@thevinci/web 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (337) hide show
  1. package/README.md +197 -0
  2. package/bin/cli-entry.js +55 -0
  3. package/bin/cli-output.js +145 -0
  4. package/bin/cli.js +4887 -0
  5. package/bin/cli.test.js +64 -0
  6. package/dist/apple-touch-icon-120x120.png +0 -0
  7. package/dist/apple-touch-icon-152x152.png +0 -0
  8. package/dist/apple-touch-icon-167x167.png +0 -0
  9. package/dist/apple-touch-icon-180x180.png +0 -0
  10. package/dist/apple-touch-icon.png +0 -0
  11. package/dist/apple-touch-icon.svg +528 -0
  12. package/dist/assets/JsonTreeView-CSm9OzXG.js +1 -0
  13. package/dist/assets/KaTeX_AMS-Regular-BQhdFMY1.woff2 +0 -0
  14. package/dist/assets/KaTeX_AMS-Regular-DMm9YOAa.woff +0 -0
  15. package/dist/assets/KaTeX_AMS-Regular-DRggAlZN.ttf +0 -0
  16. package/dist/assets/KaTeX_Caligraphic-Bold-ATXxdsX0.ttf +0 -0
  17. package/dist/assets/KaTeX_Caligraphic-Bold-BEiXGLvX.woff +0 -0
  18. package/dist/assets/KaTeX_Caligraphic-Bold-Dq_IR9rO.woff2 +0 -0
  19. package/dist/assets/KaTeX_Caligraphic-Regular-CTRA-rTL.woff +0 -0
  20. package/dist/assets/KaTeX_Caligraphic-Regular-Di6jR-x-.woff2 +0 -0
  21. package/dist/assets/KaTeX_Caligraphic-Regular-wX97UBjC.ttf +0 -0
  22. package/dist/assets/KaTeX_Fraktur-Bold-BdnERNNW.ttf +0 -0
  23. package/dist/assets/KaTeX_Fraktur-Bold-BsDP51OF.woff +0 -0
  24. package/dist/assets/KaTeX_Fraktur-Bold-CL6g_b3V.woff2 +0 -0
  25. package/dist/assets/KaTeX_Fraktur-Regular-CB_wures.ttf +0 -0
  26. package/dist/assets/KaTeX_Fraktur-Regular-CTYiF6lA.woff2 +0 -0
  27. package/dist/assets/KaTeX_Fraktur-Regular-Dxdc4cR9.woff +0 -0
  28. package/dist/assets/KaTeX_Main-Bold-Cx986IdX.woff2 +0 -0
  29. package/dist/assets/KaTeX_Main-Bold-Jm3AIy58.woff +0 -0
  30. package/dist/assets/KaTeX_Main-Bold-waoOVXN0.ttf +0 -0
  31. package/dist/assets/KaTeX_Main-BoldItalic-DxDJ3AOS.woff2 +0 -0
  32. package/dist/assets/KaTeX_Main-BoldItalic-DzxPMmG6.ttf +0 -0
  33. package/dist/assets/KaTeX_Main-BoldItalic-SpSLRI95.woff +0 -0
  34. package/dist/assets/KaTeX_Main-Italic-3WenGoN9.ttf +0 -0
  35. package/dist/assets/KaTeX_Main-Italic-BMLOBm91.woff +0 -0
  36. package/dist/assets/KaTeX_Main-Italic-NWA7e6Wa.woff2 +0 -0
  37. package/dist/assets/KaTeX_Main-Regular-B22Nviop.woff2 +0 -0
  38. package/dist/assets/KaTeX_Main-Regular-Dr94JaBh.woff +0 -0
  39. package/dist/assets/KaTeX_Main-Regular-ypZvNtVU.ttf +0 -0
  40. package/dist/assets/KaTeX_Math-BoldItalic-B3XSjfu4.ttf +0 -0
  41. package/dist/assets/KaTeX_Math-BoldItalic-CZnvNsCZ.woff2 +0 -0
  42. package/dist/assets/KaTeX_Math-BoldItalic-iY-2wyZ7.woff +0 -0
  43. package/dist/assets/KaTeX_Math-Italic-DA0__PXp.woff +0 -0
  44. package/dist/assets/KaTeX_Math-Italic-flOr_0UB.ttf +0 -0
  45. package/dist/assets/KaTeX_Math-Italic-t53AETM-.woff2 +0 -0
  46. package/dist/assets/KaTeX_SansSerif-Bold-CFMepnvq.ttf +0 -0
  47. package/dist/assets/KaTeX_SansSerif-Bold-D1sUS0GD.woff2 +0 -0
  48. package/dist/assets/KaTeX_SansSerif-Bold-DbIhKOiC.woff +0 -0
  49. package/dist/assets/KaTeX_SansSerif-Italic-C3H0VqGB.woff2 +0 -0
  50. package/dist/assets/KaTeX_SansSerif-Italic-DN2j7dab.woff +0 -0
  51. package/dist/assets/KaTeX_SansSerif-Italic-YYjJ1zSn.ttf +0 -0
