@redplanethq/corebrain 2.8.13 → 2.8.15

package/dist/server/api/files/index.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyPluginAsync } from 'fastify';
+export declare const filesRoutes: FastifyPluginAsync;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/api/files/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/api/files/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,SAAS,CAAC;AAIhD,eAAO,MAAM,WAAW,EAAE,kBAEzB,CAAC"}

package/dist/server/api/files/index.js

@@ -0,0 +1,6 @@
+import { filesTools, executeFilesTool } from '../../../server/tools/files-tools.js';
+import { makeToolGroupRoutes } from '../tool-group.js';
+export const filesRoutes = async (app) => {
+    await app.register(makeToolGroupRoutes(filesTools, executeFilesTool));
+};
+//# sourceMappingURL=index.js.map

package/dist/server/api/files/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/server/api/files/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,UAAU,EAAE,gBAAgB,EAAC,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAC,mBAAmB,EAAC,MAAM,eAAe,CAAC;AAElD,MAAM,CAAC,MAAM,WAAW,GAAuB,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5D,MAAM,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACvE,CAAC,CAAC"}

package/dist/server/api/folders/index.d.ts

@@ -0,0 +1,14 @@
+import type { FastifyPluginAsync } from 'fastify';
+/**
+ * Folder management routes (mounted at `/api/folders`).
+ *
+ *   GET    /api/folders            → manifest mirror, used by webapp settings
+ *   POST   /api/folders/local      → register an existing on-disk path
+ *   POST   /api/folders/git        → git clone <url> into the workspace, register
+ *   DELETE /api/folders/:idOrName  → unregister (does not delete files)
+ *
+ * Auth is handled upstream (`makeAuthHook`); these handlers assume the caller
+ * already passed the gateway's security key.
+ */
+export declare const folderRoutes: FastifyPluginAsync;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/api/folders/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/api/folders/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,SAAS,CAAC;AAUhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,EAAE,kBAyK1B,CAAC"}

