@openhands/agent-canvas 1.1.0 → 1.2.0

package/dist/api/conversation-service/conversation-service.api.d.ts

@@ -3,6 +3,7 @@ import { AppConversation } from "./agent-server-conversation-service.types";
 declare class ConversationService {
     private static currentConversation;
     static setCurrentConversation(currentConversation: AppConversation | null): void;
+    static getCurrentConversation(): AppConversation | null;
     private static getClientOverrides;
     static getVSCodeUrl(conversationId: string): Promise<GetVSCodeUrlResponse>;
     static getTrajectory(conversationId: string): Promise<GetTrajectoryResponse>;

package/dist/api/conversation-service/conversation-service.api.js

@@ -1,4 +1,5 @@
 import { VSCodeClient as e } from "../../node_modules/@openhands/typescript-client/dist/client/vscode-client.js";
+import "../../node_modules/@openhands/typescript-client/dist/clients.js";
 import { getAgentServerWorkingDir as t } from "../agent-server-config.js";
 import { getAgentServerClientOptions as n, getAgentServerHttpClientOptions as r } from "../agent-server-client-options.js";
 import { RemoteEventsList as i } from "../../node_modules/@openhands/typescript-client/dist/events/remote-events-list.js";
@@ -9,6 +10,9 @@ var o = class {
 	static setCurrentConversation(e) {
 		this.currentConversation = e;
 	}
+	static getCurrentConversation() {
+		return this.currentConversation;
+	}
 	static getClientOverrides() {
 		return { sessionApiKey: this.currentConversation?.session_api_key };
 	}

package/dist/api/conversation-service/conversation-service.api.js.map

@@ -1 +1 @@
-{"version":3,"file":"conversation-service.api.js","names":[],"sources":["../../../src/api/conversation-service/conversation-service.api.ts"],"sourcesContent":["import { VSCodeClient } from \"@openhands/typescript-client/clients\";\nimport { RemoteEventsList } from \"@openhands/typescript-client/events/remote-events-list\";\nimport { uploadFilesToConversation } from \"#/api/conversation-file-upload.api\";\nimport {\n  GetVSCodeUrlResponse,\n  GetTrajectoryResponse,\n  FileUploadSuccessResponse,\n} from \"../open-hands.types\";\nimport { getAgentServerWorkingDir } from \"../agent-server-config\";\nimport {\n  getAgentServerClientOptions,\n  getAgentServerHttpClientOptions,\n} from \"../agent-server-client-options\";\nimport { AppConversation } from \"./agent-server-conversation-service.types\";\n\nclass ConversationService {\n  private static currentConversation: AppConversation | null = null;\n\n  static setCurrentConversation(\n    currentConversation: AppConversation | null,\n  ): void {\n    this.currentConversation = currentConversation;\n  }\n\n  private static getClientOverrides() {\n    return {\n      sessionApiKey: this.currentConversation?.session_api_key,\n    };\n  }\n\n  static async getVSCodeUrl(\n    conversationId: string,\n  ): Promise<GetVSCodeUrlResponse> {\n    const workspaceDir =\n      this.currentConversation?.id === conversationId\n        ? (this.currentConversation?.workspace?.working_dir ??\n          getAgentServerWorkingDir())\n        : getAgentServerWorkingDir();\n    const vscodeUrl = await new VSCodeClient(\n      getAgentServerClientOptions(this.getClientOverrides()),\n    ).getUrl({\n      baseUrl:\n        typeof window !== \"undefined\" ? window.location.origin : undefined,\n      workspaceDir,\n    });\n\n    return { vscode_url: vscodeUrl };\n  }\n\n  static async getTrajectory(\n    conversationId: string,\n  ): Promise<GetTrajectoryResponse> {\n    const page = await new RemoteEventsList(\n      getAgentServerHttpClientOptions(this.getClientOverrides()),\n      conversationId,\n    ).search({ limit: 10000 });\n\n    return { trajectory: page.items ?? [] };\n  }\n\n  static async uploadFiles(\n    conversationId: string,\n    files: File[],\n  ): Promise<FileUploadSuccessResponse> {\n    return uploadFilesToConversation(\n      conversationId,\n      files,\n      this.currentConversation,\n    );\n  }\n}\n\nexport default ConversationService;\n"],"mappings":";;;;;;AAeA,IAAM,IAAN,MAA0B;CACxB,OAAe,sBAA8C;CAE7D,OAAO,uBACL,GACM;AACN,OAAK,sBAAsB;;CAG7B,OAAe,qBAAqB;AAClC,SAAO,EACL,eAAe,KAAK,qBAAqB,iBAC1C;;CAGH,aAAa,aACX,GAC+B;EAC/B,IAAM,IACJ,KAAK,qBAAqB,OAAO,IAC5B,KAAK,qBAAqB,WAAW,eACtC,GAA0B,GAC1B,GAA0B;AAShC,SAAO,EAAE,YAAY,MARG,IAAI,EAC1B,EAA4B,KAAK,oBAAoB,CAAC,CACvD,CAAC,OAAO;GACP,SACE,OAAO,SAAW,MAAc,OAAO,SAAS,SAAS,KAAA;GAC3D;GACD,CAAC,EAE8B;;CAGlC,aAAa,cACX,GACgC;AAMhC,SAAO,EAAE,aAAY,MALF,IAAI,EACrB,EAAgC,KAAK,oBAAoB,CAAC,EAC1D,EACD,CAAC,OAAO,EAAE,OAAO,KAAO,CAAC,EAEA,SAAS,EAAE,EAAE;;CAGzC,aAAa,YACX,GACA,GACoC;AACpC,SAAO,EACL,GACA,GACA,KAAK,oBACN"}
+{"version":3,"file":"conversation-service.api.js","names":[],"sources":["../../../src/api/conversation-service/conversation-service.api.ts"],"sourcesContent":["import { VSCodeClient } from \"@openhands/typescript-client/clients\";\nimport { RemoteEventsList } from \"@openhands/typescript-client/events/remote-events-list\";\nimport { uploadFilesToConversation } from \"#/api/conversation-file-upload.api\";\nimport {\n  GetVSCodeUrlResponse,\n  GetTrajectoryResponse,\n  FileUploadSuccessResponse,\n} from \"../open-hands.types\";\nimport { getAgentServerWorkingDir } from \"../agent-server-config\";\nimport {\n  getAgentServerClientOptions,\n  getAgentServerHttpClientOptions,\n} from \"../agent-server-client-options\";\nimport { AppConversation } from \"./agent-server-conversation-service.types\";\n\nclass ConversationService {\n  private static currentConversation: AppConversation | null = null;\n\n  static setCurrentConversation(\n    currentConversation: AppConversation | null,\n  ): void {\n    this.currentConversation = currentConversation;\n  }\n\n  static getCurrentConversation(): AppConversation | null {\n    return this.currentConversation;\n  }\n\n  private static getClientOverrides() {\n    return {\n      sessionApiKey: this.currentConversation?.session_api_key,\n    };\n  }\n\n  static async getVSCodeUrl(\n    conversationId: string,\n  ): Promise<GetVSCodeUrlResponse> {\n    const workspaceDir =\n      this.currentConversation?.id === conversationId\n        ? (this.currentConversation?.workspace?.working_dir ??\n          getAgentServerWorkingDir())\n        : getAgentServerWorkingDir();\n    const vscodeUrl = await new VSCodeClient(\n      getAgentServerClientOptions(this.getClientOverrides()),\n    ).getUrl({\n      baseUrl:\n        typeof window !== \"undefined\" ? window.location.origin : undefined,\n      workspaceDir,\n    });\n\n    return { vscode_url: vscodeUrl };\n  }\n\n  static async getTrajectory(\n    conversationId: string,\n  ): Promise<GetTrajectoryResponse> {\n    const page = await new RemoteEventsList(\n      getAgentServerHttpClientOptions(this.getClientOverrides()),\n      conversationId,\n    ).search({ limit: 10000 });\n\n    return { trajectory: page.items ?? [] };\n  }\n\n  static async uploadFiles(\n    conversationId: string,\n    files: File[],\n  ): Promise<FileUploadSuccessResponse> {\n    return uploadFilesToConversation(\n      conversationId,\n      files,\n      this.currentConversation,\n    );\n  }\n}\n\nexport default ConversationService;\n"],"mappings":";;;;;;;AAeA,IAAM,IAAN,MAA0B;CACxB,OAAe,sBAA8C;CAE7D,OAAO,uBACL,GACM;AACN,OAAK,sBAAsB;;CAG7B,OAAO,yBAAiD;AACtD,SAAO,KAAK;;CAGd,OAAe,qBAAqB;AAClC,SAAO,EACL,eAAe,KAAK,qBAAqB,iBAC1C;;CAGH,aAAa,aACX,GAC+B;EAC/B,IAAM,IACJ,KAAK,qBAAqB,OAAO,IAC5B,KAAK,qBAAqB,WAAW,eACtC,GAA0B,GAC1B,GAA0B;AAShC,SAAO,EAAE,YAAY,MARG,IAAI,EAC1B,EAA4B,KAAK,oBAAoB,CAAC,CACvD,CAAC,OAAO;GACP,SACE,OAAO,SAAW,MAAc,OAAO,SAAS,SAAS,KAAA;GAC3D;GACD,CAAC,EAE8B;;CAGlC,aAAa,cACX,GACgC;AAMhC,SAAO,EAAE,aAAY,MALF,IAAI,EACrB,EAAgC,KAAK,oBAAoB,CAAC,EAC1D,EACD,CAAC,OAAO,EAAE,OAAO,KAAO,CAAC,EAEA,SAAS,EAAE,EAAE;;CAGzC,aAAa,YACX,GACA,GACoC;AACpC,SAAO,EACL,GACA,GACA,KAAK,oBACN"}

package/dist/api/device-flow-client.cjs

@@ -1,2 +1,2 @@
-require(`../_virtual/_rolldown/runtime.cjs`);var e=class extends Error{constructor(e,t){super(e),this.code=t,this.name=`DeviceFlowError`}},t=6e5,n=3e4;async function r(e,t,n,r,i,a){let o=r===void 0?void 0:typeof r==`string`||r instanceof Blob||r instanceof FormData||r instanceof URLSearchParams?r:JSON.stringify(r);return await fetch(`${e.replace(/\/+$/,``)}${n}`,{method:t,headers:{...i?{"Content-Type":i}:{}},body:o,signal:a})}async function i(t){let n=t.replace(/\/+$/,``);try{let t=await r(n,`POST`,`/oauth/device/authorize`,{},`application/json`);if(!t.ok)throw new e(`Failed to start device flow: Server returned ${t.status}`);let i=await t.json();if(!i.device_code||!i.user_code||!i.verification_uri)throw new e(`Invalid response from device authorization endpoint: missing required fields`);let a=i.verification_uri_complete??`${i.verification_uri}?user_code=${encodeURIComponent(i.user_code)}`;return{device_code:i.device_code,user_code:i.user_code,verification_uri:i.verification_uri,verification_uri_complete:a,expires_in:i.expires_in??600,interval:i.interval??5}}catch(t){throw t instanceof e?t:new e(`Failed to start device flow: ${t instanceof Error?t.message:String(t)}`)}}async function a(i,a,s){let c=i.replace(/\/+$/,``),l=s.timeout??t,u=Math.max(1,s.interval)*1e3,d=Date.now();for(;Date.now()-d<l;){if(s.signal?.aborted)throw new e(`Authorization cancelled`,`cancelled`);try{let t=await r(c,`POST`,`/oauth/device/token`,new URLSearchParams({grant_type:`urn:ietf:params:oauth:grant-type:device_code`,device_code:a}).toString(),`application/x-www-form-urlencoded`,s.signal);if(t.ok){let n=await t.json();if(!n.access_token)throw new e(`Invalid token response: missing access_token`);return{access_token:n.access_token,token_type:n.token_type??`Bearer`,expires_in:n.expires_in}}let i;try{i=await t.json()}catch{throw new e(`Unexpected response from server: ${t.status}`)}let{error:o,error_description:l}=i;switch(o){case`authorization_pending`:break;case`slow_down`:u=typeof i.interval==`number`&&isFinite(i.interval)&&i.interval>0?Math.max(1,Math.min(i.interval,30))*1e3:Math.min(u+5e3,n);break;case`expired_token`:throw new e(`Device code has expired. Please try again.`,`expired_token`);case`access_denied`:throw new e(`Authorization request was denied.`,`access_denied`);default:throw new e(`Authorization error: ${o}${l?` - ${l}`:``}`,o)}}catch(t){if(t instanceof e)throw t;if(t instanceof DOMException&&t.name===`AbortError`)throw new e(`Authorization cancelled`,`cancelled`);console.warn(`Network error during polling, retrying:`,t)}try{await o(u,s.signal)}catch(t){throw t instanceof DOMException&&t.name===`AbortError`?new e(`Authorization cancelled`,`cancelled`):t}}throw new e(`Timeout waiting for authorization. Please try again.`,`timeout`)}function o(e,t){return new Promise((n,r)=>{if(t?.aborted){r(new DOMException(`Aborted`,`AbortError`));return}let i=setTimeout(n,e);t?.addEventListener(`abort`,()=>{clearTimeout(i),r(new DOMException(`Aborted`,`AbortError`))},{once:!0})})}exports.DeviceFlowError=e,exports.pollForToken=a,exports.startDeviceFlow=i;
+require(`../_virtual/_rolldown/runtime.cjs`);var e=class extends Error{constructor(e,t){super(e),this.code=t,this.name=`DeviceFlowError`}},t=6e5,n=3e4;function r(e){try{let t=e.trim().toLowerCase(),n=/^https?:\/\//i.test(t)?t:`https://${t}`,r=new URL(n).hostname;return r.endsWith(`.all-hands.dev`)||r===`all-hands.dev`||r.endsWith(`.openhands.dev`)||r===`openhands.dev`}catch{return!1}}async function i(e,t,n,r,i,a){let o=r===void 0?void 0:typeof r==`string`||r instanceof Blob||r instanceof FormData||r instanceof URLSearchParams?r:JSON.stringify(r);return await fetch(`${e.replace(/\/+$/,``)}${n}`,{method:t,headers:{...i?{"Content-Type":i}:{}},body:o,signal:a})}async function a(t){let n=t.replace(/\/+$/,``);try{let t=await i(n,`POST`,`/oauth/device/authorize`,{},`application/json`);if(!t.ok)throw new e(`Failed to start device flow: Server returned ${t.status}`);let r=await t.json();if(!r.device_code||!r.user_code||!r.verification_uri)throw new e(`Invalid response from device authorization endpoint: missing required fields`);let a=r.verification_uri_complete??`${r.verification_uri}?user_code=${encodeURIComponent(r.user_code)}`;return{device_code:r.device_code,user_code:r.user_code,verification_uri:r.verification_uri,verification_uri_complete:a,expires_in:r.expires_in??600,interval:r.interval??5}}catch(t){throw t instanceof e?t:new e(`Failed to start device flow: ${t instanceof Error?t.message:String(t)}`)}}async function o(r,a,o){let c=r.replace(/\/+$/,``),l=o.timeout??t,u=Math.max(1,o.interval)*1e3,d=Date.now();for(;Date.now()-d<l;){if(o.signal?.aborted)throw new e(`Authorization cancelled`,`cancelled`);try{let t=await i(c,`POST`,`/oauth/device/token`,new URLSearchParams({grant_type:`urn:ietf:params:oauth:grant-type:device_code`,device_code:a}).toString(),`application/x-www-form-urlencoded`,o.signal);if(t.ok){let n=await t.json();if(!n.access_token)throw new e(`Invalid token response: missing access_token`);return{access_token:n.access_token,token_type:n.token_type??`Bearer`,expires_in:n.expires_in}}let r;try{r=await t.json()}catch{throw new e(`Unexpected response from server: ${t.status}`)}let{error:s,error_description:l}=r;switch(s){case`authorization_pending`:break;case`slow_down`:u=typeof r.interval==`number`&&isFinite(r.interval)&&r.interval>0?Math.max(1,Math.min(r.interval,30))*1e3:Math.min(u+5e3,n);break;case`expired_token`:throw new e(`Device code has expired. Please try again.`,`expired_token`);case`access_denied`:throw new e(`Authorization request was denied.`,`access_denied`);default:throw new e(`Authorization error: ${s}${l?` - ${l}`:``}`,s)}}catch(t){if(t instanceof e)throw t;if(t instanceof DOMException&&t.name===`AbortError`)throw new e(`Authorization cancelled`,`cancelled`);console.warn(`Network error during polling, retrying:`,t)}try{await s(u,o.signal)}catch(t){throw t instanceof DOMException&&t.name===`AbortError`?new e(`Authorization cancelled`,`cancelled`):t}}throw new e(`Timeout waiting for authorization. Please try again.`,`timeout`)}function s(e,t){return new Promise((n,r)=>{if(t?.aborted){r(new DOMException(`Aborted`,`AbortError`));return}let i=setTimeout(n,e);t?.addEventListener(`abort`,()=>{clearTimeout(i),r(new DOMException(`Aborted`,`AbortError`))},{once:!0})})}exports.DeviceFlowError=e,exports.isOpenHandsCloudHost=r,exports.pollForToken=o,exports.startDeviceFlow=a;
 //# sourceMappingURL=device-flow-client.cjs.map

