@pellux/goodvibes-sdk 0.25.8 → 0.25.11

package/dist/_internal/platform/control-plane/gateway.js

@@ -3,49 +3,7 @@ import { createDomainDispatch } from '../runtime/store/index.js';
 import { emitControlPlaneAuthGranted, emitControlPlaneClientConnected, emitControlPlaneClientDisconnected, emitControlPlaneSubscriptionCreated, emitControlPlaneSubscriptionDropped, } from '../runtime/emitters/index.js';
 import { renderControlPlaneGatewayWebUi } from './gateway-web-ui.js';
 import { isFeatureGateEnabled, requireFeatureGate } from '../runtime/feature-flags/index.js';
-const DEFAULT_DOMAINS = [
-    'session',
-    'tasks',
-    'agents',
-    'automation',
-    'routes',
-    'control-plane',
-    'deliveries',
-    'surfaces',
-    'watchers',
-    'transport',
-    'ops',
-    'knowledge',
-    'providers',
-    'turn',
-];
-const DEFAULT_SERVER_CONFIG = {
-    enabled: false,
-    host: '127.0.0.1',
-    port: 3421,
-    streamingMode: 'sse',
-    sessionTtlMs: 12 * 60 * 60 * 1000,
-};
-function serializeEnvelope(envelope) {
-    return {
-        type: envelope.type,
-        timestamp: envelope.ts,
-        traceId: envelope.traceId,
-        sessionId: envelope.sessionId,
-        source: envelope.source,
-        payload: envelope.payload,
-    };
-}
-function toClientDescriptor(record) {
-    return {
-        id: record.id,
-        surface: record.kind,
-        label: record.label,
-        connectedAt: record.authenticatedAt ?? record.lastSeenAt ?? Date.now(),
-        lastSeenAt: record.lastSeenAt ?? Date.now(),
-        ...(record.metadata.userId && typeof record.metadata.userId === 'string' ? { userId: record.metadata.userId } : {}),
-    };
-}
+import { DEFAULT_DOMAINS, DEFAULT_SERVER_CONFIG, canReplayEventToClient, hasReplayScope, normalizeRuntimeDomains, pruneDisconnectedClientRecords, serializeEnvelope, stripReplayScope, toClientDescriptor, } from './gateway-utils.js';
 export class ControlPlaneGateway {
     runtimeBus;
     dispatch;
@@ -127,6 +85,7 @@ export class ControlPlaneGateway {
     listClients() {
         if (!this.isEnabled())
             return [];
+        pruneDisconnectedClientRecords(this.clients);
         return [...this.clients.values()]
             .sort((a, b) => (b.lastSeenAt ?? 0) - (a.lastSeenAt ?? 0) || a.id.localeCompare(b.id))
             .map(toClientDescriptor);
@@ -150,6 +109,7 @@ export class ControlPlaneGateway {
                 recentEvents: [],
             };
         }
+        pruneDisconnectedClientRecords(this.clients);
         const active = [...this.clients.values()].filter((client) => client.connected);
         return {
             server: this.serverConfig,
@@ -174,7 +134,7 @@ export class ControlPlaneGateway {
     listRecentEvents(limit = 100) {
         if (!this.isEnabled())
             return [];
-        return this.recentEvents.slice(0, Math.max(1, limit));
+        return this.recentEvents.slice(0, Math.max(1, limit)).map(stripReplayScope);
     }
     publishSurfaceMessage(input) {
         this.requireEnabled('publish surface message');
@@ -187,15 +147,19 @@ export class ControlPlaneGateway {
         if (this.recentMessages.length > 200) {
             this.recentMessages.length = 200;
         }
-        const record = this.rememberEvent('surface-message', message);
+        const record = this.rememberEvent('surface-message', message, {
+            ...(message.clientId ? { clientId: message.clientId } : {}),
+            ...(message.routeId ? { routeId: message.routeId } : {}),
+            ...(message.surfaceId ? { surfaceId: message.surfaceId } : {}),
+        });
         for (const client of this.liveClients.values()) {
             if (client.kind !== 'web')
                 continue;
             if (message.clientId && client.clientId !== message.clientId)
                 continue;
-            if (message.routeId && client.routeId && client.routeId !== message.routeId)
+            if (message.routeId && client.routeId !== message.routeId)
                 continue;
-            if (message.surfaceId && client.surfaceId && client.surfaceId !== message.surfaceId)
+            if (message.surfaceId && client.surfaceId !== message.surfaceId)
                 continue;
             client.send('surface-message', message, record.id);
         }
@@ -204,15 +168,15 @@ export class ControlPlaneGateway {
     publishEvent(event, payload, filter) {
         if (!this.isEnabled())
             return;
-        const record = this.rememberEvent(event, payload);
+        const record = this.rememberEvent(event, payload, filter);
         for (const client of this.liveClients.values()) {
             if (filter?.clientKind && client.kind !== filter.clientKind)
                 continue;
             if (filter?.clientId && client.clientId !== filter.clientId)
                 continue;
-            if (filter?.routeId && client.routeId && client.routeId !== filter.routeId)
+            if (filter?.routeId && client.routeId !== filter.routeId)
                 continue;
-            if (filter?.surfaceId && client.surfaceId && client.surfaceId !== filter.surfaceId)
+            if (filter?.surfaceId && client.surfaceId !== filter.surfaceId)
                 continue;
             client.send(event, payload, record.id);
         }
@@ -267,7 +231,7 @@ export class ControlPlaneGateway {
         if (!this.runtimeBus) {
             throw new Error('Runtime event bus unavailable');
         }
-        const selectedDomains = options.domains?.length ? [...options.domains] : [...DEFAULT_DOMAINS];
+        const selectedDomains = normalizeRuntimeDomains(options.domains);
         const clientId = options.clientId ?? `cp-${randomUUID().slice(0, 8)}`;
         const label = options.label ?? `${options.clientKind ?? 'web'}:${clientId}`;
         const now = Date.now();
@@ -344,7 +308,7 @@ export class ControlPlaneGateway {
         }
         this.subscribeWebSocketClient(clientId, selectedDomains);
         send('ready', { clientId, domains: selectedDomains, transport: 'websocket' });
-        this.replayRecentTraffic(send);
+        this.replayRecentTraffic(send, { ...options, clientId, domains: selectedDomains });
         return { clientId, domains: selectedDomains };
     }
     touchWebSocketClient(clientId, metadata = {}) {
@@ -470,6 +434,7 @@ export class ControlPlaneGateway {
             lastSeenAt: Date.now(),
         };
         this.clients.set(clientId, disconnected);
+        pruneDisconnectedClientRecords(this.clients);
         this.dispatch?.syncControlPlaneClient(disconnected, 'control-plane.gateway.ws-disconnect');
         this.dispatch?.syncControlPlaneState({
             enabled: true,
@@ -477,12 +442,14 @@ export class ControlPlaneGateway {
             connectionState: [...this.clients.values()].some((client) => client.connected) ? 'connected' : 'disconnected',
         }, 'control-plane.gateway.ws-disconnect');
     }
-    replayRecentTraffic(send, sinceId) {
+    replayRecentTraffic(send, options, sinceId) {
         const sinceIndex = sinceId ? this.recentEvents.findIndex((event) => event.id === sinceId) : -1;
         const recentEvents = sinceIndex >= 0
             ? this.recentEvents.slice(0, sinceIndex).reverse()
-            : this.listRecentEvents(20).reverse();
+            : this.recentEvents.slice(0, 20).reverse();
         for (const recentEvent of recentEvents) {
+            if (!canReplayEventToClient(recentEvent, options))
+                continue;
             send(recentEvent.event, recentEvent.payload, recentEvent.id);
         }
     }
@@ -494,7 +461,7 @@ export class ControlPlaneGateway {
             return Response.json({ error: 'Runtime event bus unavailable' }, { status: 503 });
         }
         const encoder = new TextEncoder();
-        const selectedDomains = options.domains?.length ? [...options.domains] : [...DEFAULT_DOMAINS];
+        const selectedDomains = normalizeRuntimeDomains(options.domains);
         const lastEventId = request.headers.get('last-event-id')?.trim() || undefined;
         const clientId = options.clientId ?? `cp-${randomUUID().slice(0, 8)}`;
         const label = options.label ?? `${options.clientKind ?? 'web'}:${clientId}`;
@@ -613,6 +580,7 @@ export class ControlPlaneGateway {
                             lastSeenAt: Date.now(),
                         };
                         this.clients.set(clientId, disconnected);
+                        pruneDisconnectedClientRecords(this.clients);
                         this.dispatch?.syncControlPlaneClient(disconnected, 'control-plane.gateway.disconnect');
                         this.dispatch?.syncControlPlaneState({
                             enabled: true,
@@ -643,7 +611,7 @@ export class ControlPlaneGateway {
                     controller.close();
                 }, { once: true });
                 send('ready', { clientId, domains: selectedDomains });
-                this.replayRecentTraffic(send, lastEventId);
+                this.replayRecentTraffic(send, { ...options, clientId, domains: selectedDomains }, lastEventId);
             },
             cancel: () => {
                 teardown();
@@ -677,12 +645,13 @@ export class ControlPlaneGateway {
             }, 'control-plane.gateway.event');
         });
     }
-    rememberEvent(event, payload) {
+    rememberEvent(event, payload, replayScope) {
         const record = {
             id: `cpe-${randomUUID().slice(0, 8)}`,
             event,
             createdAt: Date.now(),
             payload,
+            ...(replayScope && hasReplayScope(replayScope) ? { replayScope } : {}),
         };
         // O(1) circular ring buffer write — no array shifting.
         this._recentEventsRing[this._recentEventsHead] = record;
@@ -695,9 +664,5 @@ export class ControlPlaneGateway {
         return record;
     }
 }
-// ---------------------------------------------------------------------------
 // Test export — exposes DEFAULT_DOMAINS for regression tests.
-// This export is intentional; the const itself is module-scoped so tests
-// cannot otherwise verify its contents without runtime inspection.
-// ---------------------------------------------------------------------------
 export { DEFAULT_DOMAINS as DEFAULT_DOMAINS_TEST_EXPORT };