package/dist/server/api/folders/index.js

@@ -0,0 +1,161 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { existsSync, mkdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { addFolder, listFolders, removeFolder } from '../../../config/folders.js';
+import { gatewayLog } from '../../../server/gateway-log.js';
+const execFileP = promisify(execFile);
+/**
+ * Folder management routes (mounted at `/api/folders`).
+ *
+ *   GET    /api/folders            → manifest mirror, used by webapp settings
+ *   POST   /api/folders/local      → register an existing on-disk path
+ *   POST   /api/folders/git        → git clone <url> into the workspace, register
+ *   DELETE /api/folders/:idOrName  → unregister (does not delete files)
+ *
+ * Auth is handled upstream (`makeAuthHook`); these handlers assume the caller
+ * already passed the gateway's security key.
+ */
+export const folderRoutes = async (app) => {
+    // ---- list ----
+    app.get('/', async () => ({
+        ok: true,
+        folders: listFolders(),
+    }));
+    // ---- register existing local path ----
+    app.post('/local', async (req, reply) => {
+        const body = (req.body ?? {});
+        if (!body.path) {
+            reply.code(400);
+            return { ok: false, error: '`path` is required' };
+        }
+        const scopes = body.scopes && body.scopes.length > 0
+            ? body.scopes
+            : ['files', 'coding', 'exec'];
+        try {
+            const folder = addFolder({
+                name: body.name,
+                path: body.path,
+                scopes: scopes,
+            });
+            gatewayLog(`folder added (local): ${folder.name} → ${folder.path}`);
+            return { ok: true, folder };
+        }
+        catch (err) {
+            reply.code(400);
+            return {
+                ok: false,
+                error: err instanceof Error ? err.message : 'failed to add folder',
+            };
+        }
+    });
+    // ---- clone github / git url, register the clone ----
+    app.post('/git', async (req, reply) => {
+        const body = (req.body ?? {});
+        if (!body.url) {
+            reply.code(400);
+            return { ok: false, error: '`url` is required' };
+        }
+        const workspaceRoot = process.env.COREBRAIN_DEFAULT_WORKSPACE || '/app';
+        if (!existsSync(workspaceRoot)) {
+            try {
+                mkdirSync(workspaceRoot, { recursive: true });
+            }
+            catch {
+                reply.code(500);
+                return {
+                    ok: false,
+                    error: `workspace dir ${workspaceRoot} missing and could not be created`,
+                };
+            }
+        }
+        try {
+            if (!statSync(workspaceRoot).isDirectory()) {
+                reply.code(500);
+                return {
+                    ok: false,
+                    error: `workspace path ${workspaceRoot} is not a directory`,
+                };
+            }
+        }
+        catch {
+            reply.code(500);
+            return { ok: false, error: `workspace path ${workspaceRoot} not accessible` };
+        }
+        // Default folder name: derive from the repo URL (".../foo/bar.git" → "bar").
+        const defaultName = body.name ??
+            body.url
+                .replace(/\/$/, '')
+                .replace(/\.git$/i, '')
+                .split('/')
+                .pop() ??
+            'repo';
+        // Sanitize so we don't end up with something silly like "../etc" inside
+        // /app. Letters, digits, dot, dash, underscore only — anything else
+        // becomes "-".
+        const safeName = defaultName.replace(/[^a-zA-Z0-9._-]/g, '-');
+        const target = join(workspaceRoot, safeName);
+        if (existsSync(target)) {
+            reply.code(409);
+            return { ok: false, error: `target dir already exists: ${target}` };
+        }
+        const args = ['clone', '--depth', '1'];
+        if (body.branch) {
+            args.push('--branch', body.branch, '--single-branch');
+        }
+        args.push(body.url, target);
+        gatewayLog(`folder add (git): cloning ${body.url} → ${target}`);
+        try {
+            await execFileP('git', args, {
+                timeout: 5 * 60_000, // 5 minutes
+                env: process.env,
+            });
+        }
+        catch (err) {
+            reply.code(502);
+            const stderr = err?.stderr;
+            const message = stderr
+                ? Buffer.isBuffer(stderr)
+                    ? stderr.toString('utf8')
+                    : stderr
+                : err instanceof Error
+                    ? err.message
+                    : 'git clone failed';
+            gatewayLog(`folder add (git) FAILED: ${message.trim()}`);
+            return { ok: false, error: message.trim() };
+        }
+        try {
+            const folder = addFolder({
+                name: safeName,
+                path: target,
+                scopes: ['files', 'coding', 'exec'],
+            });
+            gatewayLog(`folder added (git): ${folder.name} → ${folder.path}`);
+            return { ok: true, folder };
+        }
+        catch (err) {
+            reply.code(500);
+            return {
+                ok: false,
+                error: err instanceof Error ? err.message : 'failed to register clone',
+            };
+        }
+    });
+    // ---- unregister (does not delete files on disk) ----
+    app.delete('/:idOrName', async (req, reply) => {
+        const { idOrName } = req.params;
+        try {
+            removeFolder(idOrName);
+            gatewayLog(`folder removed: ${idOrName}`);
+            return { ok: true };
+        }
+        catch (err) {
+            reply.code(404);
+            return {
+                ok: false,
+                error: err instanceof Error ? err.message : 'not found',
+            };
+        }
+    });
+};
+//# sourceMappingURL=index.js.map

package/dist/server/api/folders/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/server/api/folders/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,QAAQ,EAAC,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAC,SAAS,EAAC,MAAM,WAAW,CAAC;AACpC,OAAO,EAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AACxD,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAC,SAAS,EAAE,WAAW,EAAE,YAAY,EAAC,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAC,UAAU,EAAC,MAAM,sBAAsB,CAAC;AAEhD,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEtC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,YAAY,GAAuB,KAAK,EAAE,GAAG,EAAE,EAAE;IAC7D,iBAAiB;IACjB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACzB,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,WAAW,EAAE;KACtB,CAAC,CAAC,CAAC;IAEJ,yCAAyC;IACzC,GAAG,CAAC,IAAI,CAML,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAI3B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAC,CAAC;QACjD,CAAC;QAED,MAAM,MAAM,GACX,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YACpC,CAAC,CAAC,IAAI,CAAC,MAAM;YACb,CAAC,CAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAW,CAAC;QAE3C,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,SAAS,CAAC;gBACxB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,MAA4C;aACpD,CAAC,CAAC;YACH,UAAU,CAAC,yBAAyB,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACpE,OAAO,EAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB;aAClE,CAAC;QACH,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,uDAAuD;IACvD,GAAG,CAAC,IAAI,CAEL,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAI3B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAC,CAAC;QAChD,CAAC;QAED,MAAM,aAAa,GAClB,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,MAAM,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACJ,SAAS,CAAC,aAAa,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACR,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO;oBACN,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,iBAAiB,aAAa,mCAAmC;iBACxE,CAAC;YACH,CAAC;QACF,CAAC;QACD,IAAI,CAAC;YACJ,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO;oBACN,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,kBAAkB,aAAa,qBAAqB;iBAC3D,CAAC;YACH,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,aAAa,iBAAiB,EAAC,CAAC;QAC7E,CAAC;QAED,6EAA6E;QAC7E,MAAM,WAAW,GAChB,IAAI,CAAC,IAAI;YACT,IAAI,CAAC,GAAG;iBACN,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;iBAClB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;iBACtB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,EAAE;YACP,MAAM,CAAC;QAER,wEAAwE;QACxE,oEAAoE;QACpE,eAAe;QACf,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAE7C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,MAAM,EAAE,EAAC,CAAC;QACnE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE5B,UAAU,CAAC,6BAA6B,IAAI,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC;YACJ,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC5B,OAAO,EAAE,CAAC,GAAG,MAAM,EAAE,YAAY;gBACjC,GAAG,EAAE,OAAO,CAAC,GAAG;aAChB,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,MAAM,MAAM,GAAI,GAAyC,EAAE,MAAM,CAAC;YAClE,MAAM,OAAO,GAAG,MAAM;gBACrB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACzB,CAAC,CAAC,MAAM;gBACT,CAAC,CAAC,GAAG,YAAY,KAAK;oBACrB,CAAC,CAAC,GAAG,CAAC,OAAO;oBACb,CAAC,CAAC,kBAAkB,CAAC;YACvB,UAAU,CAAC,4BAA4B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACzD,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,EAAC,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,SAAS,CAAC;gBACxB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC;aACnC,CAAC,CAAC;YACH,UAAU,CAAC,uBAAuB,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAClE,OAAO,EAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B;aACtE,CAAC;QACH,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,uDAAuD;IACvD,GAAG,CAAC,MAAM,CACT,YAAY,EACZ,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACpB,MAAM,EAAC,QAAQ,EAAC,GAAG,GAAG,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC;YACJ,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,UAAU,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;YAC1C,OAAO,EAAC,EAAE,EAAE,IAAI,EAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;aACvD,CAAC;QACH,CAAC;IACF,CAAC,CACD,CAAC;AACH,CAAC,CAAC"}

