@otto-code/server 0.5.0

package/dist/src/server/persisted-config.js

@@ -0,0 +1,471 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { AgentProviderRuntimeSettingsMapSchema, migrateProviderSettings, ProviderOverridesSchema, } from "./agent/provider-launch-config.js";
+import { ensurePrivateFile, writePrivateFileAtomicSync } from "./private-files.js";
+import { TerminalProfileSchema } from "@otto-code/protocol/messages";
+export const LogLevelSchema = z.enum(["trace", "debug", "info", "warn", "error", "fatal"]);
+export const LogFormatSchema = z.enum(["pretty", "json"]);
+const LogConfigSchema = z
+    .object({
+    // Legacy global log settings (kept for backwards compatibility).
+    level: LogLevelSchema.optional(),
+    format: LogFormatSchema.optional(),
+    console: z
+        .object({
+        level: LogLevelSchema.optional(),
+        format: LogFormatSchema.optional(),
+    })
+        .strict()
+        .optional(),
+    file: z
+        .object({
+        level: LogLevelSchema.optional(),
+        path: z.string().min(1).optional(),
+        rotate: z
+            .object({
+            maxSize: z.string().min(1).optional(),
+            maxFiles: z.number().int().positive().optional(),
+        })
+            .strict()
+            .optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+const OpenAiSpeechEndpointSchema = z
+    .object({
+    apiKey: z.string().trim().min(1).optional(),
+    baseUrl: z.string().trim().min(1).optional(),
+})
+    .strict();
+const OpenAiProviderSchema = z
+    .object({
+    apiKey: z.string().min(1).optional(),
+    baseUrl: z.string().trim().min(1).optional(),
+    stt: OpenAiSpeechEndpointSchema.optional(),
+    tts: OpenAiSpeechEndpointSchema.optional(),
+})
+    .strict();
+const LocalSpeechProviderSchema = z
+    .object({
+    modelsDir: z.string().min(1).optional(),
+})
+    .strict();
+const ProvidersSchema = z
+    .object({
+    openai: OpenAiProviderSchema.optional(),
+    local: LocalSpeechProviderSchema.optional(),
+})
+    .strict();
+const WorktreesConfigSchema = z
+    .object({
+    root: z.string().min(1).optional(),
+})
+    .strict();
+const BcryptHashSchema = z.string().regex(/^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/, {
+    message: "Expected a bcrypt hash",
+});
+const DaemonAuthSchema = z
+    .object({
+    password: BcryptHashSchema.optional(),
+})
+    .strict();
+const SpeechProviderIdSchema = z
+    .string()
+    .trim()
+    .toLowerCase()
+    .pipe(z.enum(["openai", "local"]));
+const FeatureDictationSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    stt: z
+        .object({
+        provider: SpeechProviderIdSchema.optional(),
+        model: z.string().min(1).optional(),
+        language: z.string().trim().min(1).optional(),
+        confidenceThreshold: z.number().optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+const FeatureVoiceModeSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    llm: z
+        .object({
+        provider: z.string().optional(),
+        model: z.string().min(1).optional(),
+    })
+        .strict()
+        .optional(),
+    stt: z
+        .object({
+        provider: SpeechProviderIdSchema.optional(),
+        model: z.string().min(1).optional(),
+        language: z.string().trim().min(1).optional(),
+    })
+        .strict()
+        .optional(),
+    turnDetection: z
+        .object({
+        provider: SpeechProviderIdSchema.optional(),
+    })
+        .strict()
+        .optional(),
+    tts: z
+        .object({
+        provider: SpeechProviderIdSchema.optional(),
+        model: z.string().min(1).optional(),
+        voice: z
+            .enum([
+            "alloy",
+            "ash",
+            "ballad",
+            "coral",
+            "echo",
+            "fable",
+            "nova",
+            "onyx",
+            "sage",
+            "shimmer",
+            "verse",
+        ])
+            .optional(),
+        speakerId: z.number().int().optional(),
+        speed: z.number().optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+const FeatureWebUiSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    distDir: z.string().min(1).optional(),
+})
+    .strict();
+const StructuredGenerationProviderConfigSchema = z
+    .object({
+    provider: z.string().min(1),
+    model: z.string().min(1).optional(),
+    thinkingOptionId: z.string().min(1).optional(),
+})
+    .strict();
+const AgentMetadataGenerationSchema = z
+    .object({
+    providers: z.array(StructuredGenerationProviderConfigSchema).optional(),
+})
+    .strict();
+// Persisted shape of an agent personality. Mirrors AgentPersonalitySchema on the
+// wire; effort/roles stay plain strings (validated against the daemon catalog at
+// use time). Passthrough so a config written by a newer daemon round-trips
+// unknown fields instead of dropping them.
