@openhands/agent-canvas 1.0.0-rc.8 → 1.0.0

package/dist/api/llm-subscription-service.cjs

@@ -0,0 +1,2 @@
+require(`../_virtual/_rolldown/runtime.cjs`);const e=require(`./agent-server-client-options.cjs`),t=require(`../constants/llm-subscription.cjs`);function n(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}var r=(e,t)=>{for(let n of t){let t=e[n];if(typeof t==`string`&&t.trim().length>0)return t.trim()}return null},i=(e,t)=>{for(let n of t){let t=e[n];if(typeof t==`number`&&Number.isFinite(t))return t}return null},a=(e,t)=>{for(let n of t){let t=e[n];if(typeof t==`boolean`)return t}return!1};async function o(t,n={}){let{host:r,apiKey:i}=e.getAgentServerClientOptions(),a=new Headers(n.headers);a.set(`Accept`,`application/json`),n.body&&!a.has(`Content-Type`)&&a.set(`Content-Type`,`application/json`),i&&a.set(`X-Session-API-Key`,i);let o=await fetch(`${r}${t}`,{...n,headers:a});if(!o.ok)throw Error(`Subscription request failed with ${o.status}`);return o.json()}function s(e){return Array.isArray(e)?e.filter(e=>typeof e==`string`):n(e)&&Array.isArray(e.models)?e.models.filter(e=>typeof e==`string`):[]}function c(e){return{vendor:t.OPENAI_SUBSCRIPTION_VENDOR,connected:a(e,[`connected`,`authenticated`,`is_connected`]),accountEmail:r(e,[`account_email`,`email`,`account`]),expiresAt:r(e,[`expires_at`,`expiresAt`])??i(e,[`expires_at`,`expiresAt`])}}function l(e){let t=r(e,[`device_code`,`deviceCode`]),n=r(e,[`user_code`,`userCode`]),a=r(e,[`verification_uri`,`verificationUri`,`verification_url`,`verificationUrl`]);if(!t||!n||!a)throw Error(`Subscription device login response is incomplete`);return{deviceCode:t,userCode:n,verificationUri:a,verificationUriComplete:r(e,[`verification_uri_complete`,`verificationUriComplete`,`verification_url_complete`,`verificationUrlComplete`]),expiresAt:r(e,[`expires_at`,`expiresAt`])??i(e,[`expires_at`,`expiresAt`,`expires_in`,`expiresIn`]),intervalSeconds:i(e,[`interval`,`interval_seconds`,`intervalSeconds`])}}var u=class{static async getOpenAIModels(){return s(await o(t.OPENAI_SUBSCRIPTION_MODELS_PATH))}static async getOpenAIStatus(){return c(await o(t.OPENAI_SUBSCRIPTION_STATUS_PATH))}static async startOpenAIDeviceLogin(){return l(await o(t.OPENAI_SUBSCRIPTION_DEVICE_START_PATH,{method:`POST`}))}static async pollOpenAIDeviceLogin(e){return c(await o(t.OPENAI_SUBSCRIPTION_DEVICE_POLL_PATH,{method:`POST`,body:JSON.stringify({device_code:e})}))}static async logoutOpenAI(){return c(await o(t.OPENAI_SUBSCRIPTION_LOGOUT_PATH,{method:`POST`}))}};exports.default=u;
+//# sourceMappingURL=llm-subscription-service.cjs.map

package/dist/api/llm-subscription-service.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-subscription-service.cjs","names":[],"sources":["../../src/api/llm-subscription-service.ts"],"sourcesContent":["import { getAgentServerClientOptions } from \"./agent-server-client-options\";\nimport {\n  OPENAI_SUBSCRIPTION_DEVICE_POLL_PATH,\n  OPENAI_SUBSCRIPTION_DEVICE_START_PATH,\n  OPENAI_SUBSCRIPTION_LOGOUT_PATH,\n  OPENAI_SUBSCRIPTION_MODELS_PATH,\n  OPENAI_SUBSCRIPTION_STATUS_PATH,\n  OPENAI_SUBSCRIPTION_VENDOR,\n} from \"#/constants/llm-subscription\";\n\ntype RawSubscriptionStatus = Record<string, unknown>;\ntype RawDeviceStart = Record<string, unknown>;\n\nexport interface LLMSubscriptionStatus {\n  vendor: typeof OPENAI_SUBSCRIPTION_VENDOR;\n  connected: boolean;\n  accountEmail: string | null;\n  expiresAt: string | number | null;\n}\n\nexport interface LLMSubscriptionDeviceChallenge {\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string | null;\n  expiresAt: string | number | null;\n  intervalSeconds: number | null;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nconst readString = (\n  value: Record<string, unknown>,\n  keys: string[],\n): string | null => {\n  for (const key of keys) {\n    const candidate = value[key];\n    if (typeof candidate === \"string\" && candidate.trim().length > 0) {\n      return candidate.trim();\n    }\n  }\n  return null;\n};\n\nconst readNumber = (\n  value: Record<string, unknown>,\n  keys: string[],\n): number | null => {\n  for (const key of keys) {\n    const candidate = value[key];\n    if (typeof candidate === \"number\" && Number.isFinite(candidate)) {\n      return candidate;\n    }\n  }\n  return null;\n};\n\nconst readBoolean = (\n  value: Record<string, unknown>,\n  keys: string[],\n): boolean => {\n  for (const key of keys) {\n    const candidate = value[key];\n    if (typeof candidate === \"boolean\") {\n      return candidate;\n    }\n  }\n  return false;\n};\n\nasync function requestSubscriptionEndpoint(\n  path: string,\n  init: RequestInit = {},\n): Promise<unknown> {\n  const { host, apiKey } = getAgentServerClientOptions();\n  const headers = new Headers(init.headers);\n  headers.set(\"Accept\", \"application/json\");\n  if (init.body && !headers.has(\"Content-Type\")) {\n    headers.set(\"Content-Type\", \"application/json\");\n  }\n  if (apiKey) {\n    headers.set(\"X-Session-API-Key\", apiKey);\n  }\n\n  const response = await fetch(`${host}${path}`, { ...init, headers });\n  if (!response.ok) {\n    throw new Error(`Subscription request failed with ${response.status}`);\n  }\n  return response.json();\n}\n\nfunction normalizeModels(raw: unknown): string[] {\n  if (Array.isArray(raw)) {\n    return raw.filter((item): item is string => typeof item === \"string\");\n  }\n  if (isRecord(raw) && Array.isArray(raw.models)) {\n    return raw.models.filter(\n      (item): item is string => typeof item === \"string\",\n    );\n  }\n  return [];\n}\n\nfunction normalizeStatus(raw: RawSubscriptionStatus): LLMSubscriptionStatus {\n  return {\n    vendor: OPENAI_SUBSCRIPTION_VENDOR,\n    connected: readBoolean(raw, [\"connected\", \"authenticated\", \"is_connected\"]),\n    accountEmail: readString(raw, [\"account_email\", \"email\", \"account\"]),\n    expiresAt:\n      readString(raw, [\"expires_at\", \"expiresAt\"]) ??\n      readNumber(raw, [\"expires_at\", \"expiresAt\"]),\n  };\n}\n\nfunction normalizeDeviceChallenge(\n  raw: RawDeviceStart,\n): LLMSubscriptionDeviceChallenge {\n  const deviceCode = readString(raw, [\"device_code\", \"deviceCode\"]);\n  const userCode = readString(raw, [\"user_code\", \"userCode\"]);\n  const verificationUri = readString(raw, [\n    \"verification_uri\",\n    \"verificationUri\",\n    \"verification_url\",\n    \"verificationUrl\",\n  ]);\n\n  if (!deviceCode || !userCode || !verificationUri) {\n    throw new Error(\"Subscription device login response is incomplete\");\n  }\n\n  return {\n    deviceCode,\n    userCode,\n    verificationUri,\n    verificationUriComplete: readString(raw, [\n      \"verification_uri_complete\",\n      \"verificationUriComplete\",\n      \"verification_url_complete\",\n      \"verificationUrlComplete\",\n    ]),\n    expiresAt:\n      readString(raw, [\"expires_at\", \"expiresAt\"]) ??\n      readNumber(raw, [\"expires_at\", \"expiresAt\", \"expires_in\", \"expiresIn\"]),\n    intervalSeconds: readNumber(raw, [\n      \"interval\",\n      \"interval_seconds\",\n      \"intervalSeconds\",\n    ]),\n  };\n}\n\nclass LLMSubscriptionService {\n  static async getOpenAIModels(): Promise<string[]> {\n    const response = await requestSubscriptionEndpoint(\n      OPENAI_SUBSCRIPTION_MODELS_PATH,\n    );\n    return normalizeModels(response);\n  }\n\n  static async getOpenAIStatus(): Promise<LLMSubscriptionStatus> {\n    const response = await requestSubscriptionEndpoint(\n      OPENAI_SUBSCRIPTION_STATUS_PATH,\n    );\n    return normalizeStatus(response as RawSubscriptionStatus);\n  }\n\n  static async startOpenAIDeviceLogin(): Promise<LLMSubscriptionDeviceChallenge> {\n    const response = await requestSubscriptionEndpoint(\n      OPENAI_SUBSCRIPTION_DEVICE_START_PATH,\n      { method: \"POST\" },\n    );\n    return normalizeDeviceChallenge(response as RawDeviceStart);\n  }\n\n  static async pollOpenAIDeviceLogin(\n    deviceCode: string,\n  ): Promise<LLMSubscriptionStatus> {\n    const response = await requestSubscriptionEndpoint(\n      OPENAI_SUBSCRIPTION_DEVICE_POLL_PATH,\n      {\n        method: \"POST\",\n        body: JSON.stringify({ device_code: deviceCode }),\n      },\n    );\n    return normalizeStatus(response as RawSubscriptionStatus);\n  }\n\n  static async logoutOpenAI(): Promise<LLMSubscriptionStatus> {\n    const response = await requestSubscriptionEndpoint(\n      OPENAI_SUBSCRIPTION_LOGOUT_PATH,\n      { method: \"POST\" },\n    );\n    return normalizeStatus(response as RawSubscriptionStatus);\n  }\n}\n\nexport default LLMSubscriptionService;\n"],"mappings":"iJA6BA,SAAS,EAAS,EAAkD,CAClE,OAAO,OAAO,GAAU,YAAY,GAAkB,CAAC,MAAM,QAAQ,EAAM,CAG7E,IAAM,GACJ,EACA,IACkB,CAClB,IAAK,IAAM,KAAO,EAAM,CACtB,IAAM,EAAY,EAAM,GACxB,GAAI,OAAO,GAAc,UAAY,EAAU,MAAM,CAAC,OAAS,EAC7D,OAAO,EAAU,MAAM,CAG3B,OAAO,MAGH,GACJ,EACA,IACkB,CAClB,IAAK,IAAM,KAAO,EAAM,CACtB,IAAM,EAAY,EAAM,GACxB,GAAI,OAAO,GAAc,UAAY,OAAO,SAAS,EAAU,CAC7D,OAAO,EAGX,OAAO,MAGH,GACJ,EACA,IACY,CACZ,IAAK,IAAM,KAAO,EAAM,CACtB,IAAM,EAAY,EAAM,GACxB,GAAI,OAAO,GAAc,UACvB,OAAO,EAGX,MAAO,IAGT,eAAe,EACb,EACA,EAAoB,EAAE,CACJ,CAClB,GAAM,CAAE,OAAM,UAAW,EAAA,6BAA6B,CAChD,EAAU,IAAI,QAAQ,EAAK,QAAQ,CACzC,EAAQ,IAAI,SAAU,mBAAmB,CACrC,EAAK,MAAQ,CAAC,EAAQ,IAAI,eAAe,EAC3C,EAAQ,IAAI,eAAgB,mBAAmB,CAE7C,GACF,EAAQ,IAAI,oBAAqB,EAAO,CAG1C,IAAM,EAAW,MAAM,MAAM,GAAG,IAAO,IAAQ,CAAE,GAAG,EAAM,UAAS,CAAC,CACpE,GAAI,CAAC,EAAS,GACZ,MAAU,MAAM,oCAAoC,EAAS,SAAS,CAExE,OAAO,EAAS,MAAM,CAGxB,SAAS,EAAgB,EAAwB,CAS/C,OARI,MAAM,QAAQ,EAAI,CACb,EAAI,OAAQ,GAAyB,OAAO,GAAS,SAAS,CAEnE,EAAS,EAAI,EAAI,MAAM,QAAQ,EAAI,OAAO,CACrC,EAAI,OAAO,OACf,GAAyB,OAAO,GAAS,SAC3C,CAEI,EAAE,CAGX,SAAS,EAAgB,EAAmD,CAC1E,MAAO,CACL,OAAQ,EAAA,2BACR,UAAW,EAAY,EAAK,CAAC,YAAa,gBAAiB,eAAe,CAAC,CAC3E,aAAc,EAAW,EAAK,CAAC,gBAAiB,QAAS,UAAU,CAAC,CACpE,UACE,EAAW,EAAK,CAAC,aAAc,YAAY,CAAC,EAC5C,EAAW,EAAK,CAAC,aAAc,YAAY,CAAC,CAC/C,CAGH,SAAS,EACP,EACgC,CAChC,IAAM,EAAa,EAAW,EAAK,CAAC,cAAe,aAAa,CAAC,CAC3D,EAAW,EAAW,EAAK,CAAC,YAAa,WAAW,CAAC,CACrD,EAAkB,EAAW,EAAK,CACtC,mBACA,kBACA,mBACA,kBACD,CAAC,CAEF,GAAI,CAAC,GAAc,CAAC,GAAY,CAAC,EAC/B,MAAU,MAAM,mDAAmD,CAGrE,MAAO,CACL,aACA,WACA,kBACA,wBAAyB,EAAW,EAAK,CACvC,4BACA,0BACA,4BACA,0BACD,CAAC,CACF,UACE,EAAW,EAAK,CAAC,aAAc,YAAY,CAAC,EAC5C,EAAW,EAAK,CAAC,aAAc,YAAa,aAAc,YAAY,CAAC,CACzE,gBAAiB,EAAW,EAAK,CAC/B,WACA,mBACA,kBACD,CAAC,CACH,CAGH,IAAM,EAAN,KAA6B,CAC3B,aAAa,iBAAqC,CAIhD,OAAO,EAAgB,MAHA,EACrB,EAAA,gCACD,CAC+B,CAGlC,aAAa,iBAAkD,CAI7D,OAAO,EAAgB,MAHA,EACrB,EAAA,gCACD,CACwD,CAG3D,aAAa,wBAAkE,CAK7E,OAAO,EAAyB,MAJT,EACrB,EAAA,sCACA,CAAE,OAAQ,OAAQ,CACnB,CAC0D,CAG7D,aAAa,sBACX,EACgC,CAQhC,OAAO,EAAgB,MAPA,EACrB,EAAA,qCACA,CACE,OAAQ,OACR,KAAM,KAAK,UAAU,CAAE,YAAa,EAAY,CAAC,CAClD,CACF,CACwD,CAG3D,aAAa,cAA+C,CAK1D,OAAO,EAAgB,MAJA,EACrB,EAAA,gCACA,CAAE,OAAQ,OAAQ,CACnB,CACwD"}

package/dist/api/llm-subscription-service.d.ts

@@ -0,0 +1,23 @@
+import { OPENAI_SUBSCRIPTION_VENDOR } from "#/constants/llm-subscription";
+export interface LLMSubscriptionStatus {
+    vendor: typeof OPENAI_SUBSCRIPTION_VENDOR;
+    connected: boolean;
+    accountEmail: string | null;
+    expiresAt: string | number | null;
+}
+export interface LLMSubscriptionDeviceChallenge {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete: string | null;
+    expiresAt: string | number | null;
+    intervalSeconds: number | null;
+}
+declare class LLMSubscriptionService {
+    static getOpenAIModels(): Promise<string[]>;
+    static getOpenAIStatus(): Promise<LLMSubscriptionStatus>;
+    static startOpenAIDeviceLogin(): Promise<LLMSubscriptionDeviceChallenge>;
+    static pollOpenAIDeviceLogin(deviceCode: string): Promise<LLMSubscriptionStatus>;
+    static logoutOpenAI(): Promise<LLMSubscriptionStatus>;
+}
+export default LLMSubscriptionService;

