@s-gw/s-gw 0.1.0

package/dist/console-server.js

@@ -0,0 +1,978 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { executeApprovedRequest } from "./executor.js";
+import { requestAgentName } from "./agent-context.js";
+import { addLocalSecret, buildEnvCommandAction, preferredLocalSecretBackend, scanLocalText } from "./gateway.js";
+import { getAgentCodeGuardPlan, listAgentProfiles, renderAgentMcpSnippet, resolveAgentProfile } from "./agents.js";
+import { readinessForUnlock } from "./install.js";
+import { SecretStore } from "./store.js";
+import { unlockStatus } from "./unlock.js";
+const version = "0.1.0";
+const maxBodyBytes = 1024 * 1024;
+export async function startConsoleServer(options = {}) {
+    const host = options.host || "127.0.0.1";
+    const port = options.port ?? 8718;
+    const token = options.token || randomBytes(24).toString("base64url");
+    const store = options.store || new SecretStore();
+    const uiDir = options.uiDir || defaultUiDir();
+    await store.init();
+    const server = createServer((req, res) => {
+        handleRequest(req, res, store, token, uiDir).catch((error) => {
+            sendError(res, error);
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, host, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    const address = server.address();
+    const shownHost = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
+    const url = `http://${shownHost}:${address.port}/`;
+    return {
+        url,
+        token,
+        server,
+        close: () => closeServer(server)
+    };
+}
+async function closeServer(server) {
+    await new Promise((resolve, reject) => {
+        server.close((err) => (err ? reject(err) : resolve()));
+        server.closeIdleConnections();
+        setTimeout(() => {
+            server.closeAllConnections();
+        }, 250).unref();
+    });
+}
+async function handleRequest(req, res, store, token, uiDir) {
+    const url = new URL(req.url || "/", "http://127.0.0.1");
+    if (url.pathname.startsWith("/api/")) {
+        if (url.pathname !== "/api/health" && !validConsoleToken(req, token)) {
+            throw new HttpError(403, "Missing or invalid local console token.");
+        }
+        await handleApi(req, res, url, store);
+        return;
+    }
+    if (url.pathname === "/favicon.ico") {
+        res.writeHead(204, { "Cache-Control": "no-store" });
+        res.end();
+        return;
+    }
+    await serveUi(req, res, url.pathname, uiDir, token);
+}
+async function handleApi(req, res, url, store) {
+    if (req.method === "GET" && url.pathname === "/api/health") {
+        sendJson(res, 200, { ok: true, name: "s-gw", version });
+        return;
+    }
+    if (req.method === "GET" && url.pathname === "/api/state") {
+        sendJson(res, 200, await buildState(store));
+        return;
+    }
+    if (req.method === "GET" && url.pathname === "/api/audit.csv") {
+        sendCsv(res, await auditCsv(store));
+        return;
+    }
+    if (req.method === "GET" && url.pathname === "/api/approval") {
+        sendJson(res, 200, await store.getApprovalSettings());
+        return;
+    }
+    if (req.method === "GET" && url.pathname === "/api/approval/grants") {
+        sendJson(res, 200, await store.listApprovalGrants());
+        return;
+    }
+    if (req.method === "GET" && url.pathname === "/api/approval/policies") {
+        sendJson(res, 200, await store.listApprovalPolicyRules());
+        return;
+    }
+    if (req.method === "POST" && url.pathname === "/api/approval/policies") {
+        const body = await readJson(req);
+        sendJson(res, 200, await store.addApprovalPolicyRule({
+            name: optionalString(body.name),
+            enabled: body.enabled !== false,
+            priority: optionalNumberValue(body.priority),
+            decision: approvalPolicyDecision(body.decision),
+            expiresAt: optionalString(body.expiresAt),
+            durationMs: optionalNumberValue(body.durationMs),
+            conditions: {
+                handles: stringArray(body.handles),
+                secretTypes: stringArray(body.secretTypes).map(secretType),
+                providers: stringArray(body.providers),
+                minSeverity: optionalSecretSeverity(body.minSeverity),
+                agents: stringArray(body.agents),
+                actionKinds: stringArray(body.actionKinds).map(approvalPolicyActionKind),
+                commands: stringArray(body.commands),
+                injectEnvs: stringArray(body.injectEnvs),
