@supen-ai/cli 0.1.6

package/daemon/dist/core/dispatcher.js

@@ -0,0 +1,173 @@
+import { AgentCortex } from './cortex.js';
+import { isUrgentInterruptMessage } from './interrupts.js';
+import { logger } from './logger.js';
+import { ensureSession } from './store.js';
+import { getMcpManager } from '../mcp/index.js';
+/**
+ * Dispatcher: The central "Heart" (中枢) that coordinates Agents across all channels.
+ * It manages individual AgentCortex instances, ensuring context isolation by Session Key.
+ *
+ * Queuing behaviour (single-slot per session):
+ *   - If a daemon is busy and the new message is NOT an urgent interrupt, it is held
+ *     in a single-slot pending queue (newer message replaces older pending one).
+ *   - When the daemon becomes idle after a run, we drain the queue automatically.
+ *   - This ensures rapid consecutive messages (e.g. multi-turn tests, human typing) are
+ *     never silently dropped, while preserving the single-threaded agent execution model.
+ */
+export class Dispatcher {
+    daemons = new Map();
+    pending = new Map(); // FIFO queue per session key
+    deps;
+    MAX_QUEUE_SIZE = 10;
+    IDLE_TTL_MS = 30 * 60 * 1000; // 30 minutes
+    constructor(deps) {
+        this.deps = deps;
+        // Periodic GC
+        setInterval(() => this.gc(), 5 * 60 * 1000); // Every 5 minutes
+    }
+    /**
+     * Dispatches an inbound message to the appropriate AgentCortex.
+     * Session isolation is strictly enforced via `${agent_id}:${session_id}` keying.
+     */
+    async dispatch(chatJid, msg) {
+        const { agent_id, session_id, content, task_id } = msg;
+        if (!agent_id || !session_id) {
+            logger.error({ chat_jid: chatJid }, 'Dispatcher: Cannot dispatch message without agent_id or session_id');
+            return;
+        }
+        // 1. Lifecycle: Ensure session is persistent and active
+        ensureSession({
+            agent_id,
+            session_id,
+            channel: msg.chat_jid.startsWith('web:') ? 'web' : 'external',
+            agent_name: agent_id,
+        });
+        // 2. Isolation: Get or instantiate a unique AgentCortex for this session
+        const daemonKey = `${agent_id}:${session_id}`;
+        let daemon = this.daemons.get(daemonKey);
+        if (!daemon) {
+            logger.info({ agent_id, session_id }, 'Dispatcher: Spawning new AgentCortex for session');
+            // Get MCP manager for this session (async init if first call)
+            let mcpManager;
+            try {
+                mcpManager = await getMcpManager();
+            }
+            catch (err) {
+                logger.warn({ err }, 'Failed to get MCP manager, continuing without MCP');
+            }
+            daemon = new AgentCortex(agent_id, session_id, {
+                mcpManager,
+                onStateChange: (state) => {
+                    // Precise Telemetry: Push JSON status updates to the originating channel
+                    this.deps.broadcastToChat(chatJid, {
+                        type: 'computer_state',
+                        chat_jid: chatJid,
+                        ...state,
+                    });
+                },
+                onReply: async (text) => {
+                    // Reply Routing: Send response back to the correct chat JID
+                    await this.deps.sendMessage(chatJid, text);
+                },
+                onFile: this.deps.sendMessage
+                    ? async (filePath, caption) => {
+                        // Forward file path as a supen:// URL message to the originating channel
+                        const fileRef = caption ? `${caption}: ${filePath}` : filePath;
+                        await this.deps.sendMessage(chatJid, fileRef);
+                    }
+                    : undefined,
+            });
+            this.daemons.set(daemonKey, daemon);
+        }
+        // 3. Preemption / Queuing: Handle new messages while daemon is busy
+        const status = daemon.getState().status;
+        if (status === 'busy') {
+            if (this.isUrgentInterrupt(content)) {
+                logger.info({ agent_id, session_id }, 'Dispatcher: Urgent interruption triggered via message');
+                daemon.interrupt();
+                // Wait for daemon to acknowledge interruption or timeout
+                let attempts = 0;
+                while (daemon.getState().status === 'busy' && attempts < 20) {
+                    await new Promise((resolve) => setTimeout(resolve, 100));
+                    attempts++;
+                }
+            }
+            else {
+                // FIFO queue: hold message, drain after current run finishes.