package/dist/server/api/manifest-builder.d.ts

@@ -0,0 +1,13 @@
+import { type Manifest } from '@redplanethq/gateway-protocol';
+import type { GatewaySlots } from '../../types/config.js';
+/**
+ * A slot is considered enabled unless the user explicitly disabled it via
+ * `corebrain gateway config` (slots[name].enabled === false). Missing config
+ * means enabled, for backwards compatibility.
+ */
+export declare function isSlotEnabled(slots: GatewaySlots | undefined, slot: keyof GatewaySlots): boolean;
+export declare function buildManifest(): {
+    manifest: Manifest;
+    etag: string;
+};
+//# sourceMappingURL=manifest-builder.d.ts.map

package/dist/server/api/manifest-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-builder.d.ts","sourceRoot":"","sources":["../../../src/server/api/manifest-builder.ts"],"names":[],"mappings":"AAIA,OAAO,EAEN,KAAK,QAAQ,EAGb,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAgB,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAkGhE;;;;GAIG;AACH,wBAAgB,aAAa,CAC5B,KAAK,EAAE,YAAY,GAAG,SAAS,EAC/B,IAAI,EAAE,MAAM,YAAY,GACtB,OAAO,CAKT;AAED,wBAAgB,aAAa,IAAI;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,CAyDlE"}

