@openhands/agent-canvas 1.1.0 → 1.2.1

package/dist/api/profiles-service/profiles-service.api.js

@@ -1,28 +1,35 @@
 import { ProfilesClient as e } from "../../node_modules/@openhands/typescript-client/dist/client/profiles-client.js";
-import { getAgentServerClientOptions as t } from "../agent-server-client-options.js";
+import "../../node_modules/@openhands/typescript-client/dist/clients.js";
+import { getActiveBackend as t } from "../backend-registry/active-store.js";
+import { getAgentServerClientOptions as n } from "../agent-server-client-options.js";
+import { activateCloudProfile as r, deleteCloudProfile as i, fetchCloudProfile as a, fetchCloudProfiles as o, renameCloudProfile as s, saveCloudProfile as c } from "../cloud/profiles-service.api.js";
 //#region src/api/profiles-service/profiles-service.api.ts
-var n = class {
+function l() {
+	return t().backend.kind === "cloud";
+}
+var u = class {
 	static async listProfiles() {
-		return new e(t()).listProfiles();
+		return l() ? o() : new e(n()).listProfiles();
 	}
-	static async getProfile(n, r) {
+	static async getProfile(t, r) {
+		if (l()) return a(t);
 		let i = r ? { exposeSecrets: r } : {};
-		return new e(t()).getProfile(n, i);
+		return new e(n()).getProfile(t, i);
 	}
-	static async saveProfile(n, r) {
-		return new e(t()).saveProfile(n, r);
+	static async saveProfile(t, r) {
+		return l() ? c(t, r) : new e(n()).saveProfile(t, r);
 	}
-	static async deleteProfile(n) {
-		return new e(t()).deleteProfile(n);
+	static async deleteProfile(t) {
+		return l() ? i(t) : new e(n()).deleteProfile(t);
 	}
-	static async renameProfile(n, r) {
-		return new e(t()).renameProfile(n, r);
+	static async renameProfile(t, r) {
+		return l() ? s(t, r) : new e(n()).renameProfile(t, r);
 	}
-	static async activateProfile(n) {
-		return new e(t()).activateProfile(n);
+	static async activateProfile(t) {
+		return l() ? r(t) : new e(n()).activateProfile(t);
 	}
 };
 //#endregion
-export { n as default };
+export { u as default };
 
 //# sourceMappingURL=profiles-service.api.js.map

package/dist/api/profiles-service/profiles-service.api.js.map

@@ -1 +1 @@
-{"version":3,"file":"profiles-service.api.js","names":[],"sources":["../../../src/api/profiles-service/profiles-service.api.ts"],"sourcesContent":["/**\n * ProfilesService provides a thin wrapper around the SDK's ProfilesClient,\n * creating a client per-call to pick up current backend configuration.\n *\n * Uses ProfilesClient from @openhands/typescript-client v0.2.0+.\n * All types are re-exported from the SDK for consumer convenience.\n *\n * Note: Unlike some SDK clients, we don't call client.close() here for\n * consistency with other services (SettingsService, SecretsService) that\n * also create SDK clients without explicit cleanup. The SDK clients use\n * fetch-based HTTP which doesn't require connection cleanup.\n */\nimport {\n  ProfilesClient,\n  type GetProfileOptions,\n} from \"@openhands/typescript-client/clients\";\nimport type {\n  ProfileInfo,\n  ProfileListResponse,\n  ProfileDetailResponse,\n  ProfileMutationResponse,\n  ActivateProfileResponse,\n  SaveProfileRequest,\n  ExposeSecretsMode,\n} from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\n\n// Re-export SDK types for consumers\nexport type {\n  ProfileInfo,\n  ProfileListResponse,\n  ProfileDetailResponse,\n  ProfileMutationResponse,\n  ActivateProfileResponse,\n  SaveProfileRequest,\n  ExposeSecretsMode,\n};\n\nclass ProfilesService {\n  static async listProfiles(): Promise<ProfileListResponse> {\n    return new ProfilesClient(getAgentServerClientOptions()).listProfiles();\n  }\n\n  static async getProfile(\n    name: string,\n    exposeSecrets?: ExposeSecretsMode,\n  ): Promise<ProfileDetailResponse> {\n    const options: GetProfileOptions = exposeSecrets ? { exposeSecrets } : {};\n    return new ProfilesClient(getAgentServerClientOptions()).getProfile(\n      name,\n      options,\n    );\n  }\n\n  static async saveProfile(\n    name: string,\n    request: SaveProfileRequest,\n  ): Promise<ProfileMutationResponse> {\n    return new ProfilesClient(getAgentServerClientOptions()).saveProfile(\n      name,\n      request,\n    );\n  }\n\n  static async deleteProfile(name: string): Promise<ProfileMutationResponse> {\n    return new ProfilesClient(getAgentServerClientOptions()).deleteProfile(\n      name,\n    );\n  }\n\n  static async renameProfile(\n    name: string,\n    newName: string,\n  ): Promise<ProfileMutationResponse> {\n    return new ProfilesClient(getAgentServerClientOptions()).renameProfile(\n      name,\n      newName,\n    );\n  }\n\n  static async activateProfile(name: string): Promise<ActivateProfileResponse> {\n    return new ProfilesClient(getAgentServerClientOptions()).activateProfile(\n      name,\n    );\n  }\n}\n\nexport default ProfilesService;\n"],"mappings":";;;AAsCA,IAAM,IAAN,MAAsB;CACpB,aAAa,eAA6C;AACxD,SAAO,IAAI,EAAe,GAA6B,CAAC,CAAC,cAAc;;CAGzE,aAAa,WACX,GACA,GACgC;EAChC,IAAM,IAA6B,IAAgB,EAAE,kBAAe,GAAG,EAAE;AACzE,SAAO,IAAI,EAAe,GAA6B,CAAC,CAAC,WACvD,GACA,EACD;;CAGH,aAAa,YACX,GACA,GACkC;AAClC,SAAO,IAAI,EAAe,GAA6B,CAAC,CAAC,YACvD,GACA,EACD;;CAGH,aAAa,cAAc,GAAgD;AACzE,SAAO,IAAI,EAAe,GAA6B,CAAC,CAAC,cACvD,EACD;;CAGH,aAAa,cACX,GACA,GACkC;AAClC,SAAO,IAAI,EAAe,GAA6B,CAAC,CAAC,cACvD,GACA,EACD;;CAGH,aAAa,gBAAgB,GAAgD;AAC3E,SAAO,IAAI,EAAe,GAA6B,CAAC,CAAC,gBACvD,EACD"}
+{"version":3,"file":"profiles-service.api.js","names":[],"sources":["../../../src/api/profiles-service/profiles-service.api.ts"],"sourcesContent":["/**\n * ProfilesService is the single entry point for LLM-profile CRUD, routing per\n * active backend so callers (hooks, the settings manager) stay backend-agnostic:\n * - local agent-server: the SDK's ProfilesClient (`/api/profiles`), created\n *   per-call to pick up current backend configuration;\n * - cloud app-server: `src/api/cloud/profiles-service.api.ts` (the org-gated\n *   `/api/organizations/{orgId}/profiles` routes, or the per-user settings\n *   route as a fallback) via the org-scoped cloud proxy.\n * This mirrors how SettingsService branches to fetchCloudSettings().\n *\n * Uses ProfilesClient from @openhands/typescript-client v0.2.0+.\n * All types are re-exported from the SDK for consumer convenience.\n *\n * Note: Unlike some SDK clients, we don't call client.close() here for\n * consistency with other services (SettingsService, SecretsService) that\n * also create SDK clients without explicit cleanup. The SDK clients use\n * fetch-based HTTP which doesn't require connection cleanup.\n */\nimport {\n  ProfilesClient,\n  type GetProfileOptions,\n} from \"@openhands/typescript-client/clients\";\nimport type {\n  ProfileInfo,\n  ProfileListResponse,\n  ProfileDetailResponse,\n  ProfileMutationResponse,\n  ActivateProfileResponse,\n  SaveProfileRequest,\n  ExposeSecretsMode,\n} from \"@openhands/typescript-client\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport {\n  activateCloudProfile,\n  deleteCloudProfile,\n  fetchCloudProfile,\n  fetchCloudProfiles,\n  renameCloudProfile,\n  saveCloudProfile,\n} from \"../cloud/profiles-service.api\";\n\n// Re-export SDK types for consumers\nexport type {\n  ProfileInfo,\n  ProfileListResponse,\n  ProfileDetailResponse,\n  ProfileMutationResponse,\n  ActivateProfileResponse,\n  SaveProfileRequest,\n  ExposeSecretsMode,\n};\n\nfunction isCloudBackend(): boolean {\n  return getActiveBackend().backend.kind === \"cloud\";\n}\n\nclass ProfilesService {\n  static async listProfiles(): Promise<ProfileListResponse> {\n    if (isCloudBackend()) return fetchCloudProfiles();\n    return new ProfilesClient(getAgentServerClientOptions()).listProfiles();\n  }\n\n  static async getProfile(\n    name: string,\n    exposeSecrets?: ExposeSecretsMode,\n  ): Promise<ProfileDetailResponse> {\n    // Cloud never exposes profile secrets (api_key is always nulled with an\n    // api_key_set flag), so `exposeSecrets` is local-only.\n    if (isCloudBackend()) return fetchCloudProfile(name);\n    const options: GetProfileOptions = exposeSecrets ? { exposeSecrets } : {};\n    return new ProfilesClient(getAgentServerClientOptions()).getProfile(\n      name,\n      options,\n    );\n  }\n\n  static async saveProfile(\n    name: string,\n    request: SaveProfileRequest,\n  ): Promise<ProfileMutationResponse> {\n    if (isCloudBackend()) return saveCloudProfile(name, request);\n    return new ProfilesClient(getAgentServerClientOptions()).saveProfile(\n      name,\n      request,\n    );\n  }\n\n  static async deleteProfile(name: string): Promise<ProfileMutationResponse> {\n    if (isCloudBackend()) return deleteCloudProfile(name);\n    return new ProfilesClient(getAgentServerClientOptions()).deleteProfile(\n      name,\n    );\n  }\n\n  static async renameProfile(\n    name: string,\n    newName: string,\n  ): Promise<ProfileMutationResponse> {\n    if (isCloudBackend()) return renameCloudProfile(name, newName);\n    return new ProfilesClient(getAgentServerClientOptions()).renameProfile(\n      name,\n      newName,\n    );\n  }\n\n  static async activateProfile(name: string): Promise<ActivateProfileResponse> {\n    if (isCloudBackend()) return activateCloudProfile(name);\n    return new ProfilesClient(getAgentServerClientOptions()).activateProfile(\n      name,\n    );\n  }\n}\n\nexport default ProfilesService;\n"],"mappings":";;;;;;AAqDA,SAAS,IAA0B;AACjC,QAAO,GAAkB,CAAC,QAAQ,SAAS;;AAG7C,IAAM,IAAN,MAAsB;CACpB,aAAa,eAA6C;AAExD,SADI,GAAgB,GAAS,GAAoB,GAC1C,IAAI,EAAe,GAA6B,CAAC,CAAC,cAAc;;CAGzE,aAAa,WACX,GACA,GACgC;AAGhC,MAAI,GAAgB,CAAE,QAAO,EAAkB,EAAK;EACpD,IAAM,IAA6B,IAAgB,EAAE,kBAAe,GAAG,EAAE;AACzE,SAAO,IAAI,EAAe,GAA6B,CAAC,CAAC,WACvD,GACA,EACD;;CAGH,aAAa,YACX,GACA,GACkC;AAElC,SADI,GAAgB,GAAS,EAAiB,GAAM,EAAQ,GACrD,IAAI,EAAe,GAA6B,CAAC,CAAC,YACvD,GACA,EACD;;CAGH,aAAa,cAAc,GAAgD;AAEzE,SADI,GAAgB,GAAS,EAAmB,EAAK,GAC9C,IAAI,EAAe,GAA6B,CAAC,CAAC,cACvD,EACD;;CAGH,aAAa,cACX,GACA,GACkC;AAElC,SADI,GAAgB,GAAS,EAAmB,GAAM,EAAQ,GACvD,IAAI,EAAe,GAA6B,CAAC,CAAC,cACvD,GACA,EACD;;CAGH,aAAa,gBAAgB,GAAgD;AAE3E,SADI,GAAgB,GAAS,EAAqB,EAAK,GAChD,IAAI,EAAe,GAA6B,CAAC,CAAC,gBACvD,EACD"}

package/dist/api/runtime-service/agent-server-runtime-service.cjs

@@ -1,2 +1,2 @@
-require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../../node_modules/@openhands/typescript-client/dist/client/file-client.cjs`),t=require(`../../utils/websocket-url.cjs`),n=require(`../backend-registry/active-store.cjs`),r=require(`../agent-server-client-options.cjs`),i=require(`../cloud/proxy.cjs`),a=require(`../../node_modules/@openhands/typescript-client/dist/workspace/remote-workspace.cjs`);var o=class{static async executeCommand(e,o,s,c,l=30){let u=n.getActiveBackend().backend;if(u.kind===`cloud`&&e){let n=await i.callCloudProxy({backend:u,method:`POST`,hostOverride:t.buildHttpBaseUrl(e),path:`/api/bash/execute_bash_command`,body:{command:s,...c?{cwd:c}:{},timeout:Math.floor(l)},authMode:`session-api-key`,sessionApiKey:o,timeoutSeconds:l+10});return{exit_code:n.exit_code??-1,stdout:n.stdout??``,stderr:n.stderr??``}}let d=await new a.RemoteWorkspace(r.getAgentServerClientOptions({conversationUrl:e,sessionApiKey:o})).executeCommand(s,c,l);return{exit_code:d.exit_code,stdout:d.stdout,stderr:d.stderr}}static async downloadFile(a,o,s){let c=n.getActiveBackend().backend;return c.kind===`cloud`&&a?(await i.callCloudProxy({backend:c,method:`GET`,hostOverride:t.buildHttpBaseUrl(a),path:`/api/file/download?path=${encodeURIComponent(s)}`,authMode:`session-api-key`,sessionApiKey:o,responseType:`blob`})).arrayBuffer():new e.FileClient(r.getAgentServerClientOptions({conversationUrl:a,sessionApiKey:o})).downloadFile(s)}};exports.default=o;
+require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../../node_modules/@openhands/typescript-client/dist/client/file-client.cjs`);require(`../../node_modules/@openhands/typescript-client/dist/clients.cjs`);const t=require(`../../utils/websocket-url.cjs`),n=require(`../backend-registry/active-store.cjs`),r=require(`../agent-server-client-options.cjs`),i=require(`../cloud/proxy.cjs`),a=require(`../../node_modules/@openhands/typescript-client/dist/workspace/remote-workspace.cjs`);var o=class{static async executeCommand(e,o,s,c,l=30){let u=n.getActiveBackend().backend;if(u.kind===`cloud`&&e){let n=await i.callCloudProxy({backend:u,method:`POST`,hostOverride:t.buildHttpBaseUrl(e),path:`/api/bash/execute_bash_command`,body:{command:s,...c?{cwd:c}:{},timeout:Math.floor(l)},authMode:`session-api-key`,sessionApiKey:o,timeoutSeconds:l+10});return{exit_code:n.exit_code??-1,stdout:n.stdout??``,stderr:n.stderr??``}}let d=await new a.RemoteWorkspace(r.getAgentServerClientOptions({conversationUrl:e,sessionApiKey:o})).executeCommand(s,c,l);return{exit_code:d.exit_code,stdout:d.stdout,stderr:d.stderr}}static async downloadFile(a,o,s){let c=n.getActiveBackend().backend;return c.kind===`cloud`&&a?(await i.callCloudProxy({backend:c,method:`GET`,hostOverride:t.buildHttpBaseUrl(a),path:`/api/file/download?path=${encodeURIComponent(s)}`,authMode:`session-api-key`,sessionApiKey:o,responseType:`blob`})).arrayBuffer():new e.FileClient(r.getAgentServerClientOptions({conversationUrl:a,sessionApiKey:o})).downloadFile(s)}};exports.default=o;
 //# sourceMappingURL=agent-server-runtime-service.cjs.map