+                logger.info({ agent_id, session_id }, 'Dispatcher: Daemon busy — queuing message (will deliver when idle)');
+                let queue = this.pending.get(daemonKey) || [];
+                if (queue.length >= this.MAX_QUEUE_SIZE) {
+                    logger.warn({ daemonKey }, 'Dispatcher: Queue overflow, dropping oldest message');
+                    queue.shift();
+                }
+                queue.push({ chatJid, msg });
+                this.pending.set(daemonKey, queue);
+                return;
+            }
+        }
+        // 4. Execution: Pass the message into the Agent Loop
+        await this._run(daemon, daemonKey, chatJid, msg);
+    }
+    /** Execute a run and drain any pending message afterwards. */
+    async _run(daemon, daemonKey, chatJid, msg) {
+        try {
+            await daemon.run(msg.task_id || `run-${Date.now()}`, buildRuntimePrompt(msg), {
+                systemPromptAppend: buildRuntimeSystemPromptAppend(msg),
+            });
+        }
+        catch (err) {
+            if (err.message?.includes('aborted') || err.message?.includes('interrupted')) {
+                logger.debug({ daemonKey }, 'Dispatcher: Task was successfully aborted');
+            }
+            else {
+                logger.error({ err, daemonKey }, 'Dispatcher: Daemon execution failed');
+                await this.deps.sendMessage(chatJid, `Task Error: ${err.message}`);
+            }
+        }
+        // 5. Drain queue: if messages arrived while we were running, process them in order
+        const queue = this.pending.get(daemonKey);
+        if (queue && queue.length > 0) {
+            const next = queue.shift();
+            if (queue.length === 0) {
+                this.pending.delete(daemonKey);
+            }
+            logger.info({ daemonKey, remaining: queue.length }, 'Dispatcher: Draining queued message');
+            await this._run(daemon, daemonKey, next.chatJid, next.msg);
+        }
+    }
+    /**
+     * Determine if a message content should preempt a running task.
+     */
+    isUrgentInterrupt(content) {
+        return isUrgentInterruptMessage(content);
+    }
+    /**
+     * Clean up idle daemons to save memory.
+     */
+    gc() {
+        const now = Date.now();
+        for (const [key, daemon] of this.daemons.entries()) {
+            const state = daemon.getState();
+            if (state.status !== 'busy') {
+                const lastActivity = state.last_activity_at || 0;
+                if (now - lastActivity > this.IDLE_TTL_MS) {
+                    logger.info({ daemonKey: key }, 'Dispatcher: GC cleaning up idle daemon');
+                    this.daemons.delete(key);
+                    this.pending.delete(key);
+                }
+            }
+        }
+    }
+}
+export function buildRuntimePrompt(msg) {
+    return msg.content;
+}
+export function buildRuntimeSystemPromptAppend(msg) {
+    const autonomy = msg.metadata?.autonomy;
+    const executionContext = autonomy && typeof autonomy === 'object' && !Array.isArray(autonomy) &&
+        typeof autonomy.executionContext === 'string'
+        ? autonomy.executionContext.trim()
+        : '';
+    return executionContext || undefined;
+}
+//# sourceMappingURL=dispatcher.js.map

package/daemon/dist/core/dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../src/core/dispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAc,aAAa,EAAE,MAAM,YAAY,CAAC;AAEvD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAahD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,UAAU;IACb,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IACzC,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC,CAAC,6BAA6B;IACxE,IAAI,CAAyB;IACpB,cAAc,GAAG,EAAE,CAAC;IACpB,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;IAE5D,YAAY,IAA4B;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,cAAc;QACd,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB;IACjE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,GAAe;QAC7C,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;QAEvD,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,CACV,EAAE,QAAQ,EAAE,OAAO,EAAE,EACrB,oEAAoE,CACrE,CAAC;YACF,OAAO;QACT,CAAC;QAED,wDAAwD;QACxD,aAAa,CAAC;YACZ,QAAQ;YACR,UAAU;YACV,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU;YAC7D,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAC;QAEH,yEAAyE;QACzE,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC9C,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEzC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,UAAU,EAAE,EACxB,kDAAkD,CACnD,CAAC;YAEF,8DAA8D;YAC9D,IAAI,UAAU,CAAC;YACf,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,aAAa,EAAE,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,mDAAmD,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,GAAG,IAAI,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE;gBAC7C,UAAU;gBACV,aAAa,EAAE,CAAC,KAAkB,EAAE,EAAE;oBACpC,yEAAyE;oBACzE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE;wBACjC,IAAI,EAAE,gBAAgB;wBACtB,QAAQ,EAAE,OAAO;wBACjB,GAAG,KAAK;qBACT,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,IAAY,EAAE,EAAE;oBAC9B,4DAA4D;oBAC5D,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC7C,CAAC;gBACD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;oBAC3B,CAAC,CAAC,KAAK,EAAE,QAAgB,EAAE,OAAgB,EAAE,EAAE;wBAC3C,yEAAyE;wBACzE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;wBAC/D,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBAChD,CAAC;oBACH,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,oEAAoE;QACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;QACxC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,UAAU,EAAE,EACxB,uDAAuD,CACxD,CAAC;gBACF,MAAM,CAAC,SAAS,EAAE,CAAC;gBAEnB,yDAAyD;gBACzD,IAAI,QAAQ,GAAG,CAAC,CAAC;gBACjB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,QAAQ,GAAG,EAAE,EAAE,CAAC;oBAC5D,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;oBACzD,QAAQ,EAAE,CAAC;gBACb,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,8DAA8D;gBAC9D,MAAM,CAAC,IAAI,CACT,EAAE,QAAQ,EAAE,UAAU,EAAE,EACxB,oEAAoE,CACrE,CAAC;gBACF,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBAC9C,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;oBACxC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,qDAAqD,CAAC,CAAC;oBAClF,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,8DAA8D;IACtD,KAAK,CAAC,IAAI,CAChB,MAAmB,EACnB,SAAiB,EACjB,OAAe,EACf,GAAe;QAEf,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE;gBAC5E,kBAAkB,EAAE,8BAA8B,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7E,MAAM,CAAC,KAAK,CACV,EAAE,SAAS,EAAE,EACb,2CAA2C,CAC5C,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,qCAAqC,CAAC,CAAC;gBACxE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,mFAAmF;QACnF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,qCAAqC,CAAC,CAAC;YAC3F,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,OAAe;QACvC,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACI,EAAE;QACP,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC;gBACjD,IAAI,GAAG,GAAG,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,wCAAwC,CAAC,CAAC;oBAC1E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACzB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAe;IAChD,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,GAAe;IAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC;IACxC,MAAM,gBAAgB,GACpB,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpE,OAAQ,QAA2C,CAAC,gBAAgB,KAAK,QAAQ;QAC/E,CAAC,CAAE,QAAyC,CAAC,gBAAgB,CAAC,IAAI,EAAE;QACpE,CAAC,CAAC,EAAE,CAAC;IAET,OAAO,gBAAgB,IAAI,SAAS,CAAC;AACvC,CAAC"}

package/daemon/dist/core/enrollment.d.ts

@@ -0,0 +1,41 @@
+export type DaemonTrustState = 'discovered_untrusted' | 'pending_verification' | 'trusted' | 'suspended' | 'revoked';
+export interface EnrollmentState {
+    daemon_id: string;
+    daemon_fingerprint: string;
+    trust_state: DaemonTrustState;
+    token_hash?: string;
+    token_salt?: string;
+    token_expires_at?: string;
+    token_created_at?: string;
+    token_used_at?: string;
+    failed_attempts: number;
+    frozen_until?: string;
+    trusted_at?: string;
+    revoked_at?: string;
+    suspended_at?: string;
+    updated_at: string;
+}
+export declare function readEnrollmentState(daemonId?: string): EnrollmentState;
+export declare function writeEnrollmentState(state: EnrollmentState): void;
+export declare function createEnrollmentToken(opts?: {
+    ttlMinutes?: number;
+    daemonId?: string;
+}): {
+    token: string;
+    expires_at: string;
+    daemon_id: string;
+    daemon_fingerprint: string;
+};
