@pixelzx/genesis 2026.6.13-beta.3 → 2026.6.13

package/dist/command-secret-gateway-BxGIG8ny.js

@@ -0,0 +1,528 @@
+import { i as formatErrorMessage } from "./errors-CufR9eHH.js";
+import { a as normalizeLowercaseStringOrEmpty } from "./string-coerce-DPP_aYVc.js";
+import { a as coerceSecretRef, p as resolveSecretInputRef } from "./types.secrets-BbgGt42I.js";
+import { a as resolveSecretRefValue } from "./resolve-DFimFdgC.js";
+import { n as resolveManifestContractOwnerPluginId } from "./manifest-registry-CUSRRX5s.js";
+import { i as setPathExistingStrict, n as getPath } from "./path-utils-CJ35S4Ql.js";
+import { r as discoverConfigSecretTargetsByIds } from "./target-registry-BrTvhqBU.js";
+import { i as GATEWAY_CLIENT_NAMES, r as GATEWAY_CLIENT_MODES } from "./client-info-DeQMz3zN.js";
+import { Rt as validateSecretsResolveResult } from "./protocol-CqddCqi8.js";
+import { r as callGateway } from "./call-CL7Keh1p.js";
+import { r as isExpectedResolvedSecretValue, t as assertExpectedResolvedSecretValue } from "./secret-value-BaWFT5hJ.js";
+import { n as collectConfigAssignments, t as resolveRuntimeWebTools } from "./runtime-web-tools-KQK7wOgU.js";
+import { r as createResolverContext } from "./runtime-shared-CCH5V6G4.js";
+//#region src/secrets/command-config.ts
+function analyzeCommandSecretAssignmentsFromSnapshot(params) {
+	const defaults = params.sourceConfig.secrets?.defaults;
+	const assignments = [];
+	const diagnostics = [];
+	const unresolved = [];
+	const inactive = [];
+	for (const target of discoverConfigSecretTargetsByIds(params.sourceConfig, params.targetIds)) {
+		if (params.allowedPaths && !params.allowedPaths.has(target.path)) continue;
+		const { explicitRef, ref } = resolveSecretInputRef({
+			value: target.value,
+			refValue: target.refValue,
+			defaults
+		});
+		const inlineCandidateRef = explicitRef ? coerceSecretRef(target.value, defaults) : null;
+		if (!ref) continue;
+		const resolved = getPath(params.resolvedConfig, target.pathSegments);
+		if (!isExpectedResolvedSecretValue(resolved, target.entry.expectedResolvedValue)) {
+			if (params.inactiveRefPaths?.has(target.path)) {
+				diagnostics.push(`${target.path}: secret ref is configured on an inactive surface; skipping command-time assignment.`);
+				inactive.push({
+					path: target.path,
+					pathSegments: [...target.pathSegments]
+				});
+				continue;
+			}
+			unresolved.push({
+				path: target.path,
+				pathSegments: [...target.pathSegments]
+			});
+			continue;
+		}
+		assignments.push({
+			path: target.path,
+			pathSegments: [...target.pathSegments],
+			value: resolved
+		});
+		if (target.entry.secretShape === "sibling_ref" && explicitRef && inlineCandidateRef) diagnostics.push(`${target.path}: both inline and sibling ref were present; sibling ref took precedence.`);
+	}
+	return {
+		assignments,
+		diagnostics,
+		unresolved,
+		inactive
+	};
+}
+function collectCommandSecretAssignmentsFromSnapshot(params) {
+	const analyzed = analyzeCommandSecretAssignmentsFromSnapshot({
+		sourceConfig: params.sourceConfig,
+		resolvedConfig: params.resolvedConfig,
+		targetIds: params.targetIds,
+		inactiveRefPaths: params.inactiveRefPaths,
+		allowedPaths: params.allowedPaths
+	});
+	if (analyzed.unresolved.length > 0) throw new Error(`${params.commandName}: ${analyzed.unresolved[0]?.path ?? "target"} is unresolved in the active runtime snapshot.`);
+	return {
+		assignments: analyzed.assignments,
+		diagnostics: analyzed.diagnostics
+	};
+}
+//#endregion
+//#region src/cli/command-secret-gateway.ts