+const AgentPersonalitySpinnerConfigSchema = z
+    .object({
+    glowA: z.string().min(1),
+    glowB: z.string().min(1),
+})
+    .passthrough();
+const AgentPersonalityVoiceConfigSchema = z
+    .object({
+    provider: z.string().min(1),
+    model: z.string().min(1),
+    name: z.string().min(1),
+})
+    .passthrough();
+export const AgentPersonalityConfigSchema = z
+    .object({
+    id: z.string().min(1),
+    name: z.string().min(1),
+    provider: z.string().min(1),
+    model: z.string().min(1),
+    effortLevel: z.string().min(1).optional(),
+    modeId: z.string().min(1).optional(),
+    personalityPrompt: z.string().optional(),
+    respectGlobalAppendPrompt: z.boolean().optional(),
+    roles: z.array(z.string().min(1)).optional(),
+    spinner: AgentPersonalitySpinnerConfigSchema.optional(),
+    voice: AgentPersonalityVoiceConfigSchema.optional(),
+})
+    .passthrough();
+// Passthrough like every other persisted level: a sibling key written by a
+// newer daemon must survive a rollback (strict would fail the whole config
+// load and keep the daemon from booting).
+const AgentPersonalitiesSchema = z
+    .object({
+    personalities: z.array(AgentPersonalityConfigSchema).optional(),
+})
+    .passthrough();
+const BUILTIN_PROVIDER_IDS = ["claude", "codex", "copilot", "opencode", "pi", "omp"];
+function isLegacyProviderEntry(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    const command = value.command;
+    if (!command || typeof command !== "object" || Array.isArray(command)) {
+        return false;
+    }
+    return typeof command.mode === "string";
+}
+function normalizeAgentProviders(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return value;
+    }
+    const rawProviders = value;
+    const hasLegacyEntries = Object.values(rawProviders).some((entry) => isLegacyProviderEntry(entry));
+    if (!hasLegacyEntries) {
+        return value;
+    }
+    const legacyEntries = {};
+    const normalizedEntries = {};
+    for (const [providerId, providerValue] of Object.entries(rawProviders)) {
+        if (isLegacyProviderEntry(providerValue)) {
+            legacyEntries[providerId] = providerValue;
+            continue;
+        }
+        normalizedEntries[providerId] = providerValue;
+    }
+    const parsedLegacyEntries = AgentProviderRuntimeSettingsMapSchema.safeParse(legacyEntries);
+    if (!parsedLegacyEntries.success) {
+        return value;
+    }
+    return {
+        ...normalizedEntries,
+        ...migrateProviderSettings(parsedLegacyEntries.data, [...BUILTIN_PROVIDER_IDS]),
+    };
+}
+export const PersistedConfigSchema = z
+    .object({
+    $schema: z.string().optional(),
+    // v1 schema marker
+    version: z.literal(1).optional(),
+    // v1 config layout
+    daemon: z
+        .object({
+        listen: z.string().optional(),
+        hostnames: z.union([z.literal(true), z.array(z.string())]).optional(),
+        allowedHosts: z.union([z.literal(true), z.array(z.string())]).optional(),
+        trustedProxies: z.union([z.literal(true), z.array(z.string())]).optional(),
+        mcp: z
+            .object({
+            enabled: z.boolean().optional(),
+            injectIntoAgents: z.boolean().optional(),
+        })
+            .passthrough()
+            .optional(),
+        browserTools: z
+            .object({
+            enabled: z.boolean().optional(),
+        })
+            .passthrough()
+            .optional(),
+        autoArchiveAfterMerge: z.boolean().optional(),
+        enableTerminalAgentHooks: z.boolean().optional(),
+        appendSystemPrompt: z.string().optional(),
+        terminalProfiles: z.array(TerminalProfileSchema).optional(),
+        cors: z
+            .object({
+            allowedOrigins: z.array(z.string()).optional(),
+        })
+            .strict()
+            .optional(),
+        relay: z
+            .object({
+            enabled: z.boolean().optional(),
+            endpoint: z.string().optional(),
+            publicEndpoint: z.string().optional(),
+            useTls: z.boolean().optional(),
+            publicUseTls: z.boolean().optional(),
+        })
+            .strict()
+            .optional(),
+        serviceProxy: z
+            .object({
+            // COMPAT(serviceProxyEnabled): added 2026-06-02, remove after 2026-12-02.