package/dist/_internal/platform/control-plane/method-catalog-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-catalog-runtime.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/control-plane/method-catalog-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AA2C1E,eAAO,MAAM,sCAAsC,EAAE,SAAS,uBAAuB,EAqRpF,CAAC"}
+{"version":3,"file":"method-catalog-runtime.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/control-plane/method-catalog-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AA4C1E,eAAO,MAAM,sCAAsC,EAAE,SAAS,uBAAuB,EA+RpF,CAAC"}

package/dist/_internal/platform/control-plane/method-catalog-runtime.js

@@ -1,6 +1,6 @@
 import { EMPTY_OBJECT_SCHEMA, STRING_SCHEMA, NUMBER_SCHEMA, objectSchema, listOutputSchema, entityOutputSchema, bodyEnvelopeSchema, methodDescriptor, runtimeEventId, } from './method-catalog-shared.js';
 import { nullableSchema } from './operator-contract-schemas-shared.js';
-import { CONTINUITY_SNAPSHOT_SCHEMA, DISTRIBUTED_NODE_HOST_CONTRACT_SCHEMA, HEALTH_SNAPSHOT_SCHEMA, INTELLIGENCE_SNAPSHOT_SCHEMA, MEMORY_DOCTOR_REPORT_SCHEMA, MEMORY_VECTOR_STATS_SCHEMA, PROVIDER_ACCOUNT_SNAPSHOT_SCHEMA, PROVIDER_RUNTIME_SNAPSHOT_SCHEMA, PROVIDER_USAGE_SNAPSHOT_SCHEMA, REMOTE_PAIR_APPROVAL_OUTPUT_SCHEMA, REMOTE_PAIR_REQUEST_OUTPUT_SCHEMA, REMOTE_PAIR_REQUESTS_OUTPUT_SCHEMA, REMOTE_PEERS_OUTPUT_SCHEMA, REMOTE_PAIR_REQUEST_ACTION_INPUT_SCHEMA, REMOTE_PEER_DISCONNECT_INPUT_SCHEMA, REMOTE_PEER_INVOKE_INPUT_SCHEMA, REMOTE_PEER_INVOKE_OUTPUT_SCHEMA, REMOTE_PEER_OUTPUT_SCHEMA, REMOTE_PEER_TOKEN_REVOKE_INPUT_SCHEMA, REMOTE_PEER_TOKEN_ROTATE_INPUT_SCHEMA, REMOTE_PEER_TOKEN_ROTATE_OUTPUT_SCHEMA, REMOTE_SNAPSHOT_SCHEMA, REMOTE_WORK_LIST_OUTPUT_SCHEMA, REMOTE_WORK_CANCEL_INPUT_SCHEMA, REMOTE_WORK_OUTPUT_SCHEMA, SETTINGS_SNAPSHOT_SCHEMA, WORKTREE_SNAPSHOT_SCHEMA, } from './operator-contract-schemas.js';
+import { CONTINUITY_SNAPSHOT_SCHEMA, DISTRIBUTED_NODE_HOST_CONTRACT_SCHEMA, HEALTH_SNAPSHOT_SCHEMA, INTELLIGENCE_SNAPSHOT_SCHEMA, MEMORY_DOCTOR_REPORT_SCHEMA, MEMORY_VECTOR_STATS_SCHEMA, PROVIDER_ACCOUNT_SNAPSHOT_SCHEMA, PROVIDER_RUNTIME_SNAPSHOT_SCHEMA, PROVIDER_USAGE_SNAPSHOT_SCHEMA, REMOTE_PAIR_APPROVAL_OUTPUT_SCHEMA, REMOTE_PAIR_REQUEST_OUTPUT_SCHEMA, REMOTE_PAIR_REQUESTS_OUTPUT_SCHEMA, REMOTE_PEERS_OUTPUT_SCHEMA, REMOTE_PAIR_REQUEST_ACTION_INPUT_SCHEMA, REMOTE_PEER_DISCONNECT_INPUT_SCHEMA, REMOTE_PEER_INVOKE_INPUT_SCHEMA, REMOTE_PEER_INVOKE_OUTPUT_SCHEMA, REMOTE_PEER_OUTPUT_SCHEMA, REMOTE_PEER_TOKEN_REVOKE_INPUT_SCHEMA, REMOTE_PEER_TOKEN_ROTATE_INPUT_SCHEMA, REMOTE_PEER_TOKEN_ROTATE_OUTPUT_SCHEMA, REMOTE_SNAPSHOT_SCHEMA, REMOTE_WORK_LIST_OUTPUT_SCHEMA, REMOTE_WORK_CANCEL_INPUT_SCHEMA, REMOTE_WORK_OUTPUT_SCHEMA, SECURITY_SETTINGS_REPORT_SCHEMA, SETTINGS_SNAPSHOT_SCHEMA, WORKTREE_SNAPSHOT_SCHEMA, } from './operator-contract-schemas.js';
 export const builtinGatewayRuntimeMethodDescriptors = [
     methodDescriptor({
         id: 'remote.snapshot',
@@ -191,6 +191,16 @@ export const builtinGatewayRuntimeMethodDescriptors = [
         inputSchema: EMPTY_OBJECT_SCHEMA,
         outputSchema: SETTINGS_SNAPSHOT_SCHEMA,
     }),
+    methodDescriptor({
+        id: 'security.settings',
+        title: 'Security Settings Report',
+        description: 'Return security-relevant settings, defaults, current state, and enablement tradeoffs.',
+        category: 'settings',
+        scopes: ['read:settings'],
+        http: { method: 'GET', path: '/api/security-settings' },
+        inputSchema: EMPTY_OBJECT_SCHEMA,
+        outputSchema: SECURITY_SETTINGS_REPORT_SCHEMA,
+    }),
     methodDescriptor({
         id: 'continuity.snapshot',
         title: 'Continuity Snapshot',