package/dist/api/llm-subscription-service.js

@@ -0,0 +1,109 @@
+import { getAgentServerClientOptions as e } from "./agent-server-client-options.js";
+import { OPENAI_SUBSCRIPTION_DEVICE_POLL_PATH as t, OPENAI_SUBSCRIPTION_DEVICE_START_PATH as n, OPENAI_SUBSCRIPTION_LOGOUT_PATH as r, OPENAI_SUBSCRIPTION_MODELS_PATH as i, OPENAI_SUBSCRIPTION_STATUS_PATH as a, OPENAI_SUBSCRIPTION_VENDOR as o } from "../constants/llm-subscription.js";
+//#region src/api/llm-subscription-service.ts
+function s(e) {
+	return typeof e == "object" && !!e && !Array.isArray(e);
+}
+var c = (e, t) => {
+	for (let n of t) {
+		let t = e[n];
+		if (typeof t == "string" && t.trim().length > 0) return t.trim();
+	}
+	return null;
+}, l = (e, t) => {
+	for (let n of t) {
+		let t = e[n];
+		if (typeof t == "number" && Number.isFinite(t)) return t;
+	}
+	return null;
+}, u = (e, t) => {
+	for (let n of t) {
+		let t = e[n];
+		if (typeof t == "boolean") return t;
+	}
+	return !1;
+};
+async function d(t, n = {}) {
+	let { host: r, apiKey: i } = e(), a = new Headers(n.headers);
+	a.set("Accept", "application/json"), n.body && !a.has("Content-Type") && a.set("Content-Type", "application/json"), i && a.set("X-Session-API-Key", i);
+	let o = await fetch(`${r}${t}`, {
+		...n,
+		headers: a
+	});
+	if (!o.ok) throw Error(`Subscription request failed with ${o.status}`);
+	return o.json();
+}
+function f(e) {
+	return Array.isArray(e) ? e.filter((e) => typeof e == "string") : s(e) && Array.isArray(e.models) ? e.models.filter((e) => typeof e == "string") : [];
+}
+function p(e) {
+	return {
+		vendor: o,
+		connected: u(e, [
+			"connected",
+			"authenticated",
+			"is_connected"
+		]),
+		accountEmail: c(e, [
+			"account_email",
+			"email",
+			"account"
+		]),
+		expiresAt: c(e, ["expires_at", "expiresAt"]) ?? l(e, ["expires_at", "expiresAt"])
+	};
+}
+function m(e) {
+	let t = c(e, ["device_code", "deviceCode"]), n = c(e, ["user_code", "userCode"]), r = c(e, [
+		"verification_uri",
+		"verificationUri",
+		"verification_url",
+		"verificationUrl"
+	]);
+	if (!t || !n || !r) throw Error("Subscription device login response is incomplete");
+	return {
+		deviceCode: t,
+		userCode: n,
+		verificationUri: r,
+		verificationUriComplete: c(e, [
+			"verification_uri_complete",
+			"verificationUriComplete",
+			"verification_url_complete",
+			"verificationUrlComplete"
+		]),
+		expiresAt: c(e, ["expires_at", "expiresAt"]) ?? l(e, [
+			"expires_at",
+			"expiresAt",
+			"expires_in",
+			"expiresIn"
+		]),
+		intervalSeconds: l(e, [
+			"interval",
+			"interval_seconds",
+			"intervalSeconds"
+		])
+	};
+}
+var h = class {
+	static async getOpenAIModels() {
+		return f(await d(i));
+	}
+	static async getOpenAIStatus() {
+		return p(await d(a));
+	}
+	static async startOpenAIDeviceLogin() {
+		return m(await d(n, { method: "POST" }));
+	}
+	static async pollOpenAIDeviceLogin(e) {
+		return p(await d(t, {
+			method: "POST",
+			body: JSON.stringify({ device_code: e })
+		}));
+	}
+	static async logoutOpenAI() {
+		return p(await d(r, { method: "POST" }));
+	}
+};
+//#endregion
+export { h as default };
+
+//# sourceMappingURL=llm-subscription-service.js.map

package/dist/api/llm-subscription-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-subscription-service.js","names":[],"sources":["../../src/api/llm-subscription-service.ts"],"sourcesContent":["import { getAgentServerClientOptions } from \"./agent-server-client-options\";\nimport {\n  OPENAI_SUBSCRIPTION_DEVICE_POLL_PATH,\n  OPENAI_SUBSCRIPTION_DEVICE_START_PATH,\n  OPENAI_SUBSCRIPTION_LOGOUT_PATH,\n  OPENAI_SUBSCRIPTION_MODELS_PATH,\n  OPENAI_SUBSCRIPTION_STATUS_PATH,\n  OPENAI_SUBSCRIPTION_VENDOR,\n} from \"#/constants/llm-subscription\";\n\ntype RawSubscriptionStatus = Record<string, unknown>;\ntype RawDeviceStart = Record<string, unknown>;\n\nexport interface LLMSubscriptionStatus {\n  vendor: typeof OPENAI_SUBSCRIPTION_VENDOR;\n  connected: boolean;\n  accountEmail: string | null;\n  expiresAt: string | number | null;\n}\n\nexport interface LLMSubscriptionDeviceChallenge {\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string | null;\n  expiresAt: string | number | null;\n  intervalSeconds: number | null;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nconst readString = (\n  value: Record<string, unknown>,\n  keys: string[],\n): string | null => {\n  for (const key of keys) {\n    const candidate = value[key];\n    if (typeof candidate === \"string\" && candidate.trim().length > 0) {\n      return candidate.trim();\n    }\n  }\n  return null;\n};\n\nconst readNumber = (\n  value: Record<string, unknown>,\n  keys: string[],\n): number | null => {\n  for (const key of keys) {\n    const candidate = value[key];\n    if (typeof candidate === \"number\" && Number.isFinite(candidate)) {\n      return candidate;\n    }\n  }\n  return null;\n};\n\nconst readBoolean = (\n  value: Record<string, unknown>,\n  keys: string[],\n): boolean => {\n  for (const key of keys) {\n    const candidate = value[key];\n    if (typeof candidate === \"boolean\") {\n      return candidate;\n    }\n  }\n  return false;\n};\n\nasync function requestSubscriptionEndpoint(\n  path: string,\n  init: RequestInit = {},\n): Promise<unknown> {\n  const { host, apiKey } = getAgentServerClientOptions();\n  const headers = new Headers(init.headers);\n  headers.set(\"Accept\", \"application/json\");\n  if (init.body && !headers.has(\"Content-Type\")) {\n    headers.set(\"Content-Type\", \"application/json\");\n  }\n  if (apiKey) {\n    headers.set(\"X-Session-API-Key\", apiKey);\n  }\n\n  const response = await fetch(`${host}${path}`, { ...init, headers });\n  if (!response.ok) {\n    throw new Error(`Subscription request failed with ${response.status}`);\n  }\n  return response.json();\n}\n\nfunction normalizeModels(raw: unknown): string[] {\n  if (Array.isArray(raw)) {\n    return raw.filter((item): item is string => typeof item === \"string\");\n  }\n  if (isRecord(raw) && Array.isArray(raw.models)) {\n    return raw.models.filter(\n      (item): item is string => typeof item === \"string\",\n    );\n  }\n  return [];\n}\n\nfunction normalizeStatus(raw: RawSubscriptionStatus): LLMSubscriptionStatus {\n  return {\n    vendor: OPENAI_SUBSCRIPTION_VENDOR,\n    connected: readBoolean(raw, [\"connected\", \"authenticated\", \"is_connected\"]),\n    accountEmail: readString(raw, [\"account_email\", \"email\", \"account\"]),\n    expiresAt:\n      readString(raw, [\"expires_at\", \"expiresAt\"]) ??\n      readNumber(raw, [\"expires_at\", \"expiresAt\"]),\n  };\n}\n\nfunction normalizeDeviceChallenge(\n  raw: RawDeviceStart,\n): LLMSubscriptionDeviceChallenge {\n  const deviceCode = readString(raw, [\"device_code\", \"deviceCode\"]);\n  const userCode = readString(raw, [\"user_code\", \"userCode\"]);\n  const verificationUri = readString(raw, [\n    \"verification_uri\",\n    \"verificationUri\",\n    \"verification_url\",\n    \"verificationUrl\",\n  ]);\n\n  if (!deviceCode || !userCode || !verificationUri) {\n    throw new Error(\"Subscription device login response is incomplete\");\n  }\n\n  return {\n    deviceCode,\n    userCode,\n    verificationUri,\n    verificationUriComplete: readString(raw, [\n      \"verification_uri_complete\",\n      \"verificationUriComplete\",\n      \"verification_url_complete\",\n      \"verificationUrlComplete\",\n    ]),\n    expiresAt:\n      readString(raw, [\"expires_at\", \"expiresAt\"]) ??\n      readNumber(raw, [\"expires_at\", \"expiresAt\", \"expires_in\", \"expiresIn\"]),\n    intervalSeconds: readNumber(raw, [\n      \"interval\",\n      \"interval_seconds\",\n      \"intervalSeconds\",\n    ]),\n  };\n}\n\nclass LLMSubscriptionService {\n  static async getOpenAIModels(): Promise<string[]> {\n    const response = await requestSubscriptionEndpoint(\n      OPENAI_SUBSCRIPTION_MODELS_PATH,\n    );\n    return normalizeModels(response);\n  }\n\n  static async getOpenAIStatus(): Promise<LLMSubscriptionStatus> {\n    const response = await requestSubscriptionEndpoint(\n      OPENAI_SUBSCRIPTION_STATUS_PATH,\n    );\n    return normalizeStatus(response as RawSubscriptionStatus);\n  }\n\n  static async startOpenAIDeviceLogin(): Promise<LLMSubscriptionDeviceChallenge> {\n    const response = await requestSubscriptionEndpoint(\n      OPENAI_SUBSCRIPTION_DEVICE_START_PATH,\n      { method: \"POST\" },\n    );\n    return normalizeDeviceChallenge(response as RawDeviceStart);\n  }\n\n  static async pollOpenAIDeviceLogin(\n    deviceCode: string,\n  ): Promise<LLMSubscriptionStatus> {\n    const response = await requestSubscriptionEndpoint(\n      OPENAI_SUBSCRIPTION_DEVICE_POLL_PATH,\n      {\n        method: \"POST\",\n        body: JSON.stringify({ device_code: deviceCode }),\n      },\n    );\n    return normalizeStatus(response as RawSubscriptionStatus);\n  }\n\n  static async logoutOpenAI(): Promise<LLMSubscriptionStatus> {\n    const response = await requestSubscriptionEndpoint(\n      OPENAI_SUBSCRIPTION_LOGOUT_PATH,\n      { method: \"POST\" },\n    );\n    return normalizeStatus(response as RawSubscriptionStatus);\n  }\n}\n\nexport default LLMSubscriptionService;\n"],"mappings":";;;AA6BA,SAAS,EAAS,GAAkD;AAClE,QAAO,OAAO,KAAU,cAAY,KAAkB,CAAC,MAAM,QAAQ,EAAM;;AAG7E,IAAM,KACJ,GACA,MACkB;AAClB,MAAK,IAAM,KAAO,GAAM;EACtB,IAAM,IAAY,EAAM;AACxB,MAAI,OAAO,KAAc,YAAY,EAAU,MAAM,CAAC,SAAS,EAC7D,QAAO,EAAU,MAAM;;AAG3B,QAAO;GAGH,KACJ,GACA,MACkB;AAClB,MAAK,IAAM,KAAO,GAAM;EACtB,IAAM,IAAY,EAAM;AACxB,MAAI,OAAO,KAAc,YAAY,OAAO,SAAS,EAAU,CAC7D,QAAO;;AAGX,QAAO;GAGH,KACJ,GACA,MACY;AACZ,MAAK,IAAM,KAAO,GAAM;EACtB,IAAM,IAAY,EAAM;AACxB,MAAI,OAAO,KAAc,UACvB,QAAO;;AAGX,QAAO;;AAGT,eAAe,EACb,GACA,IAAoB,EAAE,EACJ;CAClB,IAAM,EAAE,SAAM,cAAW,GAA6B,EAChD,IAAU,IAAI,QAAQ,EAAK,QAAQ;AAKzC,CAJA,EAAQ,IAAI,UAAU,mBAAmB,EACrC,EAAK,QAAQ,CAAC,EAAQ,IAAI,eAAe,IAC3C,EAAQ,IAAI,gBAAgB,mBAAmB,EAE7C,KACF,EAAQ,IAAI,qBAAqB,EAAO;CAG1C,IAAM,IAAW,MAAM,MAAM,GAAG,IAAO,KAAQ;EAAE,GAAG;EAAM;EAAS,CAAC;AACpE,KAAI,CAAC,EAAS,GACZ,OAAU,MAAM,oCAAoC,EAAS,SAAS;AAExE,QAAO,EAAS,MAAM;;AAGxB,SAAS,EAAgB,GAAwB;AAS/C,QARI,MAAM,QAAQ,EAAI,GACb,EAAI,QAAQ,MAAyB,OAAO,KAAS,SAAS,GAEnE,EAAS,EAAI,IAAI,MAAM,QAAQ,EAAI,OAAO,GACrC,EAAI,OAAO,QACf,MAAyB,OAAO,KAAS,SAC3C,GAEI,EAAE;;AAGX,SAAS,EAAgB,GAAmD;AAC1E,QAAO;EACL,QAAQ;EACR,WAAW,EAAY,GAAK;GAAC;GAAa;GAAiB;GAAe,CAAC;EAC3E,cAAc,EAAW,GAAK;GAAC;GAAiB;GAAS;GAAU,CAAC;EACpE,WACE,EAAW,GAAK,CAAC,cAAc,YAAY,CAAC,IAC5C,EAAW,GAAK,CAAC,cAAc,YAAY,CAAC;EAC/C;;AAGH,SAAS,EACP,GACgC;CAChC,IAAM,IAAa,EAAW,GAAK,CAAC,eAAe,aAAa,CAAC,EAC3D,IAAW,EAAW,GAAK,CAAC,aAAa,WAAW,CAAC,EACrD,IAAkB,EAAW,GAAK;EACtC;EACA;EACA;EACA;EACD,CAAC;AAEF,KAAI,CAAC,KAAc,CAAC,KAAY,CAAC,EAC/B,OAAU,MAAM,mDAAmD;AAGrE,QAAO;EACL;EACA;EACA;EACA,yBAAyB,EAAW,GAAK;GACvC;GACA;GACA;GACA;GACD,CAAC;EACF,WACE,EAAW,GAAK,CAAC,cAAc,YAAY,CAAC,IAC5C,EAAW,GAAK;GAAC;GAAc;GAAa;GAAc;GAAY,CAAC;EACzE,iBAAiB,EAAW,GAAK;GAC/B;GACA;GACA;GACD,CAAC;EACH;;AAGH,IAAM,IAAN,MAA6B;CAC3B,aAAa,kBAAqC;AAIhD,SAAO,EAAgB,MAHA,EACrB,EACD,CAC+B;;CAGlC,aAAa,kBAAkD;AAI7D,SAAO,EAAgB,MAHA,EACrB,EACD,CACwD;;CAG3D,aAAa,yBAAkE;AAK7E,SAAO,EAAyB,MAJT,EACrB,GACA,EAAE,QAAQ,QAAQ,CACnB,CAC0D;;CAG7D,aAAa,sBACX,GACgC;AAQhC,SAAO,EAAgB,MAPA,EACrB,GACA;GACE,QAAQ;GACR,MAAM,KAAK,UAAU,EAAE,aAAa,GAAY,CAAC;GAClD,CACF,CACwD;;CAG3D,aAAa,eAA+C;AAK1D,SAAO,EAAgB,MAJA,EACrB,GACA,EAAE,QAAQ,QAAQ,CACnB,CACwD"}

package/dist/api/mcp-service/mcp-service.api.cjs

@@ -1,2 +1,2 @@
-require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../../node_modules/@openhands/typescript-client/dist/client/mcp-client.cjs`),t=require(`../backend-registry/active-store.cjs`),n=require(`../agent-server-client-options.cjs`);function r(e){return e.type===`stdio`?{type:`stdio`,command:e.command,...e.args?.length&&{args:e.args},...e.env&&Object.keys(e.env).length>0&&{env:e.env}}:{type:e.type,url:e.url,...e.api_key?{api_key:e.api_key}:{}}}var i=class{static async testServer(i){if(t.getActiveBackend().backend.kind===`cloud`)return{ok:!0,tools:[]};let{host:a,apiKey:o}=n.getAgentServerClientOptions(),s=new e.MCPClient({host:a,...o?{apiKey:o}:{}});try{return await s.testServer({server:r(i),...i.name?{name:i.name}:{},...i.timeout?{timeout:i.timeout}:{}})}finally{s.close()}}};exports.default=i;
+require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../../node_modules/@openhands/typescript-client/dist/client/mcp-client.cjs`),t=require(`../backend-registry/active-store.cjs`),n=require(`../agent-server-client-options.cjs`),r=require(`../settings-service/settings-service.api.cjs`),i=require(`../../utils/mcp-credential-validation.cjs`);var a=`<redacted>`;function o(e){return e.type===`stdio`?{type:`stdio`,command:e.command,...e.args?.length&&{args:e.args},...e.env&&Object.keys(e.env).length>0&&{env:e.env}}:{type:e.type,url:e.url,...e.api_key?{api_key:e.api_key}:{}}}async function s(e){if(e.type!==`stdio`||!e.name||!e.env||!Object.values(e.env).some(e=>e===a))return e;try{let t=((await r.default.fetchSettingsFromApi(`encrypted`)).agent_settings?.mcp_config)?.mcpServers?.[e.name]?.env??{},n=Object.fromEntries(Object.entries(e.env).map(([e,n])=>[e,n===a&&typeof t[e]==`string`?t[e]:n]));return{...e,env:n}}catch{return e}}var c=class{static async testServer(r){if(t.getActiveBackend().backend.kind===`cloud`)return{ok:!0,tools:[]};let a=i.getCredentialValidationForServer(r),c=o(await s(r)),{host:l,apiKey:u}=n.getAgentServerClientOptions(),d=new e.MCPClient({host:l,...u?{apiKey:u}:{}});try{let e={server:c,...r.name?{name:r.name}:{},...r.timeout?{timeout:r.timeout}:{},...a?{tool_call:a.toolCall}:{}},t=await d.testServer(e);if(t.ok&&a&&t.tool_result){let e=a.interpret(t.tool_result);if(e)return{ok:!1,error:e,error_kind:`credentials`}}return t}finally{d.close()}}};exports.default=c;
 //# sourceMappingURL=mcp-service.api.cjs.map