package/dist/api/device-flow-client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow-client.cjs","names":[],"sources":["../../src/api/device-flow-client.ts"],"sourcesContent":["/**\n * OAuth 2.0 Device Flow client implementation (RFC 8628).\n *\n * Used for one-click authentication with cloud backends.\n * The flow allows users to authenticate in their browser while the\n * application polls for the resulting API key.\n *\n * Device flow requests go directly to the configured OpenHands Cloud host.\n */\n\nexport class DeviceFlowError extends Error {\n  constructor(\n    message: string,\n    public readonly code?: string,\n  ) {\n    super(message);\n    this.name = \"DeviceFlowError\";\n  }\n}\n\nexport interface DeviceAuthorizationResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete: string;\n  expires_in: number;\n  interval: number;\n}\n\nexport interface DeviceTokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in?: number;\n}\n\ninterface DeviceTokenErrorResponse {\n  error: string;\n  error_description?: string;\n  interval?: number;\n}\n\nconst DEFAULT_TIMEOUT_MS = 600_000; // 10 minutes\nconst MAX_INTERVAL_MS = 30_000; // 30 seconds max polling interval\n\n/**\n * Check if a host is a known OpenHands Cloud domain.\n * Uses hostname extraction to prevent substring matching attacks.\n */\nexport function isOpenHandsCloudHost(host: string): boolean {\n  try {\n    // Extract hostname from URL or treat as hostname if no protocol\n    const trimmed = host.trim().toLowerCase();\n    const withProtocol = /^https?:\\/\\//i.test(trimmed)\n      ? trimmed\n      : `https://${trimmed}`;\n    const url = new URL(withProtocol);\n    const hostname = url.hostname;\n\n    // Check if hostname ends with known domains (exact suffix match)\n    return (\n      hostname.endsWith(\".all-hands.dev\") ||\n      hostname === \"all-hands.dev\" ||\n      hostname.endsWith(\".openhands.dev\") ||\n      hostname === \"openhands.dev\"\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Make a direct request to the OpenHands Cloud device-flow endpoint.\n */\nasync function makeCloudRequest(\n  upstreamHost: string,\n  method: \"GET\" | \"POST\",\n  path: string,\n  body?: unknown,\n  contentType?: string,\n  signal?: AbortSignal,\n): Promise<Response> {\n  const requestBody =\n    body === undefined\n      ? undefined\n      : typeof body === \"string\" ||\n          body instanceof Blob ||\n          body instanceof FormData ||\n          body instanceof URLSearchParams\n        ? body\n        : JSON.stringify(body);\n\n  const response = await fetch(`${upstreamHost.replace(/\\/+$/, \"\")}${path}`, {\n    method,\n    headers: {\n      ...(contentType ? { \"Content-Type\": contentType } : {}),\n    },\n    body: requestBody,\n    signal,\n  });\n\n  return response;\n}\n\n/**\n * Start the OAuth 2.0 Device Flow by requesting a device code.\n * Requests are sent directly to the cloud host.\n *\n * @param host - The cloud backend host URL (e.g., \"https://app.all-hands.dev\")\n * @returns DeviceAuthorizationResponse with device_code, user_code, verification URLs, etc.\n * @throws DeviceFlowError if the request fails\n */\nexport async function startDeviceFlow(\n  host: string,\n): Promise<DeviceAuthorizationResponse> {\n  const normalizedHost = host.replace(/\\/+$/, \"\");\n\n  try {\n    const response = await makeCloudRequest(\n      normalizedHost,\n      \"POST\",\n      \"/oauth/device/authorize\",\n      {},\n      \"application/json\",\n    );\n\n    if (!response.ok) {\n      // Avoid exposing sensitive server error details\n      throw new DeviceFlowError(\n        `Failed to start device flow: Server returned ${response.status}`,\n      );\n    }\n\n    const data = await response.json();\n\n    // Validate required fields per RFC 8628 Section 3.2\n    // verification_uri_complete is OPTIONAL per RFC\n    if (!data.device_code || !data.user_code || !data.verification_uri) {\n      throw new DeviceFlowError(\n        \"Invalid response from device authorization endpoint: missing required fields\",\n      );\n    }\n\n    // Build verification_uri_complete if not provided (optional per RFC)\n    const verificationUriComplete =\n      data.verification_uri_complete ??\n      `${data.verification_uri}?user_code=${encodeURIComponent(data.user_code)}`;\n\n    return {\n      device_code: data.device_code,\n      user_code: data.user_code,\n      verification_uri: data.verification_uri,\n      verification_uri_complete: verificationUriComplete,\n      expires_in: data.expires_in ?? 600,\n      interval: data.interval ?? 5,\n    };\n  } catch (error) {\n    if (error instanceof DeviceFlowError) {\n      throw error;\n    }\n    throw new DeviceFlowError(\n      `Failed to start device flow: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n\nexport interface PollOptions {\n  /** Polling interval in seconds (from device authorization response) */\n  interval: number;\n  /** Maximum time to wait for authorization in milliseconds */\n  timeout?: number;\n  /** Abort signal to cancel polling */\n  signal?: AbortSignal;\n}\n\n/**\n * Poll for the API key after user authorization.\n * Requests are sent directly to the cloud host.\n *\n * @param host - The cloud backend host URL\n * @param deviceCode - The device code from startDeviceFlow\n * @param options - Polling options including interval, timeout, and abort signal\n * @returns DeviceTokenResponse containing the access_token (API key)\n * @throws DeviceFlowError if polling fails, user denies access, or timeout expires\n */\nexport async function pollForToken(\n  host: string,\n  deviceCode: string,\n  options: PollOptions,\n): Promise<DeviceTokenResponse> {\n  const normalizedHost = host.replace(/\\/+$/, \"\");\n  const timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;\n  let interval = Math.max(1, options.interval) * 1000; // At least 1 second\n  const startTime = Date.now();\n\n  while (Date.now() - startTime < timeout) {\n    // Check if cancelled\n    if (options.signal?.aborted) {\n      throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n    }\n\n    try {\n      // RFC 8628 Section 3.4 requires grant_type parameter\n      const tokenRequestBody = new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: deviceCode,\n      }).toString();\n\n      const response = await makeCloudRequest(\n        normalizedHost,\n        \"POST\",\n        \"/oauth/device/token\",\n        tokenRequestBody,\n        \"application/x-www-form-urlencoded\",\n        options.signal,\n      );\n\n      if (response.ok) {\n        const data = await response.json();\n        if (!data.access_token) {\n          throw new DeviceFlowError(\n            \"Invalid token response: missing access_token\",\n          );\n        }\n        return {\n          access_token: data.access_token,\n          token_type: data.token_type ?? \"Bearer\",\n          expires_in: data.expires_in,\n        };\n      }\n\n      // Handle error responses\n      let errorData: DeviceTokenErrorResponse;\n      try {\n        errorData = await response.json();\n      } catch {\n        throw new DeviceFlowError(\n          `Unexpected response from server: ${response.status}`,\n        );\n      }\n\n      const { error, error_description } = errorData;\n\n      switch (error) {\n        case \"authorization_pending\":\n          // User hasn't finished yet; continue polling\n          break;\n\n        case \"slow_down\":\n          // Server asks us to poll less frequently\n          // RFC 8628 Section 3.5: \"the client MUST increase its polling interval by 5 seconds\"\n          // Validate server-provided interval to prevent DoS (must be number, finite, positive)\n          if (\n            typeof errorData.interval === \"number\" &&\n            isFinite(errorData.interval) &&\n            errorData.interval > 0\n          ) {\n            interval = Math.max(1, Math.min(errorData.interval, 30)) * 1000;\n          } else {\n            // RFC 8628 mandates incrementing by 5 seconds\n            interval = Math.min(interval + 5000, MAX_INTERVAL_MS);\n          }\n          break;\n\n        case \"expired_token\":\n          throw new DeviceFlowError(\n            \"Device code has expired. Please try again.\",\n            \"expired_token\",\n          );\n\n        case \"access_denied\":\n          throw new DeviceFlowError(\n            \"Authorization request was denied.\",\n            \"access_denied\",\n          );\n\n        default:\n          throw new DeviceFlowError(\n            `Authorization error: ${error}${error_description ? ` - ${error_description}` : \"\"}`,\n            error,\n          );\n      }\n    } catch (error) {\n      // DeviceFlowError means a definitive error (denied, expired, etc.) - rethrow\n      if (error instanceof DeviceFlowError) {\n        throw error;\n      }\n      // User cancelled - rethrow\n      if (error instanceof DOMException && error.name === \"AbortError\") {\n        throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n      }\n      // Network errors during polling should continue until timeout, not fail immediately\n      // Brief network hiccups shouldn't abort 10-minute flows\n      console.warn(\"Network error during polling, retrying:\", error);\n    }\n\n    // Wait before next poll (wrap in try-catch for consistent abort handling)\n    try {\n      await sleep(interval, options.signal);\n    } catch (error) {\n      if (error instanceof DOMException && error.name === \"AbortError\") {\n        throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n      }\n      throw error;\n    }\n  }\n\n  throw new DeviceFlowError(\n    \"Timeout waiting for authorization. Please try again.\",\n    \"timeout\",\n  );\n}\n\n/**\n * Sleep for a given duration, respecting an optional abort signal.\n */\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new DOMException(\"Aborted\", \"AbortError\"));\n      return;\n    }\n\n    const timeoutId = setTimeout(resolve, ms);\n\n    signal?.addEventListener(\n      \"abort\",\n      () => {\n        clearTimeout(timeoutId);\n        reject(new DOMException(\"Aborted\", \"AbortError\"));\n      },\n      { once: true },\n    );\n  });\n}\n"],"mappings":"6CAUA,IAAa,EAAb,cAAqC,KAAM,CACzC,YACE,EACA,EACA,CACA,MAAM,EAAQ,CAFE,KAAA,KAAA,EAGhB,KAAK,KAAO,oBAyBV,EAAqB,IACrB,EAAkB,IA+BxB,eAAe,EACb,EACA,EACA,EACA,EACA,EACA,EACmB,CACnB,IAAM,EACJ,IAAS,IAAA,GACL,IAAA,GACA,OAAO,GAAS,UACd,aAAgB,MAChB,aAAgB,UAChB,aAAgB,gBAChB,EACA,KAAK,UAAU,EAAK,CAW5B,OAAO,MATgB,MAAM,GAAG,EAAa,QAAQ,OAAQ,GAAG,GAAG,IAAQ,CACzE,SACA,QAAS,CACP,GAAI,EAAc,CAAE,eAAgB,EAAa,CAAG,EAAE,CACvD,CACD,KAAM,EACN,SACD,CAAC,CAaJ,eAAsB,EACpB,EACsC,CACtC,IAAM,EAAiB,EAAK,QAAQ,OAAQ,GAAG,CAE/C,GAAI,CACF,IAAM,EAAW,MAAM,EACrB,EACA,OACA,0BACA,EAAE,CACF,mBACD,CAED,GAAI,CAAC,EAAS,GAEZ,MAAM,IAAI,EACR,gDAAgD,EAAS,SAC1D,CAGH,IAAM,EAAO,MAAM,EAAS,MAAM,CAIlC,GAAI,CAAC,EAAK,aAAe,CAAC,EAAK,WAAa,CAAC,EAAK,iBAChD,MAAM,IAAI,EACR,+EACD,CAIH,IAAM,EACJ,EAAK,2BACL,GAAG,EAAK,iBAAiB,aAAa,mBAAmB,EAAK,UAAU,GAE1E,MAAO,CACL,YAAa,EAAK,YAClB,UAAW,EAAK,UAChB,iBAAkB,EAAK,iBACvB,0BAA2B,EAC3B,WAAY,EAAK,YAAc,IAC/B,SAAU,EAAK,UAAY,EAC5B,OACM,EAAO,CAId,MAHI,aAAiB,EACb,EAEF,IAAI,EACR,gCAAgC,aAAiB,MAAQ,EAAM,QAAU,OAAO,EAAM,GACvF,EAuBL,eAAsB,EACpB,EACA,EACA,EAC8B,CAC9B,IAAM,EAAiB,EAAK,QAAQ,OAAQ,GAAG,CACzC,EAAU,EAAQ,SAAW,EAC/B,EAAW,KAAK,IAAI,EAAG,EAAQ,SAAS,CAAG,IACzC,EAAY,KAAK,KAAK,CAE5B,KAAO,KAAK,KAAK,CAAG,EAAY,GAAS,CAEvC,GAAI,EAAQ,QAAQ,QAClB,MAAM,IAAI,EAAgB,0BAA2B,YAAY,CAGnE,GAAI,CAOF,IAAM,EAAW,MAAM,EACrB,EACA,OACA,sBARuB,IAAI,gBAAgB,CAC3C,WAAY,+CACZ,YAAa,EACd,CAAC,CAAC,UAMD,CACA,oCACA,EAAQ,OACT,CAED,GAAI,EAAS,GAAI,CACf,IAAM,EAAO,MAAM,EAAS,MAAM,CAClC,GAAI,CAAC,EAAK,aACR,MAAM,IAAI,EACR,+CACD,CAEH,MAAO,CACL,aAAc,EAAK,aACnB,WAAY,EAAK,YAAc,SAC/B,WAAY,EAAK,WAClB,CAIH,IAAI,EACJ,GAAI,CACF,EAAY,MAAM,EAAS,MAAM,MAC3B,CACN,MAAM,IAAI,EACR,oCAAoC,EAAS,SAC9C,CAGH,GAAM,CAAE,QAAO,qBAAsB,EAErC,OAAQ,EAAR,CACE,IAAK,wBAEH,MAEF,IAAK,YAIH,AAQE,EAPA,OAAO,EAAU,UAAa,UAC9B,SAAS,EAAU,SAAS,EAC5B,EAAU,SAAW,EAEV,KAAK,IAAI,EAAG,KAAK,IAAI,EAAU,SAAU,GAAG,CAAC,CAAG,IAGhD,KAAK,IAAI,EAAW,IAAM,EAAgB,CAEvD,MAEF,IAAK,gBACH,MAAM,IAAI,EACR,6CACA,gBACD,CAEH,IAAK,gBACH,MAAM,IAAI,EACR,oCACA,gBACD,CAEH,QACE,MAAM,IAAI,EACR,wBAAwB,IAAQ,EAAoB,MAAM,IAAsB,KAChF,EACD,QAEE,EAAO,CAEd,GAAI,aAAiB,EACnB,MAAM,EAGR,GAAI,aAAiB,cAAgB,EAAM,OAAS,aAClD,MAAM,IAAI,EAAgB,0BAA2B,YAAY,CAInE,QAAQ,KAAK,0CAA2C,EAAM,CAIhE,GAAI,CACF,MAAM,EAAM,EAAU,EAAQ,OAAO,OAC9B,EAAO,CAId,MAHI,aAAiB,cAAgB,EAAM,OAAS,aAC5C,IAAI,EAAgB,0BAA2B,YAAY,CAE7D,GAIV,MAAM,IAAI,EACR,uDACA,UACD,CAMH,SAAS,EAAM,EAAY,EAAqC,CAC9D,OAAO,IAAI,SAAS,EAAS,IAAW,CACtC,GAAI,GAAQ,QAAS,CACnB,EAAO,IAAI,aAAa,UAAW,aAAa,CAAC,CACjD,OAGF,IAAM,EAAY,WAAW,EAAS,EAAG,CAEzC,GAAQ,iBACN,YACM,CACJ,aAAa,EAAU,CACvB,EAAO,IAAI,aAAa,UAAW,aAAa,CAAC,EAEnD,CAAE,KAAM,GAAM,CACf,EACD"}
+{"version":3,"file":"device-flow-client.cjs","names":[],"sources":["../../src/api/device-flow-client.ts"],"sourcesContent":["/**\n * OAuth 2.0 Device Flow client implementation (RFC 8628).\n *\n * Used for one-click authentication with cloud backends.\n * The flow allows users to authenticate in their browser while the\n * application polls for the resulting API key.\n *\n * Device flow requests go directly to the configured OpenHands Cloud host.\n */\n\nexport class DeviceFlowError extends Error {\n  constructor(\n    message: string,\n    public readonly code?: string,\n  ) {\n    super(message);\n    this.name = \"DeviceFlowError\";\n  }\n}\n\nexport interface DeviceAuthorizationResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete: string;\n  expires_in: number;\n  interval: number;\n}\n\nexport interface DeviceTokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in?: number;\n}\n\ninterface DeviceTokenErrorResponse {\n  error: string;\n  error_description?: string;\n  interval?: number;\n}\n\nconst DEFAULT_TIMEOUT_MS = 600_000; // 10 minutes\nconst MAX_INTERVAL_MS = 30_000; // 30 seconds max polling interval\n\n/**\n * Check if a host is a known OpenHands Cloud domain.\n * Uses hostname extraction to prevent substring matching attacks.\n */\nexport function isOpenHandsCloudHost(host: string): boolean {\n  try {\n    // Extract hostname from URL or treat as hostname if no protocol\n    const trimmed = host.trim().toLowerCase();\n    const withProtocol = /^https?:\\/\\//i.test(trimmed)\n      ? trimmed\n      : `https://${trimmed}`;\n    const url = new URL(withProtocol);\n    const hostname = url.hostname;\n\n    // Check if hostname ends with known domains (exact suffix match)\n    return (\n      hostname.endsWith(\".all-hands.dev\") ||\n      hostname === \"all-hands.dev\" ||\n      hostname.endsWith(\".openhands.dev\") ||\n      hostname === \"openhands.dev\"\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Make a direct request to the OpenHands Cloud device-flow endpoint.\n */\nasync function makeCloudRequest(\n  upstreamHost: string,\n  method: \"GET\" | \"POST\",\n  path: string,\n  body?: unknown,\n  contentType?: string,\n  signal?: AbortSignal,\n): Promise<Response> {\n  const requestBody =\n    body === undefined\n      ? undefined\n      : typeof body === \"string\" ||\n          body instanceof Blob ||\n          body instanceof FormData ||\n          body instanceof URLSearchParams\n        ? body\n        : JSON.stringify(body);\n\n  const response = await fetch(`${upstreamHost.replace(/\\/+$/, \"\")}${path}`, {\n    method,\n    headers: {\n      ...(contentType ? { \"Content-Type\": contentType } : {}),\n    },\n    body: requestBody,\n    signal,\n  });\n\n  return response;\n}\n\n/**\n * Start the OAuth 2.0 Device Flow by requesting a device code.\n * Requests are sent directly to the cloud host.\n *\n * @param host - The cloud backend host URL (e.g., \"https://app.all-hands.dev\")\n * @returns DeviceAuthorizationResponse with device_code, user_code, verification URLs, etc.\n * @throws DeviceFlowError if the request fails\n */\nexport async function startDeviceFlow(\n  host: string,\n): Promise<DeviceAuthorizationResponse> {\n  const normalizedHost = host.replace(/\\/+$/, \"\");\n\n  try {\n    const response = await makeCloudRequest(\n      normalizedHost,\n      \"POST\",\n      \"/oauth/device/authorize\",\n      {},\n      \"application/json\",\n    );\n\n    if (!response.ok) {\n      // Avoid exposing sensitive server error details\n      throw new DeviceFlowError(\n        `Failed to start device flow: Server returned ${response.status}`,\n      );\n    }\n\n    const data = await response.json();\n\n    // Validate required fields per RFC 8628 Section 3.2\n    // verification_uri_complete is OPTIONAL per RFC\n    if (!data.device_code || !data.user_code || !data.verification_uri) {\n      throw new DeviceFlowError(\n        \"Invalid response from device authorization endpoint: missing required fields\",\n      );\n    }\n\n    // Build verification_uri_complete if not provided (optional per RFC)\n    const verificationUriComplete =\n      data.verification_uri_complete ??\n      `${data.verification_uri}?user_code=${encodeURIComponent(data.user_code)}`;\n\n    return {\n      device_code: data.device_code,\n      user_code: data.user_code,\n      verification_uri: data.verification_uri,\n      verification_uri_complete: verificationUriComplete,\n      expires_in: data.expires_in ?? 600,\n      interval: data.interval ?? 5,\n    };\n  } catch (error) {\n    if (error instanceof DeviceFlowError) {\n      throw error;\n    }\n    throw new DeviceFlowError(\n      `Failed to start device flow: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n\nexport interface PollOptions {\n  /** Polling interval in seconds (from device authorization response) */\n  interval: number;\n  /** Maximum time to wait for authorization in milliseconds */\n  timeout?: number;\n  /** Abort signal to cancel polling */\n  signal?: AbortSignal;\n}\n\n/**\n * Poll for the API key after user authorization.\n * Requests are sent directly to the cloud host.\n *\n * @param host - The cloud backend host URL\n * @param deviceCode - The device code from startDeviceFlow\n * @param options - Polling options including interval, timeout, and abort signal\n * @returns DeviceTokenResponse containing the access_token (API key)\n * @throws DeviceFlowError if polling fails, user denies access, or timeout expires\n */\nexport async function pollForToken(\n  host: string,\n  deviceCode: string,\n  options: PollOptions,\n): Promise<DeviceTokenResponse> {\n  const normalizedHost = host.replace(/\\/+$/, \"\");\n  const timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;\n  let interval = Math.max(1, options.interval) * 1000; // At least 1 second\n  const startTime = Date.now();\n\n  while (Date.now() - startTime < timeout) {\n    // Check if cancelled\n    if (options.signal?.aborted) {\n      throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n    }\n\n    try {\n      // RFC 8628 Section 3.4 requires grant_type parameter\n      const tokenRequestBody = new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: deviceCode,\n      }).toString();\n\n      const response = await makeCloudRequest(\n        normalizedHost,\n        \"POST\",\n        \"/oauth/device/token\",\n        tokenRequestBody,\n        \"application/x-www-form-urlencoded\",\n        options.signal,\n      );\n\n      if (response.ok) {\n        const data = await response.json();\n        if (!data.access_token) {\n          throw new DeviceFlowError(\n            \"Invalid token response: missing access_token\",\n          );\n        }\n        return {\n          access_token: data.access_token,\n          token_type: data.token_type ?? \"Bearer\",\n          expires_in: data.expires_in,\n        };\n      }\n\n      // Handle error responses\n      let errorData: DeviceTokenErrorResponse;\n      try {\n        errorData = await response.json();\n      } catch {\n        throw new DeviceFlowError(\n          `Unexpected response from server: ${response.status}`,\n        );\n      }\n\n      const { error, error_description } = errorData;\n\n      switch (error) {\n        case \"authorization_pending\":\n          // User hasn't finished yet; continue polling\n          break;\n\n        case \"slow_down\":\n          // Server asks us to poll less frequently\n          // RFC 8628 Section 3.5: \"the client MUST increase its polling interval by 5 seconds\"\n          // Validate server-provided interval to prevent DoS (must be number, finite, positive)\n          if (\n            typeof errorData.interval === \"number\" &&\n            isFinite(errorData.interval) &&\n            errorData.interval > 0\n          ) {\n            interval = Math.max(1, Math.min(errorData.interval, 30)) * 1000;\n          } else {\n            // RFC 8628 mandates incrementing by 5 seconds\n            interval = Math.min(interval + 5000, MAX_INTERVAL_MS);\n          }\n          break;\n\n        case \"expired_token\":\n          throw new DeviceFlowError(\n            \"Device code has expired. Please try again.\",\n            \"expired_token\",\n          );\n\n        case \"access_denied\":\n          throw new DeviceFlowError(\n            \"Authorization request was denied.\",\n            \"access_denied\",\n          );\n\n        default:\n          throw new DeviceFlowError(\n            `Authorization error: ${error}${error_description ? ` - ${error_description}` : \"\"}`,\n            error,\n          );\n      }\n    } catch (error) {\n      // DeviceFlowError means a definitive error (denied, expired, etc.) - rethrow\n      if (error instanceof DeviceFlowError) {\n        throw error;\n      }\n      // User cancelled - rethrow\n      if (error instanceof DOMException && error.name === \"AbortError\") {\n        throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n      }\n      // Network errors during polling should continue until timeout, not fail immediately\n      // Brief network hiccups shouldn't abort 10-minute flows\n      console.warn(\"Network error during polling, retrying:\", error);\n    }\n\n    // Wait before next poll (wrap in try-catch for consistent abort handling)\n    try {\n      await sleep(interval, options.signal);\n    } catch (error) {\n      if (error instanceof DOMException && error.name === \"AbortError\") {\n        throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n      }\n      throw error;\n    }\n  }\n\n  throw new DeviceFlowError(\n    \"Timeout waiting for authorization. Please try again.\",\n    \"timeout\",\n  );\n}\n\n/**\n * Sleep for a given duration, respecting an optional abort signal.\n */\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new DOMException(\"Aborted\", \"AbortError\"));\n      return;\n    }\n\n    const timeoutId = setTimeout(resolve, ms);\n\n    signal?.addEventListener(\n      \"abort\",\n      () => {\n        clearTimeout(timeoutId);\n        reject(new DOMException(\"Aborted\", \"AbortError\"));\n      },\n      { once: true },\n    );\n  });\n}\n"],"mappings":"6CAUA,IAAa,EAAb,cAAqC,KAAM,CACzC,YACE,EACA,EACA,CACA,MAAM,EAAQ,CAFE,KAAA,KAAA,EAGhB,KAAK,KAAO,oBAyBV,EAAqB,IACrB,EAAkB,IAMxB,SAAgB,EAAqB,EAAuB,CAC1D,GAAI,CAEF,IAAM,EAAU,EAAK,MAAM,CAAC,aAAa,CACnC,EAAe,gBAAgB,KAAK,EAAQ,CAC9C,EACA,WAAW,IAET,EAAW,IADD,IAAI,EACH,CAAI,SAGrB,OACE,EAAS,SAAS,iBAAiB,EACnC,IAAa,iBACb,EAAS,SAAS,iBAAiB,EACnC,IAAa,qBAET,CACN,MAAO,IAOX,eAAe,EACb,EACA,EACA,EACA,EACA,EACA,EACmB,CACnB,IAAM,EACJ,IAAS,IAAA,GACL,IAAA,GACA,OAAO,GAAS,UACd,aAAgB,MAChB,aAAgB,UAChB,aAAgB,gBAChB,EACA,KAAK,UAAU,EAAK,CAW5B,OAAO,MATgB,MAAM,GAAG,EAAa,QAAQ,OAAQ,GAAG,GAAG,IAAQ,CACzE,SACA,QAAS,CACP,GAAI,EAAc,CAAE,eAAgB,EAAa,CAAG,EAAE,CACvD,CACD,KAAM,EACN,SACD,CAAC,CAaJ,eAAsB,EACpB,EACsC,CACtC,IAAM,EAAiB,EAAK,QAAQ,OAAQ,GAAG,CAE/C,GAAI,CACF,IAAM,EAAW,MAAM,EACrB,EACA,OACA,0BACA,EAAE,CACF,mBACD,CAED,GAAI,CAAC,EAAS,GAEZ,MAAM,IAAI,EACR,gDAAgD,EAAS,SAC1D,CAGH,IAAM,EAAO,MAAM,EAAS,MAAM,CAIlC,GAAI,CAAC,EAAK,aAAe,CAAC,EAAK,WAAa,CAAC,EAAK,iBAChD,MAAM,IAAI,EACR,+EACD,CAIH,IAAM,EACJ,EAAK,2BACL,GAAG,EAAK,iBAAiB,aAAa,mBAAmB,EAAK,UAAU,GAE1E,MAAO,CACL,YAAa,EAAK,YAClB,UAAW,EAAK,UAChB,iBAAkB,EAAK,iBACvB,0BAA2B,EAC3B,WAAY,EAAK,YAAc,IAC/B,SAAU,EAAK,UAAY,EAC5B,OACM,EAAO,CAId,MAHI,aAAiB,EACb,EAEF,IAAI,EACR,gCAAgC,aAAiB,MAAQ,EAAM,QAAU,OAAO,EAAM,GACvF,EAuBL,eAAsB,EACpB,EACA,EACA,EAC8B,CAC9B,IAAM,EAAiB,EAAK,QAAQ,OAAQ,GAAG,CACzC,EAAU,EAAQ,SAAW,EAC/B,EAAW,KAAK,IAAI,EAAG,EAAQ,SAAS,CAAG,IACzC,EAAY,KAAK,KAAK,CAE5B,KAAO,KAAK,KAAK,CAAG,EAAY,GAAS,CAEvC,GAAI,EAAQ,QAAQ,QAClB,MAAM,IAAI,EAAgB,0BAA2B,YAAY,CAGnE,GAAI,CAOF,IAAM,EAAW,MAAM,EACrB,EACA,OACA,sBARuB,IAAI,gBAAgB,CAC3C,WAAY,+CACZ,YAAa,EACd,CAAC,CAAC,UAMD,CACA,oCACA,EAAQ,OACT,CAED,GAAI,EAAS,GAAI,CACf,IAAM,EAAO,MAAM,EAAS,MAAM,CAClC,GAAI,CAAC,EAAK,aACR,MAAM,IAAI,EACR,+CACD,CAEH,MAAO,CACL,aAAc,EAAK,aACnB,WAAY,EAAK,YAAc,SAC/B,WAAY,EAAK,WAClB,CAIH,IAAI,EACJ,GAAI,CACF,EAAY,MAAM,EAAS,MAAM,MAC3B,CACN,MAAM,IAAI,EACR,oCAAoC,EAAS,SAC9C,CAGH,GAAM,CAAE,QAAO,qBAAsB,EAErC,OAAQ,EAAR,CACE,IAAK,wBAEH,MAEF,IAAK,YAIH,AAQE,EAPA,OAAO,EAAU,UAAa,UAC9B,SAAS,EAAU,SAAS,EAC5B,EAAU,SAAW,EAEV,KAAK,IAAI,EAAG,KAAK,IAAI,EAAU,SAAU,GAAG,CAAC,CAAG,IAGhD,KAAK,IAAI,EAAW,IAAM,EAAgB,CAEvD,MAEF,IAAK,gBACH,MAAM,IAAI,EACR,6CACA,gBACD,CAEH,IAAK,gBACH,MAAM,IAAI,EACR,oCACA,gBACD,CAEH,QACE,MAAM,IAAI,EACR,wBAAwB,IAAQ,EAAoB,MAAM,IAAsB,KAChF,EACD,QAEE,EAAO,CAEd,GAAI,aAAiB,EACnB,MAAM,EAGR,GAAI,aAAiB,cAAgB,EAAM,OAAS,aAClD,MAAM,IAAI,EAAgB,0BAA2B,YAAY,CAInE,QAAQ,KAAK,0CAA2C,EAAM,CAIhE,GAAI,CACF,MAAM,EAAM,EAAU,EAAQ,OAAO,OAC9B,EAAO,CAId,MAHI,aAAiB,cAAgB,EAAM,OAAS,aAC5C,IAAI,EAAgB,0BAA2B,YAAY,CAE7D,GAIV,MAAM,IAAI,EACR,uDACA,UACD,CAMH,SAAS,EAAM,EAAY,EAAqC,CAC9D,OAAO,IAAI,SAAS,EAAS,IAAW,CACtC,GAAI,GAAQ,QAAS,CACnB,EAAO,IAAI,aAAa,UAAW,aAAa,CAAC,CACjD,OAGF,IAAM,EAAY,WAAW,EAAS,EAAG,CAEzC,GAAQ,iBACN,YACM,CACJ,aAAa,EAAU,CACvB,EAAO,IAAI,aAAa,UAAW,aAAa,CAAC,EAEnD,CAAE,KAAM,GAAM,CACf,EACD"}

