@riceawa/dsh-lan-gateway 0.6.0 → 0.6.2

package/src/client/lan-gateway-card.tsx

@@ -20,6 +20,7 @@ import type { PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
 import type {} from '@deepseek-ai/dsh-client-ui-plugin-manager/client'
 import {
   FIELDS,
+  MIN_PASSWORD_LENGTH,
   TRISTATE_OPTIONS,
   formatValue,
   parseValue,
@@ -52,6 +53,48 @@ interface RouteState {
   port: number
   tls: string
   lastError: string | null
+  /** Whether a login credential exists. Never the credential itself. */
+  passwordSet?: boolean
+}
+
+/** Why a password draft cannot be submitted yet. */
+export type PasswordProblem = 'tooShort' | 'mismatch'
+
+/**
+ * The card's password badge state.
+ *
+ * Three states, not two: a host that predates the password route does not
+ * report `passwordSet` at all, and `undefined` must read as "unknown" rather
+ * than "not set" — a client refreshed against a running old host would
+ * otherwise announce that a gateway which is demonstrably running (it cannot
+ * start without a credential) has no password.
+ */
+export type PasswordStatus = 'set' | 'unset' | 'unknown'
+
+/**
+ * Classify the host's `passwordSet` for the badge.
+ * @param passwordSet - the snapshot's flag, or `undefined` when absent.
+ * @returns `set` / `unset` / `unknown` (absent field).
+ */
+export function passwordStatus(passwordSet: boolean | undefined): PasswordStatus {
+  if (passwordSet === undefined) return 'unknown'
+  return passwordSet ? 'set' : 'unset'
+}
+
+/**
+ * Judge a password draft the way the host's password route will, so a draft the
+ * card enables is never answered with a 400. The length bound is the shared
+ * {@link MIN_PASSWORD_LENGTH}; the confirmation is a UI concern and is checked
+ * here rather than server-side (the host is told one password, and storing only
+ * what was typed twice is the browser's job).
+ * @param password - the new password draft.
+ * @param confirm - the confirmation draft.
+ * @returns the reason it cannot be submitted, or `null` when it can.
+ */
+export function passwordProblem(password: string, confirm: string): PasswordProblem | null {
+  if (password.length < MIN_PASSWORD_LENGTH) return 'tooShort'
+  if (password !== confirm) return 'mismatch'
+  return null
 }
 