package/dist/api/mcp-service/mcp-service.api.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-service.api.cjs","names":[],"sources":["../../../src/api/mcp-service/mcp-service.api.ts"],"sourcesContent":["import { MCPClient } from \"@openhands/typescript-client/clients\";\nimport type {\n  MCPServerSpec,\n  MCPTestResponse,\n} from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\n\nfunction toMcpServerSpec(server: MCPServerConfig): MCPServerSpec {\n  if (server.type === \"stdio\") {\n    return {\n      type: \"stdio\",\n      command: server.command!,\n      ...(server.args?.length && { args: server.args }),\n      ...(server.env &&\n        Object.keys(server.env).length > 0 && { env: server.env }),\n    };\n  }\n  return {\n    type: server.type,\n    url: server.url!,\n    ...(server.api_key ? { api_key: server.api_key } : {}),\n  };\n}\n\nclass McpService {\n  static async testServer(server: MCPServerConfig): Promise<MCPTestResponse> {\n    // The MCP connectivity-test endpoint lives on the local agent-server. It\n    // spawns the configured stdio command / opens an SSE-or-SHTTP connection\n    // from that process's environment. Cloud backends don't expose this\n    // endpoint to the frontend — the MCP server would actually run inside the\n    // cloud sandbox, which isn't reachable from the browser before the user\n    // starts a conversation. Calling `getAgentServerClientOptions()` here for\n    // a cloud-active session would throw `NoBackendAvailableError(\"No backend\n    // is configured.\")` and block the install flow entirely. Short-circuit\n    // with a synthetic success so saving proceeds; any real connection\n    // failure surfaces inside the conversation runtime instead.\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return { ok: true, tools: [] };\n    }\n    const { host, apiKey } = getAgentServerClientOptions();\n    const client = new MCPClient({ host, ...(apiKey ? { apiKey } : {}) });\n    try {\n      return await client.testServer({\n        server: toMcpServerSpec(server),\n        ...(server.name ? { name: server.name } : {}),\n        ...(server.timeout ? { timeout: server.timeout } : {}),\n      });\n    } finally {\n      client.close();\n    }\n  }\n}\n\nexport default McpService;\n"],"mappings":"gPASA,SAAS,EAAgB,EAAwC,CAU/D,OATI,EAAO,OAAS,QACX,CACL,KAAM,QACN,QAAS,EAAO,QAChB,GAAI,EAAO,MAAM,QAAU,CAAE,KAAM,EAAO,KAAM,CAChD,GAAI,EAAO,KACT,OAAO,KAAK,EAAO,IAAI,CAAC,OAAS,GAAK,CAAE,IAAK,EAAO,IAAK,CAC5D,CAEI,CACL,KAAM,EAAO,KACb,IAAK,EAAO,IACZ,GAAI,EAAO,QAAU,CAAE,QAAS,EAAO,QAAS,CAAG,EAAE,CACtD,CAGH,IAAM,EAAN,KAAiB,CACf,aAAa,WAAW,EAAmD,CAWzE,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QACtC,MAAO,CAAE,GAAI,GAAM,MAAO,EAAE,CAAE,CAEhC,GAAM,CAAE,OAAM,UAAW,EAAA,6BAA6B,CAChD,EAAS,IAAI,EAAA,UAAU,CAAE,OAAM,GAAI,EAAS,CAAE,SAAQ,CAAG,EAAE,CAAG,CAAC,CACrE,GAAI,CACF,OAAO,MAAM,EAAO,WAAW,CAC7B,OAAQ,EAAgB,EAAO,CAC/B,GAAI,EAAO,KAAO,CAAE,KAAM,EAAO,KAAM,CAAG,EAAE,CAC5C,GAAI,EAAO,QAAU,CAAE,QAAS,EAAO,QAAS,CAAG,EAAE,CACtD,CAAC,QACM,CACR,EAAO,OAAO"}
+{"version":3,"file":"mcp-service.api.cjs","names":[],"sources":["../../../src/api/mcp-service/mcp-service.api.ts"],"sourcesContent":["import { MCPClient } from \"@openhands/typescript-client/clients\";\nimport type {\n  MCPServerSpec,\n  MCPTestRequest,\n} from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport SettingsService from \"#/api/settings-service/settings-service.api\";\nimport { getCredentialValidationForServer } from \"#/utils/mcp-credential-validation\";\nimport type {\n  ExtendedMCPTestResponse,\n  MCPServerConfig,\n} from \"#/types/mcp-server\";\n\n// Placeholder the settings API substitutes for secret env values when\n// settings are fetched without X-Expose-Secrets (the MCP page's mode).\nconst REDACTED_ENV_VALUE = \"<redacted>\";\n\nfunction toMcpServerSpec(server: MCPServerConfig): MCPServerSpec {\n  if (server.type === \"stdio\") {\n    return {\n      type: \"stdio\",\n      command: server.command!,\n      ...(server.args?.length && { args: server.args }),\n      ...(server.env &&\n        Object.keys(server.env).length > 0 && { env: server.env }),\n    };\n  }\n  return {\n    type: server.type,\n    url: server.url!,\n    ...(server.api_key ? { api_key: server.api_key } : {}),\n  };\n}\n\n/**\n * The MCP page reads settings with redacted secrets, so an env value the\n * user left unchanged in the edit form is the literal `<redacted>`\n * placeholder — testing with it would exercise garbage credentials. Swap\n * each placeholder for the stored value in encrypted form (the agent\n * server decrypts it before spawning), so \"Test connection\" exercises the\n * real stored credentials. Falls back to the placeholder when encrypted\n * settings are unavailable (e.g. no cipher configured) — the credential\n * check then fails honestly instead of crashing the test flow.\n */\nasync function substituteRedactedEnv(\n  server: MCPServerConfig,\n): Promise<MCPServerConfig> {\n  if (server.type !== \"stdio\" || !server.name || !server.env) return server;\n  const values = Object.values(server.env);\n  if (!values.some((value) => value === REDACTED_ENV_VALUE)) return server;\n\n  try {\n    const response = await SettingsService.fetchSettingsFromApi(\"encrypted\");\n    const mcpConfig = response.agent_settings?.mcp_config as\n      | { mcpServers?: Record<string, { env?: Record<string, string> }> }\n      | undefined;\n    const storedEnv = mcpConfig?.mcpServers?.[server.name]?.env ?? {};\n    const env = Object.fromEntries(\n      Object.entries(server.env).map(([key, value]) => [\n        key,\n        value === REDACTED_ENV_VALUE && typeof storedEnv[key] === \"string\"\n          ? storedEnv[key]\n          : value,\n      ]),\n    );\n    return { ...server, env };\n  } catch {\n    return server;\n  }\n}\n\nclass McpService {\n  static async testServer(\n    server: MCPServerConfig,\n  ): Promise<ExtendedMCPTestResponse> {\n    // The MCP connectivity-test endpoint lives on the local agent-server. It\n    // spawns the configured stdio command / opens an SSE-or-SHTTP connection\n    // from that process's environment. Cloud backends don't expose this\n    // endpoint to the frontend — the MCP server would actually run inside the\n    // cloud sandbox, which isn't reachable from the browser before the user\n    // starts a conversation. Calling `getAgentServerClientOptions()` here for\n    // a cloud-active session would throw `NoBackendAvailableError(\"No backend\n    // is configured.\")` and block the install flow entirely. Short-circuit\n    // with a synthetic success so saving proceeds; any real connection\n    // failure surfaces inside the conversation runtime instead.\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return { ok: true, tools: [] };\n    }\n    const validation = getCredentialValidationForServer(server);\n    const serverSpec = toMcpServerSpec(await substituteRedactedEnv(server));\n    const { host, apiKey } = getAgentServerClientOptions();\n    const client = new MCPClient({ host, ...(apiKey ? { apiKey } : {}) });\n    try {\n      // `tool_call` / `tool_result` aren't in the published client types\n      // yet; the client POSTs the request object and returns the response\n      // body as-is, so the extra fields round-trip at runtime. Old agent\n      // servers ignore `tool_call` and return no `tool_result`, in which\n      // case the response passes through uninterpreted (legacy behavior).\n      const request = {\n        server: serverSpec,\n        ...(server.name ? { name: server.name } : {}),\n        ...(server.timeout ? { timeout: server.timeout } : {}),\n        ...(validation ? { tool_call: validation.toolCall } : {}),\n      };\n      const result = (await client.testServer(\n        request as MCPTestRequest,\n      )) as ExtendedMCPTestResponse;\n      if (result.ok && validation && result.tool_result) {\n        const credentialError = validation.interpret(result.tool_result);\n        if (credentialError) {\n          return {\n            ok: false,\n            error: credentialError,\n            error_kind: \"credentials\",\n          };\n        }\n      }\n      return result;\n    } finally {\n      client.close();\n    }\n  }\n}\n\nexport default McpService;\n"],"mappings":"iWAgBA,IAAM,EAAqB,aAE3B,SAAS,EAAgB,EAAwC,CAU/D,OATI,EAAO,OAAS,QACX,CACL,KAAM,QACN,QAAS,EAAO,QAChB,GAAI,EAAO,MAAM,QAAU,CAAE,KAAM,EAAO,KAAM,CAChD,GAAI,EAAO,KACT,OAAO,KAAK,EAAO,IAAI,CAAC,OAAS,GAAK,CAAE,IAAK,EAAO,IAAK,CAC5D,CAEI,CACL,KAAM,EAAO,KACb,IAAK,EAAO,IACZ,GAAI,EAAO,QAAU,CAAE,QAAS,EAAO,QAAS,CAAG,EAAE,CACtD,CAaH,eAAe,EACb,EAC0B,CAG1B,GAFI,EAAO,OAAS,SAAW,CAAC,EAAO,MAAQ,CAAC,EAAO,KAEnD,CADW,OAAO,OAAO,EAAO,IAC/B,CAAO,KAAM,GAAU,IAAU,EAAmB,CAAE,OAAO,EAElE,GAAI,CAKF,IAAM,IAHY,MADK,EAAA,QAAgB,qBAAqB,YAAY,EAC7C,gBAAgB,aAGd,aAAa,EAAO,OAAO,KAAO,EAAE,CAC3D,EAAM,OAAO,YACjB,OAAO,QAAQ,EAAO,IAAI,CAAC,KAAK,CAAC,EAAK,KAAW,CAC/C,EACA,IAAU,GAAsB,OAAO,EAAU,IAAS,SACtD,EAAU,GACV,EACL,CAAC,CACH,CACD,MAAO,CAAE,GAAG,EAAQ,MAAK,MACnB,CACN,OAAO,GAIX,IAAM,EAAN,KAAiB,CACf,aAAa,WACX,EACkC,CAWlC,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QACtC,MAAO,CAAE,GAAI,GAAM,MAAO,EAAE,CAAE,CAEhC,IAAM,EAAa,EAAA,iCAAiC,EAAO,CACrD,EAAa,EAAgB,MAAM,EAAsB,EAAO,CAAC,CACjE,CAAE,OAAM,UAAW,EAAA,6BAA6B,CAChD,EAAS,IAAI,EAAA,UAAU,CAAE,OAAM,GAAI,EAAS,CAAE,SAAQ,CAAG,EAAE,CAAG,CAAC,CACrE,GAAI,CAMF,IAAM,EAAU,CACd,OAAQ,EACR,GAAI,EAAO,KAAO,CAAE,KAAM,EAAO,KAAM,CAAG,EAAE,CAC5C,GAAI,EAAO,QAAU,CAAE,QAAS,EAAO,QAAS,CAAG,EAAE,CACrD,GAAI,EAAa,CAAE,UAAW,EAAW,SAAU,CAAG,EAAE,CACzD,CACK,EAAU,MAAM,EAAO,WAC3B,EACD,CACD,GAAI,EAAO,IAAM,GAAc,EAAO,YAAa,CACjD,IAAM,EAAkB,EAAW,UAAU,EAAO,YAAY,CAChE,GAAI,EACF,MAAO,CACL,GAAI,GACJ,MAAO,EACP,WAAY,cACb,CAGL,OAAO,SACC,CACR,EAAO,OAAO"}

package/dist/api/mcp-service/mcp-service.api.d.ts

@@ -1,6 +1,5 @@
-import type { MCPTestResponse } from "@openhands/typescript-client";
-import type { MCPServerConfig } from "#/types/mcp-server";
+import type { ExtendedMCPTestResponse, MCPServerConfig } from "#/types/mcp-server";
 declare class McpService {
-    static testServer(server: MCPServerConfig): Promise<MCPTestResponse>;
+    static testServer(server: MCPServerConfig): Promise<ExtendedMCPTestResponse>;
 }
 export default McpService;

package/dist/api/mcp-service/mcp-service.api.js

@@ -1,8 +1,11 @@
 import { MCPClient as e } from "../../node_modules/@openhands/typescript-client/dist/client/mcp-client.js";
 import { getActiveBackend as t } from "../backend-registry/active-store.js";
 import { getAgentServerClientOptions as n } from "../agent-server-client-options.js";
+import r from "../settings-service/settings-service.api.js";
+import { getCredentialValidationForServer as i } from "../../utils/mcp-credential-validation.js";
 //#region src/api/mcp-service/mcp-service.api.ts
-function r(e) {
+var a = "<redacted>";
+function o(e) {
 	return e.type === "stdio" ? {
 		type: "stdio",
 		command: e.command,
@@ -14,28 +17,50 @@ function r(e) {
 		...e.api_key ? { api_key: e.api_key } : {}
 	};
 }
-var i = class {
-	static async testServer(i) {
+async function s(e) {
+	if (e.type !== "stdio" || !e.name || !e.env || !Object.values(e.env).some((e) => e === a)) return e;
+	try {
+		let t = ((await r.fetchSettingsFromApi("encrypted")).agent_settings?.mcp_config)?.mcpServers?.[e.name]?.env ?? {}, n = Object.fromEntries(Object.entries(e.env).map(([e, n]) => [e, n === a && typeof t[e] == "string" ? t[e] : n]));
+		return {
+			...e,
+			env: n
+		};
+	} catch {
+		return e;
+	}
+}
+var c = class {
+	static async testServer(r) {
 		if (t().backend.kind === "cloud") return {
 			ok: !0,
 			tools: []
 		};
-		let { host: a, apiKey: o } = n(), s = new e({
-			host: a,
-			...o ? { apiKey: o } : {}
+		let a = i(r), c = o(await s(r)), { host: l, apiKey: u } = n(), d = new e({
+			host: l,
+			...u ? { apiKey: u } : {}
 		});
 		try {
-			return await s.testServer({
-				server: r(i),
-				...i.name ? { name: i.name } : {},
-				...i.timeout ? { timeout: i.timeout } : {}
-			});
+			let e = {
+				server: c,
+				...r.name ? { name: r.name } : {},
+				...r.timeout ? { timeout: r.timeout } : {},
+				...a ? { tool_call: a.toolCall } : {}
+			}, t = await d.testServer(e);
+			if (t.ok && a && t.tool_result) {
+				let e = a.interpret(t.tool_result);
+				if (e) return {
+					ok: !1,
+					error: e,
+					error_kind: "credentials"
+				};
+			}
+			return t;
 		} finally {
-			s.close();
+			d.close();
 		}
 	}
 };
 //#endregion
-export { i as default };
+export { c as default };
 