+            // Parsed only to suppress optional public/listen layers for old configs;
+            // localhost service proxying remains always enabled.
+            enabled: z.boolean().optional(),
+            listen: z.string().optional(),
+            publicBaseUrl: z.url().optional(),
+        })
+            .strict()
+            .optional(),
+        auth: DaemonAuthSchema.optional(),
+    })
+        .strict()
+        .transform(({ allowedHosts, ...daemon }) => {
+        const hostnames = daemon.hostnames ?? allowedHosts;
+        return hostnames === undefined ? daemon : { ...daemon, hostnames };
+    })
+        .optional(),
+    app: z
+        .object({
+        baseUrl: z.string().optional(),
+    })
+        .strict()
+        .optional(),
+    providers: ProvidersSchema.optional(),
+    worktrees: WorktreesConfigSchema.optional(),
+    agents: z
+        .object({
+        providers: z.preprocess(normalizeAgentProviders, ProviderOverridesSchema).optional(),
+        metadataGeneration: AgentMetadataGenerationSchema.optional(),
+        agentPersonalities: AgentPersonalitiesSchema.optional(),
+    })
+        .strict()
+        .optional(),
+    features: z
+        .object({
+        dictation: FeatureDictationSchema.optional(),
+        voiceMode: FeatureVoiceModeSchema.optional(),
+        webUi: FeatureWebUiSchema.optional(),
+    })
+        .strict()
+        .optional(),
+    // Host-level git hosting credentials, one set per provider. This is the
+    // ONLY place hosting tokens persist — never in a repo's otto.json.
+    gitHosting: z
+        .object({
+        providers: z
+            .object({
+            bitbucketCloud: z
+                .object({
+                email: z.string().optional(),
+                apiToken: z.string().optional(),
+            })
+                .strict()
+                .optional(),
+        })
+            .strict()
+            .optional(),
+    })
+        .strict()
+        .optional(),
+    log: LogConfigSchema.optional(),
+})
+    .strict();
+const CONFIG_FILENAME = "config.json";
+const DEFAULT_PERSISTED_CONFIG = PersistedConfigSchema.parse({
+    version: 1,
+    daemon: {
+        listen: "127.0.0.1:6868",
+        cors: {
+            allowedOrigins: ["https://app.otto-code.me"],
+        },
+        relay: {
+            enabled: true,
+        },
+    },
+    app: {
+        baseUrl: "https://app.otto-code.me",
+    },
+});
+function getConfigPath(ottoHome) {
+    return path.join(ottoHome, CONFIG_FILENAME);
+}
+function getLogger(logger) {
+    return logger?.child({ module: "config" });
+}
+// Removed config fields are stripped before parsing so the strict schema does not
+// reject a config written by an older release. The stripped values are discarded,
+// not migrated — there is no back-compat for the removed `providers.openai.voice`
+// block (use `providers.openai.stt` / `providers.openai.tts`).
+function stripRemovedConfigFields(parsed) {
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return parsed;
+    }
+    const root = { ...parsed };
+    const providers = root.providers;
+    if (!providers || typeof providers !== "object" || Array.isArray(providers)) {
+        return root;
+    }
+    const providersRecord = { ...providers };
+    const local = providersRecord.local;
+    if (local && typeof local === "object" && !Array.isArray(local)) {
+        const localRecord = { ...local };
+        delete localRecord.autoDownload;
+        providersRecord.local = localRecord;
+    }
+    const openai = providersRecord.openai;
+    if (openai && typeof openai === "object" && !Array.isArray(openai)) {
+        const openaiRecord = { ...openai };
+        // COMPAT(openaiVoiceConfig): added 2026-06-30, remove after 2026-12-30.
+        // Drop a `providers.openai.voice` block left by an older release so the strict
+        // schema doesn't reject it. The value is discarded, not migrated — there is no
+        // back-compat; configure `providers.openai.stt` / `providers.openai.tts` instead.
