@qduc/term2 0.14.0 → 0.16.0

package/dist/gateway/server.js

@@ -0,0 +1,214 @@
+import { createServer } from 'node:http';
+import { createServer as createHttpsServer } from 'node:https';
+import { dirname } from 'node:path';
+import { chmod, mkdir, unlink } from 'node:fs/promises';
+import { readFileSync } from 'node:fs';
+import { GatewayLifecycle } from './lifecycle.js';
+const MAX_REQUEST_BYTES = 1024 * 1024;
+export const GATEWAY_EVENT_STREAM_CONTENT_TYPE = 'text/event-stream';
+export const GATEWAY_EVENT_HEARTBEAT_INTERVAL_MS = 15_000;
+export const GATEWAY_EVENT_STREAM_HEARTBEAT = ': heartbeat';
+const CORRELATION_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/;
+/** Private Unix-socket or TLS network control server. */
+export class GatewayServer {
+    #socketPath;
+    #host;
+    #port;
+    #tls;
+    #verifier;
+    #handler;
+    #pairingHandler;
+    #pairingEnabled;
+    #lifecycle;
+    #server;
+    constructor(options) {
+        if ('socketPath' in options) {
+            if (!options.socketPath || !options.socketPath.startsWith('/'))
+                throw new Error('gateway requires an absolute Unix socket path');
+            this.#socketPath = options.socketPath;
+        }
+        else {
+            if (!Number.isSafeInteger(options.port) || options.port < 0 || options.port > 65_535)
+                throw new Error('gateway requires a valid network port');
+            this.#host = options.host?.trim() || '127.0.0.1';
+            const tls = options.tls;
+            if (!tls.certPath || !tls.keyPath || typeof tls.requireClientCert !== 'boolean')
+                throw new Error('gateway requires TLS certificate configuration');
+            this.#port = options.port;
+            this.#tls = {
+                cert: readFileSync(tls.certPath),
+                key: readFileSync(tls.keyPath),
+                ...(tls.caPath ? { ca: readFileSync(tls.caPath) } : {}),
+                requireClientCert: tls.requireClientCert,
+            };
+        }
+        this.#verifier = options.verifier;
+        this.#handler = options.handler;
+        this.#pairingHandler = options.pairingHandler;
+        this.#pairingEnabled = options.pairingHandler !== undefined;
+        this.#lifecycle = options.lifecycle ?? new GatewayLifecycle();
+    }
+    get lifecycle() {
+        return this.#lifecycle;
+    }
+    get listening() {
+        return this.#server?.listening === true;
+    }
+    get address() {
+        return this.#server?.address() ?? null;
+    }
+    async start() {
+        if (this.#server)
+            return;
+        if (this.#socketPath) {
+            await mkdir(dirname(this.#socketPath), { recursive: true });
+            await unlink(this.#socketPath).catch(() => undefined);
+            this.#server = createServer((request, response) => void this.#handle(request, response));
+        }
+        else {
+            const tls = this.#tls;
+            this.#server = createHttpsServer({
+                cert: tls.cert,
+                key: tls.key,
+                ...(tls.ca ? { ca: tls.ca } : {}),
+                requestCert: tls.requireClientCert,
+                rejectUnauthorized: tls.requireClientCert,
+            }, (request, response) => void this.#handle(request, response));
+        }
+        await new Promise((resolve, reject) => {
+            this.#server.once('error', reject);
+            const onListening = () => {
+                this.#server.removeListener('error', reject);
+                if (this.#socketPath)
+                    void chmod(this.#socketPath, 0o660).then(resolve, reject);
+                else
+                    resolve();
+            };
+            if (this.#socketPath)
+                this.#server.listen(this.#socketPath, onListening);
+            else
+                this.#server.listen(this.#port, this.#host, onListening);
+        });
+    }
+    async close() {
+        if (!this.#server)
+            return;
+        const server = this.#server;
+        this.#server = undefined;
+        await new Promise((resolve) => server.close(() => resolve()));
+        if (this.#socketPath)
+            await unlink(this.#socketPath).catch(() => undefined);
+    }
+    async shutdown(graceMs) {
+        await this.close();
+        await this.#lifecycle.shutdown(graceMs);
+    }
+    async #handle(request, response) {
+        const requestUrl = new URL(request.url ?? '/', 'http://gateway');
+        if (request.method === 'POST' && requestUrl.pathname === '/private/agent/v1/pairing/register') {
+            if (!this.#pairingHandler)
+                return send(response, 404, errorBody('not_found', 'gateway route not found'));
+            return this.#handlePairing(request, response, requestUrl);
+        }
+        const token = request.headers['x-term2-assertion'];
+        if (typeof token !== 'string')
+            return send(response, 401, errorBody(this.#pairingEnabled ? 'pairing_required' : 'authentication_required', 'gateway assertion required'));
+        let claims;
+        try {
+            claims = this.#verifier.verify(token);
