@supen-ai/cli 0.1.6

package/daemon/dist/core/gateway.js

@@ -0,0 +1,887 @@
+import WebSocket from 'ws';
+import http from 'http';
+import crypto from 'crypto';
+import os from 'os';
+import fs from 'fs';
+import { Agent } from 'undici';
+import { logger } from './logger.js';
+import { readGatewayConfig } from './gateway-config.js';
+import { assertSafePathSegment, validateOutboundEndpoint } from './security.js';
+import { readEnrollmentState, verifyEnrollmentToken } from './enrollment.js';
+import { DAEMON_HOSTNAME, HTTP_API_KEY, HTTP_PORT, SUPEN_HOME } from './config.js';
+import { getSessionForAgent, resolveFromChatJid, } from './store.js';
+// Direct dispatcher that bypasses any http_proxy/https_proxy env vars.
+// Without this, Node.js global fetch routes loopback traffic through the
+// system proxy, causing 504 Gateway Timeouts on every API relay.
+const directAgent = new Agent();
+const GATEWAY_JID_PREFIX = 'gateway:';
+const DEFAULT_CONNECT_TIMEOUT_MS = 15_000;
+const DEFAULT_HEARTBEAT_INTERVAL_MS = 30_000;
+const DEFAULT_HEARTBEAT_TIMEOUT_MS = 90_000;
+function gatewayConnectTimeoutMs() {
+    const parsed = Number.parseInt(process.env.SUPEN_GATEWAY_CONNECT_TIMEOUT_MS || '', 10);
+    if (Number.isFinite(parsed) && parsed > 0)
+        return parsed;
+    return DEFAULT_CONNECT_TIMEOUT_MS;
+}
+function gatewayHeartbeatIntervalMs() {
+    const parsed = Number.parseInt(process.env.SUPEN_GATEWAY_HEARTBEAT_INTERVAL_MS || '', 10);
+    if (Number.isFinite(parsed) && parsed > 0)
+        return parsed;
+    return DEFAULT_HEARTBEAT_INTERVAL_MS;
+}
+function gatewayHeartbeatTimeoutMs() {
+    const parsed = Number.parseInt(process.env.SUPEN_GATEWAY_HEARTBEAT_TIMEOUT_MS || '', 10);
+    if (Number.isFinite(parsed) && parsed > 0)
+        return parsed;
+    return DEFAULT_HEARTBEAT_TIMEOUT_MS;
+}
+export function parseGatewaySseFrame(frame) {
+    const dataLines = [];
+    let id;
+    for (const line of frame.split(/\r?\n/)) {
+        if (!line || line.startsWith(':'))
+            continue;
+        if (line.startsWith('id:')) {
+            id = line.slice(3).trimStart();
+            continue;
+        }
+        if (line.startsWith('data:')) {
+            dataLines.push(line.slice(5).trimStart());
+        }
+    }
+    if (dataLines.length === 0)
+        return null;
+    return {
+        ...(id !== undefined ? { id } : {}),
+        data: dataLines.join('\n'),
+    };
+}
+function normalizeGatewayThreadId(rawThreadId) {
+    const candidate = typeof rawThreadId === 'string' ? rawThreadId.trim() : '';
+    if (!candidate) {
+        return `gwcs_${crypto.randomBytes(20).toString('hex')}`;
+    }
+    try {
+        return assertSafePathSegment(candidate, 'thread_id');
+    }
+    catch {
+        return `gwcs_${crypto.createHash('sha1').update(candidate).digest('hex')}`;
+    }
+}
+/**
+ * Gateway — the daemon's outbound uplink to the Supen Gateway.
+ *
+ * Architecture:
+ *   - Daemons connect outward to the gateway and receive instructions from it.
+ *   - The gateway accepts connections from controller platforms (Supen, etc.)
+ *     that drive the daemons via channels (Discord, HTTP, ACP, …).
+ *
+ * This is core infrastructure, not a consumer channel.
+ * Instantiated directly in index.ts, not via the channel registry.