+export declare function verifyEnrollmentToken(input: {
+    token: string;
+    daemonFingerprint: string;
+    daemonId?: string;
+}): {
+    ok: boolean;
+    code: 'ok' | 'missing_token' | 'not_pending' | 'frozen' | 'expired' | 'daemon_fingerprint_mismatch' | 'token_mismatch';
+    state: EnrollmentState;
+};
+export declare function setTrustState(target: DaemonTrustState, opts?: {
+    daemonId?: string;
+}): EnrollmentState;
+//# sourceMappingURL=enrollment.d.ts.map

package/daemon/dist/core/enrollment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../src/core/enrollment.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,gBAAgB,GACxB,sBAAsB,GACtB,sBAAsB,GACtB,SAAS,GACT,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AA2DD,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe,CAiCtE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAOjE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,CAAC,EAAE;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG;IACF,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CA+BA;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG;IACF,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EACA,IAAI,GACJ,eAAe,GACf,aAAa,GACb,QAAQ,GACR,SAAS,GACT,6BAA6B,GAC7B,gBAAgB,CAAC;IACrB,KAAK,EAAE,eAAe,CAAC;CACxB,CAyDA;AAiBD,wBAAgB,aAAa,CAC3B,MAAM,EAAE,gBAAgB,EACxB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3B,eAAe,CAuBjB"}

package/daemon/dist/core/enrollment.js

@@ -0,0 +1,195 @@
+import crypto from 'crypto';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { SUPEN_HOME } from './config.js';
+const ENROLLMENT_DIR = path.join(SUPEN_HOME, 'security');
+const ENROLLMENT_STATE_PATH = path.join(ENROLLMENT_DIR, 'enrollment-state.json');
+const DEFAULT_TOKEN_TTL_MINUTES = 20;
+const MAX_FAILED_ATTEMPTS = 5;
+const FREEZE_MINUTES = 15;
+function nowIso() {
+    return new Date().toISOString();
+}
+function plusMinutesIso(minutes) {
+    return new Date(Date.now() + minutes * 60 * 1000).toISOString();
+}
+function ensureDir() {
+    fs.mkdirSync(ENROLLMENT_DIR, { recursive: true });
+}
+function normalizeDaemonId(input) {
+    const raw = (input || '').trim();
+    if (raw)
+        return raw;
+    return `${os.hostname()}-${crypto.randomUUID().slice(0, 8)}`;
+}
+function machineFingerprintMaterial() {
+    const host = os.hostname();
+    const platform = os.platform();
+    const arch = os.arch();
+    return `${host}|${platform}|${arch}`;
+}
+function deriveDaemonFingerprint() {
+    const h = crypto.createHash('sha256');
+    h.update(machineFingerprintMaterial());
+    return h.digest('base64url');
+}
+function hashToken(token, salt) {
+    const h = crypto.createHash('sha256');
+    h.update(`${token}:${salt}`);
+    return h.digest('hex');
+}
+function defaultState(daemonId) {
+    return {
+        daemon_id: normalizeDaemonId(daemonId),
+        daemon_fingerprint: deriveDaemonFingerprint(),
+        trust_state: 'trusted', // Auto-trust for local dev
+        failed_attempts: 0,
+        updated_at: nowIso(),
+    };
+}
+export function readEnrollmentState(daemonId) {
+    ensureDir();
+    if (!fs.existsSync(ENROLLMENT_STATE_PATH)) {
+        const initial = defaultState(daemonId);
+        writeEnrollmentState(initial);
+        return initial;
+    }
+    try {
+        const parsed = JSON.parse(fs.readFileSync(ENROLLMENT_STATE_PATH, 'utf-8'));
+        const merged = {
+            ...defaultState(daemonId),
+            ...parsed,
+        };
+        // Auto-upgrade to trusted for local dev mode to bypass enrollment
+        if (merged.trust_state !== 'trusted') {
+            merged.trust_state = 'trusted';
+            writeEnrollmentState(merged);
+        }
+        if (daemonId && daemonId.trim() && merged.daemon_id !== daemonId.trim()) {
+            merged.daemon_id = daemonId.trim();
+            writeEnrollmentState(merged);
+        }
+        return merged;
+    }
+    catch {
+        const reset = defaultState(daemonId);
+        writeEnrollmentState(reset);
+        return reset;
+    }
+}
+export function writeEnrollmentState(state) {
+    ensureDir();
+    const next = {
+        ...state,
+        updated_at: nowIso(),
+    };
+    fs.writeFileSync(ENROLLMENT_STATE_PATH, JSON.stringify(next, null, 2));
+}
+export function createEnrollmentToken(opts) {