package/dist/server/api/manifest-builder.js

@@ -0,0 +1,158 @@
+import { hostname, platform } from 'node:os';
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { PROTOCOL_VERSION, } from '@redplanethq/gateway-protocol';
+import { getPreferences } from '../../config/preferences.js';
+import { listFolders } from '../../config/folders.js';
+import { browserTools } from '../../server/tools/browser-tools.js';
+import { codingTools } from '../../server/tools/coding-tools.js';
+import { execTools } from '../../server/tools/exec-tools.js';
+import { filesTools } from '../../server/tools/files-tools.js';
+import { utilsTools } from '../../server/tools/utils-tools.js';
+let cliVersion = '0.0.0';
+try {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    cliVersion = require('../../../package.json').version ?? cliVersion;
+}
+catch {
+    /* compiled build may not have the package.json alongside */
+}
+/**
+ * Project an internal tool export (may have extra metadata) onto the public
+ * GatewayTool shape the manifest advertises.
+ */
+function projectTool(t) {
+    return {
+        name: t.name,
+        description: t.description,
+        inputSchema: t.inputSchema,
+    };
+}
+// Coding agents the gateway knows how to drive. Each entry maps the public
+// agent name (used in the manifest + tool params) to the binary we'll run on
+// PATH. Add new entries here when a new agent is supported.
+const KNOWN_AGENTS = [
+    { name: 'claude-code', command: 'claude' },
+    { name: 'codex-cli', command: 'codex' },
+];
+/**
+ * Resolve a bare command via the env's PATH (the same one node-pty will use
+ * when spawning). Returns the absolute path on success, null otherwise.
+ *
+ * We don't capture login PATH here because the manifest endpoint is hit very
+ * frequently; reading PATH from the process env is sufficient — the gateway
+ * is started by `corebrain gateway start` which already inherits the user's
+ * shell PATH (foreground mode) or had it captured at PtyManager load.
+ */
+function resolveBinary(cmd) {
+    if (cmd.includes('/'))
+        return existsSync(cmd) ? cmd : null;
+    try {
+        const out = execFileSync('/bin/sh', ['-c', `command -v ${cmd}`], {
+            encoding: 'utf8',
+            timeout: 2_000,
+        });
+        const path = out.trim();
+        return path || null;
+    }
+    catch {
+        return null;
+    }
+}
+function detectAvailableAgents(configuredAgents, coding) {
+    const result = [];
+    for (const agent of KNOWN_AGENTS) {
+        // Prefer the user-configured command (often an absolute path written
+        // during `corebrain coding setup`). Falls back to a PATH lookup of the
+        // bare binary, which is unreliable for daemons launched by launchd /
+        // systemd because they don't inherit the login shell's PATH.
+        const configuredCommand = coding[agent.name]?.command;
+        const path = (configuredCommand ? resolveBinary(configuredCommand) : null) ??
+            resolveBinary(agent.command);
+        if (!path)
+            continue;
+        result.push({
+            name: agent.name,
+            command: agent.command,
+            path,
+            configured: configuredAgents.has(agent.name),
+        });
+    }
+    return result;
+}
+function detectDeployMode() {
+    // Explicit env wins (Dockerfile sets COREBRAIN_DEPLOY_MODE=docker).
+    const envMode = process.env.COREBRAIN_DEPLOY_MODE;
+    if (envMode === 'docker' || envMode === 'native')
+        return envMode;
+    // Fallback heuristic — `/.dockerenv` is created by Docker on container init.
+    if (existsSync('/.dockerenv'))
+        return 'docker';
+    return 'native';
+}
+/**
+ * A slot is considered enabled unless the user explicitly disabled it via
+ * `corebrain gateway config` (slots[name].enabled === false). Missing config
+ * means enabled, for backwards compatibility.
+ */
+export function isSlotEnabled(slots, slot) {
+    if (!slots)
+        return true;
+    const entry = slots[slot];
+    if (!entry)
+        return true;
+    return entry.enabled !== false;
+}
+export function buildManifest() {
+    const prefs = getPreferences();
+    const gw = prefs.gateway ?? {};
+    const slots = gw.slots;
+    // Respect the user's slot toggles — a disabled slot hides its tools (and
+    // agents, when coding is off) from the manifest. Callers that shouldn't
+    // see a tool shouldn't be able to hit its route either; server.ts applies
+    // the same filter when registering routes.
+    const tools = [
+        ...(isSlotEnabled(slots, 'browser') ? browserTools : []),
+        ...(isSlotEnabled(slots, 'coding') ? codingTools : []),
+        ...(isSlotEnabled(slots, 'exec') ? execTools : []),
+        ...(isSlotEnabled(slots, 'files') ? filesTools : []),
+        ...utilsTools,
+    ].map(projectTool);
+    // Configured coding agents — keys of prefs.coding (e.g. "claude-code", "codex-cli").
+    // Empty when the coding slot is disabled so UIs don't offer agents the user
+    // doesn't want exposed.
+    const coding = (prefs.coding ?? {});
+    const agents = isSlotEnabled(slots, 'coding') ? Object.keys(coding) : [];
+    const configuredAgents = new Set(agents);
+    const availableAgents = isSlotEnabled(slots, 'coding')
+        ? detectAvailableAgents(configuredAgents, coding)
+        : [];
+    const manifest = {
+        protocolVersion: PROTOCOL_VERSION,
+        gateway: {
+            id: gw.id ?? 'pending',
+            name: gw.name ?? `${hostname()}-gateway`,
+            version: cliVersion,
+            platform: platform(),
+            hostname: hostname(),
+            deployMode: detectDeployMode(),
+        },
+        capabilities: {
+            browser: {
+                enabled: isSlotEnabled(slots, 'browser'),
+                engines: ['chromium'],
+            },
+        },
+        folders: listFolders(),
+        tools,
+        agents,
+        availableAgents,
+    };
+    const etag = createHash('sha256')
+        .update(JSON.stringify(manifest))
+        .digest('hex')
+        .slice(0, 16);
+    return { manifest, etag };
+}
+//# sourceMappingURL=manifest-builder.js.map