+ */
+export class Gateway {
+    ws = null;
+    _connected = false;
+    config;
+    callbacks;
+    reconnectTimeout = null;
+    reportingInterval = null;
+    connectionTimeout = null;
+    heartbeatInterval = null;
+    heartbeatTimeout = null;
+    activeSseSubscriptions = new Map();
+    llmToken = null;
+    llmTokenExpiresAt = null;
+    tokenRenewalTimeout = null;
+    intentionalShutdown = false;
+    socketCloseHandled = false;
+    channelReplySessions = new Map();
+    pendingReplyStarts = new Map();
+    constructor(callbacks) {
+        this.callbacks = callbacks;
+        this.config = readGatewayConfig();
+    }
+    getConfig() {
+        return { ...this.config };
+    }
+    async reloadConfigAndReconnect() {
+        await this.disconnect();
+        this.config = readGatewayConfig();
+        gatewayConfigured = !!this.config.gateway_url;
+        await this.connect();
+    }
+    async connect() {
+        if (!this.config.gateway_url) {
+            logger.debug('No gateway_url configured, Gateway uplink disabled');
+            return;
+        }
+        this.intentionalShutdown = false;
+        await this.initiateConnection();
+    }
+    async initiateConnection() {
+        if (this.reconnectTimeout)
+            clearTimeout(this.reconnectTimeout);
+        if (this.connectionTimeout)
+            clearTimeout(this.connectionTimeout);
+        this.stopHeartbeat();
+        this.socketCloseHandled = false;
+        const rawUrl = this.config.gateway_url;
+        let url;
+        try {
+            url = validateOutboundEndpoint(rawUrl, {
+                allowedProtocols: ['ws:', 'wss:'],
+                label: 'gateway_url',
+            }).toString();
+        }
+        catch (err) {
+            logger.error({ err: err.message, gateway_url: rawUrl }, 'Refusing to connect to gateway: untrusted endpoint');
+            this._connected = false;
+            return;
+        }
+        logger.info({ url }, 'Connecting to gateway...');
+        this.ws = new WebSocket(url);
+        this.connectionTimeout = setTimeout(() => {
+            if (this.ws && this.ws.readyState !== WebSocket.OPEN) {
+                logger.warn({ url, timeout_ms: gatewayConnectTimeoutMs() }, 'Gateway connection timed out');
+                this.ws.terminate();
+            }
+        }, gatewayConnectTimeoutMs());
+        this.connectionTimeout.unref?.();
+        this.ws.on('open', () => {
+            if (this.connectionTimeout) {
+                clearTimeout(this.connectionTimeout);
+                this.connectionTimeout = null;
+            }
+            logger.info({ url }, 'Connected to gateway');
+            this._connected = true;
+            this.authenticate();
+            this.startHeartbeat();
+            this.startReporting();
+        });
+        this.ws.on('message', (data) => this.handleMessage(data));
+        this.ws.on('close', () => {
+            if (this.connectionTimeout) {
+                clearTimeout(this.connectionTimeout);
+                this.connectionTimeout = null;
+            }
+            this.handleSocketClosed('Gateway disconnected');
+        });
+        this.ws.on('error', (err) => {
+            logger.error({ err }, 'Gateway connection error');
+            if (this.ws && this.ws.readyState === WebSocket.CONNECTING) {
+                this.ws.terminate();
+            }
+        });
+    }
+    authenticate() {
+        const state = readEnrollmentState(DAEMON_HOSTNAME || undefined);
+        const gatewayToken = this.buildGatewayToken(state.daemon_id);
+        if (this.config.trust_token && state.trust_state !== 'trusted') {
+            logger.info('Attempting enrollment with gateway using trust_token');
+            this.ws?.send(JSON.stringify({
+                type: 'enroll',
+                token: this.config.trust_token,
+                gateway_token: gatewayToken,
+                daemon_id: state.daemon_id,
+                daemon_fingerprint: state.daemon_fingerprint,
+            }));
+        }
+        else {
+            this.ws?.send(JSON.stringify({
+                type: 'auth',
+                token: gatewayToken,
+                daemon_id: state.daemon_id,
+                daemon_fingerprint: state.daemon_fingerprint,
+            }));
+        }
+    }
+    /**
+     * Build a HMAC token for gateway authentication.
+     * Format: `${daemonId}.${timestampMs}.${hmacHex}`
+     * Only when SUPEN_GATEWAY_SECRET env var is set on the daemon side.