package/dist/api/runtime-service/agent-server-runtime-service.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"agent-server-runtime-service.cjs","names":[],"sources":["../../../src/api/runtime-service/agent-server-runtime-service.ts"],"sourcesContent":["import { FileClient } from \"@openhands/typescript-client/clients\";\nimport { RemoteWorkspace } from \"@openhands/typescript-client/workspace/remote-workspace\";\nimport { getAgentServerClientOptions } from \"#/api/agent-server-client-options\";\nimport { getActiveBackend } from \"#/api/backend-registry/active-store\";\nimport { callCloudProxy } from \"#/api/cloud/proxy\";\nimport { buildHttpBaseUrl } from \"#/utils/websocket-url\";\n\nexport interface CommandResult {\n  exit_code: number;\n  stdout: string;\n  stderr: string;\n}\n\n/**\n * Cloud-aware runtime operations for agent-server conversations.\n *\n * In **local** mode the runtime is reachable directly from the browser\n * (e.g. `127.0.0.1:18000`) so the SDK's typed clients work fine.\n * In **cloud** mode the runtime lives at `*.prod-runtime.all-hands.dev`,\n * which doesn't allow CORS from `localhost`, so all calls go through\n * `callCloudProxy` with the runtime URL as `hostOverride` and the\n * conversation's `session_api_key` as auth — server-side hop, no CORS.\n */\nclass AgentServerRuntimeService {\n  static async executeCommand(\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    command: string,\n    cwd?: string,\n    timeout = 30,\n  ): Promise<CommandResult> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationUrl) {\n      const output = await callCloudProxy<{\n        exit_code?: number;\n        stdout?: string;\n        stderr?: string;\n      }>({\n        backend: active,\n        method: \"POST\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: \"/api/bash/execute_bash_command\",\n        body: {\n          command,\n          ...(cwd ? { cwd } : {}),\n          timeout: Math.floor(timeout),\n        },\n        authMode: \"session-api-key\",\n        sessionApiKey,\n        timeoutSeconds: timeout + 10,\n      });\n      return {\n        exit_code: output.exit_code ?? -1,\n        stdout: output.stdout ?? \"\",\n        stderr: output.stderr ?? \"\",\n      };\n    }\n\n    const result = await new RemoteWorkspace(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).executeCommand(command, cwd, timeout);\n    return {\n      exit_code: result.exit_code,\n      stdout: result.stdout,\n      stderr: result.stderr,\n    };\n  }\n\n  static async downloadFile(\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n  ): Promise<ArrayBuffer> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationUrl) {\n      const blob = await callCloudProxy<Blob>({\n        backend: active,\n        method: \"GET\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: `/api/file/download?path=${encodeURIComponent(path)}`,\n        authMode: \"session-api-key\",\n        sessionApiKey,\n        responseType: \"blob\",\n      });\n      return blob.arrayBuffer();\n    }\n\n    return new FileClient(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).downloadFile(path);\n  }\n}\n\nexport default AgentServerRuntimeService;\n"],"mappings":"6ZAuBA,IAAM,EAAN,KAAgC,CAC9B,aAAa,eACX,EACA,EACA,EACA,EACA,EAAU,GACc,CACxB,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAElC,GAAI,EAAO,OAAS,SAAW,EAAiB,CAC9C,IAAM,EAAS,MAAM,EAAA,eAIlB,CACD,QAAS,EACT,OAAQ,OACR,aAAc,EAAA,iBAAiB,EAAgB,CAC/C,KAAM,iCACN,KAAM,CACJ,UACA,GAAI,EAAM,CAAE,MAAK,CAAG,EAAE,CACtB,QAAS,KAAK,MAAM,EAAQ,CAC7B,CACD,SAAU,kBACV,gBACA,eAAgB,EAAU,GAC3B,CAAC,CACF,MAAO,CACL,UAAW,EAAO,WAAa,GAC/B,OAAQ,EAAO,QAAU,GACzB,OAAQ,EAAO,QAAU,GAC1B,CAGH,IAAM,EAAS,MAAM,IAAI,EAAA,gBACvB,EAAA,4BAA4B,CAAE,kBAAiB,gBAAe,CAAC,CAChE,CAAC,eAAe,EAAS,EAAK,EAAQ,CACvC,MAAO,CACL,UAAW,EAAO,UAClB,OAAQ,EAAO,OACf,OAAQ,EAAO,OAChB,CAGH,aAAa,aACX,EACA,EACA,EACsB,CACtB,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAelC,OAbI,EAAO,OAAS,SAAW,GAUtB,MATY,EAAA,eAAqB,CACtC,QAAS,EACT,OAAQ,MACR,aAAc,EAAA,iBAAiB,EAAgB,CAC/C,KAAM,2BAA2B,mBAAmB,EAAK,GACzD,SAAU,kBACV,gBACA,aAAc,OACf,CAAC,EACU,aAAa,CAGpB,IAAI,EAAA,WACT,EAAA,4BAA4B,CAAE,kBAAiB,gBAAe,CAAC,CAChE,CAAC,aAAa,EAAK"}
+{"version":3,"file":"agent-server-runtime-service.cjs","names":[],"sources":["../../../src/api/runtime-service/agent-server-runtime-service.ts"],"sourcesContent":["import { FileClient } from \"@openhands/typescript-client/clients\";\nimport { RemoteWorkspace } from \"@openhands/typescript-client/workspace/remote-workspace\";\nimport { getAgentServerClientOptions } from \"#/api/agent-server-client-options\";\nimport { getActiveBackend } from \"#/api/backend-registry/active-store\";\nimport { callCloudProxy } from \"#/api/cloud/proxy\";\nimport { buildHttpBaseUrl } from \"#/utils/websocket-url\";\n\nexport interface CommandResult {\n  exit_code: number;\n  stdout: string;\n  stderr: string;\n}\n\n/**\n * Cloud-aware runtime operations for agent-server conversations.\n *\n * In **local** mode the runtime is reachable directly from the browser\n * (e.g. `127.0.0.1:18000`) so the SDK's typed clients work fine.\n * In **cloud** mode the runtime lives at `*.prod-runtime.all-hands.dev`,\n * which doesn't allow CORS from `localhost`, so all calls go through\n * `callCloudProxy` with the runtime URL as `hostOverride` and the\n * conversation's `session_api_key` as auth — server-side hop, no CORS.\n */\nclass AgentServerRuntimeService {\n  static async executeCommand(\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    command: string,\n    cwd?: string,\n    timeout = 30,\n  ): Promise<CommandResult> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationUrl) {\n      const output = await callCloudProxy<{\n        exit_code?: number;\n        stdout?: string;\n        stderr?: string;\n      }>({\n        backend: active,\n        method: \"POST\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: \"/api/bash/execute_bash_command\",\n        body: {\n          command,\n          ...(cwd ? { cwd } : {}),\n          timeout: Math.floor(timeout),\n        },\n        authMode: \"session-api-key\",\n        sessionApiKey,\n        timeoutSeconds: timeout + 10,\n      });\n      return {\n        exit_code: output.exit_code ?? -1,\n        stdout: output.stdout ?? \"\",\n        stderr: output.stderr ?? \"\",\n      };\n    }\n\n    const result = await new RemoteWorkspace(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).executeCommand(command, cwd, timeout);\n    return {\n      exit_code: result.exit_code,\n      stdout: result.stdout,\n      stderr: result.stderr,\n    };\n  }\n\n  static async downloadFile(\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n  ): Promise<ArrayBuffer> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationUrl) {\n      const blob = await callCloudProxy<Blob>({\n        backend: active,\n        method: \"GET\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: `/api/file/download?path=${encodeURIComponent(path)}`,\n        authMode: \"session-api-key\",\n        sessionApiKey,\n        responseType: \"blob\",\n      });\n      return blob.arrayBuffer();\n    }\n\n    return new FileClient(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).downloadFile(path);\n  }\n}\n\nexport default AgentServerRuntimeService;\n"],"mappings":"+eAuBA,IAAM,EAAN,KAAgC,CAC9B,aAAa,eACX,EACA,EACA,EACA,EACA,EAAU,GACc,CACxB,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAElC,GAAI,EAAO,OAAS,SAAW,EAAiB,CAC9C,IAAM,EAAS,MAAM,EAAA,eAIlB,CACD,QAAS,EACT,OAAQ,OACR,aAAc,EAAA,iBAAiB,EAAgB,CAC/C,KAAM,iCACN,KAAM,CACJ,UACA,GAAI,EAAM,CAAE,MAAK,CAAG,EAAE,CACtB,QAAS,KAAK,MAAM,EAAQ,CAC7B,CACD,SAAU,kBACV,gBACA,eAAgB,EAAU,GAC3B,CAAC,CACF,MAAO,CACL,UAAW,EAAO,WAAa,GAC/B,OAAQ,EAAO,QAAU,GACzB,OAAQ,EAAO,QAAU,GAC1B,CAGH,IAAM,EAAS,MAAM,IAAI,EAAA,gBACvB,EAAA,4BAA4B,CAAE,kBAAiB,gBAAe,CAAC,CAChE,CAAC,eAAe,EAAS,EAAK,EAAQ,CACvC,MAAO,CACL,UAAW,EAAO,UAClB,OAAQ,EAAO,OACf,OAAQ,EAAO,OAChB,CAGH,aAAa,aACX,EACA,EACA,EACsB,CACtB,IAAM,EAAS,EAAA,kBAAkB,CAAC,QAelC,OAbI,EAAO,OAAS,SAAW,GAUtB,MATY,EAAA,eAAqB,CACtC,QAAS,EACT,OAAQ,MACR,aAAc,EAAA,iBAAiB,EAAgB,CAC/C,KAAM,2BAA2B,mBAAmB,EAAK,GACzD,SAAU,kBACV,gBACA,aAAc,OACf,CAAC,EACU,aAAa,CAGpB,IAAI,EAAA,WACT,EAAA,4BAA4B,CAAE,kBAAiB,gBAAe,CAAC,CAChE,CAAC,aAAa,EAAK"}

package/dist/api/runtime-service/agent-server-runtime-service.js

@@ -1,4 +1,5 @@
 import { FileClient as e } from "../../node_modules/@openhands/typescript-client/dist/client/file-client.js";
+import "../../node_modules/@openhands/typescript-client/dist/clients.js";
 import { buildHttpBaseUrl as t } from "../../utils/websocket-url.js";
 import { getActiveBackend as n } from "../backend-registry/active-store.js";
 import { getAgentServerClientOptions as r } from "../agent-server-client-options.js";

package/dist/api/runtime-service/agent-server-runtime-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-server-runtime-service.js","names":[],"sources":["../../../src/api/runtime-service/agent-server-runtime-service.ts"],"sourcesContent":["import { FileClient } from \"@openhands/typescript-client/clients\";\nimport { RemoteWorkspace } from \"@openhands/typescript-client/workspace/remote-workspace\";\nimport { getAgentServerClientOptions } from \"#/api/agent-server-client-options\";\nimport { getActiveBackend } from \"#/api/backend-registry/active-store\";\nimport { callCloudProxy } from \"#/api/cloud/proxy\";\nimport { buildHttpBaseUrl } from \"#/utils/websocket-url\";\n\nexport interface CommandResult {\n  exit_code: number;\n  stdout: string;\n  stderr: string;\n}\n\n/**\n * Cloud-aware runtime operations for agent-server conversations.\n *\n * In **local** mode the runtime is reachable directly from the browser\n * (e.g. `127.0.0.1:18000`) so the SDK's typed clients work fine.\n * In **cloud** mode the runtime lives at `*.prod-runtime.all-hands.dev`,\n * which doesn't allow CORS from `localhost`, so all calls go through\n * `callCloudProxy` with the runtime URL as `hostOverride` and the\n * conversation's `session_api_key` as auth — server-side hop, no CORS.\n */\nclass AgentServerRuntimeService {\n  static async executeCommand(\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    command: string,\n    cwd?: string,\n    timeout = 30,\n  ): Promise<CommandResult> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationUrl) {\n      const output = await callCloudProxy<{\n        exit_code?: number;\n        stdout?: string;\n        stderr?: string;\n      }>({\n        backend: active,\n        method: \"POST\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: \"/api/bash/execute_bash_command\",\n        body: {\n          command,\n          ...(cwd ? { cwd } : {}),\n          timeout: Math.floor(timeout),\n        },\n        authMode: \"session-api-key\",\n        sessionApiKey,\n        timeoutSeconds: timeout + 10,\n      });\n      return {\n        exit_code: output.exit_code ?? -1,\n        stdout: output.stdout ?? \"\",\n        stderr: output.stderr ?? \"\",\n      };\n    }\n\n    const result = await new RemoteWorkspace(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).executeCommand(command, cwd, timeout);\n    return {\n      exit_code: result.exit_code,\n      stdout: result.stdout,\n      stderr: result.stderr,\n    };\n  }\n\n  static async downloadFile(\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n  ): Promise<ArrayBuffer> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationUrl) {\n      const blob = await callCloudProxy<Blob>({\n        backend: active,\n        method: \"GET\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: `/api/file/download?path=${encodeURIComponent(path)}`,\n        authMode: \"session-api-key\",\n        sessionApiKey,\n        responseType: \"blob\",\n      });\n      return blob.arrayBuffer();\n    }\n\n    return new FileClient(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).downloadFile(path);\n  }\n}\n\nexport default AgentServerRuntimeService;\n"],"mappings":";;;;;;;AAuBA,IAAM,IAAN,MAAgC;CAC9B,aAAa,eACX,GACA,GACA,GACA,GACA,IAAU,IACc;EACxB,IAAM,IAAS,GAAkB,CAAC;AAElC,MAAI,EAAO,SAAS,WAAW,GAAiB;GAC9C,IAAM,IAAS,MAAM,EAIlB;IACD,SAAS;IACT,QAAQ;IACR,cAAc,EAAiB,EAAgB;IAC/C,MAAM;IACN,MAAM;KACJ;KACA,GAAI,IAAM,EAAE,QAAK,GAAG,EAAE;KACtB,SAAS,KAAK,MAAM,EAAQ;KAC7B;IACD,UAAU;IACV;IACA,gBAAgB,IAAU;IAC3B,CAAC;AACF,UAAO;IACL,WAAW,EAAO,aAAa;IAC/B,QAAQ,EAAO,UAAU;IACzB,QAAQ,EAAO,UAAU;IAC1B;;EAGH,IAAM,IAAS,MAAM,IAAI,EACvB,EAA4B;GAAE;GAAiB;GAAe,CAAC,CAChE,CAAC,eAAe,GAAS,GAAK,EAAQ;AACvC,SAAO;GACL,WAAW,EAAO;GAClB,QAAQ,EAAO;GACf,QAAQ,EAAO;GAChB;;CAGH,aAAa,aACX,GACA,GACA,GACsB;EACtB,IAAM,IAAS,GAAkB,CAAC;AAelC,SAbI,EAAO,SAAS,WAAW,KAUtB,MATY,EAAqB;GACtC,SAAS;GACT,QAAQ;GACR,cAAc,EAAiB,EAAgB;GAC/C,MAAM,2BAA2B,mBAAmB,EAAK;GACzD,UAAU;GACV;GACA,cAAc;GACf,CAAC,EACU,aAAa,GAGpB,IAAI,EACT,EAA4B;GAAE;GAAiB;GAAe,CAAC,CAChE,CAAC,aAAa,EAAK"}
+{"version":3,"file":"agent-server-runtime-service.js","names":[],"sources":["../../../src/api/runtime-service/agent-server-runtime-service.ts"],"sourcesContent":["import { FileClient } from \"@openhands/typescript-client/clients\";\nimport { RemoteWorkspace } from \"@openhands/typescript-client/workspace/remote-workspace\";\nimport { getAgentServerClientOptions } from \"#/api/agent-server-client-options\";\nimport { getActiveBackend } from \"#/api/backend-registry/active-store\";\nimport { callCloudProxy } from \"#/api/cloud/proxy\";\nimport { buildHttpBaseUrl } from \"#/utils/websocket-url\";\n\nexport interface CommandResult {\n  exit_code: number;\n  stdout: string;\n  stderr: string;\n}\n\n/**\n * Cloud-aware runtime operations for agent-server conversations.\n *\n * In **local** mode the runtime is reachable directly from the browser\n * (e.g. `127.0.0.1:18000`) so the SDK's typed clients work fine.\n * In **cloud** mode the runtime lives at `*.prod-runtime.all-hands.dev`,\n * which doesn't allow CORS from `localhost`, so all calls go through\n * `callCloudProxy` with the runtime URL as `hostOverride` and the\n * conversation's `session_api_key` as auth — server-side hop, no CORS.\n */\nclass AgentServerRuntimeService {\n  static async executeCommand(\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    command: string,\n    cwd?: string,\n    timeout = 30,\n  ): Promise<CommandResult> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationUrl) {\n      const output = await callCloudProxy<{\n        exit_code?: number;\n        stdout?: string;\n        stderr?: string;\n      }>({\n        backend: active,\n        method: \"POST\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: \"/api/bash/execute_bash_command\",\n        body: {\n          command,\n          ...(cwd ? { cwd } : {}),\n          timeout: Math.floor(timeout),\n        },\n        authMode: \"session-api-key\",\n        sessionApiKey,\n        timeoutSeconds: timeout + 10,\n      });\n      return {\n        exit_code: output.exit_code ?? -1,\n        stdout: output.stdout ?? \"\",\n        stderr: output.stderr ?? \"\",\n      };\n    }\n\n    const result = await new RemoteWorkspace(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).executeCommand(command, cwd, timeout);\n    return {\n      exit_code: result.exit_code,\n      stdout: result.stdout,\n      stderr: result.stderr,\n    };\n  }\n\n  static async downloadFile(\n    conversationUrl: string | null | undefined,\n    sessionApiKey: string | null | undefined,\n    path: string,\n  ): Promise<ArrayBuffer> {\n    const active = getActiveBackend().backend;\n\n    if (active.kind === \"cloud\" && conversationUrl) {\n      const blob = await callCloudProxy<Blob>({\n        backend: active,\n        method: \"GET\",\n        hostOverride: buildHttpBaseUrl(conversationUrl),\n        path: `/api/file/download?path=${encodeURIComponent(path)}`,\n        authMode: \"session-api-key\",\n        sessionApiKey,\n        responseType: \"blob\",\n      });\n      return blob.arrayBuffer();\n    }\n\n    return new FileClient(\n      getAgentServerClientOptions({ conversationUrl, sessionApiKey }),\n    ).downloadFile(path);\n  }\n}\n\nexport default AgentServerRuntimeService;\n"],"mappings":";;;;;;;;AAuBA,IAAM,IAAN,MAAgC;CAC9B,aAAa,eACX,GACA,GACA,GACA,GACA,IAAU,IACc;EACxB,IAAM,IAAS,GAAkB,CAAC;AAElC,MAAI,EAAO,SAAS,WAAW,GAAiB;GAC9C,IAAM,IAAS,MAAM,EAIlB;IACD,SAAS;IACT,QAAQ;IACR,cAAc,EAAiB,EAAgB;IAC/C,MAAM;IACN,MAAM;KACJ;KACA,GAAI,IAAM,EAAE,QAAK,GAAG,EAAE;KACtB,SAAS,KAAK,MAAM,EAAQ;KAC7B;IACD,UAAU;IACV;IACA,gBAAgB,IAAU;IAC3B,CAAC;AACF,UAAO;IACL,WAAW,EAAO,aAAa;IAC/B,QAAQ,EAAO,UAAU;IACzB,QAAQ,EAAO,UAAU;IAC1B;;EAGH,IAAM,IAAS,MAAM,IAAI,EACvB,EAA4B;GAAE;GAAiB;GAAe,CAAC,CAChE,CAAC,eAAe,GAAS,GAAK,EAAQ;AACvC,SAAO;GACL,WAAW,EAAO;GAClB,QAAQ,EAAO;GACf,QAAQ,EAAO;GAChB;;CAGH,aAAa,aACX,GACA,GACA,GACsB;EACtB,IAAM,IAAS,GAAkB,CAAC;AAelC,SAbI,EAAO,SAAS,WAAW,KAUtB,MATY,EAAqB;GACtC,SAAS;GACT,QAAQ;GACR,cAAc,EAAiB,EAAgB;GAC/C,MAAM,2BAA2B,mBAAmB,EAAK;GACzD,UAAU;GACV;GACA,cAAc;GACf,CAAC,EACU,aAAa,GAGpB,IAAI,EACT,EAA4B;GAAE;GAAiB;GAAe,CAAC,CAChE,CAAC,aAAa,EAAK"}

package/dist/api/secrets-service.cjs

@@ -1,2 +1,2 @@
-require(`../_virtual/_rolldown/runtime.cjs`);const e=require(`../node_modules/@openhands/typescript-client/dist/client/settings-client.cjs`),t=require(`./backend-registry/active-store.cjs`),n=require(`./agent-server-client-options.cjs`),r=require(`./cloud/secrets-service.api.cjs`);async function i(e,t=3,n=500){for(let r=0;r<t;r+=1)try{return await e()}catch(e){if(r>=t-1)throw e;let i=n*2**r;await new Promise(e=>{setTimeout(e,i)})}throw Error(`Retry attempts exhausted`)}var a=class{static async getSecrets(){try{return t.getActiveBackend().backend.kind===`cloud`?await i(()=>r.fetchCloudSecrets()):(await i(()=>new e.SettingsClient(n.getAgentServerClientOptions()).listSecrets())).secrets.map(e=>({name:e.name,description:e.description}))}catch(e){return console.error(`Failed to fetch secrets after retries:`,e),[]}}static async createSecret(a,o,s){if(t.getActiveBackend().backend.kind===`cloud`){await i(()=>r.createCloudSecret(a,o,s));return}await i(()=>new e.SettingsClient(n.getAgentServerClientOptions()).upsertSecret({name:a,value:o,description:s}))}static async updateSecret(e,n,a){if(t.getActiveBackend().backend.kind===`cloud`){await i(()=>r.updateCloudSecret(e,n,a));return}await this.createSecret(e,n,a)}static async deleteSecret(a){try{if(t.getActiveBackend().backend.kind===`cloud`){await i(()=>r.deleteCloudSecret(a));return}await i(()=>new e.SettingsClient(n.getAgentServerClientOptions()).deleteSecret(a))}catch(e){if(e&&typeof e==`object`&&`response`in e&&e.response?.status===404)return;throw e}}};exports.SecretsService=a;
+require(`../_virtual/_rolldown/runtime.cjs`);const e=require(`../node_modules/@openhands/typescript-client/dist/client/settings-client.cjs`);require(`../node_modules/@openhands/typescript-client/dist/clients.cjs`);const t=require(`./backend-registry/active-store.cjs`),n=require(`./agent-server-client-options.cjs`),r=require(`./cloud/secrets-service.api.cjs`);async function i(e,t=3,n=500){for(let r=0;r<t;r+=1)try{return await e()}catch(e){if(r>=t-1)throw e;let i=n*2**r;await new Promise(e=>{setTimeout(e,i)})}throw Error(`Retry attempts exhausted`)}var a=class{static async getSecrets(){try{return t.getActiveBackend().backend.kind===`cloud`?await i(()=>r.fetchCloudSecrets()):(await i(()=>new e.SettingsClient(n.getAgentServerClientOptions()).listSecrets())).secrets.map(e=>({name:e.name,description:e.description}))}catch(e){return console.error(`Failed to fetch secrets after retries:`,e),[]}}static async createSecret(a,o,s){if(t.getActiveBackend().backend.kind===`cloud`){await i(()=>r.createCloudSecret(a,o,s));return}await i(()=>new e.SettingsClient(n.getAgentServerClientOptions()).upsertSecret({name:a,value:o,description:s}))}static async updateSecret(e,n,a){if(t.getActiveBackend().backend.kind===`cloud`){await i(()=>r.updateCloudSecret(e,n,a));return}await this.createSecret(e,n,a)}static async deleteSecret(a){try{if(t.getActiveBackend().backend.kind===`cloud`){await i(()=>r.deleteCloudSecret(a));return}await i(()=>new e.SettingsClient(n.getAgentServerClientOptions()).deleteSecret(a))}catch(e){if(e&&typeof e==`object`&&`response`in e&&e.response?.status===404)return;throw e}}};exports.SecretsService=a;
 //# sourceMappingURL=secrets-service.cjs.map