  52. package/dist/assets/KaTeX_SansSerif-Regular-BNo7hRIc.ttf +0 -0
  53. package/dist/assets/KaTeX_SansSerif-Regular-CS6fqUqJ.woff +0 -0
  54. package/dist/assets/KaTeX_SansSerif-Regular-DDBCnlJ7.woff2 +0 -0
  55. package/dist/assets/KaTeX_Script-Regular-C5JkGWo-.ttf +0 -0
  56. package/dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 +0 -0
  57. package/dist/assets/KaTeX_Script-Regular-D5yQViql.woff +0 -0
  58. package/dist/assets/KaTeX_Size1-Regular-C195tn64.woff +0 -0
  59. package/dist/assets/KaTeX_Size1-Regular-Dbsnue_I.ttf +0 -0
  60. package/dist/assets/KaTeX_Size1-Regular-mCD8mA8B.woff2 +0 -0
  61. package/dist/assets/KaTeX_Size2-Regular-B7gKUWhC.ttf +0 -0
  62. package/dist/assets/KaTeX_Size2-Regular-Dy4dx90m.woff2 +0 -0
  63. package/dist/assets/KaTeX_Size2-Regular-oD1tc_U0.woff +0 -0
  64. package/dist/assets/KaTeX_Size3-Regular-CTq5MqoE.woff +0 -0
  65. package/dist/assets/KaTeX_Size3-Regular-DgpXs0kz.ttf +0 -0
  66. package/dist/assets/KaTeX_Size4-Regular-BF-4gkZK.woff +0 -0
  67. package/dist/assets/KaTeX_Size4-Regular-DWFBv043.ttf +0 -0
  68. package/dist/assets/KaTeX_Size4-Regular-Dl5lxZxV.woff2 +0 -0
  69. package/dist/assets/KaTeX_Typewriter-Regular-C0xS9mPB.woff +0 -0
  70. package/dist/assets/KaTeX_Typewriter-Regular-CO6r4hn1.woff2 +0 -0
  71. package/dist/assets/KaTeX_Typewriter-Regular-D3Ib7_Hf.ttf +0 -0
  72. package/dist/assets/MarkdownRendererImpl-DensKOLc.js +6 -0
  73. package/dist/assets/MultiRunWindow-Bo7THayo.js +1 -0
  74. package/dist/assets/OnboardingScreen-BDqmzTVR.js +2 -0
  75. package/dist/assets/SettingsWindow-coz__Ykw.js +1 -0
  76. package/dist/assets/TerminalView-DrZ-i3Dr.js +1 -0
  77. package/dist/assets/ToolOutputDialog-Eglzslt3.js +16 -0
  78. package/dist/assets/es-4o9ciP61.js +15 -0
  79. package/dist/assets/ibm-plex-mono-latin-400-normal-CvHOgSBP.woff +0 -0
  80. package/dist/assets/ibm-plex-mono-latin-400-normal-DMJ8VG8y.woff2 +0 -0
  81. package/dist/assets/ibm-plex-mono-latin-500-normal-CB9ihrfo.woff +0 -0
  82. package/dist/assets/ibm-plex-mono-latin-500-normal-DSY6xOcd.woff2 +0 -0
  83. package/dist/assets/ibm-plex-mono-latin-600-normal-BgSNZQsw.woff2 +0 -0
  84. package/dist/assets/ibm-plex-mono-latin-600-normal-DWFSQ4vo.woff +0 -0
  85. package/dist/assets/ibm-plex-sans-latin-400-normal-CDDApCn2.woff2 +0 -0
  86. package/dist/assets/ibm-plex-sans-latin-400-normal-CYLoc0-x.woff +0 -0
  87. package/dist/assets/ibm-plex-sans-latin-500-normal-6ng42L7E.woff2 +0 -0
  88. package/dist/assets/ibm-plex-sans-latin-500-normal-BgVn5rGT.woff +0 -0
  89. package/dist/assets/ibm-plex-sans-latin-600-normal-Cu4Hd6ag.woff +0 -0
  90. package/dist/assets/ibm-plex-sans-latin-600-normal-CuJfVYMP.woff2 +0 -0
  91. package/dist/assets/index-DLTDToSP.css +1 -0
  92. package/dist/assets/index-DgiFEKGN.js +1 -0
  93. package/dist/assets/ko-B20imCHE.js +15 -0
  94. package/dist/assets/main-BV3KOtdA.css +1 -0
  95. package/dist/assets/main-CDKJj0sH.js +226 -0
  96. package/dist/assets/main-LC-PSNVM.js +2 -0
  97. package/dist/assets/miniChat-CQUiG_cr.js +2 -0
  98. package/dist/assets/modelPrefsAutoSave-Dm799vzR.js +6986 -0
  99. package/dist/assets/pl-DQJ7LSzj.js +15 -0
  100. package/dist/assets/pt-BR-OmjHUz9y.js +15 -0