+     */
+    buildGatewayToken(daemonId) {
+        const secret = process.env.SUPEN_GATEWAY_SECRET;
+        if (!secret)
+            return undefined;
+        const ts = Date.now().toString();
+        const hmac = crypto.createHmac('sha256', secret).update(`${daemonId}:${ts}`).digest('hex');
+        return `${daemonId}.${ts}.${hmac}`;
+    }
+    startReporting() {
+        this.stopReporting();
+        const interval = this.config.reporting_interval || 60000;
+        this.reportingInterval = setInterval(() => {
+            if (this._connected && this.ws?.readyState === WebSocket.OPEN) {
+                const state = readEnrollmentState(DAEMON_HOSTNAME || undefined);
+                // System Telemetry
+                const cpus = os.cpus();
+                const memTotal = os.totalmem();
+                const memFree = os.freemem();
+                let disk_total;
+                let disk_free;
+                let disk_used;
+                try {
+                    const stats = fs.statfsSync(SUPEN_HOME);
+                    disk_total = stats.bsize * stats.blocks;
+                    disk_free = stats.bsize * stats.bavail;
+                    disk_used = disk_total - disk_free;
+                }
+                catch { /* ignore */ }
+                this.ws.send(JSON.stringify({
+                    type: 'report',
+                    status: 'online',
+                    trust_state: state.trust_state,
+                    timestamp: new Date().toISOString(),
+                    telemetry: {
+                        os: {
+                            platform: os.platform(),
+                            arch: os.arch(),
+                            cpus: cpus.length,
+                            cpu_model: cpus[0]?.model || 'Unknown',
+                            load_avg: os.loadavg(),
+                            mem_total: memTotal,
+                            mem_free: memFree,
+                            mem_used: memTotal - memFree,
+                            uptime: os.uptime(),
+                            disk_total,
+                            disk_free,
+                            disk_used,
+                        }
+                    }
+                }));
+            }
+        }, interval);
+        this.reportingInterval.unref?.();
+    }
+    stopReporting() {
+        if (this.reportingInterval) {
+            clearInterval(this.reportingInterval);
+            this.reportingInterval = null;
+        }
+    }
+    startHeartbeat() {
+        this.stopHeartbeat();
+        const intervalMs = gatewayHeartbeatIntervalMs();
+        const timeoutMs = gatewayHeartbeatTimeoutMs();
+        const clearHeartbeatTimeout = () => {
+            if (this.heartbeatTimeout) {
+                clearTimeout(this.heartbeatTimeout);
+                this.heartbeatTimeout = null;
+            }
+        };
+        const armHeartbeatTimeout = () => {
+            clearHeartbeatTimeout();
+            this.heartbeatTimeout = setTimeout(() => {
+                if (this._connected && this.ws?.readyState === WebSocket.OPEN) {
+                    logger.warn({ timeout_ms: timeoutMs }, 'Gateway heartbeat timed out; terminating stale socket');
+                    this.ws.terminate();
+                }
+            }, timeoutMs);
+            this.heartbeatTimeout.unref?.();
+        };
+        this.ws?.on('pong', clearHeartbeatTimeout);
+        this.ws?.on('ping', clearHeartbeatTimeout);
+        this.heartbeatInterval = setInterval(() => {
+            if (!this._connected || !this.ws || this.ws.readyState !== WebSocket.OPEN)
+                return;
+            if (this.heartbeatTimeout)
+                return;
+            try {
+                this.ws.ping();
+                armHeartbeatTimeout();
+            }
+            catch (err) {
+                logger.warn({ err }, 'Gateway heartbeat ping failed; terminating stale socket');
+                this.ws.terminate();
+            }
+        }, intervalMs);
+        this.heartbeatInterval.unref?.();
+    }
+    stopHeartbeat() {
+        if (this.heartbeatInterval) {
+            clearInterval(this.heartbeatInterval);
+            this.heartbeatInterval = null;
+        }
+        if (this.heartbeatTimeout) {
+            clearTimeout(this.heartbeatTimeout);
+            this.heartbeatTimeout = null;
+        }
+    }
+    rejectPendingReplyStarts(reason) {
+        for (const [requestId, pending] of this.pendingReplyStarts.entries()) {
+            clearTimeout(pending.timeout);
+            pending.reject(new Error(reason));
+            this.pendingReplyStarts.delete(requestId);
+        }
+    }
+    handleSocketClosed(reason) {
+        if (this.socketCloseHandled)
+            return;
+        this.socketCloseHandled = true;
+        this._connected = false;
+        this.rejectPendingReplyStarts(reason);
+        // Clear stale token — server revokes it on disconnect, so holding it
+        // would cause 401 errors on any LLM request before the new token arrives.