package/dist/api/secrets-service.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-service.cjs","names":[],"sources":["../../src/api/secrets-service.ts"],"sourcesContent":["import { SettingsClient } from \"@openhands/typescript-client/clients\";\nimport { getActiveBackend } from \"./backend-registry/active-store\";\nimport {\n  createCloudSecret,\n  deleteCloudSecret,\n  fetchCloudSecrets,\n  updateCloudSecret,\n} from \"./cloud/secrets-service.api\";\nimport { getAgentServerClientOptions } from \"./agent-server-client-options\";\nimport { CustomSecretWithoutValue } from \"./secrets-service.types\";\n\n/**\n * Retry helper for API calls with exponential backoff.\n */\nasync function withRetry<T>(\n  fn: () => Promise<T>,\n  maxRetries: number = 3,\n  baseDelayMs: number = 500,\n): Promise<T> {\n  for (let attempt = 0; attempt < maxRetries; attempt += 1) {\n    try {\n      return await fn();\n    } catch (error) {\n      if (attempt >= maxRetries - 1) {\n        throw error;\n      }\n\n      const delay = baseDelayMs * 2 ** attempt;\n\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, delay);\n      });\n    }\n  }\n\n  throw new Error(\"Retry attempts exhausted\");\n}\n\nexport class SecretsService {\n  /**\n   * List all custom secrets (names and descriptions only, no values).\n   * Uses the agent-server API endpoint: GET /api/settings/secrets\n   *\n   * Note: The agent-server API doesn't support pagination or search filtering.\n   * All secrets are returned in a single response.\n   */\n  static async getSecrets(): Promise<CustomSecretWithoutValue[]> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        return await withRetry(() => fetchCloudSecrets());\n      }\n      const response = await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).listSecrets(),\n      );\n      return response.secrets.map((s) => ({\n        name: s.name,\n        description: s.description,\n      }));\n    } catch (error) {\n      console.error(\"Failed to fetch secrets after retries:\", error);\n      return [];\n    }\n  }\n\n  /**\n   * Create or update a custom secret (upsert by name).\n   * Uses the agent-server API endpoint: PUT /api/settings/secrets\n   *\n   * @param name - Secret name (must start with letter, contain only letters/numbers/underscores, 1-64 chars)\n   * @param value - Secret value\n   * @param description - Optional description\n   * @throws Error if the API call fails after retries\n   */\n  static async createSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      await withRetry(() => createCloudSecret(name, value, description));\n      return;\n    }\n    await withRetry(() =>\n      new SettingsClient(getAgentServerClientOptions()).upsertSecret({\n        name,\n        value,\n        description,\n      }),\n    );\n  }\n\n  /**\n   * Update a secret's value and/or description.\n   * Uses the same upsert endpoint as createSecret since agent-server\n   * doesn't have a separate update endpoint.\n   *\n   * @param name - Secret name (used as identifier)\n   * @param value - New secret value\n   * @param description - Optional new description\n   * @throws Error if the API call fails after retries\n   */\n  static async updateSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      // The cloud PUT endpoint renames + redescribes only (no value field),\n      // matching what `useUpdateSecret` actually sends:\n      // (secretToEdit=name, newName=value, description).\n      await withRetry(() => updateCloudSecret(name, value, description));\n      return;\n    }\n    // Agent-server uses upsert, so update is the same as create\n    await this.createSecret(name, value, description);\n  }\n\n  /**\n   * Delete a custom secret by name.\n   * Uses the agent-server API endpoint: DELETE /api/settings/secrets/{name}\n   *\n   * @param name - Secret name to delete\n   * @throws Error if the API call fails (except 404, which is treated as success)\n   */\n  static async deleteSecret(name: string): Promise<void> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        await withRetry(() => deleteCloudSecret(name));\n        return;\n      }\n      await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).deleteSecret(name),\n      );\n    } catch (error) {\n      // 404 means secret doesn't exist - treat as successful deletion\n      if (\n        error &&\n        typeof error === \"object\" &&\n        \"response\" in error &&\n        (error as { response?: { status?: number } }).response?.status === 404\n      ) {\n        return;\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":"0RAcA,eAAe,EACb,EACA,EAAqB,EACrB,EAAsB,IACV,CACZ,IAAK,IAAI,EAAU,EAAG,EAAU,EAAY,GAAW,EACrD,GAAI,CACF,OAAO,MAAM,GAAI,OACV,EAAO,CACd,GAAI,GAAW,EAAa,EAC1B,MAAM,EAGR,IAAM,EAAQ,EAAc,GAAK,EAEjC,MAAM,IAAI,QAAe,GAAY,CACnC,WAAW,EAAS,EAAM,EAC1B,CAIN,MAAU,MAAM,2BAA2B,CAG7C,IAAa,EAAb,KAA4B,CAQ1B,aAAa,YAAkD,CAC7D,GAAI,CAOF,OANI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAC/B,MAAM,MAAgB,EAAA,mBAAmB,CAAC,EAK5C,MAHgB,MACrB,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,CAChE,EACe,QAAQ,IAAK,IAAO,CAClC,KAAM,EAAE,KACR,YAAa,EAAE,YAChB,EAAE,OACI,EAAO,CAEd,OADA,QAAQ,MAAM,yCAA0C,EAAM,CACvD,EAAE,EAab,aAAa,aACX,EACA,EACA,EACe,CACf,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAC/C,MAAM,MAAgB,EAAA,kBAAkB,EAAM,EAAO,EAAY,CAAC,CAClE,OAEF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,CAC7D,OACA,QACA,cACD,CAAC,CACH,CAaH,aAAa,aACX,EACA,EACA,EACe,CACf,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAI/C,MAAM,MAAgB,EAAA,kBAAkB,EAAM,EAAO,EAAY,CAAC,CAClE,OAGF,MAAM,KAAK,aAAa,EAAM,EAAO,EAAY,CAUnD,aAAa,aAAa,EAA6B,CACrD,GAAI,CACF,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAC/C,MAAM,MAAgB,EAAA,kBAAkB,EAAK,CAAC,CAC9C,OAEF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,EAAK,CACrE,OACM,EAAO,CAEd,GACE,GACA,OAAO,GAAU,UACjB,aAAc,GACb,EAA6C,UAAU,SAAW,IAEnE,OAEF,MAAM"}
+{"version":3,"file":"secrets-service.cjs","names":[],"sources":["../../src/api/secrets-service.ts"],"sourcesContent":["import { SettingsClient } from \"@openhands/typescript-client/clients\";\nimport { getActiveBackend } from \"./backend-registry/active-store\";\nimport {\n  createCloudSecret,\n  deleteCloudSecret,\n  fetchCloudSecrets,\n  updateCloudSecret,\n} from \"./cloud/secrets-service.api\";\nimport { getAgentServerClientOptions } from \"./agent-server-client-options\";\nimport { CustomSecretWithoutValue } from \"./secrets-service.types\";\n\n/**\n * Retry helper for API calls with exponential backoff.\n */\nasync function withRetry<T>(\n  fn: () => Promise<T>,\n  maxRetries: number = 3,\n  baseDelayMs: number = 500,\n): Promise<T> {\n  for (let attempt = 0; attempt < maxRetries; attempt += 1) {\n    try {\n      return await fn();\n    } catch (error) {\n      if (attempt >= maxRetries - 1) {\n        throw error;\n      }\n\n      const delay = baseDelayMs * 2 ** attempt;\n\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, delay);\n      });\n    }\n  }\n\n  throw new Error(\"Retry attempts exhausted\");\n}\n\nexport class SecretsService {\n  /**\n   * List all custom secrets (names and descriptions only, no values).\n   * Uses the agent-server API endpoint: GET /api/settings/secrets\n   *\n   * Note: The agent-server API doesn't support pagination or search filtering.\n   * All secrets are returned in a single response.\n   */\n  static async getSecrets(): Promise<CustomSecretWithoutValue[]> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        return await withRetry(() => fetchCloudSecrets());\n      }\n      const response = await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).listSecrets(),\n      );\n      return response.secrets.map((s) => ({\n        name: s.name,\n        description: s.description,\n      }));\n    } catch (error) {\n      console.error(\"Failed to fetch secrets after retries:\", error);\n      return [];\n    }\n  }\n\n  /**\n   * Create or update a custom secret (upsert by name).\n   * Uses the agent-server API endpoint: PUT /api/settings/secrets\n   *\n   * @param name - Secret name (must start with letter, contain only letters/numbers/underscores, 1-64 chars)\n   * @param value - Secret value\n   * @param description - Optional description\n   * @throws Error if the API call fails after retries\n   */\n  static async createSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      await withRetry(() => createCloudSecret(name, value, description));\n      return;\n    }\n    await withRetry(() =>\n      new SettingsClient(getAgentServerClientOptions()).upsertSecret({\n        name,\n        value,\n        description,\n      }),\n    );\n  }\n\n  /**\n   * Update a secret's value and/or description.\n   * Uses the same upsert endpoint as createSecret since agent-server\n   * doesn't have a separate update endpoint.\n   *\n   * @param name - Secret name (used as identifier)\n   * @param value - New secret value\n   * @param description - Optional new description\n   * @throws Error if the API call fails after retries\n   */\n  static async updateSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      // The cloud PUT endpoint renames + redescribes only (no value field),\n      // matching what `useUpdateSecret` actually sends:\n      // (secretToEdit=name, newName=value, description).\n      await withRetry(() => updateCloudSecret(name, value, description));\n      return;\n    }\n    // Agent-server uses upsert, so update is the same as create\n    await this.createSecret(name, value, description);\n  }\n\n  /**\n   * Delete a custom secret by name.\n   * Uses the agent-server API endpoint: DELETE /api/settings/secrets/{name}\n   *\n   * @param name - Secret name to delete\n   * @throws Error if the API call fails (except 404, which is treated as success)\n   */\n  static async deleteSecret(name: string): Promise<void> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        await withRetry(() => deleteCloudSecret(name));\n        return;\n      }\n      await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).deleteSecret(name),\n      );\n    } catch (error) {\n      // 404 means secret doesn't exist - treat as successful deletion\n      if (\n        error &&\n        typeof error === \"object\" &&\n        \"response\" in error &&\n        (error as { response?: { status?: number } }).response?.status === 404\n      ) {\n        return;\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":"yWAcA,eAAe,EACb,EACA,EAAqB,EACrB,EAAsB,IACV,CACZ,IAAK,IAAI,EAAU,EAAG,EAAU,EAAY,GAAW,EACrD,GAAI,CACF,OAAO,MAAM,GAAI,OACV,EAAO,CACd,GAAI,GAAW,EAAa,EAC1B,MAAM,EAGR,IAAM,EAAQ,EAAc,GAAK,EAEjC,MAAM,IAAI,QAAe,GAAY,CACnC,WAAW,EAAS,EAAM,EAC1B,CAIN,MAAU,MAAM,2BAA2B,CAG7C,IAAa,EAAb,KAA4B,CAQ1B,aAAa,YAAkD,CAC7D,GAAI,CAOF,OANI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAC/B,MAAM,MAAgB,EAAA,mBAAmB,CAAC,EAK5C,MAHgB,MACrB,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,CAChE,EACe,QAAQ,IAAK,IAAO,CAClC,KAAM,EAAE,KACR,YAAa,EAAE,YAChB,EAAE,OACI,EAAO,CAEd,OADA,QAAQ,MAAM,yCAA0C,EAAM,CACvD,EAAE,EAab,aAAa,aACX,EACA,EACA,EACe,CACf,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAC/C,MAAM,MAAgB,EAAA,kBAAkB,EAAM,EAAO,EAAY,CAAC,CAClE,OAEF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,CAC7D,OACA,QACA,cACD,CAAC,CACH,CAaH,aAAa,aACX,EACA,EACA,EACe,CACf,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAI/C,MAAM,MAAgB,EAAA,kBAAkB,EAAM,EAAO,EAAY,CAAC,CAClE,OAGF,MAAM,KAAK,aAAa,EAAM,EAAO,EAAY,CAUnD,aAAa,aAAa,EAA6B,CACrD,GAAI,CACF,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAAS,CAC/C,MAAM,MAAgB,EAAA,kBAAkB,EAAK,CAAC,CAC9C,OAEF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,aAAa,EAAK,CACrE,OACM,EAAO,CAEd,GACE,GACA,OAAO,GAAU,UACjB,aAAc,GACb,EAA6C,UAAU,SAAW,IAEnE,OAEF,MAAM"}

package/dist/api/secrets-service.js

@@ -1,4 +1,5 @@
 import { SettingsClient as e } from "../node_modules/@openhands/typescript-client/dist/client/settings-client.js";
+import "../node_modules/@openhands/typescript-client/dist/clients.js";
 import { getActiveBackend as t } from "./backend-registry/active-store.js";
 import { getAgentServerClientOptions as n } from "./agent-server-client-options.js";
 import { createCloudSecret as r, deleteCloudSecret as i, fetchCloudSecrets as a, updateCloudSecret as o } from "./cloud/secrets-service.api.js";