+        }
+        catch {
+            return send(response, 401, errorBody(this.#pairingEnabled ? 'pairing_required' : 'authentication_required', 'gateway assertion rejected'));
+        }
+        const correlationHeader = request.headers['x-correlation-id'];
+        if (correlationHeader !== undefined &&
+            (typeof correlationHeader !== 'string' || !CORRELATION_ID_PATTERN.test(correlationHeader)))
+            return send(response, 400, errorBody('validation_error', 'correlation ID is invalid'));
+        if (request.method !== 'GET' &&
+            request.method !== 'POST' &&
+            request.method !== 'PUT' &&
+            request.method !== 'DELETE')
+            return send(response, 405, errorBody('protocol_conflict', 'gateway method is not supported'));
+        if (request.method !== 'GET' &&
+            request.headers['content-type'] &&
+            !String(request.headers['content-type']).toLowerCase().startsWith('application/json'))
+            return send(response, 415, errorBody('unsupported_media_type', 'gateway expects JSON'));
+        let body = '';
+        if (request.method !== 'GET') {
+            for await (const chunk of request) {
+                body += String(chunk);
+                if (Buffer.byteLength(body) > MAX_REQUEST_BYTES)
+                    return send(response, 413, errorBody('request_too_large', 'gateway request is too large'));
+            }
+        }
+        let parsed = null;
+        try {
+            parsed = body ? JSON.parse(body) : null;
+        }
+        catch {
+            return send(response, 400, errorBody('validation_error', 'gateway request is invalid'));
+        }
+        try {
+            const result = await this.#handler({
+                claims,
+                body: parsed,
+                request,
+                url: requestUrl,
+                ...(typeof correlationHeader === 'string' ? { correlationId: correlationHeader } : {}),
+            });
+            if (result.stream) {
+                response.writeHead(result.status, result.headers);
+                await result.stream.start(response, request);
+                return;
+            }
+            send(response, result.status, result.body, result.headers);
+        }
+        catch {
+            if (!response.headersSent)
+                send(response, 503, errorBody('gateway_unavailable', 'gateway unavailable', true));
+            else
+                response.end();
+        }
+    }
+    async #handlePairing(request, response, url) {
+        if (request.headers['content-type'] &&
+            !String(request.headers['content-type']).toLowerCase().startsWith('application/json'))
+            return send(response, 415, errorBody('unsupported_media_type', 'gateway expects JSON'));
+        let body = '';
+        try {
+            for await (const chunk of request) {
+                body += String(chunk);
+                if (Buffer.byteLength(body) > MAX_REQUEST_BYTES)
+                    return send(response, 413, errorBody('request_too_large', 'gateway request is too large'));
+            }
+        }
+        catch {
+            return send(response, 400, errorBody('validation_error', 'gateway request is invalid'));
+        }
+        let parsed = null;
+        try {
+            parsed = body ? JSON.parse(body) : null;
+        }
+        catch {
+            return send(response, 400, errorBody('validation_error', 'gateway request is invalid'));
+        }
+        try {
+            const result = await this.#pairingHandler({ body: parsed, request, url });
+            send(response, result.status, result.body, result.headers);
+        }
+        catch {
+            send(response, 503, errorBody('gateway_unavailable', 'gateway unavailable', true));
+        }
+    }
+}
+function errorBody(code, message, retryable) {
+    return { error: { code, message, ...(retryable === undefined ? {} : { retryable }) } };
+}
+function send(response, status, body, headers) {
+    response.statusCode = status;
+    response.setHeader('content-type', 'application/json');
+    for (const [key, value] of Object.entries(headers ?? {}))
+        response.setHeader(key, value);
+    response.end(JSON.stringify(body));
+}
+//# sourceMappingURL=server.js.map

package/dist/gateway/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../source/gateway/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,YAAY,IAAI,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAIvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AACtC,MAAM,CAAC,MAAM,iCAAiC,GAAG,mBAAmB,CAAC;AACrE,MAAM,CAAC,MAAM,mCAAmC,GAAG,MAAM,CAAC;AAC1D,MAAM,CAAC,MAAM,8BAA8B,GAAG,aAAa,CAAC;AAC5D,MAAM,sBAAsB,GAAG,sCAAsC,CAAC;AA6CtE,yDAAyD;AACzD,MAAM,OAAO,aAAa;IACf,WAAW,CAAU;IACrB,KAAK,CAAU;IACf,KAAK,CAAU;IACf,IAAI,CAA0E;IAC9E,SAAS,CAAoB;IAC7B,QAAQ,CAAoB;IAC5B,eAAe,CAAyB;IACxC,eAAe,CAAU;IACzB,UAAU,CAAmB;IACtC,OAAO,CAAU;IAEjB,YAAY,OAA6B;QACvC,IAAI,YAAY,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;gBAC5D,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,MAAM;gBAClF,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