+                workingDirs: stringArray(body.workingDirs),
+                sshTargets: stringArray(body.sshTargets),
+                sshPorts: stringArray(body.sshPorts).map((item) => Number(item))
+            }
+        }));
+        return;
+    }
+    if (req.method === "DELETE" && url.pathname === "/api/approval/grants") {
+        sendJson(res, 200, await store.clearApprovalGrants());
+        return;
+    }
+    const approvalGrantMatch = url.pathname.match(/^\/api\/approval\/grants\/([^/]+)$/);
+    if (req.method === "DELETE" && approvalGrantMatch) {
+        sendJson(res, 200, await store.revokeApprovalGrant(decodeURIComponent(approvalGrantMatch[1])));
+        return;
+    }
+    const approvalPolicyMatch = url.pathname.match(/^\/api\/approval\/policies\/([^/]+)$/);
+    if (approvalPolicyMatch) {
+        const id = decodeURIComponent(approvalPolicyMatch[1]);
+        if (req.method === "DELETE") {
+            sendJson(res, 200, await store.deleteApprovalPolicyRule(id));
+            return;
+        }
+        if (req.method === "PATCH") {
+            const body = await readJson(req);
+            if (typeof body.enabled !== "boolean") {
+                throw new HttpError(400, "enabled must be a boolean.");
+            }
+            sendJson(res, 200, await store.setApprovalPolicyRuleEnabled(id, body.enabled));
+            return;
+        }
+    }
+    if (req.method === "POST" && url.pathname === "/api/approval") {
+        const body = await readJson(req);
+        sendJson(res, 200, await store.setApprovalSettings({
+            mode: approvalMode(body.mode),
+            durationMs: numberValue(body.durationMs, 15 * 60 * 1000)
+        }));
+        return;
+    }
+    if (req.method === "POST" && url.pathname === "/api/scan") {
+        const body = await readJson(req);
+        const text = stringValue(body.text, "text");
+        const persist = body.persist === true;
+        const source = optionalString(body.source);
+        sendJson(res, 200, await scanLocalText(store, text, { persist, source, backend: localBackendValue(body.backend) }));
+        return;
+    }
+    if (req.method === "POST" && url.pathname === "/api/secrets") {
+        const body = await readJson(req);
+        const record = await addLocalSecret(store, {
+            name: stringValue(body.name, "name"),
+            type: secretType(body.type),
+            provider: optionalString(body.provider),
+            value: stringValue(body.value, "value"),
+            source: optionalString(body.source),
+            service: optionalString(body.service),
+            policy: {
+                injectEnv: optionalString(body.injectEnv),
+                allowedCommands: stringList(body.allowedCommands),
+                maxOutputBytes: numberValue(body.maxOutputBytes, 16_384)
+            }
+        }, localBackendValue(body.backend));
+        sendJson(res, 201, {
+            handle: record.handle,
+            name: record.name,
+            type: record.type,
+            provider: record.provider,
+            backend: record.backend,
+            policy: record.policy
+        });
+        return;
+    }
+    const secretMatch = url.pathname.match(/^\/api\/secrets\/([^/]+)$/);
+    if (req.method === "DELETE" && secretMatch) {
+        const handle = decodeURIComponent(secretMatch[1]);
+        sendJson(res, 200, await store.deleteSecret(handle));
+        return;
+    }
+    if (req.method === "POST" && url.pathname === "/api/requests") {
+        const body = await readJson(req);
+        const action = buildEnvCommandAction({
+            command: stringValue(body.command, "command"),
+            args: stringList(body.args),
+            injectEnv: stringValue(body.injectEnv, "injectEnv"),
+            env: envBindingList(body.env),
+            workingDir: optionalString(body.workingDir),
+            timeoutMs: numberValue(body.timeoutMs, 30_000)
+        });
+        const request = await store.createRequest(stringValue(body.handle, "handle"), action, optionalString(body.reason) || "Local console request", {
+            agentName: optionalString(body.agentName),
+            env: {}
+        });
+        sendJson(res, 201, request);
+        return;
+    }
+    const match = url.pathname.match(/^\/api\/requests\/([^/]+)\/(approve|deny|execute|recover)$/);
+    if (req.method === "POST" && match) {
+        const id = decodeURIComponent(match[1]);
+        const action = match[2];
+        if (action === "approve") {