package/dist/_internal/platform/control-plane/operator-contract-schemas-admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator-contract-schemas-admin.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/control-plane/operator-contract-schemas-admin.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,sBAAsB,yBAGV,CAAC;AAQ1B,eAAO,MAAM,wBAAwB,yBAQ2F,CAAC;AAEjI,eAAO,MAAM,+BAA+B,yBAE7B,CAAC;AAEhB,eAAO,MAAM,wCAAwC,yBAEtC,CAAC;AAEhB,eAAO,MAAM,uCAAuC,yBAErC,CAAC;AAEhB,eAAO,MAAM,yCAAyC,yBAEvC,CAAC;AAEhB,eAAO,MAAM,wBAAwB,yBAIT,CAAC;AAE7B,eAAO,MAAM,qBAAqB,yBAMmB,CAAC;AAEtD,eAAO,MAAM,sBAAsB,yBAWG,CAAC;AAEvC,eAAO,MAAM,qBAAqB,yBAYyD,CAAC;AAE5F,eAAO,MAAM,wBAAwB,yBAIiB,CAAC;AAwGvD,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAM9D,CAAC;AASF,eAAO,MAAM,kCAAkC,yBAGrB,CAAC;AAE3B,eAAO,MAAM,0CAA0C,yBAKhB,CAAC;AAExC,eAAO,MAAM,gCAAgC,yBAUA,CAAC;AAkB9C,eAAO,MAAM,kCAAkC,yBAoBA,CAAC;AAEhD,eAAO,MAAM,iCAAiC,yBAMD,CAAC;AAE9C,eAAO,MAAM,iCAAiC,yBAQoF,CAAC;AAUnI,eAAO,MAAM,gCAAgC,yBAQyD,CAAC;AAEvG,eAAO,MAAM,+BAA+B,yBAWgE,CAAC;AAuC7G,eAAO,MAAM,+BAA+B,yBASC,CAAC;AAE9C,eAAO,MAAM,qBAAqB,yBAwBiM,CAAC;AAcpO,eAAO,MAAM,qBAAqB,yBAiCiK,CAAC;AAEpM,eAAO,MAAM,sCAAsC,yBA6Bf,CAAC;AAErC,eAAO,MAAM,6BAA6B,yBAE9B,CAAC;AAEb,eAAO,MAAM,6BAA6B,yBAE9B,CAAC;AAEb,eAAO,MAAM,mCAAmC,yBAGvB,CAAC;AAE1B,eAAO,MAAM,oCAAoC,yBAKe,CAAC;AAEjE,eAAO,MAAM,mCAAmC,yBAErC,CAAC;AAEZ,eAAO,MAAM,gCAAgC,yBAQiC,CAAC;AAE/E,eAAO,MAAM,kCAAkC,yBAQI,CAAC;AAEpD,eAAO,MAAM,8BAA8B,yBAGvB,CAAC;AAErB,eAAO,MAAM,wBAAwB,yBASX,CAAC;AAE3B,eAAO,MAAM,sBAAsB,yBAEnB,CAAC;AAEjB,eAAO,MAAM,oBAAoB,yBAA4B,CAAC;AAE9D,eAAO,MAAM,qBAAqB,yBAKmC,CAAC;AAYtE,eAAO,MAAM,qBAAqB,yBAcwD,CAAC;AAE3F,eAAO,MAAM,0BAA0B,yBAEvB,CAAC;AAEjB,eAAO,MAAM,4BAA4B,yBAGM,CAAC;AAuChD,eAAO,MAAM,qBAAqB,yBAckG,CAAC"}
+{"version":3,"file":"operator-contract-schemas-admin.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/control-plane/operator-contract-schemas-admin.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,sBAAsB,yBAGV,CAAC;AAQ1B,eAAO,MAAM,wBAAwB,yBAQ2F,CAAC;AAEjI,eAAO,MAAM,+BAA+B,yBAE7B,CAAC;AAEhB,eAAO,MAAM,wCAAwC,yBAEtC,CAAC;AAEhB,eAAO,MAAM,uCAAuC,yBAErC,CAAC;AAEhB,eAAO,MAAM,yCAAyC,yBAEvC,CAAC;AAEhB,eAAO,MAAM,wBAAwB,yBAIT,CAAC;AAE7B,eAAO,MAAM,qBAAqB,yBAMmB,CAAC;AAEtD,eAAO,MAAM,sBAAsB,yBAWG,CAAC;AAEvC,eAAO,MAAM,qBAAqB,yBAYyD,CAAC;AAE5F,eAAO,MAAM,wBAAwB,yBAIiB,CAAC;AAyGvD,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAM9D,CAAC;AASF,eAAO,MAAM,kCAAkC,yBAGrB,CAAC;AAE3B,eAAO,MAAM,0CAA0C,yBAKhB,CAAC;AAExC,eAAO,MAAM,gCAAgC,yBAUA,CAAC;AAkB9C,eAAO,MAAM,kCAAkC,yBAoBA,CAAC;AAEhD,eAAO,MAAM,iCAAiC,yBAMD,CAAC;AAE9C,eAAO,MAAM,iCAAiC,yBAQoF,CAAC;AAUnI,eAAO,MAAM,gCAAgC,yBAQyD,CAAC;AAEvG,eAAO,MAAM,+BAA+B,yBAWgE,CAAC;AAuC7G,eAAO,MAAM,+BAA+B,yBASC,CAAC;AAE9C,eAAO,MAAM,qBAAqB,yBAwBiM,CAAC;AAcpO,eAAO,MAAM,qBAAqB,yBAiCiK,CAAC;AAEpM,eAAO,MAAM,sCAAsC,yBA6Bf,CAAC;AAErC,eAAO,MAAM,6BAA6B,yBAE9B,CAAC;AAEb,eAAO,MAAM,6BAA6B,yBAE9B,CAAC;AAEb,eAAO,MAAM,mCAAmC,yBAGvB,CAAC;AAE1B,eAAO,MAAM,oCAAoC,yBAKe,CAAC;AAEjE,eAAO,MAAM,mCAAmC,yBAErC,CAAC;AAEZ,eAAO,MAAM,gCAAgC,yBAQiC,CAAC;AAE/E,eAAO,MAAM,kCAAkC,yBAQI,CAAC;AAEpD,eAAO,MAAM,8BAA8B,yBAGvB,CAAC;AAErB,eAAO,MAAM,wBAAwB,yBASX,CAAC;AAE3B,eAAO,MAAM,sBAAsB,yBAEnB,CAAC;AAEjB,eAAO,MAAM,oBAAoB,yBAA4B,CAAC;AAE9D,eAAO,MAAM,qBAAqB,yBAKmC,CAAC;AAYtE,eAAO,MAAM,qBAAqB,yBAcwD,CAAC;AAE3F,eAAO,MAAM,0BAA0B,yBAEvB,CAAC;AAEjB,eAAO,MAAM,4BAA4B,yBAGM,CAAC;AAuChD,eAAO,MAAM,qBAAqB,yBAckG,CAAC"}

package/dist/_internal/platform/control-plane/operator-contract-schemas-admin.js

@@ -5,10 +5,10 @@ export const LOCAL_AUTH_USER_SCHEMA = objectSchema({
     roles: STRING_LIST_SCHEMA,
 }, ['username', 'roles']);
 const LOCAL_AUTH_SESSION_SCHEMA = objectSchema({
-    token: STRING_SCHEMA,
+    tokenFingerprint: STRING_SCHEMA,
     username: STRING_SCHEMA,
     expiresAt: NUMBER_SCHEMA,
-}, ['token', 'username', 'expiresAt']);
+}, ['tokenFingerprint', 'username', 'expiresAt']);
 export const LOCAL_AUTH_STATUS_SCHEMA = objectSchema({
     userStorePath: STRING_SCHEMA,
     bootstrapCredentialPath: STRING_SCHEMA,
@@ -90,6 +90,7 @@ const AUTOMATION_SURFACE_KIND_SCHEMA = enumSchema([
     'discord',
     'ntfy',
     'webhook',
+    'homeassistant',
     'telegram',
     'google-chat',
     'signal',

package/dist/_internal/platform/control-plane/operator-contract-schemas-control.d.ts