  101. package/dist/assets/renderElectronMiniChatApp-CARbeW0G.js +2 -0
  102. package/dist/assets/uk-BNFxOlO4.js +15 -0
  103. package/dist/assets/vendor--DBfsbEis.css +1 -0
  104. package/dist/assets/vendor-.bun-B9l0ZNi2.js +4094 -0
  105. package/dist/assets/wasm-CG6Dc4jp.js +1 -0
  106. package/dist/assets/wasmSttWorker-Dtlxac_K.js +1 -0
  107. package/dist/assets/wasmSttWorker-oo7Dm_jy.js +1806 -0
  108. package/dist/assets/worker-CbT6TVo7.js +155 -0
  109. package/dist/assets/zh-CN-C6T-Ac7F.js +15 -0
  110. package/dist/favicon-16.png +0 -0
  111. package/dist/favicon-32.png +0 -0
  112. package/dist/favicon.png +0 -0
  113. package/dist/favicon.svg +528 -0
  114. package/dist/index.html +607 -0
  115. package/dist/logo-dark-192x192.png +0 -0
  116. package/dist/logo-dark-512x512.png +0 -0
  117. package/dist/logo-dark-512x512.svg +528 -0
  118. package/dist/logo-light-192x192.png +0 -0
  119. package/dist/logo-light-512x512.png +0 -0
  120. package/dist/logo-light-512x512.svg +528 -0
  121. package/dist/mini-chat.html +16 -0
  122. package/dist/pwa-192.png +0 -0
  123. package/dist/pwa-512.png +0 -0
  124. package/dist/pwa-maskable-192.png +0 -0
  125. package/dist/pwa-maskable-512.png +0 -0
  126. package/dist/site.webmanifest +21 -0
  127. package/dist/sw.js +1 -0
  128. package/package.json +118 -0
  129. package/public/apple-touch-icon-120x120.png +0 -0
  130. package/public/apple-touch-icon-152x152.png +0 -0
  131. package/public/apple-touch-icon-167x167.png +0 -0
  132. package/public/apple-touch-icon-180x180.png +0 -0
  133. package/public/apple-touch-icon.png +0 -0
  134. package/public/apple-touch-icon.svg +528 -0
  135. package/public/favicon-16.png +0 -0
  136. package/public/favicon-32.png +0 -0
  137. package/public/favicon.png +0 -0
  138. package/public/favicon.svg +528 -0
  139. package/public/logo-dark-192x192.png +0 -0
  140. package/public/logo-dark-512x512.png +0 -0
  141. package/public/logo-dark-512x512.svg +528 -0
  142. package/public/logo-light-192x192.png +0 -0
  143. package/public/logo-light-512x512.png +0 -0
  144. package/public/logo-light-512x512.svg +528 -0
  145. package/public/pwa-192.png +0 -0
  146. package/public/pwa-512.png +0 -0
  147. package/public/pwa-maskable-192.png +0 -0
  148. package/public/pwa-maskable-512.png +0 -0
  149. package/public/site.webmanifest +21 -0
  150. package/server/TERMINAL_WS_PROTOCOL.md +48 -0
  151. package/server/index.d.ts +39 -0
  152. package/server/index.js +1311 -0
  153. package/server/lib/cloudflare-tunnel.js +650 -0
  154. package/server/lib/event-stream/DOCUMENTATION.md +61 -0
  155. package/server/lib/event-stream/directory-ws-bridge.js +185 -0
  156. package/server/lib/event-stream/global-hub.js +158 -0
  157. package/server/lib/event-stream/global-hub.test.js +140 -0
  158. package/server/lib/event-stream/global-ws-bridge.js +206 -0
  159. package/server/lib/event-stream/index.js +25 -0
  160. package/server/lib/event-stream/protocol.js +131 -0
  161. package/server/lib/event-stream/protocol.test.js +182 -0
  162. package/server/lib/event-stream/runtime.js +180 -0
  163. package/server/lib/event-stream/runtime.test.js +512 -0
  164. package/server/lib/event-stream/upstream-reader.js +226 -0