+const WEB_RUNTIME_SECRET_TARGET_ID_PREFIXES = ["tools.web.search", "plugins.entries."];
+const WEB_RUNTIME_SECRET_PATH_PREFIXES = ["tools.web.search.", "plugins.entries."];
+const commandSecretGatewayDeps = {
+	analyzeCommandSecretAssignmentsFromSnapshot,
+	collectConfigAssignments,
+	discoverConfigSecretTargetsByIds,
+	resolveManifestContractOwnerPluginId,
+	resolveRuntimeWebTools
+};
+function pluginIdFromRuntimeWebPath(path) {
+	return /^plugins\.entries\.([^.]+)\.config\.(webSearch|webFetch)\.apiKey$/.exec(path)?.[1];
+}
+function normalizeCommandSecretResolutionMode(mode) {
+	if (!mode || mode === "enforce_resolved" || mode === "strict") return "enforce_resolved";
+	if (mode === "read_only_status" || mode === "summary") return "read_only_status";
+	return "read_only_operational";
+}
+function enforcesResolvedSecrets(mode) {
+	return mode === "enforce_resolved";
+}
+function dedupeDiagnostics(entries) {
+	const seen = /* @__PURE__ */ new Set();
+	const ordered = [];
+	for (const entry of entries) {
+		const trimmed = entry.trim();
+		if (!trimmed || seen.has(trimmed)) continue;
+		seen.add(trimmed);
+		ordered.push(trimmed);
+	}
+	return ordered;
+}
+function targetsRuntimeWebPath(path) {
+	return WEB_RUNTIME_SECRET_PATH_PREFIXES.some((prefix) => path.startsWith(prefix));
+}
+function classifyRuntimeWebTargetPathState(params) {
+	if (params.path === "tools.web.search.apiKey") return params.config.tools?.web?.search?.enabled !== false ? "active" : "inactive";
+	const pluginId = pluginIdFromRuntimeWebPath(params.path);
+	if (pluginId) {
+		if (params.path.endsWith(".config.webFetch.apiKey")) {
+			const fetch = params.config.tools?.web?.fetch;
+			if (fetch?.enabled === false) return "inactive";
+			const configuredProvider = normalizeLowercaseStringOrEmpty(fetch?.provider);
+			if (!configuredProvider) return "active";
+			return commandSecretGatewayDeps.resolveManifestContractOwnerPluginId({
+				contract: "webFetchProviders",
+				value: configuredProvider,
+				origin: "bundled",
+				config: params.config
+			}) === pluginId ? "active" : "inactive";
+		}
+		const search = params.config.tools?.web?.search;
+		if (search?.enabled === false) return "inactive";
+		const configuredProvider = normalizeLowercaseStringOrEmpty(search?.provider);
+		if (!configuredProvider) return "active";
+		return commandSecretGatewayDeps.resolveManifestContractOwnerPluginId({
+			contract: "webSearchProviders",
+			value: configuredProvider,
+			origin: "bundled",
+			config: params.config
+		}) === pluginId ? "active" : "inactive";
+	}
+	const match = /^tools\.web\.search\.([^.]+)\.apiKey$/.exec(params.path);
+	if (!match) return "unknown";
+	const search = params.config.tools?.web?.search;
+	if (search?.enabled === false) return "inactive";
+	const configuredProvider = normalizeLowercaseStringOrEmpty(search?.provider);
+	if (!configuredProvider) return "active";
+	return configuredProvider === match[1] ? "active" : "inactive";
+}
+function describeInactiveRuntimeWebTargetPath(params) {
+	if (params.path === "tools.web.search.apiKey") return params.config.tools?.web?.search?.enabled === false ? "tools.web.search is disabled." : void 0;
+	const pluginId = pluginIdFromRuntimeWebPath(params.path);
+	if (pluginId) {
+		if (params.path.endsWith(".config.webFetch.apiKey")) {
+			const fetch = params.config.tools?.web?.fetch;
+			if (fetch?.enabled === false) return "tools.web.fetch is disabled.";
+			const configuredProvider = normalizeLowercaseStringOrEmpty(fetch?.provider);
