@pixelzx/genesis 2026.5.5-3 → 2026.5.5-5

package/dist/message-action-runner-CQRkxPID.js

@@ -0,0 +1,2 @@
+import { n as runMessageAction, t as getToolResult } from "./message-action-runner-BhMtHi5R.js";
+export { getToolResult, runMessageAction };

package/dist/message-actions-BoLjX-Cs.js

@@ -0,0 +1,143 @@
+import { a as normalizeLowercaseStringOrEmpty } from "./string-coerce-C1IzJjqi.js";
+import { a as createActionGate, g as readStringParam, l as jsonResult } from "./common-YOU2Qb73.js";
+import { t as resolveReactionLevel } from "./text-runtime-B4pK_Jpd.js";
+import { r as resolveReactionMessageId } from "./channel-actions-DO6JAXrT.js";
+import { i as resolveSignalAccount, t as listEnabledSignalAccounts } from "./accounts-CJJT0vS7.js";
+import { n as sendReactionSignal, t as removeReactionSignal } from "./reaction-runtime-api-B_tKpY7u.js";
+//#region extensions/signal/src/reaction-level.ts
+/**
+* Resolve the effective reaction level and its implications for Signal.
+*
+* Levels:
+* - "off": No reactions at all
+* - "ack": Only automatic ack reactions (👀 when processing), no agent reactions
+* - "minimal": Agent can react, but sparingly (default)
+* - "extensive": Agent can react liberally
+*/
+function resolveSignalReactionLevel(params) {
+	return resolveReactionLevel({
+		value: resolveSignalAccount({
+			cfg: params.cfg,
+			accountId: params.accountId
+		}).config.reactionLevel,
+		defaultLevel: "minimal",
+		invalidFallback: "minimal"
+	});
+}
+//#endregion
+//#region extensions/signal/src/message-actions.ts
+const providerId = "signal";
+const GROUP_PREFIX = "group:";
+function normalizeSignalReactionRecipient(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return trimmed;
+	const withoutSignal = trimmed.replace(/^signal:/i, "").trim();
+	if (!withoutSignal) return withoutSignal;
+	if (normalizeLowercaseStringOrEmpty(withoutSignal).startsWith("uuid:")) return withoutSignal.slice(5).trim();
+	return withoutSignal;
+}
+function resolveSignalReactionTarget(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return {};
+	const withoutSignal = trimmed.replace(/^signal:/i, "").trim();
+	if (!withoutSignal) return {};
+	if (normalizeLowercaseStringOrEmpty(withoutSignal).startsWith(GROUP_PREFIX)) {
+		const groupId = withoutSignal.slice(6).trim();
+		return groupId ? { groupId } : {};
+	}
+	return { recipient: normalizeSignalReactionRecipient(withoutSignal) };
+}
+async function mutateSignalReaction(params) {
+	const options = {
+		cfg: params.cfg,
+		accountId: params.accountId,
+		groupId: params.target.groupId,
+		targetAuthor: params.targetAuthor,
+		targetAuthorUuid: params.targetAuthorUuid
+	};
+	if (params.remove) {
+		await removeReactionSignal(params.target.recipient ?? "", params.timestamp, params.emoji, options);
+		return jsonResult({
+			ok: true,
+			removed: params.emoji
+		});
+	}
+	await sendReactionSignal(params.target.recipient ?? "", params.timestamp, params.emoji, options);
+	return jsonResult({
+		ok: true,
+		added: params.emoji
+	});
+}
+const signalMessageActions = {
+	describeMessageTool: ({ cfg, accountId }) => {
+		const configuredAccounts = accountId ? [resolveSignalAccount({
+			cfg,
+			accountId