 //# sourceMappingURL=mcp-service.api.js.map

package/dist/api/mcp-service/mcp-service.api.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-service.api.js","names":[],"sources":["../../../src/api/mcp-service/mcp-service.api.ts"],"sourcesContent":["import { MCPClient } from \"@openhands/typescript-client/clients\";\nimport type {\n  MCPServerSpec,\n  MCPTestResponse,\n} from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\n\nfunction toMcpServerSpec(server: MCPServerConfig): MCPServerSpec {\n  if (server.type === \"stdio\") {\n    return {\n      type: \"stdio\",\n      command: server.command!,\n      ...(server.args?.length && { args: server.args }),\n      ...(server.env &&\n        Object.keys(server.env).length > 0 && { env: server.env }),\n    };\n  }\n  return {\n    type: server.type,\n    url: server.url!,\n    ...(server.api_key ? { api_key: server.api_key } : {}),\n  };\n}\n\nclass McpService {\n  static async testServer(server: MCPServerConfig): Promise<MCPTestResponse> {\n    // The MCP connectivity-test endpoint lives on the local agent-server. It\n    // spawns the configured stdio command / opens an SSE-or-SHTTP connection\n    // from that process's environment. Cloud backends don't expose this\n    // endpoint to the frontend — the MCP server would actually run inside the\n    // cloud sandbox, which isn't reachable from the browser before the user\n    // starts a conversation. Calling `getAgentServerClientOptions()` here for\n    // a cloud-active session would throw `NoBackendAvailableError(\"No backend\n    // is configured.\")` and block the install flow entirely. Short-circuit\n    // with a synthetic success so saving proceeds; any real connection\n    // failure surfaces inside the conversation runtime instead.\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return { ok: true, tools: [] };\n    }\n    const { host, apiKey } = getAgentServerClientOptions();\n    const client = new MCPClient({ host, ...(apiKey ? { apiKey } : {}) });\n    try {\n      return await client.testServer({\n        server: toMcpServerSpec(server),\n        ...(server.name ? { name: server.name } : {}),\n        ...(server.timeout ? { timeout: server.timeout } : {}),\n      });\n    } finally {\n      client.close();\n    }\n  }\n}\n\nexport default McpService;\n"],"mappings":";;;;AASA,SAAS,EAAgB,GAAwC;AAU/D,QATI,EAAO,SAAS,UACX;EACL,MAAM;EACN,SAAS,EAAO;EAChB,GAAI,EAAO,MAAM,UAAU,EAAE,MAAM,EAAO,MAAM;EAChD,GAAI,EAAO,OACT,OAAO,KAAK,EAAO,IAAI,CAAC,SAAS,KAAK,EAAE,KAAK,EAAO,KAAK;EAC5D,GAEI;EACL,MAAM,EAAO;EACb,KAAK,EAAO;EACZ,GAAI,EAAO,UAAU,EAAE,SAAS,EAAO,SAAS,GAAG,EAAE;EACtD;;AAGH,IAAM,IAAN,MAAiB;CACf,aAAa,WAAW,GAAmD;AAWzE,MAAI,GAAkB,CAAC,QAAQ,SAAS,QACtC,QAAO;GAAE,IAAI;GAAM,OAAO,EAAE;GAAE;EAEhC,IAAM,EAAE,SAAM,cAAW,GAA6B,EAChD,IAAS,IAAI,EAAU;GAAE;GAAM,GAAI,IAAS,EAAE,WAAQ,GAAG,EAAE;GAAG,CAAC;AACrE,MAAI;AACF,UAAO,MAAM,EAAO,WAAW;IAC7B,QAAQ,EAAgB,EAAO;IAC/B,GAAI,EAAO,OAAO,EAAE,MAAM,EAAO,MAAM,GAAG,EAAE;IAC5C,GAAI,EAAO,UAAU,EAAE,SAAS,EAAO,SAAS,GAAG,EAAE;IACtD,CAAC;YACM;AACR,KAAO,OAAO"}
+{"version":3,"file":"mcp-service.api.js","names":[],"sources":["../../../src/api/mcp-service/mcp-service.api.ts"],"sourcesContent":["import { MCPClient } from \"@openhands/typescript-client/clients\";\nimport type {\n  MCPServerSpec,\n  MCPTestRequest,\n} from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport SettingsService from \"#/api/settings-service/settings-service.api\";\nimport { getCredentialValidationForServer } from \"#/utils/mcp-credential-validation\";\nimport type {\n  ExtendedMCPTestResponse,\n  MCPServerConfig,\n} from \"#/types/mcp-server\";\n\n// Placeholder the settings API substitutes for secret env values when\n// settings are fetched without X-Expose-Secrets (the MCP page's mode).\nconst REDACTED_ENV_VALUE = \"<redacted>\";\n\nfunction toMcpServerSpec(server: MCPServerConfig): MCPServerSpec {\n  if (server.type === \"stdio\") {\n    return {\n      type: \"stdio\",\n      command: server.command!,\n      ...(server.args?.length && { args: server.args }),\n      ...(server.env &&\n        Object.keys(server.env).length > 0 && { env: server.env }),\n    };\n  }\n  return {\n    type: server.type,\n    url: server.url!,\n    ...(server.api_key ? { api_key: server.api_key } : {}),\n  };\n}\n\n/**\n * The MCP page reads settings with redacted secrets, so an env value the\n * user left unchanged in the edit form is the literal `<redacted>`\n * placeholder — testing with it would exercise garbage credentials. Swap\n * each placeholder for the stored value in encrypted form (the agent\n * server decrypts it before spawning), so \"Test connection\" exercises the\n * real stored credentials. Falls back to the placeholder when encrypted\n * settings are unavailable (e.g. no cipher configured) — the credential\n * check then fails honestly instead of crashing the test flow.\n */\nasync function substituteRedactedEnv(\n  server: MCPServerConfig,\n): Promise<MCPServerConfig> {\n  if (server.type !== \"stdio\" || !server.name || !server.env) return server;\n  const values = Object.values(server.env);\n  if (!values.some((value) => value === REDACTED_ENV_VALUE)) return server;\n\n  try {\n    const response = await SettingsService.fetchSettingsFromApi(\"encrypted\");\n    const mcpConfig = response.agent_settings?.mcp_config as\n      | { mcpServers?: Record<string, { env?: Record<string, string> }> }\n      | undefined;\n    const storedEnv = mcpConfig?.mcpServers?.[server.name]?.env ?? {};\n    const env = Object.fromEntries(\n      Object.entries(server.env).map(([key, value]) => [\n        key,\n        value === REDACTED_ENV_VALUE && typeof storedEnv[key] === \"string\"\n          ? storedEnv[key]\n          : value,\n      ]),\n    );\n    return { ...server, env };\n  } catch {\n    return server;\n  }\n}\n\nclass McpService {\n  static async testServer(\n    server: MCPServerConfig,\n  ): Promise<ExtendedMCPTestResponse> {\n    // The MCP connectivity-test endpoint lives on the local agent-server. It\n    // spawns the configured stdio command / opens an SSE-or-SHTTP connection\n    // from that process's environment. Cloud backends don't expose this\n    // endpoint to the frontend — the MCP server would actually run inside the\n    // cloud sandbox, which isn't reachable from the browser before the user\n    // starts a conversation. Calling `getAgentServerClientOptions()` here for\n    // a cloud-active session would throw `NoBackendAvailableError(\"No backend\n    // is configured.\")` and block the install flow entirely. Short-circuit\n    // with a synthetic success so saving proceeds; any real connection\n    // failure surfaces inside the conversation runtime instead.\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return { ok: true, tools: [] };\n    }\n    const validation = getCredentialValidationForServer(server);\n    const serverSpec = toMcpServerSpec(await substituteRedactedEnv(server));\n    const { host, apiKey } = getAgentServerClientOptions();\n    const client = new MCPClient({ host, ...(apiKey ? { apiKey } : {}) });\n    try {\n      // `tool_call` / `tool_result` aren't in the published client types\n      // yet; the client POSTs the request object and returns the response\n      // body as-is, so the extra fields round-trip at runtime. Old agent\n      // servers ignore `tool_call` and return no `tool_result`, in which\n      // case the response passes through uninterpreted (legacy behavior).\n      const request = {\n        server: serverSpec,\n        ...(server.name ? { name: server.name } : {}),\n        ...(server.timeout ? { timeout: server.timeout } : {}),\n        ...(validation ? { tool_call: validation.toolCall } : {}),\n      };\n      const result = (await client.testServer(\n        request as MCPTestRequest,\n      )) as ExtendedMCPTestResponse;\n      if (result.ok && validation && result.tool_result) {\n        const credentialError = validation.interpret(result.tool_result);\n        if (credentialError) {\n          return {\n            ok: false,\n            error: credentialError,\n            error_kind: \"credentials\",\n          };\n        }\n      }\n      return result;\n    } finally {\n      client.close();\n    }\n  }\n}\n\nexport default McpService;\n"],"mappings":";;;;;;AAgBA,IAAM,IAAqB;AAE3B,SAAS,EAAgB,GAAwC;AAU/D,QATI,EAAO,SAAS,UACX;EACL,MAAM;EACN,SAAS,EAAO;EAChB,GAAI,EAAO,MAAM,UAAU,EAAE,MAAM,EAAO,MAAM;EAChD,GAAI,EAAO,OACT,OAAO,KAAK,EAAO,IAAI,CAAC,SAAS,KAAK,EAAE,KAAK,EAAO,KAAK;EAC5D,GAEI;EACL,MAAM,EAAO;EACb,KAAK,EAAO;EACZ,GAAI,EAAO,UAAU,EAAE,SAAS,EAAO,SAAS,GAAG,EAAE;EACtD;;AAaH,eAAe,EACb,GAC0B;AAG1B,KAFI,EAAO,SAAS,WAAW,CAAC,EAAO,QAAQ,CAAC,EAAO,OAEnD,CADW,OAAO,OAAO,EAAO,IAC/B,CAAO,MAAM,MAAU,MAAU,EAAmB,CAAE,QAAO;AAElE,KAAI;EAKF,IAAM,MAHY,MADK,EAAgB,qBAAqB,YAAY,EAC7C,gBAAgB,aAGd,aAAa,EAAO,OAAO,OAAO,EAAE,EAC3D,IAAM,OAAO,YACjB,OAAO,QAAQ,EAAO,IAAI,CAAC,KAAK,CAAC,GAAK,OAAW,CAC/C,GACA,MAAU,KAAsB,OAAO,EAAU,MAAS,WACtD,EAAU,KACV,EACL,CAAC,CACH;AACD,SAAO;GAAE,GAAG;GAAQ;GAAK;SACnB;AACN,SAAO;;;AAIX,IAAM,IAAN,MAAiB;CACf,aAAa,WACX,GACkC;AAWlC,MAAI,GAAkB,CAAC,QAAQ,SAAS,QACtC,QAAO;GAAE,IAAI;GAAM,OAAO,EAAE;GAAE;EAEhC,IAAM,IAAa,EAAiC,EAAO,EACrD,IAAa,EAAgB,MAAM,EAAsB,EAAO,CAAC,EACjE,EAAE,SAAM,cAAW,GAA6B,EAChD,IAAS,IAAI,EAAU;GAAE;GAAM,GAAI,IAAS,EAAE,WAAQ,GAAG,EAAE;GAAG,CAAC;AACrE,MAAI;GAMF,IAAM,IAAU;IACd,QAAQ;IACR,GAAI,EAAO,OAAO,EAAE,MAAM,EAAO,MAAM,GAAG,EAAE;IAC5C,GAAI,EAAO,UAAU,EAAE,SAAS,EAAO,SAAS,GAAG,EAAE;IACrD,GAAI,IAAa,EAAE,WAAW,EAAW,UAAU,GAAG,EAAE;IACzD,EACK,IAAU,MAAM,EAAO,WAC3B,EACD;AACD,OAAI,EAAO,MAAM,KAAc,EAAO,aAAa;IACjD,IAAM,IAAkB,EAAW,UAAU,EAAO,YAAY;AAChE,QAAI,EACF,QAAO;KACL,IAAI;KACJ,OAAO;KACP,YAAY;KACb;;AAGL,UAAO;YACC;AACR,KAAO,OAAO"}

package/dist/api/settings-service/settings-service.api.cjs

@@ -1,2 +1,2 @@
-require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../../node_modules/@openhands/typescript-client/dist/client/settings-client.cjs`),t=require(`../backend-registry/active-store.cjs`),n=require(`../agent-server-client-options.cjs`),r=require(`../../services/settings.cjs`),i=require(`../cloud/settings-service.api.cjs`),a=require(`./legacy-app-preferences-migration.cjs`);var o=[`language`,`user_consents_to_analytics`,`enable_sound_notifications`,`git_user_name`,`git_user_email`,`disabled_skills`],s=new Set(o),c=e=>s.has(e),l=e=>{let t={},n={};for(let[r,i]of Object.entries(e))c(r)?t[r]=i:n[r]=i;return{extracted:t,rest:n}},u=e=>JSON.parse(JSON.stringify(e)),d=(e,t)=>({...e??{},...t??{}});async function f(e,t=3,n=500){for(let r=0;r<t;r+=1)try{return await e()}catch(e){if(r>=t-1)throw e;let i=n*2**r;await new Promise(e=>{setTimeout(e,i)})}throw Error(`Retry attempts exhausted`)}var p={redacted:null,encrypted:null,timestamp:0},m=300*1e3,h=()=>Date.now()-p.timestamp<m,g=()=>{p={redacted:null,encrypted:null,timestamp:0}},_=e=>{let t={agent_settings:e.agent_settings??{},conversation_settings:e.conversation_settings??{},llm_api_key_set:e.llm_api_key_is_set},n=e.misc_settings?.app_preferences;if(n)for(let e of o){let r=n[e];r!==void 0&&(t[e]=r)}return t},v=e=>{let t=d(r.DEFAULT_SETTINGS.agent_settings??{},e.agent_settings??{}),n=d(r.DEFAULT_SETTINGS.conversation_settings??{},e.conversation_settings??{}),i={...u(r.DEFAULT_SETTINGS),...e,provider_tokens_set:{...r.DEFAULT_SETTINGS.provider_tokens_set??{},...e.provider_tokens_set??{}},agent_settings:t,conversation_settings:n},a=t.llm,o=t.condenser;return typeof t.agent==`string`&&(i.agent=t.agent),typeof a?.model==`string`&&a.model.length>0&&(i.llm_model=a.model),typeof a?.base_url==`string`&&(i.llm_base_url=a.base_url),typeof o?.enabled==`boolean`&&(i.enable_default_condenser=o.enabled),typeof o?.max_size==`number`&&(i.condenser_max_size=o.max_size),t.mcp_config&&(i.mcp_config=t.mcp_config),typeof n.confirmation_mode==`boolean`&&(i.confirmation_mode=n.confirmation_mode),(typeof n.security_analyzer==`string`||n.security_analyzer===null)&&(i.security_analyzer=n.security_analyzer),typeof n.max_iterations==`number`&&(i.max_iterations=n.max_iterations),i.search_api_key_set=!!i.search_api_key,i},y=class r{static async fetchSettingsFromApi(t){return f(()=>new e.SettingsClient(n.getAgentServerClientOptions()).getSettings({exposeSecrets:t}))}static async getSettings(){if(t.getActiveBackend().backend.kind===`cloud`)try{return v(await f(()=>i.fetchCloudSettings()))}catch(e){return console.warn(`Failed to fetch cloud settings, using defaults:`,e),v({})}if(h()&&p.redacted)return v(_(p.redacted));try{let t=await this.fetchSettingsFromApi();return await a.migrateLegacyAppPreferences(t,t=>new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings({misc_settings_diff:{app_preferences:t}}))&&(t=await this.fetchSettingsFromApi()),p.redacted=t,p.timestamp=Date.now(),v(_(t))}catch(e){return console.warn(`Failed to fetch settings from API, using defaults:`,e),v({})}}static async getSettingsForConversation(){if(h()&&p.encrypted)return{agentSettings:p.encrypted.agent_settings,conversationSettings:p.encrypted.conversation_settings,secretsEncrypted:!0};let e=await this.fetchSettingsFromApi(`encrypted`);return p.encrypted=e,p.timestamp||=Date.now(),{agentSettings:e.agent_settings,conversationSettings:e.conversation_settings,secretsEncrypted:!0}}static async getSettingsSchema(){return t.getActiveBackend().backend.kind===`cloud`?await i.fetchCloudSettingsSchema():await new e.SettingsClient(n.getAgentServerClientOptions()).getAgentSchema()}static async getConversationSettingsSchema(){return t.getActiveBackend().backend.kind===`cloud`?await i.fetchCloudConversationSettingsSchema():await new e.SettingsClient(n.getAgentServerClientOptions()).getConversationSchema()}static async saveSettings(a){let{extracted:o,rest:s}=l(a),c=Object.keys(o).length>0,u={},d=s.agent_settings_diff;d&&Object.keys(d).length>0&&(u.agent_settings_diff=d);let p=s.conversation_settings_diff;p&&Object.keys(p).length>0&&(u.conversation_settings_diff=p),c&&(u.misc_settings_diff={app_preferences:o});let m=t.getActiveBackend().backend.kind===`cloud`,h=u.agent_settings_diff,_=!!h&&`mcp_config`in h&&h.mcp_config!==null,v;if(_)try{v=m?(await i.fetchCloudSettings())?.agent_settings?.mcp_config:(await r.fetchSettingsFromApi())?.agent_settings?.mcp_config}catch{}if(m){if(!(u.agent_settings_diff||u.conversation_settings_diff||c))return!0;_&&await f(()=>i.saveCloudSettings({agent_settings_diff:{mcp_config:null}}));let e={};u.agent_settings_diff&&(e.agent_settings_diff=u.agent_settings_diff),u.conversation_settings_diff&&(e.conversation_settings_diff=u.conversation_settings_diff),c&&(e.app_preferences=o);try{await f(()=>i.saveCloudSettings(e))}catch(e){if(_&&v)try{await i.saveCloudSettings({agent_settings_diff:{mcp_config:v}})}catch{}throw e}}else{if(!(u.agent_settings_diff||u.conversation_settings_diff||u.misc_settings_diff))return!0;_&&await f(()=>new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings({agent_settings_diff:{mcp_config:null}}));try{await f(()=>new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings(u))}catch(t){if(_&&v)try{await new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings({agent_settings_diff:{mcp_config:v}})}catch{}throw t}}return g(),!0}static invalidateCache(){g()}};exports.default=y;
+require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../../node_modules/@openhands/typescript-client/dist/client/settings-client.cjs`),t=require(`../backend-registry/active-store.cjs`),n=require(`../agent-server-client-options.cjs`),r=require(`../../services/settings.cjs`),i=require(`../cloud/settings-service.api.cjs`);var a=[`language`,`user_consents_to_analytics`,`enable_sound_notifications`,`git_user_name`,`git_user_email`,`disabled_skills`],o=new Set(a),s=e=>o.has(e),c=e=>{let t={},n={};for(let[r,i]of Object.entries(e))s(r)?t[r]=i:n[r]=i;return{extracted:t,rest:n}},l=e=>JSON.parse(JSON.stringify(e)),u=(e,t)=>({...e??{},...t??{}});async function d(e,t=3,n=500){for(let r=0;r<t;r+=1)try{return await e()}catch(e){if(r>=t-1)throw e;let i=n*2**r;await new Promise(e=>{setTimeout(e,i)})}throw Error(`Retry attempts exhausted`)}var f={redacted:null,encrypted:null,timestamp:0},p=300*1e3,m=()=>Date.now()-f.timestamp<p,h=()=>{f={redacted:null,encrypted:null,timestamp:0}},g=e=>{let t={agent_settings:e.agent_settings??{},conversation_settings:e.conversation_settings??{},llm_api_key_set:e.llm_api_key_is_set},n=e.misc_settings?.app_preferences;if(n)for(let e of a){let r=n[e];r!==void 0&&(t[e]=r)}return t},_=e=>{let t=u(r.DEFAULT_SETTINGS.agent_settings??{},e.agent_settings??{}),n=u(r.DEFAULT_SETTINGS.conversation_settings??{},e.conversation_settings??{}),i={...l(r.DEFAULT_SETTINGS),...e,provider_tokens_set:{...r.DEFAULT_SETTINGS.provider_tokens_set??{},...e.provider_tokens_set??{}},agent_settings:t,conversation_settings:n},a=t.llm,o=t.condenser;return typeof t.agent==`string`&&(i.agent=t.agent),typeof a?.model==`string`&&a.model.length>0&&(i.llm_model=a.model),typeof a?.base_url==`string`&&(i.llm_base_url=a.base_url),typeof o?.enabled==`boolean`&&(i.enable_default_condenser=o.enabled),typeof o?.max_size==`number`&&(i.condenser_max_size=o.max_size),t.mcp_config&&(i.mcp_config=t.mcp_config),typeof n.confirmation_mode==`boolean`&&(i.confirmation_mode=n.confirmation_mode),(typeof n.security_analyzer==`string`||n.security_analyzer===null)&&(i.security_analyzer=n.security_analyzer),typeof n.max_iterations==`number`&&(i.max_iterations=n.max_iterations),i.search_api_key_set=!!i.search_api_key,i},v=class r{static async fetchSettingsFromApi(t){return d(()=>new e.SettingsClient(n.getAgentServerClientOptions()).getSettings({exposeSecrets:t}))}static async getSettings(){if(t.getActiveBackend().backend.kind===`cloud`)try{return _(await d(()=>i.fetchCloudSettings()))}catch(e){return console.warn(`Failed to fetch cloud settings, using defaults:`,e),_({})}if(m()&&f.redacted)return _(g(f.redacted));try{let e=await this.fetchSettingsFromApi();return f.redacted=e,f.timestamp=Date.now(),_(g(e))}catch(e){return console.warn(`Failed to fetch settings from API, using defaults:`,e),_({})}}static async getSettingsForConversation(){if(m()&&f.encrypted)return{agentSettings:f.encrypted.agent_settings,conversationSettings:f.encrypted.conversation_settings,secretsEncrypted:!0};let e=await this.fetchSettingsFromApi(`encrypted`);return f.encrypted=e,f.timestamp||=Date.now(),{agentSettings:e.agent_settings,conversationSettings:e.conversation_settings,secretsEncrypted:!0}}static async getSettingsSchema(){return t.getActiveBackend().backend.kind===`cloud`?await i.fetchCloudSettingsSchema():await new e.SettingsClient(n.getAgentServerClientOptions()).getAgentSchema()}static async getConversationSettingsSchema(){return t.getActiveBackend().backend.kind===`cloud`?await i.fetchCloudConversationSettingsSchema():await new e.SettingsClient(n.getAgentServerClientOptions()).getConversationSchema()}static async saveSettings(a){let{extracted:o,rest:s}=c(a),l=Object.keys(o).length>0,u={},f=s.agent_settings_diff;f&&Object.keys(f).length>0&&(u.agent_settings_diff=f);let p=s.conversation_settings_diff;p&&Object.keys(p).length>0&&(u.conversation_settings_diff=p),l&&(u.misc_settings_diff={app_preferences:o});let m=t.getActiveBackend().backend.kind===`cloud`,g=u.agent_settings_diff,_=!!g&&`mcp_config`in g&&g.mcp_config!==null,v;if(_)try{v=m?(await i.fetchCloudSettings())?.agent_settings?.mcp_config:(await r.fetchSettingsFromApi())?.agent_settings?.mcp_config}catch{}if(m){if(!(u.agent_settings_diff||u.conversation_settings_diff||l))return!0;_&&await d(()=>i.saveCloudSettings({agent_settings_diff:{mcp_config:null}}));let e={};u.agent_settings_diff&&(e.agent_settings_diff=u.agent_settings_diff),u.conversation_settings_diff&&(e.conversation_settings_diff=u.conversation_settings_diff),l&&(e.app_preferences=o);try{await d(()=>i.saveCloudSettings(e))}catch(e){if(_&&v)try{await i.saveCloudSettings({agent_settings_diff:{mcp_config:v}})}catch{}throw e}}else{if(!(u.agent_settings_diff||u.conversation_settings_diff||u.misc_settings_diff))return!0;_&&await d(()=>new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings({agent_settings_diff:{mcp_config:null}}));try{await d(()=>new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings(u))}catch(t){if(_&&v)try{await new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings({agent_settings_diff:{mcp_config:v}})}catch{}throw t}}return h(),!0}static invalidateCache(){h()}};exports.default=v;
 //# sourceMappingURL=settings-service.api.cjs.map