package/dist/api/device-flow-client.js

@@ -4,7 +4,15 @@ var e = class extends Error {
 		super(e), this.code = t, this.name = "DeviceFlowError";
 	}
 }, t = 6e5, n = 3e4;
-async function r(e, t, n, r, i, a) {
+function r(e) {
+	try {
+		let t = e.trim().toLowerCase(), n = /^https?:\/\//i.test(t) ? t : `https://${t}`, r = new URL(n).hostname;
+		return r.endsWith(".all-hands.dev") || r === "all-hands.dev" || r.endsWith(".openhands.dev") || r === "openhands.dev";
+	} catch {
+		return !1;
+	}
+}
+async function i(e, t, n, r, i, a) {
 	let o = r === void 0 ? void 0 : typeof r == "string" || r instanceof Blob || r instanceof FormData || r instanceof URLSearchParams ? r : JSON.stringify(r);
 	return await fetch(`${e.replace(/\/+$/, "")}${n}`, {
 		method: t,
@@ -13,35 +21,35 @@ async function r(e, t, n, r, i, a) {
 		signal: a
 	});
 }
-async function i(t) {
+async function a(t) {
 	let n = t.replace(/\/+$/, "");
 	try {
-		let t = await r(n, "POST", "/oauth/device/authorize", {}, "application/json");
+		let t = await i(n, "POST", "/oauth/device/authorize", {}, "application/json");
 		if (!t.ok) throw new e(`Failed to start device flow: Server returned ${t.status}`);
-		let i = await t.json();
-		if (!i.device_code || !i.user_code || !i.verification_uri) throw new e("Invalid response from device authorization endpoint: missing required fields");
-		let a = i.verification_uri_complete ?? `${i.verification_uri}?user_code=${encodeURIComponent(i.user_code)}`;
+		let r = await t.json();
+		if (!r.device_code || !r.user_code || !r.verification_uri) throw new e("Invalid response from device authorization endpoint: missing required fields");
+		let a = r.verification_uri_complete ?? `${r.verification_uri}?user_code=${encodeURIComponent(r.user_code)}`;
 		return {
-			device_code: i.device_code,
-			user_code: i.user_code,
-			verification_uri: i.verification_uri,
+			device_code: r.device_code,
+			user_code: r.user_code,
+			verification_uri: r.verification_uri,
 			verification_uri_complete: a,
-			expires_in: i.expires_in ?? 600,
-			interval: i.interval ?? 5
+			expires_in: r.expires_in ?? 600,
+			interval: r.interval ?? 5
 		};
 	} catch (t) {
 		throw t instanceof e ? t : new e(`Failed to start device flow: ${t instanceof Error ? t.message : String(t)}`);
 	}
 }
-async function a(i, a, s) {
-	let c = i.replace(/\/+$/, ""), l = s.timeout ?? t, u = Math.max(1, s.interval) * 1e3, d = Date.now();
+async function o(r, a, o) {
+	let c = r.replace(/\/+$/, ""), l = o.timeout ?? t, u = Math.max(1, o.interval) * 1e3, d = Date.now();
 	for (; Date.now() - d < l;) {
-		if (s.signal?.aborted) throw new e("Authorization cancelled", "cancelled");
+		if (o.signal?.aborted) throw new e("Authorization cancelled", "cancelled");
 		try {
-			let t = await r(c, "POST", "/oauth/device/token", new URLSearchParams({
+			let t = await i(c, "POST", "/oauth/device/token", new URLSearchParams({
 				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
 				device_code: a
-			}).toString(), "application/x-www-form-urlencoded", s.signal);
+			}).toString(), "application/x-www-form-urlencoded", o.signal);
 			if (t.ok) {
 				let n = await t.json();
 				if (!n.access_token) throw new e("Invalid token response: missing access_token");
@@ -51,21 +59,21 @@ async function a(i, a, s) {
 					expires_in: n.expires_in
 				};
 			}
-			let i;
+			let r;
 			try {
-				i = await t.json();
+				r = await t.json();
 			} catch {
 				throw new e(`Unexpected response from server: ${t.status}`);
 			}
-			let { error: o, error_description: l } = i;
-			switch (o) {
+			let { error: s, error_description: l } = r;
+			switch (s) {
 				case "authorization_pending": break;
 				case "slow_down":
-					u = typeof i.interval == "number" && isFinite(i.interval) && i.interval > 0 ? Math.max(1, Math.min(i.interval, 30)) * 1e3 : Math.min(u + 5e3, n);
+					u = typeof r.interval == "number" && isFinite(r.interval) && r.interval > 0 ? Math.max(1, Math.min(r.interval, 30)) * 1e3 : Math.min(u + 5e3, n);
 					break;
 				case "expired_token": throw new e("Device code has expired. Please try again.", "expired_token");
 				case "access_denied": throw new e("Authorization request was denied.", "access_denied");
-				default: throw new e(`Authorization error: ${o}${l ? ` - ${l}` : ""}`, o);
+				default: throw new e(`Authorization error: ${s}${l ? ` - ${l}` : ""}`, s);
 			}
 		} catch (t) {
 			if (t instanceof e) throw t;
@@ -73,14 +81,14 @@ async function a(i, a, s) {
 			console.warn("Network error during polling, retrying:", t);
 		}
 		try {
-			await o(u, s.signal);
+			await s(u, o.signal);
 		} catch (t) {
 			throw t instanceof DOMException && t.name === "AbortError" ? new e("Authorization cancelled", "cancelled") : t;
 		}
 	}
 	throw new e("Timeout waiting for authorization. Please try again.", "timeout");
 }
-function o(e, t) {
+function s(e, t) {
 	return new Promise((n, r) => {
 		if (t?.aborted) {
 			r(new DOMException("Aborted", "AbortError"));
@@ -93,6 +101,6 @@ function o(e, t) {
 	});
 }
 //#endregion
-export { e as DeviceFlowError, a as pollForToken, i as startDeviceFlow };
+export { e as DeviceFlowError, r as isOpenHandsCloudHost, o as pollForToken, a as startDeviceFlow };
 