,WAAW,CAAC;YACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,SAAS;gBAC7E,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,IAAI,GAAG;gBACV,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAChC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;gBAC9B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;aACzC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC;QAC5D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,gBAAgB,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,KAAK,IAAI,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3F,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,IAAI,CAAC,IAAK,CAAC;YACvB,IAAI,CAAC,OAAO,GAAG,iBAAiB,CAC9B;gBACE,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,WAAW,EAAE,GAAG,CAAC,iBAAiB;gBAClC,kBAAkB,EAAE,GAAG,CAAC,iBAAiB;aAC1C,EACD,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAC5D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,OAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM,WAAW,GAAG,GAAG,EAAE;gBACvB,IAAI,CAAC,OAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC9C,IAAI,IAAI,CAAC,WAAW;oBAAE,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;;oBAC3E,OAAO,EAAE,CAAC;YACjB,CAAC,CAAC;YACF,IAAI,IAAI,CAAC,WAAW;gBAAE,IAAI,CAAC,OAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;;gBACrE,IAAI,CAAC,OAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAM,EAAE,IAAI,CAAC,KAAM,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAwB,EAAE,QAAwB;QAC9D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,QAAQ,KAAK,oCAAoC,EAAE,CAAC;YAC9F,IAAI,CAAC,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;YACzG,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAC3B,OAAO,IAAI,CACT,QAAQ,EACR,GAAG,EACH,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,yBAAyB,EAAE,4BAA4B,CAAC,CAC/G,CAAC;QACJ,IAAI,MAA8B,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CACT,QAAQ,EACR,GAAG,EACH,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,yBAAyB,EAAE,4BAA4B,CAAC,CAC/G,CAAC;QACJ,CAAC;QACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC9D,IACE,iBAAiB,KAAK,SAAS;YAC/B,CAAC,OAAO,iBAAiB,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAE1F,OAAO,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,kBAAkB,EAAE,2BAA2B,CAAC,CAAC,CAAC;QACzF,IACE,OAAO,CAAC,MAAM,KAAK,KAAK;YACxB,OAAO,CAAC,MAAM,KAAK,MAAM;YACzB,OAAO,CAAC,MAAM,KAAK,KAAK;YACxB,OAAO,CAAC,MAAM,KAAK,QAAQ;YAE3B,OAAO,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,mBAAmB,EAAE,iCAAiC,CAAC,CAAC,CAAC;QAChG,IACE,OAAO,CAAC,MAAM,KAAK,KAAK;YACxB,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;YAC/B,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC;YAErF,OAAO,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC1F,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAClC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;gBACtB,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,iBAAiB;oBAC7C,OAAO,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;QACD,IAAI,MAAM,GAAY,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;gBACjC,MAAM;gBACN,IAAI,EAAE,MAAM;gBACZ,OAAO;gBACP,GAAG,EAAE,UAAU;gBACf,GAAG,CAAC,OAAO,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvF,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,WAAW;gBAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC,CAAC;;gBACzG,QAAQ,CAAC,GAAG,EAAE,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAwB,EAAE,QAAwB,EAAE,GAAQ;QAC/E,IACE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;YAC/B,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC;YAErF,OAAO,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC1F,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAClC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;gBACtB,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,iBAAiB;oBAC7C,OAAO,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,MAAM,GAAY,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;CACF;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe,EAAE,SAAmB;IACnE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,IAAI,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa,EAAE,OAAgC;IACrG,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC"}

package/dist/gateway/settings-rpc.d.ts

@@ -0,0 +1,95 @@
+import type { ISettingsService } from '../services/service-interfaces.js';
+export declare const SAFE_SETTINGS_KEYS: readonly ['agent.model', 'agent.provider', 'agent.reasoningEffort', 'agent.temperature', 'agent.maxTurns', 'agent.maxOutputTokens', 'agent.maxStreamOutputChars', 'agent.maxModelRequestDurationMs', 'agent.retryAttempts', 'agent.maxParallelToolCalls', 'agent.contextCompaction.enabled', 'agent.contextCompaction.threshold', 'app.mentorMode', 'app.liteMode', 'app.planMode', 'app.orchestratorMode', 'webSearch.provider', 'memory.enabled', 'logging.logLevel', 'shell.timeout', 'shell.maxOutputLines', 'shell.maxOutputChars'];
+/**
+ * The browser may inspect the full safe-default projection, but it may only
+ * persist this deliberately tiny global surface.  Session policy belongs to
+ * session_update; it must never be smuggled through the launcher-wide
+ * settings authority.