@@ -3,6 +3,7 @@ export declare const CONTROL_AUTH_LOGIN_RESPONSE_SCHEMA: Record<string, unknown>
 export declare const CONTROL_PLANE_CLIENT_DESCRIPTOR_SCHEMA: Record<string, unknown>;
 export declare const CONTROL_PLANE_SURFACE_MESSAGE_SCHEMA: Record<string, unknown>;
 export declare const SETTINGS_SNAPSHOT_SCHEMA: Record<string, unknown>;
+export declare const SECURITY_SETTINGS_REPORT_SCHEMA: Record<string, unknown>;
 export declare const CONTINUITY_SNAPSHOT_SCHEMA: Record<string, unknown>;
 export declare const WORKTREE_SNAPSHOT_SCHEMA: Record<string, unknown>;
 export declare const CONTROL_PLANE_SNAPSHOT_SCHEMA: Record<string, unknown>;

package/dist/_internal/platform/control-plane/operator-contract-schemas-control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator-contract-schemas-control.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/control-plane/operator-contract-schemas-control.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,iCAAiC,yBAGlB,CAAC;AAE7B,eAAO,MAAM,kCAAkC,yBAKQ,CAAC;AAExD,eAAO,MAAM,sCAAsC,yBAOQ,CAAC;AAE5D,eAAO,MAAM,oCAAoC,yBAYE,CAAC;AAsEpD,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAE5D,CAAC;AA+BF,eAAO,MAAM,0BAA0B,yBAOkE,CAAC;AA0B1G,eAAO,MAAM,wBAAwB,yBAGX,CAAC;AAE3B,eAAO,MAAM,6BAA6B,yBAaqB,CAAC;AAEhE,eAAO,MAAM,sBAAsB,yBAQgE,CAAC"}
+{"version":3,"file":"operator-contract-schemas-control.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/control-plane/operator-contract-schemas-control.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,iCAAiC,yBAGlB,CAAC;AAE7B,eAAO,MAAM,kCAAkC,yBAKQ,CAAC;AAExD,eAAO,MAAM,sCAAsC,yBAOQ,CAAC;AAE5D,eAAO,MAAM,oCAAoC,yBAYE,CAAC;AAsEpD,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAE5D,CAAC;AA0BF,eAAO,MAAM,+BAA+B,yBAE5B,CAAC;AA+BjB,eAAO,MAAM,0BAA0B,yBAOkE,CAAC;AA0B1G,eAAO,MAAM,wBAAwB,yBAGX,CAAC;AAE3B,eAAO,MAAM,6BAA6B,yBAaqB,CAAC;AAEhE,eAAO,MAAM,sBAAsB,yBAQgE,CAAC"}

package/dist/_internal/platform/control-plane/operator-contract-schemas-control.js

@@ -103,6 +103,32 @@ const SETTINGS_SNAPSHOT_AVAILABLE_SCHEMA = objectSchema({
 export const SETTINGS_SNAPSHOT_SCHEMA = {
     anyOf: [SETTINGS_SNAPSHOT_UNAVAILABLE_SCHEMA, SETTINGS_SNAPSHOT_AVAILABLE_SCHEMA],
 };
+const SECURITY_SETTING_REPORT_SCHEMA = objectSchema({
+    key: STRING_SCHEMA,
+    type: enumSchema(['feature-flag', 'configuration']),
+    defaultState: STRING_SCHEMA,
+    currentState: STRING_SCHEMA,
+    securityRelevant: BOOLEAN_SCHEMA,
+    summary: STRING_SCHEMA,
+    insecureWhen: STRING_SCHEMA,
+    enablementEffect: STRING_SCHEMA,
+    enablementRequirements: STRING_LIST_SCHEMA,
+    compatibilityNotes: STRING_LIST_SCHEMA,
+}, [
+    'key',
+    'type',
+    'defaultState',
+    'currentState',
+    'securityRelevant',
+    'summary',
+    'insecureWhen',
+    'enablementEffect',
+    'enablementRequirements',
+    'compatibilityNotes',
+]);
+export const SECURITY_SETTINGS_REPORT_SCHEMA = objectSchema({
+    settings: arraySchema(SECURITY_SETTING_REPORT_SCHEMA),
+}, ['settings']);
 const SESSION_RETURN_CONTEXT_SCHEMA = objectSchema({
     activityLabel: STRING_SCHEMA,
     statusLabel: STRING_SCHEMA,