package/dist/api/secrets-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-service.js","names":[],"sources":["../../src/api/secrets-service.ts"],"sourcesContent":["import { SettingsClient } from \"@openhands/typescript-client/clients\";\nimport { getActiveBackend } from \"./backend-registry/active-store\";\nimport {\n  createCloudSecret,\n  deleteCloudSecret,\n  fetchCloudSecrets,\n  updateCloudSecret,\n} from \"./cloud/secrets-service.api\";\nimport { getAgentServerClientOptions } from \"./agent-server-client-options\";\nimport { CustomSecretWithoutValue } from \"./secrets-service.types\";\n\n/**\n * Retry helper for API calls with exponential backoff.\n */\nasync function withRetry<T>(\n  fn: () => Promise<T>,\n  maxRetries: number = 3,\n  baseDelayMs: number = 500,\n): Promise<T> {\n  for (let attempt = 0; attempt < maxRetries; attempt += 1) {\n    try {\n      return await fn();\n    } catch (error) {\n      if (attempt >= maxRetries - 1) {\n        throw error;\n      }\n\n      const delay = baseDelayMs * 2 ** attempt;\n\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, delay);\n      });\n    }\n  }\n\n  throw new Error(\"Retry attempts exhausted\");\n}\n\nexport class SecretsService {\n  /**\n   * List all custom secrets (names and descriptions only, no values).\n   * Uses the agent-server API endpoint: GET /api/settings/secrets\n   *\n   * Note: The agent-server API doesn't support pagination or search filtering.\n   * All secrets are returned in a single response.\n   */\n  static async getSecrets(): Promise<CustomSecretWithoutValue[]> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        return await withRetry(() => fetchCloudSecrets());\n      }\n      const response = await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).listSecrets(),\n      );\n      return response.secrets.map((s) => ({\n        name: s.name,\n        description: s.description,\n      }));\n    } catch (error) {\n      console.error(\"Failed to fetch secrets after retries:\", error);\n      return [];\n    }\n  }\n\n  /**\n   * Create or update a custom secret (upsert by name).\n   * Uses the agent-server API endpoint: PUT /api/settings/secrets\n   *\n   * @param name - Secret name (must start with letter, contain only letters/numbers/underscores, 1-64 chars)\n   * @param value - Secret value\n   * @param description - Optional description\n   * @throws Error if the API call fails after retries\n   */\n  static async createSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      await withRetry(() => createCloudSecret(name, value, description));\n      return;\n    }\n    await withRetry(() =>\n      new SettingsClient(getAgentServerClientOptions()).upsertSecret({\n        name,\n        value,\n        description,\n      }),\n    );\n  }\n\n  /**\n   * Update a secret's value and/or description.\n   * Uses the same upsert endpoint as createSecret since agent-server\n   * doesn't have a separate update endpoint.\n   *\n   * @param name - Secret name (used as identifier)\n   * @param value - New secret value\n   * @param description - Optional new description\n   * @throws Error if the API call fails after retries\n   */\n  static async updateSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      // The cloud PUT endpoint renames + redescribes only (no value field),\n      // matching what `useUpdateSecret` actually sends:\n      // (secretToEdit=name, newName=value, description).\n      await withRetry(() => updateCloudSecret(name, value, description));\n      return;\n    }\n    // Agent-server uses upsert, so update is the same as create\n    await this.createSecret(name, value, description);\n  }\n\n  /**\n   * Delete a custom secret by name.\n   * Uses the agent-server API endpoint: DELETE /api/settings/secrets/{name}\n   *\n   * @param name - Secret name to delete\n   * @throws Error if the API call fails (except 404, which is treated as success)\n   */\n  static async deleteSecret(name: string): Promise<void> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        await withRetry(() => deleteCloudSecret(name));\n        return;\n      }\n      await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).deleteSecret(name),\n      );\n    } catch (error) {\n      // 404 means secret doesn't exist - treat as successful deletion\n      if (\n        error &&\n        typeof error === \"object\" &&\n        \"response\" in error &&\n        (error as { response?: { status?: number } }).response?.status === 404\n      ) {\n        return;\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":";;;;;AAcA,eAAe,EACb,GACA,IAAqB,GACrB,IAAsB,KACV;AACZ,MAAK,IAAI,IAAU,GAAG,IAAU,GAAY,KAAW,EACrD,KAAI;AACF,SAAO,MAAM,GAAI;UACV,GAAO;AACd,MAAI,KAAW,IAAa,EAC1B,OAAM;EAGR,IAAM,IAAQ,IAAc,KAAK;AAEjC,QAAM,IAAI,SAAe,MAAY;AACnC,cAAW,GAAS,EAAM;IAC1B;;AAIN,OAAU,MAAM,2BAA2B;;AAG7C,IAAa,IAAb,MAA4B;CAQ1B,aAAa,aAAkD;AAC7D,MAAI;AAOF,UANI,GAAkB,CAAC,QAAQ,SAAS,UAC/B,MAAM,QAAgB,GAAmB,CAAC,IAK5C,MAHgB,QACrB,IAAI,EAAe,GAA6B,CAAC,CAAC,aAAa,CAChE,EACe,QAAQ,KAAK,OAAO;IAClC,MAAM,EAAE;IACR,aAAa,EAAE;IAChB,EAAE;WACI,GAAO;AAEd,UADA,QAAQ,MAAM,0CAA0C,EAAM,EACvD,EAAE;;;CAab,aAAa,aACX,GACA,GACA,GACe;AACf,MAAI,GAAkB,CAAC,QAAQ,SAAS,SAAS;AAC/C,SAAM,QAAgB,EAAkB,GAAM,GAAO,EAAY,CAAC;AAClE;;AAEF,QAAM,QACJ,IAAI,EAAe,GAA6B,CAAC,CAAC,aAAa;GAC7D;GACA;GACA;GACD,CAAC,CACH;;CAaH,aAAa,aACX,GACA,GACA,GACe;AACf,MAAI,GAAkB,CAAC,QAAQ,SAAS,SAAS;AAI/C,SAAM,QAAgB,EAAkB,GAAM,GAAO,EAAY,CAAC;AAClE;;AAGF,QAAM,KAAK,aAAa,GAAM,GAAO,EAAY;;CAUnD,aAAa,aAAa,GAA6B;AACrD,MAAI;AACF,OAAI,GAAkB,CAAC,QAAQ,SAAS,SAAS;AAC/C,UAAM,QAAgB,EAAkB,EAAK,CAAC;AAC9C;;AAEF,SAAM,QACJ,IAAI,EAAe,GAA6B,CAAC,CAAC,aAAa,EAAK,CACrE;WACM,GAAO;AAEd,OACE,KACA,OAAO,KAAU,YACjB,cAAc,KACb,EAA6C,UAAU,WAAW,IAEnE;AAEF,SAAM"}
+{"version":3,"file":"secrets-service.js","names":[],"sources":["../../src/api/secrets-service.ts"],"sourcesContent":["import { SettingsClient } from \"@openhands/typescript-client/clients\";\nimport { getActiveBackend } from \"./backend-registry/active-store\";\nimport {\n  createCloudSecret,\n  deleteCloudSecret,\n  fetchCloudSecrets,\n  updateCloudSecret,\n} from \"./cloud/secrets-service.api\";\nimport { getAgentServerClientOptions } from \"./agent-server-client-options\";\nimport { CustomSecretWithoutValue } from \"./secrets-service.types\";\n\n/**\n * Retry helper for API calls with exponential backoff.\n */\nasync function withRetry<T>(\n  fn: () => Promise<T>,\n  maxRetries: number = 3,\n  baseDelayMs: number = 500,\n): Promise<T> {\n  for (let attempt = 0; attempt < maxRetries; attempt += 1) {\n    try {\n      return await fn();\n    } catch (error) {\n      if (attempt >= maxRetries - 1) {\n        throw error;\n      }\n\n      const delay = baseDelayMs * 2 ** attempt;\n\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, delay);\n      });\n    }\n  }\n\n  throw new Error(\"Retry attempts exhausted\");\n}\n\nexport class SecretsService {\n  /**\n   * List all custom secrets (names and descriptions only, no values).\n   * Uses the agent-server API endpoint: GET /api/settings/secrets\n   *\n   * Note: The agent-server API doesn't support pagination or search filtering.\n   * All secrets are returned in a single response.\n   */\n  static async getSecrets(): Promise<CustomSecretWithoutValue[]> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        return await withRetry(() => fetchCloudSecrets());\n      }\n      const response = await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).listSecrets(),\n      );\n      return response.secrets.map((s) => ({\n        name: s.name,\n        description: s.description,\n      }));\n    } catch (error) {\n      console.error(\"Failed to fetch secrets after retries:\", error);\n      return [];\n    }\n  }\n\n  /**\n   * Create or update a custom secret (upsert by name).\n   * Uses the agent-server API endpoint: PUT /api/settings/secrets\n   *\n   * @param name - Secret name (must start with letter, contain only letters/numbers/underscores, 1-64 chars)\n   * @param value - Secret value\n   * @param description - Optional description\n   * @throws Error if the API call fails after retries\n   */\n  static async createSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      await withRetry(() => createCloudSecret(name, value, description));\n      return;\n    }\n    await withRetry(() =>\n      new SettingsClient(getAgentServerClientOptions()).upsertSecret({\n        name,\n        value,\n        description,\n      }),\n    );\n  }\n\n  /**\n   * Update a secret's value and/or description.\n   * Uses the same upsert endpoint as createSecret since agent-server\n   * doesn't have a separate update endpoint.\n   *\n   * @param name - Secret name (used as identifier)\n   * @param value - New secret value\n   * @param description - Optional new description\n   * @throws Error if the API call fails after retries\n   */\n  static async updateSecret(\n    name: string,\n    value: string,\n    description?: string,\n  ): Promise<void> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      // The cloud PUT endpoint renames + redescribes only (no value field),\n      // matching what `useUpdateSecret` actually sends:\n      // (secretToEdit=name, newName=value, description).\n      await withRetry(() => updateCloudSecret(name, value, description));\n      return;\n    }\n    // Agent-server uses upsert, so update is the same as create\n    await this.createSecret(name, value, description);\n  }\n\n  /**\n   * Delete a custom secret by name.\n   * Uses the agent-server API endpoint: DELETE /api/settings/secrets/{name}\n   *\n   * @param name - Secret name to delete\n   * @throws Error if the API call fails (except 404, which is treated as success)\n   */\n  static async deleteSecret(name: string): Promise<void> {\n    try {\n      if (getActiveBackend().backend.kind === \"cloud\") {\n        await withRetry(() => deleteCloudSecret(name));\n        return;\n      }\n      await withRetry(() =>\n        new SettingsClient(getAgentServerClientOptions()).deleteSecret(name),\n      );\n    } catch (error) {\n      // 404 means secret doesn't exist - treat as successful deletion\n      if (\n        error &&\n        typeof error === \"object\" &&\n        \"response\" in error &&\n        (error as { response?: { status?: number } }).response?.status === 404\n      ) {\n        return;\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":";;;;;;AAcA,eAAe,EACb,GACA,IAAqB,GACrB,IAAsB,KACV;AACZ,MAAK,IAAI,IAAU,GAAG,IAAU,GAAY,KAAW,EACrD,KAAI;AACF,SAAO,MAAM,GAAI;UACV,GAAO;AACd,MAAI,KAAW,IAAa,EAC1B,OAAM;EAGR,IAAM,IAAQ,IAAc,KAAK;AAEjC,QAAM,IAAI,SAAe,MAAY;AACnC,cAAW,GAAS,EAAM;IAC1B;;AAIN,OAAU,MAAM,2BAA2B;;AAG7C,IAAa,IAAb,MAA4B;CAQ1B,aAAa,aAAkD;AAC7D,MAAI;AAOF,UANI,GAAkB,CAAC,QAAQ,SAAS,UAC/B,MAAM,QAAgB,GAAmB,CAAC,IAK5C,MAHgB,QACrB,IAAI,EAAe,GAA6B,CAAC,CAAC,aAAa,CAChE,EACe,QAAQ,KAAK,OAAO;IAClC,MAAM,EAAE;IACR,aAAa,EAAE;IAChB,EAAE;WACI,GAAO;AAEd,UADA,QAAQ,MAAM,0CAA0C,EAAM,EACvD,EAAE;;;CAab,aAAa,aACX,GACA,GACA,GACe;AACf,MAAI,GAAkB,CAAC,QAAQ,SAAS,SAAS;AAC/C,SAAM,QAAgB,EAAkB,GAAM,GAAO,EAAY,CAAC;AAClE;;AAEF,QAAM,QACJ,IAAI,EAAe,GAA6B,CAAC,CAAC,aAAa;GAC7D;GACA;GACA;GACD,CAAC,CACH;;CAaH,aAAa,aACX,GACA,GACA,GACe;AACf,MAAI,GAAkB,CAAC,QAAQ,SAAS,SAAS;AAI/C,SAAM,QAAgB,EAAkB,GAAM,GAAO,EAAY,CAAC;AAClE;;AAGF,QAAM,KAAK,aAAa,GAAM,GAAO,EAAY;;CAUnD,aAAa,aAAa,GAA6B;AACrD,MAAI;AACF,OAAI,GAAkB,CAAC,QAAQ,SAAS,SAAS;AAC/C,UAAM,QAAgB,EAAkB,EAAK,CAAC;AAC9C;;AAEF,SAAM,QACJ,IAAI,EAAe,GAA6B,CAAC,CAAC,aAAa,EAAK,CACrE;WACM,GAAO;AAEd,OACE,KACA,OAAO,KAAU,YACjB,cAAc,KACb,EAA6C,UAAU,WAAW,IAEnE;AAEF,SAAM"}

package/dist/api/settings-service/settings-service.api.cjs

@@ -1,2 +1,2 @@
-require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../../node_modules/@openhands/typescript-client/dist/client/settings-client.cjs`),t=require(`../backend-registry/active-store.cjs`),n=require(`../agent-server-client-options.cjs`),r=require(`../../services/settings.cjs`),i=require(`../cloud/settings-service.api.cjs`);var a=[`language`,`user_consents_to_analytics`,`enable_sound_notifications`,`git_user_name`,`git_user_email`,`disabled_skills`],o=new Set(a),s=e=>o.has(e),c=e=>{let t={},n={};for(let[r,i]of Object.entries(e))s(r)?t[r]=i:n[r]=i;return{extracted:t,rest:n}},l=e=>JSON.parse(JSON.stringify(e)),u=(e,t)=>({...e??{},...t??{}});async function d(e,t=3,n=500){for(let r=0;r<t;r+=1)try{return await e()}catch(e){if(r>=t-1)throw e;let i=n*2**r;await new Promise(e=>{setTimeout(e,i)})}throw Error(`Retry attempts exhausted`)}var f={redacted:null,encrypted:null,timestamp:0},p=300*1e3,m=()=>Date.now()-f.timestamp<p,h=()=>{f={redacted:null,encrypted:null,timestamp:0}},g=e=>{let t={agent_settings:e.agent_settings??{},conversation_settings:e.conversation_settings??{},llm_api_key_set:e.llm_api_key_is_set},n=e.misc_settings?.app_preferences;if(n)for(let e of a){let r=n[e];r!==void 0&&(t[e]=r)}return t},_=e=>{let t=u(r.DEFAULT_SETTINGS.agent_settings??{},e.agent_settings??{}),n=u(r.DEFAULT_SETTINGS.conversation_settings??{},e.conversation_settings??{}),i={...l(r.DEFAULT_SETTINGS),...e,provider_tokens_set:{...r.DEFAULT_SETTINGS.provider_tokens_set??{},...e.provider_tokens_set??{}},agent_settings:t,conversation_settings:n},a=t.llm,o=t.condenser;return typeof t.agent==`string`&&(i.agent=t.agent),typeof a?.model==`string`&&a.model.length>0&&(i.llm_model=a.model),typeof a?.base_url==`string`&&(i.llm_base_url=a.base_url),typeof o?.enabled==`boolean`&&(i.enable_default_condenser=o.enabled),typeof o?.max_size==`number`&&(i.condenser_max_size=o.max_size),t.mcp_config&&(i.mcp_config=t.mcp_config),typeof n.confirmation_mode==`boolean`&&(i.confirmation_mode=n.confirmation_mode),(typeof n.security_analyzer==`string`||n.security_analyzer===null)&&(i.security_analyzer=n.security_analyzer),typeof n.max_iterations==`number`&&(i.max_iterations=n.max_iterations),i.search_api_key_set=!!i.search_api_key,i},v=class r{static async fetchSettingsFromApi(t){return d(()=>new e.SettingsClient(n.getAgentServerClientOptions()).getSettings({exposeSecrets:t}))}static async getSettings(){if(t.getActiveBackend().backend.kind===`cloud`)try{return _(await d(()=>i.fetchCloudSettings()))}catch(e){return console.warn(`Failed to fetch cloud settings, using defaults:`,e),_({})}if(m()&&f.redacted)return _(g(f.redacted));try{let e=await this.fetchSettingsFromApi();return f.redacted=e,f.timestamp=Date.now(),_(g(e))}catch(e){return console.warn(`Failed to fetch settings from API, using defaults:`,e),_({})}}static async getSettingsForConversation(){if(m()&&f.encrypted)return{agentSettings:f.encrypted.agent_settings,conversationSettings:f.encrypted.conversation_settings,secretsEncrypted:!0};let e=await this.fetchSettingsFromApi(`encrypted`);return f.encrypted=e,f.timestamp||=Date.now(),{agentSettings:e.agent_settings,conversationSettings:e.conversation_settings,secretsEncrypted:!0}}static async getSettingsSchema(){return t.getActiveBackend().backend.kind===`cloud`?await i.fetchCloudSettingsSchema():await new e.SettingsClient(n.getAgentServerClientOptions()).getAgentSchema()}static async getConversationSettingsSchema(){return t.getActiveBackend().backend.kind===`cloud`?await i.fetchCloudConversationSettingsSchema():await new e.SettingsClient(n.getAgentServerClientOptions()).getConversationSchema()}static async saveSettings(a){let{extracted:o,rest:s}=c(a),l=Object.keys(o).length>0,u={},f=s.agent_settings_diff;f&&Object.keys(f).length>0&&(u.agent_settings_diff=f);let p=s.conversation_settings_diff;p&&Object.keys(p).length>0&&(u.conversation_settings_diff=p),l&&(u.misc_settings_diff={app_preferences:o});let m=t.getActiveBackend().backend.kind===`cloud`,g=u.agent_settings_diff,_=!!g&&`mcp_config`in g&&g.mcp_config!==null,v;if(_)try{v=m?(await i.fetchCloudSettings())?.agent_settings?.mcp_config:(await r.fetchSettingsFromApi())?.agent_settings?.mcp_config}catch{}if(m){if(!(u.agent_settings_diff||u.conversation_settings_diff||l))return!0;_&&await d(()=>i.saveCloudSettings({agent_settings_diff:{mcp_config:null}}));let e={};u.agent_settings_diff&&(e.agent_settings_diff=u.agent_settings_diff),u.conversation_settings_diff&&(e.conversation_settings_diff=u.conversation_settings_diff),l&&(e.app_preferences=o);try{await d(()=>i.saveCloudSettings(e))}catch(e){if(_&&v)try{await i.saveCloudSettings({agent_settings_diff:{mcp_config:v}})}catch{}throw e}}else{if(!(u.agent_settings_diff||u.conversation_settings_diff||u.misc_settings_diff))return!0;_&&await d(()=>new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings({agent_settings_diff:{mcp_config:null}}));try{await d(()=>new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings(u))}catch(t){if(_&&v)try{await new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings({agent_settings_diff:{mcp_config:v}})}catch{}throw t}}return h(),!0}static invalidateCache(){h()}};exports.default=v;
+require(`../../_virtual/_rolldown/runtime.cjs`);const e=require(`../../node_modules/@openhands/typescript-client/dist/client/settings-client.cjs`);require(`../../node_modules/@openhands/typescript-client/dist/clients.cjs`);const t=require(`../backend-registry/active-store.cjs`),n=require(`../agent-server-client-options.cjs`),r=require(`../../services/settings.cjs`),i=require(`../../utils/mcp-config.cjs`),a=require(`../cloud/settings-service.api.cjs`);var o=[`language`,`user_consents_to_analytics`,`enable_sound_notifications`,`git_user_name`,`git_user_email`,`disabled_skills`],s=new Set(o),c=e=>s.has(e),l=e=>{let t={},n={};for(let[r,i]of Object.entries(e))c(r)?t[r]=i:n[r]=i;return{extracted:t,rest:n}},u=e=>JSON.parse(JSON.stringify(e)),d=(e,t)=>({...e??{},...t??{}});async function f(e,t=3,n=500){for(let r=0;r<t;r+=1)try{return await e()}catch(e){if(r>=t-1)throw e;let i=n*2**r;await new Promise(e=>{setTimeout(e,i)})}throw Error(`Retry attempts exhausted`)}var p={redacted:null,encrypted:null,timestamp:0},m=300*1e3,h=()=>Date.now()-p.timestamp<m,g=()=>{p={redacted:null,encrypted:null,timestamp:0}},_=e=>!!e&&typeof e==`object`&&!Array.isArray(e),v=(e,t)=>`Basic ${btoa(`${e}:${t}`)}`,y=e=>{switch(e.strategy){case`none`:return{};case`api_key`:{if(typeof e.value!=`string`||!e.value)return null;let t=typeof e.header_name==`string`&&e.header_name?e.header_name:`Authorization`,n=t===`Authorization`?`Bearer ${e.value}`:e.value;return{[t]:n}}case`bearer`:return typeof e.value!=`string`||!e.value?null:{Authorization:`Bearer ${e.value}`};case`basic`:return typeof e.username!=`string`||typeof e.password!=`string`?null:{Authorization:v(e.username,e.password)};case`header`:return i.stringRecord(e.headers)??{};case`oauth2`:{let t=_(e.state)?e.state.tokens:void 0;return!_(t)||typeof t.access_token!=`string`?null:{Authorization:`Bearer ${t.access_token}`}}default:return null}},b=e=>{if(!_(e))return e;let t=_(e.mcpServers),n=t?e.mcpServers:e,r=Object.fromEntries(Object.entries(n).map(([e,t])=>{if(!_(t)||!_(t.auth))return[e,t];let n=y(t.auth);if(n===null)return[e,t];let r={...t},a={...i.stringRecord(t.headers)??{},...n};return delete r.auth,Object.keys(a).length>0?r.headers=a:delete r.headers,[e,r]}));return t?{...e,mcpServers:r}:r},x=e=>{let t=i.getSdkMcpServerMap(e);return t?Object.values(t).some(e=>i.hasRedactedMcpSecretLeaf(_(e)?e.auth:void 0)||i.hasRedactedMcpSecretLeaf(_(e)?e.headers:void 0)||i.hasRedactedMcpSecretLeaf(_(e)?e.env:void 0)):!1},S=(e,t)=>{let n=i.getSdkMcpServerMap(e),r=i.getSdkMcpServerMap(t);return!n||!r?!1:Object.keys(n).some(e=>!(e in r))},C=e=>{let t={agent_settings:e.agent_settings??{},conversation_settings:e.conversation_settings??{},llm_api_key_set:e.llm_api_key_is_set},n=e.misc_settings?.app_preferences;if(n)for(let e of o){let r=n[e];r!==void 0&&(t[e]=r)}return t},w=e=>{let t=d(r.DEFAULT_SETTINGS.agent_settings??{},e.agent_settings??{}),n=d(r.DEFAULT_SETTINGS.conversation_settings??{},e.conversation_settings??{}),i={...u(r.DEFAULT_SETTINGS),...e,provider_tokens_set:{...r.DEFAULT_SETTINGS.provider_tokens_set??{},...e.provider_tokens_set??{}},agent_settings:t,conversation_settings:n},a=t.llm,o=t.condenser;return typeof t.agent==`string`&&(i.agent=t.agent),typeof a?.model==`string`&&a.model.length>0&&(i.llm_model=a.model),typeof a?.base_url==`string`&&(i.llm_base_url=a.base_url),typeof o?.enabled==`boolean`&&(i.enable_default_condenser=o.enabled),typeof o?.max_size==`number`&&(i.condenser_max_size=o.max_size),typeof n.confirmation_mode==`boolean`&&(i.confirmation_mode=n.confirmation_mode),(typeof n.security_analyzer==`string`||n.security_analyzer===null)&&(i.security_analyzer=n.security_analyzer),typeof n.max_iterations==`number`&&(i.max_iterations=n.max_iterations),i.search_api_key_set=!!i.search_api_key,i},T=class r{static async fetchSettingsFromApi(t){return f(()=>new e.SettingsClient(n.getAgentServerClientOptions()).getSettings({exposeSecrets:t}))}static async getSettings(){if(t.getActiveBackend().backend.kind===`cloud`)try{return w(await f(()=>a.fetchCloudSettings()))}catch(e){return console.warn(`Failed to fetch cloud settings, using defaults:`,e),w({})}if(h()&&p.redacted)return w(C(p.redacted));try{let e=await this.fetchSettingsFromApi();return p.redacted=e,p.timestamp=Date.now(),w(C(e))}catch(e){return console.warn(`Failed to fetch settings from API, using defaults:`,e),w({})}}static async getSettingsForConversation(){if(h()&&p.encrypted)return{agentSettings:p.encrypted.agent_settings,conversationSettings:p.encrypted.conversation_settings,secretsEncrypted:!0};let e=await this.fetchSettingsFromApi(`encrypted`);return p.encrypted=e,p.timestamp||=Date.now(),{agentSettings:e.agent_settings,conversationSettings:e.conversation_settings,secretsEncrypted:!0}}static async getSettingsSchema(){return t.getActiveBackend().backend.kind===`cloud`?await a.fetchCloudSettingsSchema():await new e.SettingsClient(n.getAgentServerClientOptions()).getAgentSchema()}static async getConversationSettingsSchema(){return t.getActiveBackend().backend.kind===`cloud`?await a.fetchCloudConversationSettingsSchema():await new e.SettingsClient(n.getAgentServerClientOptions()).getConversationSchema()}static async saveSettings(i){let{extracted:o,rest:s}=l(i),c=Object.keys(o).length>0,u={},d=s.agent_settings_diff;d&&Object.keys(d).length>0&&(u.agent_settings_diff=d);let p=s.conversation_settings_diff;p&&Object.keys(p).length>0&&(u.conversation_settings_diff=p),c&&(u.misc_settings_diff={app_preferences:o});let m=t.getActiveBackend().backend.kind===`cloud`,h=u.agent_settings_diff,_=!!h&&`mcp_config`in h&&h.mcp_config!==null,v;if(_)try{v=m?(await a.fetchCloudSettings())?.agent_settings?.mcp_config:(await r.fetchSettingsFromApi())?.agent_settings?.mcp_config}catch{}let y=m&&_&&x(v)&&!S(v,h?.mcp_config),C=_&&!y;if(m){if(!(u.agent_settings_diff||u.conversation_settings_diff||c))return!0;C&&await f(()=>a.saveCloudSettings({agent_settings_diff:{mcp_config:null}}));let e={};u.agent_settings_diff&&(e.agent_settings_diff={...u.agent_settings_diff},`mcp_config`in e.agent_settings_diff&&(e.agent_settings_diff.mcp_config=b(e.agent_settings_diff.mcp_config))),u.conversation_settings_diff&&(e.conversation_settings_diff=u.conversation_settings_diff),c&&(e.app_preferences=o);try{await f(()=>a.saveCloudSettings(e))}catch(e){if(C&&v)try{await a.saveCloudSettings({agent_settings_diff:{mcp_config:v}})}catch{}throw e}}else{if(!(u.agent_settings_diff||u.conversation_settings_diff||u.misc_settings_diff))return!0;C&&await f(()=>new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings({agent_settings_diff:{mcp_config:null}}));try{await f(()=>new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings(u))}catch(t){if(C&&v)try{await new e.SettingsClient(n.getAgentServerClientOptions()).updateSettings({agent_settings_diff:{mcp_config:v}})}catch{}throw t}}return g(),!0}static invalidateCache(){g()}};exports.default=T;
 //# sourceMappingURL=settings-service.api.cjs.map