+ */
+export declare const PERSISTENT_SETTINGS_KEYS: readonly ['logging.logLevel'];
+export type SafeSettingsKey = (typeof SAFE_SETTINGS_KEYS)[number];
+export type CredentialSource = 'setting' | 'stored' | 'environment' | 'token-file' | 'local' | 'external' | 'missing';
+export type SecretFreeCredential = {
+    configured: boolean;
+    required: boolean;
+    source: CredentialSource;
+    writable: boolean;
+};
+export type SettingsProjection = {
+    schemaVersion: 1;
+    revision: string;
+    defaultsRevision: string;
+    settings: {
+        safeDefaults: Record<string, {
+            value?: string | number | boolean | string[] | null;
+            source: string;
+            scope: 'global' | 'session';
+            confirmRequired: boolean;
+            /** Whether the browser may persist this key (PERSISTENT_SETTINGS_KEYS). */
+            persistable: boolean;
+        }>;
+        credentials: Record<string, SecretFreeCredential>;
+        providers: Array<{
+            id: string;
+            label: string;
+            isCustom: boolean;
+            active: boolean;
+            credential: SecretFreeCredential;
+        }>;
+        oauthAccounts: Record<string, Array<{
+            id: string;
+            label: string;
+            isSelected: boolean;
+            isInUse: boolean;
+        }>>;
+        safety: {
+            sandbox: 'enabled' | 'disabled' | 'unavailable';
+            approval: 'off' | 'advisory' | 'auto' | 'unsafe-active' | 'hidden';
+            backgroundShell: 'disabled-by-gateway';
+            workspaceAccess: 'read' | 'read_write';
+            network: 'denied' | 'configured' | 'confirmation-required';
+        };
+    };
+};
+export type SettingsAuthority = ISettingsService & {
+    getSource?: (key: string) => string;
+    setPersistentDynamic?: (key: string, value: unknown) => unknown;
+    setPersistentDynamicTransaction?: (changes: readonly {
+        key: string;
+        value: unknown;
+    }[]) => {
+        status?: string;
+    } | undefined;
+    reset?: (key?: string) => unknown;
+};
+export declare class SettingsRpcError extends Error {
+    readonly code: 'settings_unavailable' | 'settings_conflict' | 'settings_not_allowed' | 'not_persisted';
+    readonly details?: {
+        currentRevision?: string;
+        projection?: SettingsProjection;
+    };
+    constructor(code: SettingsRpcError['code'], details?: SettingsRpcError['details']);
+}
+export declare function isSafeSettingsKey(key: string): key is SafeSettingsKey;
+export declare function isPersistentSettingsKey(key: string): boolean;
+export declare function buildSettingsProjection(settings: SettingsAuthority, workspaceAccess?: 'read' | 'read_write'): SettingsProjection;
+export declare function applySettingsChanges(settings: SettingsAuthority, expectedRevision: string, changes: readonly {
+    key: string;
+    value: unknown;
+}[]): SettingsProjection;
+export declare function setCredential(settings: SettingsAuthority, credentialId: string, value: string): {
+    status: 'saved';
+    configured: boolean;
+    source: CredentialSource;
+};
+export declare function deleteCredential(settings: SettingsAuthority, credentialId: string): {
+    status: 'deleted' | 'unchanged';
+    configured: boolean;
+    source?: 'environment';
+};
+export declare function credentialStatus(settings: SettingsAuthority, definition: {
+    settingKey: string;
+    providerId: string;
+    required: boolean;
+}): SecretFreeCredential;
+//# sourceMappingURL=settings-rpc.d.ts.map