+		})].filter((account) => account.enabled && account.configured) : listEnabledSignalAccounts(cfg).filter((account) => account.configured);
+		if (configuredAccounts.length === 0) return null;
+		const actions = new Set(["send"]);
+		if (configuredAccounts.some((account) => createActionGate(account.config.actions)("reactions"))) actions.add("react");
+		return { actions: Array.from(actions) };
+	},
+	supportsAction: ({ action }) => action !== "send",
+	handleAction: async ({ action, params, cfg, accountId, toolContext }) => {
+		if (action === "send") throw new Error("Send should be handled by outbound, not actions handler.");
+		if (action === "react") {
+			const reactionLevelInfo = resolveSignalReactionLevel({
+				cfg,
+				accountId: accountId ?? void 0
+			});
+			if (!reactionLevelInfo.agentReactionsEnabled) throw new Error(`Signal agent reactions disabled (reactionLevel="${reactionLevelInfo.level}"). Set channels.signal.reactionLevel to "minimal" or "extensive" to enable.`);
+			const actionConfig = resolveSignalAccount({
+				cfg,
+				accountId
+			}).config.actions;
+			if (!createActionGate(actionConfig)("reactions")) throw new Error("Signal reactions are disabled via actions.reactions.");
+			const target = resolveSignalReactionTarget(readStringParam(params, "recipient") ?? readStringParam(params, "to", {
+				required: true,
+				label: "recipient (UUID, phone number, or group)"
+			}));
+			if (!target.recipient && !target.groupId) throw new Error("recipient or group required");
+			const messageIdRaw = resolveReactionMessageId({
+				args: params,
+				toolContext
+			});
+			const messageId = messageIdRaw != null ? String(messageIdRaw) : void 0;
+			if (!messageId) throw new Error("messageId (timestamp) required. Provide messageId explicitly or react to the current inbound message.");
+			const targetAuthor = readStringParam(params, "targetAuthor");
+			const targetAuthorUuid = readStringParam(params, "targetAuthorUuid");
+			if (target.groupId && !targetAuthor && !targetAuthorUuid) throw new Error("targetAuthor or targetAuthorUuid required for group reactions.");
+			const emoji = readStringParam(params, "emoji", { allowEmpty: true });
+			const remove = typeof params.remove === "boolean" ? params.remove : void 0;
+			const timestamp = Number.parseInt(messageId, 10);
+			if (!Number.isFinite(timestamp)) throw new Error(`Invalid messageId: ${messageId}. Expected numeric timestamp.`);
+			if (remove) {
+				if (!emoji) throw new Error("Emoji required to remove reaction.");
+				return await mutateSignalReaction({
+					cfg,
+					accountId: accountId ?? void 0,
+					target,
+					timestamp,
+					emoji,
+					remove: true,
+					targetAuthor,
+					targetAuthorUuid
+				});
+			}
+			if (!emoji) throw new Error("Emoji required to add reaction.");
+			return await mutateSignalReaction({
+				cfg,
+				accountId: accountId ?? void 0,
+				target,
+				timestamp,
+				emoji,
+				remove: false,
+				targetAuthor,
+				targetAuthorUuid
+			});
+		}
+		throw new Error(`Action ${action} not supported for ${providerId}.`);
+	}
+};
+//#endregion
+export { resolveSignalReactionLevel as n, signalMessageActions as t };