+			if (configuredProvider) return `tools.web.fetch.provider is "${configuredProvider}".`;
+			return;
+		}
+		const search = params.config.tools?.web?.search;
+		if (search?.enabled === false) return "tools.web.search is disabled.";
+		const configuredProvider = normalizeLowercaseStringOrEmpty(search?.provider);
+		const configuredPluginId = configuredProvider ? commandSecretGatewayDeps.resolveManifestContractOwnerPluginId({
+			contract: "webSearchProviders",
+			value: configuredProvider,
+			origin: "bundled",
+			config: params.config
+		}) : void 0;
+		if (configuredPluginId && configuredPluginId !== pluginId) return `tools.web.search.provider is "${configuredProvider}".`;
+		return;
+	}
+	const match = /^tools\.web\.search\.([^.]+)\.apiKey$/.exec(params.path);
+	if (!match) return;
+	const search = params.config.tools?.web?.search;
+	if (search?.enabled === false) return "tools.web.search is disabled.";
+	const configuredProvider = normalizeLowercaseStringOrEmpty(search?.provider);
+	if (configuredProvider && configuredProvider !== match[1]) return `tools.web.search.provider is "${configuredProvider}".`;
+}
+function targetsRuntimeWebResolution(params) {
+	if (params.allowedPaths) {
+		for (const path of params.allowedPaths) if (targetsRuntimeWebPath(path)) return true;
+		return false;
+	}
+	for (const targetId of params.targetIds) if (WEB_RUNTIME_SECRET_TARGET_ID_PREFIXES.some((prefix) => targetId.startsWith(prefix))) return true;
+	return false;
+}
+function collectConfiguredTargetRefPaths(params) {
+	const defaults = params.config.secrets?.defaults;
+	const configuredTargetRefPaths = /* @__PURE__ */ new Set();
+	for (const target of commandSecretGatewayDeps.discoverConfigSecretTargetsByIds(params.config, params.targetIds)) {
+		if (params.allowedPaths && !params.allowedPaths.has(target.path)) continue;
+		const { ref } = resolveSecretInputRef({
+			value: target.value,
+			refValue: target.refValue,
+			defaults
+		});
+		if (ref) configuredTargetRefPaths.add(target.path);
+	}
+	return configuredTargetRefPaths;
+}
+function classifyConfiguredTargetRefs(params) {
+	if (params.configuredTargetRefPaths.size === 0) return {
+		hasActiveConfiguredRef: false,
+		hasUnknownConfiguredRef: false,
+		diagnostics: []
+	};
+	const context = createResolverContext({
+		sourceConfig: params.config,
+		env: process.env
+	});
+	commandSecretGatewayDeps.collectConfigAssignments({
+		config: structuredClone(params.config),
+		context
+	});
+	const activePaths = new Set(context.assignments.map((assignment) => assignment.path));
+	const inactiveWarningsByPath = /* @__PURE__ */ new Map();
+	for (const warning of context.warnings) {
+		if (warning.code !== "SECRETS_REF_IGNORED_INACTIVE_SURFACE") continue;
+		inactiveWarningsByPath.set(warning.path, warning.message);
+	}
+	const diagnostics = /* @__PURE__ */ new Set();
+	let hasActiveConfiguredRef = false;
+	let hasUnknownConfiguredRef = false;
+	for (const path of params.configuredTargetRefPaths) {
+		if (activePaths.has(path)) {
+			hasActiveConfiguredRef = true;
+			continue;
+		}
+		const inactiveWarning = inactiveWarningsByPath.get(path);
+		if (inactiveWarning) {
+			diagnostics.add(inactiveWarning);
+			continue;
+		}
+		hasUnknownConfiguredRef = true;
+	}
+	return {
+		hasActiveConfiguredRef,
+		hasUnknownConfiguredRef,
+		diagnostics: [...diagnostics]
+	};
+}
+function parseGatewaySecretsResolveResult(payload) {
+	if (!validateSecretsResolveResult(payload)) throw new Error("gateway returned invalid secrets.resolve payload.");
+	const parsed = payload;
+	return {