 /* ------------------------------------------------------------------ */
@@ -74,6 +117,21 @@ interface Labels {
   stopped: string
   tls: string
   lastError: string
+  passwordSection: string
+  passwordHint: string
+  passwordNew: string
+  passwordConfirm: string
+  passwordSet: string
+  passwordUnset: string
+  passwordUnknown: string
+  passwordRequired: string
+  passwordHostStale: string
+  passwordChange: string
+  passwordChanged: string
+  passwordFailed: string
+  passwordStaleHost: string
+  passwordTooShort: string
+  passwordMismatch: string
   [key: `field.${string}`]: string
   [key: `hint.${string}`]: string
   [key: `opt.${string}`]: string
@@ -96,6 +154,21 @@ const LABELS: Record<'zh' | 'en', Labels> = {
     stopped: '已停止',
     tls: 'TLS',
     lastError: '上次错误',
+    passwordSection: '登录密码',
+    passwordHint: '当前密码不会显示（也读不出来）。输入两次新密码后直接覆盖原密码；改密会递增会话代次，所有已登录会话与已建立的 WebSocket 立即失效。仅在从本机 loopback 打开 dsh web 时可改。',
+    passwordNew: '新密码（至少 8 位）',
+    passwordConfirm: '再次输入新密码',
+    passwordSet: '已设置',
+    passwordUnset: '未设置',
+    passwordUnknown: '状态未知（宿主端较旧）',
+    passwordRequired: '未设置密码时网关拒绝启动。',
+    passwordHostStale: '宿主端没有报告密码状态，说明 dsh web 还在运行旧版本：重启后这里才会显示「已设置 / 未设置」，这个改密表单也才会生效。',
+    passwordChange: '修改密码',
+    passwordChanged: '密码已更新：旧密码立即失效，所有已登录会话已作废。',
+    passwordFailed: '修改密码失败，请重试。',
+    passwordStaleHost: '宿主端没有响应这个接口：可能还没重启 dsh web 加载新版本。重启后再试；重启前仍可用 lan_gateway 工具改密。',
+    passwordTooShort: '密码至少 8 位。',
+    passwordMismatch: '两次输入不一致。',
     'field.enabled': '启用网关',
     'hint.enabled': '启动时监听 0.0.0.0 网关端口',
     'field.gatewayPort': '网关端口',
@@ -146,6 +219,21 @@ const LABELS: Record<'zh' | 'en', Labels> = {
     stopped: 'Stopped',
     tls: 'TLS',
     lastError: 'Last error',
+    passwordSection: 'Login password',
+    passwordHint: 'The current password is never shown (it cannot be read back). Enter a new one twice to overwrite it; changing it advances the session epoch, so every signed-in session and live WebSocket is invalidated at once. Only changeable where dsh web runs on loopback.',
+    passwordNew: 'New password (min 8 chars)',
+    passwordConfirm: 'Repeat new password',
+    passwordSet: 'Set',
+    passwordUnset: 'Not set',
+    passwordUnknown: 'Unknown (older host)',
+    passwordRequired: 'The gateway refuses to start without a password.',
+    passwordHostStale: 'The host did not report a password state, so dsh web is still running the previous build: restart it to get Set / Not set here and to make this form take effect.',
+    passwordChange: 'Change password',
+    passwordChanged: 'Password updated: the old one no longer works and every signed-in session was revoked.',
+    passwordFailed: 'The password change failed — retry.',
+    passwordStaleHost: 'The host did not answer this endpoint — it may still be running the previous build. Restart dsh web and retry; the lan_gateway tool can change the password meanwhile.',
+    passwordTooShort: 'At least 8 characters.',
+    passwordMismatch: 'The two entries do not match.',
     'field.enabled': 'Enable gateway',
     'hint.enabled': 'Listen on the gateway port at boot',
     'field.gatewayPort': 'Gateway port',
@@ -218,6 +306,14 @@ export function LanGatewayCard(props: LanGatewayCardProps): ReactNode {
   const [drafts, setDrafts] = useState<Partial<Record<string, string>>>({})
   const [saving, setSaving] = useState(false)
   const [failed, setFailed] = useState<string | null>(null)
+  // The password section is its own submit path: a password is not a settings
+  // key, so it must not ride the config patch (nor light up the card's "未保存"
+  // badge for every keystroke in a password box).
+  const [password, setPasswordDraft] = useState('')
+  const [passwordConfirm, setPasswordConfirmDraft] = useState('')
+  const [passwordBusy, setPasswordBusy] = useState(false)
+  const [passwordError, setPasswordError] = useState<string | null>(null)
+  const [passwordNotice, setPasswordNotice] = useState<string | null>(null)
 
   useEffect(() => {
     let cancelled = false
@@ -290,6 +386,68 @@ export function LanGatewayCard(props: LanGatewayCardProps): ReactNode {
     })
 
