@spacebar_ai/moldclaw-core 2026.3.41 → 2026.3.44

package/dist/gateway-install-token-CNv17ac9.js

@@ -1,163 +0,0 @@
-import { DE as loadAuthProfileStoreForSecretsRuntime } from "./auth-profiles-1kPLbBwI.js";
-import { f as readConfigFileSnapshot, gn as collectConfigServiceEnvVars, y as writeConfigFile } from "./io-CMfWWPXQ.js";
-import { a as hasConfiguredSecretInput, d as resolveSecretInputRef } from "./types.secrets-Ca-9L8vU.js";
-import { u as secretRefKey } from "./ref-contract-4C9nIZsw.js";
-import { i as resolveSecretRefValues } from "./resolve-PSlwZjg3.js";
-import { m as resolveGatewayAuth } from "./config-BwkGZjD5.js";
-import { t as formatCliCommand } from "./command-format-C_z0Ru-7.js";
-import { d as readGatewayTokenEnv } from "./credentials-D-5Pb-aZ.js";
-import { ct as hasAmbiguousGatewayAuthModeConfig } from "./routes-4k2kpvoT.js";
-import { l as resolveGatewayLaunchAgentLabel } from "./constants-BHwb0DmS.js";
-import { n as resolveDaemonInstallRuntimeInputs, r as resolveGatewayProgramArguments, t as emitDaemonInstallRuntimeWarning } from "./daemon-install-plan.shared-so6KadNd.js";
-import { l as buildServiceEnvironment } from "./runtime-paths-BfFqPvDh.js";
-import { m as randomToken } from "./onboard-helpers-BK0Hsb7Y.js";
-//#region src/commands/daemon-install-helpers.ts
-function collectAuthProfileServiceEnvVars(params) {
-	const authStore = params.authStore ?? loadAuthProfileStoreForSecretsRuntime();
-	const entries = {};
-	for (const credential of Object.values(authStore.profiles)) {
-		const ref = credential.type === "api_key" ? credential.keyRef : credential.type === "token" ? credential.tokenRef : void 0;
-		if (!ref || ref.source !== "env") continue;
-		const value = params.env[ref.id]?.trim();
-		if (!value) continue;
-		entries[ref.id] = value;
-	}
-	return entries;
-}
-async function buildGatewayInstallPlan(params) {
-	const { devMode, nodePath } = await resolveDaemonInstallRuntimeInputs({
-		env: params.env,
-		runtime: params.runtime,
-		devMode: params.devMode,
-		nodePath: params.nodePath
-	});
-	const { programArguments, workingDirectory } = await resolveGatewayProgramArguments({
-		port: params.port,
-		dev: devMode,
-		runtime: params.runtime,
-		nodePath
-	});
-	await emitDaemonInstallRuntimeWarning({
-		env: params.env,
-		runtime: params.runtime,
-		programArguments,
-		warn: params.warn,
-		title: "Gateway runtime"
-	});
-	const serviceEnvironment = buildServiceEnvironment({
-		env: params.env,
-		port: params.port,
-		launchdLabel: process.platform === "darwin" ? resolveGatewayLaunchAgentLabel(params.env.MOLDCLAW_PROFILE) : void 0
-	});
-	const environment = {
-		...collectConfigServiceEnvVars(params.config),
-		...collectAuthProfileServiceEnvVars({
-			env: params.env,
-			authStore: params.authStore
-		})
-	};
-	Object.assign(environment, serviceEnvironment);
-	return {
-		programArguments,
-		workingDirectory,
-		environment
-	};
-}
-function gatewayInstallErrorHint(platform = process.platform) {
-	return platform === "win32" ? "Tip: native Windows now falls back to a per-user Startup-folder login item when Scheduled Task creation is denied; if install still fails, rerun from an elevated PowerShell or skip service install." : `Tip: rerun \`${formatCliCommand("moldclaw gateway install")}\` after fixing the error.`;
-}
-//#endregion
-//#region src/gateway/auth-install-policy.ts
-function shouldRequireGatewayTokenForInstall(cfg, _env) {
-	const mode = cfg.gateway?.auth?.mode;
-	if (mode === "token") return true;
-	if (mode === "password" || mode === "none" || mode === "trusted-proxy") return false;
-	if (hasConfiguredSecretInput(cfg.gateway?.auth?.password, cfg.secrets?.defaults)) return false;
-	const configServiceEnv = collectConfigServiceEnvVars(cfg);
-	if (Boolean(configServiceEnv.MOLDCLAW_GATEWAY_PASSWORD?.trim() || configServiceEnv.MOLDCLAW_GATEWAY_PASSWORD?.trim())) return false;
-	return true;
-}
-//#endregion