+        this.llmToken = null;
+        this.llmTokenExpiresAt = null;
+        if (this.tokenRenewalTimeout) {
+            clearTimeout(this.tokenRenewalTimeout);
+            this.tokenRenewalTimeout = null;
+        }
+        this.stopReporting();
+        this.stopHeartbeat();
+        if (this.intentionalShutdown) {
+            this.intentionalShutdown = false;
+            return;
+        }
+        if (this.reconnectTimeout)
+            return;
+        logger.warn('Gateway connection closed, reconnecting in 5s...');
+        this.reconnectTimeout = setTimeout(() => this.initiateConnection(), 5000);
+    }
+    handleMessage(data) {
+        try {
+            const payload = JSON.parse(data.toString());
+            logger.debug({ payload }, 'Received message from gateway');
+            if (payload.type === 'enrollment_result') {
+                if (payload.ok) {
+                    logger.info('Gateway enrollment successful');
+                    verifyEnrollmentToken({
+                        token: this.config.trust_token,
+                        daemonFingerprint: payload.daemon_fingerprint,
+                        daemonId: DAEMON_HOSTNAME || undefined,
+                    });
+                    // Notify caller so it can send configure_channels
+                    this.callbacks.onEnrollmentSuccess?.(payload.daemon_id);
+                }
+                else {
+                    logger.error({ code: payload.code }, 'Gateway enrollment failed');
+                }
+                return;
+            }
+            if (payload.type === 'auth_result') {
+                if (payload.ok) {
+                    const daemonId = (typeof payload.daemon_id === 'string' && payload.daemon_id.trim()) ||
+                        readEnrollmentState(DAEMON_HOSTNAME || undefined).daemon_id;
+                    logger.info('Gateway authentication successful');
+                    // Notify caller so it can send configure_channels after reconnect/auth.
+                    this.callbacks.onEnrollmentSuccess?.(daemonId);
+                }
+                else {
+                    logger.error({ code: payload.code }, 'Gateway authentication failed');
+                }
+                return;
+            }
+            if (payload.type === 'message') {
+                const { agent_id, thread_id, content, sender, sender_name, task_id } = payload;
+                const normalizedThreadId = normalizeGatewayThreadId(thread_id);
+                const chatJid = `${GATEWAY_JID_PREFIX}${agent_id}:${normalizedThreadId}`;
+                const msg = {
+                    id: payload.id || `gateway-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
+                    chat_jid: chatJid,
+                    sender: sender || 'gateway-user',
+                    sender_name: sender_name || 'Gateway User',
+                    content,
+                    timestamp: payload.timestamp || new Date().toISOString(),
+                    is_from_me: false,
+                    agent_id,
+                    session_id: normalizedThreadId,
+                    task_id: task_id || `gateway-task-${Date.now()}`,
+                };
+                this.callbacks.onChatMetadata(chatJid, msg.timestamp, agent_id, 'gateway', false);
+                this.callbacks.onMessage(chatJid, msg);
+                return;
+            }
+            if (payload.type === 'channel_message') {
+                const { trace_id, channel, jid: channelSession, sender, sender_name, content, timestamp, agent_id, task_id, session_id, thread_id, metadata, } = payload;
+                const normalizedMetadata = {
+                    ...(metadata || {}),
+                    channel,
+                    channel_thread: channelSession,
+                    ...(trace_id ? { trace_id } : {}),
+                };
+                const normalizedThreadId = normalizeGatewayThreadId(thread_id || task_id || session_id || channelSession);
+                const chatJid = `${GATEWAY_JID_PREFIX}${agent_id}:${normalizedThreadId}`;
+                const normalizedTaskId = task_id || session_id || thread_id || normalizedThreadId;
+                const msg = {
+                    id: payload.id || `gateway-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
+                    chat_jid: chatJid,
+                    sender: sender || 'channel-user',
+                    sender_name: sender_name || 'Channel User',
+                    content,
+                    timestamp: timestamp || new Date().toISOString(),
+                    is_from_me: false,
+                    agent_id,
+                    session_id: normalizedThreadId,
+                    task_id: normalizedTaskId,
+                    metadata: normalizedMetadata,
+                };
+                this.channelReplySessions.set(chatJid, {
+                    channel,
+                    channelSession,
+                    traceId: typeof trace_id === 'string' && trace_id.trim() ? trace_id.trim() : undefined,
+                });
+                this.callbacks.onChatMetadata(chatJid, msg.timestamp, agent_id, channel, false);
+                this.callbacks.onMessage(chatJid, msg);
+                return;
+            }
+            if (payload.type === 'channel_reply_started') {
+                const { request_id, reply_handle } = payload;
+                const pending = this.pendingReplyStarts.get(request_id);
+                if (!pending)
+                    return;
+                clearTimeout(pending.timeout);
+                this.pendingReplyStarts.delete(request_id);
+                pending.resolve(reply_handle);
+                return;
+            }
+            if (payload.type === 'api_request') {
+                this.handleApiRequest(payload);
+                return;
+            }
+            if (payload.type === 'sse_subscribe') {
+                this.handleSseSubscribe(payload);
+                return;
+            }
+            if (payload.type === 'chat_stream_request') {
+                this.handleChatStreamRequest(payload);
+                return;
+            }
+            if (payload.type === 'llm_token') {
+                this.handleLlmToken(payload);
+                return;
+            }
+        }
+        catch (err) {
+            logger.error({ err }, 'Failed to handle gateway message');
+        }
+    }
+    handleLlmToken(payload) {
+        const previousToken = this.llmToken;
+        this.llmToken = payload.token;
+        this.llmTokenExpiresAt = payload.expires_at;
+        process.env.SUPEN_LLM_TOKEN = payload.token;
+        process.env.SUPEN_LLM_API_KEY = payload.token;
+        logger.info({ expires_at: new Date(payload.expires_at).toISOString() }, 'Received LLM token from gateway');
+        if (previousToken && previousToken !== payload.token) {
+            // Claude SDK sessions receive the LLM token through process env at
+            // creation time. If the gateway restarts or renews the token, cached SDK
+            // sessions keep retrying with the stale credential until they are closed.