+		assignments: parsed.assignments ?? [],
+		diagnostics: (parsed.diagnostics ?? []).filter((entry) => entry.trim().length > 0),
+		inactiveRefPaths: (parsed.inactiveRefPaths ?? []).filter((entry) => entry.trim().length > 0)
+	};
+}
+function collectInactiveSurfacePathsFromDiagnostics(diagnostics) {
+	const paths = /* @__PURE__ */ new Set();
+	for (const entry of diagnostics) {
+		const markerIndex = entry.indexOf(": secret ref is configured on an inactive surface;");
+		if (markerIndex <= 0) continue;
+		const path = entry.slice(0, markerIndex).trim();
+		if (path.length > 0) paths.add(path);
+	}
+	return paths;
+}
+function isUnsupportedSecretsResolveError(err) {
+	const message = normalizeLowercaseStringOrEmpty(formatErrorMessage(err));
+	if (!message.includes("secrets.resolve")) return false;
+	return message.includes("does not support required method") || message.includes("unknown method") || message.includes("method not found") || message.includes("invalid request");
+}
+function isDirectRuntimeWebTargetPath(path) {
+	return /^plugins\.entries\.[^.]+\.config\.(webSearch|webFetch)\.apiKey$/.test(path) || /^tools\.web\.search\.[^.]+\.apiKey$/.test(path);
+}
+async function resolveCommandSecretRefsLocally(params) {
+	const sourceConfig = params.config;
+	const resolvedConfig = structuredClone(params.config);
+	const context = createResolverContext({
+		sourceConfig,
+		env: process.env
+	});
+	const localResolutionDiagnostics = [];
+	const discoveredTargets = commandSecretGatewayDeps.discoverConfigSecretTargetsByIds(sourceConfig, params.targetIds).filter((target) => !params.allowedPaths || params.allowedPaths.has(target.path));
+	const runtimeWebTargets = discoveredTargets.filter((target) => targetsRuntimeWebPath(target.path));
+	commandSecretGatewayDeps.collectConfigAssignments({
+		config: structuredClone(params.config),
+		context
+	});
+	if (targetsRuntimeWebResolution({
+		targetIds: params.targetIds,
+		allowedPaths: params.allowedPaths
+	}) && !runtimeWebTargets.every((target) => isDirectRuntimeWebTargetPath(target.path))) try {
+		await commandSecretGatewayDeps.resolveRuntimeWebTools({
+			sourceConfig,
+			resolvedConfig,
+			context
+		});
+	} catch (error) {
+		if (enforcesResolvedSecrets(params.mode)) throw error;
+		localResolutionDiagnostics.push(`${params.commandName}: failed to resolve web tool secrets locally (${formatErrorMessage(error)}).`);
+	}
+	const inactiveRefPaths = new Set(context.warnings.filter((warning) => warning.code === "SECRETS_REF_IGNORED_INACTIVE_SURFACE").filter((warning) => !params.allowedPaths || params.allowedPaths.has(warning.path)).map((warning) => warning.path));
+	const runtimeWebActivePaths = /* @__PURE__ */ new Set();
+	const runtimeWebInactiveDiagnostics = [];
+	for (const target of runtimeWebTargets) {
+		const runtimeState = classifyRuntimeWebTargetPathState({
+			config: sourceConfig,
+			path: target.path
+		});
+		if (runtimeState === "inactive") {
+			inactiveRefPaths.add(target.path);
+			const inactiveDetail = describeInactiveRuntimeWebTargetPath({
+				config: sourceConfig,
+				path: target.path
+			});
+			if (inactiveDetail) runtimeWebInactiveDiagnostics.push(`${target.path}: ${inactiveDetail}`);
+			continue;
+		}
+		if (runtimeState === "active") runtimeWebActivePaths.add(target.path);
+	}
+	const inactiveWarningDiagnostics = context.warnings.filter((warning) => warning.code === "SECRETS_REF_IGNORED_INACTIVE_SURFACE").filter((warning) => !params.allowedPaths || params.allowedPaths.has(warning.path)).map((warning) => warning.message);