package/dist/_internal/platform/control-plane/routes/operator.d.ts

@@ -1,3 +1,3 @@
 import type { DaemonApiRouteHandlers } from './context.js';
-export declare function dispatchOperatorRoutes(req: Request, handlers: Pick<DaemonApiRouteHandlers, 'getStatus' | 'getCurrentAuth' | 'getControlPlaneSnapshot' | 'getOperatorContract' | 'getControlPlaneWeb' | 'getControlPlaneRecentEvents' | 'getControlPlaneMessages' | 'getControlPlaneClients' | 'getTelemetrySnapshot' | 'getTelemetryEvents' | 'getTelemetryErrors' | 'getTelemetryTraces' | 'getTelemetryMetrics' | 'createTelemetryEventStream' | 'getTelemetryOtlpTraces' | 'getTelemetryOtlpLogs' | 'getTelemetryOtlpMetrics' | 'getGatewayMethods' | 'getGatewayEvents' | 'getGatewayMethod' | 'invokeGatewayMethod' | 'createControlPlaneEventStream' | 'getRoutesSnapshot' | 'getSurfaces' | 'getChannelAccounts' | 'getChannelSurfaceAccounts' | 'getChannelAccount' | 'postChannelAccountAction' | 'getChannelSetupSchema' | 'getChannelDoctor' | 'getChannelRepairActions' | 'getChannelLifecycle' | 'postChannelLifecycleMigrate' | 'getChannelCapabilities' | 'getChannelSurfaceCapabilities' | 'getChannelTools' | 'getChannelSurfaceTools' | 'getChannelAgentTools' | 'getChannelSurfaceAgentTools' | 'postChannelTool' | 'getChannelActions' | 'getChannelSurfaceActions' | 'postChannelAction' | 'postChannelResolveTarget' | 'postChannelAuthorize' | 'postChannelAllowlistResolve' | 'postChannelAllowlistEdit' | 'getChannelPolicies' | 'postChannelPolicy' | 'getChannelPolicyAudit' | 'getChannelStatus' | 'getChannelDirectory' | 'getWatchers' | 'postWatcher' | 'patchWatcher' | 'watcherAction' | 'deleteWatcher' | 'getServiceStatus' | 'installService' | 'startService' | 'stopService' | 'restartService' | 'uninstallService' | 'getRouteBindings' | 'postRouteBinding' | 'patchRouteBinding' | 'deleteRouteBinding' | 'getApprovals' | 'approvalAction' | 'getRemote' | 'getHealth' | 'getAccounts' | 'getProviders' | 'getProvider' | 'getProviderUsage' | 'getSettings' | 'getContinuity' | 'getWorktrees' | 'getIntelligence' | 'getLocalAuth' | 'postLocalAuthUser' | 'deleteLocalAuthUser' | 'postLocalAuthPassword' | 'deleteLocalAuthSession' | 'deleteBootstrapFile' | 'getPanels' | 'postPanelOpen' | 'getEvents' | 'getConfig' | 'postConfig' | 'getReview' | 'getIntegrationSession' | 'getIntegrationTasks' | 'getIntegrationAutomation' | 'getIntegrationSessions' | 'getAutomationHeartbeat' | 'postAutomationHeartbeat' | 'getMemoryDoctor' | 'getMemoryVectorStats' | 'postMemoryVectorRebuild' | 'postMemoryEmbeddingDefault' | 'getKnowledgeStatus' | 'getKnowledgeSources' | 'getKnowledgeNodes' | 'getKnowledgeIssues' | 'getKnowledgeItem' | 'getKnowledgeConnectors' | 'getKnowledgeConnector' | 'getKnowledgeConnectorDoctor' | 'getKnowledgeProjectionTargets' | 'getKnowledgeGraphqlSchema' | 'getKnowledgeExtractions' | 'getKnowledgeUsage' | 'getKnowledgeCandidates' | 'getKnowledgeCandidate' | 'getKnowledgeReports' | 'getKnowledgeReport' | 'getKnowledgeExtraction' | 'getKnowledgeSourceExtraction' | 'getKnowledgeJobs' | 'getKnowledgeJob' | 'getKnowledgeJobRuns' | 'getKnowledgeSchedules' | 'getKnowledgeSchedule' | 'postKnowledgeIngestUrl' | 'postKnowledgeIngestArtifact' | 'postKnowledgeImportBookmarks' | 'postKnowledgeImportUrls' | 'postKnowledgeIngestConnector' | 'postKnowledgeSearch' | 'postKnowledgePacket' | 'postKnowledgeDecideCandidate' | 'postKnowledgeRunJob' | 'postKnowledgeLint' | 'postKnowledgeReindex' | 'postKnowledgeSaveSchedule' | 'deleteKnowledgeSchedule' | 'postKnowledgeSetScheduleEnabled' | 'postKnowledgeRenderProjection' | 'postKnowledgeMaterializeProjection' | 'executeKnowledgeGraphql' | 'getVoiceStatus' | 'getVoiceProviders' | 'getVoiceVoices' | 'postVoiceTts' | 'postVoiceTtsStream' | 'postVoiceStt' | 'postVoiceRealtimeSession' | 'getWebSearchProviders' | 'postWebSearch' | 'getArtifacts' | 'postArtifact' | 'getArtifact' | 'getArtifactContent' | 'getMediaProviders' | 'postMediaAnalyze' | 'postMediaTransform' | 'postMediaGenerate' | 'getMultimodalStatus' | 'getMultimodalProviders' | 'postMultimodalAnalyze' | 'postMultimodalPacket' | 'postMultimodalWriteback' | 'getRemoteNodeHostContract'>): Promise<Response | null>;
+export declare function dispatchOperatorRoutes(req: Request, handlers: Pick<DaemonApiRouteHandlers, 'getStatus' | 'getCurrentAuth' | 'getControlPlaneSnapshot' | 'getOperatorContract' | 'getControlPlaneWeb' | 'getControlPlaneRecentEvents' | 'getControlPlaneMessages' | 'getControlPlaneClients' | 'getTelemetrySnapshot' | 'getTelemetryEvents' | 'getTelemetryErrors' | 'getTelemetryTraces' | 'getTelemetryMetrics' | 'createTelemetryEventStream' | 'getTelemetryOtlpTraces' | 'getTelemetryOtlpLogs' | 'getTelemetryOtlpMetrics' | 'getGatewayMethods' | 'getGatewayEvents' | 'getGatewayMethod' | 'invokeGatewayMethod' | 'createControlPlaneEventStream' | 'getRoutesSnapshot' | 'getSurfaces' | 'getChannelAccounts' | 'getChannelSurfaceAccounts' | 'getChannelAccount' | 'postChannelAccountAction' | 'getChannelSetupSchema' | 'getChannelDoctor' | 'getChannelRepairActions' | 'getChannelLifecycle' | 'postChannelLifecycleMigrate' | 'getChannelCapabilities' | 'getChannelSurfaceCapabilities' | 'getChannelTools' | 'getChannelSurfaceTools' | 'getChannelAgentTools' | 'getChannelSurfaceAgentTools' | 'postChannelTool' | 'getChannelActions' | 'getChannelSurfaceActions' | 'postChannelAction' | 'postChannelResolveTarget' | 'postChannelAuthorize' | 'postChannelAllowlistResolve' | 'postChannelAllowlistEdit' | 'getChannelPolicies' | 'postChannelPolicy' | 'getChannelPolicyAudit' | 'getChannelStatus' | 'getChannelDirectory' | 'getWatchers' | 'postWatcher' | 'patchWatcher' | 'watcherAction' | 'deleteWatcher' | 'getServiceStatus' | 'installService' | 'startService' | 'stopService' | 'restartService' | 'uninstallService' | 'getRouteBindings' | 'postRouteBinding' | 'patchRouteBinding' | 'deleteRouteBinding' | 'getApprovals' | 'approvalAction' | 'getRemote' | 'getHealth' | 'getAccounts' | 'getProviders' | 'getProvider' | 'getProviderUsage' | 'getSettings' | 'getSecuritySettings' | 'getContinuity' | 'getWorktrees' | 'getIntelligence' | 'getLocalAuth' | 'postLocalAuthUser' | 'deleteLocalAuthUser' | 'postLocalAuthPassword' | 'deleteLocalAuthSession' | 'deleteBootstrapFile' | 'getPanels' | 'postPanelOpen' | 'getEvents' | 'getConfig' | 'postConfig' | 'getReview' | 'getIntegrationSession' | 'getIntegrationTasks' | 'getIntegrationAutomation' | 'getIntegrationSessions' | 'getAutomationHeartbeat' | 'postAutomationHeartbeat' | 'getMemoryDoctor' | 'getMemoryVectorStats' | 'postMemoryVectorRebuild' | 'postMemoryEmbeddingDefault' | 'getKnowledgeStatus' | 'getKnowledgeSources' | 'getKnowledgeNodes' | 'getKnowledgeIssues' | 'getKnowledgeItem' | 'getKnowledgeConnectors' | 'getKnowledgeConnector' | 'getKnowledgeConnectorDoctor' | 'getKnowledgeProjectionTargets' | 'getKnowledgeGraphqlSchema' | 'getKnowledgeExtractions' | 'getKnowledgeUsage' | 'getKnowledgeCandidates' | 'getKnowledgeCandidate' | 'getKnowledgeReports' | 'getKnowledgeReport' | 'getKnowledgeExtraction' | 'getKnowledgeSourceExtraction' | 'getKnowledgeJobs' | 'getKnowledgeJob' | 'getKnowledgeJobRuns' | 'getKnowledgeSchedules' | 'getKnowledgeSchedule' | 'postKnowledgeIngestUrl' | 'postKnowledgeIngestArtifact' | 'postKnowledgeImportBookmarks' | 'postKnowledgeImportUrls' | 'postKnowledgeIngestConnector' | 'postKnowledgeSearch' | 'postKnowledgePacket' | 'postKnowledgeDecideCandidate' | 'postKnowledgeRunJob' | 'postKnowledgeLint' | 'postKnowledgeReindex' | 'postKnowledgeSaveSchedule' | 'deleteKnowledgeSchedule' | 'postKnowledgeSetScheduleEnabled' | 'postKnowledgeRenderProjection' | 'postKnowledgeMaterializeProjection' | 'executeKnowledgeGraphql' | 'getVoiceStatus' | 'getVoiceProviders' | 'getVoiceVoices' | 'postVoiceTts' | 'postVoiceTtsStream' | 'postVoiceStt' | 'postVoiceRealtimeSession' | 'getWebSearchProviders' | 'postWebSearch' | 'getArtifacts' | 'postArtifact' | 'getArtifact' | 'getArtifactContent' | 'getMediaProviders' | 'postMediaAnalyze' | 'postMediaTransform' | 'postMediaGenerate' | 'getMultimodalStatus' | 'getMultimodalProviders' | 'postMultimodalAnalyze' | 'postMultimodalPacket' | 'postMultimodalWriteback' | 'getRemoteNodeHostContract'>): Promise<Response | null>;
 //# sourceMappingURL=operator.d.ts.map