   const dirty = Object.keys(drafts).length > 0
+  const passwordDraftProblem = passwordProblem(password, passwordConfirm)
+  const passwordTyping = password !== '' || passwordConfirm !== ''
+  const passwordBadge = passwordStatus(route.passwordSet)
+
+  /** Adopt the host's post-write snapshot, keeping the last known values. */
+  const adopt = (body: Partial<RouteState>): void => {
+    if (body.config === undefined) return
+    setRoute({
+      config: body.config,
+      running: body.running ?? false,
+      port: body.port ?? 0,
+      tls: body.tls ?? '',
+      lastError: body.lastError ?? null,
+      // Absent is a state of its own (an older host does not report the field),
+      // so it must not be coerced into `false`: that is what made a running,
+      // password-protected gateway render as "not set".
+      ...(body.passwordSet !== undefined ? { passwordSet: body.passwordSet } : {}),
+    })
+  }
+
+  /**
+   * Overwrite the login password. Deliberately writes only to
+   * `/lan-gateway/password`: the credential is not part of the config patch, so
+   * a change here can never disturb an unsaved settings draft, and the old
+   * password is neither sent nor requested.
+   */
+  const changePassword = async (): Promise<void> => {
+    if (passwordBusy || passwordProblem(password, passwordConfirm) !== null) return
+    setPasswordBusy(true)
+    setPasswordError(null)
+    setPasswordNotice(null)
+    try {
+      const response = await fetch('/lan-gateway/password', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ password }),
+      })
+      // A host that predates this route answers the SPA fallback (HTML, 200),
+      // not a 404 — so "not our JSON" is the signal, and it must not read as a
+      // wrong password or a network failure.
+      const body = await response.json().catch(() => null) as (Partial<RouteState> & { error?: string }) | null
+      if (!response.ok) {
+        setPasswordError(body?.error ?? (response.status === 404 ? t.passwordStaleHost : `HTTP ${response.status}`))
+        return
+      }
+      if (body === null) {
+        setPasswordError(t.passwordStaleHost)
+        return
+      }
+      // Clear the boxes the moment the write lands: the new credential is now
+      // the stored one, and leaving it on screen is the one thing a password
+      // field should not do.
+      setPasswordDraft('')
+      setPasswordConfirmDraft('')
+      setPasswordNotice(t.passwordChanged)
+      adopt(body)
+    } catch {
+      setPasswordError(t.passwordFailed)
+    } finally {
+      setPasswordBusy(false)
+    }
+  }
 