package/dist/server/api/manifest-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-builder.js","sourceRoot":"","sources":["../../../src/server/api/manifest-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,QAAQ,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AACvC,OAAO,EAAC,YAAY,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAC,UAAU,EAAC,MAAM,SAAS,CAAC;AACnC,OAAO,EACN,gBAAgB,GAIhB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAC,cAAc,EAAC,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAC,YAAY,EAAC,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAC,WAAW,EAAC,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAC,SAAS,EAAC,MAAM,2BAA2B,CAAC;AACpD,OAAO,EAAC,UAAU,EAAC,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAC,UAAU,EAAC,MAAM,4BAA4B,CAAC;AAEtD,IAAI,UAAU,GAAG,OAAO,CAAC;AACzB,IAAI,CAAC;IACJ,8DAA8D;IAC9D,UAAU,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC;AACrE,CAAC;AAAC,MAAM,CAAC;IACR,4DAA4D;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,CAIpB;IACA,OAAO;QACN,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAkD;KACjE,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,4DAA4D;AAC5D,MAAM,YAAY,GAA2C;IAC5D,EAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAC;IACxC,EAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAC;CACrC,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,GAAW;IACjC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,cAAc,GAAG,EAAE,CAAC,EAAE;YAChE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;SACd,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,IAAI,IAAI,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,qBAAqB,CAC7B,gBAA6B,EAC7B,MAAsD;IAEtD,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QAClC,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,6DAA6D;QAC7D,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QACtD,MAAM,IAAI,GACT,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI;YACJ,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;SAC5C,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB;IACxB,oEAAoE;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAClD,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IACjE,6EAA6E;IAC7E,IAAI,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC5B,KAA+B,EAC/B,IAAwB;IAExB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAQ,KAA6B,CAAC,OAAO,KAAK,KAAK,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,aAAa;IAC5B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,MAAM,EAAE,GAA2B,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;IAEvB,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,2CAA2C;IAC3C,MAAM,KAAK,GAAG;QACb,GAAG,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,UAAU;KACb,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAEnB,qFAAqF;IACrF,4EAA4E;IAC5E,wBAAwB;IACxB,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IAC/D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC;QACrD,CAAC,CAAC,qBAAqB,CACrB,gBAAgB,EAChB,MAAwD,CACvD;QACH,CAAC,CAAC,EAAE,CAAC;IAEN,MAAM,QAAQ,GAAa;QAC1B,eAAe,EAAE,gBAAgB;QACjC,OAAO,EAAE;YACR,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,SAAS;YACtB,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,QAAQ,EAAE,UAAU;YACxC,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,QAAQ,EAAE;YACpB,QAAQ,EAAE,QAAQ,EAAE;YACpB,UAAU,EAAE,gBAAgB,EAAE;SAC9B;QACD,YAAY,EAAE;YACb,OAAO,EAAE;gBACR,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC;gBACxC,OAAO,EAAE,CAAC,UAAU,CAAC;aACrB;SACD;QACD,OAAO,EAAE,WAAW,EAAE;QACtB,KAAK;QACL,MAAM;QACN,eAAe;KACf,CAAC;IACF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC/B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;SAChC,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,EAAC,QAAQ,EAAE,IAAI,EAAC,CAAC;AACzB,CAAC"}

package/dist/server/api/ops.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyPluginAsync } from 'fastify';
+export declare const opsRoutes: FastifyPluginAsync;
+//# sourceMappingURL=ops.d.ts.map

package/dist/server/api/ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops.d.ts","sourceRoot":"","sources":["../../../src/server/api/ops.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,SAAS,CAAC;AAQhD,eAAO,MAAM,SAAS,EAAE,kBA6BvB,CAAC"}

package/dist/server/api/ops.js

@@ -0,0 +1,32 @@
+import { hostname, platform } from 'node:os';
+import { buildManifest } from './manifest-builder.js';
+import { getPreferences } from '../../config/preferences.js';
+const startedAt = Date.now();
+export const opsRoutes = async (app) => {
+    app.get('/manifest', async (_req, reply) => {
+        const { manifest, etag } = buildManifest();
+        reply.header('etag', etag);
+        return manifest;
+    });
+    app.get('/healthz', async () => {
+        const { etag } = buildManifest();
+        return {
+            status: 'ok',
+            manifestEtag: etag,
+            uptimeSec: Math.floor((Date.now() - startedAt) / 1000),
+        };
+    });
+    app.get('/healthz/public', async () => {
+        return { status: 'ok' };
+    });
+    app.get('/verify', async () => {
+        const gw = getPreferences().gateway ?? {};
+        return {
+            ok: true,
+            gatewayId: gw.id ?? null,
+            hostname: hostname(),
+            platform: platform(),
+        };
+    });
+};
+//# sourceMappingURL=ops.js.map