+            const body = await readJson(req);
+            sendJson(res, 200, await store.approveRequest(id, {
+                mode: optionalApprovalMode(body.mode),
+                durationMs: optionalNumberValue(body.durationMs),
+                agentScope: optionalApprovalAgentScope(body.agentScope)
+            }));
+            return;
+        }
+        if (action === "deny") {
+            sendJson(res, 200, await store.denyRequest(id));
+            return;
+        }
+        if (action === "recover") {
+            const recovered = await store.forceRecoverExecutions(id);
+            sendJson(res, 200, recovered[0]);
+            return;
+        }
+        sendJson(res, 200, await executeApprovedRequest(store, id));
+        return;
+    }
+    throw new HttpError(404, "Unknown console API route.");
+}
+async function buildState(store) {
+    const handles = await store.listHandles();
+    const requests = await store.listRequests();
+    const audit = await store.auditLog();
+    const approvalSettings = await store.getApprovalSettings();
+    const approvalGrants = await store.listApprovalGrants();
+    const approvalPolicyRules = await store.listApprovalPolicyRules();
+    const pending = requests.filter((request) => request.state === "pending");
+    const highRisk = handles.filter((handle) => handle.severity === "high" || handle.severity === "critical");
+    const agents = listAgentProfiles();
+    const unlock = unlockStatus();
+    const readiness = readinessForUnlock(unlock.activeSource !== "none");
+    const usageFlow = buildUsageFlow(requests, handles);
+    return {
+        version,
+        ready: readiness.ok,
+        readiness,
+        status: {
+            daemonRunning: true,
+            storePath: store.storePath,
+            unlock
+        },
+        metrics: {
+            localSecrets: handles.length,
+            pendingApprovals: pending.length,
+            activeAgents: agents.length,
+            highRiskFindings: highRisk.length
+        },
+        handles,
+        approvalSettings,
+        approvalGrants,
+        approvalPolicyRules,
+        usageFlow,
+        credentials: groupHandles(handles),
+        requests: sortRequests(requests),
+        pendingRequests: sortRequests(pending),
+        audit: [...audit].reverse(),
+        agents: agents.map((agent) => {
+            const profile = resolveAgentProfile(agent.id);
+            return {
+                id: agent.id,
+                name: agent.displayName,
+                status: agent.mcpStatus,
+                aliases: profile.aliases,
+                mcp: {
+                    supported: profile.mcp.supported,
+                    format: profile.mcp.snippet,
+                    writeMode: profile.mcp.writeMode,
+                    configPaths: profile.mcp.configPaths,
+                    notes: profile.mcp.notes,
+                    snippet: profile.mcp.supported ? renderAgentMcpSnippet(profile.id) : null
+                },
+                skills: profile.skills,
+                plugins: profile.plugins,
+                hooks: {
+                    supported: profile.hooks?.supported || false,
+                    kind: profile.hooks?.kind || "none",
+                    configPaths: profile.hooks?.configPaths || [],
+                    events: profile.hooks?.events || [],
+                    notes: profile.hooks?.notes || []
+                },
+                limitations: profile.limitations,
+                codeGuard: getAgentCodeGuardPlan(profile.id),
+                snippetCommand: `s-gw agent mcp-snippet ${profile.id}`,
+                guardCommand: `s-gw run ${profile.id}`
+            };
+        })
+    };
+}
+function groupHandles(handles) {
+    const grouped = new Map();
+    for (const handle of handles) {
+        const provider = handle.provider || providerForType(handle.type);
+        const existing = grouped.get(provider);
+        if (!existing) {
+            grouped.set(provider, {
+                provider,
+                label: providerLabel(provider),
+                prefix: handlePrefix(provider, handle.type),
+                secrets: 1,
+                severity: handle.severity || "low",
+                lastUsed: handle.updatedAt
+            });
+            continue;
+        }
+        existing.secrets += 1;
+        existing.severity = higherSeverity(existing.severity, handle.severity || "low");
+        if (!existing.lastUsed || handle.updatedAt > existing.lastUsed) {