+            void import('./sdk-wrapper.js')
+                .then(({ resetAgentSessionCache }) => {
+                resetAgentSessionCache();
+                logger.info('Reset cached SDK sessions after gateway LLM token rotation');
+            })
+                .catch((err) => {
+                logger.warn({ err }, 'Failed to reset SDK sessions after gateway LLM token rotation');
+            });
+        }
+        // Schedule renewal at 80% of TTL
+        this.scheduleTokenRenewal(payload.ttl_ms || (payload.expires_at - Date.now()));
+    }
+    scheduleTokenRenewal(ttlMs) {
+        if (this.tokenRenewalTimeout)
+            clearTimeout(this.tokenRenewalTimeout);
+        const renewAt = Math.max(ttlMs * 0.8, 30_000); // At least 30s before attempting renewal
+        this.tokenRenewalTimeout = setTimeout(() => {
+            if (this._connected && this.ws?.readyState === WebSocket.OPEN) {
+                logger.debug('Renewing LLM token');
+                this.ws.send(JSON.stringify({ type: 'llm_token_renew' }));
+            }
+        }, renewAt);
+    }
+    /** Get the current LLM token (null if not yet received from gateway). */
+    getLlmToken() {
+        return this.llmToken;
+    }
+    async handleApiRequest(payload) {
+        const localUrl = `http://127.0.0.1:${HTTP_PORT}${payload.path}`;
+        try {
+            const headers = {
+                'Content-Type': 'application/json',
+            };
+            if (HTTP_API_KEY.trim()) {
+                headers['X-API-Key'] = HTTP_API_KEY.trim();
+            }
+            const fetchOpts = {
+                method: payload.method || 'GET',
+                headers,
+            };
+            if (payload.body && payload.method !== 'GET')
+                fetchOpts.body = JSON.stringify(payload.body);
+            const res = await fetch(localUrl, { ...fetchOpts, dispatcher: directAgent });
+            const contentType = res.headers.get('content-type') || '';
+            if (contentType.includes('application/json')) {
+                const body = await res.text();
+                let parsed;
+                try {
+                    parsed = JSON.parse(body);
+                }
+                catch {
+                    parsed = body;
+                }
+                this.ws?.send(JSON.stringify({ type: 'api_response', request_id: payload.request_id, status: res.status, headers: {}, body: parsed }));
+            }
+            else {
+                const buffer = Buffer.from(await res.arrayBuffer());
+                this.ws?.send(JSON.stringify({
+                    type: 'api_response', request_id: payload.request_id, status: res.status, encoding: 'base64',
+                    headers: { 'content-type': contentType, 'content-disposition': res.headers.get('content-disposition') || '', 'content-length': String(buffer.length), 'cache-control': res.headers.get('cache-control') || '' },
+                    body: buffer.toString('base64'),
+                }));
+            }
+        }
+        catch (err) {
+            logger.error({ err, path: payload.path }, 'Failed to relay API request to daemon');
+            this.ws?.send(JSON.stringify({ type: 'api_response', request_id: payload.request_id, status: 502, headers: {}, body: { error: 'relay_failed', message: String(err) } }));
+        }
+    }
+    handleSseSubscribe(payload) {
+        const streamKey = payload.path;
+        const clientKey = payload.client_key || streamKey;
+        const existing = this.activeSseSubscriptions.get(streamKey);
+        if (existing) {
+            existing.destroy();
+            this.activeSseSubscriptions.delete(streamKey);
+        }
+        const localUrl = `http://127.0.0.1:${HTTP_PORT}${streamKey}`;
+        logger.info({ path: streamKey }, 'SSE relay: subscribing to local stream');
+        const headers = {};
+        if (HTTP_API_KEY.trim()) {
+            headers['X-API-Key'] = HTTP_API_KEY.trim();
+        }
+        const req = http.get(localUrl, { headers }, (res) => {
+            let buf = '';
+            res.on('data', (chunk) => {
+                buf += chunk.toString();
+                const parts = buf.split('\n\n');
+                buf = parts.pop() || '';
+                for (const part of parts) {
