage still surfaces an error.
+            this.initialConnectAttempts += 1;
+            if (this.initialConnectAttempts >= INITIAL_CONNECT_ATTEMPTS) {
+                this.rejectFirstConnect(new Error(`cloud runtime connection failed after ${this.initialConnectAttempts} attempt(s)`));
+                return;
+            }
+            this.logger.warn("cloud runtime initial connect failed; retrying", {
+                attempt: this.initialConnectAttempts,
+                max: INITIAL_CONNECT_ATTEMPTS,
+            });
+        }
+        else {
+            this.logger.warn("cloud runtime disconnected; reconnecting");
+        }
+        if (this.reconnect)
+            clearTimeout(this.reconnect);
+        this.reconnect = setTimeout(() => this.connect(), RECONNECT_DELAY_MS);
+    }
+    handleSocketError(socket, err) {
+        if (socket !== this.socket)
+            return;
+        this.logger.warn("cloud runtime socket error", { error: err.message });
+    }
+    async advertiseProjects() {
+        const projects = await this.executor.advertisedProjects();
+        this.send({
+            type: "hello",
+            runtimeId: this.cloud.runtime_id,
+            runtimeName: this.cloud.runtime_name,
+            projects,
+        });
+    }
+    async handleMessage(text) {
+        let message;
+        try {
+            message = JSON.parse(text);
+        }
+        catch {
+            return;
+        }
+        if (message.type === "cancel" && message.requestId) {
+            void this.cancelInFlight(message.requestId);
+            return;
+        }
+        if (message.type !== "tool_call" || !message.requestId || !message.toolName)
+            return;
+        this.inFlight.set(message.requestId, message);
+        try {
+            const result = await this.executor.execute(message.toolName, message.args ?? {}, message.projectAlias);
+            if (!this.inFlight.has(message.requestId))
+                return;
+            this.send({ type: "tool_result", requestId: message.requestId, result });
+        }
+        catch (err) {
+            if (!this.inFlight.has(message.requestId))
+                return;
+            this.send({
+                type: "tool_result",
+                requestId: message.requestId,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+        finally {
+            this.inFlight.delete(message.requestId);
+        }
+    }
+    async cancelInFlight(requestId) {
+        const pending = this.inFlight.get(requestId);
+        if (!pending)
+            return;
+        this.inFlight.delete(requestId);
+        try {
+            if (typeof pending.args?.sessionId === "string") {
+                await this.executor.execute("gsd_cancel", { sessionId: pending.args.sessionId }, pending.projectAlias);
+                return;
+            }
+            const projectDir = typeof pending.args?.projectDir === "string" ? pending.args.projectDir : pending.projectAlias;
+            if (projectDir) {
+                await this.executor.execute("gsd_cancel", { projectDir });
+            }
+        }
+        catch (err) {
+            this.logger.warn("cloud runtime cancel failed", {
+                requestId,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    resolveFirstConnect() {
+        const deferred = this.firstConnectDeferred;
+        if (!deferred)
+            return;
+        this.firstConnectDeferred = undefined;
+        deferred.resolve();
+    }
+    rejectFirstConnect(err) {
+        const deferred = this.firstConnectDeferred;
+        if (!deferred)
+            return;
+        this.firstConnectDeferred = undefined;
+        deferred.reject(err);
+    }
+    send(message) {
+        const text = JSON.stringify(message);
+        if (this.socket?.readyState === WebSocket.OPEN) {
+            this.socket.send(text);
+            return;
+        }
+        // Buffer while disconnected; flushed on reconnect in handleSocketOpen. Bounded
+        // so a long outage cannot grow memory without limit — a stale heartbeat is
+        // worth less than a fresh tool_result, so drop oldest first.
+        this.outbox.push(text);
+        if (this.outbox.length > CloudRuntime.MAX_OUTBOX) {
+            this.outbox.shift();
+        }
+    }
+}
+//# sourceMappingURL=cloud-runtime.js.map