+            existing.lastUsed = handle.updatedAt;
+        }
+    }
+    return [...grouped.values()].sort((a, b) => a.label.localeCompare(b.label));
+}
+function sortRequests(requests) {
+    return [...requests].sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+}
+function buildUsageFlow(requests, handles) {
+    const handlesById = new Map(handles.map((handle) => [handle.handle, handle]));
+    const nodeCounts = new Map();
+    const linkCounts = new Map();
+    const rowCounts = new Map();
+    const entries = [];
+    for (const request of requests) {
+        const handle = handlesById.get(request.handle);
+        const agent = request.agentName || requestAgentName(request.reason);
+        const credential = handle?.name || request.handle;
+        const authType = authTypeLabel(handle);
+        const authTypeId = `auth:${authTypeKey(handle)}`;
+        const targetType = targetTypeLabel(request.action);
+        const targetTypeId = `target:${targetTypeKey(request.action)}`;
+        const action = actionLabel(request.action);
+        const command = commandBase(request.action.command);
+        const target = actionTarget(request.action);
+        const agentId = `agent:${agent}`;
+        bumpNode(nodeCounts, agentId, "agent", agent, "Requesting agent");
+        bumpNode(nodeCounts, authTypeId, "auth", authType, authTypeDetail(handle));
+        bumpNode(nodeCounts, targetTypeId, "target", targetType, targetTypeDetail(request.action));
+        bumpLink(linkCounts, agentId, authTypeId);
+        bumpLink(linkCounts, authTypeId, targetTypeId);
+        entries.push({
+            requestId: request.id,
+            agentId,
+            agent,
+            authTypeId,
+            authType,
+            targetTypeId,
+            targetType,
+            credential,
+            action,
+            command,
+            target,
+            state: request.state,
+            lastSeen: request.updatedAt
+        });
+        const rowKey = `${agent}\n${authType}\n${targetType}`;
+        let row = rowCounts.get(rowKey);
+        if (!row) {
+            row = {
+                agentId,
+                agent,
+                authTypeId,
+                authType,
+                targetTypeId,
+                targetType,
+                handle: request.handle,
+                credential,
+                action,
+                command,
+                target,
+                handles: [],
+                credentials: [],
+                actions: [],
+                targets: [],
+                count: 0,
+                lastSeen: request.updatedAt,
+                states: emptyStateCounts()
+            };
+            rowCounts.set(rowKey, row);
+        }
+        row.count += 1;
+        row.states[request.state] += 1;
+        addFlowExample(row.handles, shortHandle(request.handle));
+        addFlowExample(row.credentials, credential);
+        addFlowExample(row.actions, action);
+        addFlowExample(row.targets, target);
+        if (request.updatedAt > row.lastSeen) {
+            row.lastSeen = request.updatedAt;
+        }
+    }
+    return {
+        generatedAt: new Date().toISOString(),
+        totalRequests: requests.length,
+        nodes: [...nodeCounts.values()].sort((a, b) => b.count - a.count || a.label.localeCompare(b.label)),
+        links: [...linkCounts.values()].sort((a, b) => b.value - a.value || a.source.localeCompare(b.source)),
+        rows: [...rowCounts.values()].sort((a, b) => b.count - a.count || b.lastSeen.localeCompare(a.lastSeen)),
+        entries: entries.sort((a, b) => b.lastSeen.localeCompare(a.lastSeen))
+    };
+}
+function emptyStateCounts() {
+    return {
+        pending: 0,
+        approved: 0,
+        executing: 0,
+        denied: 0,
+        executed: 0,
+        failed: 0
+    };
+}
+function bumpNode(nodes, id, kind, label, detail) {
+    const existing = nodes.get(id);
+    if (existing) {
+        existing.count += 1;
+        return;
+    }
+    nodes.set(id, { id, kind, label, detail, count: 1 });
+}
+function bumpLink(links, source, target) {
+    const key = `${source}\n${target}`;
+    const existing = links.get(key);
+    if (existing) {
+        existing.value += 1;
+        return;
+    }
+    links.set(key, { source, target, value: 1 });
+}
+function addFlowExample(values, value) {
+    const cleaned = String(value || "").trim();
+    if (!cleaned || values.includes(cleaned) || values.length >= 4) {
+        return;