+                    if (!part.trim())
+                        continue;
+                    const frame = parseGatewaySseFrame(part);
+                    if (!frame)
+                        continue;
+                    try {
+                        this.ws?.send(JSON.stringify({
+                            type: 'sse_event',
+                            stream_key: streamKey,
+                            client_key: clientKey,
+                            event_id: frame.id,
+                            event: JSON.parse(frame.data),
+                        }));
+                    }
+                    catch {
+                        this.ws?.send(JSON.stringify({
+                            type: 'sse_event',
+                            stream_key: streamKey,
+                            client_key: clientKey,
+                            event_id: frame.id,
+                            event: { raw: frame.data },
+                        }));
+                    }
+                }
+            });
+            res.on('end', () => this.activeSseSubscriptions.delete(streamKey));
+            res.on('error', (err) => { logger.debug({ err, path: streamKey }, 'SSE relay: stream error'); this.activeSseSubscriptions.delete(streamKey); });
+        });
+        req.on('error', (err) => logger.error({ err, path: streamKey }, 'SSE relay: failed to connect'));
+        this.activeSseSubscriptions.set(streamKey, { destroy: () => req.destroy() });
+    }
+    handleChatStreamRequest(payload) {
+        const streamKey = payload.path;
+        const existing = this.activeSseSubscriptions.get(streamKey);
+        if (existing) {
+            existing.destroy();
+            this.activeSseSubscriptions.delete(streamKey);
+        }
+        const localUrl = `http://127.0.0.1:${HTTP_PORT}${streamKey}`;
+        logger.info({ path: streamKey }, 'Chat relay: POST to local stream');
+        const headers = { 'Content-Type': 'application/json' };
+        if (HTTP_API_KEY.trim()) {
+            headers['X-API-Key'] = HTTP_API_KEY.trim();
+        }
+        const parsedUrl = new URL(localUrl);
+        const req = http.request({
+            hostname: parsedUrl.hostname,
+            port: parsedUrl.port,
+            path: parsedUrl.pathname + parsedUrl.search,
+            method: 'POST',
+            headers,
+        }, (res) => {
+            logger.info({ statusCode: res.statusCode, headers: res.headers }, 'Chat relay: got response from local stream');
+            res.on('data', (chunk) => {
+                logger.debug({ chunkLength: chunk.length }, 'Chat relay: received chunk from local stream');
+                this.ws?.send(JSON.stringify({ type: 'stream_raw_chunk', stream_key: streamKey, chunk: chunk.toString() }));
+            });
+            res.on('end', () => {
+                logger.info('Chat relay: local stream ended');
+                this.ws?.send(JSON.stringify({ type: 'stream_raw_end', stream_key: streamKey }));
+                this.activeSseSubscriptions.delete(streamKey);
+            });
+            res.on('error', (err) => {
+                logger.debug({ err, path: streamKey }, 'Chat relay: stream error');
+                this.ws?.send(JSON.stringify({ type: 'stream_raw_end', stream_key: streamKey }));
+                this.activeSseSubscriptions.delete(streamKey);
+            });
+        });
+        req.on('error', (err) => logger.error({ err, path: streamKey }, 'Chat relay: failed to connect'));
+        req.write(payload.body || '');
+        req.end();
+        this.activeSseSubscriptions.set(streamKey, { destroy: () => req.destroy() });
+    }
+    /** Send a message back to the gateway (from a local agent reply). */
+    async sendMessage(chatJid, text) {
+        if (!this._connected || !this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            logger.warn({ chatJid }, 'Cannot send message: Gateway not connected');
+            return;
+        }
+        const parts = chatJid.slice(GATEWAY_JID_PREFIX.length).split(':');
+        this.ws.send(JSON.stringify({ type: 'message', agent_id: parts[0], thread_id: parts[1], content: text, timestamp: new Date().toISOString() }));
+    }
+    /**
+     * Send a reply to be delivered via an external channel (Discord, DingTalk, Feishu).