+	const activePaths = new Set(context.assignments.map((assignment) => assignment.path));
+	for (const target of discoveredTargets) await resolveTargetSecretLocally({
+		target,
+		sourceConfig,
+		resolvedConfig,
+		env: context.env,
+		cache: context.cache,
+		activePaths,
+		runtimeWebActivePaths,
+		inactiveRefPaths,
+		mode: params.mode,
+		commandName: params.commandName,
+		localResolutionDiagnostics
+	});
+	const analyzed = commandSecretGatewayDeps.analyzeCommandSecretAssignmentsFromSnapshot({
+		sourceConfig,
+		resolvedConfig,
+		targetIds: params.targetIds,
+		inactiveRefPaths,
+		...params.allowedPaths ? { allowedPaths: params.allowedPaths } : {}
+	});
+	const targetStatesByPath = buildTargetStatesByPath({
+		analyzed,
+		resolvedState: "resolved_local"
+	});
+	if (!enforcesResolvedSecrets(params.mode) && analyzed.unresolved.length > 0) scrubUnresolvedAssignments(resolvedConfig, analyzed.unresolved);
+	else if (analyzed.unresolved.length > 0) throw new Error(`${params.commandName}: ${analyzed.unresolved[0]?.path ?? "target"} is unresolved in the active runtime snapshot.`);
+	return {
+		resolvedConfig,
+		diagnostics: dedupeDiagnostics([
+			...params.preflightDiagnostics,
+			...runtimeWebInactiveDiagnostics,
+			...inactiveWarningDiagnostics,
+			...filterInactiveSurfaceDiagnostics({
+				diagnostics: analyzed.diagnostics,
+				inactiveRefPaths
+			}),
+			...localResolutionDiagnostics,
+			...buildUnresolvedDiagnostics(params.commandName, analyzed.unresolved, params.mode)
+		]),
+		targetStatesByPath,
+		hadUnresolvedTargets: analyzed.unresolved.length > 0
+	};
+}
+function buildTargetStatesByPath(params) {
+	const states = {};
+	for (const assignment of params.analyzed.assignments) states[assignment.path] = params.resolvedState;
+	for (const entry of params.analyzed.inactive) states[entry.path] = "inactive_surface";
+	for (const entry of params.analyzed.unresolved) states[entry.path] = "unresolved";
+	return states;
+}
+function buildUnresolvedDiagnostics(commandName, unresolved, mode) {
+	if (enforcesResolvedSecrets(mode)) return [];
+	return unresolved.map((entry) => `${commandName}: ${entry.path} is unavailable in this command path; continuing with degraded read-only config.`);
+}
+function scrubUnresolvedAssignments(config, unresolved) {
+	for (const entry of unresolved) setPathExistingStrict(config, entry.pathSegments, void 0);
+}
+function filterInactiveSurfaceDiagnostics(params) {
+	return params.diagnostics.filter((entry) => {
+		const markerIndex = entry.indexOf(": secret ref is configured on an inactive surface;");
+		if (markerIndex <= 0) return true;
+		const path = entry.slice(0, markerIndex).trim();
+		return !params.inactiveRefPaths.has(path);
+	});
+}
+async function resolveTargetSecretLocally(params) {
+	const defaults = params.sourceConfig.secrets?.defaults;
+	const { ref } = resolveSecretInputRef({
+		value: params.target.value,
+		refValue: params.target.refValue,
+		defaults
+	});
+	if (!ref || params.inactiveRefPaths.has(params.target.path) || !params.activePaths.has(params.target.path) && !params.runtimeWebActivePaths.has(params.target.path)) return;
+	try {
+		const resolved = await resolveSecretRefValue(ref, {
+			config: params.sourceConfig,
+			env: params.env,
+			cache: params.cache
+		});
+		assertExpectedResolvedSecretValue({
+			value: resolved,
+			expected: params.target.entry.expectedResolvedValue,
+			errorMessage: params.target.entry.expectedResolvedValue === "string" ? `${params.target.path} resolved to a non-string or empty value.` : `${params.target.path} resolved to an unsupported value type.`