   const save = async (): Promise<void> => {
     if (!dirty || saving || invalid()) return
@@ -318,15 +476,7 @@ export function LanGatewayCard(props: LanGatewayCardProps): ReactNode {
         setFailed(body.error ?? `HTTP ${response.status}`)
         return
       }
-      if (body.config !== undefined) {
-        setRoute({
-          config: body.config,
-          running: body.running ?? false,
-          port: body.port ?? 0,
-          tls: body.tls ?? '',
-          lastError: body.lastError ?? null,
-        })
-      }
+      adopt(body)
       setDrafts({})
     } catch {
       setFailed(t.saveFailed)
@@ -440,6 +590,72 @@ export function LanGatewayCard(props: LanGatewayCardProps): ReactNode {
         ? (
           <div style={styles.body}>
             {route.lastError ? <p style={styles.error} role="status">{t.lastError}: {route.lastError}</p> : null}
+            <div style={styles.section}>
+              <div style={styles.sectionHead}>
+                <span style={styles.label}>{t.passwordSection}</span>
+                <span style={passwordBadge === 'unset' ? styles.badgeAlert : styles.badge}>
+                  {passwordBadge === 'set'
+                    ? t.passwordSet
+                    : passwordBadge === 'unset' ? t.passwordUnset : t.passwordUnknown}
+                </span>
+              </div>
+              <p style={styles.hint}>{t.passwordHint}</p>
+              {passwordBadge === 'unset' ? <p style={styles.error}>{t.passwordRequired}</p> : null}
+              {passwordBadge === 'unknown' ? <p style={styles.hint}>{t.passwordHostStale}</p> : null}
+              <div style={styles.passwordRow}>
+                <input
+                  id="lan-gw-password"
+                  type="password"
+                  autoComplete="new-password"
+                  aria-label={t.passwordNew}
+                  style={passwordInput}
+                  placeholder={t.passwordNew}
+                  value={password}
+                  disabled={passwordBusy}
+                  onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                    setPasswordDraft(e.target.value)
+                    setPasswordError(null)
+                    setPasswordNotice(null)
+                  }}
+                />
+                <input
+                  id="lan-gw-password-confirm"
+                  type="password"
+                  autoComplete="new-password"
+                  aria-label={t.passwordConfirm}
+                  style={passwordInput}
+                  placeholder={t.passwordConfirm}
+                  value={passwordConfirm}
+                  disabled={passwordBusy}
+                  onChange={(e: ChangeEvent<HTMLInputElement>) => {
+                    setPasswordConfirmDraft(e.target.value)
+                    setPasswordError(null)
+                    setPasswordNotice(null)
+                  }}
+                />
+              </div>
+              <div style={styles.passwordFoot}>
+                {passwordError !== null
+                  ? <p style={styles.error} role="alert">{passwordError}</p>
+                  : passwordNotice !== null
+                    ? <p style={styles.notice} role="status">{passwordNotice}</p>
+                    : passwordTyping && passwordDraftProblem !== null
+                      ? (
+                        <p style={styles.error} role="status">
+                          {passwordDraftProblem === 'tooShort' ? t.passwordTooShort : t.passwordMismatch}
+                        </p>
+                      )
+                      : null}
+                <button
+                  type="button"
+                  style={styles.save}
+                  disabled={passwordBusy || passwordDraftProblem !== null}
+                  onClick={() => { void changePassword() }}
+                >
+                  {passwordBusy ? t.saving : t.passwordChange}
+                </button>
+              </div>
+            </div>
             {FIELDS.map(def => <div key={def.field}>{renderControl(def)}</div>)}
             <div style={styles.footer}>
               {failed ? <p style={styles.error} role="status">{failed}</p> : null}
@@ -563,6 +779,47 @@ const styles: Record<string, React.CSSProperties> = {
     display: 'flex',
     flexDirection: 'column',
   },
+  // The password block sits inside the card body, ahead of the config fields:
+  // it is the setting an operator comes here for, and it owns its own submit
+  // button (a password is not part of the settings patch), so it is separated
+  // by a rule rather than merged into the field list.
+  section: {
+    display: 'flex',
+    flexDirection: 'column',
+    gap: '8px',
+    padding: '14px 0',
+    borderBottom: `1px solid ${L.border}`,
+  },
+  sectionHead: { display: 'flex', alignItems: 'center', gap: '8px' },
+  badge: {
+    borderRadius: '999px',
+    padding: '1px 8px',
+    fontSize: '11px',
+    lineHeight: '17px',
+    fontWeight: 500,
+    whiteSpace: 'nowrap',
+    background: L.badgeBg,
+    color: L.labelSecondary,
+  },
+  badgeAlert: {
+    borderRadius: '999px',
+    padding: '1px 8px',
+    fontSize: '11px',
+    lineHeight: '17px',
+    fontWeight: 500,
+    whiteSpace: 'nowrap',
+    background: L.badgeBg,
+    color: L.error,
+  },
+  notice: { flex: 1, minWidth: 0, margin: 0, fontSize: '12px', lineHeight: 1.5, color: L.labelSecondary },
+  passwordRow: { display: 'flex', flexWrap: 'wrap', gap: '8px' },
+  passwordFoot: {
+    display: 'flex',
+    alignItems: 'center',
+    justifyContent: 'flex-end',
+    gap: '8px',
+    marginTop: '2px',
+  },
   field: {
     display: 'flex',
     flexDirection: 'column',
@@ -628,3 +885,6 @@ const styles: Record<string, React.CSSProperties> = {
     cursor: 'pointer',
   },
 }
+
+/** The shared input style plus the growth two side-by-side password boxes need. */
+const passwordInput: React.CSSProperties = { ...styles.input, flex: '1 1 160px' }