package/dist/message.gateway.runtime-HANIkH2g.js

@@ -0,0 +1,2 @@
+import { a as callGatewayLeastPrivilege, c as randomIdempotencyKey } from "./call-Bu6qiSj3.js";
+export { callGatewayLeastPrivilege, randomIdempotencyKey };

package/dist/message.gateway.runtime.js

@@ -1 +1 @@
-export * from "./message.gateway.runtime-BXChuYAf.js";
+export * from "./message.gateway.runtime-HANIkH2g.js";

package/dist/method-scopes-CVKEoi44.js

@@ -0,0 +1,216 @@
+import { r as getPluginRegistryState } from "./runtime-state-Dpb3g8vL.js";
+import { n as resolveReservedGatewayMethodScope } from "./gateway-method-policy-BqTei_1n.js";
+//#region src/gateway/operator-scopes.ts
+const ADMIN_SCOPE = "operator.admin";
+const READ_SCOPE = "operator.read";
+const WRITE_SCOPE = "operator.write";
+const APPROVALS_SCOPE = "operator.approvals";
+const PAIRING_SCOPE = "operator.pairing";
+const TALK_SECRETS_SCOPE = "operator.talk.secrets";
+//#endregion
+//#region src/gateway/method-scopes.ts
+const CLI_DEFAULT_OPERATOR_SCOPES = [
+	ADMIN_SCOPE,
+	READ_SCOPE,
+	WRITE_SCOPE,
+	APPROVALS_SCOPE,
+	PAIRING_SCOPE,
+	TALK_SECRETS_SCOPE
+];
+const NODE_ROLE_METHODS = new Set([
+	"node.invoke.result",
+	"node.event",
+	"node.pending.drain",
+	"node.canvas.capability.refresh",
+	"node.pending.pull",
+	"node.pending.ack",
+	"skills.bins"
+]);
+const METHOD_SCOPE_BY_NAME = new Map(Object.entries({
+	[APPROVALS_SCOPE]: [
+		"exec.approval.get",
+		"exec.approval.list",
+		"exec.approval.request",
+		"exec.approval.waitDecision",
+		"exec.approval.resolve",
+		"plugin.approval.list",
+		"plugin.approval.request",
+		"plugin.approval.waitDecision",
+		"plugin.approval.resolve"
+	],
+	[PAIRING_SCOPE]: [
+		"node.pair.request",
+		"node.pair.list",
+		"node.pair.reject",
+		"node.pair.verify",
+		"node.pair.approve",
+		"device.pair.list",
+		"device.pair.approve",
+		"device.pair.reject",
+		"device.pair.remove",
+		"device.token.rotate",
+		"device.token.revoke",
+		"node.rename"
+	],
+	[READ_SCOPE]: [
+		"assistant.media.get",
+		"health",
+		"diagnostics.stability",
+		"doctor.memory.status",
+		"doctor.memory.dreamDiary",
+		"logs.tail",
+		"channels.status",
+		"status",
+		"usage.status",
+		"usage.cost",
+		"tts.status",
+		"tts.providers",
+		"commands.list",
+		"models.list",
+		"models.authStatus",
+		"tools.catalog",
+		"tools.effective",
+		"agents.list",
+		"agent.identity.get",
+		"skills.status",
+		"skills.search",
+		"skills.detail",
+		"plugins.status",
+		"plugins.search",
+		"plugins.detail",
+		"voicewake.get",
+		"sessions.list",
+		"sessions.get",
+		"sessions.preview",
+		"sessions.resolve",
+		"sessions.compaction.list",
+		"sessions.compaction.get",
+		"sessions.subscribe",
+		"sessions.unsubscribe",
+		"sessions.messages.subscribe",
+		"sessions.messages.unsubscribe",
+		"sessions.usage",
+		"sessions.usage.timeseries",
+		"sessions.usage.logs",
+		"cron.list",
+		"cron.status",
+		"cron.runs",
+		"gateway.identity.get",
+		"system-presence",
+		"last-heartbeat",
+		"node.list",
+		"node.describe",
+		"chat.history",
+		"config.get",
+		"config.schema.lookup",
+		"wallet.summary",
+		"talk.config",
+		"agents.files.list",
+		"agents.files.get"
+	],
+	[WRITE_SCOPE]: [