+		});
+		setPathExistingStrict(params.resolvedConfig, params.target.pathSegments, resolved);
+	} catch (error) {
+		if (!enforcesResolvedSecrets(params.mode)) params.localResolutionDiagnostics.push(`${params.commandName}: failed to resolve ${params.target.path} locally (${formatErrorMessage(error)}).`);
+	}
+}
+async function resolveCommandSecretRefsViaGateway(params) {
+	const mode = normalizeCommandSecretResolutionMode(params.mode);
+	const configuredTargetRefPaths = collectConfiguredTargetRefPaths({
+		config: params.config,
+		targetIds: params.targetIds,
+		allowedPaths: params.allowedPaths
+	});
+	if (configuredTargetRefPaths.size === 0) return {
+		resolvedConfig: params.config,
+		diagnostics: [],
+		targetStatesByPath: {},
+		hadUnresolvedTargets: false
+	};
+	const preflight = classifyConfiguredTargetRefs({
+		config: params.config,
+		configuredTargetRefPaths
+	});
+	if (!preflight.hasActiveConfiguredRef && !preflight.hasUnknownConfiguredRef) return {
+		resolvedConfig: params.config,
+		diagnostics: preflight.diagnostics,
+		targetStatesByPath: {},
+		hadUnresolvedTargets: false
+	};
+	let payload;
+	try {
+		payload = await callGateway({
+			config: params.config,
+			method: "secrets.resolve",
+			requiredMethods: ["secrets.resolve"],
+			params: {
+				commandName: params.commandName,
+				targetIds: [...params.targetIds]
+			},
+			timeoutMs: 3e4,
+			clientName: GATEWAY_CLIENT_NAMES.CLI,
+			mode: GATEWAY_CLIENT_MODES.CLI
+		});
+	} catch (err) {
+		try {
+			const fallback = await resolveCommandSecretRefsLocally({
+				config: params.config,
+				commandName: params.commandName,
+				targetIds: params.targetIds,
+				preflightDiagnostics: preflight.diagnostics,
+				mode,
+				allowedPaths: params.allowedPaths
+			});
+			const fallbackMessage = Object.values(fallback.targetStatesByPath).some((state) => state === "resolved_local") && !fallback.hadUnresolvedTargets ? "resolved command secrets locally." : "attempted local command-secret resolution.";
+			return {
+				resolvedConfig: fallback.resolvedConfig,
+				diagnostics: dedupeDiagnostics([...fallback.diagnostics, `${params.commandName}: gateway secrets.resolve unavailable (${formatErrorMessage(err)}); ${fallbackMessage}`]),
+				targetStatesByPath: fallback.targetStatesByPath,
+				hadUnresolvedTargets: fallback.hadUnresolvedTargets
+			};
+		} catch {}
+		if (isUnsupportedSecretsResolveError(err)) throw new Error(`${params.commandName}: active gateway does not support secrets.resolve (${formatErrorMessage(err)}). Update the gateway or run without SecretRefs.`, { cause: err });
+		throw new Error(`${params.commandName}: failed to resolve secrets from the active gateway snapshot (${formatErrorMessage(err)}). Start the gateway and retry.`, { cause: err });
+	}
+	const parsed = parseGatewaySecretsResolveResult(payload);
+	const resolvedConfig = structuredClone(params.config);
+	for (const assignment of parsed.assignments) {
+		const pathSegments = assignment.pathSegments.filter((segment) => segment.length > 0);
+		if (pathSegments.length === 0) continue;
+		try {
+			setPathExistingStrict(resolvedConfig, pathSegments, assignment.value);
+		} catch (err) {
+			const path = pathSegments.join(".");
+			throw new Error(`${params.commandName}: failed to apply resolved secret assignment at ${path} (${formatErrorMessage(err)}).`, { cause: err });
+		}
+	}
+	const inactiveRefPaths = parsed.inactiveRefPaths.length > 0 ? new Set(parsed.inactiveRefPaths) : collectInactiveSurfacePathsFromDiagnostics(parsed.diagnostics);