package/dist/server/api/ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops.js","sourceRoot":"","sources":["../../../src/server/api/ops.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,QAAQ,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAE3C,OAAO,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAC,cAAc,EAAC,MAAM,sBAAsB,CAAC;AAEpD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,SAAS,GAAuB,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1D,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC1C,MAAM,EAAC,QAAQ,EAAE,IAAI,EAAC,GAAG,aAAa,EAAE,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3B,OAAO,QAAQ,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;QAC9B,MAAM,EAAC,IAAI,EAAC,GAAG,aAAa,EAAE,CAAC;QAC/B,OAAO;YACN,MAAM,EAAE,IAAa;YACrB,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;SACtD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE;QACrC,OAAO,EAAC,MAAM,EAAE,IAAa,EAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAC7B,MAAM,EAAE,GAA2B,cAAc,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;QAClE,OAAO;YACN,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,EAAE,CAAC,EAAE,IAAI,IAAI;YACxB,QAAQ,EAAE,QAAQ,EAAE;YACpB,QAAQ,EAAE,QAAQ,EAAE;SACpB,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/server/api/server.d.ts

@@ -0,0 +1,9 @@
+import { type FastifyInstance } from 'fastify';
+export interface ApiServerOptions {
+    port: number;
+    host?: string;
+    log?: (message: string) => void;
+}
+export declare function buildServer(opts: ApiServerOptions): Promise<FastifyInstance>;
+export declare function startServer(opts: ApiServerOptions): Promise<FastifyInstance>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server/api/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/server/api/server.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAC,KAAK,eAAe,EAAC,MAAM,SAAS,CAAC;AActD,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAoDlF;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAKlF"}

package/dist/server/api/server.js

@@ -0,0 +1,66 @@
+import Fastify from 'fastify';
+import fastifyWebsocket from '@fastify/websocket';
+import { makeAuthHook } from './auth.js';
+import { opsRoutes } from './ops.js';
+import { codingRoutes } from './coding/index.js';
+import { browserRoutes } from './browser/index.js';
+import { execRoutes } from './exec/index.js';
+import { filesRoutes } from './files/index.js';
+import { utilsRoutes } from './utils/index.js';
+import { folderRoutes } from './folders/index.js';
+import { shellRoutes } from './shell/index.js';
+import { isSlotEnabled } from './manifest-builder.js';
+import { getPreferences } from '../../config/preferences.js';
+export async function buildServer(opts) {
+    const log = opts.log ?? (() => { });
+    const app = Fastify({
+        logger: false,
+        bodyLimit: 50 * 1024 * 1024, // 50 MB — browser_screenshot base64 can be large
+        trustProxy: true,
+    });
+    await app.register(fastifyWebsocket);
+    // Auth for every route except /healthz/public.
+    app.addHook('onRequest', makeAuthHook(['/healthz/public']));
+    // Ops routes are always on (manifest / healthz / verify).
+    await app.register(opsRoutes);
+    // Group routes gated by slot config — a disabled slot hides both the
+    // manifest entries and the HTTP routes so clients can't dodge the toggle.
+    const slots = getPreferences().gateway?.slots;
+    if (isSlotEnabled(slots, 'coding')) {
+        await app.register(codingRoutes, { prefix: '/api/coding' });
+    }
+    if (isSlotEnabled(slots, 'browser')) {
+        await app.register(browserRoutes, { prefix: '/api/browser' });
+    }
+    if (isSlotEnabled(slots, 'exec')) {
+        await app.register(execRoutes, { prefix: '/api/exec' });
+    }
+    if (isSlotEnabled(slots, 'files')) {
+        await app.register(filesRoutes, { prefix: '/api/files' });
+    }
+    // utils has no slot — it's always enabled (e.g. `sleep`).
+    await app.register(utilsRoutes, { prefix: '/api/utils' });
+    // Folder management — used by the webapp's per-gateway settings page to
+    // add/remove local paths or clone GitHub URLs into the workspace.
+    await app.register(folderRoutes, { prefix: '/api/folders' });
+    // General-purpose shell PTY for the webapp's Terminal tab.
+    await app.register(shellRoutes, { prefix: '/api/shell' });
+    app.setErrorHandler((err, _req, reply) => {
+        log(`api error: ${err.message}`);
+        if (reply.sent)
+            return;
+        const status = err.statusCode ?? 500;
+        reply.code(status).send({
+            ok: false,
+            error: { code: err.code ?? 'INTERNAL', message: err.message },
+        });
+    });
+    return app;
+}
+export async function startServer(opts) {
+    const app = await buildServer(opts);
+    await app.listen({ port: opts.port, host: opts.host ?? '0.0.0.0' });
+    opts.log?.(`gateway HTTP listening on :${opts.port}`);
+    return app;
+}
+//# sourceMappingURL=server.js.map