-//#region src/commands/gateway-install-token.ts
-function formatAmbiguousGatewayAuthModeReason() {
-	return ["gateway.auth.token and gateway.auth.password are both configured while gateway.auth.mode is unset.", `Set ${formatCliCommand("moldclaw config set gateway.auth.mode token")} or ${formatCliCommand("moldclaw config set gateway.auth.mode password")}.`].join(" ");
-}
-async function resolveGatewayInstallToken(options) {
-	const cfg = options.config;
-	const warnings = [];
-	const tokenRef = resolveSecretInputRef({
-		value: cfg.gateway?.auth?.token,
-		defaults: cfg.secrets?.defaults
-	}).ref;
-	const tokenRefConfigured = Boolean(tokenRef);
-	const configToken = tokenRef || typeof cfg.gateway?.auth?.token !== "string" ? void 0 : cfg.gateway.auth.token.trim() || void 0;
-	const explicitToken = options.explicitToken?.trim() || void 0;
-	const envToken = readGatewayTokenEnv(options.env);
-	if (hasAmbiguousGatewayAuthModeConfig(cfg)) return {
-		token: void 0,
-		tokenRefConfigured,
-		unavailableReason: formatAmbiguousGatewayAuthModeReason(),
-		warnings
-	};
-	const resolvedAuth = resolveGatewayAuth({
-		authConfig: cfg.gateway?.auth,
-		tailscaleMode: cfg.gateway?.tailscale?.mode ?? "off"
-	});
-	const needsToken = shouldRequireGatewayTokenForInstall(cfg, options.env) && !resolvedAuth.allowTailscale;
-	let token = explicitToken || configToken || (tokenRef ? void 0 : envToken);
-	let unavailableReason;
-	if (tokenRef && !token && needsToken) try {
-		const value = (await resolveSecretRefValues([tokenRef], {
-			config: cfg,
-			env: options.env
-		})).get(secretRefKey(tokenRef));
-		if (typeof value !== "string" || value.trim().length === 0) throw new Error("gateway.auth.token resolved to an empty or non-string value.");
-		warnings.push("gateway.auth.token is SecretRef-managed; install will not persist a resolved token in service environment. Ensure the SecretRef is resolvable in the daemon runtime context.");
-	} catch (err) {
-		unavailableReason = `gateway.auth.token SecretRef is configured but unresolved (${String(err)}).`;
-	}
-	const allowAutoGenerate = options.autoGenerateWhenMissing ?? false;
-	const persistGeneratedToken = options.persistGeneratedToken ?? false;
-	if (!token && needsToken && !tokenRef && allowAutoGenerate) {
-		token = randomToken();
-		warnings.push(persistGeneratedToken ? "No gateway token found. Auto-generated one and saving to config." : "No gateway token found. Auto-generated one for this run without saving to config.");
-		if (persistGeneratedToken) try {
-			const snapshot = await readConfigFileSnapshot();
-			if (snapshot.exists && !snapshot.valid) warnings.push("Warning: config file exists but is invalid; skipping token persistence.");
-			else {
-				const baseConfig = snapshot.exists ? snapshot.config : {};
-				const existingTokenRef = resolveSecretInputRef({
-					value: baseConfig.gateway?.auth?.token,
-					defaults: baseConfig.secrets?.defaults
-				}).ref;
-				const baseConfigToken = existingTokenRef || typeof baseConfig.gateway?.auth?.token !== "string" ? void 0 : baseConfig.gateway.auth.token.trim() || void 0;
-				if (!existingTokenRef && !baseConfigToken) await writeConfigFile({
-					...baseConfig,
-					gateway: {
-						...baseConfig.gateway,
-						auth: {
-							...baseConfig.gateway?.auth,
-							mode: baseConfig.gateway?.auth?.mode ?? "token",
-							token
-						}
-					}
-				});
-				else if (baseConfigToken) token = baseConfigToken;
-				else {
-					token = void 0;
-					warnings.push("Warning: gateway.auth.token is SecretRef-managed; skipping plaintext token persistence.");
-				}
-			}
-		} catch (err) {
-			warnings.push(`Warning: could not persist token to config: ${String(err)}`);
-		}
-	}
-	return {
-		token,
-		tokenRefConfigured,
-		unavailableReason,
-		warnings
-	};
-}
-//#endregion
-export { buildGatewayInstallPlan as n, gatewayInstallErrorHint as r, resolveGatewayInstallToken as t };