+        delete openaiRecord.voice;
+        providersRecord.openai = openaiRecord;
+    }
+    root.providers = providersRecord;
+    return root;
+}
+export function loadPersistedConfig(ottoHome, logger) {
+    const log = getLogger(logger);
+    const configPath = getConfigPath(ottoHome);
+    if (!existsSync(configPath)) {
+        try {
+            writePrivateFileAtomicSync(configPath, JSON.stringify(DEFAULT_PERSISTED_CONFIG, null, 2) + "\n");
+            log?.info(`Initialized config file at ${configPath}`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(`[Config] Failed to initialize ${configPath}: ${message}`, { cause: err });
+        }
+    }
+    let raw;
+    try {
+        ensurePrivateFile(configPath);
+        raw = readFileSync(configPath, "utf-8");
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`[Config] Failed to read ${configPath}: ${message}`, {
+            cause: err,
+        });
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`[Config] Invalid JSON in ${configPath}: ${message}`, {
+            cause: err,
+        });
+    }
+    const migrated = stripRemovedConfigFields(parsed);
+    const result = PersistedConfigSchema.safeParse(migrated);
+    if (!result.success) {
+        const issues = result.error.issues
+            .map((i) => `  - ${i.path.join(".")}: ${i.message}`)
+            .join("\n");
+        throw new Error(`[Config] Invalid config in ${configPath}:\n${issues}`);
+    }
+    log?.info(`Loaded from ${configPath}`);
+    return result.data;
+}
+export function savePersistedConfig(ottoHome, config, logger) {
+    const log = getLogger(logger);
+    const configPath = getConfigPath(ottoHome);
+    const result = PersistedConfigSchema.safeParse(config);
+    if (!result.success) {
+        const issues = result.error.issues
+            .map((i) => `  - ${i.path.join(".")}: ${i.message}`)
+            .join("\n");
+        throw new Error(`[Config] Invalid config to save:\n${issues}`);
+    }
+    try {
+        writePrivateFileAtomicSync(configPath, JSON.stringify(result.data, null, 2) + "\n");
+        log?.info(`Saved to ${configPath}`);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`[Config] Failed to write ${configPath}: ${message}`, {
+            cause: err,
+        });
+    }
+}
+//# sourceMappingURL=persisted-config.js.map

package/dist/src/server/pid-lock.js

@@ -0,0 +1,170 @@
+import { open, readFile, unlink, mkdir } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { hostname } from "node:os";
+import { z } from "zod";
+export const pidLockInfoSchema = z.object({
+    pid: z.number(),
+    startedAt: z.string(),
+    hostname: z.string(),
+    uid: z.number(),
+    listen: z.string().nullable(),
+    desktopManaged: z.boolean().optional(),
+});
+function parsePidLockInfo(raw) {
+    const result = pidLockInfoSchema.safeParse(raw);
+    return result.success ? result.data : null;
+}
+function isErrnoException(err) {
+    return err instanceof Error && "code" in err;
+}
+export class PidLockError extends Error {
+    constructor(message, existingLock) {
+        super(message);
+        this.existingLock = existingLock;
+        this.name = "PidLockError";
+    }
+}
+function isPidRunning(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function getPidFilePath(ottoHome) {
+    return join(ottoHome, "otto.pid");
+}
+function resolveOwnerPid(ownerPid) {
+    if (typeof ownerPid === "number" && Number.isInteger(ownerPid) && ownerPid > 0) {
+        return ownerPid;
+    }
+    return process.pid;
+}
+export async function acquirePidLock(ottoHome, listen, options) {
+    const pidPath = getPidFilePath(ottoHome);
+    // Ensure ottoHome directory exists
+    if (!existsSync(ottoHome)) {
+        await mkdir(ottoHome, { recursive: true });
+    }
+    // Try to read existing lock
+    let existingLock = null;
+    try {
+        const content = await readFile(pidPath, "utf-8");
+        existingLock = parsePidLockInfo(JSON.parse(content));
+    }
+    catch {
+        // No existing lock or invalid JSON - that's fine
+    }
+    // Check if existing lock is stale
+    const lockOwnerPid = resolveOwnerPid(options?.ownerPid);
+    if (existingLock) {
+        if (isPidRunning(existingLock.pid)) {
+            if (existingLock.pid === lockOwnerPid) {
+                return;
+            }
+            throw new PidLockError(`Another Otto daemon is already running (PID ${existingLock.pid}, started ${existingLock.startedAt})`, existingLock);
+        }
+        // Stale lock - remove it
+        await unlink(pidPath).catch(() => { });
+    }
+    // Create new lock with exclusive flag