  165. package/server/lib/event-stream/upstream-reader.test.js +276 -0
  166. package/server/lib/fs/DOCUMENTATION.md +36 -0
  167. package/server/lib/fs/routes.js +1040 -0
  168. package/server/lib/fs/search.js +238 -0
  169. package/server/lib/git/DOCUMENTATION.md +152 -0
  170. package/server/lib/git/credentials.js +74 -0
  171. package/server/lib/git/identity-storage.js +112 -0
  172. package/server/lib/git/index.js +6 -0
  173. package/server/lib/git/routes.js +972 -0
  174. package/server/lib/git/service.js +3432 -0
  175. package/server/lib/git/service.test.js +39 -0
  176. package/server/lib/github/DOCUMENTATION.md +171 -0
  177. package/server/lib/github/auth.js +307 -0
  178. package/server/lib/github/device-flow.js +50 -0
  179. package/server/lib/github/index.js +24 -0
  180. package/server/lib/github/octokit.js +10 -0
  181. package/server/lib/github/pr-status.js +519 -0
  182. package/server/lib/github/repo/fork-detection.js +102 -0
  183. package/server/lib/github/repo/index.js +55 -0
  184. package/server/lib/github/routes.js +1560 -0
  185. package/server/lib/magic-prompts/routes.js +63 -0
  186. package/server/lib/magic-prompts/runtime.js +119 -0
  187. package/server/lib/notifications/DOCUMENTATION.md +122 -0
  188. package/server/lib/notifications/emitter-runtime.js +102 -0
  189. package/server/lib/notifications/index.js +4 -0
  190. package/server/lib/notifications/message.js +52 -0
  191. package/server/lib/notifications/message.test.js +34 -0
  192. package/server/lib/notifications/push-runtime.js +304 -0
  193. package/server/lib/notifications/routes.js +315 -0
  194. package/server/lib/notifications/runtime.js +566 -0
  195. package/server/lib/notifications/template-runtime.js +349 -0
  196. package/server/lib/notifications/template-runtime.test.js +26 -0
  197. package/server/lib/opencode/DOCUMENTATION.md +362 -0
  198. package/server/lib/opencode/agents.js +634 -0
  199. package/server/lib/opencode/auth-state-runtime.js +88 -0
  200. package/server/lib/opencode/auth.js +83 -0
  201. package/server/lib/opencode/bootstrap-runtime.js +131 -0
  202. package/server/lib/opencode/cli-entry-runtime.js +43 -0
  203. package/server/lib/opencode/cli-options.js +128 -0
  204. package/server/lib/opencode/commands.js +339 -0
  205. package/server/lib/opencode/config-entity-routes.js +370 -0
  206. package/server/lib/opencode/core-routes.js +500 -0
  207. package/server/lib/opencode/core-routes.test.js +26 -0
  208. package/server/lib/opencode/env-config.js +74 -0
  209. package/server/lib/opencode/env-keys.js +68 -0
  210. package/server/lib/opencode/env-runtime.js +1162 -0
  211. package/server/lib/opencode/env-runtime.test.js +116 -0
  212. package/server/lib/opencode/feature-routes-runtime.js +244 -0
  213. package/server/lib/opencode/hmr-state-runtime.js +85 -0
  214. package/server/lib/opencode/index.js +66 -0
  215. package/server/lib/opencode/lifecycle.js +1019 -0
  216. package/server/lib/opencode/lifecycle.test.js +240 -0
  217. package/server/lib/opencode/mcp.js +278 -0
  218. package/server/lib/opencode/network-runtime.js +104 -0
  219. package/server/lib/opencode/network-runtime.test.js +37 -0