package/dist/_internal/platform/control-plane/routes/operator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/control-plane/routes/operator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE3D,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,IAAI,CACZ,sBAAsB,EACpB,WAAW,GACX,gBAAgB,GAChB,yBAAyB,GACzB,qBAAqB,GACrB,oBAAoB,GACpB,6BAA6B,GAC7B,yBAAyB,GACzB,wBAAwB,GACxB,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,qBAAqB,GACrB,4BAA4B,GAC5B,wBAAwB,GACxB,sBAAsB,GACtB,yBAAyB,GACzB,mBAAmB,GACnB,kBAAkB,GAClB,kBAAkB,GAClB,qBAAqB,GACrB,+BAA+B,GAC/B,mBAAmB,GACnB,aAAa,GACb,oBAAoB,GACpB,2BAA2B,GAC3B,mBAAmB,GACnB,0BAA0B,GAC1B,uBAAuB,GACvB,kBAAkB,GAClB,yBAAyB,GACzB,qBAAqB,GACrB,6BAA6B,GAC7B,wBAAwB,GACxB,+BAA+B,GAC/B,iBAAiB,GACjB,wBAAwB,GACxB,sBAAsB,GACtB,6BAA6B,GAC7B,iBAAiB,GACjB,mBAAmB,GACnB,0BAA0B,GAC1B,mBAAmB,GACnB,0BAA0B,GAC1B,sBAAsB,GACtB,6BAA6B,GAC7B,0BAA0B,GAC1B,oBAAoB,GACpB,mBAAmB,GACnB,uBAAuB,GACvB,kBAAkB,GAClB,qBAAqB,GACrB,aAAa,GACb,aAAa,GACb,cAAc,GACd,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,gBAAgB,GAChB,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,mBAAmB,GACnB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,WAAW,GACX,WAAW,GACX,aAAa,GACb,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,aAAa,GACb,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,qBAAqB,GACrB,uBAAuB,GACvB,wBAAwB,GACxB,qBAAqB,GACrB,WAAW,GACX,eAAe,GACf,WAAW,GACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,uBAAuB,GACvB,qBAAqB,GACrB,0BAA0B,GAC1B,wBAAwB,GACxB,wBAAwB,GACxB,yBAAyB,GACzB,iBAAiB,GACjB,sBAAsB,GACtB,yBAAyB,GACzB,4BAA4B,GAC5B,oBAAoB,GACpB,qBAAqB,GACrB,mBAAmB,GACnB,oBAAoB,GACpB,kBAAkB,GAClB,wBAAwB,GACxB,uBAAuB,GACvB,6BAA6B,GAC7B,+BAA+B,GAC/B,2BAA2B,GAC3B,yBAAyB,GACzB,mBAAmB,GACnB,wBAAwB,GACxB,uBAAuB,GACvB,qBAAqB,GACrB,oBAAoB,GACpB,wBAAwB,GACxB,8BAA8B,GAC9B,kBAAkB,GAClB,iBAAiB,GACjB,qBAAqB,GACrB,uBAAuB,GACvB,sBAAsB,GACtB,wBAAwB,GACxB,6BAA6B,GAC7B,8BAA8B,GAC9B,yBAAyB,GACzB,8BAA8B,GAC9B,qBAAqB,GACrB,qBAAqB,GACrB,8BAA8B,GAC9B,qBAAqB,GACrB,mBAAmB,GACnB,sBAAsB,GACtB,2BAA2B,GAC3B,yBAAyB,GACzB,iCAAiC,GACjC,+BAA+B,GAC/B,oCAAoC,GACpC,yBAAyB,GACzB,gBAAgB,GAChB,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,GACd,oBAAoB,GACpB,cAAc,GACd,0BAA0B,GAC1B,uBAAuB,GACvB,eAAe,GACf,cAAc,GACd,cAAc,GACd,aAAa,GACb,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,wBAAwB,GACxB,uBAAuB,GACvB,sBAAsB,GACtB,yBAAyB,GACzB,2BAA2B,CAC9B,GACA,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA4R1B"}
+{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/control-plane/routes/operator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAE3D,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,IAAI,CACZ,sBAAsB,EACpB,WAAW,GACX,gBAAgB,GAChB,yBAAyB,GACzB,qBAAqB,GACrB,oBAAoB,GACpB,6BAA6B,GAC7B,yBAAyB,GACzB,wBAAwB,GACxB,sBAAsB,GACtB,oBAAoB,GACpB,oBAAoB,GACpB,oBAAoB,GACpB,qBAAqB,GACrB,4BAA4B,GAC5B,wBAAwB,GACxB,sBAAsB,GACtB,yBAAyB,GACzB,mBAAmB,GACnB,kBAAkB,GAClB,kBAAkB,GAClB,qBAAqB,GACrB,+BAA+B,GAC/B,mBAAmB,GACnB,aAAa,GACb,oBAAoB,GACpB,2BAA2B,GAC3B,mBAAmB,GACnB,0BAA0B,GAC1B,uBAAuB,GACvB,kBAAkB,GAClB,yBAAyB,GACzB,qBAAqB,GACrB,6BAA6B,GAC7B,wBAAwB,GACxB,+BAA+B,GAC/B,iBAAiB,GACjB,wBAAwB,GACxB,sBAAsB,GACtB,6BAA6B,GAC7B,iBAAiB,GACjB,mBAAmB,GACnB,0BAA0B,GAC1B,mBAAmB,GACnB,0BAA0B,GAC1B,sBAAsB,GACtB,6BAA6B,GAC7B,0BAA0B,GAC1B,oBAAoB,GACpB,mBAAmB,GACnB,uBAAuB,GACvB,kBAAkB,GAClB,qBAAqB,GACrB,aAAa,GACb,aAAa,GACb,cAAc,GACd,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,gBAAgB,GAChB,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,mBAAmB,GACnB,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,WAAW,GACX,WAAW,GACX,aAAa,GACb,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,aAAa,GACb,qBAAqB,GACrB,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,qBAAqB,GACrB,uBAAuB,GACvB,wBAAwB,GACxB,qBAAqB,GACrB,WAAW,GACX,eAAe,GACf,WAAW,GACX,WAAW,GACX,YAAY,GACZ,WAAW,GACX,uBAAuB,GACvB,qBAAqB,GACrB,0BAA0B,GAC1B,wBAAwB,GACxB,wBAAwB,GACxB,yBAAyB,GACzB,iBAAiB,GACjB,sBAAsB,GACtB,yBAAyB,GACzB,4BAA4B,GAC5B,oBAAoB,GACpB,qBAAqB,GACrB,mBAAmB,GACnB,oBAAoB,GACpB,kBAAkB,GAClB,wBAAwB,GACxB,uBAAuB,GACvB,6BAA6B,GAC7B,+BAA+B,GAC/B,2BAA2B,GAC3B,yBAAyB,GACzB,mBAAmB,GACnB,wBAAwB,GACxB,uBAAuB,GACvB,qBAAqB,GACrB,oBAAoB,GACpB,wBAAwB,GACxB,8BAA8B,GAC9B,kBAAkB,GAClB,iBAAiB,GACjB,qBAAqB,GACrB,uBAAuB,GACvB,sBAAsB,GACtB,wBAAwB,GACxB,6BAA6B,GAC7B,8BAA8B,GAC9B,yBAAyB,GACzB,8BAA8B,GAC9B,qBAAqB,GACrB,qBAAqB,GACrB,8BAA8B,GAC9B,qBAAqB,GACrB,mBAAmB,GACnB,sBAAsB,GACtB,2BAA2B,GAC3B,yBAAyB,GACzB,iCAAiC,GACjC,+BAA+B,GAC/B,oCAAoC,GACpC,yBAAyB,GACzB,gBAAgB,GAChB,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,GACd,oBAAoB,GACpB,cAAc,GACd,0BAA0B,GAC1B,uBAAuB,GACvB,eAAe,GACf,cAAc,GACd,cAAc,GACd,aAAa,GACb,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,wBAAwB,GACxB,uBAAuB,GACvB,sBAAsB,GACtB,yBAAyB,GACzB,2BAA2B,CAC9B,GACA,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA6R1B"}

package/dist/_internal/platform/control-plane/routes/operator.js

@@ -212,6 +212,8 @@ export async function dispatchOperatorRoutes(req, handlers) {
         return handlers.getProvider(decodeURIComponent(providerMatch[1]));
     if (pathname === '/api/settings' && method === 'GET')
         return handlers.getSettings();
+    if (pathname === '/api/security-settings' && method === 'GET')
+        return handlers.getSecuritySettings();
     if (pathname === '/api/continuity' && method === 'GET')
         return handlers.getContinuity();
     if (pathname === '/api/worktrees' && method === 'GET')

package/dist/_internal/platform/control-plane/types.d.ts

@@ -3,7 +3,7 @@
  */
 import type { ArtifactAttachment } from '../artifacts/index.js';
 export type ControlPlaneStreamingMode = 'sse' | 'websocket' | 'both';
-export type ControlPlaneClientSurface = 'tui' | 'web' | 'slack' | 'discord' | 'ntfy' | 'webhook' | 'telegram' | 'google-chat' | 'signal' | 'whatsapp' | 'imessage' | 'msteams' | 'bluebubbles' | 'mattermost' | 'matrix' | 'service';
+export type ControlPlaneClientSurface = 'tui' | 'web' | 'slack' | 'discord' | 'ntfy' | 'webhook' | 'homeassistant' | 'telegram' | 'google-chat' | 'signal' | 'whatsapp' | 'imessage' | 'msteams' | 'bluebubbles' | 'mattermost' | 'matrix' | 'service';
 export interface ControlPlaneServerConfig {
     enabled: boolean;
     host: string;

package/dist/_internal/platform/control-plane/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/control-plane/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,MAAM,yBAAyB,GAAG,KAAK,GAAG,WAAW,GAAG,MAAM,CAAC;AACrE,MAAM,MAAM,yBAAyB,GACjC,KAAK,GACL,KAAK,GACL,OAAO,GACP,SAAS,GACT,MAAM,GACN,SAAS,GACT,UAAU,GACV,aAAa,GACb,QAAQ,GACR,UAAU,GACV,UAAU,GACV,SAAS,GACT,aAAa,GACb,YAAY,GACZ,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,yBAAyB,CAAC;IACzC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,yBAAyB,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,yBAAyB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/control-plane/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,MAAM,yBAAyB,GAAG,KAAK,GAAG,WAAW,GAAG,MAAM,CAAC;AACrE,MAAM,MAAM,yBAAyB,GACjC,KAAK,GACL,KAAK,GACL,OAAO,GACP,SAAS,GACT,MAAM,GACN,SAAS,GACT,eAAe,GACf,UAAU,GACV,aAAa,GACb,QAAQ,GACR,UAAU,GACV,UAAU,GACV,SAAS,GACT,aAAa,GACb,YAAY,GACZ,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,yBAAyB,CAAC;IACzC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,yBAAyB,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,yBAAyB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC"}