 //# sourceMappingURL=device-flow-client.js.map

package/dist/api/device-flow-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-flow-client.js","names":[],"sources":["../../src/api/device-flow-client.ts"],"sourcesContent":["/**\n * OAuth 2.0 Device Flow client implementation (RFC 8628).\n *\n * Used for one-click authentication with cloud backends.\n * The flow allows users to authenticate in their browser while the\n * application polls for the resulting API key.\n *\n * Device flow requests go directly to the configured OpenHands Cloud host.\n */\n\nexport class DeviceFlowError extends Error {\n  constructor(\n    message: string,\n    public readonly code?: string,\n  ) {\n    super(message);\n    this.name = \"DeviceFlowError\";\n  }\n}\n\nexport interface DeviceAuthorizationResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete: string;\n  expires_in: number;\n  interval: number;\n}\n\nexport interface DeviceTokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in?: number;\n}\n\ninterface DeviceTokenErrorResponse {\n  error: string;\n  error_description?: string;\n  interval?: number;\n}\n\nconst DEFAULT_TIMEOUT_MS = 600_000; // 10 minutes\nconst MAX_INTERVAL_MS = 30_000; // 30 seconds max polling interval\n\n/**\n * Check if a host is a known OpenHands Cloud domain.\n * Uses hostname extraction to prevent substring matching attacks.\n */\nexport function isOpenHandsCloudHost(host: string): boolean {\n  try {\n    // Extract hostname from URL or treat as hostname if no protocol\n    const trimmed = host.trim().toLowerCase();\n    const withProtocol = /^https?:\\/\\//i.test(trimmed)\n      ? trimmed\n      : `https://${trimmed}`;\n    const url = new URL(withProtocol);\n    const hostname = url.hostname;\n\n    // Check if hostname ends with known domains (exact suffix match)\n    return (\n      hostname.endsWith(\".all-hands.dev\") ||\n      hostname === \"all-hands.dev\" ||\n      hostname.endsWith(\".openhands.dev\") ||\n      hostname === \"openhands.dev\"\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Make a direct request to the OpenHands Cloud device-flow endpoint.\n */\nasync function makeCloudRequest(\n  upstreamHost: string,\n  method: \"GET\" | \"POST\",\n  path: string,\n  body?: unknown,\n  contentType?: string,\n  signal?: AbortSignal,\n): Promise<Response> {\n  const requestBody =\n    body === undefined\n      ? undefined\n      : typeof body === \"string\" ||\n          body instanceof Blob ||\n          body instanceof FormData ||\n          body instanceof URLSearchParams\n        ? body\n        : JSON.stringify(body);\n\n  const response = await fetch(`${upstreamHost.replace(/\\/+$/, \"\")}${path}`, {\n    method,\n    headers: {\n      ...(contentType ? { \"Content-Type\": contentType } : {}),\n    },\n    body: requestBody,\n    signal,\n  });\n\n  return response;\n}\n\n/**\n * Start the OAuth 2.0 Device Flow by requesting a device code.\n * Requests are sent directly to the cloud host.\n *\n * @param host - The cloud backend host URL (e.g., \"https://app.all-hands.dev\")\n * @returns DeviceAuthorizationResponse with device_code, user_code, verification URLs, etc.\n * @throws DeviceFlowError if the request fails\n */\nexport async function startDeviceFlow(\n  host: string,\n): Promise<DeviceAuthorizationResponse> {\n  const normalizedHost = host.replace(/\\/+$/, \"\");\n\n  try {\n    const response = await makeCloudRequest(\n      normalizedHost,\n      \"POST\",\n      \"/oauth/device/authorize\",\n      {},\n      \"application/json\",\n    );\n\n    if (!response.ok) {\n      // Avoid exposing sensitive server error details\n      throw new DeviceFlowError(\n        `Failed to start device flow: Server returned ${response.status}`,\n      );\n    }\n\n    const data = await response.json();\n\n    // Validate required fields per RFC 8628 Section 3.2\n    // verification_uri_complete is OPTIONAL per RFC\n    if (!data.device_code || !data.user_code || !data.verification_uri) {\n      throw new DeviceFlowError(\n        \"Invalid response from device authorization endpoint: missing required fields\",\n      );\n    }\n\n    // Build verification_uri_complete if not provided (optional per RFC)\n    const verificationUriComplete =\n      data.verification_uri_complete ??\n      `${data.verification_uri}?user_code=${encodeURIComponent(data.user_code)}`;\n\n    return {\n      device_code: data.device_code,\n      user_code: data.user_code,\n      verification_uri: data.verification_uri,\n      verification_uri_complete: verificationUriComplete,\n      expires_in: data.expires_in ?? 600,\n      interval: data.interval ?? 5,\n    };\n  } catch (error) {\n    if (error instanceof DeviceFlowError) {\n      throw error;\n    }\n    throw new DeviceFlowError(\n      `Failed to start device flow: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n\nexport interface PollOptions {\n  /** Polling interval in seconds (from device authorization response) */\n  interval: number;\n  /** Maximum time to wait for authorization in milliseconds */\n  timeout?: number;\n  /** Abort signal to cancel polling */\n  signal?: AbortSignal;\n}\n\n/**\n * Poll for the API key after user authorization.\n * Requests are sent directly to the cloud host.\n *\n * @param host - The cloud backend host URL\n * @param deviceCode - The device code from startDeviceFlow\n * @param options - Polling options including interval, timeout, and abort signal\n * @returns DeviceTokenResponse containing the access_token (API key)\n * @throws DeviceFlowError if polling fails, user denies access, or timeout expires\n */\nexport async function pollForToken(\n  host: string,\n  deviceCode: string,\n  options: PollOptions,\n): Promise<DeviceTokenResponse> {\n  const normalizedHost = host.replace(/\\/+$/, \"\");\n  const timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;\n  let interval = Math.max(1, options.interval) * 1000; // At least 1 second\n  const startTime = Date.now();\n\n  while (Date.now() - startTime < timeout) {\n    // Check if cancelled\n    if (options.signal?.aborted) {\n      throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n    }\n\n    try {\n      // RFC 8628 Section 3.4 requires grant_type parameter\n      const tokenRequestBody = new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: deviceCode,\n      }).toString();\n\n      const response = await makeCloudRequest(\n        normalizedHost,\n        \"POST\",\n        \"/oauth/device/token\",\n        tokenRequestBody,\n        \"application/x-www-form-urlencoded\",\n        options.signal,\n      );\n\n      if (response.ok) {\n        const data = await response.json();\n        if (!data.access_token) {\n          throw new DeviceFlowError(\n            \"Invalid token response: missing access_token\",\n          );\n        }\n        return {\n          access_token: data.access_token,\n          token_type: data.token_type ?? \"Bearer\",\n          expires_in: data.expires_in,\n        };\n      }\n\n      // Handle error responses\n      let errorData: DeviceTokenErrorResponse;\n      try {\n        errorData = await response.json();\n      } catch {\n        throw new DeviceFlowError(\n          `Unexpected response from server: ${response.status}`,\n        );\n      }\n\n      const { error, error_description } = errorData;\n\n      switch (error) {\n        case \"authorization_pending\":\n          // User hasn't finished yet; continue polling\n          break;\n\n        case \"slow_down\":\n          // Server asks us to poll less frequently\n          // RFC 8628 Section 3.5: \"the client MUST increase its polling interval by 5 seconds\"\n          // Validate server-provided interval to prevent DoS (must be number, finite, positive)\n          if (\n            typeof errorData.interval === \"number\" &&\n            isFinite(errorData.interval) &&\n            errorData.interval > 0\n          ) {\n            interval = Math.max(1, Math.min(errorData.interval, 30)) * 1000;\n          } else {\n            // RFC 8628 mandates incrementing by 5 seconds\n            interval = Math.min(interval + 5000, MAX_INTERVAL_MS);\n          }\n          break;\n\n        case \"expired_token\":\n          throw new DeviceFlowError(\n            \"Device code has expired. Please try again.\",\n            \"expired_token\",\n          );\n\n        case \"access_denied\":\n          throw new DeviceFlowError(\n            \"Authorization request was denied.\",\n            \"access_denied\",\n          );\n\n        default:\n          throw new DeviceFlowError(\n            `Authorization error: ${error}${error_description ? ` - ${error_description}` : \"\"}`,\n            error,\n          );\n      }\n    } catch (error) {\n      // DeviceFlowError means a definitive error (denied, expired, etc.) - rethrow\n      if (error instanceof DeviceFlowError) {\n        throw error;\n      }\n      // User cancelled - rethrow\n      if (error instanceof DOMException && error.name === \"AbortError\") {\n        throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n      }\n      // Network errors during polling should continue until timeout, not fail immediately\n      // Brief network hiccups shouldn't abort 10-minute flows\n      console.warn(\"Network error during polling, retrying:\", error);\n    }\n\n    // Wait before next poll (wrap in try-catch for consistent abort handling)\n    try {\n      await sleep(interval, options.signal);\n    } catch (error) {\n      if (error instanceof DOMException && error.name === \"AbortError\") {\n        throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n      }\n      throw error;\n    }\n  }\n\n  throw new DeviceFlowError(\n    \"Timeout waiting for authorization. Please try again.\",\n    \"timeout\",\n  );\n}\n\n/**\n * Sleep for a given duration, respecting an optional abort signal.\n */\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new DOMException(\"Aborted\", \"AbortError\"));\n      return;\n    }\n\n    const timeoutId = setTimeout(resolve, ms);\n\n    signal?.addEventListener(\n      \"abort\",\n      () => {\n        clearTimeout(timeoutId);\n        reject(new DOMException(\"Aborted\", \"AbortError\"));\n      },\n      { once: true },\n    );\n  });\n}\n"],"mappings":";AAUA,IAAa,IAAb,cAAqC,MAAM;CACzC,YACE,GACA,GACA;AAEA,EADA,MAAM,EAAQ,EAFE,KAAA,OAAA,GAGhB,KAAK,OAAO;;GAyBV,IAAqB,KACrB,IAAkB;AA+BxB,eAAe,EACb,GACA,GACA,GACA,GACA,GACA,GACmB;CACnB,IAAM,IACJ,MAAS,KAAA,IACL,KAAA,IACA,OAAO,KAAS,YACd,aAAgB,QAChB,aAAgB,YAChB,aAAgB,kBAChB,IACA,KAAK,UAAU,EAAK;AAW5B,QAAO,MATgB,MAAM,GAAG,EAAa,QAAQ,QAAQ,GAAG,GAAG,KAAQ;EACzE;EACA,SAAS,EACP,GAAI,IAAc,EAAE,gBAAgB,GAAa,GAAG,EAAE,EACvD;EACD,MAAM;EACN;EACD,CAAC;;AAaJ,eAAsB,EACpB,GACsC;CACtC,IAAM,IAAiB,EAAK,QAAQ,QAAQ,GAAG;AAE/C,KAAI;EACF,IAAM,IAAW,MAAM,EACrB,GACA,QACA,2BACA,EAAE,EACF,mBACD;AAED,MAAI,CAAC,EAAS,GAEZ,OAAM,IAAI,EACR,gDAAgD,EAAS,SAC1D;EAGH,IAAM,IAAO,MAAM,EAAS,MAAM;AAIlC,MAAI,CAAC,EAAK,eAAe,CAAC,EAAK,aAAa,CAAC,EAAK,iBAChD,OAAM,IAAI,EACR,+EACD;EAIH,IAAM,IACJ,EAAK,6BACL,GAAG,EAAK,iBAAiB,aAAa,mBAAmB,EAAK,UAAU;AAE1E,SAAO;GACL,aAAa,EAAK;GAClB,WAAW,EAAK;GAChB,kBAAkB,EAAK;GACvB,2BAA2B;GAC3B,YAAY,EAAK,cAAc;GAC/B,UAAU,EAAK,YAAY;GAC5B;UACM,GAAO;AAId,QAHI,aAAiB,IACb,IAEF,IAAI,EACR,gCAAgC,aAAiB,QAAQ,EAAM,UAAU,OAAO,EAAM,GACvF;;;AAuBL,eAAsB,EACpB,GACA,GACA,GAC8B;CAC9B,IAAM,IAAiB,EAAK,QAAQ,QAAQ,GAAG,EACzC,IAAU,EAAQ,WAAW,GAC/B,IAAW,KAAK,IAAI,GAAG,EAAQ,SAAS,GAAG,KACzC,IAAY,KAAK,KAAK;AAE5B,QAAO,KAAK,KAAK,GAAG,IAAY,IAAS;AAEvC,MAAI,EAAQ,QAAQ,QAClB,OAAM,IAAI,EAAgB,2BAA2B,YAAY;AAGnE,MAAI;GAOF,IAAM,IAAW,MAAM,EACrB,GACA,QACA,uBARuB,IAAI,gBAAgB;IAC3C,YAAY;IACZ,aAAa;IACd,CAAC,CAAC,UAMD,EACA,qCACA,EAAQ,OACT;AAED,OAAI,EAAS,IAAI;IACf,IAAM,IAAO,MAAM,EAAS,MAAM;AAClC,QAAI,CAAC,EAAK,aACR,OAAM,IAAI,EACR,+CACD;AAEH,WAAO;KACL,cAAc,EAAK;KACnB,YAAY,EAAK,cAAc;KAC/B,YAAY,EAAK;KAClB;;GAIH,IAAI;AACJ,OAAI;AACF,QAAY,MAAM,EAAS,MAAM;WAC3B;AACN,UAAM,IAAI,EACR,oCAAoC,EAAS,SAC9C;;GAGH,IAAM,EAAE,UAAO,yBAAsB;AAErC,WAAQ,GAAR;IACE,KAAK,wBAEH;IAEF,KAAK;AAIH,KAQE,IAPA,OAAO,EAAU,YAAa,YAC9B,SAAS,EAAU,SAAS,IAC5B,EAAU,WAAW,IAEV,KAAK,IAAI,GAAG,KAAK,IAAI,EAAU,UAAU,GAAG,CAAC,GAAG,MAGhD,KAAK,IAAI,IAAW,KAAM,EAAgB;AAEvD;IAEF,KAAK,gBACH,OAAM,IAAI,EACR,8CACA,gBACD;IAEH,KAAK,gBACH,OAAM,IAAI,EACR,qCACA,gBACD;IAEH,QACE,OAAM,IAAI,EACR,wBAAwB,IAAQ,IAAoB,MAAM,MAAsB,MAChF,EACD;;WAEE,GAAO;AAEd,OAAI,aAAiB,EACnB,OAAM;AAGR,OAAI,aAAiB,gBAAgB,EAAM,SAAS,aAClD,OAAM,IAAI,EAAgB,2BAA2B,YAAY;AAInE,WAAQ,KAAK,2CAA2C,EAAM;;AAIhE,MAAI;AACF,SAAM,EAAM,GAAU,EAAQ,OAAO;WAC9B,GAAO;AAId,SAHI,aAAiB,gBAAgB,EAAM,SAAS,eAC5C,IAAI,EAAgB,2BAA2B,YAAY,GAE7D;;;AAIV,OAAM,IAAI,EACR,wDACA,UACD;;AAMH,SAAS,EAAM,GAAY,GAAqC;AAC9D,QAAO,IAAI,SAAS,GAAS,MAAW;AACtC,MAAI,GAAQ,SAAS;AACnB,KAAO,IAAI,aAAa,WAAW,aAAa,CAAC;AACjD;;EAGF,IAAM,IAAY,WAAW,GAAS,EAAG;AAEzC,KAAQ,iBACN,eACM;AAEJ,GADA,aAAa,EAAU,EACvB,EAAO,IAAI,aAAa,WAAW,aAAa,CAAC;KAEnD,EAAE,MAAM,IAAM,CACf;GACD"}
+{"version":3,"file":"device-flow-client.js","names":[],"sources":["../../src/api/device-flow-client.ts"],"sourcesContent":["/**\n * OAuth 2.0 Device Flow client implementation (RFC 8628).\n *\n * Used for one-click authentication with cloud backends.\n * The flow allows users to authenticate in their browser while the\n * application polls for the resulting API key.\n *\n * Device flow requests go directly to the configured OpenHands Cloud host.\n */\n\nexport class DeviceFlowError extends Error {\n  constructor(\n    message: string,\n    public readonly code?: string,\n  ) {\n    super(message);\n    this.name = \"DeviceFlowError\";\n  }\n}\n\nexport interface DeviceAuthorizationResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete: string;\n  expires_in: number;\n  interval: number;\n}\n\nexport interface DeviceTokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in?: number;\n}\n\ninterface DeviceTokenErrorResponse {\n  error: string;\n  error_description?: string;\n  interval?: number;\n}\n\nconst DEFAULT_TIMEOUT_MS = 600_000; // 10 minutes\nconst MAX_INTERVAL_MS = 30_000; // 30 seconds max polling interval\n\n/**\n * Check if a host is a known OpenHands Cloud domain.\n * Uses hostname extraction to prevent substring matching attacks.\n */\nexport function isOpenHandsCloudHost(host: string): boolean {\n  try {\n    // Extract hostname from URL or treat as hostname if no protocol\n    const trimmed = host.trim().toLowerCase();\n    const withProtocol = /^https?:\\/\\//i.test(trimmed)\n      ? trimmed\n      : `https://${trimmed}`;\n    const url = new URL(withProtocol);\n    const hostname = url.hostname;\n\n    // Check if hostname ends with known domains (exact suffix match)\n    return (\n      hostname.endsWith(\".all-hands.dev\") ||\n      hostname === \"all-hands.dev\" ||\n      hostname.endsWith(\".openhands.dev\") ||\n      hostname === \"openhands.dev\"\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Make a direct request to the OpenHands Cloud device-flow endpoint.\n */\nasync function makeCloudRequest(\n  upstreamHost: string,\n  method: \"GET\" | \"POST\",\n  path: string,\n  body?: unknown,\n  contentType?: string,\n  signal?: AbortSignal,\n): Promise<Response> {\n  const requestBody =\n    body === undefined\n      ? undefined\n      : typeof body === \"string\" ||\n          body instanceof Blob ||\n          body instanceof FormData ||\n          body instanceof URLSearchParams\n        ? body\n        : JSON.stringify(body);\n\n  const response = await fetch(`${upstreamHost.replace(/\\/+$/, \"\")}${path}`, {\n    method,\n    headers: {\n      ...(contentType ? { \"Content-Type\": contentType } : {}),\n    },\n    body: requestBody,\n    signal,\n  });\n\n  return response;\n}\n\n/**\n * Start the OAuth 2.0 Device Flow by requesting a device code.\n * Requests are sent directly to the cloud host.\n *\n * @param host - The cloud backend host URL (e.g., \"https://app.all-hands.dev\")\n * @returns DeviceAuthorizationResponse with device_code, user_code, verification URLs, etc.\n * @throws DeviceFlowError if the request fails\n */\nexport async function startDeviceFlow(\n  host: string,\n): Promise<DeviceAuthorizationResponse> {\n  const normalizedHost = host.replace(/\\/+$/, \"\");\n\n  try {\n    const response = await makeCloudRequest(\n      normalizedHost,\n      \"POST\",\n      \"/oauth/device/authorize\",\n      {},\n      \"application/json\",\n    );\n\n    if (!response.ok) {\n      // Avoid exposing sensitive server error details\n      throw new DeviceFlowError(\n        `Failed to start device flow: Server returned ${response.status}`,\n      );\n    }\n\n    const data = await response.json();\n\n    // Validate required fields per RFC 8628 Section 3.2\n    // verification_uri_complete is OPTIONAL per RFC\n    if (!data.device_code || !data.user_code || !data.verification_uri) {\n      throw new DeviceFlowError(\n        \"Invalid response from device authorization endpoint: missing required fields\",\n      );\n    }\n\n    // Build verification_uri_complete if not provided (optional per RFC)\n    const verificationUriComplete =\n      data.verification_uri_complete ??\n      `${data.verification_uri}?user_code=${encodeURIComponent(data.user_code)}`;\n\n    return {\n      device_code: data.device_code,\n      user_code: data.user_code,\n      verification_uri: data.verification_uri,\n      verification_uri_complete: verificationUriComplete,\n      expires_in: data.expires_in ?? 600,\n      interval: data.interval ?? 5,\n    };\n  } catch (error) {\n    if (error instanceof DeviceFlowError) {\n      throw error;\n    }\n    throw new DeviceFlowError(\n      `Failed to start device flow: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n\nexport interface PollOptions {\n  /** Polling interval in seconds (from device authorization response) */\n  interval: number;\n  /** Maximum time to wait for authorization in milliseconds */\n  timeout?: number;\n  /** Abort signal to cancel polling */\n  signal?: AbortSignal;\n}\n\n/**\n * Poll for the API key after user authorization.\n * Requests are sent directly to the cloud host.\n *\n * @param host - The cloud backend host URL\n * @param deviceCode - The device code from startDeviceFlow\n * @param options - Polling options including interval, timeout, and abort signal\n * @returns DeviceTokenResponse containing the access_token (API key)\n * @throws DeviceFlowError if polling fails, user denies access, or timeout expires\n */\nexport async function pollForToken(\n  host: string,\n  deviceCode: string,\n  options: PollOptions,\n): Promise<DeviceTokenResponse> {\n  const normalizedHost = host.replace(/\\/+$/, \"\");\n  const timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;\n  let interval = Math.max(1, options.interval) * 1000; // At least 1 second\n  const startTime = Date.now();\n\n  while (Date.now() - startTime < timeout) {\n    // Check if cancelled\n    if (options.signal?.aborted) {\n      throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n    }\n\n    try {\n      // RFC 8628 Section 3.4 requires grant_type parameter\n      const tokenRequestBody = new URLSearchParams({\n        grant_type: \"urn:ietf:params:oauth:grant-type:device_code\",\n        device_code: deviceCode,\n      }).toString();\n\n      const response = await makeCloudRequest(\n        normalizedHost,\n        \"POST\",\n        \"/oauth/device/token\",\n        tokenRequestBody,\n        \"application/x-www-form-urlencoded\",\n        options.signal,\n      );\n\n      if (response.ok) {\n        const data = await response.json();\n        if (!data.access_token) {\n          throw new DeviceFlowError(\n            \"Invalid token response: missing access_token\",\n          );\n        }\n        return {\n          access_token: data.access_token,\n          token_type: data.token_type ?? \"Bearer\",\n          expires_in: data.expires_in,\n        };\n      }\n\n      // Handle error responses\n      let errorData: DeviceTokenErrorResponse;\n      try {\n        errorData = await response.json();\n      } catch {\n        throw new DeviceFlowError(\n          `Unexpected response from server: ${response.status}`,\n        );\n      }\n\n      const { error, error_description } = errorData;\n\n      switch (error) {\n        case \"authorization_pending\":\n          // User hasn't finished yet; continue polling\n          break;\n\n        case \"slow_down\":\n          // Server asks us to poll less frequently\n          // RFC 8628 Section 3.5: \"the client MUST increase its polling interval by 5 seconds\"\n          // Validate server-provided interval to prevent DoS (must be number, finite, positive)\n          if (\n            typeof errorData.interval === \"number\" &&\n            isFinite(errorData.interval) &&\n            errorData.interval > 0\n          ) {\n            interval = Math.max(1, Math.min(errorData.interval, 30)) * 1000;\n          } else {\n            // RFC 8628 mandates incrementing by 5 seconds\n            interval = Math.min(interval + 5000, MAX_INTERVAL_MS);\n          }\n          break;\n\n        case \"expired_token\":\n          throw new DeviceFlowError(\n            \"Device code has expired. Please try again.\",\n            \"expired_token\",\n          );\n\n        case \"access_denied\":\n          throw new DeviceFlowError(\n            \"Authorization request was denied.\",\n            \"access_denied\",\n          );\n\n        default:\n          throw new DeviceFlowError(\n            `Authorization error: ${error}${error_description ? ` - ${error_description}` : \"\"}`,\n            error,\n          );\n      }\n    } catch (error) {\n      // DeviceFlowError means a definitive error (denied, expired, etc.) - rethrow\n      if (error instanceof DeviceFlowError) {\n        throw error;\n      }\n      // User cancelled - rethrow\n      if (error instanceof DOMException && error.name === \"AbortError\") {\n        throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n      }\n      // Network errors during polling should continue until timeout, not fail immediately\n      // Brief network hiccups shouldn't abort 10-minute flows\n      console.warn(\"Network error during polling, retrying:\", error);\n    }\n\n    // Wait before next poll (wrap in try-catch for consistent abort handling)\n    try {\n      await sleep(interval, options.signal);\n    } catch (error) {\n      if (error instanceof DOMException && error.name === \"AbortError\") {\n        throw new DeviceFlowError(\"Authorization cancelled\", \"cancelled\");\n      }\n      throw error;\n    }\n  }\n\n  throw new DeviceFlowError(\n    \"Timeout waiting for authorization. Please try again.\",\n    \"timeout\",\n  );\n}\n\n/**\n * Sleep for a given duration, respecting an optional abort signal.\n */\nfunction sleep(ms: number, signal?: AbortSignal): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal?.aborted) {\n      reject(new DOMException(\"Aborted\", \"AbortError\"));\n      return;\n    }\n\n    const timeoutId = setTimeout(resolve, ms);\n\n    signal?.addEventListener(\n      \"abort\",\n      () => {\n        clearTimeout(timeoutId);\n        reject(new DOMException(\"Aborted\", \"AbortError\"));\n      },\n      { once: true },\n    );\n  });\n}\n"],"mappings":";AAUA,IAAa,IAAb,cAAqC,MAAM;CACzC,YACE,GACA,GACA;AAEA,EADA,MAAM,EAAQ,EAFE,KAAA,OAAA,GAGhB,KAAK,OAAO;;GAyBV,IAAqB,KACrB,IAAkB;AAMxB,SAAgB,EAAqB,GAAuB;AAC1D,KAAI;EAEF,IAAM,IAAU,EAAK,MAAM,CAAC,aAAa,EACnC,IAAe,gBAAgB,KAAK,EAAQ,GAC9C,IACA,WAAW,KAET,IAAW,IADD,IAAI,EACH,CAAI;AAGrB,SACE,EAAS,SAAS,iBAAiB,IACnC,MAAa,mBACb,EAAS,SAAS,iBAAiB,IACnC,MAAa;SAET;AACN,SAAO;;;AAOX,eAAe,EACb,GACA,GACA,GACA,GACA,GACA,GACmB;CACnB,IAAM,IACJ,MAAS,KAAA,IACL,KAAA,IACA,OAAO,KAAS,YACd,aAAgB,QAChB,aAAgB,YAChB,aAAgB,kBAChB,IACA,KAAK,UAAU,EAAK;AAW5B,QAAO,MATgB,MAAM,GAAG,EAAa,QAAQ,QAAQ,GAAG,GAAG,KAAQ;EACzE;EACA,SAAS,EACP,GAAI,IAAc,EAAE,gBAAgB,GAAa,GAAG,EAAE,EACvD;EACD,MAAM;EACN;EACD,CAAC;;AAaJ,eAAsB,EACpB,GACsC;CACtC,IAAM,IAAiB,EAAK,QAAQ,QAAQ,GAAG;AAE/C,KAAI;EACF,IAAM,IAAW,MAAM,EACrB,GACA,QACA,2BACA,EAAE,EACF,mBACD;AAED,MAAI,CAAC,EAAS,GAEZ,OAAM,IAAI,EACR,gDAAgD,EAAS,SAC1D;EAGH,IAAM,IAAO,MAAM,EAAS,MAAM;AAIlC,MAAI,CAAC,EAAK,eAAe,CAAC,EAAK,aAAa,CAAC,EAAK,iBAChD,OAAM,IAAI,EACR,+EACD;EAIH,IAAM,IACJ,EAAK,6BACL,GAAG,EAAK,iBAAiB,aAAa,mBAAmB,EAAK,UAAU;AAE1E,SAAO;GACL,aAAa,EAAK;GAClB,WAAW,EAAK;GAChB,kBAAkB,EAAK;GACvB,2BAA2B;GAC3B,YAAY,EAAK,cAAc;GAC/B,UAAU,EAAK,YAAY;GAC5B;UACM,GAAO;AAId,QAHI,aAAiB,IACb,IAEF,IAAI,EACR,gCAAgC,aAAiB,QAAQ,EAAM,UAAU,OAAO,EAAM,GACvF;;;AAuBL,eAAsB,EACpB,GACA,GACA,GAC8B;CAC9B,IAAM,IAAiB,EAAK,QAAQ,QAAQ,GAAG,EACzC,IAAU,EAAQ,WAAW,GAC/B,IAAW,KAAK,IAAI,GAAG,EAAQ,SAAS,GAAG,KACzC,IAAY,KAAK,KAAK;AAE5B,QAAO,KAAK,KAAK,GAAG,IAAY,IAAS;AAEvC,MAAI,EAAQ,QAAQ,QAClB,OAAM,IAAI,EAAgB,2BAA2B,YAAY;AAGnE,MAAI;GAOF,IAAM,IAAW,MAAM,EACrB,GACA,QACA,uBARuB,IAAI,gBAAgB;IAC3C,YAAY;IACZ,aAAa;IACd,CAAC,CAAC,UAMD,EACA,qCACA,EAAQ,OACT;AAED,OAAI,EAAS,IAAI;IACf,IAAM,IAAO,MAAM,EAAS,MAAM;AAClC,QAAI,CAAC,EAAK,aACR,OAAM,IAAI,EACR,+CACD;AAEH,WAAO;KACL,cAAc,EAAK;KACnB,YAAY,EAAK,cAAc;KAC/B,YAAY,EAAK;KAClB;;GAIH,IAAI;AACJ,OAAI;AACF,QAAY,MAAM,EAAS,MAAM;WAC3B;AACN,UAAM,IAAI,EACR,oCAAoC,EAAS,SAC9C;;GAGH,IAAM,EAAE,UAAO,yBAAsB;AAErC,WAAQ,GAAR;IACE,KAAK,wBAEH;IAEF,KAAK;AAIH,KAQE,IAPA,OAAO,EAAU,YAAa,YAC9B,SAAS,EAAU,SAAS,IAC5B,EAAU,WAAW,IAEV,KAAK,IAAI,GAAG,KAAK,IAAI,EAAU,UAAU,GAAG,CAAC,GAAG,MAGhD,KAAK,IAAI,IAAW,KAAM,EAAgB;AAEvD;IAEF,KAAK,gBACH,OAAM,IAAI,EACR,8CACA,gBACD;IAEH,KAAK,gBACH,OAAM,IAAI,EACR,qCACA,gBACD;IAEH,QACE,OAAM,IAAI,EACR,wBAAwB,IAAQ,IAAoB,MAAM,MAAsB,MAChF,EACD;;WAEE,GAAO;AAEd,OAAI,aAAiB,EACnB,OAAM;AAGR,OAAI,aAAiB,gBAAgB,EAAM,SAAS,aAClD,OAAM,IAAI,EAAgB,2BAA2B,YAAY;AAInE,WAAQ,KAAK,2CAA2C,EAAM;;AAIhE,MAAI;AACF,SAAM,EAAM,GAAU,EAAQ,OAAO;WAC9B,GAAO;AAId,SAHI,aAAiB,gBAAgB,EAAM,SAAS,eAC5C,IAAI,EAAgB,2BAA2B,YAAY,GAE7D;;;AAIV,OAAM,IAAI,EACR,wDACA,UACD;;AAMH,SAAS,EAAM,GAAY,GAAqC;AAC9D,QAAO,IAAI,SAAS,GAAS,MAAW;AACtC,MAAI,GAAQ,SAAS;AACnB,KAAO,IAAI,aAAa,WAAW,aAAa,CAAC;AACjD;;EAGF,IAAM,IAAY,WAAW,GAAS,EAAG;AAEzC,KAAQ,iBACN,eACM;AAEJ,GADA,aAAa,EAAU,EACvB,EAAO,IAAI,aAAa,WAAW,aAAa,CAAC;KAEnD,EAAE,MAAM,IAAM,CACf;GACD"}