package/dist/gateway-rpc-BGC1Rxvg.js

@@ -1,26 +0,0 @@
-import { _ as GATEWAY_CLIENT_MODES, v as GATEWAY_CLIENT_NAMES } from "./message-channel-DFE4FuE_.js";
-import { n as callGateway } from "./call-ByEzDJ1_.js";
-import { n as withProgress } from "./progress-Cwq59vgZ.js";
-//#region src/cli/gateway-rpc.ts
-function addGatewayClientOptions(cmd) {
-	return cmd.option("--url <url>", "Gateway WebSocket URL (defaults to gateway.remote.url when configured)").option("--token <token>", "Gateway token (if required)").option("--timeout <ms>", "Timeout in ms", "30000").option("--expect-final", "Wait for final response (agent)", false);
-}
-async function callGatewayFromCli(method, opts, params, extra) {
-	const showProgress = extra?.progress ?? opts.json !== true;
-	return await withProgress({
-		label: `Gateway ${method}`,
-		indeterminate: true,
-		enabled: showProgress
-	}, async () => await callGateway({
-		url: opts.url,
-		token: opts.token,
-		method,
-		params,
-		expectFinal: extra?.expectFinal ?? Boolean(opts.expectFinal),
-		timeoutMs: Number(opts.timeout ?? 1e4),
-		clientName: GATEWAY_CLIENT_NAMES.CLI,
-		mode: GATEWAY_CLIENT_MODES.CLI
-	}));
-}
-//#endregion
-export { callGatewayFromCli as n, addGatewayClientOptions as t };

package/dist/gateway-runtime-D89mSQPB.js

@@ -1,69 +0,0 @@
-import { _ as GATEWAY_CLIENT_MODES, v as GATEWAY_CLIENT_NAMES } from "./message-channel-DFE4FuE_.js";
-import { u as GatewayClient } from "./method-scopes-CQE7-bZ-.js";
-import { l as resolveGatewayCredentialsWithSecretInputs, t as buildGatewayConnectionDetails } from "./call-ByEzDJ1_.js";
-//#region src/gateway/channel-status-patches.ts
-function createConnectedChannelStatusPatch(at = Date.now()) {
-	return {
-		connected: true,
-		lastConnectedAt: at,
-		lastEventAt: at
-	};
-}
-//#endregion
-//#region src/gateway/connection-auth.ts
-function toGatewayCredentialOptions(params) {
-	return {
-		cfg: params.cfg,
-		env: params.env,
-		explicitAuth: params.explicitAuth,
-		urlOverride: params.urlOverride,
-		urlOverrideSource: params.urlOverrideSource,
-		modeOverride: params.modeOverride,
-		includeLegacyEnv: params.includeLegacyEnv,
-		localTokenPrecedence: params.localTokenPrecedence,
-		localPasswordPrecedence: params.localPasswordPrecedence,
-		remoteTokenPrecedence: params.remoteTokenPrecedence,
-		remotePasswordPrecedence: params.remotePasswordPrecedence,
-		remoteTokenFallback: params.remoteTokenFallback,
-		remotePasswordFallback: params.remotePasswordFallback
-	};
-}
-async function resolveGatewayConnectionAuth(params) {
-	return await resolveGatewayCredentialsWithSecretInputs({
-		config: params.config,
-		...toGatewayCredentialOptions({
-			...params,
-			cfg: params.config
-		})
-	});
-}
-//#endregion
-//#region src/gateway/operator-approvals-client.ts
-async function createOperatorApprovalsGatewayClient(params) {
-	const { url: gatewayUrl, urlSource } = buildGatewayConnectionDetails({
-		config: params.config,
-		url: params.gatewayUrl
-	});
-	const gatewayUrlOverrideSource = urlSource === "cli --url" ? "cli" : urlSource === "env MOLDCLAW_GATEWAY_URL" ? "env" : void 0;
-	const auth = await resolveGatewayConnectionAuth({
-		config: params.config,
-		env: process.env,
-		urlOverride: gatewayUrlOverrideSource ? gatewayUrl : void 0,
-		urlOverrideSource: gatewayUrlOverrideSource
-	});
-	return new GatewayClient({
-		url: gatewayUrl,
-		token: auth.token,
-		password: auth.password,
-		clientName: GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT,
-		clientDisplayName: params.clientDisplayName,
-		mode: GATEWAY_CLIENT_MODES.BACKEND,
-		scopes: ["operator.approvals"],
-		onEvent: params.onEvent,
-		onHelloOk: params.onHelloOk,
-		onConnectError: params.onConnectError,
-		onClose: params.onClose
-	});
-}
-//#endregion
-export { resolveGatewayConnectionAuth as n, createConnectedChannelStatusPatch as r, createOperatorApprovalsGatewayClient as t };