package/dist/gateway/settings-rpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-rpc.d.ts","sourceRoot":"","sources":["../../source/gateway/settings-rpc.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAK1E,eAAO,MAAM,kBAAkB,YAC7B,aAAa,EACb,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,4BAA4B,EAC5B,iCAAiC,EACjC,qBAAqB,EACrB,4BAA4B,EAC5B,iCAAiC,EACjC,mCAAmC,EACnC,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,sBAAsB,EACtB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,sBAAsB,CACd,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,YAAI,kBAAkB,CAAU,CAAC;AAEtE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AACtH,MAAM,MAAM,oBAAoB,GAAG;IACjC,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AACF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,aAAa,EAAE,CAAC,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE;QACR,YAAY,EAAE,MAAM,CAClB,MAAM,EACN;YACE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;YACpD,MAAM,EAAE,MAAM,CAAC;YACf,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;YAC5B,eAAe,EAAE,OAAO,CAAC;YACzB,2EAA2E;YAC3E,WAAW,EAAE,OAAO,CAAC;SACtB,CACF,CAAC;QACF,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;QAClD,SAAS,EAAE,KAAK,CAAC;YACf,EAAE,EAAE,MAAM,CAAC;YACX,KAAK,EAAE,MAAM,CAAC;YACd,QAAQ,EAAE,OAAO,CAAC;YAClB,MAAM,EAAE,OAAO,CAAC;YAChB,UAAU,EAAE,oBAAoB,CAAC;SAClC,CAAC,CAAC;QACH,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,OAAO,CAAC;YAAC,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC,CAAC;QAC3G,MAAM,EAAE;YACN,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,aAAa,CAAC;YAChD,QAAQ,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,eAAe,GAAG,QAAQ,CAAC;YACnE,eAAe,EAAE,qBAAqB,CAAC;YACvC,eAAe,EAAE,MAAM,GAAG,YAAY,CAAC;YACvC,OAAO,EAAE,QAAQ,GAAG,YAAY,GAAG,uBAAuB,CAAC;SAC5D,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG;IACjD,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAChE,+BAA+B,CAAC,EAAE,CAChC,OAAO,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,EAAE,KAChD;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACrC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;CACnC,CAAC;AAEF,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,GAAG,mBAAmB,GAAG,sBAAsB,GAAG,eAAe,CAAC;IACvG,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAAE,CAAC;IACjF,YAAY,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB,CAAC,SAAS,CAAC,EAKhF;CACF;AASD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,IAAI,eAAe,CAErE;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,iBAAiB,EAC3B,eAAe,GAAE,MAAM,GAAG,YAAqB,GAC9C,kBAAkB,CAkEpB;AAED,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,iBAAiB,EAC3B,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,SAAS;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,EAAE,GAClD,kBAAkB,CAiBpB;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAUpE;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,EAAE,MAAM,GACnB;IAAE,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAAE,CAQlF;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,iBAAiB,EAC3B,UAAU,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GACxE,oBAAoB,CAqBtB"}

package/dist/gateway/settings-rpc.js

@@ -0,0 +1,227 @@
+import crypto from 'node:crypto';
+import { loadProviderItems } from '../providers/provider-service.js';
+import { resolveProviderCredentials } from '../utils/ai/provider-credentials.js';
+import { listOAuthAccounts } from '../providers/oauth-accounts.js';
+export const SAFE_SETTINGS_KEYS = [
+    'agent.model',
+    'agent.provider',
+    'agent.reasoningEffort',
+    'agent.temperature',
+    'agent.maxTurns',
+    'agent.maxOutputTokens',
+    'agent.maxStreamOutputChars',
+    'agent.maxModelRequestDurationMs',
+    'agent.retryAttempts',
+    'agent.maxParallelToolCalls',
+    'agent.contextCompaction.enabled',
+    'agent.contextCompaction.threshold',
+    'app.mentorMode',
+    'app.liteMode',
+    'app.planMode',
+    'app.orchestratorMode',
+    'webSearch.provider',
+    'memory.enabled',
+    'logging.logLevel',
+    'shell.timeout',
+    'shell.maxOutputLines',
+    'shell.maxOutputChars',
+];
+/**
+ * The browser may inspect the full safe-default projection, but it may only
+ * persist this deliberately tiny global surface.  Session policy belongs to
+ * session_update; it must never be smuggled through the launcher-wide
+ * settings authority.