package/packages/gsd-cloud/dist/cloud-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-runtime.js","sourceRoot":"","sources":["../src/cloud-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,IAAI,CAAC;AAI3B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAE5G,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,oCAAoC,GAAG,MAAM,CAAC;AACpD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,MAAM,CAAC,MAAM,uCAAuC,GAClD,wBAAwB,GAAG,oCAAoC;MAC7D,CAAC,wBAAwB,GAAG,CAAC,CAAC,GAAG,kBAAkB,CAAC;AAUxD,MAAM,OAAO,YAAY;IAiBJ;IACA;IACA;IAlBX,MAAM,CAAU,UAAU,GAAG,GAAG,CAAC;IACzC,0EAA0E;IAC1E,+EAA+E;IAC/E,yEAAyE;IACzE,gFAAgF;IAChF,mEAAmE;IAC3D,MAAM,CAAwB;IAC9B,SAAS,CAA6C;IACtD,SAAS,CAA4C;IAC5C,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACtD,MAAM,GAAa,EAAE,CAAC;IACtB,OAAO,GAAG,KAAK,CAAC;IAChB,oBAAoB,CAAyC;IAC7D,sBAAsB,GAAG,CAAC,CAAC;IAEnC,YACmB,KAAyC,EACzC,QAAkB,EAClB,MAAc;QAFd,UAAK,GAAL,KAAK,CAAoC;QACzC,aAAQ,GAAR,QAAQ,CAAU;QAClB,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,sBAAsB,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;IAC3C,CAAC;IAED,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,IAAI,CAAC,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,MAAM,EAAE,KAAK,EAAE,CAAC;IAClB,CAAC;IAEO,OAAO;QACb,IAAI,IAAI,CAAC,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;YAC/E,IAAI,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,4BAA4B,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACjF,IAAI,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QACpD,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE;YAC/D,MAAM,EAAE,mBAAmB,CAAC,UAAU,CAAC;YACvC,gBAAgB,EAAE,oCAAoC;SACvD,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,cAAc,EAAE,CAAC;YACnB,yEAAyE;YACzE,oEAAoE;YACpE,oDAAoD;YACpD,cAAc,CAAC,kBAAkB,EAAE,CAAC;YACpC,IAAI,cAAc,CAAC,UAAU,KAAK,SAAS,CAAC,OAAO,IAAI,cAAc,CAAC,UAAU,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;gBACtG,cAAc,CAAC,KAAK,EAAE,CAAC;YACzB,CAAC;QACH,CAAC;QAED,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACrB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5B,KAAK,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,MAAiB;QACxC,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QACnC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QACxH,8EAA8E;QAC9E,wEAAwE;QACxE,4EAA4E;QAC5E,mBAAmB;QACnB,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,IAAI,CAAC,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/F,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,MAAiB,EAAE,IAAY;QAC/D,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QACnC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAEO,iBAAiB,CAAC,MAAiB;QACzC,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QACnC,IAAI,IAAI,CAAC,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,kEAAkE;YAClE,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E;YAC1E,IAAI,CAAC,sBAAsB,IAAI,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,sBAAsB,IAAI,wBAAwB,EAAE,CAAC;gBAC5D,IAAI,CAAC,kBAAkB,CACrB,IAAI,KAAK,CACP,yCAAyC,IAAI,CAAC,sBAAsB,aAAa,CAClF,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gBACjE,OAAO,EAAE,IAAI,CAAC,sBAAsB;gBACpC,GAAG,EAAE,wBAAwB;aAC9B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,IAAI,CAAC,SAAS;YAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACxE,CAAC;IAEO,iBAAiB,CAAC,MAAiB,EAAE,GAAU;QACrD,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;YAChC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;YACpC,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAY;QACtC,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACnD,KAAK,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,OAAO;QACpF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YACvG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,OAAO;YAClD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,OAAO;YAClD,IAAI,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,aAAa;gBACnB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,SAAiB;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,IAAI,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAChD,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;gBACvG,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,OAAO,OAAO,CAAC,IAAI,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;YACjH,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBAC9C,SAAS;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,mBAAmB;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,oBAAoB,GAAG,SAAS,CAAC;QACtC,QAAQ,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;IAEO,kBAAkB,CAAC,GAAU;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,oBAAoB,GAAG,SAAS,CAAC;QACtC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAEO,IAAI,CAAC,OAAgB;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,+EAA+E;QAC/E,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;IACH,CAAC","sourcesContent":["import WebSocket from \"ws\";\nimport type { Logger } from \"./logger.js\";\nimport type { DaemonConfig } from \"./types.js\";\nimport type { Executor } from \"./executors/executor.js\";\nimport { createGatewayLookup, parseCloudGatewayUrl, validateGatewayNetworkTarget } from \"./cloud-config.js\";\n\nconst INITIAL_CONNECT_ATTEMPTS = 5;\nconst INITIAL_CONNECT_HANDSHAKE_TIMEOUT_MS = 30_000;\nconst RECONNECT_DELAY_MS = 5_000;\n\nexport const CLOUD_RUNTIME_INITIAL_CONNECT_WINDOW_MS =\n  INITIAL_CONNECT_ATTEMPTS * INITIAL_CONNECT_HANDSHAKE_TIMEOUT_MS\n  + (INITIAL_CONNECT_ATTEMPTS - 1) * RECONNECT_DELAY_MS;\n\ninterface GatewayMessage {\n  type: string;\n  requestId?: string;\n  toolName?: string;\n  args?: Record<string, unknown>;\n  projectAlias?: string;\n}\n\nexport class CloudRuntime {\n  private static readonly MAX_OUTBOX = 200;\n  // How many times to retry the initial connect before rejecting start(). A\n  // transient handshake failure (gateway briefly unreachable, DNS hiccup) should\n  // retry like the daemon's reconnect loop rather than kill the runtime; a\n  // persistent failure (gateway down, session rejected) must eventually reject so\n  // the CLI reports an error instead of hanging or exiting silently.\n  private socket: WebSocket | undefined;\n  private heartbeat: ReturnType<typeof setInterval> | undefined;\n  private reconnect: ReturnType<typeof setTimeout> | undefined;\n  private readonly inFlight = new Map<string, GatewayMessage>();\n  private outbox: string[] = [];\n  private stopped = false;\n  private firstConnectDeferred: PromiseWithResolvers<void> | undefined;\n  private initialConnectAttempts = 0;\n\n  constructor(\n    private readonly cloud: NonNullable<DaemonConfig[\"cloud\"]>,\n    private readonly executor: Executor,\n    private readonly logger: Logger,\n  ) {}\n\n  start(): Promise<void> {\n    this.stopped = false;\n    this.initialConnectAttempts = 0;\n    this.firstConnectDeferred = Promise.withResolvers<void>();\n    this.connect();\n    return this.firstConnectDeferred.promise;\n  }\n\n  stop(): void {\n    this.stopped = true;\n    this.rejectFirstConnect(new Error(\"cloud runtime stopped\"));\n    if (this.reconnect) clearTimeout(this.reconnect);\n    this.reconnect = undefined;\n    if (this.heartbeat) clearInterval(this.heartbeat);\n    this.heartbeat = undefined;\n    this.inFlight.clear();\n    this.outbox = [];\n    const socket = this.socket;\n    this.socket = undefined;\n    socket?.close();\n  }\n\n  private connect(): void {\n    if (this.reconnect) clearTimeout(this.reconnect);\n    this.reconnect = undefined;\n    if (!this.cloud.device_token || !this.cloud.runtime_id) {\n      this.logger.warn(\"cloud runtime skipped — missing device token or runtime id\");\n      this.rejectFirstConnect(new Error(\"cloud runtime missing device token or runtime id\"));\n      return;\n    }\n    const gatewayUrl = parseCloudGatewayUrl(this.cloud.gateway_url);\n    try {\n      validateGatewayNetworkTarget(gatewayUrl);\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      this.logger.warn(\"cloud runtime skipped unsafe gateway URL\", { error: message });\n      this.rejectFirstConnect(new Error(`cloud runtime unsafe gateway URL: ${message}`));\n      return;\n    }\n    const url = new URL(\"/runtime/connect\", gatewayUrl);\n    url.protocol = url.protocol === \"https:\" ? \"wss:\" : \"ws:\";\n    const socket = new WebSocket(url, {\n      headers: { Authorization: `Bearer ${this.cloud.device_token}` },\n      lookup: createGatewayLookup(gatewayUrl),\n      handshakeTimeout: INITIAL_CONNECT_HANDSHAKE_TIMEOUT_MS,\n    });\n    const previousSocket = this.socket;\n    this.socket = socket;\n    if (previousSocket) {\n      // Detach the old socket's handlers before closing so its listeners don't\n      // linger on a socket we've already replaced (handlers also guard on\n      // identity, but this releases them eagerly for GC).\n      previousSocket.removeAllListeners();\n      if (previousSocket.readyState !== WebSocket.CLOSING && previousSocket.readyState !== WebSocket.CLOSED) {\n        previousSocket.close();\n      }\n    }\n\n    socket.on(\"open\", () => {\n      this.handleSocketOpen(socket);\n    });\n    socket.on(\"message\", (data) => {\n      void this.handleSocketMessage(socket, data.toString(\"utf8\"));\n    });\n    socket.on(\"close\", () => {\n      this.handleSocketClose(socket);\n    });\n    socket.on(\"error\", (err) => {\n      this.handleSocketError(socket, err);\n    });\n  }\n\n  private handleSocketOpen(socket: WebSocket): void {\n    if (socket !== this.socket) return;\n    this.resolveFirstConnect();\n    this.logger.info(\"cloud runtime connected\", { gateway_url: this.cloud.gateway_url, runtime_id: this.cloud.runtime_id });\n    // Re-advertise projects (async: the hello is sent on a later microtask), then\n    // drain any messages buffered while disconnected. tool_results route by\n    // requestId on the authenticated connection, so drain order vs the hello is\n    // not significant.