package/src/config-fields.ts

@@ -9,6 +9,11 @@
  * side and unknown on the other, which is what let the card silently rewrite
  * keys it never showed.
  *
+ * It also carries `MIN_PASSWORD_LENGTH`: the login password is deliberately not
+ * a field here (it is a secret in `state.json`, not a settings key), but its
+ * length bound is a contract the card's form and the host's password route
+ * must not disagree about.
+ *
  * Because both halves import it, this module must stay dependency-free and
  * side-effect-free: no schemastery (the host schema remains the validating
  * authority, not this table), no node built-ins, no DOM, no I/O.
@@ -43,6 +48,14 @@ export interface LanGatewaySettings {
 /** A settings key this table knows how to edit. */
 export type ConfigFieldKey = keyof LanGatewaySettings
 
+/**
+ * Minimum login-password length, in characters. The credential is not a config
+ * field (it lives in `state.json`, never in the schema), but the bound belongs
+ * here all the same: the card's password form and the host's password route
+ * both read it, so a draft the card accepts is never answered with a 400.
+ */
+export const MIN_PASSWORD_LENGTH = 8
+
 /** How a field is rendered and parsed. */
 export type FieldKind = 'boolean' | 'number' | 'text' | 'cidrs' | 'select' | 'tristate'
 

package/src/index.ts

@@ -31,9 +31,12 @@
  * Every tunable is also exposed as the `lan-gateway` user-settings namespace
  * (`ctx.settings`), so the official DSH Settings → Plugins page can adjust
  * port, CIDRs, auth, and TLS live; the running listener restarts on change.
- * The card reads/writes through the loopback-only `/lan-gateway/config` route;
- * remote browsers get a 403 from the gateway for that prefix and manage the
- * gateway through the `lan_gateway` tool instead.
+ * The card reads/writes through the loopback-only `/lan-gateway/config` route
+ * and changes the login password through the loopback-only
+ * `/lan-gateway/password` route (the credential is a secret in `state.json`,
+ * never a settings key, so it cannot ride a config patch); remote browsers get
+ * a 403 from the gateway for that whole prefix and manage the gateway through
+ * the `lan_gateway` tool instead.
  *
  * Disabled by default in the bundle patch (safe): the listener opens only
  * after `lan_gateway enable` or `enabled: true`.
@@ -53,6 +56,7 @@ import type {} from '@deepseek-ai/cordis-plugin-loader'
 import { DEFAULT_LAN_CIDR_STRINGS, originMatchesHost } from './auth.ts'
 import {
   CONFIG_FIELD_KEYS,
+  MIN_PASSWORD_LENGTH,
   OPTIONAL_CONFIG_KEYS,
 } from './config-fields.ts'
 import { LanGateway } from './gateway.ts'
@@ -677,6 +681,50 @@ export function apply(ctx: Context, config: ConfigRefs): void {
     manualOverride = enabled
   }
 