package/dist/api/event-service/event-service.api.cjs

@@ -1,2 +1,2 @@
-require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../../node_modules/@openhands/typescript-client/dist/client/conversation-client.cjs`),t=require(`../../utils/websocket-url.cjs`),n=require(`../backend-registry/active-store.cjs`),r=require(`../agent-server-client-options.cjs`),i=require(`../../node_modules/@openhands/typescript-client/dist/events/remote-events-list.cjs`),a=require(`../cloud/proxy.cjs`);var o=class{static async respondToConfirmation(i,o,s,c){let l=n.getActiveBackend().backend;return l.kind===`cloud`?a.callCloudProxy({backend:l,method:`POST`,hostOverride:t.buildHttpBaseUrl(o),path:`/api/conversations/${i}/events/respond_to_confirmation`,body:s,authMode:`session-api-key`,sessionApiKey:c}):new e.ConversationClient(r.getAgentServerClientOptions({conversationUrl:o,sessionApiKey:c})).respondToConfirmation(i,s)}static async getEventCount(i,o,s){let c=n.getActiveBackend().backend;return c.kind===`cloud`?a.callCloudProxy({backend:c,method:`GET`,hostOverride:t.buildHttpBaseUrl(o),path:`/api/conversations/${i}/events/count`,authMode:`session-api-key`,sessionApiKey:s}):new e.ConversationClient(r.getAgentServerClientOptions({conversationUrl:o,sessionApiKey:s})).getEventCount(i)}static async searchEvents(e,t,o,s={}){let c=n.getActiveBackend().backend,l=s.limit??100;if(c.kind===`cloud`){let t=Math.min(l,100),n=!!(s.sortOrder||s.pageId||s.timestampGte||s.timestampLt),r=new URLSearchParams;r.set(`limit`,String(t)),s.sortOrder&&r.set(`sort_order`,s.sortOrder),s.pageId&&r.set(`page_id`,s.pageId),s.timestampGte&&r.set(`timestamp__gte`,s.timestampGte),s.timestampLt&&r.set(`timestamp__lt`,s.timestampLt);let i=t=>a.callCloudProxy({backend:c,method:`GET`,path:`/api/v1/conversation/${e}/events/search?${t.toString()}`});try{let e=await i(r);return{items:e?.items??[],next_page_id:e?.next_page_id??null}}catch(e){if(!n)throw e;return console.warn(`[EventService] Cloud backend doesn't support pagination filters. Falling back to initial load only. Server needs OpenHands/OpenHands#14399.`),{items:[],next_page_id:null}}}let u=await new i.RemoteEventsList(r.getAgentServerHttpClientOptions({conversationUrl:t,sessionApiKey:o}),e).search({limit:l,...s.pageId?{page_id:s.pageId}:{},...s.sortOrder?{sort_order:s.sortOrder}:{},...s.timestampGte?{timestamp__gte:s.timestampGte}:{},...s.timestampLt?{timestamp__lt:s.timestampLt}:{}});return{items:u?.items??[],next_page_id:u?.next_page_id??null}}};exports.default=o;
+require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../../node_modules/@openhands/typescript-client/dist/client/conversation-client.cjs`);require(`../../node_modules/@openhands/typescript-client/dist/clients.cjs`);const t=require(`../../utils/websocket-url.cjs`),n=require(`../backend-registry/active-store.cjs`),r=require(`../agent-server-client-options.cjs`),i=require(`../../node_modules/@openhands/typescript-client/dist/events/remote-events-list.cjs`),a=require(`../cloud/proxy.cjs`);var o=class{static async respondToConfirmation(i,o,s,c){let l=n.getActiveBackend().backend;return l.kind===`cloud`?a.callCloudProxy({backend:l,method:`POST`,hostOverride:t.buildHttpBaseUrl(o),path:`/api/conversations/${i}/events/respond_to_confirmation`,body:s,authMode:`session-api-key`,sessionApiKey:c}):new e.ConversationClient(r.getAgentServerClientOptions({conversationUrl:o,sessionApiKey:c})).respondToConfirmation(i,s)}static async getEventCount(i,o,s){let c=n.getActiveBackend().backend;return c.kind===`cloud`?a.callCloudProxy({backend:c,method:`GET`,hostOverride:t.buildHttpBaseUrl(o),path:`/api/conversations/${i}/events/count`,authMode:`session-api-key`,sessionApiKey:s}):new e.ConversationClient(r.getAgentServerClientOptions({conversationUrl:o,sessionApiKey:s})).getEventCount(i)}static async searchEvents(e,t,o,s={}){let c=n.getActiveBackend().backend,l=s.limit??100;if(c.kind===`cloud`){let t=Math.min(l,100),n=!!(s.sortOrder||s.pageId||s.timestampGte||s.timestampLt),r=new URLSearchParams;r.set(`limit`,String(t)),s.sortOrder&&r.set(`sort_order`,s.sortOrder),s.pageId&&r.set(`page_id`,s.pageId),s.timestampGte&&r.set(`timestamp__gte`,s.timestampGte),s.timestampLt&&r.set(`timestamp__lt`,s.timestampLt);let i=t=>a.callCloudProxy({backend:c,method:`GET`,path:`/api/v1/conversation/${e}/events/search?${t.toString()}`});try{let e=await i(r);return{items:e?.items??[],next_page_id:e?.next_page_id??null}}catch(e){if(!n)throw e;return console.warn(`[EventService] Cloud backend doesn't support pagination filters. Falling back to initial load only. Server needs OpenHands/OpenHands#14399.`),{items:[],next_page_id:null}}}let u=await new i.RemoteEventsList(r.getAgentServerHttpClientOptions({conversationUrl:t,sessionApiKey:o}),e).search({limit:l,...s.pageId?{page_id:s.pageId}:{},...s.sortOrder?{sort_order:s.sortOrder}:{},...s.timestampGte?{timestamp__gte:s.timestampGte}:{},...s.timestampLt?{timestamp__lt:s.timestampLt}:{}});return{items:u?.items??[],next_page_id:u?.next_page_id??null}}};exports.default=o;
 //# sourceMappingURL=event-service.api.cjs.map