+    }
+    values.push(cleaned);
+}
+function authTypeKey(handle) {
+    return normalizeFlowKey(authTypeLabel(handle));
+}
+function authTypeLabel(handle) {
+    const provider = String(handle?.provider || "").toLowerCase();
+    const name = String(handle?.name || "").toLowerCase();
+    const source = String(handle?.source || "").toLowerCase();
+    const envName = String(handle?.policy.injectEnv || "").toLowerCase();
+    const haystack = `${provider} ${name} ${source} ${envName}`;
+    if (provider === "aws" || handle?.type === "access-key" || /\baws\b|amazon|access[_ -]?key|secret[_ -]?access/.test(haystack)) {
+        return "AWS access key";
+    }
+    if (provider === "github" || /\bgithub\b|\bgh\b|ghp_|github[_ -]?token/.test(haystack)) {
+        return "GitHub token";
+    }
+    if (provider === "openai" || /openai|sk-/.test(haystack)) {
+        return "OpenAI API key";
+    }
+    if (provider === "ssh" || /ssh|bastion|private[_ -]?key|rsa|ed25519/.test(haystack)) {
+        return handle?.type === "password" ? "SSH password" : "SSH private key";
+    }
+    if (handle?.type === "private-key" || handle?.type === "ssh-key") {
+        return "Private key";
+    }
+    if (handle?.type === "password") {
+        return "Password";
+    }
+    if (handle?.type === "api-token") {
+        return "API token";
+    }
+    if (handle?.type === "credential") {
+        return "Credential pair";
+    }
+    return "Unknown credential";
+}
+function authTypeDetail(handle) {
+    const parts = [];
+    if (handle?.severity) {
+        parts.push(`${handle.severity} risk`);
+    }
+    if (handle?.backend) {
+        parts.push(`stored in ${flowProviderLabel(handle.backend)}`);
+    }
+    return parts.join(" / ") || "Authentication type";
+}
+function targetTypeKey(action) {
+    return normalizeFlowKey(targetTypeLabel(action));
+}
+function targetTypeLabel(action) {
+    if (sshDestination(action)) {
+        return "SSH server";
+    }
+    const command = commandBase(action.command).toLowerCase();
+    const target = actionTarget(action).toLowerCase();
+    const args = action.args.join(" ").toLowerCase();
+    const envName = action.injectEnv.toLowerCase();
+    const haystack = `${command} ${target} ${args} ${envName}`;
+    if (command === "aws" || /\baws\b|\bec2\b|\bs3\b|\bsts\b|cloudformation|securityhub|iam\b/.test(haystack)) {
+        return "AWS API";
+    }
+    if (command === "gh" || command === "github" || /github|pull request|\brepo\b/.test(haystack)) {
+        return "GitHub repository";
+    }
+    if (command === "kubectl" || /kubernetes|kubeconfig|namespace/.test(haystack)) {
+        return "Kubernetes cluster";
+    }
+    if (command === "docker" || command === "podman" || /container|image|compose/.test(haystack)) {
+        return "Container runtime";
+    }
+    if (command === "curl" || command === "wget" || target.startsWith("http://") || target.startsWith("https://") || args.includes("http://") || args.includes("https://")) {
+        return "Web API";
+    }
+    if (command === "psql" || command === "mysql" || command === "redis-cli" || /database|postgres|mysql|redis/.test(haystack)) {
+        return "Database";
+    }
+    if (/\bnas\b|network.?attached.?storage|storage.?appliance|file.?server/.test(haystack)) {
+        return "NAS / appliance";
+    }
+    if (action.kind === "env_command") {
+        return "Local command";
+    }
+    return "Other target";
+}
+function targetTypeDetail(action) {
+    const target = actionTarget(action);
+    if (target && target !== "local command") {
+        return target;
+    }
+    return commandBase(action.command);
+}
+function flowProviderLabel(provider) {
+    const value = provider || "generic";
+    if (value === "aws")
+        return "AWS";
+    if (value === "github")
+        return "GitHub";
+    if (value === "openai")
+        return "OpenAI";
+    if (value === "ssh")
+        return "SSH";
+    if (value === "onepassword")
+        return "1Password";
+    if (value === "keychain" || value === "macos-keychain")
+        return "macOS Keychain";
+    if (value === "windows-credential-manager")
+        return "Windows Credential Manager";
+    return titleCase(value);
+}
+function normalizeFlowKey(value) {
+    return String(value || "unknown").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "unknown";
+}
+function titleCase(value) {
+    return String(value || "unknown")
+        .split(/[-_\s]+/)
+        .filter(Boolean)