package/dist/api/settings-service/settings-service.api.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"settings-service.api.cjs","names":[],"sources":["../../../src/api/settings-service/settings-service.api.ts"],"sourcesContent":["import { SettingsClient } from \"@openhands/typescript-client/clients\";\nimport { DEFAULT_SETTINGS } from \"#/services/settings\";\nimport { Settings, SettingsSchema, SettingsValue } from \"#/types/settings\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport {\n  fetchCloudConversationSettingsSchema,\n  fetchCloudSettings,\n  fetchCloudSettingsSchema,\n  saveCloudSettings,\n} from \"../cloud/settings-service.api\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport { migrateLegacyAppPreferences } from \"./legacy-app-preferences-migration\";\n\n/**\n * Fields the agent-server stores under `misc_settings.app_preferences` (see\n * SDK `openhands.sdk.settings.AppPreferences`). Mirrored here as a flat\n * partial of Settings so the rest of the frontend can keep treating them as\n * top-level keys (`settings.language`, `settings.disabled_skills`, …).\n */\nexport const APP_PREFERENCE_FIELDS = [\n  \"language\",\n  \"user_consents_to_analytics\",\n  \"enable_sound_notifications\",\n  \"git_user_name\",\n  \"git_user_email\",\n  \"disabled_skills\",\n] as const;\n\nexport type AppPreferenceField = (typeof APP_PREFERENCE_FIELDS)[number];\n\nexport type AppPreferences = Partial<Pick<Settings, AppPreferenceField>>;\n\n/**\n * Container for frontend-owned settings the agent doesn't interpret.\n * Mirrors the SDK `MiscSettings` model introduced in agent-server 1.27.\n *\n * Single nested category today (`app_preferences`). Adding a future\n * category (e.g. `ui_preferences`) is a non-breaking change for the wire\n * shape — it just adds another optional sibling here.\n */\nexport interface MiscSettings {\n  app_preferences?: AppPreferences;\n}\n\n/**\n * Response from GET /api/settings\n * Mirrors the SettingsResponse model in the agent server.\n */\nexport interface SettingsApiResponse {\n  agent_settings: Record<string, SettingsValue>;\n  conversation_settings: Record<string, SettingsValue>;\n  llm_api_key_is_set: boolean;\n  /**\n   * Frontend-owned settings the agent does not interpret (currently just\n   * `app_preferences`). Added in agent-server 1.27; earlier servers omit\n   * the field entirely, in which case the frontend falls back to defaults.\n   */\n  misc_settings?: MiscSettings;\n}\n\n/**\n * Request payload for PATCH /api/settings.\n *\n * `misc_settings_diff` is deep-merged into the persisted `misc_settings`\n * block, matching the semantics of `agent_settings_diff` /\n * `conversation_settings_diff`. A partial diff like\n * `{ app_preferences: { language: \"fr\" } }` updates only `language` and\n * leaves every other `app_preferences` field alone. Lists\n * (`disabled_skills`) are replaced wholesale rather than merged.\n */\nexport interface SettingsUpdateRequest {\n  agent_settings_diff?: Record<string, SettingsValue>;\n  conversation_settings_diff?: Record<string, SettingsValue>;\n  misc_settings_diff?: MiscSettings;\n  // Permit additional keys so this stays assignable to the underlying\n  // typescript-client SDK type, which uses `[key: string]: unknown` for\n  // forward compatibility.\n  [key: string]: unknown;\n}\n\nconst APP_PREFERENCE_FIELD_SET: ReadonlySet<string> = new Set(\n  APP_PREFERENCE_FIELDS,\n);\n\nconst isAppPreferenceField = (key: string): key is AppPreferenceField =>\n  APP_PREFERENCE_FIELD_SET.has(key);\n\n/**\n * Split known app-preference keys out of a save payload so callers can\n * route them through `misc_settings_diff.app_preferences` (local) or as\n * flat top-level keys (cloud), while the remaining fields flow into the\n * `agent_settings_diff` / `conversation_settings_diff` branches.\n */\nconst extractAppPreferences = (\n  input: Record<string, unknown>,\n): { extracted: AppPreferences; rest: Record<string, unknown> } => {\n  const extracted: AppPreferences = {};\n  const rest: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(input)) {\n    if (isAppPreferenceField(key)) {\n      (extracted as Record<string, unknown>)[key] = value;\n    } else {\n      rest[key] = value;\n    }\n  }\n  return { extracted, rest };\n};\n\n/**\n * Secret exposure mode for X-Expose-Secrets header.\n *\n * - undefined: Returns redacted secrets (\"**********\")\n * - \"encrypted\": Returns cipher-encrypted values (safe for frontend to round-trip)\n * - \"plaintext\": Returns raw secret values (backend use only!)\n */\nexport type ExposeSecretsMode = \"encrypted\" | \"plaintext\" | undefined;\n\nconst deepClone = <T>(value: T): T => JSON.parse(JSON.stringify(value)) as T;\n\nconst mergeRecords = (\n  base: Record<string, SettingsValue> | null | undefined,\n  next: Record<string, SettingsValue> | null | undefined,\n) => ({ ...(base ?? {}), ...(next ?? {}) });\n\n/**\n * Retry helper for API calls with exponential backoff.\n */\nasync function withRetry<T>(\n  fn: () => Promise<T>,\n  maxRetries: number = 3,\n  baseDelayMs: number = 500,\n): Promise<T> {\n  for (let attempt = 0; attempt < maxRetries; attempt += 1) {\n    try {\n      return await fn();\n    } catch (error) {\n      if (attempt >= maxRetries - 1) {\n        throw error;\n      }\n\n      const delay = baseDelayMs * 2 ** attempt;\n\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, delay);\n      });\n    }\n  }\n\n  throw new Error(\"Retry attempts exhausted\");\n}\n\n/**\n * In-memory cache for settings to avoid repeated network calls.\n * The cache is invalidated on save operations.\n */\nlet settingsCache: {\n  /** Settings with redacted secrets for display */\n  redacted: SettingsApiResponse | null;\n  /** Settings with encrypted secrets for conversation start */\n  encrypted: SettingsApiResponse | null;\n  /** Timestamp when the cache was last populated */\n  timestamp: number;\n} = {\n  redacted: null,\n  encrypted: null,\n  timestamp: 0,\n};\n\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\nconst isCacheValid = () => Date.now() - settingsCache.timestamp < CACHE_TTL_MS;\n\nconst clearCache = () => {\n  settingsCache = { redacted: null, encrypted: null, timestamp: 0 };\n};\n\n/**\n * Transform API response into Settings object with derived fields.\n */\nconst transformApiResponse = (\n  response: SettingsApiResponse,\n): Partial<Settings> => {\n  const agentSettings = response.agent_settings ?? {};\n  const conversationSettings = response.conversation_settings ?? {};\n\n  const partial: Partial<Settings> = {\n    agent_settings: agentSettings,\n    conversation_settings: conversationSettings,\n    llm_api_key_set: response.llm_api_key_is_set,\n  };\n\n  // App-level user preferences come back nested under\n  // `misc_settings.app_preferences` from the local agent-server (added in\n  // 1.27, restructured into the `misc_settings` container in the follow-up\n  // refactor). Hoist them onto the flat Settings shape the rest of the\n  // frontend already speaks. Older servers omit the `misc_settings` field\n  // entirely; the migration helper invoked from `getSettings` promotes any\n  // leftover localStorage values to the server on first run, so the omitted\n  // case just falls back to defaults.\n  const prefs = response.misc_settings?.app_preferences;\n  if (prefs) {\n    for (const key of APP_PREFERENCE_FIELDS) {\n      const value = prefs[key];\n      if (value !== undefined) {\n        (partial as Record<string, unknown>)[key] = value;\n      }\n    }\n  }\n\n  return partial;\n};\n\n/**\n * Sync derived settings fields from agent_settings and conversation_settings.\n * This ensures backward compatibility with code that reads top-level fields.\n */\nconst syncDerivedSettings = (settings: Partial<Settings>): Settings => {\n  const agentSettings = mergeRecords(\n    DEFAULT_SETTINGS.agent_settings ?? {},\n    settings.agent_settings ?? {},\n  );\n  const conversationSettings = mergeRecords(\n    DEFAULT_SETTINGS.conversation_settings ?? {},\n    settings.conversation_settings ?? {},\n  );\n\n  const merged = {\n    ...deepClone(DEFAULT_SETTINGS),\n    ...settings,\n    provider_tokens_set: {\n      ...(DEFAULT_SETTINGS.provider_tokens_set ?? {}),\n      ...(settings.provider_tokens_set ?? {}),\n    },\n    agent_settings: agentSettings,\n    conversation_settings: conversationSettings,\n  } as Settings;\n\n  const llm = agentSettings.llm as Record<string, SettingsValue> | undefined;\n  const condenser = agentSettings.condenser as\n    | Record<string, SettingsValue>\n    | undefined;\n\n  if (typeof agentSettings.agent === \"string\") {\n    merged.agent = agentSettings.agent;\n  }\n  if (typeof llm?.model === \"string\" && llm.model.length > 0) {\n    merged.llm_model = llm.model;\n  }\n  if (typeof llm?.base_url === \"string\") {\n    merged.llm_base_url = llm.base_url;\n  }\n  // Note: api_key may be redacted (\"**********\") when fetched without expose header\n  // We don't sync it to top-level llm_api_key to avoid overwriting with redacted value\n  if (typeof condenser?.enabled === \"boolean\") {\n    merged.enable_default_condenser = condenser.enabled;\n  }\n  if (typeof condenser?.max_size === \"number\") {\n    merged.condenser_max_size = condenser.max_size;\n  }\n  if (agentSettings.mcp_config) {\n    merged.mcp_config = agentSettings.mcp_config as Settings[\"mcp_config\"];\n  }\n\n  if (typeof conversationSettings.confirmation_mode === \"boolean\") {\n    merged.confirmation_mode = conversationSettings.confirmation_mode;\n  }\n  if (\n    typeof conversationSettings.security_analyzer === \"string\" ||\n    conversationSettings.security_analyzer === null\n  ) {\n    merged.security_analyzer = conversationSettings.security_analyzer as\n      | string\n      | null;\n  }\n  if (typeof conversationSettings.max_iterations === \"number\") {\n    merged.max_iterations = conversationSettings.max_iterations;\n  }\n\n  merged.search_api_key_set = !!merged.search_api_key;\n\n  return merged;\n};\n\nclass SettingsService {\n  /**\n   * Fetch settings from the agent server API with retry logic.\n   *\n   * @param exposeSecrets - Controls how secrets are returned:\n   *   - undefined: Secrets are redacted (\"**********\") - safe for display\n   *   - \"encrypted\": Secrets are cipher-encrypted - safe for round-trip to start conversation\n   *   - \"plaintext\": Raw secrets - DO NOT USE from frontend\n   */\n  static async fetchSettingsFromApi(\n    exposeSecrets?: ExposeSecretsMode,\n  ): Promise<SettingsApiResponse> {\n    return withRetry(() =>\n      new SettingsClient(getAgentServerClientOptions()).getSettings({\n        exposeSecrets,\n      }),\n    ) as Promise<SettingsApiResponse>;\n  }\n\n  /**\n   * Get settings for display (secrets are redacted).\n   * Uses in-memory cache for performance.\n   */\n  static async getSettings(): Promise<Settings> {\n    // Cloud uses a different settings shape (flat top-level fields\n    // including provider_tokens_set, llm_model, etc.). Branch out before\n    // touching the local-only cache: cloud responses bypass the local\n    // SettingsApiResponse shape and feed straight into syncDerivedSettings\n    // so cloud-native fields like provider_tokens_set reach the GUI's\n    // useUserProviders → useAppInstallations → useGitRepositories chain.\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      try {\n        const cloud = await withRetry(() => fetchCloudSettings());\n        return syncDerivedSettings(cloud);\n      } catch (error) {\n        console.warn(\"Failed to fetch cloud settings, using defaults:\", error);\n        return syncDerivedSettings({});\n      }\n    }\n\n    // Check cache first\n    if (isCacheValid() && settingsCache.redacted) {\n      return syncDerivedSettings(transformApiResponse(settingsCache.redacted));\n    }\n\n    try {\n      let response = await this.fetchSettingsFromApi();\n      // One-shot migration: if the user previously stored app preferences in\n      // localStorage (older agent-canvas versions) and the server has no\n      // app_preferences for this user yet, promote the local values to the\n      // server now. Re-fetches so the cache is seeded with the migrated\n      // response. Safe to call repeatedly — clears the legacy keys after a\n      // successful push and no-ops thereafter.\n      const migrated = await migrateLegacyAppPreferences(\n        response,\n        (diff) =>\n          new SettingsClient(getAgentServerClientOptions()).updateSettings({\n            misc_settings_diff: { app_preferences: diff },\n          }) as Promise<unknown>,\n      );\n      if (migrated) {\n        response = await this.fetchSettingsFromApi();\n      }\n      settingsCache.redacted = response;\n      settingsCache.timestamp = Date.now();\n      return syncDerivedSettings(transformApiResponse(response));\n    } catch (error) {\n      // If API fails, return defaults\n      console.warn(\"Failed to fetch settings from API, using defaults:\", error);\n      return syncDerivedSettings({});\n    }\n  }\n\n  /**\n   * Get settings with encrypted secrets for starting conversations.\n   * The encrypted secrets can be passed to the start conversation API\n   * with secrets_encrypted=true for server-side decryption.\n   *\n   * @throws Error if encrypted settings cannot be fetched - conversations\n   *   should not start with broken/redacted credentials.\n   */\n  static async getSettingsForConversation(): Promise<{\n    agentSettings: Record<string, SettingsValue>;\n    conversationSettings: Record<string, SettingsValue>;\n    secretsEncrypted: boolean;\n  }> {\n    // Check cache first\n    if (isCacheValid() && settingsCache.encrypted) {\n      return {\n        agentSettings: settingsCache.encrypted.agent_settings,\n        conversationSettings: settingsCache.encrypted.conversation_settings,\n        secretsEncrypted: true,\n      };\n    }\n\n    // Fetch encrypted settings - this MUST succeed for conversations to work.