+		"message.action",
+		"send",
+		"poll",
+		"agent",
+		"agent.wait",
+		"wake",
+		"talk.mode",
+		"talk.realtime.session",
+		"talk.speak",
+		"tts.enable",
+		"tts.disable",
+		"tts.convert",
+		"tts.setProvider",
+		"voicewake.set",
+		"node.invoke",
+		"canvas.document.create",
+		"chat.send",
+		"chat.abort",
+		"sessions.create",
+		"sessions.send",
+		"sessions.steer",
+		"sessions.abort",
+		"sessions.compaction.branch",
+		"doctor.memory.backfillDreamDiary",
+		"doctor.memory.resetDreamDiary",
+		"doctor.memory.resetGroundedShortTerm",
+		"doctor.memory.repairDreamingArtifacts",
+		"doctor.memory.dedupeDreamDiary",
+		"push.test",
+		"node.pending.enqueue"
+	],
+	[ADMIN_SCOPE]: [
+		"channels.start",
+		"channels.logout",
+		"agents.create",
+		"agents.update",
+		"agents.delete",
+		"skills.install",
+		"skills.update",
+		"plugins.install",
+		"plugins.update",
+		"plugins.uninstall",
+		"secrets.reload",
+		"secrets.resolve",
+		"cron.add",
+		"cron.update",
+		"cron.remove",
+		"cron.run",
+		"sessions.patch",
+		"sessions.reset",
+		"sessions.delete",
+		"sessions.compact",
+		"sessions.compaction.restore",
+		"wallet.recoveryPhrase.set",
+		"connect",
+		"chat.inject",
+		"nativeHook.invoke",
+		"web.login.start",
+		"web.login.wait",
+		"set-heartbeats",
+		"system-event",
+		"agents.files.set"
+	],
+	[TALK_SECRETS_SCOPE]: []
+}).flatMap(([scope, methods]) => methods.map((method) => [method, scope])));
+function resolveScopedMethod(method) {
+	const explicitScope = METHOD_SCOPE_BY_NAME.get(method);
+	if (explicitScope) return explicitScope;
+	const reservedScope = resolveReservedGatewayMethodScope(method);
+	if (reservedScope) return reservedScope;
+	const pluginScope = getPluginRegistryState()?.activeRegistry?.gatewayMethodScopes?.[method];
+	if (pluginScope) return pluginScope;
+}
+function isNodeRoleMethod(method) {
+	return NODE_ROLE_METHODS.has(method);
+}
+function isAdminOnlyMethod(method) {
+	return resolveScopedMethod(method) === ADMIN_SCOPE;
+}
+function resolveRequiredOperatorScopeForMethod(method) {
+	return resolveScopedMethod(method);
+}
+function resolveLeastPrivilegeOperatorScopesForMethod(method) {
+	const requiredScope = resolveRequiredOperatorScopeForMethod(method);
+	if (requiredScope) return [requiredScope];
+	return [];
+}
+function authorizeOperatorScopesForMethod(method, scopes) {
+	if (scopes.includes("operator.admin")) return { allowed: true };
+	const requiredScope = resolveRequiredOperatorScopeForMethod(method) ?? "operator.admin";
+	if (requiredScope === "operator.read") {
+		if (scopes.includes("operator.read") || scopes.includes("operator.write")) return { allowed: true };
+		return {
+			allowed: false,
+			missingScope: READ_SCOPE
+		};
+	}
+	if (scopes.includes(requiredScope)) return { allowed: true };
+	return {
+		allowed: false,
+		missingScope: requiredScope
+	};
+}
+//#endregion
+export { resolveLeastPrivilegeOperatorScopesForMethod as a, PAIRING_SCOPE as c, WRITE_SCOPE as d, isNodeRoleMethod as i, READ_SCOPE as l, authorizeOperatorScopesForMethod as n, ADMIN_SCOPE as o, isAdminOnlyMethod as r, APPROVALS_SCOPE as s, CLI_DEFAULT_OPERATOR_SCOPES as t, TALK_SECRETS_SCOPE as u };