\n    void this.advertiseProjects();\n    const pending = this.outbox;\n    this.outbox = [];\n    for (const text of pending) {\n      if (this.socket?.readyState === WebSocket.OPEN) this.socket.send(text);\n      else this.outbox.push(text);\n    }\n    if (this.heartbeat) clearInterval(this.heartbeat);\n    this.heartbeat = setInterval(() => this.send({ type: \"heartbeat\", at: Date.now() }), 30_000);\n  }\n\n  private async handleSocketMessage(socket: WebSocket, text: string): Promise<void> {\n    if (socket !== this.socket) return;\n    await this.handleMessage(text);\n  }\n\n  private handleSocketClose(socket: WebSocket): void {\n    if (socket !== this.socket) return;\n    if (this.heartbeat) clearInterval(this.heartbeat);\n    this.heartbeat = undefined;\n    this.socket = undefined;\n    if (this.stopped) return;\n    if (this.firstConnectDeferred) {\n      // Still trying to establish the first connection: retry transient\n      // handshake failures (like the daemon's reconnect loop) and only reject\n      // start() once the bounded attempts are exhausted, so a brief blip does\n      // not kill the runtime while a persistent outage still surfaces an error.\n      this.initialConnectAttempts += 1;\n      if (this.initialConnectAttempts >= INITIAL_CONNECT_ATTEMPTS) {\n        this.rejectFirstConnect(\n          new Error(\n            `cloud runtime connection failed after ${this.initialConnectAttempts} attempt(s)`,\n          ),\n        );\n        return;\n      }\n      this.logger.warn(\"cloud runtime initial connect failed; retrying\", {\n        attempt: this.initialConnectAttempts,\n        max: INITIAL_CONNECT_ATTEMPTS,\n      });\n    } else {\n      this.logger.warn(\"cloud runtime disconnected; reconnecting\");\n    }\n    if (this.reconnect) clearTimeout(this.reconnect);\n    this.reconnect = setTimeout(() => this.connect(), RECONNECT_DELAY_MS);\n  }\n\n  private handleSocketError(socket: WebSocket, err: Error): void {\n    if (socket !== this.socket) return;\n    this.logger.warn(\"cloud runtime socket error\", { error: err.message });\n  }\n\n  private async advertiseProjects(): Promise<void> {\n    const projects = await this.executor.advertisedProjects();\n    this.send({\n      type: \"hello\",\n      runtimeId: this.cloud.runtime_id,\n      runtimeName: this.cloud.runtime_name,\n      projects,\n    });\n  }\n\n  private async handleMessage(text: string): Promise<void> {\n    let message: GatewayMessage;\n    try {\n      message = JSON.parse(text) as GatewayMessage;\n    } catch {\n      return;\n    }\n    if (message.type === \"cancel\" && message.requestId) {\n      void this.cancelInFlight(message.requestId);\n      return;\n    }\n    if (message.type !== \"tool_call\" || !message.requestId || !message.toolName) return;\n    this.inFlight.set(message.requestId, message);\n    try {\n      const result = await this.executor.execute(message.toolName, message.args ?? {}, message.projectAlias);\n      if (!this.inFlight.has(message.requestId)) return;\n      this.send({ type: \"tool_result\", requestId: message.requestId, result });\n    } catch (err) {\n      if (!this.inFlight.has(message.requestId)) return;\n      this.send({\n        type: \"tool_result\",\n        requestId: message.requestId,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    } finally {\n      this.inFlight.delete(message.requestId);\n    }\n  }\n\n  private async cancelInFlight(requestId: string): Promise<void> {\n    const pending = this.inFlight.get(requestId);\n    if (!pending) return;\n    this.inFlight.delete(requestId);\n    try {\n      if (typeof pending.args?.sessionId === \"string\") {\n        await this.executor.execute(\"gsd_cancel\", { sessionId: pending.args.sessionId }, pending.projectAlias);\n        return;\n      }\n      const projectDir = typeof pending.args?.projectDir === \"string\" ? pending.args.projectDir : pending.projectAlias;\n      if (projectDir) {\n        await this.executor.execute(\"gsd_cancel\", { projectDir });\n      }\n    } catch (err) {\n      this.logger.warn(\"cloud runtime cancel failed\", {\n        requestId,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  private resolveFirstConnect(): void {\n    const deferred = this.firstConnectDeferred;\n    if (!deferred) return;\n    this.firstConnectDeferred = undefined;\n    deferred.resolve();\n  }\n\n  private rejectFirstConnect(err: Error): void {\n    const deferred = this.firstConnectDeferred;\n    if (!deferred) return;\n    this.firstConnectDeferred = undefined;\n    deferred.reject(err);\n  }\n\n  private send(message: unknown): void {\n    const text = JSON.stringify(message);\n    if (this.socket?.readyState === WebSocket.OPEN) {\n      this.socket.send(text);\n      return;\n    }\n    // Buffer while disconnected; flushed on reconnect in handleSocketOpen. Bounded\n    // so a long outage cannot grow memory without limit — a stale heartbeat is\n    // worth less than a fresh tool_result, so drop oldest first.\n    this.outbox.push(text);\n    if (this.outbox.length > CloudRuntime.MAX_OUTBOX) {\n      this.outbox.shift();\n    }\n  }\n}\n"]}