package/dist/server/api/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/server/api/server.ts"],"names":[],"mappings":"AAAA,OAAO,OAA+B,MAAM,SAAS,CAAC;AACtD,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAC,YAAY,EAAC,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAC,SAAS,EAAC,MAAM,OAAO,CAAC;AAChC,OAAO,EAAC,YAAY,EAAC,MAAM,UAAU,CAAC;AACtC,OAAO,EAAC,aAAa,EAAC,MAAM,WAAW,CAAC;AACxC,OAAO,EAAC,UAAU,EAAC,MAAM,QAAQ,CAAC;AAClC,OAAO,EAAC,WAAW,EAAC,MAAM,SAAS,CAAC;AACpC,OAAO,EAAC,WAAW,EAAC,MAAM,SAAS,CAAC;AACpC,OAAO,EAAC,YAAY,EAAC,MAAM,WAAW,CAAC;AACvC,OAAO,EAAC,WAAW,EAAC,MAAM,SAAS,CAAC;AACpC,OAAO,EAAC,aAAa,EAAC,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAC,cAAc,EAAC,MAAM,sBAAsB,CAAC;AAQpD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAsB;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC;QACnB,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,iDAAiD;QAC9E,UAAU,EAAE,IAAI;KAChB,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAErC,+CAA+C;IAC/C,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAE5D,0DAA0D;IAC1D,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAE9B,qEAAqE;IACrE,0EAA0E;IAC1E,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;IAC9C,IAAI,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAC,MAAM,EAAE,aAAa,EAAC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;QACrC,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAC,MAAM,EAAE,cAAc,EAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAC,MAAM,EAAE,WAAW,EAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAC,MAAM,EAAE,YAAY,EAAC,CAAC,CAAC;IACzD,CAAC;IACD,0DAA0D;IAC1D,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAC,MAAM,EAAE,YAAY,EAAC,CAAC,CAAC;IAExD,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAC,MAAM,EAAE,cAAc,EAAC,CAAC,CAAC;IAE3D,2DAA2D;IAC3D,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAC,MAAM,EAAE,YAAY,EAAC,CAAC,CAAC;IAExD,GAAG,CAAC,eAAe,CAAC,CAAC,GAAiD,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACtF,GAAG,CAAC,cAAc,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI;YAAE,OAAO;QACvB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YACvB,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAC;SAC3D,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAsB;IACvD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS,EAAC,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG,EAAE,CAAC,8BAA8B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/server/api/shell/index.d.ts

@@ -0,0 +1,17 @@
+import type { FastifyPluginAsync } from 'fastify';
+/**
+ * General-purpose shell PTY for the webapp's per-gateway Terminal tab.
+ *
+ *   POST /api/shell/spawn
+ *   body: { cwd?: string }
+ *   → 200 { ok: true, sessionId, pid }
+ *
+ * Spawns the user's `$SHELL` (falling back to `/bin/bash` → `/bin/sh`) inside
+ * a PTY managed by `ptyManager`. The browser attaches via the existing xterm
+ * WS endpoint — no CodingSession involved.
+ *
+ * Auth is handled by the global gateway auth hook (security key), so anyone
+ * able to hit this can already exec arbitrary tools — no extra guardrails.
+ */
+export declare const shellRoutes: FastifyPluginAsync;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/api/shell/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/api/shell/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,kBAAkB,EAAC,MAAM,SAAS,CAAC;AAOhD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,EAAE,kBA8CzB,CAAC"}