+    const state = readEnrollmentState(opts?.daemonId);
+    const ttl = Math.max(10, Math.min(30, opts?.ttlMinutes ?? DEFAULT_TOKEN_TTL_MINUTES));
+    const token = crypto.randomBytes(24).toString('base64url');
+    const salt = crypto.randomBytes(16).toString('hex');
+    const tokenHash = hashToken(token, salt);
+    const next = {
+        ...state,
+        trust_state: 'pending_verification',
+        token_hash: tokenHash,
+        token_salt: salt,
+        token_created_at: nowIso(),
+        token_expires_at: plusMinutesIso(ttl),
+        token_used_at: undefined,
+        failed_attempts: 0,
+        frozen_until: undefined,
+    };
+    writeEnrollmentState(next);
+    return {
+        token,
+        expires_at: next.token_expires_at,
+        daemon_id: next.daemon_id,
+        daemon_fingerprint: next.daemon_fingerprint,
+    };
+}
+export function verifyEnrollmentToken(input) {
+    const state = readEnrollmentState(input.daemonId);
+    if (!state.token_hash || !state.token_salt || !state.token_expires_at) {
+        return { ok: false, code: 'missing_token', state };
+    }
+    if (state.trust_state !== 'pending_verification') {
+        return { ok: false, code: 'not_pending', state };
+    }
+    if (state.frozen_until &&
+        new Date(state.frozen_until).getTime() > Date.now()) {
+        return { ok: false, code: 'frozen', state };
+    }
+    if (new Date(state.token_expires_at).getTime() <= Date.now()) {
+        const expired = {
+            ...state,
+            trust_state: 'discovered_untrusted',
+            token_hash: undefined,
+            token_salt: undefined,
+            token_expires_at: undefined,
+            token_created_at: undefined,
+        };
+        writeEnrollmentState(expired);
+        return { ok: false, code: 'expired', state: expired };
+    }
+    const fingerprint = input.daemonFingerprint;
+    if (fingerprint !== state.daemon_fingerprint) {
+        const failed = applyFailedAttempt(state);
+        return { ok: false, code: 'daemon_fingerprint_mismatch', state: failed };
+    }
+    const hashed = hashToken(input.token, state.token_salt);
+    if (hashed !== state.token_hash) {
+        const failed = applyFailedAttempt(state);
+        return { ok: false, code: 'token_mismatch', state: failed };
+    }
+    const trusted = {
+        ...state,
+        trust_state: 'trusted',
+        trusted_at: nowIso(),
+        token_hash: undefined,
+        token_salt: undefined,
+        token_expires_at: undefined,
+        token_used_at: nowIso(),
+        failed_attempts: 0,
+        frozen_until: undefined,
+    };
+    writeEnrollmentState(trusted);
+    return { ok: true, code: 'ok', state: trusted };
+}
+function applyFailedAttempt(state) {
+    const attempts = (state.failed_attempts || 0) + 1;
+    const shouldFreeze = attempts >= MAX_FAILED_ATTEMPTS;
+    const next = {
+        ...state,
+        failed_attempts: attempts,
+        frozen_until: shouldFreeze
+            ? plusMinutesIso(FREEZE_MINUTES)
+            : state.frozen_until,
+    };
+    writeEnrollmentState(next);
+    return next;
+}
+export function setTrustState(target, opts) {
+    const state = readEnrollmentState(opts?.daemonId);
+    const next = {
+        ...state,
+        trust_state: target,
+        revoked_at: target === 'revoked' ? nowIso() : state.revoked_at,
+        suspended_at: target === 'suspended' ? nowIso() : state.suspended_at,
+    };
+    if (target === 'revoked' ||
+        target === 'suspended' ||
+        target === 'discovered_untrusted') {
+        next.token_hash = undefined;
+        next.token_salt = undefined;
+        next.token_expires_at = undefined;
+        next.token_created_at = undefined;
+        next.token_used_at = undefined;
+    }
+    writeEnrollmentState(next);
+    return next;
+}
+//# sourceMappingURL=enrollment.js.map