package/packages/gsd-cloud/dist/cloud-runtime.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cloud-runtime.test.d.ts.map

package/packages/gsd-cloud/dist/cloud-runtime.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-runtime.test.d.ts","sourceRoot":"","sources":["../src/cloud-runtime.test.ts"],"names":[],"mappings":""}

package/packages/gsd-cloud/dist/cloud-runtime.test.js

@@ -0,0 +1,88 @@
+// Project/App: Open GSD
+// File Purpose: Regression tests for CloudRuntime.start()'s first-connect promise
+// — it must resolve only once the relay is actually up and reject on connect
+// failure, so the CLI never reports "connected" for a socket that never opened.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import WebSocket from "ws";
+import { CloudRuntime } from "./cloud-runtime.js";
+const noopLogger = { info: () => undefined, warn: () => undefined, error: () => undefined, debug: () => undefined };
+const noopExecutor = { execute: async () => ({}), advertisedProjects: async () => [] };
+function makeRuntime(cloud = {}) {
+    return new CloudRuntime({ gateway_url: "wss://cloud.example.net", device_token: "fixture", runtime_id: "runtime", ...cloud }, noopExecutor, noopLogger);
+}
+function fakeSocket(readyState = WebSocket.OPEN) {
+    const sent = [];
+    return { readyState, sent, send: (t) => sent.push(t), close: () => undefined };
+}
+test("start()'s first-connect promise resolves only when the relay socket opens", async () => {
+    const runtime = makeRuntime();
+    const internals = runtime;
+    try {
+        const deferred = Promise.withResolvers();
+        internals.firstConnectDeferred = deferred;
+        const socket = fakeSocket();
+        internals.socket = socket;
+        let settled = false;
+        void deferred.promise.then(() => (settled = true));
+        await Promise.resolve(); // let any premature settle flush
+        assert.equal(settled, false, "promise must not resolve before the socket opens");
+        internals.handleSocketOpen(socket);
+        await deferred.promise; // resolves — otherwise this hangs/throws
+    }
+    finally {
+        runtime.stop();
+    }
+});
+test("an early socket close retries instead of rejecting while attempts remain", async () => {
+    const runtime = makeRuntime();
+    const internals = runtime;
+    try {
+        const deferred = Promise.withResolvers();
+        internals.firstConnectDeferred = deferred;
+        const socket = fakeSocket();
+        internals.socket = socket;
+        let settled = false;
+        void deferred.promise.then(() => (settled = true), () => (settled = true));
+        internals.handleSocketClose(socket); // first transient failure
+        await Promise.resolve();
+        assert.equal(settled, false, "a single early close must not settle start()");
+        assert.equal(internals.initialConnectAttempts, 1);
+        assert.notEqual(internals.reconnect, undefined, "a reconnect must be scheduled");
+    }
+    finally {
+        runtime.stop();
+    }
+});
+test("start()'s first-connect promise rejects once the initial connect attempts are exhausted", async () => {
+    const runtime = makeRuntime();
+    const internals = runtime;
+    try {
+        const deferred = Promise.withResolvers();
+        internals.firstConnectDeferred = deferred;
+        // Simulate having already burned every retry but the last so the next close
+        // is the one that must give up and reject.
+        internals.initialConnectAttempts = 4;
+        const socket = fakeSocket();
+        internals.socket = socket;
+        internals.handleSocketClose(socket);
+        await assert.rejects(deferred.promise, /connection failed/);
+    }
+    finally {
+        runtime.stop();
+    }
+});
+test("connect() rejects the first-connect promise when the device token is missing", async () => {
+    const runtime = makeRuntime({ device_token: "" });
+    const internals = runtime;
+    try {
+        const deferred = Promise.withResolvers();
+        internals.firstConnectDeferred = deferred;
+        internals.connect();
+        await assert.rejects(deferred.promise, /missing device token/);
+    }
+    finally {
+        runtime.stop();
+    }
+});
+//# sourceMappingURL=cloud-runtime.test.js.map