package/dist/api/event-service/event-service.api.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"event-service.api.cjs","names":[],"sources":["../../../src/api/event-service/event-service.api.ts"],"sourcesContent":["import { ConversationClient } from \"@openhands/typescript-client/clients\";\nimport { RemoteEventsList } from \"@openhands/typescript-client/events/remote-events-list\";\nimport { OpenHandsEvent } from \"#/types/agent-server/core\";\nimport { buildHttpBaseUrl } from \"#/utils/websocket-url\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport { callCloudProxy } from \"../cloud/proxy\";\nimport {\n  getAgentServerClientOptions,\n  getAgentServerHttpClientOptions,\n} from \"../agent-server-client-options\";\nimport type {\n  ConfirmationResponseRequest,\n  ConfirmationResponseResponse,\n  EventSearchOptions,\n  EventSearchPage,\n} from \"./event-service.types\";\n\n/**\n * Cloud-mode REST calls are split between two upstream hosts (matching\n * OpenHands' cloud frontend):\n *\n *   - **App API** (`backend.host`, default in `callCloudProxy`):\n *     event *history* (`/api/v1/conversation/{id}/events/search`).\n *     Persisted by the cloud backend — survives the runtime sandbox.\n *\n *   - **Runtime sandbox** (extracted from `conversation.conversation_url`\n *     and passed as `hostOverride`): live runtime endpoints like\n *     `/api/conversations/{id}/events/count` and\n *     `/api/conversations/{id}/events/respond_to_confirmation`. Auth on\n *     these endpoints is `X-Session-API-Key`, not `Authorization: Bearer`.\n *\n * App API calls go directly to the cloud backend with bearer auth. Runtime\n * sandbox calls go through `/api/cloud-proxy`, which avoids depending on CORS\n * for per-conversation runtime hosts.\n *\n * Local mode keeps the existing typescript-client path: it targets the\n * conversation's host directly via typed client classes.\n */\nclass EventService {\n  static async respondToConfirmation(\n    conversationId: string,\n    conversationUrl: string,\n    request: ConfirmationResponseRequest,\n    sessionApiKey?: string | null,\n  ): Promise<ConfirmationResponseResponse> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\") {\n      return callCloudProxy<ConfirmationResponseResponse>({\n        backend: active,\n        method: \"POST\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: `/api/conversations/${conversationId}/events/respond_to_confirmation`,\n        body: request,\n        authMode: \"session-api-key\",\n        sessionApiKey,\n      });\n    }\n\n    return new ConversationClient(\n      getAgentServerClientOptions({\n        conversationUrl,\n        sessionApiKey,\n      }),\n    ).respondToConfirmation<ConfirmationResponseResponse>(\n      conversationId,\n      request,\n    );\n  }\n\n  static async getEventCount(\n    conversationId: string,\n    conversationUrl: string,\n    sessionApiKey?: string | null,\n  ): Promise<number> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\") {\n      return callCloudProxy<number>({\n        backend: active,\n        method: \"GET\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: `/api/conversations/${conversationId}/events/count`,\n        authMode: \"session-api-key\",\n        sessionApiKey,\n      });\n    }\n\n    return new ConversationClient(\n      getAgentServerClientOptions({\n        conversationUrl,\n        sessionApiKey,\n      }),\n    ).getEventCount(conversationId);\n  }\n\n  /**\n   * Search events for a conversation. Returns the raw page so callers can\n   * paginate (via `next_page_id`) and so REST-driven history loading can\n   * tell when there are no more older events to load.\n   */\n  static async searchEvents(\n    conversationId: string,\n    conversationUrl?: string | null,\n    sessionApiKey?: string | null,\n    options: EventSearchOptions = {},\n  ): Promise<EventSearchPage<OpenHandsEvent>> {\n    const active = getActiveBackend().backend;\n    const limit = options.limit ?? 100;\n\n    if (active.kind === \"cloud\") {\n      // Event *history* lives on the cloud App API, not the runtime\n      // sandbox. Path is singular `conversation` and v1-prefixed.\n      //\n      // Full pagination params (sort_order, page_id, timestamp filters)\n      // require the server-side fix from OpenHands/OpenHands#14399. If\n      // the cloud backend hasn't been updated yet, the timestamp filters\n      // trigger a 500 (str-vs-datetime comparison). We attempt the full\n      // request first and fall back to a limit-only request on failure.\n      const cloudLimit = Math.min(limit, 100);\n      const hasFilterParams = !!(\n        options.sortOrder ||\n        options.pageId ||\n        options.timestampGte ||\n        options.timestampLt\n      );\n\n      const params = new URLSearchParams();\n      params.set(\"limit\", String(cloudLimit));\n      if (options.sortOrder) params.set(\"sort_order\", options.sortOrder);\n      if (options.pageId) params.set(\"page_id\", options.pageId);\n      if (options.timestampGte)\n        params.set(\"timestamp__gte\", options.timestampGte);\n      if (options.timestampLt) params.set(\"timestamp__lt\", options.timestampLt);\n\n      const doCloudSearch = (searchParams: URLSearchParams) =>\n        callCloudProxy<EventSearchPage<OpenHandsEvent>>({\n          backend: active,\n          method: \"GET\",\n          path: `/api/v1/conversation/${conversationId}/events/search?${searchParams.toString()}`,\n        });\n\n      try {\n        const data = await doCloudSearch(params);\n        return {\n          items: data?.items ?? [],\n          next_page_id: data?.next_page_id ?? null,\n        };\n      } catch (err) {\n        if (!hasFilterParams) throw err;\n\n        // Server doesn't support timestamp filters yet — stop pagination\n        // by returning an empty page so the UI doesn't retry indefinitely.\n        // A limit-only fallback would return the same most-recent events\n        // already in the store, which get deduped but keep hasMore=true.\n        console.warn(\n          \"[EventService] Cloud backend doesn't support pagination filters. \" +\n            \"Falling back to initial load only. \" +\n            \"Server needs OpenHands/OpenHands#14399.\",\n        );\n        return { items: [], next_page_id: null };\n      }\n    }\n\n    const page = await new RemoteEventsList(\n      getAgentServerHttpClientOptions({ conversationUrl, sessionApiKey }),\n      conversationId,\n    ).search({\n      limit,\n      ...(options.pageId ? { page_id: options.pageId } : {}),\n      ...(options.sortOrder ? { sort_order: options.sortOrder } : {}),\n      ...(options.timestampGte ? { timestamp__gte: options.timestampGte } : {}),\n      ...(options.timestampLt ? { timestamp__lt: options.timestampLt } : {}),\n    });\n\n    return {\n      items: (page?.items ?? []) as OpenHandsEvent[],\n      next_page_id: page?.next_page_id ?? null,\n    };\n  }\n}\n\nexport default EventService;\n"],"mappings":"oaAsCA,IAAM,EAAN,KAAmB,CACjB,aAAa,sBACX,EACA,EACA,EACA,EACuC,CACvC,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAclC,OAZI,EAAO,OAAS,QACX,EAAA,eAA6C,CAClD,QAAS,EACT,OAAQ,OACR,aAAc,EAAA,iBAAiB,EAAgB,CAC/C,KAAM,sBAAsB,EAAe,iCAC3C,KAAM,EACN,SAAU,kBACV,gBACD,CAAC,CAGG,IAAI,EAAA,mBACT,EAAA,4BAA4B,CAC1B,kBACA,gBACD,CAAC,CACH,CAAC,sBACA,EACA,EACD,CAGH,aAAa,cACX,EACA,EACA,EACiB,CACjB,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAalC,OAXI,EAAO,OAAS,QACX,EAAA,eAAuB,CAC5B,QAAS,EACT,OAAQ,MACR,aAAc,EAAA,iBAAiB,EAAgB,CAC/C,KAAM,sBAAsB,EAAe,eAC3C,SAAU,kBACV,gBACD,CAAC,CAGG,IAAI,EAAA,mBACT,EAAA,4BAA4B,CAC1B,kBACA,gBACD,CAAC,CACH,CAAC,cAAc,EAAe,CAQjC,aAAa,aACX,EACA,EACA,EACA,EAA8B,EAAE,CACU,CAC1C,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAC5B,EAAQ,EAAQ,OAAS,IAE/B,GAAI,EAAO,OAAS,QAAS,CAS3B,IAAM,EAAa,KAAK,IAAI,EAAO,IAAI,CACjC,EAAkB,CAAC,EACvB,EAAQ,WACR,EAAQ,QACR,EAAQ,cACR,EAAQ,aAGJ,EAAS,IAAI,gBACnB,EAAO,IAAI,QAAS,OAAO,EAAW,CAAC,CACnC,EAAQ,WAAW,EAAO,IAAI,aAAc,EAAQ,UAAU,CAC9D,EAAQ,QAAQ,EAAO,IAAI,UAAW,EAAQ,OAAO,CACrD,EAAQ,cACV,EAAO,IAAI,iBAAkB,EAAQ,aAAa,CAChD,EAAQ,aAAa,EAAO,IAAI,gBAAiB,EAAQ,YAAY,CAEzE,IAAM,EAAiB,GACrB,EAAA,eAAgD,CAC9C,QAAS,EACT,OAAQ,MACR,KAAM,wBAAwB,EAAe,iBAAiB,EAAa,UAAU,GACtF,CAAC,CAEJ,GAAI,CACF,IAAM,EAAO,MAAM,EAAc,EAAO,CACxC,MAAO,CACL,MAAO,GAAM,OAAS,EAAE,CACxB,aAAc,GAAM,cAAgB,KACrC,OACM,EAAK,CACZ,GAAI,CAAC,EAAiB,MAAM,EAW5B,OALA,QAAQ,KACN,8IAGD,CACM,CAAE,MAAO,EAAE,CAAE,aAAc,KAAM,EAI5C,IAAM,EAAO,MAAM,IAAI,EAAA,iBACrB,EAAA,gCAAgC,CAAE,kBAAiB,gBAAe,CAAC,CACnE,EACD,CAAC,OAAO,CACP,QACA,GAAI,EAAQ,OAAS,CAAE,QAAS,EAAQ,OAAQ,CAAG,EAAE,CACrD,GAAI,EAAQ,UAAY,CAAE,WAAY,EAAQ,UAAW,CAAG,EAAE,CAC9D,GAAI,EAAQ,aAAe,CAAE,eAAgB,EAAQ,aAAc,CAAG,EAAE,CACxE,GAAI,EAAQ,YAAc,CAAE,cAAe,EAAQ,YAAa,CAAG,EAAE,CACtE,CAAC,CAEF,MAAO,CACL,MAAQ,GAAM,OAAS,EAAE,CACzB,aAAc,GAAM,cAAgB,KACrC"}
+{"version":3,"file":"event-service.api.cjs","names":[],"sources":["../../../src/api/event-service/event-service.api.ts"],"sourcesContent":["import { ConversationClient } from \"@openhands/typescript-client/clients\";\nimport { RemoteEventsList } from \"@openhands/typescript-client/events/remote-events-list\";\nimport { OpenHandsEvent } from \"#/types/agent-server/core\";\nimport { buildHttpBaseUrl } from \"#/utils/websocket-url\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport { callCloudProxy } from \"../cloud/proxy\";\nimport {\n  getAgentServerClientOptions,\n  getAgentServerHttpClientOptions,\n} from \"../agent-server-client-options\";\nimport type {\n  ConfirmationResponseRequest,\n  ConfirmationResponseResponse,\n  EventSearchOptions,\n  EventSearchPage,\n} from \"./event-service.types\";\n\n/**\n * Cloud-mode REST calls are split between two upstream hosts (matching\n * OpenHands' cloud frontend):\n *\n *   - **App API** (`backend.host`, default in `callCloudProxy`):\n *     event *history* (`/api/v1/conversation/{id}/events/search`).\n *     Persisted by the cloud backend — survives the runtime sandbox.\n *\n *   - **Runtime sandbox** (extracted from `conversation.conversation_url`\n *     and passed as `hostOverride`): live runtime endpoints like\n *     `/api/conversations/{id}/events/count` and\n *     `/api/conversations/{id}/events/respond_to_confirmation`. Auth on\n *     these endpoints is `X-Session-API-Key`, not `Authorization: Bearer`.\n *\n * App API calls go directly to the cloud backend with bearer auth. Runtime\n * sandbox calls go through `/api/cloud-proxy`, which avoids depending on CORS\n * for per-conversation runtime hosts.\n *\n * Local mode keeps the existing typescript-client path: it targets the\n * conversation's host directly via typed client classes.\n */\nclass EventService {\n  static async respondToConfirmation(\n    conversationId: string,\n    conversationUrl: string,\n    request: ConfirmationResponseRequest,\n    sessionApiKey?: string | null,\n  ): Promise<ConfirmationResponseResponse> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\") {\n      return callCloudProxy<ConfirmationResponseResponse>({\n        backend: active,\n        method: \"POST\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: `/api/conversations/${conversationId}/events/respond_to_confirmation`,\n        body: request,\n        authMode: \"session-api-key\",\n        sessionApiKey,\n      });\n    }\n\n    return new ConversationClient(\n      getAgentServerClientOptions({\n        conversationUrl,\n        sessionApiKey,\n      }),\n    ).respondToConfirmation<ConfirmationResponseResponse>(\n      conversationId,\n      request,\n    );\n  }\n\n  static async getEventCount(\n    conversationId: string,\n    conversationUrl: string,\n    sessionApiKey?: string | null,\n  ): Promise<number> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\") {\n      return callCloudProxy<number>({\n        backend: active,\n        method: \"GET\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: `/api/conversations/${conversationId}/events/count`,\n        authMode: \"session-api-key\",\n        sessionApiKey,\n      });\n    }\n\n    return new ConversationClient(\n      getAgentServerClientOptions({\n        conversationUrl,\n        sessionApiKey,\n      }),\n    ).getEventCount(conversationId);\n  }\n\n  /**\n   * Search events for a conversation. Returns the raw page so callers can\n   * paginate (via `next_page_id`) and so REST-driven history loading can\n   * tell when there are no more older events to load.\n   */\n  static async searchEvents(\n    conversationId: string,\n    conversationUrl?: string | null,\n    sessionApiKey?: string | null,\n    options: EventSearchOptions = {},\n  ): Promise<EventSearchPage<OpenHandsEvent>> {\n    const active = getActiveBackend().backend;\n    const limit = options.limit ?? 100;\n\n    if (active.kind === \"cloud\") {\n      // Event *history* lives on the cloud App API, not the runtime\n      // sandbox. Path is singular `conversation` and v1-prefixed.\n      //\n      // Full pagination params (sort_order, page_id, timestamp filters)\n      // require the server-side fix from OpenHands/OpenHands#14399. If\n      // the cloud backend hasn't been updated yet, the timestamp filters\n      // trigger a 500 (str-vs-datetime comparison). We attempt the full\n      // request first and fall back to a limit-only request on failure.\n      const cloudLimit = Math.min(limit, 100);\n      const hasFilterParams = !!(\n        options.sortOrder ||\n        options.pageId ||\n        options.timestampGte ||\n        options.timestampLt\n      );\n\n      const params = new URLSearchParams();\n      params.set(\"limit\", String(cloudLimit));\n      if (options.sortOrder) params.set(\"sort_order\", options.sortOrder);\n      if (options.pageId) params.set(\"page_id\", options.pageId);\n      if (options.timestampGte)\n        params.set(\"timestamp__gte\", options.timestampGte);\n      if (options.timestampLt) params.set(\"timestamp__lt\", options.timestampLt);\n\n      const doCloudSearch = (searchParams: URLSearchParams) =>\n        callCloudProxy<EventSearchPage<OpenHandsEvent>>({\n          backend: active,\n          method: \"GET\",\n          path: `/api/v1/conversation/${conversationId}/events/search?${searchParams.toString()}`,\n        });\n\n      try {\n        const data = await doCloudSearch(params);\n        return {\n          items: data?.items ?? [],\n          next_page_id: data?.next_page_id ?? null,\n        };\n      } catch (err) {\n        if (!hasFilterParams) throw err;\n\n        // Server doesn't support timestamp filters yet — stop pagination\n        // by returning an empty page so the UI doesn't retry indefinitely.\n        // A limit-only fallback would return the same most-recent events\n        // already in the store, which get deduped but keep hasMore=true.\n        console.warn(\n          \"[EventService] Cloud backend doesn't support pagination filters. \" +\n            \"Falling back to initial load only. \" +\n            \"Server needs OpenHands/OpenHands#14399.\",\n        );\n        return { items: [], next_page_id: null };\n      }\n    }\n\n    const page = await new RemoteEventsList(\n      getAgentServerHttpClientOptions({ conversationUrl, sessionApiKey }),\n      conversationId,\n    ).search({\n      limit,\n      ...(options.pageId ? { page_id: options.pageId } : {}),\n      ...(options.sortOrder ? { sort_order: options.sortOrder } : {}),\n      ...(options.timestampGte ? { timestamp__gte: options.timestampGte } : {}),\n      ...(options.timestampLt ? { timestamp__lt: options.timestampLt } : {}),\n    });\n\n    return {\n      items: (page?.items ?? []) as OpenHandsEvent[],\n      next_page_id: page?.next_page_id ?? null,\n    };\n  }\n}\n\nexport default EventService;\n"],"mappings":"sfAsCA,IAAM,EAAN,KAAmB,CACjB,aAAa,sBACX,EACA,EACA,EACA,EACuC,CACvC,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAclC,OAZI,EAAO,OAAS,QACX,EAAA,eAA6C,CAClD,QAAS,EACT,OAAQ,OACR,aAAc,EAAA,iBAAiB,EAAgB,CAC/C,KAAM,sBAAsB,EAAe,iCAC3C,KAAM,EACN,SAAU,kBACV,gBACD,CAAC,CAGG,IAAI,EAAA,mBACT,EAAA,4BAA4B,CAC1B,kBACA,gBACD,CAAC,CACH,CAAC,sBACA,EACA,EACD,CAGH,aAAa,cACX,EACA,EACA,EACiB,CACjB,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAalC,OAXI,EAAO,OAAS,QACX,EAAA,eAAuB,CAC5B,QAAS,EACT,OAAQ,MACR,aAAc,EAAA,iBAAiB,EAAgB,CAC/C,KAAM,sBAAsB,EAAe,eAC3C,SAAU,kBACV,gBACD,CAAC,CAGG,IAAI,EAAA,mBACT,EAAA,4BAA4B,CAC1B,kBACA,gBACD,CAAC,CACH,CAAC,cAAc,EAAe,CAQjC,aAAa,aACX,EACA,EACA,EACA,EAA8B,EAAE,CACU,CAC1C,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAC5B,EAAQ,EAAQ,OAAS,IAE/B,GAAI,EAAO,OAAS,QAAS,CAS3B,IAAM,EAAa,KAAK,IAAI,EAAO,IAAI,CACjC,EAAkB,CAAC,EACvB,EAAQ,WACR,EAAQ,QACR,EAAQ,cACR,EAAQ,aAGJ,EAAS,IAAI,gBACnB,EAAO,IAAI,QAAS,OAAO,EAAW,CAAC,CACnC,EAAQ,WAAW,EAAO,IAAI,aAAc,EAAQ,UAAU,CAC9D,EAAQ,QAAQ,EAAO,IAAI,UAAW,EAAQ,OAAO,CACrD,EAAQ,cACV,EAAO,IAAI,iBAAkB,EAAQ,aAAa,CAChD,EAAQ,aAAa,EAAO,IAAI,gBAAiB,EAAQ,YAAY,CAEzE,IAAM,EAAiB,GACrB,EAAA,eAAgD,CAC9C,QAAS,EACT,OAAQ,MACR,KAAM,wBAAwB,EAAe,iBAAiB,EAAa,UAAU,GACtF,CAAC,CAEJ,GAAI,CACF,IAAM,EAAO,MAAM,EAAc,EAAO,CACxC,MAAO,CACL,MAAO,GAAM,OAAS,EAAE,CACxB,aAAc,GAAM,cAAgB,KACrC,OACM,EAAK,CACZ,GAAI,CAAC,EAAiB,MAAM,EAW5B,OALA,QAAQ,KACN,8IAGD,CACM,CAAE,MAAO,EAAE,CAAE,aAAc,KAAM,EAI5C,IAAM,EAAO,MAAM,IAAI,EAAA,iBACrB,EAAA,gCAAgC,CAAE,kBAAiB,gBAAe,CAAC,CACnE,EACD,CAAC,OAAO,CACP,QACA,GAAI,EAAQ,OAAS,CAAE,QAAS,EAAQ,OAAQ,CAAG,EAAE,CACrD,GAAI,EAAQ,UAAY,CAAE,WAAY,EAAQ,UAAW,CAAG,EAAE,CAC9D,GAAI,EAAQ,aAAe,CAAE,eAAgB,EAAQ,aAAc,CAAG,EAAE,CACxE,GAAI,EAAQ,YAAc,CAAE,cAAe,EAAQ,YAAa,CAAG,EAAE,CACtE,CAAC,CAEF,MAAO,CACL,MAAQ,GAAM,OAAS,EAAE,CACzB,aAAc,GAAM,cAAgB,KACrC"}

package/dist/api/event-service/event-service.api.js

@@ -1,4 +1,5 @@
 import { ConversationClient as e } from "../../node_modules/@openhands/typescript-client/dist/client/conversation-client.js";
+import "../../node_modules/@openhands/typescript-client/dist/clients.js";
 import { buildHttpBaseUrl as t } from "../../utils/websocket-url.js";
 import { getActiveBackend as n } from "../backend-registry/active-store.js";
 import { getAgentServerClientOptions as r, getAgentServerHttpClientOptions as i } from "../agent-server-client-options.js";