package/dist/api/settings-service/settings-service.api.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"settings-service.api.cjs","names":[],"sources":["../../../src/api/settings-service/settings-service.api.ts"],"sourcesContent":["import { SettingsClient } from \"@openhands/typescript-client/clients\";\nimport { DEFAULT_SETTINGS } from \"#/services/settings\";\nimport { Settings, SettingsSchema, SettingsValue } from \"#/types/settings\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport {\n  fetchCloudConversationSettingsSchema,\n  fetchCloudSettings,\n  fetchCloudSettingsSchema,\n  saveCloudSettings,\n} from \"../cloud/settings-service.api\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\n\n/**\n * Fields the agent-server stores under `misc_settings.app_preferences` (see\n * SDK `openhands.sdk.settings.AppPreferences`). Mirrored here as a flat\n * partial of Settings so the rest of the frontend can keep treating them as\n * top-level keys (`settings.language`, `settings.disabled_skills`, …).\n */\nexport const APP_PREFERENCE_FIELDS = [\n  \"language\",\n  \"user_consents_to_analytics\",\n  \"enable_sound_notifications\",\n  \"git_user_name\",\n  \"git_user_email\",\n  \"disabled_skills\",\n] as const;\n\nexport type AppPreferenceField = (typeof APP_PREFERENCE_FIELDS)[number];\n\nexport type AppPreferences = Partial<Pick<Settings, AppPreferenceField>>;\n\n/**\n * Container for frontend-owned settings the agent doesn't interpret.\n * Mirrors the SDK `MiscSettings` model introduced in agent-server 1.27.\n *\n * Single nested category today (`app_preferences`). Adding a future\n * category (e.g. `ui_preferences`) is a non-breaking change for the wire\n * shape — it just adds another optional sibling here.\n */\nexport interface MiscSettings {\n  app_preferences?: AppPreferences;\n}\n\n/**\n * Response from GET /api/settings\n * Mirrors the SettingsResponse model in the agent server.\n */\nexport interface SettingsApiResponse {\n  agent_settings: Record<string, SettingsValue>;\n  conversation_settings: Record<string, SettingsValue>;\n  llm_api_key_is_set: boolean;\n  /**\n   * Frontend-owned settings the agent does not interpret (currently just\n   * `app_preferences`). Added in agent-server 1.27; earlier servers omit\n   * the field entirely, in which case the frontend falls back to defaults.\n   */\n  misc_settings?: MiscSettings;\n}\n\n/**\n * Request payload for PATCH /api/settings.\n *\n * `misc_settings_diff` is deep-merged into the persisted `misc_settings`\n * block, matching the semantics of `agent_settings_diff` /\n * `conversation_settings_diff`. A partial diff like\n * `{ app_preferences: { language: \"fr\" } }` updates only `language` and\n * leaves every other `app_preferences` field alone. Lists\n * (`disabled_skills`) are replaced wholesale rather than merged.\n */\nexport interface SettingsUpdateRequest {\n  agent_settings_diff?: Record<string, SettingsValue>;\n  conversation_settings_diff?: Record<string, SettingsValue>;\n  misc_settings_diff?: MiscSettings;\n  // Permit additional keys so this stays assignable to the underlying\n  // typescript-client SDK type, which uses `[key: string]: unknown` for\n  // forward compatibility.\n  [key: string]: unknown;\n}\n\nconst APP_PREFERENCE_FIELD_SET: ReadonlySet<string> = new Set(\n  APP_PREFERENCE_FIELDS,\n);\n\nconst isAppPreferenceField = (key: string): key is AppPreferenceField =>\n  APP_PREFERENCE_FIELD_SET.has(key);\n\n/**\n * Split known app-preference keys out of a save payload so callers can\n * route them through `misc_settings_diff.app_preferences` (local) or as\n * flat top-level keys (cloud), while the remaining fields flow into the\n * `agent_settings_diff` / `conversation_settings_diff` branches.\n */\nconst extractAppPreferences = (\n  input: Record<string, unknown>,\n): { extracted: AppPreferences; rest: Record<string, unknown> } => {\n  const extracted: AppPreferences = {};\n  const rest: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(input)) {\n    if (isAppPreferenceField(key)) {\n      (extracted as Record<string, unknown>)[key] = value;\n    } else {\n      rest[key] = value;\n    }\n  }\n  return { extracted, rest };\n};\n\n/**\n * Secret exposure mode for X-Expose-Secrets header.\n *\n * - undefined: Returns redacted secrets (\"**********\")\n * - \"encrypted\": Returns cipher-encrypted values (safe for frontend to round-trip)\n * - \"plaintext\": Returns raw secret values (backend use only!)\n */\nexport type ExposeSecretsMode = \"encrypted\" | \"plaintext\" | undefined;\n\nconst deepClone = <T>(value: T): T => JSON.parse(JSON.stringify(value)) as T;\n\nconst mergeRecords = (\n  base: Record<string, SettingsValue> | null | undefined,\n  next: Record<string, SettingsValue> | null | undefined,\n) => ({ ...(base ?? {}), ...(next ?? {}) });\n\n/**\n * Retry helper for API calls with exponential backoff.\n */\nasync function withRetry<T>(\n  fn: () => Promise<T>,\n  maxRetries: number = 3,\n  baseDelayMs: number = 500,\n): Promise<T> {\n  for (let attempt = 0; attempt < maxRetries; attempt += 1) {\n    try {\n      return await fn();\n    } catch (error) {\n      if (attempt >= maxRetries - 1) {\n        throw error;\n      }\n\n      const delay = baseDelayMs * 2 ** attempt;\n\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, delay);\n      });\n    }\n  }\n\n  throw new Error(\"Retry attempts exhausted\");\n}\n\n/**\n * In-memory cache for settings to avoid repeated network calls.\n * The cache is invalidated on save operations.\n */\nlet settingsCache: {\n  /** Settings with redacted secrets for display */\n  redacted: SettingsApiResponse | null;\n  /** Settings with encrypted secrets for conversation start */\n  encrypted: SettingsApiResponse | null;\n  /** Timestamp when the cache was last populated */\n  timestamp: number;\n} = {\n  redacted: null,\n  encrypted: null,\n  timestamp: 0,\n};\n\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\nconst isCacheValid = () => Date.now() - settingsCache.timestamp < CACHE_TTL_MS;\n\nconst clearCache = () => {\n  settingsCache = { redacted: null, encrypted: null, timestamp: 0 };\n};\n\n/**\n * Transform API response into Settings object with derived fields.\n */\nconst transformApiResponse = (\n  response: SettingsApiResponse,\n): Partial<Settings> => {\n  const agentSettings = response.agent_settings ?? {};\n  const conversationSettings = response.conversation_settings ?? {};\n\n  const partial: Partial<Settings> = {\n    agent_settings: agentSettings,\n    conversation_settings: conversationSettings,\n    llm_api_key_set: response.llm_api_key_is_set,\n  };\n\n  // App-level user preferences come back nested under\n  // `misc_settings.app_preferences` from the local agent-server (added in\n  // 1.27, restructured into the `misc_settings` container in the follow-up\n  // refactor). Hoist them onto the flat Settings shape the rest of the\n  // frontend already speaks. Older servers omit the `misc_settings` field\n  // entirely; the migration helper invoked from `getSettings` promotes any\n  // leftover localStorage values to the server on first run, so the omitted\n  // case just falls back to defaults.\n  const prefs = response.misc_settings?.app_preferences;\n  if (prefs) {\n    for (const key of APP_PREFERENCE_FIELDS) {\n      const value = prefs[key];\n      if (value !== undefined) {\n        (partial as Record<string, unknown>)[key] = value;\n      }\n    }\n  }\n\n  return partial;\n};\n\n/**\n * Sync derived settings fields from agent_settings and conversation_settings.\n * This ensures backward compatibility with code that reads top-level fields.\n */\nconst syncDerivedSettings = (settings: Partial<Settings>): Settings => {\n  const agentSettings = mergeRecords(\n    DEFAULT_SETTINGS.agent_settings ?? {},\n    settings.agent_settings ?? {},\n  );\n  const conversationSettings = mergeRecords(\n    DEFAULT_SETTINGS.conversation_settings ?? {},\n    settings.conversation_settings ?? {},\n  );\n\n  const merged = {\n    ...deepClone(DEFAULT_SETTINGS),\n    ...settings,\n    provider_tokens_set: {\n      ...(DEFAULT_SETTINGS.provider_tokens_set ?? {}),\n      ...(settings.provider_tokens_set ?? {}),\n    },\n    agent_settings: agentSettings,\n    conversation_settings: conversationSettings,\n  } as Settings;\n\n  const llm = agentSettings.llm as Record<string, SettingsValue> | undefined;\n  const condenser = agentSettings.condenser as\n    | Record<string, SettingsValue>\n    | undefined;\n\n  if (typeof agentSettings.agent === \"string\") {\n    merged.agent = agentSettings.agent;\n  }\n  if (typeof llm?.model === \"string\" && llm.model.length > 0) {\n    merged.llm_model = llm.model;\n  }\n  if (typeof llm?.base_url === \"string\") {\n    merged.llm_base_url = llm.base_url;\n  }\n  // Note: api_key may be redacted (\"**********\") when fetched without expose header\n  // We don't sync it to top-level llm_api_key to avoid overwriting with redacted value\n  if (typeof condenser?.enabled === \"boolean\") {\n    merged.enable_default_condenser = condenser.enabled;\n  }\n  if (typeof condenser?.max_size === \"number\") {\n    merged.condenser_max_size = condenser.max_size;\n  }\n  if (agentSettings.mcp_config) {\n    merged.mcp_config = agentSettings.mcp_config as Settings[\"mcp_config\"];\n  }\n\n  if (typeof conversationSettings.confirmation_mode === \"boolean\") {\n    merged.confirmation_mode = conversationSettings.confirmation_mode;\n  }\n  if (\n    typeof conversationSettings.security_analyzer === \"string\" ||\n    conversationSettings.security_analyzer === null\n  ) {\n    merged.security_analyzer = conversationSettings.security_analyzer as\n      | string\n      | null;\n  }\n  if (typeof conversationSettings.max_iterations === \"number\") {\n    merged.max_iterations = conversationSettings.max_iterations;\n  }\n\n  merged.search_api_key_set = !!merged.search_api_key;\n\n  return merged;\n};\n\nclass SettingsService {\n  /**\n   * Fetch settings from the agent server API with retry logic.\n   *\n   * @param exposeSecrets - Controls how secrets are returned:\n   *   - undefined: Secrets are redacted (\"**********\") - safe for display\n   *   - \"encrypted\": Secrets are cipher-encrypted - safe for round-trip to start conversation\n   *   - \"plaintext\": Raw secrets - DO NOT USE from frontend\n   */\n  static async fetchSettingsFromApi(\n    exposeSecrets?: ExposeSecretsMode,\n  ): Promise<SettingsApiResponse> {\n    return withRetry(() =>\n      new SettingsClient(getAgentServerClientOptions()).getSettings({\n        exposeSecrets,\n      }),\n    ) as Promise<SettingsApiResponse>;\n  }\n\n  /**\n   * Get settings for display (secrets are redacted).\n   * Uses in-memory cache for performance.\n   */\n  static async getSettings(): Promise<Settings> {\n    // Cloud uses a different settings shape (flat top-level fields\n    // including provider_tokens_set, llm_model, etc.). Branch out before\n    // touching the local-only cache: cloud responses bypass the local\n    // SettingsApiResponse shape and feed straight into syncDerivedSettings\n    // so cloud-native fields like provider_tokens_set reach the GUI's\n    // useUserProviders → useAppInstallations → useGitRepositories chain.\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      try {\n        const cloud = await withRetry(() => fetchCloudSettings());\n        return syncDerivedSettings(cloud);\n      } catch (error) {\n        console.warn(\"Failed to fetch cloud settings, using defaults:\", error);\n        return syncDerivedSettings({});\n      }\n    }\n\n    // Check cache first\n    if (isCacheValid() && settingsCache.redacted) {\n      return syncDerivedSettings(transformApiResponse(settingsCache.redacted));\n    }\n\n    try {\n      const response = await this.fetchSettingsFromApi();\n      settingsCache.redacted = response;\n      settingsCache.timestamp = Date.now();\n      return syncDerivedSettings(transformApiResponse(response));\n    } catch (error) {\n      // If API fails, return defaults\n      console.warn(\"Failed to fetch settings from API, using defaults:\", error);\n      return syncDerivedSettings({});\n    }\n  }\n\n  /**\n   * Get settings with encrypted secrets for starting conversations.\n   * The encrypted secrets can be passed to the start conversation API\n   * with secrets_encrypted=true for server-side decryption.\n   *\n   * @throws Error if encrypted settings cannot be fetched - conversations\n   *   should not start with broken/redacted credentials.\n   */\n  static async getSettingsForConversation(): Promise<{\n    agentSettings: Record<string, SettingsValue>;\n    conversationSettings: Record<string, SettingsValue>;\n    secretsEncrypted: boolean;\n  }> {\n    // Check cache first\n    if (isCacheValid() && settingsCache.encrypted) {\n      return {\n        agentSettings: settingsCache.encrypted.agent_settings,\n        conversationSettings: settingsCache.encrypted.conversation_settings,\n        secretsEncrypted: true,\n      };\n    }\n\n    // Fetch encrypted settings - this MUST succeed for conversations to work.\n    // Do not fall back to redacted settings as that would cause auth failures.\n    const response = await this.fetchSettingsFromApi(\"encrypted\");\n    settingsCache.encrypted = response;\n    if (!settingsCache.timestamp) {\n      settingsCache.timestamp = Date.now();\n    }\n    return {\n      agentSettings: response.agent_settings,\n      conversationSettings: response.conversation_settings,\n      secretsEncrypted: true,\n    };\n  }\n\n  static async getSettingsSchema(): Promise<SettingsSchema> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return (await fetchCloudSettingsSchema()) as SettingsSchema;\n    }\n    return (await new SettingsClient(\n      getAgentServerClientOptions(),\n    ).getAgentSchema()) as SettingsSchema;\n  }\n\n  static async getConversationSettingsSchema(): Promise<SettingsSchema> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return (await fetchCloudConversationSettingsSchema()) as SettingsSchema;\n    }\n    return (await new SettingsClient(\n      getAgentServerClientOptions(),\n    ).getConversationSchema()) as SettingsSchema;\n  }\n\n  /**\n   * Save settings to the agent server API.\n   * Uses PATCH for incremental updates.\n   */\n  static async saveSettings(\n    settings: Partial<Settings> & Record<string, unknown>,\n  ): Promise<boolean> {\n    // Split app-level user-preference fields (language, git identity, sound\n    // notifications, analytics consent, disabled_skills) off and route them\n    // through `misc_settings_diff.app_preferences` (local) or as flat\n    // top-level keys (cloud). The local agent-server stores them under\n    // `PersistedSettings.misc_settings.app_preferences`; the cloud accepts\n    // them as flat keys on `POST /api/v1/settings`.