package/dist/server/api/shell/index.js

@@ -0,0 +1,61 @@
+import { randomUUID } from 'node:crypto';
+import { homedir } from 'node:os';
+import { existsSync } from 'node:fs';
+import { ptyManager } from '../../../server/pty/manager.js';
+import { gatewayLog } from '../../../server/gateway-log.js';
+/**
+ * General-purpose shell PTY for the webapp's per-gateway Terminal tab.
+ *
+ *   POST /api/shell/spawn
+ *   body: { cwd?: string }
+ *   → 200 { ok: true, sessionId, pid }
+ *
+ * Spawns the user's `$SHELL` (falling back to `/bin/bash` → `/bin/sh`) inside
+ * a PTY managed by `ptyManager`. The browser attaches via the existing xterm
+ * WS endpoint — no CodingSession involved.
+ *
+ * Auth is handled by the global gateway auth hook (security key), so anyone
+ * able to hit this can already exec arbitrary tools — no extra guardrails.
+ */
+export const shellRoutes = async (app) => {
+    app.post('/spawn', async (req, reply) => {
+        const body = (req.body ?? {});
+        // Resolve a usable shell. SHELL → /bin/zsh → /bin/bash → /bin/sh.
+        const candidates = [
+            process.env.SHELL,
+            '/bin/zsh',
+            '/bin/bash',
+            '/bin/sh',
+        ].filter((s) => Boolean(s && existsSync(s)));
+        const shell = candidates[0];
+        if (!shell) {
+            reply.code(500);
+            return { ok: false, error: 'no usable shell on PATH' };
+        }
+        const cwd = body.cwd && existsSync(body.cwd)
+            ? body.cwd
+            : process.env.COREBRAIN_DEFAULT_WORKSPACE &&
+                existsSync(process.env.COREBRAIN_DEFAULT_WORKSPACE)
+                ? process.env.COREBRAIN_DEFAULT_WORKSPACE
+                : homedir();
+        const sessionId = randomUUID();
+        gatewayLog(`shell spawn: shell=${shell} cwd=${cwd} sessionId=${sessionId}`);
+        try {
+            const { pid } = ptyManager.spawn({
+                sessionId,
+                command: shell,
+                args: ['-il'], // login + interactive so PATH/aliases are loaded
+                cwd,
+                agent: 'shell',
+            });
+            return { ok: true, sessionId, pid };
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : 'spawn failed';
+            gatewayLog(`shell spawn FAILED: ${msg}`);
+            reply.code(500);
+            return { ok: false, error: msg };
+        }
+    });
+};
+//# sourceMappingURL=index.js.map

package/dist/server/api/shell/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/server/api/shell/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AACvC,OAAO,EAAC,OAAO,EAAC,MAAM,SAAS,CAAC;AAChC,OAAO,EAAC,UAAU,EAAC,MAAM,SAAS,CAAC;AACnC,OAAO,EAAC,UAAU,EAAC,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAC,UAAU,EAAC,MAAM,sBAAsB,CAAC;AAEhD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,WAAW,GAAuB,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5D,GAAG,CAAC,IAAI,CAAyB,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAmB,CAAC;QAEhD,kEAAkE;QAClE,MAAM,UAAU,GAAG;YAClB,OAAO,CAAC,GAAG,CAAC,KAAK;YACjB,UAAU;YACV,WAAW;YACX,SAAS;SACT,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAC,CAAC;QACtD,CAAC;QAED,MAAM,GAAG,GACR,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAC/B,CAAC,CAAC,IAAI,CAAC,GAAG;YACV,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B;gBACtC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;gBACrD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B;gBACzC,CAAC,CAAC,OAAO,EAAE,CAAC;QAEf,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,UAAU,CACT,sBAAsB,KAAK,QAAQ,GAAG,cAAc,SAAS,EAAE,CAC/D,CAAC;QAEF,IAAI,CAAC;YACJ,MAAM,EAAC,GAAG,EAAC,GAAG,UAAU,CAAC,KAAK,CAAC;gBAC9B,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,iDAAiD;gBAChE,GAAG;gBACH,KAAK,EAAE,OAAO;aACd,CAAC,CAAC;YACH,OAAO,EAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;YAChE,UAAU,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAC,CAAC;QAChC,CAAC;IACF,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/server/api/tool-group.d.ts

@@ -0,0 +1,21 @@
+import type { FastifyPluginAsync } from 'fastify';
+interface ToolMeta {
+    name: string;
+    description: string;
+}
+interface ToolResult {
+    success: boolean;
+    result?: unknown;
+    error?: string;
+}
+type Executor = (toolName: string, params: Record<string, unknown>) => Promise<ToolResult> | ToolResult;
+/**
+ * Build a Fastify plugin that exposes one POST route per tool in `tools`,
+ * each at path `/{tool.name}` — e.g. /api/coding/coding_ask.
+ *
+ * The plugin is meant to be registered with a prefix:
+ *   app.register(makeToolGroupRoutes(codingTools, executeCodingTool), { prefix: '/api/coding' });
+ */
+export declare function makeToolGroupRoutes(tools: ToolMeta[], execute: Executor): FastifyPluginAsync;
+export {};
+//# sourceMappingURL=tool-group.d.ts.map