+    const lockInfo = {
+        pid: lockOwnerPid,
+        startedAt: new Date().toISOString(),
+        hostname: hostname(),
+        uid: process.getuid?.() ?? 0,
+        listen,
+        ...(process.env.OTTO_DESKTOP_MANAGED === "1" ? { desktopManaged: true } : {}),
+    };
+    let fd;
+    try {
+        fd = await open(pidPath, "wx");
+        await fd.write(JSON.stringify(lockInfo));
+    }
+    catch (err) {
+        if (isErrnoException(err) && err.code === "EEXIST") {
+            // Race condition - another process created the file
+            // Re-read and check
+            try {
+                const content = await readFile(pidPath, "utf-8");
+                const raceLock = parsePidLockInfo(JSON.parse(content));
+                if (raceLock) {
+                    throw new PidLockError(`Another Otto daemon is already running (PID ${raceLock.pid})`, raceLock);
+                }
+                throw new PidLockError("Failed to acquire PID lock due to race condition");
+            }
+            catch (innerErr) {
+                if (innerErr instanceof PidLockError)
+                    throw innerErr;
+                throw new PidLockError("Failed to acquire PID lock due to race condition");
+            }
+        }
+        throw err;
+    }
+    finally {
+        await fd?.close();
+    }
+}
+export async function updatePidLock(ottoHome, patch, options) {
+    const pidPath = getPidFilePath(ottoHome);
+    const lockOwnerPid = resolveOwnerPid(options?.ownerPid);
+    const content = await readFile(pidPath, "utf-8");
+    const existingLock = parsePidLockInfo(JSON.parse(content));
+    if (!existingLock) {
+        throw new PidLockError("Cannot update PID lock: invalid lock file");
+    }
+    if (existingLock.pid !== lockOwnerPid) {
+        throw new PidLockError(`Cannot update PID lock owned by PID ${existingLock.pid}`, existingLock);
+    }
+    const updatedLock = {
+        ...existingLock,
+        ...patch,
+    };
+    const fd = await open(pidPath, "r+");
+    try {
+        await fd.truncate(0);
+        await fd.writeFile(JSON.stringify(updatedLock));
+    }
+    finally {
+        await fd.close();
+    }
+}
+export async function releasePidLock(ottoHome, options) {
+    const pidPath = getPidFilePath(ottoHome);
+    const lockOwnerPid = resolveOwnerPid(options?.ownerPid);
+    try {
+        // Only remove if it's our lock
+        const content = await readFile(pidPath, "utf-8");
+        const lock = parsePidLockInfo(JSON.parse(content));
+        if (lock?.pid === lockOwnerPid) {
+            await unlink(pidPath);
+        }
+    }
+    catch {
+        // Ignore errors - lock may already be gone
+    }
+}
+export async function getPidLockInfo(ottoHome) {
+    const pidPath = getPidFilePath(ottoHome);
+    try {
+        const content = await readFile(pidPath, "utf-8");
+        return parsePidLockInfo(JSON.parse(content));
+    }
+    catch {
+        return null;
+    }
+}
+export async function isLocked(ottoHome) {
+    const info = await getPidLockInfo(ottoHome);
+    if (!info) {
+        return { locked: false };
+    }
+    if (!isPidRunning(info.pid)) {
+        return { locked: false, info };
+    }
+    return { locked: true, info };
+}
+//# sourceMappingURL=pid-lock.js.map

package/dist/src/server/private-files.js

@@ -0,0 +1,37 @@
+import { chmodSync, mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+export const PRIVATE_DIRECTORY_MODE = 0o700;
+export const PRIVATE_FILE_MODE = 0o600;
+function chmodBestEffort(targetPath, mode) {
+    if (process.platform === "win32") {
+        return;
+    }
+    try {
+        chmodSync(targetPath, mode);
+    }
+    catch {
+        // Keep startup resilient if the filesystem does not support POSIX modes.
+    }
+}
+export function ensurePrivateDirectory(directoryPath) {
+    mkdirSync(directoryPath, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+    chmodBestEffort(directoryPath, PRIVATE_DIRECTORY_MODE);
+}
+export function ensurePrivateFile(filePath) {
+    chmodBestEffort(filePath, PRIVATE_FILE_MODE);
+}
+export function writePrivateFileAtomicSync(filePath, data) {
+    ensurePrivateDirectory(path.dirname(filePath));
+    const tmpPath = path.join(path.dirname(filePath), `.${path.basename(filePath)}.${process.pid}.${randomUUID()}.tmp`);
+    try {
+        writeFileSync(tmpPath, data, { mode: PRIVATE_FILE_MODE });
+        renameSync(tmpPath, filePath);
+        ensurePrivateFile(filePath);
+    }
+    catch (error) {
+        rmSync(tmpPath, { force: true });
+        throw error;
+    }
+}
+//# sourceMappingURL=private-files.js.map