\n    // Do not fall back to redacted settings as that would cause auth failures.\n    const response = await this.fetchSettingsFromApi(\"encrypted\");\n    settingsCache.encrypted = response;\n    if (!settingsCache.timestamp) {\n      settingsCache.timestamp = Date.now();\n    }\n    return {\n      agentSettings: response.agent_settings,\n      conversationSettings: response.conversation_settings,\n      secretsEncrypted: true,\n    };\n  }\n\n  static async getSettingsSchema(): Promise<SettingsSchema> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return (await fetchCloudSettingsSchema()) as SettingsSchema;\n    }\n    return (await new SettingsClient(\n      getAgentServerClientOptions(),\n    ).getAgentSchema()) as SettingsSchema;\n  }\n\n  static async getConversationSettingsSchema(): Promise<SettingsSchema> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return (await fetchCloudConversationSettingsSchema()) as SettingsSchema;\n    }\n    return (await new SettingsClient(\n      getAgentServerClientOptions(),\n    ).getConversationSchema()) as SettingsSchema;\n  }\n\n  /**\n   * Save settings to the agent server API.\n   * Uses PATCH for incremental updates.\n   */\n  static async saveSettings(\n    settings: Partial<Settings> & Record<string, unknown>,\n  ): Promise<boolean> {\n    // Split app-level user-preference fields (language, git identity, sound\n    // notifications, analytics consent, disabled_skills) off and route them\n    // through `misc_settings_diff.app_preferences` (local) or as flat\n    // top-level keys (cloud). The local agent-server stores them under\n    // `PersistedSettings.misc_settings.app_preferences`; the cloud accepts\n    // them as flat keys on `POST /api/v1/settings`.\n    const { extracted: appPreferences, rest } = extractAppPreferences(\n      settings as Record<string, unknown>,\n    );\n    const hasAppPreferences = Object.keys(appPreferences).length > 0;\n\n    const payload: SettingsUpdateRequest = {};\n\n    // Extract agent_settings_diff\n    const agentSettingsDiff = rest.agent_settings_diff as\n      | Record<string, SettingsValue>\n      | undefined;\n    if (agentSettingsDiff && Object.keys(agentSettingsDiff).length > 0) {\n      payload.agent_settings_diff = agentSettingsDiff;\n    }\n\n    // Extract conversation_settings_diff\n    const conversationSettingsDiff = rest.conversation_settings_diff as\n      | Record<string, SettingsValue>\n      | undefined;\n    if (\n      conversationSettingsDiff &&\n      Object.keys(conversationSettingsDiff).length > 0\n    ) {\n      payload.conversation_settings_diff = conversationSettingsDiff;\n    }\n\n    if (hasAppPreferences) {\n      payload.misc_settings_diff = { app_preferences: appPreferences };\n    }\n\n    const isCloud = getActiveBackend().backend.kind === \"cloud\";\n\n    // The backend applies ``agent_settings_diff`` by deep-merging it into the\n    // existing ``agent_settings`` dict (see SDK\n    // ``openhands.agent_server.persistence.models._deep_merge``). That works\n    // for scalar fields but is wrong for ``mcp_config.mcpServers``, which is\n    // a name-keyed map: a diff that omits a server cannot remove it (stale\n    // key stays), and a diff whose key indices shift (e.g. after deleting\n    // index 0, the second server is renumbered) leaves the original keys\n    // behind as duplicates pointing to the wrong server config.\n    //\n    // The only way to make ``mcp_config`` behave like a replace through this\n    // API is to first null it out — ``null`` is not a dict, so deep-merge\n    // takes the else branch and sets the field to ``None`` outright — and\n    // then send the new value in a follow-up call. We do this for every\n    // ``mcp_config`` write, including adds (the wasted round-trip is\n    // negligible for this user action and avoids divergent code paths).\n    const agentDiff = payload.agent_settings_diff;\n    // Send a pre-clear PATCH when the diff sets ``mcp_config`` to a non-null\n    // value. A second PATCH below then writes the new value. Skipping the\n    // pre-clear when the caller is already clearing (``mcp_config: null``)\n    // avoids a pointless duplicate request.\n    const needsMcpPreClear =\n      !!agentDiff && \"mcp_config\" in agentDiff && agentDiff.mcp_config !== null;\n\n    // The pre-clear is destructive: if the follow-up write fails after the\n    // clear succeeds, the user's MCP config is left empty. Snapshot the\n    // previous value (in raw SDK shape, NOT the GUI's parsed MCPConfig)\n    // before pre-clearing so we can attempt a best-effort rollback. The\n    // original write error is always re-thrown to the caller regardless\n    // of rollback success — the GUI's react-query mutations surface that\n    // as an error toast so the user knows to retry.\n    //\n    // Snapshot must be the SDK shape (``{ mcpServers: { name: cfg }}``)\n    // because that is what the backend expects on the rollback PATCH.\n    // ``SettingsService.getSettings`` returns a GUI Settings object whose\n    // ``mcp_config`` is typed as the parsed frontend MCPConfig and\n    // defaults to empty arrays when nothing is installed, so it is not\n    // suitable for round-tripping back to the backend.\n    let mcpConfigSnapshot: unknown = undefined;\n    if (needsMcpPreClear) {\n      try {\n        if (isCloud) {\n          const raw = (await fetchCloudSettings()) as {\n            agent_settings?: { mcp_config?: unknown };\n          };\n          mcpConfigSnapshot = raw?.agent_settings?.mcp_config;\n        } else {\n          const raw = (await SettingsService.fetchSettingsFromApi()) as {\n            agent_settings?: { mcp_config?: unknown };\n          };\n          mcpConfigSnapshot = raw?.agent_settings?.mcp_config;\n        }\n      } catch {\n        // Snapshot failed (network blip, etc.). Continue without rollback\n        // ability — the original write error will still surface.\n      }\n    }\n\n    if (isCloud) {\n      const hasCloudWork =\n        !!payload.agent_settings_diff ||\n        !!payload.conversation_settings_diff ||\n        hasAppPreferences;\n      if (!hasCloudWork) {\n        return true;\n      }\n      if (needsMcpPreClear) {\n        await withRetry(() =>\n          saveCloudSettings({\n            agent_settings_diff: { mcp_config: null },\n          }),\n        );\n      }\n      // Build the cloud payload from the same diffs, but as a separate\n      // object so undefined keys don't appear in the call (saveCloudSettings\n      // is called from tests with an exact-shape assertion).\n      const cloudPayload: Parameters<typeof saveCloudSettings>[0] = {};\n      if (payload.agent_settings_diff) {\n        cloudPayload.agent_settings_diff = payload.agent_settings_diff;\n      }\n      if (payload.conversation_settings_diff) {\n        cloudPayload.conversation_settings_diff =\n          payload.conversation_settings_diff;\n      }\n      if (hasAppPreferences) {\n        // The cloud `POST /api/v1/settings` takes app-preference fields as\n        // flat top-level keys (not under `app_preferences_diff`).\n        // `saveCloudSettings` re-flattens them onto the request body.\n        cloudPayload.app_preferences = appPreferences;\n      }\n      try {\n        await withRetry(() => saveCloudSettings(cloudPayload));\n      } catch (err) {\n        if (needsMcpPreClear && mcpConfigSnapshot) {\n          // Best-effort rollback. We deliberately do not wrap in withRetry:\n          // the user's session is already in a degraded state and we want\n          // to surface the original error promptly. Swallowing the restore\n          // error preserves the original failure context for the caller.\n          try {\n            await saveCloudSettings({\n              agent_settings_diff: {\n                mcp_config: mcpConfigSnapshot as SettingsValue,\n              },\n            });\n          } catch {\n            // Rollback failed; the original error takes precedence.\n          }\n        }\n        throw err;\n      }\n    } else {\n      // The local agent-server PATCH /api/settings requires at least one of\n      // the three diff fields. Skip the request entirely if nothing changed.\n      const hasLocalDiffs =\n        !!payload.agent_settings_diff ||\n        !!payload.conversation_settings_diff ||\n        !!payload.misc_settings_diff;\n      if (!hasLocalDiffs) {\n        return true;\n      }\n      if (needsMcpPreClear) {\n        await withRetry(() =>\n          new SettingsClient(getAgentServerClientOptions()).updateSettings({\n            agent_settings_diff: { mcp_config: null },\n          }),\n        );\n      }\n      try {\n        await withRetry(() =>\n          new SettingsClient(getAgentServerClientOptions()).updateSettings(\n            payload,\n          ),\n        );\n      } catch (err) {\n        if (needsMcpPreClear && mcpConfigSnapshot) {\n          // See cloud branch above for rationale.\n          try {\n            await new SettingsClient(\n              getAgentServerClientOptions(),\n            ).updateSettings({\n              agent_settings_diff: {\n                mcp_config: mcpConfigSnapshot as SettingsValue,\n              },\n            });\n          } catch {\n            // Rollback failed; the original error takes precedence.\n          }\n        }\n        throw err;\n      }\n    }\n\n    // Invalidate cache after successful save\n    clearCache();\n\n    return true;\n  }\n\n  /**\n   * Invalidate the settings cache.\n   * Call this when settings may have changed externally.\n   */\n  static invalidateCache(): void {\n    clearCache();\n  }\n}\n\nexport default SettingsService;\n"],"mappings":"iYAmBA,IAAa,EAAwB,CACnC,WACA,6BACA,6BACA,gBACA,iBACA,kBACD,CAsDK,EAAgD,IAAI,IACxD,EACD,CAEK,EAAwB,GAC5B,EAAyB,IAAI,EAAI,CAQ7B,EACJ,GACiE,CACjE,IAAM,EAA4B,EAAE,CAC9B,EAAgC,EAAE,CACxC,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,EAAM,CAC1C,EAAqB,EAAI,CAC1B,EAAsC,GAAO,EAE9C,EAAK,GAAO,EAGhB,MAAO,CAAE,YAAW,OAAM,EAYtB,EAAgB,GAAgB,KAAK,MAAM,KAAK,UAAU,EAAM,CAAC,CAEjE,GACJ,EACA,KACI,CAAE,GAAI,GAAQ,EAAE,CAAG,GAAI,GAAQ,EAAE,CAAG,EAK1C,eAAe,EACb,EACA,EAAqB,EACrB,EAAsB,IACV,CACZ,IAAK,IAAI,EAAU,EAAG,EAAU,EAAY,GAAW,EACrD,GAAI,CACF,OAAO,MAAM,GAAI,OACV,EAAO,CACd,GAAI,GAAW,EAAa,EAC1B,MAAM,EAGR,IAAM,EAAQ,EAAc,GAAK,EAEjC,MAAM,IAAI,QAAe,GAAY,CACnC,WAAW,EAAS,EAAM,EAC1B,CAIN,MAAU,MAAM,2BAA2B,CAO7C,IAAI,EAOA,CACF,SAAU,KACV,UAAW,KACX,UAAW,EACZ,CAEK,EAAe,IAAS,IAExB,MAAqB,KAAK,KAAK,CAAG,EAAc,UAAY,EAE5D,MAAmB,CACvB,EAAgB,CAAE,SAAU,KAAM,UAAW,KAAM,UAAW,EAAG,EAM7D,EACJ,GACsB,CAItB,IAAM,EAA6B,CACjC,eAJoB,EAAS,gBAAkB,EAAE,CAKjD,sBAJ2B,EAAS,uBAAyB,EAAE,CAK/D,gBAAiB,EAAS,mBAC3B,CAUK,EAAQ,EAAS,eAAe,gBACtC,GAAI,EACF,IAAK,IAAM,KAAO,EAAuB,CACvC,IAAM,EAAQ,EAAM,GAChB,IAAU,IAAA,KACX,EAAoC,GAAO,GAKlD,OAAO,GAOH,EAAuB,GAA0C,CACrE,IAAM,EAAgB,EACpB,EAAA,iBAAiB,gBAAkB,EAAE,CACrC,EAAS,gBAAkB,EAAE,CAC9B,CACK,EAAuB,EAC3B,EAAA,iBAAiB,uBAAyB,EAAE,CAC5C,EAAS,uBAAyB,EAAE,CACrC,CAEK,EAAS,CACb,GAAG,EAAU,EAAA,iBAAiB,CAC9B,GAAG,EACH,oBAAqB,CACnB,GAAI,EAAA,iBAAiB,qBAAuB,EAAE,CAC9C,GAAI,EAAS,qBAAuB,EAAE,CACvC,CACD,eAAgB,EAChB,sBAAuB,EACxB,CAEK,EAAM,EAAc,IACpB,EAAY,EAAc,UA0ChC,OAtCI,OAAO,EAAc,OAAU,WACjC,EAAO,MAAQ,EAAc,OAE3B,OAAO,GAAK,OAAU,UAAY,EAAI,MAAM,OAAS,IACvD,EAAO,UAAY,EAAI,OAErB,OAAO,GAAK,UAAa,WAC3B,EAAO,aAAe,EAAI,UAIxB,OAAO,GAAW,SAAY,YAChC,EAAO,yBAA2B,EAAU,SAE1C,OAAO,GAAW,UAAa,WACjC,EAAO,mBAAqB,EAAU,UAEpC,EAAc,aAChB,EAAO,WAAa,EAAc,YAGhC,OAAO,EAAqB,mBAAsB,YACpD,EAAO,kBAAoB,EAAqB,oBAGhD,OAAO,EAAqB,mBAAsB,UAClD,EAAqB,oBAAsB,QAE3C,EAAO,kBAAoB,EAAqB,mBAI9C,OAAO,EAAqB,gBAAmB,WACjD,EAAO,eAAiB,EAAqB,gBAG/C,EAAO,mBAAqB,CAAC,CAAC,EAAO,eAE9B,GAGH,EAAN,MAAM,CAAgB,CASpB,aAAa,qBACX,EAC8B,CAC9B,OAAO,MACL,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,YAAY,CAC5D,gBACD,CAAC,CACH,CAOH,aAAa,aAAiC,CAO5C,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QACtC,GAAI,CAEF,OAAO,EAAoB,MADP,MAAgB,EAAA,oBAAoB,CAAC,CACxB,OAC1B,EAAO,CAEd,OADA,QAAQ,KAAK,kDAAmD,EAAM,CAC/D,EAAoB,EAAE,CAAC,CAKlC,GAAI,GAAc,EAAI,EAAc,SAClC,OAAO,EAAoB,EAAqB,EAAc,SAAS,CAAC,CAG1E,GAAI,CACF,IAAI,EAAW,MAAM,KAAK,sBAAsB,CAmBhD,OALI,MAPmB,EAAA,4BACrB,EACC,GACC,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,eAAe,CAC/D,mBAAoB,CAAE,gBAAiB,EAAM,CAC9C,CAAC,CACL,GAEC,EAAW,MAAM,KAAK,sBAAsB,EAE9C,EAAc,SAAW,EACzB,EAAc,UAAY,KAAK,KAAK,CAC7B,EAAoB,EAAqB,EAAS,CAAC,OACnD,EAAO,CAGd,OADA,QAAQ,KAAK,qDAAsD,EAAM,CAClE,EAAoB,EAAE,CAAC,EAYlC,aAAa,4BAIV,CAED,GAAI,GAAc,EAAI,EAAc,UAClC,MAAO,CACL,cAAe,EAAc,UAAU,eACvC,qBAAsB,EAAc,UAAU,sBAC9C,iBAAkB,GACnB,CAKH,IAAM,EAAW,MAAM,KAAK,qBAAqB,YAAY,CAK7D,MAJA,GAAc,UAAY,EAC1B,AACE,EAAc,YAAY,KAAK,KAAK,CAE/B,CACL,cAAe,EAAS,eACxB,qBAAsB,EAAS,sBAC/B,iBAAkB,GACnB,CAGH,aAAa,mBAA6C,CAIxD,OAHI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAC9B,MAAM,EAAA,0BAA0B,CAElC,MAAM,IAAI,EAAA,eAChB,EAAA,6BAA6B,CAC9B,CAAC,gBAAgB,CAGpB,aAAa,+BAAyD,CAIpE,OAHI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAC9B,MAAM,EAAA,sCAAsC,CAE9C,MAAM,IAAI,EAAA,eAChB,EAAA,6BAA6B,CAC9B,CAAC,uBAAuB,CAO3B,aAAa,aACX,EACkB,CAOlB,GAAM,CAAE,UAAW,EAAgB,QAAS,EAC1C,EACD,CACK,EAAoB,OAAO,KAAK,EAAe,CAAC,OAAS,EAEzD,EAAiC,EAAE,CAGnC,EAAoB,EAAK,oBAG3B,GAAqB,OAAO,KAAK,EAAkB,CAAC,OAAS,IAC/D,EAAQ,oBAAsB,GAIhC,IAAM,EAA2B,EAAK,2BAIpC,GACA,OAAO,KAAK,EAAyB,CAAC,OAAS,IAE/C,EAAQ,2BAA6B,GAGnC,IACF,EAAQ,mBAAqB,CAAE,gBAAiB,EAAgB,EAGlE,IAAM,EAAU,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAiB9C,EAAY,EAAQ,oBAKpB,EACJ,CAAC,CAAC,GAAa,eAAgB,GAAa,EAAU,aAAe,KAgBnE,EACJ,GAAI,EACF,GAAI,CACF,AASE,EATE,GAIkB,MAHD,EAAA,oBAAoB,GAGd,gBAAgB,YAKrB,MAHD,EAAgB,sBAAsB,GAGhC,gBAAgB,gBAErC,EAMV,GAAI,EAAS,CAKX,GAAI,EAHA,EAAQ,qBACR,EAAQ,4BACV,GAEA,MAAO,GAEL,GACF,MAAM,MACJ,EAAA,kBAAkB,CAChB,oBAAqB,CAAE,WAAY,KAAM,CAC1C,CAAC,CACH,CAKH,IAAM,EAAwD,EAAE,CAC5D,EAAQ,sBACV,EAAa,oBAAsB,EAAQ,qBAEzC,EAAQ,6BACV,EAAa,2BACX,EAAQ,4BAER,IAIF,EAAa,gBAAkB,GAEjC,GAAI,CACF,MAAM,MAAgB,EAAA,kBAAkB,EAAa,CAAC,OAC/C,EAAK,CACZ,GAAI,GAAoB,EAKtB,GAAI,CACF,MAAM,EAAA,kBAAkB,CACtB,oBAAqB,CACnB,WAAY,EACb,CACF,CAAC,MACI,EAIV,MAAM,OAEH,CAOL,GAAI,EAHA,EAAQ,qBACR,EAAQ,4BACR,EAAQ,oBAEV,MAAO,GAEL,GACF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,eAAe,CAC/D,oBAAqB,CAAE,WAAY,KAAM,CAC1C,CAAC,CACH,CAEH,GAAI,CACF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,eAChD,EACD,CACF,OACM,EAAK,CACZ,GAAI,GAAoB,EAEtB,GAAI,CACF,MAAM,IAAI,EAAA,eACR,EAAA,6BAA6B,CAC9B,CAAC,eAAe,CACf,oBAAqB,CACnB,WAAY,EACb,CACF,CAAC,MACI,EAIV,MAAM,GAOV,OAFA,GAAY,CAEL,GAOT,OAAO,iBAAwB,CAC7B,GAAY"}