package/packages/gsd-cloud/dist/cloud-runtime.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-runtime.test.js","sourceRoot":"","sources":["../src/cloud-runtime.test.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,kFAAkF;AAClF,6EAA6E;AAC7E,gFAAgF;AAChF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AACpH,MAAM,YAAY,GAAG,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;AAEvF,SAAS,WAAW,CAAC,QAAiC,EAAE;IACtD,OAAO,IAAI,YAAY,CACrB,EAAE,WAAW,EAAE,yBAAyB,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,KAAK,EAAW,EAC7G,YAAqB,EACrB,UAAmB,CACpB,CAAC;AACJ,CAAC;AAGD,SAAS,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,IAAI;IAC7C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AACzF,CAAC;AAWD,IAAI,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;IAC3F,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAsC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;QAC/C,SAAS,CAAC,oBAAoB,GAAG,QAAQ,CAAC;QAC1C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;QAE1B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,iCAAiC;QAC1D,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,kDAAkD,CAAC,CAAC;QAEjF,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,yCAAyC;IACnE,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,EAAE,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAsC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;QAC/C,SAAS,CAAC,oBAAoB,GAAG,QAAQ,CAAC;QAC1C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;QAE1B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;QAE3E,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B;QAC/D,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,8CAA8C,CAAC,CAAC;QAC7E,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,+BAA+B,CAAC,CAAC;IACnF,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,EAAE,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;IACzG,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAsC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;QAC/C,SAAS,CAAC,oBAAoB,GAAG,QAAQ,CAAC;QAC1C,4EAA4E;QAC5E,2CAA2C;QAC3C,SAAS,CAAC,sBAAsB,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;QAE1B,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,EAAE,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;IAC9F,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAsC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;QAC/C,SAAS,CAAC,oBAAoB,GAAG,QAAQ,CAAC;QAC1C,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,EAAE,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["// Project/App: Open GSD\n// File Purpose: Regression tests for CloudRuntime.start()'s first-connect promise\n// — it must resolve only once the relay is actually up and reject on connect\n// failure, so the CLI never reports \"connected\" for a socket that never opened.\nimport { test } from \"node:test\";\nimport assert from \"node:assert/strict\";\nimport WebSocket from \"ws\";\nimport { CloudRuntime } from \"./cloud-runtime.js\";\n\nconst noopLogger = { info: () => undefined, warn: () => undefined, error: () => undefined, debug: () => undefined };\nconst noopExecutor = { execute: async () => ({}), advertisedProjects: async () => [] };\n\nfunction makeRuntime(cloud: Record<string, unknown> = {}): CloudRuntime {\n  return new CloudRuntime(\n    { gateway_url: \"wss://cloud.example.net\", device_token: \"fixture\", runtime_id: \"runtime\", ...cloud } as never,\n    noopExecutor as never,\n    noopLogger as never,\n  );\n}\n\ntype FakeSocket = { readyState: number; sent: string[]; send: (t: string) => void; close: () => void };\nfunction fakeSocket(readyState = WebSocket.OPEN): FakeSocket {\n  const sent: string[] = [];\n  return { readyState, sent, send: (t: string) => sent.push(t), close: () => undefined };\n}\ntype RuntimeInternals = {\n  socket: FakeSocket | undefined;\n  firstConnectDeferred: PromiseWithResolvers<void> | undefined;\n  initialConnectAttempts: number;\n  reconnect: ReturnType<typeof setTimeout> | undefined;\n  handleSocketOpen: (socket: unknown) => void;\n  handleSocketClose: (socket: unknown) => void;\n  connect: () => void;\n};\n\ntest(\"start()'s first-connect promise resolves only when the relay socket opens\", async () => {\n  const runtime = makeRuntime();\n  const internals = runtime as unknown as RuntimeInternals;\n  try {\n    const deferred = Promise.withResolvers<void>();\n    internals.firstConnectDeferred = deferred;\n    const socket = fakeSocket();\n    internals.socket = socket;\n\n    let settled = false;\n    void deferred.promise.then(() => (settled = true));\n    await Promise.resolve(); // let any premature settle flush\n    assert.equal(settled, false, \"promise must not resolve before the socket opens\");\n\n    internals.handleSocketOpen(socket);\n    await deferred.promise; // resolves — otherwise this hangs/throws\n  } finally {\n    runtime.stop();\n  }\n});\n\ntest(\"an early socket close retries instead of rejecting while attempts remain\", async () => {\n  const runtime = makeRuntime();\n  const internals = runtime as unknown as RuntimeInternals;\n  try {\n    const deferred = Promise.withResolvers<void>();\n    internals.firstConnectDeferred = deferred;\n    const socket = fakeSocket();\n    internals.socket = socket;\n\n    let settled = false;\n    void deferred.promise.then(() => (settled = true), () => (settled = true));\n\n    internals.handleSocketClose(socket); // first transient failure\n    await Promise.resolve();\n    assert.equal(settled, false, \"a single early close must not settle start()\");\n    assert.equal(internals.initialConnectAttempts, 1);\n    assert.notEqual(internals.reconnect, undefined, \"a reconnect must be scheduled\");\n  } finally {\n    runtime.stop();\n  }\n});\n\ntest(\"start()'s first-connect promise rejects once the initial connect attempts are exhausted\", async () => {\n  const runtime = makeRuntime();\n  const internals = runtime as unknown as RuntimeInternals;\n  try {\n    const deferred = Promise.withResolvers<void>();\n    internals.firstConnectDeferred = deferred;\n    // Simulate having already burned every retry but the last so the next close\n    // is the one that must give up and reject.\n    internals.initialConnectAttempts = 4;\n    const socket = fakeSocket();\n    internals.socket = socket;\n\n    internals.handleSocketClose(socket);\n    await assert.rejects(deferred.promise, /connection failed/);\n  } finally {\n    runtime.stop();\n  }\n});\n\ntest(\"connect() rejects the first-connect promise when the device token is missing\", async () => {\n  const runtime = makeRuntime({ device_token: \"\" });\n  const internals = runtime as unknown as RuntimeInternals;\n  try {\n    const deferred = Promise.withResolvers<void>();\n    internals.firstConnectDeferred = deferred;\n    internals.connect();\n    await assert.rejects(deferred.promise, /missing device token/);\n  } finally {\n    runtime.stop();\n  }\n});\n"]}

package/packages/gsd-cloud/dist/cloud-token.d.ts

@@ -0,0 +1,3 @@
+export declare function protectCloudDeviceToken(token: string): string;
+export declare function unprotectCloudDeviceToken(value: string): string | undefined;
+//# sourceMappingURL=cloud-token.d.ts.map

package/packages/gsd-cloud/dist/cloud-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-token.d.ts","sourceRoot":"","sources":["../src/cloud-token.ts"],"names":[],"mappings":"AAMA,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM7D;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAc3E"}

package/packages/gsd-cloud/dist/cloud-token.js

@@ -0,0 +1,37 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { homedir, hostname, userInfo } from "node:os";
+const PREFIX = "v1.";
+const ALGORITHM = "aes-256-gcm";
+export function protectCloudDeviceToken(token) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv(ALGORITHM, cloudTokenKey(), iv);
+    const ciphertext = Buffer.concat([cipher.update(token, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `${PREFIX}${Buffer.concat([iv, tag, ciphertext]).toString("base64url")}`;
+}
+export function unprotectCloudDeviceToken(value) {
+    if (!value.startsWith(PREFIX))
+        return undefined;
+    try {
+        const payload = Buffer.from(value.slice(PREFIX.length), "base64url");
+        if (payload.length <= 28)
+            return undefined;
+        const iv = payload.subarray(0, 12);
+        const tag = payload.subarray(12, 28);
+        const ciphertext = payload.subarray(28);
+        const decipher = createDecipheriv(ALGORITHM, cloudTokenKey(), iv);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+function cloudTokenKey() {
+    const configuredKey = process.env["GSD_CLOUD_TOKEN_KEY"];
+    const material = configuredKey && configuredKey.trim()
+        ? `env:${configuredKey}`
+        : `local:${hostname()}:${userInfo().username}:${homedir()}`;
+    return createHash("sha256").update(material, "utf8").digest();
+}
+//# sourceMappingURL=cloud-token.js.map