package/dist/_internal/platform/daemon/control-plane.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/daemon/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAOhE,OAAO,KAAK,EAAE,mBAAmB,EAAuB,MAAM,2BAA2B,CAAC;AAC1F,OAAO,KAAK,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAI5E,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;IAC3D,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,UAAU,EACf,KAAK,GACL,KAAK,GACL,OAAO,GACP,SAAS,GACT,MAAM,GACN,SAAS,GACT,UAAU,GACV,aAAa,GACb,QAAQ,GACR,UAAU,GACV,UAAU,GACV,SAAS,GACT,aAAa,GACb,YAAY,GACZ,QAAQ,GACR,QAAQ,CAAC;IACb,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,OAAO,CAAC;IAC1C,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACvE,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IACtF,QAAQ,CAAC,2BAA2B,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CAC/G;AAED,UAAU,oBAAoB;IAC5B,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC;CAC9D;AAED,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,yBAAyB;IAE/D,OAAO,CAAC,iBAAiB;IAIzB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM;IAItC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO;IAOhC,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI;IAYhG,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI;IAYrC,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,4BAA4B,EAAE,mBAAmB,GAAG,QAAQ,CAAC;IAenI,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI;IAuB5E,uBAAuB,CAAC,YAAY,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE;IAUjE,yBAAyB,CACvB,UAAU,EAAE,uBAAuB,EACnC,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,aAAa,CAAC;QAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;KAC1B,GACA;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI;IAsCtE,+BAA+B,CAC7B,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,oBAAoB,GAC3B,QAAQ,GAAG,UAAU,GAAG,IAAI;IAuC/B,+BAA+B,CAAC,EAAE,EAAE;QAClC,IAAI,EAAE,yBAAyB,CAAC;QAChC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,GAAG,IAAI;IAeF,kCAAkC,CACtC,EAAE,EAAE;QACF,IAAI,EAAE,yBAAyB,CAAC;QAChC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,EACD,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,UAAU,GAClD,OAAO,CAAC,IAAI,CAAC;IA6HhB,gCAAgC,CAAC,EAAE,EAAE;QACnC,IAAI,EAAE,yBAAyB,CAAC;KACjC,GAAG,IAAI;IAKF,+BAA+B,CAAC,KAAK,EAAE;QAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,OAAO,CAAC,EAAE;YACjB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,aAAa,CAAC;YAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;YACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;SACrC,CAAC;KACH,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAsCrD,uBAAuB,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,OAAO,CAAC,EAAE;YACjB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,aAAa,CAAC;YAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;YACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;YACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;SAC9B,CAAC;KACH,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAyD5D"}
+{"version":3,"file":"control-plane.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/daemon/control-plane.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAOhE,OAAO,KAAK,EAAE,mBAAmB,EAAuB,MAAM,2BAA2B,CAAC;AAC1F,OAAO,KAAK,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAI5E,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;IAC3D,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD,QAAQ,CAAC,UAAU,EACf,KAAK,GACL,KAAK,GACL,OAAO,GACP,SAAS,GACT,MAAM,GACN,SAAS,GACT,UAAU,GACV,aAAa,GACb,QAAQ,GACR,UAAU,GACV,UAAU,GACV,SAAS,GACT,aAAa,GACb,YAAY,GACZ,QAAQ,GACR,QAAQ,CAAC;IACb,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;IACvD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,OAAO,CAAC;IAC1C,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACvE,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IACtF,QAAQ,CAAC,2BAA2B,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CAC/G;AAED,UAAU,oBAAoB;IAC5B,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC;CAC9D;AAED,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,yBAAyB;IAE/D,OAAO,CAAC,iBAAiB;IAIzB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM;IAItC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO;IAOhC,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI;IAYhG,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI;IAYrC,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,4BAA4B,EAAE,mBAAmB,GAAG,QAAQ,CAAC;IAenI,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI;IAuB5E,uBAAuB,CAAC,YAAY,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE;IAUjE,yBAAyB,CACvB,UAAU,EAAE,uBAAuB,EACnC,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,aAAa,CAAC;QAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;KAC1B,GACA;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI;IAsCtE,+BAA+B,CAC7B,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,oBAAoB,GAC3B,QAAQ,GAAG,UAAU,GAAG,IAAI;IAwC/B,+BAA+B,CAAC,EAAE,EAAE;QAClC,IAAI,EAAE,yBAAyB,CAAC;QAChC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,GAAG,IAAI;IAeF,kCAAkC,CACtC,EAAE,EAAE;QACF,IAAI,EAAE,yBAAyB,CAAC;QAChC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7B,EACD,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,UAAU,GAClD,OAAO,CAAC,IAAI,CAAC;IA0IhB,gCAAgC,CAAC,EAAE,EAAE;QACnC,IAAI,EAAE,yBAAyB,CAAC;KACjC,GAAG,IAAI;IAKF,+BAA+B,CAAC,KAAK,EAAE;QAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,OAAO,CAAC,EAAE;YACjB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,aAAa,CAAC;YAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;YACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;SACrC,CAAC;KACH,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAsCrD,uBAAuB,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,OAAO,CAAC,EAAE;YACjB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,aAAa,CAAC;YAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;YACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;YACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;SAC9B,CAAC;KACH,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAyD5D"}

package/dist/_internal/platform/daemon/control-plane.js

@@ -1,4 +1,5 @@
 import { authenticateOperatorRequest, authenticateOperatorToken, extractOperatorAuthToken, isOperatorAdmin, } from '../security/http-auth.js';
+import { isRuntimeEventDomain } from '../runtime/events/index.js';
 import { extractForwardedClientIp } from '../runtime/network/index.js';
 import { resolveGatewayPathTemplate } from './helpers.js';
 import { summarizeError } from '../utils/error-display.js';
@@ -133,11 +134,13 @@ export class DaemonControlPlaneHelper {
         }
         const token = this.extractAuthToken(req);
         const principal = resolveAuthenticatedPrincipal(req, this);
-        if (token && !principal) {
+        if (!principal) {
             return Response.json({ error: 'Unauthorized' }, { status: 401 });
         }
         const rawDomains = url.searchParams.get('domains');
-        const domains = (rawDomains ? rawDomains.split(',').map((value) => value.trim()).filter(Boolean) : []);
+        const domains = parseRuntimeDomains(rawDomains);
+        if (domains instanceof Response)
+            return domains;
         const requestedKind = url.searchParams.get('clientKind');
         const clientKind = requestedKind === 'tui'
             || requestedKind === 'web'
@@ -159,7 +162,7 @@ export class DaemonControlPlaneHelper {
                 domains,
                 clientKind,
                 remoteAddress: extractForwardedClientIp(req, this.trustProxyEnabled()),
-                authenticated: Boolean(principal),
+                authenticated: true,
             },
         });
         return upgraded ? 'upgraded' : Response.json({ error: 'WebSocket upgrade failed' }, { status: 400 });
@@ -219,7 +222,12 @@ export class DaemonControlPlaneHelper {
                 ...(Array.isArray(frame.capabilities) ? { capabilities: frame.capabilities.filter((value) => typeof value === 'string') } : {}),
             });
             if (Array.isArray(frame.domains)) {
-                this.context.controlPlaneGateway.subscribeWebSocketClient(clientId, frame.domains.filter((value) => typeof value === 'string'));
+                const domains = normalizeFrameDomains(frame.domains);
+                if (domains instanceof Response) {
+                    ws.send(JSON.stringify({ type: 'auth', ok: false, error: 'Invalid runtime event domain' }));
+                    return;
+                }
+                this.context.controlPlaneGateway.subscribeWebSocketClient(clientId, domains);
             }
             ws.data.authToken = token;
             ws.data.principalId = principal.principalId;
@@ -236,16 +244,24 @@ export class DaemonControlPlaneHelper {
                 return;
             }
             const domains = Array.isArray(frame.domains)
-                ? frame.domains.filter((value) => typeof value === 'string')
+                ? normalizeFrameDomains(frame.domains)
                 : [];
+            if (domains instanceof Response) {
+                ws.send(JSON.stringify({ type: 'error', error: 'Invalid runtime event domain' }));
+                return;
+            }
             this.context.controlPlaneGateway.subscribeWebSocketClient(clientId, domains);
             ws.send(JSON.stringify({ type: 'subscribed', clientId, domains }));
             return;
         }
         if (frame.type === 'unsubscribe') {
             const domains = Array.isArray(frame.domains)
-                ? frame.domains.filter((value) => typeof value === 'string')
+                ? normalizeFrameDomains(frame.domains)
                 : undefined;
+            if (domains instanceof Response) {
+                ws.send(JSON.stringify({ type: 'error', error: 'Invalid runtime event domain' }));
+                return;
+            }
             this.context.controlPlaneGateway.unsubscribeWebSocketClient(clientId, domains);
             ws.send(JSON.stringify({ type: 'unsubscribed', clientId, domains: domains ?? [] }));
             return;
@@ -400,3 +416,31 @@ export class DaemonControlPlaneHelper {
         });
     }
 }
+function parseRuntimeDomains(rawDomains) {
+    if (!rawDomains)
+        return [];
+    return normalizeFrameDomains(rawDomains.split(',').map((value) => value.trim()).filter(Boolean));
+}
+function normalizeFrameDomains(values) {
+    const domains = [];
+    const invalid = [];
+    for (const value of values) {
+        if (typeof value !== 'string') {
+            invalid.push(String(value));
+            continue;
+        }
+        const trimmed = value.trim();
+        if (!isRuntimeEventDomain(trimmed)) {
+            invalid.push(trimmed);
+            continue;
+        }
+        domains.push(trimmed);
+    }
+    if (invalid.length > 0) {
+        return Response.json({
+            error: 'Invalid runtime event domain',
+            invalid,
+        }, { status: 400 });
+    }
+    return [...new Set(domains)];
+}