+	const analyzed = commandSecretGatewayDeps.analyzeCommandSecretAssignmentsFromSnapshot({
+		sourceConfig: params.config,
+		resolvedConfig,
+		targetIds: params.targetIds,
+		inactiveRefPaths,
+		allowedPaths: params.allowedPaths
+	});
+	let diagnostics = dedupeDiagnostics(parsed.diagnostics);
+	const targetStatesByPath = buildTargetStatesByPath({
+		analyzed,
+		resolvedState: "resolved_gateway"
+	});
+	if (analyzed.unresolved.length > 0) try {
+		const localFallback = await resolveCommandSecretRefsLocally({
+			config: params.config,
+			commandName: params.commandName,
+			targetIds: params.targetIds,
+			preflightDiagnostics: [],
+			mode,
+			allowedPaths: new Set(analyzed.unresolved.map((entry) => entry.path))
+		});
+		for (const unresolved of analyzed.unresolved) {
+			if (localFallback.targetStatesByPath[unresolved.path] !== "resolved_local") continue;
+			setPathExistingStrict(resolvedConfig, unresolved.pathSegments, getPath(localFallback.resolvedConfig, unresolved.pathSegments));
+			targetStatesByPath[unresolved.path] = "resolved_local";
+		}
+		const recoveredPaths = new Set(Object.entries(localFallback.targetStatesByPath).filter(([, state]) => state === "resolved_local").map(([path]) => path));
+		const stillUnresolved = analyzed.unresolved.filter((entry) => !recoveredPaths.has(entry.path));
+		if (stillUnresolved.length > 0) {
+			if (enforcesResolvedSecrets(mode)) throw new Error(`${params.commandName}: ${stillUnresolved[0]?.path ?? "target"} is unresolved in the active runtime snapshot.`);
+			scrubUnresolvedAssignments(resolvedConfig, stillUnresolved);
+			diagnostics = dedupeDiagnostics([
+				...diagnostics,
+				...localFallback.diagnostics,
+				...buildUnresolvedDiagnostics(params.commandName, stillUnresolved, mode)
+			]);
+			for (const unresolved of stillUnresolved) targetStatesByPath[unresolved.path] = "unresolved";
+		} else if (recoveredPaths.size > 0) diagnostics = dedupeDiagnostics([...diagnostics, `${params.commandName}: resolved ${recoveredPaths.size} secret ${recoveredPaths.size === 1 ? "path" : "paths"} locally after the gateway snapshot was incomplete.`]);
+	} catch (error) {
+		if (enforcesResolvedSecrets(mode)) throw error;
+		scrubUnresolvedAssignments(resolvedConfig, analyzed.unresolved);
+		diagnostics = dedupeDiagnostics([
+			...diagnostics,
+			`${params.commandName}: local fallback after incomplete gateway snapshot failed (${formatErrorMessage(error)}).`,
+			...buildUnresolvedDiagnostics(params.commandName, analyzed.unresolved, mode)
+		]);
+	}
+	return {
+		resolvedConfig,
+		diagnostics,
+		targetStatesByPath,
+		hadUnresolvedTargets: Object.values(targetStatesByPath).includes("unresolved")
+	};
+}
+//#endregion
+export { collectCommandSecretAssignmentsFromSnapshot as n, resolveCommandSecretRefsViaGateway as t };

package/dist/command-status.runtime-5QfAs_4U.js

@@ -0,0 +1,87 @@
+import { h as listAgentEntries, p as resolveSessionAgentId } from "./agent-scope-Duyu_T59.js";
+import { o as resolveDefaultModelForAgent } from "./model-selection-Le6XU3cD.js";
+import { a as loadSessionEntry } from "./session-utils-B_-Qo0jX.js";
+import { t as resolveDefaultModel } from "./directive-handling.defaults-DcnYJMbx.js";
+import { n as createModelSelectionState } from "./model-selection-C2NxhW2U.js";
+import { t as buildStatusReply } from "./commands-status-BfvtgMfw.js";
+import { t as resolveCurrentDirectiveLevels } from "./directive-handling.levels-CdEAHITp.js";