\n    const { extracted: appPreferences, rest } = extractAppPreferences(\n      settings as Record<string, unknown>,\n    );\n    const hasAppPreferences = Object.keys(appPreferences).length > 0;\n\n    const payload: SettingsUpdateRequest = {};\n\n    // Extract agent_settings_diff\n    const agentSettingsDiff = rest.agent_settings_diff as\n      | Record<string, SettingsValue>\n      | undefined;\n    if (agentSettingsDiff && Object.keys(agentSettingsDiff).length > 0) {\n      payload.agent_settings_diff = agentSettingsDiff;\n    }\n\n    // Extract conversation_settings_diff\n    const conversationSettingsDiff = rest.conversation_settings_diff as\n      | Record<string, SettingsValue>\n      | undefined;\n    if (\n      conversationSettingsDiff &&\n      Object.keys(conversationSettingsDiff).length > 0\n    ) {\n      payload.conversation_settings_diff = conversationSettingsDiff;\n    }\n\n    if (hasAppPreferences) {\n      payload.misc_settings_diff = { app_preferences: appPreferences };\n    }\n\n    const isCloud = getActiveBackend().backend.kind === \"cloud\";\n\n    // The backend applies ``agent_settings_diff`` by deep-merging it into the\n    // existing ``agent_settings`` dict (see SDK\n    // ``openhands.agent_server.persistence.models._deep_merge``). That works\n    // for scalar fields but is wrong for ``mcp_config.mcpServers``, which is\n    // a name-keyed map: a diff that omits a server cannot remove it (stale\n    // key stays), and a diff whose key indices shift (e.g. after deleting\n    // index 0, the second server is renumbered) leaves the original keys\n    // behind as duplicates pointing to the wrong server config.\n    //\n    // The only way to make ``mcp_config`` behave like a replace through this\n    // API is to first null it out — ``null`` is not a dict, so deep-merge\n    // takes the else branch and sets the field to ``None`` outright — and\n    // then send the new value in a follow-up call. We do this for every\n    // ``mcp_config`` write, including adds (the wasted round-trip is\n    // negligible for this user action and avoids divergent code paths).\n    const agentDiff = payload.agent_settings_diff;\n    // Send a pre-clear PATCH when the diff sets ``mcp_config`` to a non-null\n    // value. A second PATCH below then writes the new value. Skipping the\n    // pre-clear when the caller is already clearing (``mcp_config: null``)\n    // avoids a pointless duplicate request.\n    const needsMcpPreClear =\n      !!agentDiff && \"mcp_config\" in agentDiff && agentDiff.mcp_config !== null;\n\n    // The pre-clear is destructive: if the follow-up write fails after the\n    // clear succeeds, the user's MCP config is left empty. Snapshot the\n    // previous value (in raw SDK shape, NOT the GUI's parsed MCPConfig)\n    // before pre-clearing so we can attempt a best-effort rollback. The\n    // original write error is always re-thrown to the caller regardless\n    // of rollback success — the GUI's react-query mutations surface that\n    // as an error toast so the user knows to retry.\n    //\n    // Snapshot must be the SDK shape (``{ mcpServers: { name: cfg }}``)\n    // because that is what the backend expects on the rollback PATCH.\n    // ``SettingsService.getSettings`` returns a GUI Settings object whose\n    // ``mcp_config`` is typed as the parsed frontend MCPConfig and\n    // defaults to empty arrays when nothing is installed, so it is not\n    // suitable for round-tripping back to the backend.\n    let mcpConfigSnapshot: unknown = undefined;\n    if (needsMcpPreClear) {\n      try {\n        if (isCloud) {\n          const raw = (await fetchCloudSettings()) as {\n            agent_settings?: { mcp_config?: unknown };\n          };\n          mcpConfigSnapshot = raw?.agent_settings?.mcp_config;\n        } else {\n          const raw = (await SettingsService.fetchSettingsFromApi()) as {\n            agent_settings?: { mcp_config?: unknown };\n          };\n          mcpConfigSnapshot = raw?.agent_settings?.mcp_config;\n        }\n      } catch {\n        // Snapshot failed (network blip, etc.). Continue without rollback\n        // ability — the original write error will still surface.\n      }\n    }\n\n    if (isCloud) {\n      const hasCloudWork =\n        !!payload.agent_settings_diff ||\n        !!payload.conversation_settings_diff ||\n        hasAppPreferences;\n      if (!hasCloudWork) {\n        return true;\n      }\n      if (needsMcpPreClear) {\n        await withRetry(() =>\n          saveCloudSettings({\n            agent_settings_diff: { mcp_config: null },\n          }),\n        );\n      }\n      // Build the cloud payload from the same diffs, but as a separate\n      // object so undefined keys don't appear in the call (saveCloudSettings\n      // is called from tests with an exact-shape assertion).\n      const cloudPayload: Parameters<typeof saveCloudSettings>[0] = {};\n      if (payload.agent_settings_diff) {\n        cloudPayload.agent_settings_diff = payload.agent_settings_diff;\n      }\n      if (payload.conversation_settings_diff) {\n        cloudPayload.conversation_settings_diff =\n          payload.conversation_settings_diff;\n      }\n      if (hasAppPreferences) {\n        // The cloud `POST /api/v1/settings` takes app-preference fields as\n        // flat top-level keys (not under `app_preferences_diff`).\n        // `saveCloudSettings` re-flattens them onto the request body.\n        cloudPayload.app_preferences = appPreferences;\n      }\n      try {\n        await withRetry(() => saveCloudSettings(cloudPayload));\n      } catch (err) {\n        if (needsMcpPreClear && mcpConfigSnapshot) {\n          // Best-effort rollback. We deliberately do not wrap in withRetry:\n          // the user's session is already in a degraded state and we want\n          // to surface the original error promptly. Swallowing the restore\n          // error preserves the original failure context for the caller.\n          try {\n            await saveCloudSettings({\n              agent_settings_diff: {\n                mcp_config: mcpConfigSnapshot as SettingsValue,\n              },\n            });\n          } catch {\n            // Rollback failed; the original error takes precedence.\n          }\n        }\n        throw err;\n      }\n    } else {\n      // The local agent-server PATCH /api/settings requires at least one of\n      // the three diff fields. Skip the request entirely if nothing changed.\n      const hasLocalDiffs =\n        !!payload.agent_settings_diff ||\n        !!payload.conversation_settings_diff ||\n        !!payload.misc_settings_diff;\n      if (!hasLocalDiffs) {\n        return true;\n      }\n      if (needsMcpPreClear) {\n        await withRetry(() =>\n          new SettingsClient(getAgentServerClientOptions()).updateSettings({\n            agent_settings_diff: { mcp_config: null },\n          }),\n        );\n      }\n      try {\n        await withRetry(() =>\n          new SettingsClient(getAgentServerClientOptions()).updateSettings(\n            payload,\n          ),\n        );\n      } catch (err) {\n        if (needsMcpPreClear && mcpConfigSnapshot) {\n          // See cloud branch above for rationale.\n          try {\n            await new SettingsClient(\n              getAgentServerClientOptions(),\n            ).updateSettings({\n              agent_settings_diff: {\n                mcp_config: mcpConfigSnapshot as SettingsValue,\n              },\n            });\n          } catch {\n            // Rollback failed; the original error takes precedence.\n          }\n        }\n        throw err;\n      }\n    }\n\n    // Invalidate cache after successful save\n    clearCache();\n\n    return true;\n  }\n\n  /**\n   * Invalidate the settings cache.\n   * Call this when settings may have changed externally.\n   */\n  static invalidateCache(): void {\n    clearCache();\n  }\n}\n\nexport default SettingsService;\n"],"mappings":"6UAkBA,IAAa,EAAwB,CACnC,WACA,6BACA,6BACA,gBACA,iBACA,kBACD,CAsDK,EAAgD,IAAI,IACxD,EACD,CAEK,EAAwB,GAC5B,EAAyB,IAAI,EAAI,CAQ7B,EACJ,GACiE,CACjE,IAAM,EAA4B,EAAE,CAC9B,EAAgC,EAAE,CACxC,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,EAAM,CAC1C,EAAqB,EAAI,CAC1B,EAAsC,GAAO,EAE9C,EAAK,GAAO,EAGhB,MAAO,CAAE,YAAW,OAAM,EAYtB,EAAgB,GAAgB,KAAK,MAAM,KAAK,UAAU,EAAM,CAAC,CAEjE,GACJ,EACA,KACI,CAAE,GAAI,GAAQ,EAAE,CAAG,GAAI,GAAQ,EAAE,CAAG,EAK1C,eAAe,EACb,EACA,EAAqB,EACrB,EAAsB,IACV,CACZ,IAAK,IAAI,EAAU,EAAG,EAAU,EAAY,GAAW,EACrD,GAAI,CACF,OAAO,MAAM,GAAI,OACV,EAAO,CACd,GAAI,GAAW,EAAa,EAC1B,MAAM,EAGR,IAAM,EAAQ,EAAc,GAAK,EAEjC,MAAM,IAAI,QAAe,GAAY,CACnC,WAAW,EAAS,EAAM,EAC1B,CAIN,MAAU,MAAM,2BAA2B,CAO7C,IAAI,EAOA,CACF,SAAU,KACV,UAAW,KACX,UAAW,EACZ,CAEK,EAAe,IAAS,IAExB,MAAqB,KAAK,KAAK,CAAG,EAAc,UAAY,EAE5D,MAAmB,CACvB,EAAgB,CAAE,SAAU,KAAM,UAAW,KAAM,UAAW,EAAG,EAM7D,EACJ,GACsB,CAItB,IAAM,EAA6B,CACjC,eAJoB,EAAS,gBAAkB,EAAE,CAKjD,sBAJ2B,EAAS,uBAAyB,EAAE,CAK/D,gBAAiB,EAAS,mBAC3B,CAUK,EAAQ,EAAS,eAAe,gBACtC,GAAI,EACF,IAAK,IAAM,KAAO,EAAuB,CACvC,IAAM,EAAQ,EAAM,GAChB,IAAU,IAAA,KACX,EAAoC,GAAO,GAKlD,OAAO,GAOH,EAAuB,GAA0C,CACrE,IAAM,EAAgB,EACpB,EAAA,iBAAiB,gBAAkB,EAAE,CACrC,EAAS,gBAAkB,EAAE,CAC9B,CACK,EAAuB,EAC3B,EAAA,iBAAiB,uBAAyB,EAAE,CAC5C,EAAS,uBAAyB,EAAE,CACrC,CAEK,EAAS,CACb,GAAG,EAAU,EAAA,iBAAiB,CAC9B,GAAG,EACH,oBAAqB,CACnB,GAAI,EAAA,iBAAiB,qBAAuB,EAAE,CAC9C,GAAI,EAAS,qBAAuB,EAAE,CACvC,CACD,eAAgB,EAChB,sBAAuB,EACxB,CAEK,EAAM,EAAc,IACpB,EAAY,EAAc,UA0ChC,OAtCI,OAAO,EAAc,OAAU,WACjC,EAAO,MAAQ,EAAc,OAE3B,OAAO,GAAK,OAAU,UAAY,EAAI,MAAM,OAAS,IACvD,EAAO,UAAY,EAAI,OAErB,OAAO,GAAK,UAAa,WAC3B,EAAO,aAAe,EAAI,UAIxB,OAAO,GAAW,SAAY,YAChC,EAAO,yBAA2B,EAAU,SAE1C,OAAO,GAAW,UAAa,WACjC,EAAO,mBAAqB,EAAU,UAEpC,EAAc,aAChB,EAAO,WAAa,EAAc,YAGhC,OAAO,EAAqB,mBAAsB,YACpD,EAAO,kBAAoB,EAAqB,oBAGhD,OAAO,EAAqB,mBAAsB,UAClD,EAAqB,oBAAsB,QAE3C,EAAO,kBAAoB,EAAqB,mBAI9C,OAAO,EAAqB,gBAAmB,WACjD,EAAO,eAAiB,EAAqB,gBAG/C,EAAO,mBAAqB,CAAC,CAAC,EAAO,eAE9B,GAGH,EAAN,MAAM,CAAgB,CASpB,aAAa,qBACX,EAC8B,CAC9B,OAAO,MACL,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,YAAY,CAC5D,gBACD,CAAC,CACH,CAOH,aAAa,aAAiC,CAO5C,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QACtC,GAAI,CAEF,OAAO,EAAoB,MADP,MAAgB,EAAA,oBAAoB,CAAC,CACxB,OAC1B,EAAO,CAEd,OADA,QAAQ,KAAK,kDAAmD,EAAM,CAC/D,EAAoB,EAAE,CAAC,CAKlC,GAAI,GAAc,EAAI,EAAc,SAClC,OAAO,EAAoB,EAAqB,EAAc,SAAS,CAAC,CAG1E,GAAI,CACF,IAAM,EAAW,MAAM,KAAK,sBAAsB,CAGlD,MAFA,GAAc,SAAW,EACzB,EAAc,UAAY,KAAK,KAAK,CAC7B,EAAoB,EAAqB,EAAS,CAAC,OACnD,EAAO,CAGd,OADA,QAAQ,KAAK,qDAAsD,EAAM,CAClE,EAAoB,EAAE,CAAC,EAYlC,aAAa,4BAIV,CAED,GAAI,GAAc,EAAI,EAAc,UAClC,MAAO,CACL,cAAe,EAAc,UAAU,eACvC,qBAAsB,EAAc,UAAU,sBAC9C,iBAAkB,GACnB,CAKH,IAAM,EAAW,MAAM,KAAK,qBAAqB,YAAY,CAK7D,MAJA,GAAc,UAAY,EAC1B,AACE,EAAc,YAAY,KAAK,KAAK,CAE/B,CACL,cAAe,EAAS,eACxB,qBAAsB,EAAS,sBAC/B,iBAAkB,GACnB,CAGH,aAAa,mBAA6C,CAIxD,OAHI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAC9B,MAAM,EAAA,0BAA0B,CAElC,MAAM,IAAI,EAAA,eAChB,EAAA,6BAA6B,CAC9B,CAAC,gBAAgB,CAGpB,aAAa,+BAAyD,CAIpE,OAHI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAC9B,MAAM,EAAA,sCAAsC,CAE9C,MAAM,IAAI,EAAA,eAChB,EAAA,6BAA6B,CAC9B,CAAC,uBAAuB,CAO3B,aAAa,aACX,EACkB,CAOlB,GAAM,CAAE,UAAW,EAAgB,QAAS,EAC1C,EACD,CACK,EAAoB,OAAO,KAAK,EAAe,CAAC,OAAS,EAEzD,EAAiC,EAAE,CAGnC,EAAoB,EAAK,oBAG3B,GAAqB,OAAO,KAAK,EAAkB,CAAC,OAAS,IAC/D,EAAQ,oBAAsB,GAIhC,IAAM,EAA2B,EAAK,2BAIpC,GACA,OAAO,KAAK,EAAyB,CAAC,OAAS,IAE/C,EAAQ,2BAA6B,GAGnC,IACF,EAAQ,mBAAqB,CAAE,gBAAiB,EAAgB,EAGlE,IAAM,EAAU,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAiB9C,EAAY,EAAQ,oBAKpB,EACJ,CAAC,CAAC,GAAa,eAAgB,GAAa,EAAU,aAAe,KAgBnE,EACJ,GAAI,EACF,GAAI,CACF,AASE,EATE,GAIkB,MAHD,EAAA,oBAAoB,GAGd,gBAAgB,YAKrB,MAHD,EAAgB,sBAAsB,GAGhC,gBAAgB,gBAErC,EAMV,GAAI,EAAS,CAKX,GAAI,EAHA,EAAQ,qBACR,EAAQ,4BACV,GAEA,MAAO,GAEL,GACF,MAAM,MACJ,EAAA,kBAAkB,CAChB,oBAAqB,CAAE,WAAY,KAAM,CAC1C,CAAC,CACH,CAKH,IAAM,EAAwD,EAAE,CAC5D,EAAQ,sBACV,EAAa,oBAAsB,EAAQ,qBAEzC,EAAQ,6BACV,EAAa,2BACX,EAAQ,4BAER,IAIF,EAAa,gBAAkB,GAEjC,GAAI,CACF,MAAM,MAAgB,EAAA,kBAAkB,EAAa,CAAC,OAC/C,EAAK,CACZ,GAAI,GAAoB,EAKtB,GAAI,CACF,MAAM,EAAA,kBAAkB,CACtB,oBAAqB,CACnB,WAAY,EACb,CACF,CAAC,MACI,EAIV,MAAM,OAEH,CAOL,GAAI,EAHA,EAAQ,qBACR,EAAQ,4BACR,EAAQ,oBAEV,MAAO,GAEL,GACF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,eAAe,CAC/D,oBAAqB,CAAE,WAAY,KAAM,CAC1C,CAAC,CACH,CAEH,GAAI,CACF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,eAChD,EACD,CACF,OACM,EAAK,CACZ,GAAI,GAAoB,EAEtB,GAAI,CACF,MAAM,IAAI,EAAA,eACR,EAAA,6BAA6B,CAC9B,CAAC,eAAe,CACf,oBAAqB,CACnB,WAAY,EACb,CACF,CAAC,MACI,EAIV,MAAM,GAOV,OAFA,GAAY,CAEL,GAOT,OAAO,iBAAwB,CAC7B,GAAY"}
+{"version":3,"file":"settings-service.api.cjs","names":[],"sources":["../../../src/api/settings-service/settings-service.api.ts"],"sourcesContent":["import { SettingsClient } from \"@openhands/typescript-client/clients\";\nimport { DEFAULT_SETTINGS } from \"#/services/settings\";\nimport { Settings, SettingsSchema, SettingsValue } from \"#/types/settings\";\nimport {\n  getSdkMcpServerMap,\n  hasRedactedMcpSecretLeaf,\n  stringRecord,\n} from \"#/utils/mcp-config\";\nimport { getActiveBackend } from \"../backend-registry/active-store\";\nimport {\n  fetchCloudConversationSettingsSchema,\n  fetchCloudSettings,\n  fetchCloudSettingsSchema,\n  saveCloudSettings,\n} from \"../cloud/settings-service.api\";\nimport { getAgentServerClientOptions } from \"../agent-server-client-options\";\n\n/**\n * Fields the agent-server stores under `misc_settings.app_preferences` (see\n * SDK `openhands.sdk.settings.AppPreferences`). Mirrored here as a flat\n * partial of Settings so the rest of the frontend can keep treating them as\n * top-level keys (`settings.language`, `settings.disabled_skills`, …).\n */\nexport const APP_PREFERENCE_FIELDS = [\n  \"language\",\n  \"user_consents_to_analytics\",\n  \"enable_sound_notifications\",\n  \"git_user_name\",\n  \"git_user_email\",\n  \"disabled_skills\",\n] as const;\n\nexport type AppPreferenceField = (typeof APP_PREFERENCE_FIELDS)[number];\n\nexport type AppPreferences = Partial<Pick<Settings, AppPreferenceField>>;\n\n/**\n * Container for frontend-owned settings the agent doesn't interpret.\n * Mirrors the SDK `MiscSettings` model introduced in agent-server 1.27.\n *\n * Single nested category today (`app_preferences`). Adding a future\n * category (e.g. `ui_preferences`) is a non-breaking change for the wire\n * shape — it just adds another optional sibling here.\n */\nexport interface MiscSettings {\n  app_preferences?: AppPreferences;\n}\n\n/**\n * Response from GET /api/settings\n * Mirrors the SettingsResponse model in the agent server.\n */\nexport interface SettingsApiResponse {\n  agent_settings: Record<string, SettingsValue>;\n  conversation_settings: Record<string, SettingsValue>;\n  llm_api_key_is_set: boolean;\n  /**\n   * Frontend-owned settings the agent does not interpret (currently just\n   * `app_preferences`). Added in agent-server 1.27; earlier servers omit\n   * the field entirely, in which case the frontend falls back to defaults.\n   */\n  misc_settings?: MiscSettings;\n}\n\n/**\n * Request payload for PATCH /api/settings.\n *\n * `misc_settings_diff` is deep-merged into the persisted `misc_settings`\n * block, matching the semantics of `agent_settings_diff` /\n * `conversation_settings_diff`. A partial diff like\n * `{ app_preferences: { language: \"fr\" } }` updates only `language` and\n * leaves every other `app_preferences` field alone. Lists\n * (`disabled_skills`) are replaced wholesale rather than merged.\n */\nexport interface SettingsUpdateRequest {\n  agent_settings_diff?: Record<string, SettingsValue>;\n  conversation_settings_diff?: Record<string, SettingsValue>;\n  misc_settings_diff?: MiscSettings;\n  // Permit additional keys so this stays assignable to the underlying\n  // typescript-client SDK type, which uses `[key: string]: unknown` for\n  // forward compatibility.