package/daemon/dist/core/enrollment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment.js","sourceRoot":"","sources":["../../src/core/enrollment.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA0BzC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AACzD,MAAM,qBAAqB,GAAG,IAAI,CAAC,IAAI,CACrC,cAAc,EACd,uBAAuB,CACxB,CAAC;AAEF,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,SAAS,MAAM;IACb,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,SAAS;IAChB,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,OAAO,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IACvB,OAAO,GAAG,IAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,uBAAuB;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,IAAY;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,YAAY,CAAC,QAAiB;IACrC,OAAO;QACL,SAAS,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QACtC,kBAAkB,EAAE,uBAAuB,EAAE;QAC7C,WAAW,EAAE,SAAS,EAAE,2BAA2B;QACnD,eAAe,EAAE,CAAC;QAClB,UAAU,EAAE,MAAM,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,SAAS,EAAE,CAAC;IACZ,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,EAAE,CAAC,YAAY,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAC7B,CAAC;QACrB,MAAM,MAAM,GAAG;YACb,GAAG,YAAY,CAAC,QAAQ,CAAC;YACzB,GAAG,MAAM;SACV,CAAC;QAEF,kEAAkE;QAClE,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC;YAC/B,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACxE,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACrC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAsB;IACzD,SAAS,EAAE,CAAC;IACZ,MAAM,IAAI,GAAoB;QAC5B,GAAG,KAAK;QACR,UAAU,EAAE,MAAM,EAAE;KACrB,CAAC;IACF,EAAE,CAAC,aAAa,CAAC,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAGrC;IAMC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,EAAE,EACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,IAAI,yBAAyB,CAAC,CAC5D,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAEzC,MAAM,IAAI,GAAoB;QAC5B,GAAG,KAAK;QACR,WAAW,EAAE,sBAAsB;QACnC,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,IAAI;QAChB,gBAAgB,EAAE,MAAM,EAAE;QAC1B,gBAAgB,EAAE,cAAc,CAAC,GAAG,CAAC;QACrC,aAAa,EAAE,SAAS;QACxB,eAAe,EAAE,CAAC;QAClB,YAAY,EAAE,SAAS;KACxB,CAAC;IAEF,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAE3B,OAAO;QACL,KAAK;QACL,UAAU,EAAE,IAAI,CAAC,gBAAiB;QAClC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAIrC;IAYC,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAElD,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,sBAAsB,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,IACE,KAAK,CAAC,YAAY;QAClB,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EACnD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAoB;YAC/B,GAAG,KAAK;YACR,WAAW,EAAE,sBAAsB;YACnC,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,SAAS;YACrB,gBAAgB,EAAE,SAAS;YAC3B,gBAAgB,EAAE,SAAS;SAC5B,CAAC;QACF,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC5C,IAAI,WAAW,KAAK,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,OAAO,GAAoB;QAC/B,GAAG,KAAK;QACR,WAAW,EAAE,SAAS;QACtB,UAAU,EAAE,MAAM,EAAE;QACpB,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,SAAS;QACrB,gBAAgB,EAAE,SAAS;QAC3B,aAAa,EAAE,MAAM,EAAE;QACvB,eAAe,EAAE,CAAC;QAClB,YAAY,EAAE,SAAS;KACxB,CAAC;IACF,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAsB;IAChD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,QAAQ,IAAI,mBAAmB,CAAC;IAErD,MAAM,IAAI,GAAoB;QAC5B,GAAG,KAAK;QACR,eAAe,EAAE,QAAQ;QACzB,YAAY,EAAE,YAAY;YACxB,CAAC,CAAC,cAAc,CAAC,cAAc,CAAC;YAChC,CAAC,CAAC,KAAK,CAAC,YAAY;KACvB,CAAC;IACF,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAAwB,EACxB,IAA4B;IAE5B,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,IAAI,GAAoB;QAC5B,GAAG,KAAK;QACR,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU;QAC9D,YAAY,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY;KACrE,CAAC;IAEF,IACE,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,sBAAsB,EACjC,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QAClC,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QAClC,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;IACjC,CAAC;IAED,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/daemon/dist/core/env.d.ts

@@ -0,0 +1,109 @@
+/** A model definition within a provider entry in config.yaml. */
+export interface ProviderModelDef {
+    /** Model name sent to the LLM API (e.g. "claude-3-5-sonnet-latest"). */
+    name: string;
+    /** Human-friendly display name (optional). */
+    display_name?: string;
+    /** Per-model pricing overrides from config.yaml. */
+    pricing?: {
+        input_usd_per_1m: number;
+        output_usd_per_1m: number;
+    };
+}
+/**
+ * Expanded model entry — one per (provider, model) pair.
+ * Flattened from the config.yaml `providers` array at startup.