package/dist/models-auth-status-B-Mv4ebj.js

@@ -0,0 +1,201 @@
+import { t as createSubsystemLogger } from "./subsystem-DTMy5YmO.js";
+import { s as isSecretRef } from "./types.secrets-ews2W8BF.js";
+import { a as loadConfig } from "./io-DNd8mbjy.js";
+import { r as normalizeProviderId } from "./provider-id-BLh32HP1.js";
+import "./config-3He3LWHw.js";
+import { mn as errorShape, pn as ErrorCodes } from "./protocol-DWprZycP.js";
+import { n as ensureAuthProfileStore } from "./store-zVJHt5-N.js";
+import { t as resolveGenesisAgentDir } from "./agent-paths-C8JZWFei.js";
+import "./auth-profiles-qkJp8etH.js";
+import { t as formatForLog } from "./ws-log-B59Ub3FE.js";
+import { n as PROVIDER_LABELS, o as resolveUsageProviderId } from "./provider-usage.shared-CcvPrv1N.js";
+import { t as loadProviderUsageSummary } from "./provider-usage.load-Ckz1tFpH.js";
+import { n as buildAuthHealthSummary, r as formatRemainingShort } from "./auth-health-DvPWpSkl.js";
+//#region src/gateway/server-methods/models-auth-status.ts
+const log = createSubsystemLogger("models-auth-status");
+const CACHE_TTL_MS = 6e4;
+let cached = null;
+/**
+* Invalidate the in-memory cache. Reserved for future gateway-side auth
+* mutation handlers (login, logout, token rotation) so the next read returns
+* fresh data. Today those mutations happen via the CLI and the 60s TTL plus
+* `{refresh: true}` param cover the stale-data window.
+*/
+function invalidateModelAuthStatusCache() {
+	cached = null;
+}
+function buildExpiry(remainingMs, expiresAt) {
+	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt) || typeof remainingMs !== "number") return;
+	return {
+		at: expiresAt,
+		remainingMs,
+		label: formatRemainingShort(remainingMs)
+	};
+}
+function providerDisplayName(provider) {
+	const usageId = resolveUsageProviderId(provider);
+	if (usageId && PROVIDER_LABELS[usageId]) return PROVIDER_LABELS[usageId];
+	return provider;
+}
+/**
+* Aggregate provider status from OAuth profiles only. `buildAuthHealthSummary`
+* rolls up across both OAuth and token profiles, which mis-reports providers
+* where a healthy OAuth sits alongside an expired/missing bearer token.
+* For the dashboard's OAuth-health signal, token profiles are a separate
+* concern — we want "is OAuth healthy?", not "is every credential healthy?"
+*
+* `expectsOAuth` surfaces the configured-OAuth-but-no-oauth-profile case as
+* `missing` instead of silently falling back to the provider's rollup (which
+* would report `static` if only api_key credentials exist). Without this,
+* switching a provider from api_key to oauth in config but forgetting to
+* login hides behind the residual api_key profile until runtime fails.
+*
+* Exported for direct unit testing of the rollup rules.
+*/
+function aggregateOAuthStatus(prov, now = Date.now(), expectsOAuth = false) {
+	const oauth = prov.profiles.filter((p) => p.type === "oauth");
+	if (oauth.length === 0) {
+		if (expectsOAuth) return { status: "missing" };
+		return {
+			status: prov.status,
+			expiresAt: prov.expiresAt,
+			remainingMs: prov.remainingMs
+		};
+	}
+	const statuses = new Set(oauth.map((p) => p.status));
+	let status;
+	if (statuses.has("expired") || statuses.has("missing")) status = "expired";
+	else if (statuses.has("expiring")) status = "expiring";
+	else if (statuses.has("ok")) status = "ok";
+	else if (statuses.has("static")) status = "static";
+	else {
+		Array.from(statuses)[0];
+		status = "static";
+	}
+	const expirable = oauth.map((p) => p.expiresAt).filter((v) => typeof v === "number" && Number.isFinite(v));
+	const expiresAt = expirable.length > 0 ? Math.min(...expirable) : void 0;
+	const remainingMs = expiresAt !== void 0 ? expiresAt - now : void 0;
+	return {
+		status,
+		expiresAt,
+		remainingMs
+	};
+}
+function mapProvider(prov, usageByProvider, expectsOAuthSet) {
+	const usageKey = resolveUsageProviderId(prov.provider);
+	const usage = usageKey ? usageByProvider.get(usageKey) : void 0;
+	const rollup = aggregateOAuthStatus(prov, Date.now(), expectsOAuthSet.has(prov.provider));
+	return {
+		provider: prov.provider,
+		displayName: providerDisplayName(prov.provider),
+		status: rollup.status,
+		expiry: buildExpiry(rollup.remainingMs, rollup.expiresAt),
+		profiles: prov.profiles.map((prof) => ({
+			profileId: prof.profileId,