+{"version":3,"file":"settings-service.api.cjs","names":[],"sources":["../../../src/api/settings-service/settings-service.api.ts"],"sourcesContent":["import { SettingsClient } from \"@openhands/typescript-client/clients\";\nimport { DEFAULT_SETTINGS } from \"#/services/settings\";\nimport { Settings, SettingsSchema, SettingsValue } from \"#/types/settings\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport {\n  fetchCloudConversationSettingsSchema,\n  fetchCloudSettings,\n  fetchCloudSettingsSchema,\n  saveCloudSettings,\n} from \"../cloud/settings-service.api\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\n\n/**\n * Fields the agent-server stores under `misc_settings.app_preferences` (see\n * SDK `openhands.sdk.settings.AppPreferences`). Mirrored here as a flat\n * partial of Settings so the rest of the frontend can keep treating them as\n * top-level keys (`settings.language`, `settings.disabled_skills`, …).\n */\nexport const APP_PREFERENCE_FIELDS = [\n  \"language\",\n  \"user_consents_to_analytics\",\n  \"enable_sound_notifications\",\n  \"git_user_name\",\n  \"git_user_email\",\n  \"disabled_skills\",\n] as const;\n\nexport type AppPreferenceField = (typeof APP_PREFERENCE_FIELDS)[number];\n\nexport type AppPreferences = Partial<Pick<Settings, AppPreferenceField>>;\n\n/**\n * Container for frontend-owned settings the agent doesn't interpret.\n * Mirrors the SDK `MiscSettings` model introduced in agent-server 1.27.\n *\n * Single nested category today (`app_preferences`). Adding a future\n * category (e.g. `ui_preferences`) is a non-breaking change for the wire\n * shape — it just adds another optional sibling here.\n */\nexport interface MiscSettings {\n  app_preferences?: AppPreferences;\n}\n\n/**\n * Response from GET /api/settings\n * Mirrors the SettingsResponse model in the agent server.\n */\nexport interface SettingsApiResponse {\n  agent_settings: Record<string, SettingsValue>;\n  conversation_settings: Record<string, SettingsValue>;\n  llm_api_key_is_set: boolean;\n  /**\n   * Frontend-owned settings the agent does not interpret (currently just\n   * `app_preferences`). Added in agent-server 1.27; earlier servers omit\n   * the field entirely, in which case the frontend falls back to defaults.\n   */\n  misc_settings?: MiscSettings;\n}\n\n/**\n * Request payload for PATCH /api/settings.\n *\n * `misc_settings_diff` is deep-merged into the persisted `misc_settings`\n * block, matching the semantics of `agent_settings_diff` /\n * `conversation_settings_diff`. A partial diff like\n * `{ app_preferences: { language: \"fr\" } }` updates only `language` and\n * leaves every other `app_preferences` field alone. Lists\n * (`disabled_skills`) are replaced wholesale rather than merged.\n */\nexport interface SettingsUpdateRequest {\n  agent_settings_diff?: Record<string, SettingsValue>;\n  conversation_settings_diff?: Record<string, SettingsValue>;\n  misc_settings_diff?: MiscSettings;\n  // Permit additional keys so this stays assignable to the underlying\n  // typescript-client SDK type, which uses `[key: string]: unknown` for\n  // forward compatibility.\n  [key: string]: unknown;\n}\n\nconst APP_PREFERENCE_FIELD_SET: ReadonlySet<string> = new Set(\n  APP_PREFERENCE_FIELDS,\n);\n\nconst isAppPreferenceField = (key: string): key is AppPreferenceField =>\n  APP_PREFERENCE_FIELD_SET.has(key);\n\n/**\n * Split known app-preference keys out of a save payload so callers can\n * route them through `misc_settings_diff.app_preferences` (local) or as\n * flat top-level keys (cloud), while the remaining fields flow into the\n * `agent_settings_diff` / `conversation_settings_diff` branches.\n */\nconst extractAppPreferences = (\n  input: Record<string, unknown>,\n): { extracted: AppPreferences; rest: Record<string, unknown> } => {\n  const extracted: AppPreferences = {};\n  const rest: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(input)) {\n    if (isAppPreferenceField(key)) {\n      (extracted as Record<string, unknown>)[key] = value;\n    } else {\n      rest[key] = value;\n    }\n  }\n  return { extracted, rest };\n};\n\n/**\n * Secret exposure mode for X-Expose-Secrets header.\n *\n * - undefined: Returns redacted secrets (\"**********\")\n * - \"encrypted\": Returns cipher-encrypted values (safe for frontend to round-trip)\n * - \"plaintext\": Returns raw secret values (backend use only!)\n */\nexport type ExposeSecretsMode = \"encrypted\" | \"plaintext\" | undefined;\n\nconst deepClone = <T>(value: T): T => JSON.parse(JSON.stringify(value)) as T;\n\nconst mergeRecords = (\n  base: Record<string, SettingsValue> | null | undefined,\n  next: Record<string, SettingsValue> | null | undefined,\n) => ({ ...(base ?? {}), ...(next ?? {}) });\n\n/**\n * Retry helper for API calls with exponential backoff.\n */\nasync function withRetry<T>(\n  fn: () => Promise<T>,\n  maxRetries: number = 3,\n  baseDelayMs: number = 500,\n): Promise<T> {\n  for (let attempt = 0; attempt < maxRetries; attempt += 1) {\n    try {\n      return await fn();\n    } catch (error) {\n      if (attempt >= maxRetries - 1) {\n        throw error;\n      }\n\n      const delay = baseDelayMs * 2 ** attempt;\n\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, delay);\n      });\n    }\n  }\n\n  throw new Error(\"Retry attempts exhausted\");\n}\n\n/**\n * In-memory cache for settings to avoid repeated network calls.\n * The cache is invalidated on save operations.\n */\nlet settingsCache: {\n  /** Settings with redacted secrets for display */\n  redacted: SettingsApiResponse | null;\n  /** Settings with encrypted secrets for conversation start */\n  encrypted: SettingsApiResponse | null;\n  /** Timestamp when the cache was last populated */\n  timestamp: number;\n} = {\n  redacted: null,\n  encrypted: null,\n  timestamp: 0,\n};\n\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\nconst isCacheValid = () => Date.now() - settingsCache.timestamp < CACHE_TTL_MS;\n\nconst clearCache = () => {\n  settingsCache = { redacted: null, encrypted: null, timestamp: 0 };\n};\n\n/**\n * Transform API response into Settings object with derived fields.\n */\nconst transformApiResponse = (\n  response: SettingsApiResponse,\n): Partial<Settings> => {\n  const agentSettings = response.agent_settings ?? {};\n  const conversationSettings = response.conversation_settings ?? {};\n\n  const partial: Partial<Settings> = {\n    agent_settings: agentSettings,\n    conversation_settings: conversationSettings,\n    llm_api_key_set: response.llm_api_key_is_set,\n  };\n\n  // App-level user preferences come back nested under\n  // `misc_settings.app_preferences` from the local agent-server (added in\n  // 1.27, restructured into the `misc_settings` container in the follow-up\n  // refactor). Hoist them onto the flat Settings shape the rest of the\n  // frontend already speaks. Older servers omit the `misc_settings` field\n  // entirely; the migration helper invoked from `getSettings` promotes any\n  // leftover localStorage values to the server on first run, so the omitted\n  // case just falls back to defaults.\n  const prefs = response.misc_settings?.app_preferences;\n  if (prefs) {\n    for (const key of APP_PREFERENCE_FIELDS) {\n      const value = prefs[key];\n      if (value !== undefined) {\n        (partial as Record<string, unknown>)[key] = value;\n      }\n    }\n  }\n\n  return partial;\n};\n\n/**\n * Sync derived settings fields from agent_settings and conversation_settings.\n * This ensures backward compatibility with code that reads top-level fields.\n */\nconst syncDerivedSettings = (settings: Partial<Settings>): Settings => {\n  const agentSettings = mergeRecords(\n    DEFAULT_SETTINGS.agent_settings ?? {},\n    settings.agent_settings ?? {},\n  );\n  const conversationSettings = mergeRecords(\n    DEFAULT_SETTINGS.conversation_settings ?? {},\n    settings.conversation_settings ?? {},\n  );\n\n  const merged = {\n    ...deepClone(DEFAULT_SETTINGS),\n    ...settings,\n    provider_tokens_set: {\n      ...(DEFAULT_SETTINGS.provider_tokens_set ?? {}),\n      ...(settings.provider_tokens_set ?? {}),\n    },\n    agent_settings: agentSettings,\n    conversation_settings: conversationSettings,\n  } as Settings;\n\n  const llm = agentSettings.llm as Record<string, SettingsValue> | undefined;\n  const condenser = agentSettings.condenser as\n    | Record<string, SettingsValue>\n    | undefined;\n\n  if (typeof agentSettings.agent === \"string\") {\n    merged.agent = agentSettings.agent;\n  }\n  if (typeof llm?.model === \"string\" && llm.model.length > 0) {\n    merged.llm_model = llm.model;\n  }\n  if (typeof llm?.base_url === \"string\") {\n    merged.llm_base_url = llm.base_url;\n  }\n  // Note: api_key may be redacted (\"**********\") when fetched without expose header\n  // We don't sync it to top-level llm_api_key to avoid overwriting with redacted value\n  if (typeof condenser?.enabled === \"boolean\") {\n    merged.enable_default_condenser = condenser.enabled;\n  }\n  if (typeof condenser?.max_size === \"number\") {\n    merged.condenser_max_size = condenser.max_size;\n  }\n  if (agentSettings.mcp_config) {\n    merged.mcp_config = agentSettings.mcp_config as Settings[\"mcp_config\"];\n  }\n\n  if (typeof conversationSettings.confirmation_mode === \"boolean\") {\n    merged.confirmation_mode = conversationSettings.confirmation_mode;\n  }\n  if (\n    typeof conversationSettings.security_analyzer === \"string\" ||\n    conversationSettings.security_analyzer === null\n  ) {\n    merged.security_analyzer = conversationSettings.security_analyzer as\n      | string\n      | null;\n  }\n  if (typeof conversationSettings.max_iterations === \"number\") {\n    merged.max_iterations = conversationSettings.max_iterations;\n  }\n\n  merged.search_api_key_set = !!merged.search_api_key;\n\n  return merged;\n};\n\nclass SettingsService {\n  /**\n   * Fetch settings from the agent server API with retry logic.\n   *\n   * @param exposeSecrets - Controls how secrets are returned:\n   *   - undefined: Secrets are redacted (\"**********\") - safe for display\n   *   - \"encrypted\": Secrets are cipher-encrypted - safe for round-trip to start conversation\n   *   - \"plaintext\": Raw secrets - DO NOT USE from frontend\n   */\n  static async fetchSettingsFromApi(\n    exposeSecrets?: ExposeSecretsMode,\n  ): Promise<SettingsApiResponse> {\n    return withRetry(() =>\n      new SettingsClient(getAgentServerClientOptions()).getSettings({\n        exposeSecrets,\n      }),\n    ) as Promise<SettingsApiResponse>;\n  }\n\n  /**\n   * Get settings for display (secrets are redacted).\n   * Uses in-memory cache for performance.\n   */\n  static async getSettings(): Promise<Settings> {\n    // Cloud uses a different settings shape (flat top-level fields\n    // including provider_tokens_set, llm_model, etc.). Branch out before\n    // touching the local-only cache: cloud responses bypass the local\n    // SettingsApiResponse shape and feed straight into syncDerivedSettings\n    // so cloud-native fields like provider_tokens_set reach the GUI's\n    // useUserProviders → useAppInstallations → useGitRepositories chain.\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      try {\n        const cloud = await withRetry(() => fetchCloudSettings());\n        return syncDerivedSettings(cloud);\n      } catch (error) {\n        console.warn(\"Failed to fetch cloud settings, using defaults:\", error);\n        return syncDerivedSettings({});\n      }\n    }\n\n    // Check cache first\n    if (isCacheValid() && settingsCache.redacted) {\n      return syncDerivedSettings(transformApiResponse(settingsCache.redacted));\n    }\n\n    try {\n      const response = await this.fetchSettingsFromApi();\n      settingsCache.redacted = response;\n      settingsCache.timestamp = Date.now();\n      return syncDerivedSettings(transformApiResponse(response));\n    } catch (error) {\n      // If API fails, return defaults\n      console.warn(\"Failed to fetch settings from API, using defaults:\", error);\n      return syncDerivedSettings({});\n    }\n  }\n\n  /**\n   * Get settings with encrypted secrets for starting conversations.\n   * The encrypted secrets can be passed to the start conversation API\n   * with secrets_encrypted=true for server-side decryption.\n   *\n   * @throws Error if encrypted settings cannot be fetched - conversations\n   *   should not start with broken/redacted credentials.\n   */\n  static async getSettingsForConversation(): Promise<{\n    agentSettings: Record<string, SettingsValue>;\n    conversationSettings: Record<string, SettingsValue>;\n    secretsEncrypted: boolean;\n  }> {\n    // Check cache first\n    if (isCacheValid() && settingsCache.encrypted) {\n      return {\n        agentSettings: settingsCache.encrypted.agent_settings,\n        conversationSettings: settingsCache.encrypted.conversation_settings,\n        secretsEncrypted: true,\n      };\n    }\n\n    // Fetch encrypted settings - this MUST succeed for conversations to work.\n    // Do not fall back to redacted settings as that would cause auth failures.