package/dist/api/event-service/event-service.api.js.map

@@ -1 +1 @@
-{"version":3,"file":"event-service.api.js","names":[],"sources":["../../../src/api/event-service/event-service.api.ts"],"sourcesContent":["import { ConversationClient } from \"@openhands/typescript-client/clients\";\nimport { RemoteEventsList } from \"@openhands/typescript-client/events/remote-events-list\";\nimport { OpenHandsEvent } from \"#/types/agent-server/core\";\nimport { buildHttpBaseUrl } from \"#/utils/websocket-url\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport { callCloudProxy } from \"../cloud/proxy\";\nimport {\n  getAgentServerClientOptions,\n  getAgentServerHttpClientOptions,\n} from \"../agent-server-client-options\";\nimport type {\n  ConfirmationResponseRequest,\n  ConfirmationResponseResponse,\n  EventSearchOptions,\n  EventSearchPage,\n} from \"./event-service.types\";\n\n/**\n * Cloud-mode REST calls are split between two upstream hosts (matching\n * OpenHands' cloud frontend):\n *\n *   - **App API** (`backend.host`, default in `callCloudProxy`):\n *     event *history* (`/api/v1/conversation/{id}/events/search`).\n *     Persisted by the cloud backend — survives the runtime sandbox.\n *\n *   - **Runtime sandbox** (extracted from `conversation.conversation_url`\n *     and passed as `hostOverride`): live runtime endpoints like\n *     `/api/conversations/{id}/events/count` and\n *     `/api/conversations/{id}/events/respond_to_confirmation`. Auth on\n *     these endpoints is `X-Session-API-Key`, not `Authorization: Bearer`.\n *\n * App API calls go directly to the cloud backend with bearer auth. Runtime\n * sandbox calls go through `/api/cloud-proxy`, which avoids depending on CORS\n * for per-conversation runtime hosts.\n *\n * Local mode keeps the existing typescript-client path: it targets the\n * conversation's host directly via typed client classes.\n */\nclass EventService {\n  static async respondToConfirmation(\n    conversationId: string,\n    conversationUrl: string,\n    request: ConfirmationResponseRequest,\n    sessionApiKey?: string | null,\n  ): Promise<ConfirmationResponseResponse> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\") {\n      return callCloudProxy<ConfirmationResponseResponse>({\n        backend: active,\n        method: \"POST\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: `/api/conversations/${conversationId}/events/respond_to_confirmation`,\n        body: request,\n        authMode: \"session-api-key\",\n        sessionApiKey,\n      });\n    }\n\n    return new ConversationClient(\n      getAgentServerClientOptions({\n        conversationUrl,\n        sessionApiKey,\n      }),\n    ).respondToConfirmation<ConfirmationResponseResponse>(\n      conversationId,\n      request,\n    );\n  }\n\n  static async getEventCount(\n    conversationId: string,\n    conversationUrl: string,\n    sessionApiKey?: string | null,\n  ): Promise<number> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\") {\n      return callCloudProxy<number>({\n        backend: active,\n        method: \"GET\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: `/api/conversations/${conversationId}/events/count`,\n        authMode: \"session-api-key\",\n        sessionApiKey,\n      });\n    }\n\n    return new ConversationClient(\n      getAgentServerClientOptions({\n        conversationUrl,\n        sessionApiKey,\n      }),\n    ).getEventCount(conversationId);\n  }\n\n  /**\n   * Search events for a conversation. Returns the raw page so callers can\n   * paginate (via `next_page_id`) and so REST-driven history loading can\n   * tell when there are no more older events to load.\n   */\n  static async searchEvents(\n    conversationId: string,\n    conversationUrl?: string | null,\n    sessionApiKey?: string | null,\n    options: EventSearchOptions = {},\n  ): Promise<EventSearchPage<OpenHandsEvent>> {\n    const active = getActiveBackend().backend;\n    const limit = options.limit ?? 100;\n\n    if (active.kind === \"cloud\") {\n      // Event *history* lives on the cloud App API, not the runtime\n      // sandbox. Path is singular `conversation` and v1-prefixed.\n      //\n      // Full pagination params (sort_order, page_id, timestamp filters)\n      // require the server-side fix from OpenHands/OpenHands#14399. If\n      // the cloud backend hasn't been updated yet, the timestamp filters\n      // trigger a 500 (str-vs-datetime comparison). We attempt the full\n      // request first and fall back to a limit-only request on failure.\n      const cloudLimit = Math.min(limit, 100);\n      const hasFilterParams = !!(\n        options.sortOrder ||\n        options.pageId ||\n        options.timestampGte ||\n        options.timestampLt\n      );\n\n      const params = new URLSearchParams();\n      params.set(\"limit\", String(cloudLimit));\n      if (options.sortOrder) params.set(\"sort_order\", options.sortOrder);\n      if (options.pageId) params.set(\"page_id\", options.pageId);\n      if (options.timestampGte)\n        params.set(\"timestamp__gte\", options.timestampGte);\n      if (options.timestampLt) params.set(\"timestamp__lt\", options.timestampLt);\n\n      const doCloudSearch = (searchParams: URLSearchParams) =>\n        callCloudProxy<EventSearchPage<OpenHandsEvent>>({\n          backend: active,\n          method: \"GET\",\n          path: `/api/v1/conversation/${conversationId}/events/search?${searchParams.toString()}`,\n        });\n\n      try {\n        const data = await doCloudSearch(params);\n        return {\n          items: data?.items ?? [],\n          next_page_id: data?.next_page_id ?? null,\n        };\n      } catch (err) {\n        if (!hasFilterParams) throw err;\n\n        // Server doesn't support timestamp filters yet — stop pagination\n        // by returning an empty page so the UI doesn't retry indefinitely.\n        // A limit-only fallback would return the same most-recent events\n        // already in the store, which get deduped but keep hasMore=true.\n        console.warn(\n          \"[EventService] Cloud backend doesn't support pagination filters. \" +\n            \"Falling back to initial load only. \" +\n            \"Server needs OpenHands/OpenHands#14399.\",\n        );\n        return { items: [], next_page_id: null };\n      }\n    }\n\n    const page = await new RemoteEventsList(\n      getAgentServerHttpClientOptions({ conversationUrl, sessionApiKey }),\n      conversationId,\n    ).search({\n      limit,\n      ...(options.pageId ? { page_id: options.pageId } : {}),\n      ...(options.sortOrder ? { sort_order: options.sortOrder } : {}),\n      ...(options.timestampGte ? { timestamp__gte: options.timestampGte } : {}),\n      ...(options.timestampLt ? { timestamp__lt: options.timestampLt } : {}),\n    });\n\n    return {\n      items: (page?.items ?? []) as OpenHandsEvent[],\n      next_page_id: page?.next_page_id ?? null,\n    };\n  }\n}\n\nexport default EventService;\n"],"mappings":";;;;;;;AAsCA,IAAM,IAAN,MAAmB;CACjB,aAAa,sBACX,GACA,GACA,GACA,GACuC;EACvC,IAAM,IAAS,GAAkB,CAAC;AAclC,SAZI,EAAO,SAAS,UACX,EAA6C;GAClD,SAAS;GACT,QAAQ;GACR,cAAc,EAAiB,EAAgB;GAC/C,MAAM,sBAAsB,EAAe;GAC3C,MAAM;GACN,UAAU;GACV;GACD,CAAC,GAGG,IAAI,EACT,EAA4B;GAC1B;GACA;GACD,CAAC,CACH,CAAC,sBACA,GACA,EACD;;CAGH,aAAa,cACX,GACA,GACA,GACiB;EACjB,IAAM,IAAS,GAAkB,CAAC;AAalC,SAXI,EAAO,SAAS,UACX,EAAuB;GAC5B,SAAS;GACT,QAAQ;GACR,cAAc,EAAiB,EAAgB;GAC/C,MAAM,sBAAsB,EAAe;GAC3C,UAAU;GACV;GACD,CAAC,GAGG,IAAI,EACT,EAA4B;GAC1B;GACA;GACD,CAAC,CACH,CAAC,cAAc,EAAe;;CAQjC,aAAa,aACX,GACA,GACA,GACA,IAA8B,EAAE,EACU;EAC1C,IAAM,IAAS,GAAkB,CAAC,SAC5B,IAAQ,EAAQ,SAAS;AAE/B,MAAI,EAAO,SAAS,SAAS;GAS3B,IAAM,IAAa,KAAK,IAAI,GAAO,IAAI,EACjC,IAAkB,CAAC,EACvB,EAAQ,aACR,EAAQ,UACR,EAAQ,gBACR,EAAQ,cAGJ,IAAS,IAAI,iBAAiB;AAMpC,GALA,EAAO,IAAI,SAAS,OAAO,EAAW,CAAC,EACnC,EAAQ,aAAW,EAAO,IAAI,cAAc,EAAQ,UAAU,EAC9D,EAAQ,UAAQ,EAAO,IAAI,WAAW,EAAQ,OAAO,EACrD,EAAQ,gBACV,EAAO,IAAI,kBAAkB,EAAQ,aAAa,EAChD,EAAQ,eAAa,EAAO,IAAI,iBAAiB,EAAQ,YAAY;GAEzE,IAAM,KAAiB,MACrB,EAAgD;IAC9C,SAAS;IACT,QAAQ;IACR,MAAM,wBAAwB,EAAe,iBAAiB,EAAa,UAAU;IACtF,CAAC;AAEJ,OAAI;IACF,IAAM,IAAO,MAAM,EAAc,EAAO;AACxC,WAAO;KACL,OAAO,GAAM,SAAS,EAAE;KACxB,cAAc,GAAM,gBAAgB;KACrC;YACM,GAAK;AACZ,QAAI,CAAC,EAAiB,OAAM;AAW5B,WALA,QAAQ,KACN,8IAGD,EACM;KAAE,OAAO,EAAE;KAAE,cAAc;KAAM;;;EAI5C,IAAM,IAAO,MAAM,IAAI,EACrB,EAAgC;GAAE;GAAiB;GAAe,CAAC,EACnE,EACD,CAAC,OAAO;GACP;GACA,GAAI,EAAQ,SAAS,EAAE,SAAS,EAAQ,QAAQ,GAAG,EAAE;GACrD,GAAI,EAAQ,YAAY,EAAE,YAAY,EAAQ,WAAW,GAAG,EAAE;GAC9D,GAAI,EAAQ,eAAe,EAAE,gBAAgB,EAAQ,cAAc,GAAG,EAAE;GACxE,GAAI,EAAQ,cAAc,EAAE,eAAe,EAAQ,aAAa,GAAG,EAAE;GACtE,CAAC;AAEF,SAAO;GACL,OAAQ,GAAM,SAAS,EAAE;GACzB,cAAc,GAAM,gBAAgB;GACrC"}
+{"version":3,"file":"event-service.api.js","names":[],"sources":["../../../src/api/event-service/event-service.api.ts"],"sourcesContent":["import { ConversationClient } from \"@openhands/typescript-client/clients\";\nimport { RemoteEventsList } from \"@openhands/typescript-client/events/remote-events-list\";\nimport { OpenHandsEvent } from \"#/types/agent-server/core\";\nimport { buildHttpBaseUrl } from \"#/utils/websocket-url\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport { callCloudProxy } from \"../cloud/proxy\";\nimport {\n  getAgentServerClientOptions,\n  getAgentServerHttpClientOptions,\n} from \"../agent-server-client-options\";\nimport type {\n  ConfirmationResponseRequest,\n  ConfirmationResponseResponse,\n  EventSearchOptions,\n  EventSearchPage,\n} from \"./event-service.types\";\n\n/**\n * Cloud-mode REST calls are split between two upstream hosts (matching\n * OpenHands' cloud frontend):\n *\n *   - **App API** (`backend.host`, default in `callCloudProxy`):\n *     event *history* (`/api/v1/conversation/{id}/events/search`).\n *     Persisted by the cloud backend — survives the runtime sandbox.\n *\n *   - **Runtime sandbox** (extracted from `conversation.conversation_url`\n *     and passed as `hostOverride`): live runtime endpoints like\n *     `/api/conversations/{id}/events/count` and\n *     `/api/conversations/{id}/events/respond_to_confirmation`. Auth on\n *     these endpoints is `X-Session-API-Key`, not `Authorization: Bearer`.\n *\n * App API calls go directly to the cloud backend with bearer auth. Runtime\n * sandbox calls go through `/api/cloud-proxy`, which avoids depending on CORS\n * for per-conversation runtime hosts.\n *\n * Local mode keeps the existing typescript-client path: it targets the\n * conversation's host directly via typed client classes.\n */\nclass EventService {\n  static async respondToConfirmation(\n    conversationId: string,\n    conversationUrl: string,\n    request: ConfirmationResponseRequest,\n    sessionApiKey?: string | null,\n  ): Promise<ConfirmationResponseResponse> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\") {\n      return callCloudProxy<ConfirmationResponseResponse>({\n        backend: active,\n        method: \"POST\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: `/api/conversations/${conversationId}/events/respond_to_confirmation`,\n        body: request,\n        authMode: \"session-api-key\",\n        sessionApiKey,\n      });\n    }\n\n    return new ConversationClient(\n      getAgentServerClientOptions({\n        conversationUrl,\n        sessionApiKey,\n      }),\n    ).respondToConfirmation<ConfirmationResponseResponse>(\n      conversationId,\n      request,\n    );\n  }\n\n  static async getEventCount(\n    conversationId: string,\n    conversationUrl: string,\n    sessionApiKey?: string | null,\n  ): Promise<number> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\") {\n      return callCloudProxy<number>({\n        backend: active,\n        method: \"GET\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: `/api/conversations/${conversationId}/events/count`,\n        authMode: \"session-api-key\",\n        sessionApiKey,\n      });\n    }\n\n    return new ConversationClient(\n      getAgentServerClientOptions({\n        conversationUrl,\n        sessionApiKey,\n      }),\n    ).getEventCount(conversationId);\n  }\n\n  /**\n   * Search events for a conversation. Returns the raw page so callers can\n   * paginate (via `next_page_id`) and so REST-driven history loading can\n   * tell when there are no more older events to load.\n   */\n  static async searchEvents(\n    conversationId: string,\n    conversationUrl?: string | null,\n    sessionApiKey?: string | null,\n    options: EventSearchOptions = {},\n  ): Promise<EventSearchPage<OpenHandsEvent>> {\n    const active = getActiveBackend().backend;\n    const limit = options.limit ?? 100;\n\n    if (active.kind === \"cloud\") {\n      // Event *history* lives on the cloud App API, not the runtime\n      // sandbox. Path is singular `conversation` and v1-prefixed.\n      //\n      // Full pagination params (sort_order, page_id, timestamp filters)\n      // require the server-side fix from OpenHands/OpenHands#14399. If\n      // the cloud backend hasn't been updated yet, the timestamp filters\n      // trigger a 500 (str-vs-datetime comparison). We attempt the full\n      // request first and fall back to a limit-only request on failure.\n      const cloudLimit = Math.min(limit, 100);\n      const hasFilterParams = !!(\n        options.sortOrder ||\n        options.pageId ||\n        options.timestampGte ||\n        options.timestampLt\n      );\n\n      const params = new URLSearchParams();\n      params.set(\"limit\", String(cloudLimit));\n      if (options.sortOrder) params.set(\"sort_order\", options.sortOrder);\n      if (options.pageId) params.set(\"page_id\", options.pageId);\n      if (options.timestampGte)\n        params.set(\"timestamp__gte\", options.timestampGte);\n      if (options.timestampLt) params.set(\"timestamp__lt\", options.timestampLt);\n\n      const doCloudSearch = (searchParams: URLSearchParams) =>\n        callCloudProxy<EventSearchPage<OpenHandsEvent>>({\n          backend: active,\n          method: \"GET\",\n          path: `/api/v1/conversation/${conversationId}/events/search?${searchParams.toString()}`,\n        });\n\n      try {\n        const data = await doCloudSearch(params);\n        return {\n          items: data?.items ?? [],\n          next_page_id: data?.next_page_id ?? null,\n        };\n      } catch (err) {\n        if (!hasFilterParams) throw err;\n\n        // Server doesn't support timestamp filters yet — stop pagination\n        // by returning an empty page so the UI doesn't retry indefinitely.\n        // A limit-only fallback would return the same most-recent events\n        // already in the store, which get deduped but keep hasMore=true.\n        console.warn(\n          \"[EventService] Cloud backend doesn't support pagination filters. \" +\n            \"Falling back to initial load only. \" +\n            \"Server needs OpenHands/OpenHands#14399.\",\n        );\n        return { items: [], next_page_id: null };\n      }\n    }\n\n    const page = await new RemoteEventsList(\n      getAgentServerHttpClientOptions({ conversationUrl, sessionApiKey }),\n      conversationId,\n    ).search({\n      limit,\n      ...(options.pageId ? { page_id: options.pageId } : {}),\n      ...(options.sortOrder ? { sort_order: options.sortOrder } : {}),\n      ...(options.timestampGte ? { timestamp__gte: options.timestampGte } : {}),\n      ...(options.timestampLt ? { timestamp__lt: options.timestampLt } : {}),\n    });\n\n    return {\n      items: (page?.items ?? []) as OpenHandsEvent[],\n      next_page_id: page?.next_page_id ?? null,\n    };\n  }\n}\n\nexport default EventService;\n"],"mappings":";;;;;;;;AAsCA,IAAM,IAAN,MAAmB;CACjB,aAAa,sBACX,GACA,GACA,GACA,GACuC;EACvC,IAAM,IAAS,GAAkB,CAAC;AAclC,SAZI,EAAO,SAAS,UACX,EAA6C;GAClD,SAAS;GACT,QAAQ;GACR,cAAc,EAAiB,EAAgB;GAC/C,MAAM,sBAAsB,EAAe;GAC3C,MAAM;GACN,UAAU;GACV;GACD,CAAC,GAGG,IAAI,EACT,EAA4B;GAC1B;GACA;GACD,CAAC,CACH,CAAC,sBACA,GACA,EACD;;CAGH,aAAa,cACX,GACA,GACA,GACiB;EACjB,IAAM,IAAS,GAAkB,CAAC;AAalC,SAXI,EAAO,SAAS,UACX,EAAuB;GAC5B,SAAS;GACT,QAAQ;GACR,cAAc,EAAiB,EAAgB;GAC/C,MAAM,sBAAsB,EAAe;GAC3C,UAAU;GACV;GACD,CAAC,GAGG,IAAI,EACT,EAA4B;GAC1B;GACA;GACD,CAAC,CACH,CAAC,cAAc,EAAe;;CAQjC,aAAa,aACX,GACA,GACA,GACA,IAA8B,EAAE,EACU;EAC1C,IAAM,IAAS,GAAkB,CAAC,SAC5B,IAAQ,EAAQ,SAAS;AAE/B,MAAI,EAAO,SAAS,SAAS;GAS3B,IAAM,IAAa,KAAK,IAAI,GAAO,IAAI,EACjC,IAAkB,CAAC,EACvB,EAAQ,aACR,EAAQ,UACR,EAAQ,gBACR,EAAQ,cAGJ,IAAS,IAAI,iBAAiB;AAMpC,GALA,EAAO,IAAI,SAAS,OAAO,EAAW,CAAC,EACnC,EAAQ,aAAW,EAAO,IAAI,cAAc,EAAQ,UAAU,EAC9D,EAAQ,UAAQ,EAAO,IAAI,WAAW,EAAQ,OAAO,EACrD,EAAQ,gBACV,EAAO,IAAI,kBAAkB,EAAQ,aAAa,EAChD,EAAQ,eAAa,EAAO,IAAI,iBAAiB,EAAQ,YAAY;GAEzE,IAAM,KAAiB,MACrB,EAAgD;IAC9C,SAAS;IACT,QAAQ;IACR,MAAM,wBAAwB,EAAe,iBAAiB,EAAa,UAAU;IACtF,CAAC;AAEJ,OAAI;IACF,IAAM,IAAO,MAAM,EAAc,EAAO;AACxC,WAAO;KACL,OAAO,GAAM,SAAS,EAAE;KACxB,cAAc,GAAM,gBAAgB;KACrC;YACM,GAAK;AACZ,QAAI,CAAC,EAAiB,OAAM;AAW5B,WALA,QAAQ,KACN,8IAGD,EACM;KAAE,OAAO,EAAE;KAAE,cAAc;KAAM;;;EAI5C,IAAM,IAAO,MAAM,IAAI,EACrB,EAAgC;GAAE;GAAiB;GAAe,CAAC,EACnE,EACD,CAAC,OAAO;GACP;GACA,GAAI,EAAQ,SAAS,EAAE,SAAS,EAAQ,QAAQ,GAAG,EAAE;GACrD,GAAI,EAAQ,YAAY,EAAE,YAAY,EAAQ,WAAW,GAAG,EAAE;GAC9D,GAAI,EAAQ,eAAe,EAAE,gBAAgB,EAAQ,cAAc,GAAG,EAAE;GACxE,GAAI,EAAQ,cAAc,EAAE,eAAe,EAAQ,aAAa,GAAG,EAAE;GACtE,CAAC;AAEF,SAAO;GACL,OAAQ,GAAM,SAAS,EAAE;GACzB,cAAc,GAAM,gBAAgB;GACrC"}

package/dist/api/mcp-service/mcp-redacted-credentials.cjs

@@ -1,2 +1,2 @@
-require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../settings-service/settings-service.api.cjs`);require(`../../utils/mcp-config.cjs`);var t=e=>!!e&&typeof e==`object`&&!Array.isArray(e),n=e=>{if(!t(e))return;let n=Object.entries(e).filter(e=>typeof e[1]==`string`);return n.length>0?Object.fromEntries(n):void 0},r=e=>!!e&&Object.values(e).some(e=>e===`<redacted>`),i=(e,t)=>e===`sse`?t===`sse`:e===`shttp`?t===void 0||t===`http`||t===`shttp`||t===`streamable-http`:!1,a=e=>{if(!e)return;let t=/^stdio-(\d+)$/.exec(e);return t?Number.parseInt(t[1],10):void 0},o=(e,t)=>{let n=a(e);if(n!==void 0)return Object.entries(t).filter(([,e])=>!e.url)[n]?.[1]},s=(e,t)=>e.type===`stdio`?o(e.id,t)??(e.name?t[e.name]:void 0):e.name&&t[e.name]?t[e.name]:Object.values(t).find(t=>t.url===e.url&&i(e.type,t.transport));async function c(n){let r=(await e.default.fetchSettingsFromApi(`encrypted`)).agent_settings?.mcp_config;if(!(!t(r)||!t(r.mcpServers)))return s(n,r.mcpServers)}async function l(e){let t=e.type===`stdio`&&r(e.env),i=(e.type===`sse`||e.type===`shttp`)&&e.api_key===`<redacted>`;if(!t&&!i)return e;try{let r=await c(e);if(!r)return e;if(t){let t=n(r.env)??{},i=Object.fromEntries(Object.entries(e.env??{}).map(([e,n])=>[e,n===`<redacted>`&&typeof t[e]==`string`?t[e]:n]));return{...e,env:i}}let i=n(r.headers);return i?{...e,api_key:void 0,headers:i}:e}catch{return e}}exports.substituteRedactedMcpCredentials=l;
+require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../../utils/mcp-config.cjs`),t=require(`../settings-service/settings-service.api.cjs`),n=require(`../../types/mcp-auth.cjs`);var r=e=>!!e&&typeof e==`object`&&!Array.isArray(e),i=e=>{if(!r(e))return;let t=Object.entries(e).filter(e=>typeof e[1]==`string`);return t.length>0?Object.fromEntries(t):void 0},a=e=>!!e&&Object.values(e).some(e=>e===`**********`),o=(e,t)=>e===`sse`?t===`sse`:e===`shttp`?t===void 0||t===`http`||t===`shttp`||t===`streamable-http`:!1,s=e=>{if(!e)return;let t=/^stdio-(\d+)$/.exec(e);return t?Number.parseInt(t[1],10):void 0},c=(e,t)=>{let n=s(e);if(n!==void 0)return Object.entries(t).filter(([,e])=>!e.url)[n]?.[1]},l=(e,t)=>e.type===`stdio`?c(e.id,t)??(e.name?t[e.name]:void 0):e.name&&t[e.name]?t[e.name]:Object.values(t).find(t=>t.url===e.url&&o(e.type,t.transport));async function u(e){let n=(await t.default.fetchSettingsFromApi(`encrypted`)).agent_settings?.mcp_config;if(r(n))return l(e,n)}async function d(t){let r=t.type===`stdio`&&a(t.env),o=(t.type===`sse`||t.type===`shttp`)&&e.hasRedactedMcpSecretLeaf(t.auth);if(!r&&!o)return t;try{let e=await u(t);if(!e)return t;if(r){let n=i(e.env)??{},r=Object.fromEntries(Object.entries(t.env??{}).map(([e,t])=>[e,t===`**********`&&typeof n[e]==`string`?n[e]:t]));return{...t,env:r}}return o&&n.isMcpAuthCredential(e.auth)?{...t,auth:e.auth}:t}catch{return t}}exports.substituteRedactedMcpCredentials=d;
 //# sourceMappingURL=mcp-redacted-credentials.cjs.map