package/dist/_internal/platform/daemon/facade-composition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"facade-composition.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/daemon/facade-composition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAkBrD,OAAO,KAAK,EAAE,oBAAoB,EAA0B,MAAM,wCAAwC,CAAC;AAI3G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAuB,MAAM,YAAY,CAAC;AAIpE,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,sCAAsC,EACvC,MAAM,mBAAmB,CAAC;AAI3B;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,oBAAoB,CA2FvG;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,YAAY,EACpB,qBAAqB,CAAC,EAAE,aAAa,GACpC,2BAA2B,CAoI7B;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,sCAAsC,GAC9C,yBAAyB,CAuK3B;AAED,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC1D,QAAQ,CAAC,aAAa,EAAE,OAAO,2BAA2B,EAAE,mBAAmB,CAAC;IAChF,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,yBAAyB,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzK,QAAQ,CAAC,4BAA4B,EAAE,CAAC,OAAO,EAAE,OAAO,kDAAkD,EAAE,sBAAsB,GAAG,SAAS,EAAE,KAAK,EAAE;QACrJ,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,KAAK,IAAI,CAAC;CACZ,GAAG,IAAI,CAsBP"}
+{"version":3,"file":"facade-composition.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/daemon/facade-composition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAkBrD,OAAO,KAAK,EAAE,oBAAoB,EAA0B,MAAM,wCAAwC,CAAC;AAI3G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAuB,MAAM,YAAY,CAAC;AAKpE,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,sCAAsC,EACvC,MAAM,mBAAmB,CAAC;AAI3B;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,oBAAoB,CAoHvG;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,YAAY,EACpB,qBAAqB,CAAC,EAAE,aAAa,GACpC,2BAA2B,CA6I7B;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,sCAAsC,GAC9C,yBAAyB,CAuK3B;AAED,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC1D,QAAQ,CAAC,aAAa,EAAE,OAAO,2BAA2B,EAAE,mBAAmB,CAAC;IAChF,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,yBAAyB,EAAE,WAAW,GAAG,QAAQ,CAAC;IACzK,QAAQ,CAAC,4BAA4B,EAAE,CAAC,OAAO,EAAE,OAAO,kDAAkD,EAAE,sBAAsB,GAAG,SAAS,EAAE,KAAK,EAAE;QACrJ,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,KAAK,IAAI,CAAC;CACZ,GAAG,IAAI,CAsBP"}

package/dist/_internal/platform/daemon/facade-composition.js

@@ -19,6 +19,7 @@ import { getBaseModelId } from '../providers/registry-helpers.js';
 import { CATALOG_PROVIDER_NAME_ALIASES } from '../providers/builtin-registry.js';
 import { createRuntimeServices } from '../runtime/services.js';
 import { PlatformServiceManager } from './service-manager.js';
+import { PermissionManager, createPermissionConfigReader } from '../permissions/manager.js';
 /**
  * Creates the CompanionLLMProvider adapter that bridges the daemon's
  * ProviderRegistry (chat-based) to the queue-driven async-generator interface
@@ -89,6 +90,7 @@ export function createCompanionProviderAdapter(providerRegistry) {
             let resolve = null;
             let done = false;
             let streamError;
+            let streamedContent = '';
             const push = (chunk) => {
                 queue.push(chunk);
                 resolve?.();
@@ -96,14 +98,37 @@ export function createCompanionProviderAdapter(providerRegistry) {
             };
             const chatPromise = provider.chat({
                 model: bareModelId,
-                messages: messages.map((m) => ({ role: m.role, content: m.content })),
+                messages: messages.map((m) => {
+                    if (m.role === 'tool') {
+                        return {
+                            role: 'tool',
+                            callId: m.callId,
+                            content: m.content,
+                            ...(m.name ? { name: m.name } : {}),
+                        };
+                    }
+                    if (m.role === 'assistant') {
+                        return {
+                            role: 'assistant',
+                            content: m.content,
+                            ...(m.toolCalls ? { toolCalls: m.toolCalls } : {}),
+                        };
+                    }
+                    return { role: 'user', content: m.content };
+                }),
+                tools: options.tools && options.tools.length > 0 ? [...options.tools] : undefined,
                 systemPrompt: options.systemPrompt ?? undefined,
                 signal: options.abortSignal,
                 onDelta(delta) {
-                    if (delta.content)
+                    if (delta.content) {
+                        streamedContent += delta.content;
                         push({ type: 'text_delta', delta: delta.content });
+                    }
                 },
             }).then((resp) => {
+                if (resp.content && streamedContent.length === 0) {
+                    push({ type: 'text_delta', delta: resp.content });
+                }
                 if (resp.toolCalls?.length) {
                     for (const tc of resp.toolCalls) {
                         push({ type: 'tool_call', toolCallId: tc.id, toolName: tc.name, toolInput: tc.arguments });
@@ -199,6 +224,9 @@ export function resolveDaemonFacadeRuntime(config, fallbackConfigManager) {
         persist: true,
         // C-3: Wire the full ToolRegistry so LLM-emitted tool calls are executed.
         toolRegistry: runtimeServices.agentOrchestrator.getToolRegistry(),
+        permissionManager: new PermissionManager(undefined, createPermissionConfigReader(resolvedConfigManager), runtimeServices.policyRuntimeState, runtimeServices.hookDispatcher, runtimeServices.featureFlags),
+        hookDispatcher: runtimeServices.hookDispatcher,
+        runtimeBus,
     });
     runtimeServices.approvalBroker.setPublisher(controlPlaneGateway);
     runtimeServices.sessionBroker.setEventPublisher((event, payload) => {

package/dist/_internal/platform/daemon/facade-types.d.ts

@@ -117,7 +117,7 @@ export interface CreateDaemonFacadeCollaboratorsOptions {
     }>;
     readonly syncSpawnedAgentTask: (record: import('../tools/agent/index.js').AgentRecord, sessionId?: string) => void;
     readonly syncFinishedAgentTask: (record: import('../tools/agent/index.js').AgentRecord) => void;
-    readonly surfaceDeliveryEnabled: (surface: 'slack' | 'discord' | 'ntfy' | 'webhook' | 'telegram' | 'google-chat' | 'signal' | 'whatsapp' | 'imessage' | 'msteams' | 'bluebubbles' | 'mattermost' | 'matrix') => boolean;
+    readonly surfaceDeliveryEnabled: (surface: 'slack' | 'discord' | 'ntfy' | 'webhook' | 'homeassistant' | 'telegram' | 'google-chat' | 'signal' | 'whatsapp' | 'imessage' | 'msteams' | 'bluebubbles' | 'mattermost' | 'matrix') => boolean;
     readonly signWebhookPayload: (body: string, secret: string) => string;
     readonly handleApprovalAction: (approvalId: string, action: 'claim' | 'approve' | 'deny' | 'cancel', req: Request) => Promise<Response>;
     readonly tlsState: () => ResolvedInboundTlsContext | null;