package/packages/gsd-cloud/dist/cloud-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-token.js","sourceRoot":"","sources":["../src/cloud-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEtD,MAAM,MAAM,GAAG,KAAK,CAAC;AACrB,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;QAClE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,aAAa,IAAI,aAAa,CAAC,IAAI,EAAE;QACpD,CAAC,CAAC,OAAO,aAAa,EAAE;QACxB,CAAC,CAAC,SAAS,QAAQ,EAAE,IAAI,QAAQ,EAAE,CAAC,QAAQ,IAAI,OAAO,EAAE,EAAE,CAAC;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAChE,CAAC","sourcesContent":["import { createCipheriv, createDecipheriv, createHash, randomBytes } from \"node:crypto\";\nimport { homedir, hostname, userInfo } from \"node:os\";\n\nconst PREFIX = \"v1.\";\nconst ALGORITHM = \"aes-256-gcm\";\n\nexport function protectCloudDeviceToken(token: string): string {\n  const iv = randomBytes(12);\n  const cipher = createCipheriv(ALGORITHM, cloudTokenKey(), iv);\n  const ciphertext = Buffer.concat([cipher.update(token, \"utf8\"), cipher.final()]);\n  const tag = cipher.getAuthTag();\n  return `${PREFIX}${Buffer.concat([iv, tag, ciphertext]).toString(\"base64url\")}`;\n}\n\nexport function unprotectCloudDeviceToken(value: string): string | undefined {\n  if (!value.startsWith(PREFIX)) return undefined;\n  try {\n    const payload = Buffer.from(value.slice(PREFIX.length), \"base64url\");\n    if (payload.length <= 28) return undefined;\n    const iv = payload.subarray(0, 12);\n    const tag = payload.subarray(12, 28);\n    const ciphertext = payload.subarray(28);\n    const decipher = createDecipheriv(ALGORITHM, cloudTokenKey(), iv);\n    decipher.setAuthTag(tag);\n    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString(\"utf8\");\n  } catch {\n    return undefined;\n  }\n}\n\nfunction cloudTokenKey(): Buffer {\n  const configuredKey = process.env[\"GSD_CLOUD_TOKEN_KEY\"];\n  const material = configuredKey && configuredKey.trim()\n    ? `env:${configuredKey}`\n    : `local:${hostname()}:${userInfo().username}:${homedir()}`;\n  return createHash(\"sha256\").update(material, \"utf8\").digest();\n}\n"]}

package/packages/gsd-cloud/dist/config.d.ts

@@ -0,0 +1,17 @@
+import type { DaemonConfig } from './types.js';
+/**
+ * Resolve the config file path.
+ * Priority: explicit CLI arg → GSD_DAEMON_CONFIG env → ~/.gsd/daemon.yaml
+ */
+export declare function resolveConfigPath(cliPath?: string): string;
+/**
+ * Validate and normalise a raw parsed object into a DaemonConfig.
+ * Missing/invalid fields are filled with defaults. Invalid log level falls back to 'info'.
+ */
+export declare function validateConfig(raw: unknown): DaemonConfig;
+/**
+ * Load and validate a DaemonConfig from a YAML file.
+ * If the file doesn't exist, returns defaults. If the file is malformed YAML, throws.
+ */
+export declare function loadConfig(configPath: string): DaemonConfig;
+//# sourceMappingURL=config.d.ts.map

package/packages/gsd-cloud/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAY,MAAM,YAAY,CAAC;AA0BzD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAK1D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAwFzD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAgB3D"}