+  /**
+   * Apply a login-password change and reconcile the listener. One
+   * implementation behind both surfaces the operator has — the `lan_gateway`
+   * tool's `set-password` command and the Settings card's
+   * `/lan-gateway/password` route — so the epoch bump, the listener stop on a
+   * clear, and the first-password reconcile cannot diverge between them.
+   *
+   * The credential itself is never read back out: `state` holds a scrypt hash
+   * and salt, and neither is returned to a caller.
+   */
+  const applyPassword = async (password: string | undefined): Promise<ToolResult> => {
+    if (password !== undefined && password.length > 0 && password.length < MIN_PASSWORD_LENGTH) {
+      return { ok: false, message: `Password must be at least ${MIN_PASSWORD_LENGTH} characters.` }
+    }
+    const setting = password !== undefined && password.length > 0
+    const hadPassword = state.password !== undefined
+    state = await setPassword(state, setting ? password : undefined)
+    saveState(state)
+    gateway?.setState(state)
+    if (!setting) {
+      // Clearing the credential must not leave an open gateway serving
+      // sessions the old password authorized: stop the listener. A password
+      // is required to run, so a later enable fails closed.
+      await setRunIntent(false)
+      return enqueue('password cleared', async () => {
+        if (gateway !== undefined) await stopGateway()
+        lastError = 'Password cleared — the gateway listener was stopped (a password is required to run).'
+      }).then(() => ({
+        ok: true,
+        message: 'Password cleared. Session epoch advanced and the gateway listener was stopped — set a password before enabling it again.',
+      }))
+    }
+    // The first password turns a dormant "enabled but unpassworded" intent
+    // into a startable one, so reconcile: the listener was refused a moment
+    // ago for a reason that no longer holds. A later password change needs no
+    // reconcile (the listener is already running or already refused for some
+    // other reason), and reconciling anyway would be harmless but noisy.
+    if (!hadPassword) await syncGateway('password set')
+    return {
+      ok: true,
+      message: 'Password set. Session epoch advanced — every previously issued session is now invalid; all sources must sign in again.',
+    }
+  }
+
   // The tunables live in this plugin's own profile entry, and dsh 0.1.7 reaches
   // it by *entry id*: the `lan-gateway` settings namespace this plugin used to
   // register (and the scope handle it wrote through) no longer exist. The entry
@@ -735,28 +783,35 @@ export function apply(ctx: Context, config: ConfigRefs): void {
     void syncGateway('connection attach')
   })
 
-  // The Settings → Plugins card reads and writes through this loopback-only
-  // JSON route (ModLens-style: the browser never touches the settings seam
+  // The Settings → Plugins card reads and writes through these loopback-only
+  // JSON routes (ModLens-style: the browser never touches the settings seam
   // directly, so the card has no service dependencies to resolve). The gateway
-  // refuses to relay this prefix, so only the native loopback listener can
+  // refuses to relay this whole prefix, so only the native loopback listener can
   // reach it — a genuine local user, or a local process that could already read
   // ~/.dsh.
-  const configRouteHandler = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
-    const snapshot = (): Record<string, unknown> => {
-      const cfg = effective()
-      return {
-        config: cfg,
-        running: gateway !== undefined,
-        port: cfg.gatewayPort,
-        tls: tlsStatusLine(cfg),
-        upstreamSessionAvailable,
-        lastError: lastError ?? null,
-      }
-    }
-    const send = (status: number, body: unknown): void => {
-      res.writeHead(status, { 'content-type': 'application/json' })
-      res.end(JSON.stringify(body))
+  const sendJson = (res: ServerResponse, status: number, body: unknown): void => {
+    res.writeHead(status, { 'content-type': 'application/json' })
+    res.end(JSON.stringify(body))
+  }
+  /**
+   * What both card routes report. `passwordSet` is a boolean on purpose: the
+   * card must be able to say whether a credential exists without any part of
+   * that credential — not even its length — ever leaving this process.
+   */
+  const snapshot = (): Record<string, unknown> => {
+    const cfg = effective()
+    return {
+      config: cfg,
+      running: gateway !== undefined,
+      port: cfg.gatewayPort,
+      tls: tlsStatusLine(cfg),
+      upstreamSessionAvailable,
+      passwordSet: state.password !== undefined,
+      lastError: lastError ?? null,
     }
+  }
+  const configRouteHandler = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
+    const send = (status: number, body: unknown): void => sendJson(res, status, body)
     if (!isTrustedConfigRequest(req)) {
       send(403, { error: 'request refused: this route answers same-origin loopback requests only' })
       return
@@ -840,6 +895,58 @@ export function apply(ctx: Context, config: ConfigRefs): void {
     'dsh-lan-gateway: config route',
   )
 