+        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+        .join(" ");
+}
+function actionLabel(action) {
+    const command = action.kind === "ssh_session" ? "ssh" : commandBase(action.command);
+    const target = actionTarget(action);
+    if (!target || target === "local command") {
+        return command;
+    }
+    return `${command} -> ${target}`;
+}
+function actionTarget(action) {
+    const sshTarget = sshDestination(action);
+    if (sshTarget)
+        return sshTarget;
+    if (action.workingDir) {
+        return action.workingDir;
+    }
+    if (action.args[0] === "-e") {
+        return `${commandBase(action.command)} inline script`;
+    }
+    for (const arg of action.args) {
+        if (arg && !arg.startsWith("-")) {
+            return arg;
+        }
+    }
+    return action.injectEnv || "local command";
+}
+const sshOptionsWithValue = new Set([
+    "-b", "-c", "-D", "-E", "-e", "-F", "-I", "-i", "-J", "-L", "-l", "-m", "-O", "-o", "-p", "-Q", "-R", "-S", "-W", "-w"
+]);
+function sshDestination(action) {
+    if (action.kind === "ssh_session" && action.ssh?.target) {
+        return action.ssh.port && action.ssh.port !== 22 ? `${action.ssh.target}:${action.ssh.port}` : action.ssh.target;
+    }
+    if (commandBase(action.command).toLowerCase() !== "ssh")
+        return undefined;
+    let skipNext = false;
+    for (const arg of action.args) {
+        if (skipNext) {
+            skipNext = false;
+            continue;
+        }
+        if (sshOptionsWithValue.has(arg)) {
+            skipNext = true;
+            continue;
+        }
+        if (arg === "--" || arg.startsWith("-"))
+            continue;
+        return arg;
+    }
+    return undefined;
+}
+function commandBase(command) {
+    const normalized = String(command || "").replace(/\\/g, "/");
+    const parts = normalized.split("/");
+    return parts[parts.length - 1] || normalized || "local command";
+}
+function shortHandle(handle) {
+    if (handle.length <= 34) {
+        return handle;
+    }
+    return `${handle.slice(0, 18)}...${handle.slice(-8)}`;
+}
+async function auditCsv(store) {
+    const audit = await store.auditLog();
+    const rows = [["time", "event", "handle", "request", "message"]];
+    for (const event of audit) {
+        rows.push([event.ts, event.type, event.handle || "", event.requestId || "", event.message]);
+    }
+    return rows.map((row) => row.map(csvCell).join(",")).join("\n") + "\n";
+}
+async function serveUi(req, res, pathname, uiDir, token) {
+    if (req.method !== "GET" && req.method !== "HEAD") {
+        throw new HttpError(405, "Only GET is supported for local console assets.");
+    }
+    const safeRoot = path.resolve(uiDir);
+    let relative = uiRelativePath(pathname, uiDir);
+    let target = path.resolve(uiDir, relative);
+    if (target !== safeRoot && !target.startsWith(`${safeRoot}${path.sep}`)) {
+        throw new HttpError(403, "Path is outside the local console directory.");
+    }
+    if (!existsSync(target) && shouldServeSpaFallback(pathname, uiDir)) {
+        relative = "index.html";
+        target = path.resolve(uiDir, relative);
+    }
+    let body = await readFile(target);
+    if (path.basename(target) === "local-console.html" || path.basename(target) === "index.html") {
+        body = Buffer.from(injectConsoleToken(body.toString("utf8"), token));
+    }
+    res.writeHead(200, {
+        "Content-Type": contentType(target),
+        "Cache-Control": "no-store"
+    });
+    if (req.method === "HEAD") {
+        res.end();
+        return;
+    }
+    res.end(body);
+}
+function uiRelativePath(pathname, uiDir) {
+    if (pathname === "/" || pathname === "") {
+        return existsSync(path.join(uiDir, "index.html")) ? "index.html" : "local-console.html";
+    }
+    let cleaned = decodeURIComponent(pathname).replace(/^\/+/, "");
+    cleaned = cleaned.replace(/^docs\/ui\//, "");
+    return cleaned || (existsSync(path.join(uiDir, "index.html")) ? "index.html" : "local-console.html");
+}
+function shouldServeSpaFallback(pathname, uiDir) {
+    if (!existsSync(path.join(uiDir, "index.html"))) {
+        return false;
+    }
+    const cleaned = decodeURIComponent(pathname || "").replace(/^\/+/, "");
+    if (!cleaned) {
+        return true;
+    }
+    const ext = path.extname(cleaned);
+    return ext === "";
+}
+function injectConsoleToken(html, token) {
+    const script = `<script>window.SGW_CONSOLE_TOKEN=${JSON.stringify(token)};window.SGW_CONSOLE_LIVE=true;</script>`;