+     * The gateway routes this to the appropriate channel instance.
+     */
+    async sendChannelReply(channel, jid, content, inReplyTo, traceId) {
+        if (!this._connected || !this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            logger.warn({ channel, jid }, 'Cannot send channel reply: Gateway not connected');
+            return;
+        }
+        this.ws.send(JSON.stringify({
+            type: 'channel_reply',
+            ...(traceId ? { trace_id: traceId } : {}),
+            channel,
+            jid,
+            content,
+            in_reply_to: inReplyTo,
+        }));
+    }
+    getChannelReplySession(chatJid) {
+        const existing = this.channelReplySessions.get(chatJid);
+        if (existing)
+            return existing;
+        const resolved = resolveFromChatJid(chatJid);
+        if (!resolved)
+            return null;
+        const session = getSessionForAgent(resolved.agentId, resolved.sessionId);
+        if (!session?.channel ||
+            !session.channel_session ||
+            session.channel === 'unknown' ||
+            session.channel === 'gateway') {
+            return null;
+        }
+        const recovered = {
+            channel: session.channel,
+            channelSession: session.channel_session,
+        };
+        this.channelReplySessions.set(chatJid, recovered);
+        return recovered;
+    }
+    async startChannelReplyForChat(chatJid, content) {
+        const channelCtx = this.getChannelReplySession(chatJid);
+        if (!channelCtx) {
+            throw new Error(`No gateway channel context for ${chatJid}`);
+        }
+        if (!this._connected || !this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            throw new Error('Gateway not connected');
+        }
+        const requestId = `reply-start-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        return new Promise((resolve, reject) => {
+            const timeout = setTimeout(() => {
+                this.pendingReplyStarts.delete(requestId);
+                reject(new Error(`Timed out waiting for reply handle: ${requestId}`));
+            }, 10_000);
+            this.pendingReplyStarts.set(requestId, { resolve, reject, timeout });
+            this.ws?.send(JSON.stringify({
+                type: 'channel_reply_start',
+                ...(channelCtx.traceId ? { trace_id: channelCtx.traceId } : {}),
+                channel: channelCtx.channel,
+                jid: channelCtx.channelSession,
+                request_id: requestId,
+                content,
+            }));
+        });
+    }
+    async updateChannelReply(replyHandle, content, traceId) {
+        if (!this._connected || !this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            throw new Error('Gateway not connected');
+        }
+        this.ws.send(JSON.stringify({
+            type: 'channel_reply_update',
+            ...(traceId ? { trace_id: traceId } : {}),
+            reply_handle: replyHandle,
+            content,
+        }));
+    }
+    async finalizeChannelReply(replyHandle, traceId) {
+        if (!this._connected || !this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            throw new Error('Gateway not connected');
+        }
+        this.ws.send(JSON.stringify({
+            type: 'channel_reply_finalize',
+            ...(traceId ? { trace_id: traceId } : {}),
+            reply_handle: replyHandle,
+        }));
+    }
+    async failChannelReply(replyHandle, content, traceId) {
+        if (!this._connected || !this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            throw new Error('Gateway not connected');
+        }
+        this.ws.send(JSON.stringify({
+            type: 'channel_reply_error',
+            ...(traceId ? { trace_id: traceId } : {}),
+            reply_handle: replyHandle,
+            content,
+        }));
+    }
+    /**
+     * Send a reply for a chat JID. If the chat originated from a channel message,
+     * uses sendChannelReply; otherwise uses sendMessage.
+     */
+    async sendReplyForChat(chatJid, text, inReplyTo, traceId) {
+        const channelCtx = this.getChannelReplySession(chatJid);
+        if (channelCtx) {
+            await this.sendChannelReply(channelCtx.channel, channelCtx.channelSession, text, inReplyTo, traceId || channelCtx.traceId);
+            return;
+        }
+        await this.sendMessage(chatJid, text);
+    }
+    emitTraceEvent(event) {
+        if (!this._connected || !this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            return;
+        }
+        const traceId = typeof event.trace_id === 'string' ? event.trace_id.trim() : '';
+        if (!traceId)
+            return;
+        this.ws.send(JSON.stringify({
+            type: 'trace_event',
+            trace_id: traceId,
+            kind: event.kind,
+            message: event.message,
+            ...(event.level ? { level: event.level } : {}),
+            ...(event.channel ? { channel: event.channel } : {}),
+            ...(event.jid ? { jid: event.jid } : {}),
+            ...(event.agent_id ? { agent_id: event.agent_id } : {}),
+            ...(event.daemon_id ? { daemon_id: event.daemon_id } : {}),
+            ...(event.details ? { details: event.details } : {}),
+        }));
+    }
+    reportUsage(event) {
+        if (!this._connected || !this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            return;
+        }
+        this.ws.send(JSON.stringify({
+            type: 'usage_report',
+            ...event,
+        }));
+    }
+    /**
+     * Clear channel context for a thread (e.g., when a thread ends).