+			type: prof.type,
+			status: prof.status,
+			expiry: buildExpiry(prof.remainingMs, prof.expiresAt)
+		})),
+		usage: usage ? {
+			windows: usage.windows,
+			plan: usage.plan
+		} : void 0
+	};
+}
+/**
+* Collect provider IDs with refreshable credentials (OAuth or bearer token)
+* so a configured-but-not-logged-in provider surfaces as `missing` rather
+* than being silently absent. API-key and AWS-SDK providers are excluded —
+* their credentials don't expire on a schedule this endpoint can meaningfully
+* monitor, and surfacing them here would flash a red alert on a healthy
+* API-key setup.
+*
+* Providers with `models.providers.<id>.apiKey` set (commonly via a
+* SecretRef env binding) are excluded from the "missing" synthesis even
+* when their `auth` mode is `oauth` or `token` — an env-backed credential
+* is already present, so flagging the dashboard as missing would cry wolf
+* for a working auth path. They can still show up with real status if the
+* profile store has an entry for them.
+*/
+function resolveConfiguredProviders(cfg) {
+	const out = /* @__PURE__ */ new Set();
+	const expectsOAuth = /* @__PURE__ */ new Set();
+	const envBacked = /* @__PURE__ */ new Set();
+	for (const [id, provider] of Object.entries(cfg.models?.providers ?? {})) {
+		const apiKey = provider?.apiKey;
+		if (!id || apiKey === void 0 || apiKey === null) continue;
+		let resolvable = false;
+		if (typeof apiKey === "string" && apiKey.length > 0) resolvable = true;
+		else if (isSecretRef(apiKey)) if (apiKey.source === "env") {
+			const envValue = process.env[apiKey.id];
+			resolvable = typeof envValue === "string" && envValue.length > 0;
+		} else resolvable = true;
+		if (resolvable) envBacked.add(normalizeProviderId(id));
+	}
+	for (const [id, provider] of Object.entries(cfg.models?.providers ?? {})) {
+		if (!id) continue;
+		const mode = provider?.auth;
+		if (mode !== "oauth" && mode !== "token") continue;
+		if (envBacked.has(normalizeProviderId(id))) continue;
+		out.add(id);
+		if (mode === "oauth") expectsOAuth.add(normalizeProviderId(id));
+	}
+	for (const profile of Object.values(cfg.auth?.profiles ?? {})) {
+		const provider = profile?.provider;
+		const mode = profile?.mode;
+		if (typeof provider !== "string" || provider.length === 0 || mode !== "oauth" && mode !== "token") continue;
+		if (envBacked.has(normalizeProviderId(provider))) continue;
+		out.add(provider);
+		if (mode === "oauth") expectsOAuth.add(normalizeProviderId(provider));
+	}
+	return {
+		providers: Array.from(out),
+		expectsOAuth
+	};
+}
+const modelsAuthStatusHandlers = { "models.authStatus": async ({ params, respond }) => {
+	const now = Date.now();
+	if (!Boolean(params?.refresh) && cached && now - cached.ts < CACHE_TTL_MS) {
+		respond(true, cached.result, void 0, { cached: true });
+		return;
+	}
+	try {
+		const cfg = loadConfig();
+		const agentDir = resolveGenesisAgentDir();
+		const store = ensureAuthProfileStore(agentDir);
+		const configured = resolveConfiguredProviders(cfg);
+		const authHealth = buildAuthHealthSummary({
+			store,
+			cfg,
+			providers: configured.providers.length > 0 ? configured.providers : void 0
+		});
+		const usageProviderIds = [...new Set(authHealth.profiles.filter((p) => p.type === "oauth" || p.type === "token").map((p) => resolveUsageProviderId(p.provider)).filter((id) => Boolean(id)))];
+		const usageByProvider = /* @__PURE__ */ new Map();
+		if (usageProviderIds.length > 0) try {
+			const usage = await loadProviderUsageSummary({
+				providers: usageProviderIds,
+				agentDir,
+				timeoutMs: 3500
+			});
+			for (const snap of usage.providers) usageByProvider.set(snap.provider, {
+				windows: snap.windows,
+				plan: snap.plan
+			});
+		} catch (err) {
+			log.debug(`usage enrichment failed (auth status still returned): providers=${usageProviderIds.join(",")} error=${formatForLog(err)}`);
+		}
+		const result = {
+			ts: now,
+			providers: authHealth.providers.map((prov) => mapProvider(prov, usageByProvider, configured.expectsOAuth))
+		};
+		cached = {
+			ts: now,
+			result
+		};
+		respond(true, result, void 0);
+	} catch (err) {
+		respond(false, void 0, errorShape(ErrorCodes.UNAVAILABLE, formatForLog(err)));
+	}
+} };
+//#endregion
+export { modelsAuthStatusHandlers as n, invalidateModelAuthStatusCache as t };