+  // The card's password control, on its own loopback-only route. It cannot ride
+  // the config patch: the credential is a scrypt hash in `state.json`, not a
+  // settings key, and a key that reached `--dump-config` would be exactly the
+  // leak the state file exists to prevent. Same fence as the config route, so
+  // remote browsers (which the gateway answers 403 for this whole prefix) keep
+  // using the `lan_gateway` tool.
+  //
+  // This surface only *sets* a password. Clearing stops the listener by design,
+  // and a card button that silently takes remote access down is a footgun; the
+  // tool's `set-password` with an empty password remains the way to clear.
+  const passwordRouteHandler = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
+    if (!isTrustedConfigRequest(req)) {
+      sendJson(res, 403, { error: 'request refused: this route answers same-origin loopback requests only' })
+      return
+    }
+    if (req.method !== 'POST') {
+      sendJson(res, 405, { error: 'method not allowed' })
+      return
+    }
+    const body = await readBody(req, 4 * 1024, res)
+    if (body === undefined) return // response already sent (413/400)
+    let submitted: unknown
+    try {
+      submitted = JSON.parse(body)
+    } catch {
+      sendJson(res, 400, { error: 'invalid JSON body' })
+      return
+    }
+    const password = typeof submitted === 'object' && submitted !== null && !Array.isArray(submitted)
+      ? (submitted as Record<string, unknown>)['password']
+      : undefined
+    if (typeof password !== 'string' || password.length === 0) {
+      sendJson(res, 400, {
+        error: `password must be a non-empty string of at least ${MIN_PASSWORD_LENGTH} characters; `
+          + 'this route only sets one — use the lan_gateway tool to clear it',
+      })
+      return
+    }
+    const result = await applyPassword(password)
+    if (!result.ok) {
+      sendJson(res, 400, { error: result.message })
+      return
+    }
+    // The snapshot flips `passwordSet` for the card's status badge. Nothing here
+    // carries the password, its hash, or its length back to the browser.
+    sendJson(res, 200, snapshot())
+  }
+  ctx.effect(
+    () => ctx.webServer.register({ kind: 'exact', path: '/lan-gateway/password', handler: passwordRouteHandler }),
+    'dsh-lan-gateway: password route',
+  )
+
   const controller: GatewayController = {
     status(): ToolResult {
       const cfg = desiredConfig()
@@ -875,39 +982,7 @@ export function apply(ctx: Context, config: ConfigRefs): void {
       await syncGateway('tool disable')
       return { ok: true, message: 'Gateway disabled.' }
     },
-    async setPassword(password: string | undefined): Promise<ToolResult> {
-      if (password !== undefined && password.length > 0 && password.length < 8) {
-        return { ok: false, message: 'Password must be at least 8 characters.' }
-      }
-      const setting = password !== undefined && password.length > 0
-      const hadPassword = state.password !== undefined
-      state = await setPassword(state, setting ? password : undefined)
-      saveState(state)
-      gateway?.setState(state)
-      if (!setting) {
-        // Clearing the credential must not leave an open gateway serving
-        // sessions the old password authorized: stop the listener. A password
-        // is required to run, so a later enable fails closed.
-        await setRunIntent(false)
-        return enqueue('password cleared', async () => {
-          if (gateway !== undefined) await stopGateway()
-          lastError = 'Password cleared — the gateway listener was stopped (a password is required to run).'
-        }).then(() => ({
-          ok: true,
-          message: 'Password cleared. Session epoch advanced and the gateway listener was stopped — set a password before enabling it again.',
-        }))
-      }
-      // The first password turns a dormant "enabled but unpassworded" intent
-      // into a startable one, so reconcile: the listener was refused a moment
-      // ago for a reason that no longer holds. A later password change needs no
-      // reconcile (the listener is already running or already refused for some
-      // other reason), and reconciling anyway would be harmless but noisy.
-      if (!hadPassword) await syncGateway('password set')
-      return {
-        ok: true,
-        message: 'Password set. Session epoch advanced — every previously issued session is now invalid; all sources must sign in again.',
-      }
-    },
+    setPassword: applyPassword,
     rotateSecret(): ToolResult {
       const next: GatewayState = {
         cookieSecret: randomBytes(32).toString('base64'),