\n  [key: string]: unknown;\n}\n\nconst APP_PREFERENCE_FIELD_SET: ReadonlySet<string> = new Set(\n  APP_PREFERENCE_FIELDS,\n);\n\nconst isAppPreferenceField = (key: string): key is AppPreferenceField =>\n  APP_PREFERENCE_FIELD_SET.has(key);\n\n/**\n * Split known app-preference keys out of a save payload so callers can\n * route them through `misc_settings_diff.app_preferences` (local) or as\n * flat top-level keys (cloud), while the remaining fields flow into the\n * `agent_settings_diff` / `conversation_settings_diff` branches.\n */\nconst extractAppPreferences = (\n  input: Record<string, unknown>,\n): { extracted: AppPreferences; rest: Record<string, unknown> } => {\n  const extracted: AppPreferences = {};\n  const rest: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(input)) {\n    if (isAppPreferenceField(key)) {\n      (extracted as Record<string, unknown>)[key] = value;\n    } else {\n      rest[key] = value;\n    }\n  }\n  return { extracted, rest };\n};\n\n/**\n * Secret exposure mode for X-Expose-Secrets header.\n *\n * - undefined: Returns redacted secrets (\"**********\")\n * - \"encrypted\": Returns cipher-encrypted values (safe for frontend to round-trip)\n * - \"plaintext\": Returns raw secret values (backend use only!)\n */\nexport type ExposeSecretsMode = \"encrypted\" | \"plaintext\" | undefined;\n\nconst deepClone = <T>(value: T): T => JSON.parse(JSON.stringify(value)) as T;\n\nconst mergeRecords = (\n  base: Record<string, SettingsValue> | null | undefined,\n  next: Record<string, SettingsValue> | null | undefined,\n) => ({ ...(base ?? {}), ...(next ?? {}) });\n\n/**\n * Retry helper for API calls with exponential backoff.\n */\nasync function withRetry<T>(\n  fn: () => Promise<T>,\n  maxRetries: number = 3,\n  baseDelayMs: number = 500,\n): Promise<T> {\n  for (let attempt = 0; attempt < maxRetries; attempt += 1) {\n    try {\n      return await fn();\n    } catch (error) {\n      if (attempt >= maxRetries - 1) {\n        throw error;\n      }\n\n      const delay = baseDelayMs * 2 ** attempt;\n\n      await new Promise<void>((resolve) => {\n        setTimeout(resolve, delay);\n      });\n    }\n  }\n\n  throw new Error(\"Retry attempts exhausted\");\n}\n\n/**\n * In-memory cache for settings to avoid repeated network calls.\n * The cache is invalidated on save operations.\n */\nlet settingsCache: {\n  /** Settings with redacted secrets for display */\n  redacted: SettingsApiResponse | null;\n  /** Settings with encrypted secrets for conversation start */\n  encrypted: SettingsApiResponse | null;\n  /** Timestamp when the cache was last populated */\n  timestamp: number;\n} = {\n  redacted: null,\n  encrypted: null,\n  timestamp: 0,\n};\n\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\nconst isCacheValid = () => Date.now() - settingsCache.timestamp < CACHE_TTL_MS;\n\nconst clearCache = () => {\n  settingsCache = { redacted: null, encrypted: null, timestamp: 0 };\n};\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === \"object\" && !Array.isArray(value);\n\nconst basicAuthHeader = (username: string, password: string): string => {\n  const token = btoa(`${username}:${password}`);\n  return `Basic ${token}`;\n};\n\nconst headersFromMcpAuth = (\n  auth: Record<string, unknown>,\n): Record<string, string> | null => {\n  switch (auth.strategy) {\n    case \"none\":\n      return {};\n    case \"api_key\": {\n      if (typeof auth.value !== \"string\" || !auth.value) return null;\n      const header =\n        typeof auth.header_name === \"string\" && auth.header_name\n          ? auth.header_name\n          : \"Authorization\";\n      const value =\n        header === \"Authorization\" ? `Bearer ${auth.value}` : auth.value;\n      return { [header]: value };\n    }\n    case \"bearer\":\n      if (typeof auth.value !== \"string\" || !auth.value) return null;\n      return { Authorization: `Bearer ${auth.value}` };\n    case \"basic\":\n      if (\n        typeof auth.username !== \"string\" ||\n        typeof auth.password !== \"string\"\n      ) {\n        return null;\n      }\n      return { Authorization: basicAuthHeader(auth.username, auth.password) };\n    case \"header\":\n      return stringRecord(auth.headers) ?? {};\n    case \"oauth2\": {\n      const tokens = isRecord(auth.state) ? auth.state.tokens : undefined;\n      if (!isRecord(tokens) || typeof tokens.access_token !== \"string\") {\n        return null;\n      }\n      return { Authorization: `Bearer ${tokens.access_token}` };\n    }\n    default:\n      return null;\n  }\n};\n\nconst cloudCompatibleMcpConfig = (value: unknown): unknown => {\n  if (!isRecord(value)) return value;\n\n  const hasWrapper = isRecord(value.mcpServers);\n  const serverMap: Record<string, unknown> = hasWrapper\n    ? (value.mcpServers as Record<string, unknown>)\n    : value;\n\n  const converted = Object.fromEntries(\n    Object.entries(serverMap).map(([name, server]) => {\n      if (!isRecord(server) || !isRecord(server.auth)) return [name, server];\n\n      const authHeaders = headersFromMcpAuth(server.auth);\n      if (authHeaders === null) return [name, server];\n\n      const nextServer = { ...server };\n      const existingHeaders = stringRecord(server.headers) ?? {};\n      const mergedHeaders = { ...existingHeaders, ...authHeaders };\n      delete nextServer.auth;\n      if (Object.keys(mergedHeaders).length > 0) {\n        nextServer.headers = mergedHeaders;\n      } else {\n        delete nextServer.headers;\n      }\n      return [name, nextServer];\n    }),\n  );\n\n  return hasWrapper ? { ...value, mcpServers: converted } : converted;\n};\n\nconst hasRedactedMcpSecrets = (mcpConfig: unknown): boolean => {\n  const servers = getSdkMcpServerMap(mcpConfig);\n  if (!servers) return false;\n  return Object.values(servers).some(\n    (server) =>\n      hasRedactedMcpSecretLeaf(isRecord(server) ? server.auth : undefined) ||\n      hasRedactedMcpSecretLeaf(isRecord(server) ? server.headers : undefined) ||\n      hasRedactedMcpSecretLeaf(isRecord(server) ? server.env : undefined),\n  );\n};\n\nconst removesMcpServer = (previous: unknown, next: unknown): boolean => {\n  const previousServers = getSdkMcpServerMap(previous);\n  const nextServers = getSdkMcpServerMap(next);\n  if (!previousServers || !nextServers) return false;\n  return Object.keys(previousServers).some((name) => !(name in nextServers));\n};\n\n/**\n * Transform API response into Settings object with derived fields.\n */\nconst transformApiResponse = (\n  response: SettingsApiResponse,\n): Partial<Settings> => {\n  const agentSettings = response.agent_settings ?? {};\n  const conversationSettings = response.conversation_settings ?? {};\n\n  const partial: Partial<Settings> = {\n    agent_settings: agentSettings,\n    conversation_settings: conversationSettings,\n    llm_api_key_set: response.llm_api_key_is_set,\n  };\n\n  // App-level user preferences come back nested under\n  // `misc_settings.app_preferences` from the local agent-server (added in\n  // 1.27, restructured into the `misc_settings` container in the follow-up\n  // refactor). Hoist them onto the flat Settings shape the rest of the\n  // frontend already speaks. Older servers omit the `misc_settings` field\n  // entirely; the migration helper invoked from `getSettings` promotes any\n  // leftover localStorage values to the server on first run, so the omitted\n  // case just falls back to defaults.\n  const prefs = response.misc_settings?.app_preferences;\n  if (prefs) {\n    for (const key of APP_PREFERENCE_FIELDS) {\n      const value = prefs[key];\n      if (value !== undefined) {\n        (partial as Record<string, unknown>)[key] = value;\n      }\n    }\n  }\n\n  return partial;\n};\n\n/**\n * Sync derived settings fields from agent_settings and conversation_settings.\n * This ensures backward compatibility with code that reads top-level fields.\n */\nconst syncDerivedSettings = (settings: Partial<Settings>): Settings => {\n  const agentSettings = mergeRecords(\n    DEFAULT_SETTINGS.agent_settings ?? {},\n    settings.agent_settings ?? {},\n  );\n  const conversationSettings = mergeRecords(\n    DEFAULT_SETTINGS.conversation_settings ?? {},\n    settings.conversation_settings ?? {},\n  );\n\n  const merged = {\n    ...deepClone(DEFAULT_SETTINGS),\n    ...settings,\n    provider_tokens_set: {\n      ...(DEFAULT_SETTINGS.provider_tokens_set ?? {}),\n      ...(settings.provider_tokens_set ?? {}),\n    },\n    agent_settings: agentSettings,\n    conversation_settings: conversationSettings,\n  } as Settings;\n\n  const llm = agentSettings.llm as Record<string, SettingsValue> | undefined;\n  const condenser = agentSettings.condenser as\n    | Record<string, SettingsValue>\n    | undefined;\n\n  if (typeof agentSettings.agent === \"string\") {\n    merged.agent = agentSettings.agent;\n  }\n  if (typeof llm?.model === \"string\" && llm.model.length > 0) {\n    merged.llm_model = llm.model;\n  }\n  if (typeof llm?.base_url === \"string\") {\n    merged.llm_base_url = llm.base_url;\n  }\n  // Note: api_key may be redacted (\"**********\") when fetched without expose header\n  // We don't sync it to top-level llm_api_key to avoid overwriting with redacted value\n  if (typeof condenser?.enabled === \"boolean\") {\n    merged.enable_default_condenser = condenser.enabled;\n  }\n  if (typeof condenser?.max_size === \"number\") {\n    merged.condenser_max_size = condenser.max_size;\n  }\n  if (typeof conversationSettings.confirmation_mode === \"boolean\") {\n    merged.confirmation_mode = conversationSettings.confirmation_mode;\n  }\n  if (\n    typeof conversationSettings.security_analyzer === \"string\" ||\n    conversationSettings.security_analyzer === null\n  ) {\n    merged.security_analyzer = conversationSettings.security_analyzer as\n      | string\n      | null;\n  }\n  if (typeof conversationSettings.max_iterations === \"number\") {\n    merged.max_iterations = conversationSettings.max_iterations;\n  }\n\n  merged.search_api_key_set = !!merged.search_api_key;\n\n  return merged;\n};\n\nclass SettingsService {\n  /**\n   * Fetch settings from the agent server API with retry logic.\n   *\n   * @param exposeSecrets - Controls how secrets are returned:\n   *   - undefined: Secrets are redacted (\"**********\") - safe for display\n   *   - \"encrypted\": Secrets are cipher-encrypted - safe for round-trip to start conversation\n   *   - \"plaintext\": Raw secrets - DO NOT USE from frontend\n   */\n  static async fetchSettingsFromApi(\n    exposeSecrets?: ExposeSecretsMode,\n  ): Promise<SettingsApiResponse> {\n    return withRetry(() =>\n      new SettingsClient(getAgentServerClientOptions()).getSettings({\n        exposeSecrets,\n      }),\n    ) as Promise<SettingsApiResponse>;\n  }\n\n  /**\n   * Get settings for display (secrets are redacted).\n   * Uses in-memory cache for performance.\n   */\n  static async getSettings(): Promise<Settings> {\n    // Cloud uses a different settings shape (flat top-level fields\n    // including provider_tokens_set, llm_model, etc.). Branch out before\n    // touching the local-only cache: cloud responses bypass the local\n    // SettingsApiResponse shape and feed straight into syncDerivedSettings\n    // so cloud-native fields like provider_tokens_set reach the GUI's\n    // useUserProviders → useAppInstallations → useGitRepositories chain.\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      try {\n        const cloud = await withRetry(() => fetchCloudSettings());\n        return syncDerivedSettings(cloud);\n      } catch (error) {\n        console.warn(\"Failed to fetch cloud settings, using defaults:\", error);\n        return syncDerivedSettings({});\n      }\n    }\n\n    // Check cache first\n    if (isCacheValid() && settingsCache.redacted) {\n      return syncDerivedSettings(transformApiResponse(settingsCache.redacted));\n    }\n\n    try {\n      const response = await this.fetchSettingsFromApi();\n      settingsCache.redacted = response;\n      settingsCache.timestamp = Date.now();\n      return syncDerivedSettings(transformApiResponse(response));\n    } catch (error) {\n      // If API fails, return defaults\n      console.warn(\"Failed to fetch settings from API, using defaults:\", error);\n      return syncDerivedSettings({});\n    }\n  }\n\n  /**\n   * Get settings with encrypted secrets for starting conversations.\n   * The encrypted secrets can be passed to the start conversation API\n   * with secrets_encrypted=true for server-side decryption.\n   *\n   * @throws Error if encrypted settings cannot be fetched - conversations\n   *   should not start with broken/redacted credentials.\n   */\n  static async getSettingsForConversation(): Promise<{\n    agentSettings: Record<string, SettingsValue>;\n    conversationSettings: Record<string, SettingsValue>;\n    secretsEncrypted: boolean;\n  }> {\n    // Check cache first\n    if (isCacheValid() && settingsCache.encrypted) {\n      return {\n        agentSettings: settingsCache.encrypted.agent_settings,\n        conversationSettings: settingsCache.encrypted.conversation_settings,\n        secretsEncrypted: true,\n      };\n    }\n\n    // Fetch encrypted settings - this MUST succeed for conversations to work.\n    // Do not fall back to redacted settings as that would cause auth failures.\n    const response = await this.fetchSettingsFromApi(\"encrypted\");\n    settingsCache.encrypted = response;\n    if (!settingsCache.timestamp) {\n      settingsCache.timestamp = Date.now();\n    }\n    return {\n      agentSettings: response.agent_settings,\n      conversationSettings: response.conversation_settings,\n      secretsEncrypted: true,\n    };\n  }\n\n  static async getSettingsSchema(): Promise<SettingsSchema> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return (await fetchCloudSettingsSchema()) as SettingsSchema;\n    }\n    return (await new SettingsClient(\n      getAgentServerClientOptions(),\n    ).getAgentSchema()) as SettingsSchema;\n  }\n\n  static async getConversationSettingsSchema(): Promise<SettingsSchema> {\n    if (getActiveBackend().backend.kind === \"cloud\") {\n      return (await fetchCloudConversationSettingsSchema()) as SettingsSchema;\n    }\n    return (await new SettingsClient(\n      getAgentServerClientOptions(),\n    ).getConversationSchema()) as SettingsSchema;\n  }\n\n  /**\n   * Save settings to the agent server API.\n   * Uses PATCH for incremental updates.\n   */\n  static async saveSettings(\n    settings: Partial<Settings> & Record<string, unknown>,\n  ): Promise<boolean> {\n    // Split app-level user-preference fields (language, git identity, sound\n    // notifications, analytics consent, disabled_skills) off and route them\n    // through `misc_settings_diff.app_preferences` (local) or as flat\n    // top-level keys (cloud). The local agent-server stores them under\n    // `PersistedSettings.misc_settings.app_preferences`; the cloud accepts\n    // them as flat keys on `POST /api/v1/settings`.