+    return html.includes("</head>") ? html.replace("</head>", `${script}\n</head>`) : `${script}\n${html}`;
+}
+async function readJson(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += buffer.byteLength;
+        if (size > maxBodyBytes) {
+            throw new HttpError(413, "Request body is too large.");
+        }
+        chunks.push(buffer);
+    }
+    if (chunks.length === 0) {
+        return {};
+    }
+    const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new HttpError(400, "JSON body must be an object.");
+    }
+    return parsed;
+}
+function validConsoleToken(req, expected) {
+    const header = req.headers["x-sgw-console-token"];
+    const token = Array.isArray(header) ? header[0] : header;
+    if (!token || token.length !== expected.length) {
+        return false;
+    }
+    return timingSafeEqual(Buffer.from(token), Buffer.from(expected));
+}
+function stringValue(value, name) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new HttpError(400, `${name} is required.`);
+    }
+    return value;
+}
+function optionalString(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function localBackendValue(value) {
+    if (value === undefined || value === null || value === "") {
+        return preferredLocalSecretBackend();
+    }
+    if (value === "local" || value === "keychain") {
+        return value;
+    }
+    throw new HttpError(400, "backend must be either local or keychain.");
+}
+function stringList(value) {
+    if (value === undefined) {
+        return [];
+    }
+    if (!Array.isArray(value)) {
+        throw new HttpError(400, "Expected an array of strings.");
+    }
+    const out = [];
+    for (const item of value) {
+        if (typeof item !== "string") {
+            throw new HttpError(400, "Expected an array of strings.");
+        }
+        out.push(item);
+    }
+    return out;
+}
+function envBindingList(value) {
+    if (value === undefined) {
+        return [];
+    }
+    if (!Array.isArray(value)) {
+        throw new HttpError(400, "env must be an array of {handle, injectEnv} objects.");
+    }
+    return value.map((item) => {
+        if (!item || typeof item !== "object" || Array.isArray(item)) {
+            throw new HttpError(400, "env must be an array of {handle, injectEnv} objects.");
+        }
+        const record = item;
+        return {
+            handle: stringValue(record.handle, "env.handle"),
+            injectEnv: stringValue(record.injectEnv, "env.injectEnv")
+        };
+    });
+}
+function numberValue(value, fallback) {
+    if (value === undefined || value === null || value === "") {
+        return fallback;
+    }
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed)) {
+        throw new HttpError(400, "Expected a finite number.");
+    }
+    return parsed;
+}
+function secretType(input) {
+    const allowed = [
+        "api-token",
+        "ssh-key",
+        "private-key",
+        "password",
+        "credential",
+        "access-key",
+        "unknown"
+    ];
+    return allowed.includes(input) ? input : "unknown";
+}
+function approvalMode(input) {
+    if (input === "per-transaction" || input === "timed-session" || input === "login-session" || input === "always") {
+        return input;
+    }
+    throw new HttpError(400, "mode must be per-transaction, timed-session, login-session, or always.");
+}
+function approvalPolicyDecision(input) {
+    if (input === "ask" || input === "allow" || input === "deny") {
+        return input;
+    }
+    throw new HttpError(400, "decision must be ask, allow, or deny.");
+}
+function approvalPolicyActionKind(input) {
+    if (input === "env_command" || input === "env-command" || input === "command") {
+        return "env_command";
+    }
+    if (input === "ssh_session" || input === "ssh-session" || input === "ssh") {
+        return "ssh_session";
+    }
+    throw new HttpError(400, "actionKinds must contain env_command or ssh_session.");
+}
+function optionalApprovalMode(input) {
+    if (input === undefined || input === null || input === "") {
+        return undefined;
+    }
+    return approvalMode(input);
+}
+function optionalApprovalAgentScope(input) {
+    if (input === undefined || input === null || input === "") {
+        return undefined;
+    }
+    if (input === "same-agent" || input === "any-agent") {
+        return input;
+    }
+    throw new HttpError(400, "agentScope must be same-agent or any-agent.");
+}
+function optionalSecretSeverity(input) {