+     */
+    clearChannelThread(chatJid) {
+        this.channelReplySessions.delete(chatJid);
+    }
+    /** Check if this JID belongs to a gateway thread. */
+    ownsJid(jid) { return jid.startsWith(GATEWAY_JID_PREFIX); }
+    isConnected() { return this._connected; }
+    async publishRoutingConfig(input = {}) {
+        if (!this._connected || !this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            logger.warn('Cannot publish gateway routing config: Gateway not connected');
+            return;
+        }
+        const routeTargetIds = input.routeTargetIds ?? [];
+        const channelThreads = input.channelThreads ?? [];
+        const channelThreadOwners = input.channelThreadOwners;
+        const commands = input.commands;
+        this.ws.send(JSON.stringify({
+            type: 'configure_channels',
+            agent_ids: routeTargetIds,
+            channel_threads: channelThreads,
+            ...(channelThreadOwners?.length
+                ? { channel_thread_owners: channelThreadOwners }
+                : {}),
+            ...(commands?.length ? { commands } : {}),
+        }));
+        logger.debug({
+            routeTargetCount: routeTargetIds.length,
+            channelThreadCount: channelThreads.length,
+            commandCount: commands?.length || 0,
+        }, 'Sent gateway routing config');
+    }
+    async disconnect() {
+        this.intentionalShutdown = true;
+        this._connected = false;
+        this.rejectPendingReplyStarts('Gateway disconnected');
+        this.stopReporting();
+        this.stopHeartbeat();
+        this.llmToken = null;
+        this.llmTokenExpiresAt = null;
+        if (this.connectionTimeout) {
+            clearTimeout(this.connectionTimeout);
+            this.connectionTimeout = null;
+        }
+        if (this.tokenRenewalTimeout)
+            clearTimeout(this.tokenRenewalTimeout);
+        if (this.reconnectTimeout)
+            clearTimeout(this.reconnectTimeout);
+        if (this.ws) {
+            this.ws.close();
+            this.ws = null;
+        }
+    }
+}
+// ── Module-level singleton for LLM token access ──
+let gatewayInstance = null;
+let gatewayConfigured = false;
+/** Set the gateway singleton (called once in index.ts after construction). */
+export function setGatewayInstance(gw) {
+    gatewayInstance = gw;
+    gatewayConfigured = !!gw && !!gw.config?.gateway_url;
+}
+/** Check if a gateway URL was configured (regardless of connection state). */
+export function isGatewayConfigured() {
+    return gatewayConfigured;
+}
+/** Get the gateway singleton (for routing channel replies). */
+export function getGatewayInstance() {
+    return gatewayInstance;
+}
+/** Get the current LLM token. Returns null if gateway hasn't issued one yet. */
+export function getLlmToken() {
+    return gatewayInstance?.getLlmToken() ?? null;
+}
+/**
+ * Wait for an LLM token to become available.
+ * Polls every 500ms up to timeoutMs (default 10s).
+ * Useful at startup when tasks may queue before the gateway connection is established.
+ * Rejects immediately if no gateway is configured (standalone mode).
+ */
+export function getLlmTokenOrWait(timeoutMs = 10_000) {
+    if (!gatewayConfigured) {
+        return Promise.reject(new Error('No gateway configured — cannot wait for LLM token'));
+    }
+    return new Promise((resolve, reject) => {
+        const token = getLlmToken();
+        if (token) {
+            resolve(token);
+            return;
+        }
+        const deadline = Date.now() + timeoutMs;
+        const interval = setInterval(() => {
+            const t = getLlmToken();
+            if (t) {
+                clearInterval(interval);
+                resolve(t);
+                return;
+            }
+            if (Date.now() > deadline) {
+                clearInterval(interval);
+                reject(new Error('Timed out waiting for LLM token'));
+            }
+        }, 500);
+    });
+}
+//# sourceMappingURL=gateway.js.map