package/packages/gsd-cloud/dist/config.js

@@ -0,0 +1,146 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { resolve } from 'node:path';
+import { parse as parseYaml } from 'yaml';
+import { unprotectCloudDeviceToken } from './cloud-token.js';
+const VALID_LOG_LEVELS = new Set(['debug', 'info', 'warn', 'error']);
+/** Expand leading ~ to the user's home directory. */
+function expandTilde(p) {
+    if (p.startsWith('~/') || p === '~') {
+        return resolve(homedir(), p.slice(2) || '.');
+    }
+    return p;
+}
+/** Default config values when no file is present or fields are missing. */
+function defaults() {
+    return {
+        cloud: undefined,
+        discord: undefined,
+        projects: { scan_roots: [] },
+        log: {
+            file: resolve(homedir(), '.gsd', 'daemon.log'),
+            level: 'info',
+            max_size_mb: 50,
+        },
+    };
+}
+/**
+ * Resolve the config file path.
+ * Priority: explicit CLI arg → GSD_DAEMON_CONFIG env → ~/.gsd/daemon.yaml
+ */
+export function resolveConfigPath(cliPath) {
+    if (cliPath)
+        return expandTilde(cliPath);
+    const envPath = process.env['GSD_DAEMON_CONFIG'];
+    if (envPath)
+        return expandTilde(envPath);
+    return resolve(homedir(), '.gsd', 'daemon.yaml');
+}
+/**
+ * Validate and normalise a raw parsed object into a DaemonConfig.
+ * Missing/invalid fields are filled with defaults. Invalid log level falls back to 'info'.
+ */
+export function validateConfig(raw) {
+    const def = defaults();
+    if (raw == null || typeof raw !== 'object')
+        return def;
+    const obj = raw;
+    // --- cloud ---
+    let cloud = undefined;
+    if (obj['cloud'] != null && typeof obj['cloud'] === 'object') {
+        const c = obj['cloud'];
+        const encryptedDeviceToken = typeof c['device_token_encrypted'] === 'string'
+            ? unprotectCloudDeviceToken(c['device_token_encrypted'])
+            : undefined;
+        const deviceToken = typeof c['device_token'] === 'string' ? c['device_token'] : encryptedDeviceToken;
+        cloud = {
+            gateway_url: typeof c['gateway_url'] === 'string' ? c['gateway_url'] : '',
+            ...(deviceToken ? { device_token: deviceToken } : {}),
+            ...(typeof c['runtime_id'] === 'string' ? { runtime_id: c['runtime_id'] } : {}),
+            ...(typeof c['runtime_name'] === 'string' ? { runtime_name: c['runtime_name'] } : {}),
+            ...(typeof c['enabled'] === 'boolean' ? { enabled: c['enabled'] } : {}),
+        };
+    }
+    // --- discord ---
+    let discord = undefined;
+    if (obj['discord'] != null && typeof obj['discord'] === 'object') {
+        const d = obj['discord'];
+        discord = {
+            token: typeof d['token'] === 'string' ? d['token'] : '',
+            guild_id: typeof d['guild_id'] === 'string' ? d['guild_id'] : '',
+            owner_id: typeof d['owner_id'] === 'string' ? d['owner_id'] : '',
+            ...(typeof d['dm_on_blocker'] === 'boolean' ? { dm_on_blocker: d['dm_on_blocker'] } : {}),
+            ...(typeof d['control_channel_id'] === 'string' ? { control_channel_id: d['control_channel_id'] } : {}),
+        };
+        // Parse orchestrator sub-block
+        if (d['orchestrator'] != null && typeof d['orchestrator'] === 'object') {
+            const orc = d['orchestrator'];
+            discord.orchestrator = {
+                ...(typeof orc['model'] === 'string' ? { model: orc['model'] } : {}),
+                ...(typeof orc['max_tokens'] === 'number' && orc['max_tokens'] > 0 ? { max_tokens: orc['max_tokens'] } : {}),
+            };
+        }
+    }
+    // --- projects ---
+    let scanRoots = [];
+    if (obj['projects'] != null && typeof obj['projects'] === 'object') {
+        const p = obj['projects'];
+        if (Array.isArray(p['scan_roots'])) {
+            scanRoots = p['scan_roots']
+                .filter((s) => typeof s === 'string')
+                .map(expandTilde);
+        }
+    }
+    // --- log ---
+    let logFile = def.log.file;
+    let logLevel = def.log.level;
+    let maxSizeMb = def.log.max_size_mb;
+    if (obj['log'] != null && typeof obj['log'] === 'object') {
+        const l = obj['log'];
+        if (typeof l['file'] === 'string')
+            logFile = expandTilde(l['file']);
+        if (typeof l['level'] === 'string') {
+            logLevel = VALID_LOG_LEVELS.has(l['level']) ? l['level'] : 'info';
+        }
+        if (typeof l['max_size_mb'] === 'number' && l['max_size_mb'] > 0) {
+            maxSizeMb = l['max_size_mb'];
+        }
+    }
+    // --- env override: DISCORD_BOT_TOKEN ---
+    const envToken = process.env['DISCORD_BOT_TOKEN'];
+    if (envToken) {
+        if (!discord) {
+            discord = { token: envToken, guild_id: '', owner_id: '' };
+        }
+        else {
+            discord = { ...discord, token: envToken };
+        }
+    }
+    return {
+        cloud,
+        discord,
+        projects: { scan_roots: scanRoots },
+        log: { file: logFile, level: logLevel, max_size_mb: maxSizeMb },
+    };
+}
+/**
+ * Load and validate a DaemonConfig from a YAML file.
+ * If the file doesn't exist, returns defaults. If the file is malformed YAML, throws.
+ */
+export function loadConfig(configPath) {
+    if (!existsSync(configPath)) {
+        // Still apply env-var overrides even when file is missing
+        return validateConfig(null);
+    }
+    const raw = readFileSync(configPath, 'utf-8');
+    let parsed;
+    try {
+        parsed = parseYaml(raw);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to parse YAML config at ${configPath}: ${msg}`);
+    }
+    return validateConfig(parsed);
+}
+//# sourceMappingURL=config.js.map