+ */
+export interface ModelEntry {
+    /** Composite key: "provider_id:model_name" — uniquely identifies this configuration. */
+    id: string;
+    /** Provider identifier (e.g. "babelark", "anthropic"). */
+    provider_id: string;
+    /** Provider API key. */
+    api_key: string;
+    /** Provider base URL. */
+    base_url: string;
+    /** Model name sent to the API. */
+    model: string;
+    /** Human-friendly display name. */
+    display_name?: string;
+    /** If true, this is the default model. First in list wins if none marked default. */
+    default?: boolean;
+    /** Per-provider pricing for this model. */
+    pricing?: {
+        input_usd_per_1m: number;
+        output_usd_per_1m: number;
+    };
+}
+export declare function getSupenHome(): string;
+export declare function getSupenConfigPath(): string;
+declare const SUPEN_CONFIG_PATH: string;
+/**
+ * Read config values from ${SUPEN_HOME}/config.yaml.
+ * Returns a flat key-value map using env-style keys.
+ * Creates a default config template on first run.
+ */
+export declare function readConfigYaml(keys: string[], options?: {
+    ensureExists?: boolean;
+}): Record<string, string>;
+/**
+ * Read config values from ${SUPEN_HOME}/config.yaml.
+ * Runtime priority is still enforced by callers as: process.env -> config.yaml.
+ * This function does NOT mutate process.env.
+ */
+export declare function readEnvFile(keys: string[], options?: {
+    ensureExists?: boolean;
+}): Record<string, string>;
+/** Path to the YAML config file resolved at module load. Prefer getSupenConfigPath() for live lookups. */
+export { SUPEN_CONFIG_PATH };
+/**
+ * Read the models registry from config.yaml `providers` array.
+ *
+ * Each provider entry contains API credentials and a list of models.
+ * This function expands them into a flat list of `ModelEntry` objects,
+ * each with a composite key `"provider_id:model_name"`.
+ *
+ * Returns entries in list order. Fallback order = list order.
+ */
+export declare function readModelsConfig(options?: {
+    ensureExists?: boolean;
+}): ModelEntry[];
+/**
+ * Returns channel names enabled in config.yaml.
+ * Config-driven: only channels with a config block and enabled !== false are started.
+ * Credentials can come from config or env; the channel factory returns null if missing.
+ * If no channels are configured, returns [] and index falls back to all registered.
+ */
+export declare function getEnabledChannelsFromConfig(): string[];
+export interface ConfigSummary {
+    supen_home: string;
+    config_path: string;
+    timezone: string | null;
+    coding_cli: string | null;
+    codex_transport: string | null;
+    enabled_channels: string[];
+    workspace_allowed_roots: string[];
+    child_env_allowlist: string[];
+    providers: Array<{
+        id: string;
+        base_url: string | null;
+        default: boolean;
+        model_count: number;
+        models: string[];
+        has_api_key: boolean;
+    }>;
+}
+export declare function readConfigSummary(): ConfigSummary;
+/** Full `config.yaml` text (UTF-8). Caller must enforce admin auth. */
+export declare function readConfigYamlFile(): string;
+/**
+ * Replace `config.yaml` with validated YAML, then callers should reload in-memory state as needed.
+ * Returns an error message on invalid YAML or non-object document.
+ */
+export declare function writeConfigYamlFile(rawYaml: string): {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+//# sourceMappingURL=env.d.ts.map

package/daemon/dist/core/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/core/env.ts"],"names":[],"mappings":"AAMA,iEAAiE;AACjE,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,OAAO,CAAC,EAAE;QACR,gBAAgB,EAAE,MAAM,CAAC;QACzB,iBAAiB,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,wFAAwF;IACxF,EAAE,EAAE,MAAM,CAAC;IACX,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2CAA2C;IAC3C,OAAO,CAAC,EAAE;QACR,gBAAgB,EAAE,MAAM,CAAC;QACzB,iBAAiB,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAUD,QAAA,MAAM,iBAAiB,QAAuB,CAAC;AA4E/C;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwB/G;AAqBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE5G;AAED,0GAA0G;AAC1G,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,UAAU,EAAE,CA6DvF;AAWD;;;;;GAKG;AACH,wBAAgB,4BAA4B,IAAI,MAAM,EAAE,CAsBvD;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,SAAS,EAAE,KAAK,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,OAAO,EAAE,OAAO,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,WAAW,EAAE,OAAO,CAAC;KACtB,CAAC,CAAC;CACJ;AAED,wBAAgB,iBAAiB,IAAI,aAAa,CA8CjD;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,IAAI,MAAM,CAM3C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAoBlG"}