+//#region src/plugin-sdk/command-status.runtime.ts
+async function resolveDirectStatusReplyForSession(params) {
+	const requestedSessionKey = params.sessionKey.trim();
+	if (!requestedSessionKey) return;
+	const statusLoaded = loadSessionEntry(requestedSessionKey);
+	const statusCfg = statusLoaded.cfg ?? params.cfg;
+	const statusSessionKey = statusLoaded.canonicalKey;
+	const statusEntry = statusLoaded.entry;
+	const statusAgentId = resolveSessionAgentId({
+		sessionKey: statusSessionKey,
+		config: statusCfg
+	});
+	const agentCfg = statusCfg.agents?.defaults;
+	const agentEntry = listAgentEntries(statusCfg).find((entry) => entry.id?.trim().toLowerCase() === statusAgentId);
+	const statusModel = resolveDefaultModelForAgent({
+		cfg: statusCfg,
+		agentId: statusAgentId
+	});
+	const { defaultProvider, defaultModel } = resolveDefaultModel({
+		cfg: statusCfg,
+		agentId: statusAgentId
+	});
+	const selectedProvider = statusEntry?.providerOverride?.trim() || statusEntry?.modelProvider?.trim() || statusModel.provider;
+	const selectedModel = statusEntry?.modelOverride?.trim() || statusEntry?.model?.trim() || statusModel.model;
+	const modelState = await createModelSelectionState({
+		cfg: statusCfg,
+		agentId: statusAgentId,
+		agentCfg,
+		sessionEntry: statusEntry,
+		sessionStore: statusLoaded.store,
+		sessionKey: statusSessionKey,
+		parentSessionKey: statusEntry?.parentSessionKey,
+		storePath: statusLoaded.storePath,
+		defaultProvider,
+		defaultModel,
+		provider: selectedProvider,
+		model: selectedModel,
+		hasModelDirective: false
+	});
+	const { currentThinkLevel, currentFastMode, currentVerboseLevel, currentReasoningLevel, currentElevatedLevel } = await resolveCurrentDirectiveLevels({
+		sessionEntry: statusEntry,
+		agentEntry,
+		agentCfg,
+		resolveDefaultThinkingLevel: () => modelState.resolveDefaultThinkingLevel()
+	});
+	let resolvedReasoningLevel = currentReasoningLevel;
+	const hasAgentReasoningDefault = agentEntry?.reasoningDefault !== void 0 && agentEntry.reasoningDefault !== null;
+	if (!(statusEntry?.reasoningLevel !== void 0 && statusEntry.reasoningLevel !== null || hasAgentReasoningDefault) && resolvedReasoningLevel === "off" && currentThinkLevel === "off") resolvedReasoningLevel = await modelState.resolveDefaultReasoningLevel();
+	return await buildStatusReply({
+		cfg: statusCfg,
+		command: {
+			surface: params.channel,
+			channel: params.channel,
+			ownerList: [],
+			senderIsOwner: params.senderIsOwner,
+			isAuthorizedSender: params.isAuthorizedSender,
+			senderId: params.senderId,
+			rawBodyNormalized: "/status",
+			commandBodyNormalized: "/status"
+		},
+		sessionEntry: statusEntry,
+		sessionKey: statusSessionKey,
+		parentSessionKey: statusEntry?.parentSessionKey,
+		sessionScope: statusCfg.session?.scope,
+		storePath: statusLoaded.storePath,
+		provider: selectedProvider,
+		model: selectedModel,
+		contextTokens: statusEntry?.contextTokens ?? 0,
+		resolvedThinkLevel: currentThinkLevel,
+		resolvedFastMode: currentFastMode,
+		resolvedVerboseLevel: currentVerboseLevel ?? "off",
+		resolvedReasoningLevel,
+		resolvedElevatedLevel: currentElevatedLevel,
+		resolveDefaultThinkingLevel: () => modelState.resolveDefaultThinkingLevel(),
+		isGroup: params.isGroup,
+		defaultGroupActivation: params.defaultGroupActivation
+	});
+}
+//#endregion
+export { resolveDirectStatusReplyForSession };

package/dist/command-status.runtime.js

@@ -1 +1 @@
-export * from "./command-status.runtime-BlV8RkuN.js";
+export * from "./command-status.runtime-5QfAs_4U.js";