\n    const { extracted: appPreferences, rest } = extractAppPreferences(\n      settings as Record<string, unknown>,\n    );\n    const hasAppPreferences = Object.keys(appPreferences).length > 0;\n\n    const payload: SettingsUpdateRequest = {};\n\n    // Extract agent_settings_diff\n    const agentSettingsDiff = rest.agent_settings_diff as\n      | Record<string, SettingsValue>\n      | undefined;\n    if (agentSettingsDiff && Object.keys(agentSettingsDiff).length > 0) {\n      payload.agent_settings_diff = agentSettingsDiff;\n    }\n\n    // Extract conversation_settings_diff\n    const conversationSettingsDiff = rest.conversation_settings_diff as\n      | Record<string, SettingsValue>\n      | undefined;\n    if (\n      conversationSettingsDiff &&\n      Object.keys(conversationSettingsDiff).length > 0\n    ) {\n      payload.conversation_settings_diff = conversationSettingsDiff;\n    }\n\n    if (hasAppPreferences) {\n      payload.misc_settings_diff = { app_preferences: appPreferences };\n    }\n\n    const isCloud = getActiveBackend().backend.kind === \"cloud\";\n\n    // The backend applies ``agent_settings_diff`` by deep-merging it into the\n    // existing ``agent_settings`` dict (see SDK\n    // ``openhands.agent_server.persistence.models._deep_merge``). That works\n    // for scalar fields but is wrong for ``mcp_config``, which is\n    // a name-keyed map: a diff that omits a server cannot remove it (stale\n    // key stays), and a diff whose key indices shift (e.g. after deleting\n    // index 0, the second server is renumbered) leaves the original keys\n    // behind as duplicates pointing to the wrong server config.\n    //\n    // The only way to make ``mcp_config`` behave like a replace through this\n    // API is to first null it out — ``null`` is not a dict, so deep-merge\n    // takes the else branch and sets the field to ``None`` outright — and\n    // then send the new value in a follow-up call. We do this for every\n    // ``mcp_config`` write, including adds (the wasted round-trip is\n    // negligible for this user action and avoids divergent code paths).\n    const agentDiff = payload.agent_settings_diff;\n    // Send a pre-clear PATCH when the diff sets ``mcp_config`` to a non-null\n    // value. A second PATCH below then writes the new value. Skipping the\n    // pre-clear when the caller is already clearing (``mcp_config: null``)\n    // avoids a pointless duplicate request.\n    const needsMcpPreClear =\n      !!agentDiff && \"mcp_config\" in agentDiff && agentDiff.mcp_config !== null;\n\n    // The pre-clear is destructive: if the follow-up write fails after the\n    // clear succeeds, the user's MCP config is left empty. Snapshot the\n    // previous value (in raw SDK-native shape, NOT the GUI's parsed MCPConfig)\n    // before pre-clearing so we can attempt a best-effort rollback. The\n    // original write error is always re-thrown to the caller regardless\n    // of rollback success — the GUI's react-query mutations surface that\n    // as an error toast so the user knows to retry.\n    //\n    // Snapshot must be the SDK-native server map because that is what the\n    // backend expects on the rollback PATCH.\n    // ``SettingsService.getSettings`` returns a GUI Settings object whose\n    // ``mcp_config`` is typed as the parsed frontend MCPConfig and\n    // defaults to empty arrays when nothing is installed, so it is not\n    // suitable for round-tripping back to the backend.\n    let mcpConfigSnapshot: unknown = undefined;\n    if (needsMcpPreClear) {\n      try {\n        if (isCloud) {\n          const raw = (await fetchCloudSettings()) as {\n            agent_settings?: { mcp_config?: unknown };\n          };\n          mcpConfigSnapshot = raw?.agent_settings?.mcp_config;\n        } else {\n          const raw = (await SettingsService.fetchSettingsFromApi()) as {\n            agent_settings?: { mcp_config?: unknown };\n          };\n          mcpConfigSnapshot = raw?.agent_settings?.mcp_config;\n        }\n      } catch {\n        // Snapshot failed (network blip, etc.). Continue without rollback\n        // ability — the original write error will still surface.\n      }\n    }\n\n    // Cloud settings may redact MCP env/header/auth secrets without an\n    // encrypted exposure mode. A pre-clear before a non-delete update can\n    // permanently erase unchanged secrets; for updates that keep all existing\n    // server keys, rely on the backend deep-merge to preserve redacted leaves\n    // while applying edited fields and newly typed credentials.\n    const shouldUseCloudMergePatchForRedactedMcpSecrets =\n      isCloud &&\n      needsMcpPreClear &&\n      hasRedactedMcpSecrets(mcpConfigSnapshot) &&\n      !removesMcpServer(mcpConfigSnapshot, agentDiff?.mcp_config);\n    const shouldPreClearMcpConfig =\n      needsMcpPreClear && !shouldUseCloudMergePatchForRedactedMcpSecrets;\n\n    if (isCloud) {\n      const hasCloudWork =\n        !!payload.agent_settings_diff ||\n        !!payload.conversation_settings_diff ||\n        hasAppPreferences;\n      if (!hasCloudWork) {\n        return true;\n      }\n      if (shouldPreClearMcpConfig) {\n        await withRetry(() =>\n          saveCloudSettings({\n            agent_settings_diff: { mcp_config: null },\n          }),\n        );\n      }\n      // Build the cloud payload from the same diffs, but as a separate\n      // object so undefined keys don't appear in the call (saveCloudSettings\n      // is called from tests with an exact-shape assertion).\n      const cloudPayload: Parameters<typeof saveCloudSettings>[0] = {};\n      if (payload.agent_settings_diff) {\n        cloudPayload.agent_settings_diff = { ...payload.agent_settings_diff };\n        if (\"mcp_config\" in cloudPayload.agent_settings_diff) {\n          cloudPayload.agent_settings_diff.mcp_config =\n            cloudCompatibleMcpConfig(\n              cloudPayload.agent_settings_diff.mcp_config,\n            ) as SettingsValue;\n        }\n      }\n      if (payload.conversation_settings_diff) {\n        cloudPayload.conversation_settings_diff =\n          payload.conversation_settings_diff;\n      }\n      if (hasAppPreferences) {\n        // The cloud `POST /api/v1/settings` takes app-preference fields as\n        // flat top-level keys (not under `app_preferences_diff`).\n        // `saveCloudSettings` re-flattens them onto the request body.\n        cloudPayload.app_preferences = appPreferences;\n      }\n      try {\n        await withRetry(() => saveCloudSettings(cloudPayload));\n      } catch (err) {\n        if (shouldPreClearMcpConfig && mcpConfigSnapshot) {\n          // Best-effort rollback. We deliberately do not wrap in withRetry:\n          // the user's session is already in a degraded state and we want\n          // to surface the original error promptly. Swallowing the restore\n          // error preserves the original failure context for the caller.\n          try {\n            await saveCloudSettings({\n              agent_settings_diff: {\n                mcp_config: mcpConfigSnapshot as SettingsValue,\n              },\n            });\n          } catch {\n            // Rollback failed; the original error takes precedence.\n          }\n        }\n        throw err;\n      }\n    } else {\n      // The local agent-server PATCH /api/settings requires at least one of\n      // the three diff fields. Skip the request entirely if nothing changed.\n      const hasLocalDiffs =\n        !!payload.agent_settings_diff ||\n        !!payload.conversation_settings_diff ||\n        !!payload.misc_settings_diff;\n      if (!hasLocalDiffs) {\n        return true;\n      }\n      if (shouldPreClearMcpConfig) {\n        await withRetry(() =>\n          new SettingsClient(getAgentServerClientOptions()).updateSettings({\n            agent_settings_diff: { mcp_config: null },\n          }),\n        );\n      }\n      try {\n        await withRetry(() =>\n          new SettingsClient(getAgentServerClientOptions()).updateSettings(\n            payload,\n          ),\n        );\n      } catch (err) {\n        if (shouldPreClearMcpConfig && mcpConfigSnapshot) {\n          // See cloud branch above for rationale.\n          try {\n            await new SettingsClient(\n              getAgentServerClientOptions(),\n            ).updateSettings({\n              agent_settings_diff: {\n                mcp_config: mcpConfigSnapshot as SettingsValue,\n              },\n            });\n          } catch {\n            // Rollback failed; the original error takes precedence.\n          }\n        }\n        throw err;\n      }\n    }\n\n    // Invalidate cache after successful save\n    clearCache();\n\n    return true;\n  }\n\n  /**\n   * Invalidate the settings cache.\n   * Call this when settings may have changed externally.\n   */\n  static invalidateCache(): void {\n    clearCache();\n  }\n}\n\nexport default SettingsService;\n"],"mappings":"ucAuBA,IAAa,EAAwB,CACnC,WACA,6BACA,6BACA,gBACA,iBACA,kBACD,CAsDK,EAAgD,IAAI,IACxD,EACD,CAEK,EAAwB,GAC5B,EAAyB,IAAI,EAAI,CAQ7B,EACJ,GACiE,CACjE,IAAM,EAA4B,EAAE,CAC9B,EAAgC,EAAE,CACxC,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,EAAM,CAC1C,EAAqB,EAAI,CAC1B,EAAsC,GAAO,EAE9C,EAAK,GAAO,EAGhB,MAAO,CAAE,YAAW,OAAM,EAYtB,EAAgB,GAAgB,KAAK,MAAM,KAAK,UAAU,EAAM,CAAC,CAEjE,GACJ,EACA,KACI,CAAE,GAAI,GAAQ,EAAE,CAAG,GAAI,GAAQ,EAAE,CAAG,EAK1C,eAAe,EACb,EACA,EAAqB,EACrB,EAAsB,IACV,CACZ,IAAK,IAAI,EAAU,EAAG,EAAU,EAAY,GAAW,EACrD,GAAI,CACF,OAAO,MAAM,GAAI,OACV,EAAO,CACd,GAAI,GAAW,EAAa,EAC1B,MAAM,EAGR,IAAM,EAAQ,EAAc,GAAK,EAEjC,MAAM,IAAI,QAAe,GAAY,CACnC,WAAW,EAAS,EAAM,EAC1B,CAIN,MAAU,MAAM,2BAA2B,CAO7C,IAAI,EAOA,CACF,SAAU,KACV,UAAW,KACX,UAAW,EACZ,CAEK,EAAe,IAAS,IAExB,MAAqB,KAAK,KAAK,CAAG,EAAc,UAAY,EAE5D,MAAmB,CACvB,EAAgB,CAAE,SAAU,KAAM,UAAW,KAAM,UAAW,EAAG,EAG7D,EAAY,GAChB,CAAC,CAAC,GAAS,OAAO,GAAU,UAAY,CAAC,MAAM,QAAQ,EAAM,CAEzD,GAAmB,EAAkB,IAElC,SADO,KAAK,GAAG,EAAS,GAAG,IAClB,GAGZ,EACJ,GACkC,CAClC,OAAQ,EAAK,SAAb,CACE,IAAK,OACH,MAAO,EAAE,CACX,IAAK,UAAW,CACd,GAAI,OAAO,EAAK,OAAU,UAAY,CAAC,EAAK,MAAO,OAAO,KAC1D,IAAM,EACJ,OAAO,EAAK,aAAgB,UAAY,EAAK,YACzC,EAAK,YACL,gBACA,EACJ,IAAW,gBAAkB,UAAU,EAAK,QAAU,EAAK,MAC7D,MAAO,EAAG,GAAS,EAAO,CAE5B,IAAK,SAEH,OADI,OAAO,EAAK,OAAU,UAAY,CAAC,EAAK,MAAc,KACnD,CAAE,cAAe,UAAU,EAAK,QAAS,CAClD,IAAK,QAOH,OALE,OAAO,EAAK,UAAa,UACzB,OAAO,EAAK,UAAa,SAElB,KAEF,CAAE,cAAe,EAAgB,EAAK,SAAU,EAAK,SAAS,CAAE,CACzE,IAAK,SACH,OAAO,EAAA,aAAa,EAAK,QAAQ,EAAI,EAAE,CACzC,IAAK,SAAU,CACb,IAAM,EAAS,EAAS,EAAK,MAAM,CAAG,EAAK,MAAM,OAAS,IAAA,GAI1D,MAHI,CAAC,EAAS,EAAO,EAAI,OAAO,EAAO,cAAiB,SAC/C,KAEF,CAAE,cAAe,UAAU,EAAO,eAAgB,CAE3D,QACE,OAAO,OAIP,EAA4B,GAA4B,CAC5D,GAAI,CAAC,EAAS,EAAM,CAAE,OAAO,EAE7B,IAAM,EAAa,EAAS,EAAM,WAAW,CACvC,EAAqC,EACtC,EAAM,WACP,EAEE,EAAY,OAAO,YACvB,OAAO,QAAQ,EAAU,CAAC,KAAK,CAAC,EAAM,KAAY,CAChD,GAAI,CAAC,EAAS,EAAO,EAAI,CAAC,EAAS,EAAO,KAAK,CAAE,MAAO,CAAC,EAAM,EAAO,CAEtE,IAAM,EAAc,EAAmB,EAAO,KAAK,CACnD,GAAI,IAAgB,KAAM,MAAO,CAAC,EAAM,EAAO,CAE/C,IAAM,EAAa,CAAE,GAAG,EAAQ,CAE1B,EAAgB,CAAE,GADA,EAAA,aAAa,EAAO,QAAQ,EAAI,EAAE,CACd,GAAG,EAAa,CAO5D,OANA,OAAO,EAAW,KACd,OAAO,KAAK,EAAc,CAAC,OAAS,EACtC,EAAW,QAAU,EAErB,OAAO,EAAW,QAEb,CAAC,EAAM,EAAW,EACzB,CACH,CAED,OAAO,EAAa,CAAE,GAAG,EAAO,WAAY,EAAW,CAAG,GAGtD,EAAyB,GAAgC,CAC7D,IAAM,EAAU,EAAA,mBAAmB,EAAU,CAE7C,OADK,EACE,OAAO,OAAO,EAAQ,CAAC,KAC3B,GACC,EAAA,yBAAyB,EAAS,EAAO,CAAG,EAAO,KAAO,IAAA,GAAU,EACpE,EAAA,yBAAyB,EAAS,EAAO,CAAG,EAAO,QAAU,IAAA,GAAU,EACvE,EAAA,yBAAyB,EAAS,EAAO,CAAG,EAAO,IAAM,IAAA,GAAU,CACtE,CANoB,IASjB,GAAoB,EAAmB,IAA2B,CACtE,IAAM,EAAkB,EAAA,mBAAmB,EAAS,CAC9C,EAAc,EAAA,mBAAmB,EAAK,CAE5C,MADI,CAAC,GAAmB,CAAC,EAAoB,GACtC,OAAO,KAAK,EAAgB,CAAC,KAAM,GAAS,EAAE,KAAQ,GAAa,EAMtE,EACJ,GACsB,CAItB,IAAM,EAA6B,CACjC,eAJoB,EAAS,gBAAkB,EAAE,CAKjD,sBAJ2B,EAAS,uBAAyB,EAAE,CAK/D,gBAAiB,EAAS,mBAC3B,CAUK,EAAQ,EAAS,eAAe,gBACtC,GAAI,EACF,IAAK,IAAM,KAAO,EAAuB,CACvC,IAAM,EAAQ,EAAM,GAChB,IAAU,IAAA,KACX,EAAoC,GAAO,GAKlD,OAAO,GAOH,EAAuB,GAA0C,CACrE,IAAM,EAAgB,EACpB,EAAA,iBAAiB,gBAAkB,EAAE,CACrC,EAAS,gBAAkB,EAAE,CAC9B,CACK,EAAuB,EAC3B,EAAA,iBAAiB,uBAAyB,EAAE,CAC5C,EAAS,uBAAyB,EAAE,CACrC,CAEK,EAAS,CACb,GAAG,EAAU,EAAA,iBAAiB,CAC9B,GAAG,EACH,oBAAqB,CACnB,GAAI,EAAA,iBAAiB,qBAAuB,EAAE,CAC9C,GAAI,EAAS,qBAAuB,EAAE,CACvC,CACD,eAAgB,EAChB,sBAAuB,EACxB,CAEK,EAAM,EAAc,IACpB,EAAY,EAAc,UAsChC,OAlCI,OAAO,EAAc,OAAU,WACjC,EAAO,MAAQ,EAAc,OAE3B,OAAO,GAAK,OAAU,UAAY,EAAI,MAAM,OAAS,IACvD,EAAO,UAAY,EAAI,OAErB,OAAO,GAAK,UAAa,WAC3B,EAAO,aAAe,EAAI,UAIxB,OAAO,GAAW,SAAY,YAChC,EAAO,yBAA2B,EAAU,SAE1C,OAAO,GAAW,UAAa,WACjC,EAAO,mBAAqB,EAAU,UAEpC,OAAO,EAAqB,mBAAsB,YACpD,EAAO,kBAAoB,EAAqB,oBAGhD,OAAO,EAAqB,mBAAsB,UAClD,EAAqB,oBAAsB,QAE3C,EAAO,kBAAoB,EAAqB,mBAI9C,OAAO,EAAqB,gBAAmB,WACjD,EAAO,eAAiB,EAAqB,gBAG/C,EAAO,mBAAqB,CAAC,CAAC,EAAO,eAE9B,GAGH,EAAN,MAAM,CAAgB,CASpB,aAAa,qBACX,EAC8B,CAC9B,OAAO,MACL,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,YAAY,CAC5D,gBACD,CAAC,CACH,CAOH,aAAa,aAAiC,CAO5C,GAAI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QACtC,GAAI,CAEF,OAAO,EAAoB,MADP,MAAgB,EAAA,oBAAoB,CAAC,CACxB,OAC1B,EAAO,CAEd,OADA,QAAQ,KAAK,kDAAmD,EAAM,CAC/D,EAAoB,EAAE,CAAC,CAKlC,GAAI,GAAc,EAAI,EAAc,SAClC,OAAO,EAAoB,EAAqB,EAAc,SAAS,CAAC,CAG1E,GAAI,CACF,IAAM,EAAW,MAAM,KAAK,sBAAsB,CAGlD,MAFA,GAAc,SAAW,EACzB,EAAc,UAAY,KAAK,KAAK,CAC7B,EAAoB,EAAqB,EAAS,CAAC,OACnD,EAAO,CAGd,OADA,QAAQ,KAAK,qDAAsD,EAAM,CAClE,EAAoB,EAAE,CAAC,EAYlC,aAAa,4BAIV,CAED,GAAI,GAAc,EAAI,EAAc,UAClC,MAAO,CACL,cAAe,EAAc,UAAU,eACvC,qBAAsB,EAAc,UAAU,sBAC9C,iBAAkB,GACnB,CAKH,IAAM,EAAW,MAAM,KAAK,qBAAqB,YAAY,CAK7D,MAJA,GAAc,UAAY,EAC1B,AACE,EAAc,YAAY,KAAK,KAAK,CAE/B,CACL,cAAe,EAAS,eACxB,qBAAsB,EAAS,sBAC/B,iBAAkB,GACnB,CAGH,aAAa,mBAA6C,CAIxD,OAHI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAC9B,MAAM,EAAA,0BAA0B,CAElC,MAAM,IAAI,EAAA,eAChB,EAAA,6BAA6B,CAC9B,CAAC,gBAAgB,CAGpB,aAAa,+BAAyD,CAIpE,OAHI,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAC9B,MAAM,EAAA,sCAAsC,CAE9C,MAAM,IAAI,EAAA,eAChB,EAAA,6BAA6B,CAC9B,CAAC,uBAAuB,CAO3B,aAAa,aACX,EACkB,CAOlB,GAAM,CAAE,UAAW,EAAgB,QAAS,EAC1C,EACD,CACK,EAAoB,OAAO,KAAK,EAAe,CAAC,OAAS,EAEzD,EAAiC,EAAE,CAGnC,EAAoB,EAAK,oBAG3B,GAAqB,OAAO,KAAK,EAAkB,CAAC,OAAS,IAC/D,EAAQ,oBAAsB,GAIhC,IAAM,EAA2B,EAAK,2BAIpC,GACA,OAAO,KAAK,EAAyB,CAAC,OAAS,IAE/C,EAAQ,2BAA6B,GAGnC,IACF,EAAQ,mBAAqB,CAAE,gBAAiB,EAAgB,EAGlE,IAAM,EAAU,EAAA,kBAAkB,CAAC,QAAQ,OAAS,QAiB9C,EAAY,EAAQ,oBAKpB,EACJ,CAAC,CAAC,GAAa,eAAgB,GAAa,EAAU,aAAe,KAgBnE,EACJ,GAAI,EACF,GAAI,CACF,AASE,EATE,GAIkB,MAHD,EAAA,oBAAoB,GAGd,gBAAgB,YAKrB,MAHD,EAAgB,sBAAsB,GAGhC,gBAAgB,gBAErC,EAWV,IAAM,EACJ,GACA,GACA,EAAsB,EAAkB,EACxC,CAAC,EAAiB,EAAmB,GAAW,WAAW,CACvD,EACJ,GAAoB,CAAC,EAEvB,GAAI,EAAS,CAKX,GAAI,EAHA,EAAQ,qBACR,EAAQ,4BACV,GAEA,MAAO,GAEL,GACF,MAAM,MACJ,EAAA,kBAAkB,CAChB,oBAAqB,CAAE,WAAY,KAAM,CAC1C,CAAC,CACH,CAKH,IAAM,EAAwD,EAAE,CAC5D,EAAQ,sBACV,EAAa,oBAAsB,CAAE,GAAG,EAAQ,oBAAqB,CACjE,eAAgB,EAAa,sBAC/B,EAAa,oBAAoB,WAC/B,EACE,EAAa,oBAAoB,WAClC,GAGH,EAAQ,6BACV,EAAa,2BACX,EAAQ,4BAER,IAIF,EAAa,gBAAkB,GAEjC,GAAI,CACF,MAAM,MAAgB,EAAA,kBAAkB,EAAa,CAAC,OAC/C,EAAK,CACZ,GAAI,GAA2B,EAK7B,GAAI,CACF,MAAM,EAAA,kBAAkB,CACtB,oBAAqB,CACnB,WAAY,EACb,CACF,CAAC,MACI,EAIV,MAAM,OAEH,CAOL,GAAI,EAHA,EAAQ,qBACR,EAAQ,4BACR,EAAQ,oBAEV,MAAO,GAEL,GACF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,eAAe,CAC/D,oBAAqB,CAAE,WAAY,KAAM,CAC1C,CAAC,CACH,CAEH,GAAI,CACF,MAAM,MACJ,IAAI,EAAA,eAAe,EAAA,6BAA6B,CAAC,CAAC,eAChD,EACD,CACF,OACM,EAAK,CACZ,GAAI,GAA2B,EAE7B,GAAI,CACF,MAAM,IAAI,EAAA,eACR,EAAA,6BAA6B,CAC9B,CAAC,eAAe,CACf,oBAAqB,CACnB,WAAY,EACb,CACF,CAAC,MACI,EAIV,MAAM,GAOV,OAFA,GAAY,CAEL,GAOT,OAAO,iBAAwB,CAC7B,GAAY"}