\n    const response = await this.fetchSettingsFromApi(\"encrypted\");\n    settingsCache.encrypted = response;\n    if (!settingsCache.timestamp) {\n      settingsCache.timestamp = Date.now();\n    }\n    return {\n      agentSettings: response.agent_settings,\n      conversationSettings: response.conversation_settings,\n      secretsEncrypted: true,\n    };\n  }\n\n  static async getSettingsSchema(): Promise<SettingsSchema> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return (await fetchCloudSettingsSchema()) as SettingsSchema;\n    }\n    return (await new SettingsClient(\n      getAgentServerClientOptions(),\n    ).getAgentSchema()) as SettingsSchema;\n  }\n\n  static async getConversationSettingsSchema(): Promise<SettingsSchema> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return (await fetchCloudConversationSettingsSchema()) as SettingsSchema;\n    }\n    return (await new SettingsClient(\n      getAgentServerClientOptions(),\n    ).getConversationSchema()) as SettingsSchema;\n  }\n\n  /**\n   * Save settings to the agent server API.\n   * Uses PATCH for incremental updates.\n   */\n  static async saveSettings(\n    settings: Partial<Settings> & Record<string, unknown>,\n  ): Promise<boolean> {\n    // Split app-level user-preference fields (language, git identity, sound\n    // notifications, analytics consent, disabled_skills) off and route them\n    // through `misc_settings_diff.app_preferences` (local) or as flat\n    // top-level keys (cloud). The local agent-server stores them under\n    // `PersistedSettings.misc_settings.app_preferences`; the cloud accepts\n    // them as flat keys on `POST /api/v1/settings`.\n    const { extracted: appPreferences, rest } = extractAppPreferences(\n      settings as Record<string, unknown>,\n    );\n    const hasAppPreferences = Object.keys(appPreferences).length > 0;\n\n    const payload: SettingsUpdateRequest = {};\n\n    // Extract agent_settings_diff\n    const agentSettingsDiff = rest.agent_settings_diff as\n      | Record<string, SettingsValue>\n      | undefined;\n    if (agentSettingsDiff && Object.keys(agentSettingsDiff).length > 0) {\n      payload.agent_settings_diff = agentSettingsDiff;\n    }\n\n    // Extract conversation_settings_diff\n    const conversationSettingsDiff = rest.conversation_settings_diff as\n      | Record<string, SettingsValue>\n      | undefined;\n    if (\n      conversationSettingsDiff &&\n      Object.keys(conversationSettingsDiff).length > 0\n    ) {\n      payload.conversation_settings_diff = conversationSettingsDiff;\n    }\n\n    if (hasAppPreferences) {\n      payload.misc_settings_diff = { app_preferences: appPreferences };\n    }\n\n    const isCloud = getActiveBackend().backend.kind === \"cloud\";\n\n    // The backend applies ``agent_settings_diff`` by deep-merging it into the\n    // existing ``agent_settings`` dict (see SDK\n    // ``openhands.agent_server.persistence.models._deep_merge``). That works\n    // for scalar fields but is wrong for ``mcp_config.mcpServers``, which is\n    // a name-keyed map: a diff that omits a server cannot remove it (stale\n    // key stays), and a diff whose key indices shift (e.g. after deleting\n    // index 0, the second server is renumbered) leaves the original keys\n    // behind as duplicates pointing to the wrong server config.\n    //\n    // The only way to make ``mcp_config`` behave like a replace through this\n    // API is to first null it out — ``null`` is not a dict, so deep-merge\n    // takes the else branch and sets the field to ``None`` outright — and\n    // then send the new value in a follow-up call. We do this for every\n    // ``mcp_config`` write, including adds (the wasted round-trip is\n    // negligible for this user action and avoids divergent code paths).\n    const agentDiff = payload.agent_settings_diff;\n    // Send a pre-clear PATCH when the diff sets ``mcp_config`` to a non-null\n    // value. A second PATCH below then writes the new value. Skipping the\n    // pre-clear when the caller is already clearing (``mcp_config: null``)\n    // avoids a pointless duplicate request.\n    const needsMcpPreClear =\n      !!agentDiff && \"mcp_config\" in agentDiff && agentDiff.mcp_config !== null;\n\n    // The pre-clear is destructive: if the follow-up write fails after the\n    // clear succeeds, the user's MCP config is left empty. Snapshot the\n    // previous value (in raw SDK shape, NOT the GUI's parsed MCPConfig)\n    // before pre-clearing so we can attempt a best-effort rollback. The\n    // original write error is always re-thrown to the caller regardless\n    // of rollback success — the GUI's react-query mutations surface that\n    // as an error toast so the user knows to retry.\n    //\n    // Snapshot must be the SDK shape (``{ mcpServers: { name: cfg }}``)\n    // because that is what the backend expects on the rollback PATCH.\n    // ``SettingsService.getSettings`` returns a GUI Settings object whose\n    // ``mcp_config`` is typed as the parsed frontend MCPConfig and\n    // defaults to empty arrays when nothing is installed, so it is not\n    // suitable for round-tripping back to the backend.\n    let mcpConfigSnapshot: unknown = undefined;\n    if (needsMcpPreClear) {\n      try {\n        if (isCloud) {\n          const raw = (await fetchCloudSettings()) as {\n            agent_settings?: { mcp_config?: unknown };\n          };\n          mcpConfigSnapshot = raw?.agent_settings?.mcp_config;\n        } else {\n          const raw = (await SettingsService.fetchSettingsFromApi()) as {\n            agent_settings?: { mcp_config?: unknown };\n          };\n          mcpConfigSnapshot = raw?.agent_settings?.mcp_config;\n        }\n      } catch {\n        // Snapshot failed (network blip, etc.). Continue without rollback\n        // ability — the original write error will still surface.\n      }\n    }\n\n    if (isCloud) {\n      const hasCloudWork =\n        !!payload.agent_settings_diff ||\n        !!payload.conversation_settings_diff ||\n        hasAppPreferences;\n      if (!hasCloudWork) {\n        return true;\n      }\n      if (needsMcpPreClear) {\n        await withRetry(() =>\n          saveCloudSettings({\n            agent_settings_diff: { mcp_config: null },\n          }),\n        );\n      }\n      // Build the cloud payload from the same diffs, but as a separate\n      // object so undefined keys don't appear in the call (saveCloudSettings\n      // is called from tests with an exact-shape assertion).\n      const cloudPayload: Parameters<typeof saveCloudSettings>[0] = {};\n      if (payload.agent_settings_diff) {\n        cloudPayload.agent_settings_diff = payload.agent_settings_diff;\n      }\n      if (payload.conversation_settings_diff) {\n        cloudPayload.conversation_settings_diff =\n          payload.conversation_settings_diff;\n      }\n      if (hasAppPreferences) {\n        // The cloud `POST /api/v1/settings` takes app-preference fields as\n        // flat top-level keys (not under `app_preferences_diff`).\n        // `saveCloudSettings` re-flattens them onto the request body.\n        cloudPayload.app_preferences = appPreferences;\n      }\n      try {\n        await withRetry(() => saveCloudSettings(cloudPayload));\n      } catch (err) {\n        if (needsMcpPreClear && mcpConfigSnapshot) {\n          // Best-effort rollback. We deliberately do not wrap in withRetry:\n          // the user's session is already in a degraded state and we want\n          // to surface the original error promptly. Swallowing the restore\n          // error preserves the original failure context for the caller.\n          try {\n            await saveCloudSettings({\n              agent_settings_diff: {\n                mcp_config: mcpConfigSnapshot as SettingsValue,\n              },\n            });\n          } catch {\n            // Rollback failed; the original error takes precedence.\n          }\n        }\n        throw err;\n      }\n    } else {\n      // The local agent-server PATCH /api/settings requires at least one of\n      // the three diff fields. Skip the request entirely if nothing changed.\n      const hasLocalDiffs =\n        !!payload.agent_settings_diff ||\n        !!payload.conversation_settings_diff ||\n        !!payload.misc_settings_diff;\n      if (!hasLocalDiffs) {\n        return true;\n      }\n      if (needsMcpPreClear) {\n        await withRetry(() =>\n          new SettingsClient(getAgentServerClientOptions()).updateSettings({\n            agent_settings_diff: { mcp_config: null },\n          }),\n        );\n      }\n      try {\n        await withRetry(() =>\n          new SettingsClient(getAgentServerClientOptions()).updateSettings(\n            payload,\n          ),\n        );\n      } catch (err) {\n        if (needsMcpPreClear && mcpConfigSnapshot) {\n          // See cloud branch above for rationale.\n          try {\n            await new SettingsClient(\n              getAgentServerClientOptions(),\n            ).updateSettings({\n              agent_settings_diff: {\n                mcp_config: mcpConfigSnapshot as SettingsValue,\n              },\n            });\n          } catch {\n            // Rollback failed; the original error takes precedence.\n          }\n        }\n        throw err;\n      }\n    }\n\n    // Invalidate cache after successful save\n    clearCache();\n\n    return true;\n  }\n\n  /**\n   * Invalidate the settings cache.\n   * Call this when settings may have changed externally.\n   */\n  static invalidateCache(): void {\n    clearCache();\n  }\n}\n\nexport default SettingsService;\n"],"mappings":"6UAkBA,IAAa,EAAwB,CACnC,WACA,6BACA,6BACA,gBACA,iBACA,kBACD,CAsDK,EAAgD,IAAI,IACxD,EACD,CAEK,EAAwB,GAC5B,EAAyB,IAAI,EAAI,CAQ7B,EACJ,GACiE,CACjE,IAAM,EAA4B,EAAE,CAC9B,EAAgC,EAAE,CACxC,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,EAAM,CAC1C,EAAqB,EAAI,CAC1B,EAAsC,GAAO,EAE9C,EAAK,GAAO,EAGhB,MAAO,CAAE,YAAW,OAAM,EAYtB,EAAgB,GAAgB,KAAK,MAAM,KAAK,UAAU,EAAM,CAAC,CAEjE,GACJ,EACA,KACI,CAAE,GAAI,GAAQ,EAAE,CAAG,GAAI,GAAQ,EAAE,CAAG,EAK1C,eAAe,EACb,EACA,EAAqB,EACrB,EAAsB,IACV,CACZ,IAAK,IAAI,EAAU,EAAG,EAAU,EAAY,GAAW,EACrD,GAAI,CACF,OAAO,MAAM,GAAI,OACV,EAAO,CACd,GAAI,GAAW,EAAa,EAC1B,MAAM,EAGR,IAAM,EAAQ,EAAc,GAAK,EAEjC,MAAM,IAAI,QAAe,GAAY,CACnC,WAAW,EAAS,EAAM,EAC1B,CAIN,MAAU,MAAM,2BAA2B,CAO7C,IAAI,EAOA,CACF,SAAU,KACV,UAAW,KACX,UAAW,EACZ,CAEK,EAAe,IAAS,IAExB,MAAqB,KAAK,KAAK,CAAG,EAAc,UAAY,EAE5D,MAAmB,CACvB,EAAgB,CAAE,SAAU,KAAM,UAAW,KAAM,UAAW,EAAG,EAM7D,EACJ,GACsB,CAItB,IAAM,EAA6B,CACjC,eAJoB,EAAS,gBAAkB,EAAE,CAKjD,sBAJ2B,EAAS,uBAAyB,EAAE,CAK/D,gBAAiB,EAAS,mBAC3B,CAUK,EAAQ,EAAS,eAAe,gBACtC,GAAI,EACF,IAAK,IAAM,KAAO,EAAuB,CACvC,IAAM,EAAQ,EAAM,GAChB,IAAU,IAAA,KACX,EAAoC,GAAO,GAKlD,OAAO,GAOH,EAAuB,GAA0C,CACrE,IAAM,EAAgB,EACpB,EAAA,iBAAiB,gBAAkB,EAAE,CACrC,EAAS,gBAAkB,EAAE,CAC9B,CACK,EAAuB,EAC3B,EAAA,iBAAiB,uBAAyB,EAAE,CAC5C,EAAS,uBAAyB,EAAE,CACrC,CAEK,EAAS,CACb,GAAG,EAAU,EAAA,iBAAiB,CAC9B,GAAG,EACH,oBAAqB,CACnB,GAAI,EAAA,iBAAiB,qBAAuB,EAAE,CAC9C,GAAI,EAAS,qBAAuB,EAAE,CACvC,CACD,eAAgB,EAChB,sBAAuB,EACxB,CAEK,EAAM,EAAc,IACpB,EAAY,EAAc,UA0ChC,OAtCI,OAAO,EAAc,OAAU,WACjC,EAAO,MAAQ,EAAc,OAE3B,OAAO,GAAK,OAAU,UAAY,EAAI,MAAM,OAAS,IACvD,EAAO,UAAY,EAAI,OAErB,OAAO,GAAK,UAAa,WAC3B,EAAO,aAAe,EAAI,UAIxB,OAAO,GAAW,SAAY,YAChC,EAAO,yBAA2B,EAAU,SAE1C,OAAO,GAAW,UAAa,WACjC,EAAO,mBAAqB,EAAU,UAEpC,EAAc,aAChB,EAAO,WAAa,EAAc,YAGhC,OAAO,EAAqB,mBAAsB,YACpD,EAAO,kBAAoB,EAAqB,oBAGhD,OAAO,EAAqB,mBAAsB,UAClD,EAAqB,oBAAsB,QAE3C,EAAO,kBAAoB,EAAqB,mBAI9C,OAAO,EAAqB,gBAAmB,WACjD,EAAO,eAAiB,EAAqB,gBAG/C,EAAO,mBAAqB,CAAC,CAAC,EAAO,eAE9B,GAGH,EAAN,MAAM,CAAgB,CASpB,aAAa,qBACX,EAC8B,CAC9B,OAAO,MACL,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,YAAY,CAC5D,gBACD,CAAC,CACH,CAOH,aAAa,aAAiC,CAO5C,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QACtC,GAAI,CAEF,OAAO,EAAoB,MADP,MAAgB,EAAA,oBAAoB,CAAC,CACxB,OAC1B,EAAO,CAEd,OADA,QAAQ,KAAK,kDAAmD,EAAM,CAC/D,EAAoB,EAAE,CAAC,CAKlC,GAAI,GAAc,EAAI,EAAc,SAClC,OAAO,EAAoB,EAAqB,EAAc,SAAS,CAAC,CAG1E,GAAI,CACF,IAAM,EAAW,MAAM,KAAK,sBAAsB,CAGlD,MAFA,GAAc,SAAW,EACzB,EAAc,UAAY,KAAK,KAAK,CAC7B,EAAoB,EAAqB,EAAS,CAAC,OACnD,EAAO,CAGd,OADA,QAAQ,KAAK,qDAAsD,EAAM,CAClE,EAAoB,EAAE,CAAC,EAYlC,aAAa,4BAIV,CAED,GAAI,GAAc,EAAI,EAAc,UAClC,MAAO,CACL,cAAe,EAAc,UAAU,eACvC,qBAAsB,EAAc,UAAU,sBAC9C,iBAAkB,GACnB,CAKH,IAAM,EAAW,MAAM,KAAK,qBAAqB,YAAY,CAK7D,MAJA,GAAc,UAAY,EAC1B,AACE,EAAc,YAAY,KAAK,KAAK,CAE/B,CACL,cAAe,EAAS,eACxB,qBAAsB,EAAS,sBAC/B,iBAAkB,GACnB,CAGH,aAAa,mBAA6C,CAIxD,OAHI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAC9B,MAAM,EAAA,0BAA0B,CAElC,MAAM,IAAI,EAAA,eAChB,EAAA,6BAA6B,CAC9B,CAAC,gBAAgB,CAGpB,aAAa,+BAAyD,CAIpE,OAHI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAC9B,MAAM,EAAA,sCAAsC,CAE9C,MAAM,IAAI,EAAA,eAChB,EAAA,6BAA6B,CAC9B,CAAC,uBAAuB,CAO3B,aAAa,aACX,EACkB,CAOlB,GAAM,CAAE,UAAW,EAAgB,QAAS,EAC1C,EACD,CACK,EAAoB,OAAO,KAAK,EAAe,CAAC,OAAS,EAEzD,EAAiC,EAAE,CAGnC,EAAoB,EAAK,oBAG3B,GAAqB,OAAO,KAAK,EAAkB,CAAC,OAAS,IAC/D,EAAQ,oBAAsB,GAIhC,IAAM,EAA2B,EAAK,2BAIpC,GACA,OAAO,KAAK,EAAyB,CAAC,OAAS,IAE/C,EAAQ,2BAA6B,GAGnC,IACF,EAAQ,mBAAqB,CAAE,gBAAiB,EAAgB,EAGlE,IAAM,EAAU,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAiB9C,EAAY,EAAQ,oBAKpB,EACJ,CAAC,CAAC,GAAa,eAAgB,GAAa,EAAU,aAAe,KAgBnE,EACJ,GAAI,EACF,GAAI,CACF,AASE,EATE,GAIkB,MAHD,EAAA,oBAAoB,GAGd,gBAAgB,YAKrB,MAHD,EAAgB,sBAAsB,GAGhC,gBAAgB,gBAErC,EAMV,GAAI,EAAS,CAKX,GAAI,EAHA,EAAQ,qBACR,EAAQ,4BACV,GAEA,MAAO,GAEL,GACF,MAAM,MACJ,EAAA,kBAAkB,CAChB,oBAAqB,CAAE,WAAY,KAAM,CAC1C,CAAC,CACH,CAKH,IAAM,EAAwD,EAAE,CAC5D,EAAQ,sBACV,EAAa,oBAAsB,EAAQ,qBAEzC,EAAQ,6BACV,EAAa,2BACX,EAAQ,4BAER,IAIF,EAAa,gBAAkB,GAEjC,GAAI,CACF,MAAM,MAAgB,EAAA,kBAAkB,EAAa,CAAC,OAC/C,EAAK,CACZ,GAAI,GAAoB,EAKtB,GAAI,CACF,MAAM,EAAA,kBAAkB,CACtB,oBAAqB,CACnB,WAAY,EACb,CACF,CAAC,MACI,EAIV,MAAM,OAEH,CAOL,GAAI,EAHA,EAAQ,qBACR,EAAQ,4BACR,EAAQ,oBAEV,MAAO,GAEL,GACF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,eAAe,CAC/D,oBAAqB,CAAE,WAAY,KAAM,CAC1C,CAAC,CACH,CAEH,GAAI,CACF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,eAChD,EACD,CACF,OACM,EAAK,CACZ,GAAI,GAAoB,EAEtB,GAAI,CACF,MAAM,IAAI,EAAA,eACR,EAAA,6BAA6B,CAC9B,CAAC,eAAe,CACf,oBAAqB,CACnB,WAAY,EACb,CACF,CAAC,MACI,EAIV,MAAM,GAOV,OAFA,GAAY,CAEL,GAOT,OAAO,iBAAwB,CAC7B,GAAY"}