+ */
+export const PERSISTENT_SETTINGS_KEYS = ['logging.logLevel'];
+export class SettingsRpcError extends Error {
+    code;
+    details;
+    constructor(code, details) {
+        super('settings RPC rejected the request');
+        this.name = 'SettingsRpcError';
+        this.code = code;
+        this.details = details;
+    }
+}
+const CREDENTIALS = {
+    openai: { settingKey: 'agent.openai.apiKey', providerId: 'openai', required: true },
+    openrouter: { settingKey: 'agent.openrouter.apiKey', providerId: 'openrouter', required: true },
+    tavily: { settingKey: 'webSearch.tavily.apiKey', providerId: 'tavily', required: true },
+    exa: { settingKey: 'webSearch.exa.apiKey', providerId: 'exa', required: true },
+};
+export function isSafeSettingsKey(key) {
+    return SAFE_SETTINGS_KEYS.includes(key);
+}
+export function isPersistentSettingsKey(key) {
+    return PERSISTENT_SETTINGS_KEYS.includes(key);
+}
+export function buildSettingsProjection(settings, workspaceAccess = 'read') {
+    const safeDefaults = {};
+    for (const key of SAFE_SETTINGS_KEYS) {
+        const actualKey = key === 'agent.contextCompaction.threshold' ? 'agent.contextCompaction.compactThreshold' : key;
+        const value = settings.getDynamic(actualKey);
+        const safeValue = asSafeSettingValue(value);
+        const source = settings.getSource?.(actualKey) ?? 'default';
+        safeDefaults[key] = {
+            ...(safeValue === undefined ? {} : { value: safeValue }),
+            source,
+            scope: sessionScopedKey(key) ? 'session' : 'global',
+            confirmRequired: key.startsWith('shell.') || key === 'agent.maxParallelToolCalls',
+            persistable: isPersistentSettingsKey(key),
+        };
+    }
+    const credentials = {};
+    for (const [id, definition] of Object.entries(CREDENTIALS)) {
+        credentials[id] = credentialStatus(settings, definition);
+    }
+    let providers = [];
+    try {
+        providers = loadProviderItems(settings).map((provider) => ({
+            id: provider.id,
+            label: provider.label,
+            isCustom: provider.isCustom,
+            active: provider.isActive,
+            credential: providerCredentialStatus(settings, provider.id),
+        }));
+    }
+    catch {
+        providers = [];
+    }
+    const oauthAccounts = {};
+    for (const provider of ['codex', 'grok']) {
+        try {
+            oauthAccounts[provider] = listOAuthAccounts(provider);
+        }
+        catch {
+            oauthAccounts[provider] = [];
+        }
+    }
+    const approval = settings.getDynamic('shell.autoApproveMode');
+    const sandboxEnabled = settings.getDynamic('sandbox.enabled') === true;
+    const allowNetworking = settings.getDynamic('sandbox.allowNetworking') === true;
+    const settingsOnly = {
+        safeDefaults,
+        credentials,
+        providers,
+        oauthAccounts,
+        safety: {
+            sandbox: sandboxEnabled ? 'enabled' : 'disabled',
+            approval: approval === 'always'
+                ? 'unsafe-active'
+                : approval === 'auto' || approval === 'advisory' || approval === 'off'
+                    ? approval
+                    : 'hidden',
+            backgroundShell: 'disabled-by-gateway',
+            workspaceAccess,
+            network: allowNetworking ? 'confirmation-required' : 'denied',
+        },
+    };
+    const revision = crypto.createHash('sha256').update(JSON.stringify(settingsOnly)).digest('hex');
+    return { schemaVersion: 1, revision, defaultsRevision: revision, settings: settingsOnly };
+}
+export function applySettingsChanges(settings, expectedRevision, changes) {
+    const current = buildSettingsProjection(settings);
+    if (current.revision !== expectedRevision)
+        throw new SettingsRpcError('settings_conflict', { currentRevision: current.revision, projection: current });
+    const normalized = changes.map((change) => {
+        if (!isSafeSettingsKey(change.key) || !isPersistentSettingsKey(change.key))
+            throw new SettingsRpcError('settings_not_allowed');
+        return {
+            key: change.key === 'agent.contextCompaction.threshold' ? 'agent.contextCompaction.compactThreshold' : change.key,
+            value: change.value,
+        };
+    });
+    const setter = settings.setPersistentDynamicTransaction;
+    if (!setter)
+        throw new SettingsRpcError('settings_unavailable');
+    const result = setter.call(settings, normalized);
+    if (result?.status !== 'saved')
+        throw new SettingsRpcError('not_persisted');
+    return buildSettingsProjection(settings);
+}
+export function setCredential(settings, credentialId, value) {
+    const definition = CREDENTIALS[credentialId];
+    if (!definition || !value)
+        throw new SettingsRpcError('settings_not_allowed');
+    const status = credentialStatus(settings, definition);
+    if (status.source === 'environment')
+        throw new SettingsRpcError('settings_not_allowed');
+    if (!settings.setPersistentDynamic)
+        throw new SettingsRpcError('settings_unavailable');
+    const result = settings.setPersistentDynamic(definition.settingKey, value);