package/dist/api/mcp-service/mcp-redacted-credentials.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-redacted-credentials.cjs","names":[],"sources":["../../../src/api/mcp-service/mcp-redacted-credentials.ts"],"sourcesContent":["import SettingsService from \"#/api/settings-service/settings-service.api\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport { REDACTED_MCP_SECRET_VALUE } from \"#/utils/mcp-config\";\n\ntype StoredMcpServer = {\n  url?: unknown;\n  transport?: unknown;\n  env?: unknown;\n  headers?: unknown;\n};\n\ntype StoredMcpServers = Record<string, StoredMcpServer>;\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === \"object\" && !Array.isArray(value);\n\nconst stringRecord = (value: unknown): Record<string, string> | undefined => {\n  if (!isRecord(value)) return undefined;\n  const entries = Object.entries(value).filter(\n    (entry): entry is [string, string] => typeof entry[1] === \"string\",\n  );\n  return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n};\n\nconst hasRedactedValue = (values: Record<string, string> | undefined) =>\n  !!values &&\n  Object.values(values).some((value) => value === REDACTED_MCP_SECRET_VALUE);\n\nconst remoteTransportMatches = (\n  type: MCPServerConfig[\"type\"],\n  transport: unknown,\n) => {\n  if (type === \"sse\") return transport === \"sse\";\n  if (type === \"shttp\") {\n    return (\n      transport === undefined ||\n      transport === \"http\" ||\n      transport === \"shttp\" ||\n      transport === \"streamable-http\"\n    );\n  }\n  return false;\n};\n\n// The editor assigns each stdio server an id of the form ``stdio-<i>`` matching\n// its position in ``parseMcpConfig``'s stdio array. That position is stable\n// across a rename because ``parseMcpConfig`` collects stdio entries (those\n// without a ``url``) in ``Object.entries`` order, identical for the redacted\n// and encrypted settings. Resolve the original stored entry by position so a\n// renamed stdio server still finds its stored encrypted env, instead of\n// looking it up by the new (no-longer-matching) display name.\nconst stdioIndexFromId = (id: string | undefined): number | undefined => {\n  if (!id) return undefined;\n  const match = /^stdio-(\\d+)$/.exec(id);\n  return match ? Number.parseInt(match[1], 10) : undefined;\n};\n\nconst findStoredStdioByIndex = (\n  id: string | undefined,\n  storedServers: StoredMcpServers,\n): StoredMcpServer | undefined => {\n  const index = stdioIndexFromId(id);\n  if (index === undefined) return undefined;\n  const stdioEntries = Object.entries(storedServers).filter(\n    ([, stored]) => !stored.url,\n  );\n  return stdioEntries[index]?.[1];\n};\n\nconst findStoredServer = (\n  server: MCPServerConfig,\n  storedServers: StoredMcpServers,\n): StoredMcpServer | undefined => {\n  if (server.type === \"stdio\") {\n    // Prefer the positional id: a rename changes the display name (the stored\n    // dict key), and a rename onto an existing name would otherwise restore the\n    // wrong server's secrets. Fall back to a name match only when no id-based\n    // position is available (e.g. configs built without an editor-assigned id).\n    return (\n      findStoredStdioByIndex(server.id, storedServers) ??\n      (server.name ? storedServers[server.name] : undefined)\n    );\n  }\n\n  if (server.name && storedServers[server.name]) {\n    return storedServers[server.name];\n  }\n\n  return Object.values(storedServers).find(\n    (stored) =>\n      stored.url === server.url &&\n      remoteTransportMatches(server.type, stored.transport),\n  );\n};\n\nasync function fetchEncryptedStoredServer(\n  server: MCPServerConfig,\n): Promise<StoredMcpServer | undefined> {\n  const response = await SettingsService.fetchSettingsFromApi(\"encrypted\");\n  const mcpConfig = response.agent_settings?.mcp_config;\n  if (!isRecord(mcpConfig) || !isRecord(mcpConfig.mcpServers)) {\n    return undefined;\n  }\n  return findStoredServer(server, mcpConfig.mcpServers as StoredMcpServers);\n}\n\n/**\n * The MCP editor sees redacted settings (`<redacted>`). When the user leaves\n * a secret unchanged, replace that placeholder with the stored encrypted\n * env/header value so tests and saves round-trip the real credential without\n * exposing plaintext in the browser.\n */\nexport async function substituteRedactedMcpCredentials(\n  server: MCPServerConfig,\n): Promise<MCPServerConfig> {\n  const redactedStdioEnv =\n    server.type === \"stdio\" && hasRedactedValue(server.env);\n  const redactedRemoteApiKey =\n    (server.type === \"sse\" || server.type === \"shttp\") &&\n    server.api_key === REDACTED_MCP_SECRET_VALUE;\n\n  if (!redactedStdioEnv && !redactedRemoteApiKey) return server;\n\n  try {\n    const stored = await fetchEncryptedStoredServer(server);\n    if (!stored) return server;\n\n    if (redactedStdioEnv) {\n      const storedEnv = stringRecord(stored.env) ?? {};\n      const env = Object.fromEntries(\n        Object.entries(server.env ?? {}).map(([key, value]) => [\n          key,\n          value === REDACTED_MCP_SECRET_VALUE &&\n          typeof storedEnv[key] === \"string\"\n            ? storedEnv[key]\n            : value,\n        ]),\n      );\n      return { ...server, env };\n    }\n\n    const headers = stringRecord(stored.headers);\n    if (!headers) return server;\n    return { ...server, api_key: undefined, headers };\n  } catch {\n    return server;\n  }\n}\n"],"mappings":"sJAaA,IAAM,EAAY,GAChB,CAAC,CAAC,GAAS,OAAO,GAAU,UAAY,CAAC,MAAM,QAAQ,EAAM,CAEzD,EAAgB,GAAuD,CAC3E,GAAI,CAAC,EAAS,EAAM,CAAE,OACtB,IAAM,EAAU,OAAO,QAAQ,EAAM,CAAC,OACnC,GAAqC,OAAO,EAAM,IAAO,SAC3D,CACD,OAAO,EAAQ,OAAS,EAAI,OAAO,YAAY,EAAQ,CAAG,IAAA,IAGtD,EAAoB,GACxB,CAAC,CAAC,GACF,OAAO,OAAO,EAAO,CAAC,KAAM,GAAU,IAAA,aAAoC,CAEtE,GACJ,EACA,IAEI,IAAS,MAAc,IAAc,MACrC,IAAS,QAET,IAAc,IAAA,IACd,IAAc,QACd,IAAc,SACd,IAAc,kBAGX,GAUH,EAAoB,GAA+C,CACvE,GAAI,CAAC,EAAI,OACT,IAAM,EAAQ,gBAAgB,KAAK,EAAG,CACtC,OAAO,EAAQ,OAAO,SAAS,EAAM,GAAI,GAAG,CAAG,IAAA,IAG3C,GACJ,EACA,IACgC,CAChC,IAAM,EAAQ,EAAiB,EAAG,CAC9B,OAAU,IAAA,GAId,OAHqB,OAAO,QAAQ,EAAc,CAAC,QAChD,EAAG,KAAY,CAAC,EAAO,IAEnB,CAAa,KAAS,IAGzB,GACJ,EACA,IAEI,EAAO,OAAS,QAMhB,EAAuB,EAAO,GAAI,EAAc,GAC/C,EAAO,KAAO,EAAc,EAAO,MAAQ,IAAA,IAI5C,EAAO,MAAQ,EAAc,EAAO,MAC/B,EAAc,EAAO,MAGvB,OAAO,OAAO,EAAc,CAAC,KACjC,GACC,EAAO,MAAQ,EAAO,KACtB,EAAuB,EAAO,KAAM,EAAO,UAAU,CACxD,CAGH,eAAe,EACb,EACsC,CAEtC,IAAM,GAAY,MADK,EAAA,QAAgB,qBAAqB,YAAY,EAC7C,gBAAgB,WACvC,MAAC,EAAS,EAAU,EAAI,CAAC,EAAS,EAAU,WAAW,EAG3D,OAAO,EAAiB,EAAQ,EAAU,WAA+B,CAS3E,eAAsB,EACpB,EAC0B,CAC1B,IAAM,EACJ,EAAO,OAAS,SAAW,EAAiB,EAAO,IAAI,CACnD,GACH,EAAO,OAAS,OAAS,EAAO,OAAS,UAC1C,EAAO,UAAA,aAET,GAAI,CAAC,GAAoB,CAAC,EAAsB,OAAO,EAEvD,GAAI,CACF,IAAM,EAAS,MAAM,EAA2B,EAAO,CACvD,GAAI,CAAC,EAAQ,OAAO,EAEpB,GAAI,EAAkB,CACpB,IAAM,EAAY,EAAa,EAAO,IAAI,EAAI,EAAE,CAC1C,EAAM,OAAO,YACjB,OAAO,QAAQ,EAAO,KAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAK,KAAW,CACrD,EACA,IAAA,cACA,OAAO,EAAU,IAAS,SACtB,EAAU,GACV,EACL,CAAC,CACH,CACD,MAAO,CAAE,GAAG,EAAQ,MAAK,CAG3B,IAAM,EAAU,EAAa,EAAO,QAAQ,CAE5C,OADK,EACE,CAAE,GAAG,EAAQ,QAAS,IAAA,GAAW,UAAS,CAD5B,OAEf,CACN,OAAO"}
+{"version":3,"file":"mcp-redacted-credentials.cjs","names":[],"sources":["../../../src/api/mcp-service/mcp-redacted-credentials.ts"],"sourcesContent":["import SettingsService from \"#/api/settings-service/settings-service.api\";\nimport { isMcpAuthCredential } from \"#/types/mcp-auth\";\nimport type { MCPServerConfig } from \"#/types/mcp-server\";\nimport {\n  hasRedactedMcpSecretLeaf,\n  REDACTED_MCP_SECRET_VALUE,\n} from \"#/utils/mcp-config\";\n\ntype StoredMcpServer = {\n  url?: unknown;\n  transport?: unknown;\n  env?: unknown;\n  auth?: unknown;\n  headers?: unknown;\n};\n\ntype StoredMcpConfig = Record<string, StoredMcpServer>;\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === \"object\" && !Array.isArray(value);\n\nconst stringRecord = (value: unknown): Record<string, string> | undefined => {\n  if (!isRecord(value)) return undefined;\n  const entries = Object.entries(value).filter(\n    (entry): entry is [string, string] => typeof entry[1] === \"string\",\n  );\n  return entries.length > 0 ? Object.fromEntries(entries) : undefined;\n};\n\nconst hasRedactedValue = (values: Record<string, string> | undefined) =>\n  !!values &&\n  Object.values(values).some((value) => value === REDACTED_MCP_SECRET_VALUE);\n\nconst remoteTransportMatches = (\n  type: MCPServerConfig[\"type\"],\n  transport: unknown,\n) => {\n  if (type === \"sse\") return transport === \"sse\";\n  if (type === \"shttp\") {\n    return (\n      transport === undefined ||\n      transport === \"http\" ||\n      transport === \"shttp\" ||\n      transport === \"streamable-http\"\n    );\n  }\n  return false;\n};\n\n// The editor assigns each stdio server an id of the form ``stdio-<i>`` matching\n// its position in ``parseMcpConfig``'s stdio array. That position is stable\n// across a rename because ``parseMcpConfig`` collects stdio entries (those\n// without a ``url``) in ``Object.entries`` order, identical for the redacted\n// and encrypted settings. Resolve the original stored entry by position so a\n// renamed stdio server still finds its stored encrypted env, instead of\n// looking it up by the new (no-longer-matching) display name.\nconst stdioIndexFromId = (id: string | undefined): number | undefined => {\n  if (!id) return undefined;\n  const match = /^stdio-(\\d+)$/.exec(id);\n  return match ? Number.parseInt(match[1], 10) : undefined;\n};\n\nconst findStoredStdioByIndex = (\n  id: string | undefined,\n  storedServers: StoredMcpConfig,\n): StoredMcpServer | undefined => {\n  const index = stdioIndexFromId(id);\n  if (index === undefined) return undefined;\n  const stdioEntries = Object.entries(storedServers).filter(\n    ([, stored]) => !stored.url,\n  );\n  return stdioEntries[index]?.[1];\n};\n\nconst findStoredServer = (\n  server: MCPServerConfig,\n  storedServers: StoredMcpConfig,\n): StoredMcpServer | undefined => {\n  if (server.type === \"stdio\") {\n    // Prefer the positional id: a rename changes the display name (the stored\n    // dict key), and a rename onto an existing name would otherwise restore the\n    // wrong server's secrets. Fall back to a name match only when no id-based\n    // position is available (e.g. configs built without an editor-assigned id).\n    return (\n      findStoredStdioByIndex(server.id, storedServers) ??\n      (server.name ? storedServers[server.name] : undefined)\n    );\n  }\n\n  if (server.name && storedServers[server.name]) {\n    return storedServers[server.name];\n  }\n\n  return Object.values(storedServers).find(\n    (stored) =>\n      stored.url === server.url &&\n      remoteTransportMatches(server.type, stored.transport),\n  );\n};\n\nasync function fetchEncryptedStoredServer(\n  server: MCPServerConfig,\n): Promise<StoredMcpServer | undefined> {\n  const response = await SettingsService.fetchSettingsFromApi(\"encrypted\");\n  const mcpConfig = response.agent_settings?.mcp_config;\n  if (!isRecord(mcpConfig)) {\n    return undefined;\n  }\n  return findStoredServer(server, mcpConfig as StoredMcpConfig);\n}\n\n/**\n * The MCP editor sees redacted settings (`**********`). When the user leaves\n * a secret unchanged, replace that placeholder with the stored encrypted\n * env/header/OAuth state value so tests and saves round-trip the real\n * credential without exposing plaintext in the browser.\n */\nexport async function substituteRedactedMcpCredentials(\n  server: MCPServerConfig,\n): Promise<MCPServerConfig> {\n  const redactedStdioEnv =\n    server.type === \"stdio\" && hasRedactedValue(server.env);\n  const redactedRemoteAuth =\n    (server.type === \"sse\" || server.type === \"shttp\") &&\n    hasRedactedMcpSecretLeaf(server.auth);\n\n  if (!redactedStdioEnv && !redactedRemoteAuth) {\n    return server;\n  }\n\n  try {\n    const stored = await fetchEncryptedStoredServer(server);\n    if (!stored) return server;\n\n    if (redactedStdioEnv) {\n      const storedEnv = stringRecord(stored.env) ?? {};\n      const env = Object.fromEntries(\n        Object.entries(server.env ?? {}).map(([key, value]) => [\n          key,\n          value === REDACTED_MCP_SECRET_VALUE &&\n          typeof storedEnv[key] === \"string\"\n            ? storedEnv[key]\n            : value,\n        ]),\n      );\n      return { ...server, env };\n    }\n\n    if (!redactedRemoteAuth) return server;\n    if (isMcpAuthCredential(stored.auth)) {\n      return { ...server, auth: stored.auth };\n    }\n    return server;\n  } catch {\n    return server;\n  }\n}\n"],"mappings":"8LAkBA,IAAM,EAAY,GAChB,CAAC,CAAC,GAAS,OAAO,GAAU,UAAY,CAAC,MAAM,QAAQ,EAAM,CAEzD,EAAgB,GAAuD,CAC3E,GAAI,CAAC,EAAS,EAAM,CAAE,OACtB,IAAM,EAAU,OAAO,QAAQ,EAAM,CAAC,OACnC,GAAqC,OAAO,EAAM,IAAO,SAC3D,CACD,OAAO,EAAQ,OAAS,EAAI,OAAO,YAAY,EAAQ,CAAG,IAAA,IAGtD,EAAoB,GACxB,CAAC,CAAC,GACF,OAAO,OAAO,EAAO,CAAC,KAAM,GAAU,IAAA,aAAoC,CAEtE,GACJ,EACA,IAEI,IAAS,MAAc,IAAc,MACrC,IAAS,QAET,IAAc,IAAA,IACd,IAAc,QACd,IAAc,SACd,IAAc,kBAGX,GAUH,EAAoB,GAA+C,CACvE,GAAI,CAAC,EAAI,OACT,IAAM,EAAQ,gBAAgB,KAAK,EAAG,CACtC,OAAO,EAAQ,OAAO,SAAS,EAAM,GAAI,GAAG,CAAG,IAAA,IAG3C,GACJ,EACA,IACgC,CAChC,IAAM,EAAQ,EAAiB,EAAG,CAC9B,OAAU,IAAA,GAId,OAHqB,OAAO,QAAQ,EAAc,CAAC,QAChD,EAAG,KAAY,CAAC,EAAO,IAEnB,CAAa,KAAS,IAGzB,GACJ,EACA,IAEI,EAAO,OAAS,QAMhB,EAAuB,EAAO,GAAI,EAAc,GAC/C,EAAO,KAAO,EAAc,EAAO,MAAQ,IAAA,IAI5C,EAAO,MAAQ,EAAc,EAAO,MAC/B,EAAc,EAAO,MAGvB,OAAO,OAAO,EAAc,CAAC,KACjC,GACC,EAAO,MAAQ,EAAO,KACtB,EAAuB,EAAO,KAAM,EAAO,UAAU,CACxD,CAGH,eAAe,EACb,EACsC,CAEtC,IAAM,GAAY,MADK,EAAA,QAAgB,qBAAqB,YAAY,EAC7C,gBAAgB,WACtC,KAAS,EAAU,CAGxB,OAAO,EAAiB,EAAQ,EAA6B,CAS/D,eAAsB,EACpB,EAC0B,CAC1B,IAAM,EACJ,EAAO,OAAS,SAAW,EAAiB,EAAO,IAAI,CACnD,GACH,EAAO,OAAS,OAAS,EAAO,OAAS,UAC1C,EAAA,yBAAyB,EAAO,KAAK,CAEvC,GAAI,CAAC,GAAoB,CAAC,EACxB,OAAO,EAGT,GAAI,CACF,IAAM,EAAS,MAAM,EAA2B,EAAO,CACvD,GAAI,CAAC,EAAQ,OAAO,EAEpB,GAAI,EAAkB,CACpB,IAAM,EAAY,EAAa,EAAO,IAAI,EAAI,EAAE,CAC1C,EAAM,OAAO,YACjB,OAAO,QAAQ,EAAO,KAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAK,KAAW,CACrD,EACA,IAAA,cACA,OAAO,EAAU,IAAS,SACtB,EAAU,GACV,EACL,CAAC,CACH,CACD,MAAO,CAAE,GAAG,EAAQ,MAAK,CAO3B,OAJK,GACD,EAAA,oBAAoB,EAAO,KAAK,CAC3B,CAAE,GAAG,EAAQ,KAAM,EAAO,KAAM,CAElC,OACD,CACN,OAAO"}

package/dist/api/mcp-service/mcp-redacted-credentials.d.ts

@@ -1,8 +1,8 @@
 import type { MCPServerConfig } from "#/types/mcp-server";
 /**
- * The MCP editor sees redacted settings (`<redacted>`). When the user leaves
+ * The MCP editor sees redacted settings (`**********`). When the user leaves
  * a secret unchanged, replace that placeholder with the stored encrypted
- * env/header value so tests and saves round-trip the real credential without
- * exposing plaintext in the browser.
+ * env/header/OAuth state value so tests and saves round-trip the real
+ * credential without exposing plaintext in the browser.
  */
 export declare function substituteRedactedMcpCredentials(server: MCPServerConfig): Promise<MCPServerConfig>;

package/dist/api/mcp-service/mcp-redacted-credentials.js

@@ -1,46 +1,45 @@
-import e from "../settings-service/settings-service.api.js";
-import "../../utils/mcp-config.js";
+import { hasRedactedMcpSecretLeaf as e } from "../../utils/mcp-config.js";
+import t from "../settings-service/settings-service.api.js";
+import { isMcpAuthCredential as n } from "../../types/mcp-auth.js";
 //#region src/api/mcp-service/mcp-redacted-credentials.ts
-var t = (e) => !!e && typeof e == "object" && !Array.isArray(e), n = (e) => {
-	if (!t(e)) return;
-	let n = Object.entries(e).filter((e) => typeof e[1] == "string");
-	return n.length > 0 ? Object.fromEntries(n) : void 0;
-}, r = (e) => !!e && Object.values(e).some((e) => e === "<redacted>"), i = (e, t) => e === "sse" ? t === "sse" : e === "shttp" ? t === void 0 || t === "http" || t === "shttp" || t === "streamable-http" : !1, a = (e) => {
+var r = (e) => !!e && typeof e == "object" && !Array.isArray(e), i = (e) => {
+	if (!r(e)) return;
+	let t = Object.entries(e).filter((e) => typeof e[1] == "string");
+	return t.length > 0 ? Object.fromEntries(t) : void 0;
+}, a = (e) => !!e && Object.values(e).some((e) => e === "**********"), o = (e, t) => e === "sse" ? t === "sse" : e === "shttp" ? t === void 0 || t === "http" || t === "shttp" || t === "streamable-http" : !1, s = (e) => {
 	if (!e) return;
 	let t = /^stdio-(\d+)$/.exec(e);
 	return t ? Number.parseInt(t[1], 10) : void 0;
-}, o = (e, t) => {
-	let n = a(e);
+}, c = (e, t) => {
+	let n = s(e);
 	if (n !== void 0) return Object.entries(t).filter(([, e]) => !e.url)[n]?.[1];
-}, s = (e, t) => e.type === "stdio" ? o(e.id, t) ?? (e.name ? t[e.name] : void 0) : e.name && t[e.name] ? t[e.name] : Object.values(t).find((t) => t.url === e.url && i(e.type, t.transport));
-async function c(n) {
-	let r = (await e.fetchSettingsFromApi("encrypted")).agent_settings?.mcp_config;
-	if (!(!t(r) || !t(r.mcpServers))) return s(n, r.mcpServers);
+}, l = (e, t) => e.type === "stdio" ? c(e.id, t) ?? (e.name ? t[e.name] : void 0) : e.name && t[e.name] ? t[e.name] : Object.values(t).find((t) => t.url === e.url && o(e.type, t.transport));
+async function u(e) {
+	let n = (await t.fetchSettingsFromApi("encrypted")).agent_settings?.mcp_config;
+	if (r(n)) return l(e, n);
 }
-async function l(e) {
-	let t = e.type === "stdio" && r(e.env), i = (e.type === "sse" || e.type === "shttp") && e.api_key === "<redacted>";
-	if (!t && !i) return e;
+async function d(t) {
+	let r = t.type === "stdio" && a(t.env), o = (t.type === "sse" || t.type === "shttp") && e(t.auth);
+	if (!r && !o) return t;
 	try {
-		let r = await c(e);
-		if (!r) return e;
-		if (t) {
-			let t = n(r.env) ?? {}, i = Object.fromEntries(Object.entries(e.env ?? {}).map(([e, n]) => [e, n === "<redacted>" && typeof t[e] == "string" ? t[e] : n]));
+		let e = await u(t);
+		if (!e) return t;
+		if (r) {
+			let n = i(e.env) ?? {}, r = Object.fromEntries(Object.entries(t.env ?? {}).map(([e, t]) => [e, t === "**********" && typeof n[e] == "string" ? n[e] : t]));
 			return {
-				...e,
-				env: i
+				...t,
+				env: r
 			};
 		}
-		let i = n(r.headers);
-		return i ? {
-			...e,
-			api_key: void 0,
-			headers: i
-		} : e;
+		return o && n(e.auth) ? {
+			...t,
+			auth: e.auth
+		} : t;
 	} catch {
-		return e;
+		return t;
 	}
 }
 //#endregion
-export { l as substituteRedactedMcpCredentials };
+export { d as substituteRedactedMcpCredentials };
 
 //# sourceMappingURL=mcp-redacted-credentials.js.map