package/dist/git-commit-CeLH5Ozm.js

@@ -1,2 +0,0 @@
-import { n as resolveCommitHash, t as __testing } from "./git-commit-DUKRiCP-.js";
-export { __testing, resolveCommitHash };

package/dist/git-commit-DUKRiCP-.js

@@ -1,177 +0,0 @@
-import { n as resolvemoldClawPackageRootSync } from "./moldclaw-root-D6PbhbZk.js";
-import { createRequire } from "node:module";
-import { fileURLToPath } from "node:url";
-import fs from "node:fs";
-import path from "node:path";
-function walkUpFrom(startDir, opts, resolveAtDir) {
-	let current = path.resolve(startDir);
-	const maxDepth = opts.maxDepth ?? 12;
-	for (let i = 0; i < maxDepth; i += 1) {
-		const resolved = resolveAtDir(current);
-		if (resolved !== null && resolved !== void 0) return resolved;
-		const parent = path.dirname(current);
-		if (parent === current) break;
-		current = parent;
-	}
-	return null;
-}
-function hasGitMarker(repoRoot) {
-	const gitPath = path.join(repoRoot, ".git");
-	try {
-		const stat = fs.statSync(gitPath);
-		return stat.isDirectory() || stat.isFile();
-	} catch {
-		return false;
-	}
-}
-function findGitRoot(startDir, opts = {}) {
-	return walkUpFrom(startDir, opts, (repoRoot) => hasGitMarker(repoRoot) ? repoRoot : null);
-}
-function resolveGitDirFromMarker(repoRoot) {
-	const gitPath = path.join(repoRoot, ".git");
-	try {
-		const stat = fs.statSync(gitPath);
-		if (stat.isDirectory()) return gitPath;
-		if (!stat.isFile()) return null;
-		const match = fs.readFileSync(gitPath, "utf-8").match(/gitdir:\s*(.+)/i);
-		if (!match?.[1]) return null;
-		return path.resolve(repoRoot, match[1].trim());
-	} catch {
-		return null;
-	}
-}
-function resolveGitHeadPath(startDir, opts = {}) {
-	return walkUpFrom(startDir, opts, (repoRoot) => {
-		const gitDir = resolveGitDirFromMarker(repoRoot);
-		return gitDir ? path.join(gitDir, "HEAD") : null;
-	});
-}
-//#endregion
-//#region src/infra/git-commit.ts
-const formatCommit = (value) => {
-	if (!value) return null;
-	const trimmed = value.trim();
-	if (!trimmed) return null;
-	const match = trimmed.match(/[0-9a-fA-F]{7,40}/);
-	if (!match) return null;
-	return match[0].slice(0, 7).toLowerCase();
-};
-const cachedGitCommitBySearchDir = /* @__PURE__ */ new Map();
-function isMissingPathError(error) {
-	if (!(error instanceof Error)) return false;
-	const code = error.code;
-	return code === "ENOENT" || code === "ENOTDIR";
-}
-const resolveCommitSearchDir = (options) => {
-	if (options.cwd) return path.resolve(options.cwd);
-	if (options.moduleUrl) try {
-		return path.dirname(fileURLToPath(options.moduleUrl));
-	} catch {}
-	return process.cwd();
-};
-/** Read at most `limit` bytes from a file to avoid unbounded reads. */
-const safeReadFilePrefix = (filePath, limit = 256) => {
-	const fd = fs.openSync(filePath, "r");
-	try {
-		const buf = Buffer.alloc(limit);
-		const bytesRead = fs.readSync(fd, buf, 0, limit, 0);
-		return buf.subarray(0, bytesRead).toString("utf-8");
-	} finally {
-		fs.closeSync(fd);
-	}
-};
-const cacheGitCommit = (searchDir, commit) => {
-	cachedGitCommitBySearchDir.set(searchDir, commit);
-	return commit;
-};
-const clearCachedGitCommits = () => {
-	cachedGitCommitBySearchDir.clear();
-};
-const resolveGitLookupDepth = (searchDir, packageRoot) => {
-	if (!packageRoot) return;
-	const relative = path.relative(packageRoot, searchDir);
-	if (relative.startsWith("..") || path.isAbsolute(relative)) return;