+    if (result?.status !== 'saved')
+        throw new SettingsRpcError('not_persisted');
+    const next = credentialStatus(settings, definition);
+    return { status: 'saved', configured: next.configured, source: next.source };
+}
+export function deleteCredential(settings, credentialId) {
+    const definition = CREDENTIALS[credentialId];
+    if (!definition || !settings.reset)
+        throw new SettingsRpcError('settings_not_allowed');
+    const before = credentialStatus(settings, definition);
+    if (before.source === 'environment')
+        return { status: 'unchanged', configured: true, source: 'environment' };
+    const result = settings.reset(definition.settingKey);
+    if (result?.status !== 'saved')
+        throw new SettingsRpcError('not_persisted');
+    return { status: 'deleted', configured: false };
+}
+export function credentialStatus(settings, definition) {
+    if (isEnvironmentSource(settings.getSource?.(definition.settingKey))) {
+        return { configured: true, required: definition.required, source: 'environment', writable: false };
+    }
+    if (definition.providerId === 'tavily' || definition.providerId === 'exa') {
+        const value = settings.getDynamic(definition.settingKey);
+        const configured = typeof value === 'string' && value.trim().length > 0;
+        const source = isEnvironmentSource(settings.getSource?.(definition.settingKey))
+            ? 'environment'
+            : configured
+                ? 'setting'
+                : 'missing';
+        return { configured, required: definition.required, source, writable: source !== 'environment' };
+    }
+    const resolution = resolveProviderCredentials(settings, definition.providerId);
+    return {
+        configured: resolution.configured,
+        required: definition.required,
+        source: safeSource(resolution.source),
+        writable: resolution.source !== 'environment',
+    };
+}
+function providerCredentialStatus(settings, providerId) {
+    try {
+        const resolution = resolveProviderCredentials(settings, providerId);
+        return {
+            configured: resolution.configured,
+            required: resolution.required,
+            source: safeSource(resolution.source),
+            writable: resolution.source !== 'environment',
+        };
+    }
+    catch {
+        return { configured: false, required: false, source: 'missing', writable: false };
+    }
+}
+function safeSource(source) {
+    return source;
+}
+function isEnvironmentSource(source) {
+    return source === 'env' || source === 'environment';
+}
+function sessionScopedKey(key) {
+    return (key === 'agent.model' ||
+        key === 'agent.provider' ||
+        key === 'agent.reasoningEffort' ||
+        key === 'app.mentorMode' ||
+        key === 'app.liteMode' ||
+        key === 'app.planMode' ||
+        key === 'app.orchestratorMode');
+}
+function asSafeSettingValue(value) {
+    if (value === null || typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean')
+        return value;
+    if (Array.isArray(value) && value.every((item) => typeof item === 'string'))
+        return value;
+    return undefined;
+}
+//# sourceMappingURL=settings-rpc.js.map

package/dist/gateway/settings-rpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-rpc.js","sourceRoot":"","sources":["../../source/gateway/settings-rpc.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAqC,MAAM,qCAAqC,CAAC;AACpH,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,aAAa;IACb,gBAAgB;IAChB,uBAAuB;IACvB,mBAAmB;IACnB,gBAAgB;IAChB,uBAAuB;IACvB,4BAA4B;IAC5B,iCAAiC;IACjC,qBAAqB;IACrB,4BAA4B;IAC5B,iCAAiC;IACjC,mCAAmC;IACnC,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,sBAAsB;IACtB,oBAAoB;IACpB,gBAAgB;IAChB,kBAAkB;IAClB,eAAe;IACf,sBAAsB;IACtB,sBAAsB;CACd,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,kBAAkB,CAAU,CAAC;AAsDtE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAA0F;IAC9F,OAAO,CAAiE;IACjF,YAAY,IAA8B,EAAE,OAAqC;QAC/E,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,WAAW,GAAkF;IACjG,MAAM,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACnF,UAAU,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC/F,MAAM,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvF,GAAG,EAAE,EAAE,UAAU,EAAE,sBAAsB,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;CAC/E,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAQ,wBAA8C,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAA2B,EAC3B,eAAe,GAA0B,MAAM;IAE/C,MAAM,YAAY,GAAmD,EAAE,CAAC;IACxE,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,GAAG,KAAK,mCAAmC,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,GAAG,CAAC;QACjH,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;QAC5D,YAAY,CAAC,GAAG,CAAC,GAAG;YAClB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACxD,MAAM;YACN,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACnD,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,4BAA4B;YACjF,WAAW,EAAE,uBAAuB,CAAC,GAAG,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAyC,EAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3D,WAAW,CAAC,EAAE,CAAC,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,SAAS,GAAgD,EAAE,CAAC;IAChE,IAAI,CAAC;QACH,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACzD,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,QAAQ;YACzB,UAAU,EAAE,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;SAC5D,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,aAAa,GAAoD,EAAE,CAAC;IAC1E,KAAK,MAAM,QAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,CAAU,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,aAAa,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,IAAI,CAAC;IACvE,MAAM,eAAe,GAAG,QAAQ,CAAC,UAAU,CAAC,yBAAyB,CAAC,KAAK,IAAI,CAAC;IAChF,MAAM,YAAY,GAAG;QACnB,YAAY;QACZ,WAAW;QACX,SAAS;QACT,aAAa;QACb,MAAM,EAAE;YACN,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;YAChD,QAAQ,EACN,QAAQ,KAAK,QAAQ;gBACnB,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,KAAK;oBACtE,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,QAAQ;YACd,eAAe,EAAE,qBAAqB;YACtC,eAAe;YACf,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,QAAQ;SAC9D;KACgC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChG,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAA2B,EAC3B,gBAAwB,EACxB,OAAmD;IAEnD,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,gBAAgB;QACvC,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9G,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACxC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC;YACxE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;QACrD,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG;YACjH,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,QAAQ,CAAC,+BAA+B,CAAC;IACxD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACjD,IAAI,MAAM,EAAE,MAAM,KAAK,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC5E,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,QAA2B,EAC3B,YAAoB,EACpB,KAAa;IAEb,MAAM,UAAU,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa;QAAE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACxF,IAAI,CAAC,QAAQ,CAAC,oBAAoB;QAAE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,QAAQ,CAAC,oBAAoB,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAoC,CAAC;IAC9G,IAAI,MAAM,EAAE,MAAM,KAAK,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAA2B,EAC3B,YAAoB;IAEpB,MAAM,UAAU,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC7G,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAoC,CAAC;IACxF,IAAI,MAAM,EAAE,MAAM,KAAK,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC5E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAA2B,EAC3B,UAAyE;IAEzE,IAAI,mBAAmB,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACrG,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC7E,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,aAAa,EAAE,CAAC;IACnG,CAAC;IACD,MAAM,UAAU,GAAG,0BAA0B,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAC/E,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;QACrC,QAAQ,EAAE,UAAU,CAAC,MAAM,KAAK,aAAa;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,QAA2B,EAAE,UAAkB;IAC/E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,0BAA0B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpE,OAAO;YACL,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;YACrC,QAAQ,EAAE,UAAU,CAAC,MAAM,KAAK,aAAa;SAC9C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAA8C;IAChE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAA0B;IACrD,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,aAAa,CAAC;AACtD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAoB;IAC5C,OAAO,CACL,GAAG,KAAK,aAAa;QACrB,GAAG,KAAK,gBAAgB;QACxB,GAAG,KAAK,uBAAuB;QAC/B,GAAG,KAAK,gBAAgB;QACxB,GAAG,KAAK,cAAc;QACtB,GAAG,KAAK,cAAc;QACtB,GAAG,KAAK,sBAAsB,CAC/B,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QACxG,OAAO,KAAK,CAAC;IACf,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1F,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/gateway/trusted-clients.d.ts

@@ -0,0 +1,27 @@
+export type TrustedClient = {
+    publicKeyPem: string;
+    pairedAt: string;
+    fingerprint: string;
+};
+export type TrustedClientsFile = {
+    version: 1;
+    clients: Record<string, TrustedClient>;
+};
+export type TrustedPublicKey = {
+    kid: string;
+    publicKeyPem: string;
+    fingerprint: string;
+};
+export declare class TrustedClientsError extends Error {
+    constructor(message?: string);
+}
+export declare class TrustedClientsStore {
+    #private;
+    constructor(filePath: string);
+    get filePath(): string;
+    get size(): number;
+    entries(): ReadonlyArray<TrustedPublicKey>;
+    add(publicKeyPem: string): TrustedPublicKey;
+    static normalizePublicKey(publicKeyPem: string): TrustedPublicKey;
+}
+//# sourceMappingURL=trusted-clients.d.ts.map

package/dist/gateway/trusted-clients.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-clients.d.ts","sourceRoot":"","sources":["../../source/gateway/trusted-clients.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,aAAa,GAAG;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,SAAwC,EAG1D;CACF;AAED,qBAAa,mBAAmB;;IAI9B,YAAY,QAAQ,EAAE,MAAM,EAI3B;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,OAAO,IAAI,aAAa,CAAC,gBAAgB,CAAC,CAMzC;IAED,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,gBAAgB,CAc1C;IAED,MAAM,CAAC,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,gBAAgB,CAGhE;CA2DF"}