+    if (input === undefined || input === null || input === "") {
+        return undefined;
+    }
+    if (input === "low" || input === "medium" || input === "high" || input === "critical") {
+        return input;
+    }
+    throw new HttpError(400, "minSeverity must be low, medium, high, or critical.");
+}
+function stringArray(input) {
+    if (input === undefined || input === null || input === "") {
+        return [];
+    }
+    if (Array.isArray(input) && input.every((item) => typeof item === "string")) {
+        return input;
+    }
+    throw new HttpError(400, "Expected an array of strings.");
+}
+function optionalNumberValue(value) {
+    if (value === undefined || value === null || value === "") {
+        return undefined;
+    }
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed)) {
+        throw new HttpError(400, "Expected a finite number.");
+    }
+    return parsed;
+}
+function providerForType(type) {
+    if (type === "private-key" || type === "ssh-key") {
+        return "ssh";
+    }
+    if (type === "unknown") {
+        return "generic";
+    }
+    return type;
+}
+function providerLabel(provider) {
+    const known = {
+        aws: "AWS",
+        github: "GitHub",
+        openai: "OpenAI",
+        ssh: "SSH",
+        "1password": "1Password",
+        onepassword: "1Password",
+        generic: "Generic",
+        keychain: "macOS Keychain",
+        "macos-keychain": "macOS Keychain",
+        "windows-credential-manager": "Windows Credential Manager",
+        "api-token": "API Tokens",
+        credential: "Credentials"
+    };
+    return known[provider] || provider.replace(/(^|-)([a-z])/g, (_match, dash, char) => {
+        return `${dash ? " " : ""}${char.toUpperCase()}`;
+    });
+}
+function handlePrefix(provider, type) {
+    if (provider && provider !== "generic") {
+        return `s-gw:${provider}`;
+    }
+    return `s-gw:${type}`;
+}
+function higherSeverity(a, b) {
+    const rank = {
+        low: 0,
+        medium: 1,
+        high: 2,
+        critical: 3
+    };
+    return rank[b] > rank[a] ? b : a;
+}
+function csvCell(value) {
+    return `"${value.replace(/"/g, '""')}"`;
+}
+function contentType(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (ext === ".html") {
+        return "text/html; charset=utf-8";
+    }
+    if (ext === ".css") {
+        return "text/css; charset=utf-8";
+    }
+    if (ext === ".js") {
+        return "text/javascript; charset=utf-8";
+    }
+    if (ext === ".png") {
+        return "image/png";
+    }
+    if (ext === ".svg") {
+        return "image/svg+xml";
+    }
+    if (ext === ".woff2") {
+        return "font/woff2";
+    }
+    if (ext === ".md") {
+        return "text/markdown; charset=utf-8";
+    }
+    return "application/octet-stream";
+}
+function defaultUiDir() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const builtReactCandidates = [
+        path.resolve(here, "console-ui"),
+        path.resolve(here, "..", "dist", "console-ui")
+    ];
+    for (const candidate of builtReactCandidates) {
+        if (isBuiltReactUi(candidate)) {
+            return candidate;
+        }
+    }
+    return path.resolve(here, "..", "docs", "ui");
+}
+function isBuiltReactUi(candidate) {
+    return existsSync(path.join(candidate, "index.html")) && existsSync(path.join(candidate, "assets"));
+}
+function sendJson(res, status, value) {
+    res.writeHead(status, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Cache-Control": "no-store"
+    });
+    res.end(`${JSON.stringify(value, null, 2)}\n`);
+}
+function sendCsv(res, csv) {
+    res.writeHead(200, {
+        "Content-Type": "text/csv; charset=utf-8",
+        "Content-Disposition": 'attachment; filename="s-gw-audit.csv"',
+        "Cache-Control": "no-store"
+    });
+    res.end(csv);
+}
+function sendError(res, error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const status = error instanceof HttpError ? error.status : statusForErrorMessage(message);
+    sendJson(res, status, { error: message });
+}
+function statusForErrorMessage(message) {
+    if (/unknown (secret handle|request)/i.test(message)) {
+        return 404;
+    }
+    if (/approval|approved|pending|denied|executed|failed/i.test(message)) {
+        return 409;
+    }
+    if (/not allowed|invalid|required|missing|empty/i.test(message)) {
+        return 400;
+    }
+    return 500;
+}
+class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+//# sourceMappingURL=console-server.js.map