-	return (relative ? relative.split(path.sep).filter(Boolean).length : 0) + 1;
-};
-const readCommitFromGit = (searchDir, packageRoot) => {
-	const headPath = resolveGitHeadPath(searchDir, { maxDepth: resolveGitLookupDepth(searchDir, packageRoot) });
-	if (!headPath) return;
-	const head = fs.readFileSync(headPath, "utf-8").trim();
-	if (!head) return null;
-	if (head.startsWith("ref:")) {
-		const refPath = resolveRefPath(headPath, head.replace(/^ref:\s*/i, "").trim());
-		if (!refPath) return null;
-		return formatCommit(safeReadFilePrefix(refPath).trim());
-	}
-	return formatCommit(head);
-};
-const resolveGitRefsBase = (headPath) => {
-	const gitDir = path.dirname(headPath);
-	try {
-		const commonDir = safeReadFilePrefix(path.join(gitDir, "commondir")).trim();
-		if (commonDir) return path.resolve(gitDir, commonDir);
-	} catch (error) {
-		if (!isMissingPathError(error)) throw error;
-	}
-	return gitDir;
-};
-/** Safely resolve a git ref path, rejecting traversal attacks from a crafted HEAD file. */
-const resolveRefPath = (headPath, ref) => {
-	if (!ref.startsWith("refs/")) return null;
-	if (path.isAbsolute(ref)) return null;
-	if (ref.split(/[/]/).includes("..")) return null;
-	const refsBase = resolveGitRefsBase(headPath);
-	const resolved = path.resolve(refsBase, ref);
-	const rel = path.relative(refsBase, resolved);
-	if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) return null;
-	return resolved;
-};
-const readCommitFromPackageJson = () => {
-	try {
-		const pkg = createRequire(import.meta.url)("../../package.json");
-		return formatCommit(pkg.gitHead ?? pkg.githead ?? null);
-	} catch {
-		return null;
-	}
-};
-const readCommitFromBuildInfo = () => {
-	try {
-		const require = createRequire(import.meta.url);
-		for (const candidate of ["../build-info.json", "./build-info.json"]) try {
-			const formatted = formatCommit(require(candidate).commit ?? null);
-			if (formatted) return formatted;
-		} catch {}
-		return null;
-	} catch {
-		return null;
-	}
-};
-const resolveCommitHash = (options = {}) => {
-	const env = options.env ?? process.env;
-	const readers = options.readers ?? {};
-	const readGitCommit = readers.readGitCommit ?? readCommitFromGit;
-	const normalized = formatCommit(env.GIT_COMMIT?.trim() || env.GIT_SHA?.trim());
-	if (normalized) return normalized;
-	const searchDir = resolveCommitSearchDir(options);
-	if (cachedGitCommitBySearchDir.has(searchDir)) return cachedGitCommitBySearchDir.get(searchDir) ?? null;
-	const packageRoot = resolvemoldClawPackageRootSync({
-		cwd: options.cwd,
-		moduleUrl: options.moduleUrl
-	});
-	try {
-		const gitCommit = readGitCommit(searchDir, packageRoot);
-		if (gitCommit !== void 0) return cacheGitCommit(searchDir, gitCommit);
-	} catch {}
-	const buildInfoCommit = readers.readBuildInfoCommit?.() ?? readCommitFromBuildInfo();
-	if (buildInfoCommit) return cacheGitCommit(searchDir, buildInfoCommit);
-	const pkgCommit = readers.readPackageJsonCommit?.() ?? readCommitFromPackageJson();
-	if (pkgCommit) return cacheGitCommit(searchDir, pkgCommit);
-	try {
-		return cacheGitCommit(searchDir, readGitCommit(searchDir, packageRoot) ?? null);
-	} catch {
-		return cacheGitCommit(searchDir, null);
-	}
-};
-const __testing = { clearCachedGitCommits };
-//#endregion
-export { resolveCommitHash as n, findGitRoot as r, __testing as t };