  220. package/server/lib/opencode/opencode-resolution-runtime.js +71 -0
  221. package/server/lib/opencode/path-utils.js +100 -0
  222. package/server/lib/opencode/path-utils.test.js +71 -0
  223. package/server/lib/opencode/project-directory-runtime.js +124 -0
  224. package/server/lib/opencode/project-icon-routes.js +399 -0
  225. package/server/lib/opencode/project-icon-routes.test.js +107 -0
  226. package/server/lib/opencode/providers.js +96 -0
  227. package/server/lib/opencode/proxy.js +445 -0
  228. package/server/lib/opencode/pwa-manifest-routes.js +257 -0
  229. package/server/lib/opencode/pwa-manifest-routes.test.js +133 -0
  230. package/server/lib/opencode/routes.js +541 -0
  231. package/server/lib/opencode/server-startup-runtime.js +156 -0
  232. package/server/lib/opencode/server-utils-runtime.js +168 -0
  233. package/server/lib/opencode/server-utils-runtime.test.js +135 -0
  234. package/server/lib/opencode/session-runtime.js +356 -0
  235. package/server/lib/opencode/session-runtime.test.js +151 -0
  236. package/server/lib/opencode/settings-helpers.js +770 -0
  237. package/server/lib/opencode/settings-helpers.test.js +109 -0
  238. package/server/lib/opencode/settings-normalization-runtime.js +428 -0
  239. package/server/lib/opencode/settings-runtime.js +826 -0
  240. package/server/lib/opencode/settings-runtime.test.js +85 -0
  241. package/server/lib/opencode/shared.js +615 -0
  242. package/server/lib/opencode/shutdown-runtime.js +139 -0
  243. package/server/lib/opencode/shutdown-runtime.test.js +58 -0
  244. package/server/lib/opencode/skill-routes.js +701 -0
  245. package/server/lib/opencode/skills.js +548 -0
  246. package/server/lib/opencode/startup-pipeline-runtime.js +130 -0
  247. package/server/lib/opencode/static-routes-runtime.js +65 -0
  248. package/server/lib/opencode/theme-runtime.js +167 -0
  249. package/server/lib/opencode/tunnel-auth.js +591 -0
  250. package/server/lib/opencode/tunnel-wiring-runtime.js +94 -0
  251. package/server/lib/opencode/vinci-routes.js +76 -0
  252. package/server/lib/opencode/watcher.js +115 -0
  253. package/server/lib/opencode/watcher.test.js +239 -0
  254. package/server/lib/preview/proxy-runtime.js +1333 -0
  255. package/server/lib/preview/proxy-runtime.test.js +144 -0
  256. package/server/lib/projects/project-config.js +567 -0
  257. package/server/lib/projects/project-config.test.js +175 -0
  258. package/server/lib/projects/project-id.js +13 -0
  259. package/server/lib/quota/DOCUMENTATION.md +58 -0
  260. package/server/lib/quota/index.js +25 -0
  261. package/server/lib/quota/providers/claude.js +107 -0
  262. package/server/lib/quota/providers/codex.js +113 -0
  263. package/server/lib/quota/providers/copilot.js +165 -0
  264. package/server/lib/quota/providers/google/api.js +92 -0
  265. package/server/lib/quota/providers/google/auth.js +108 -0
  266. package/server/lib/quota/providers/google/index.js +124 -0
  267. package/server/lib/quota/providers/google/transforms.js +109 -0
  268. package/server/lib/quota/providers/index.js +168 -0
  269. package/server/lib/quota/providers/interface.js +55 -0
  270. package/server/lib/quota/providers/kimi.js +108 -0
  271. package/server/lib/quota/providers/minimax-cn-coding-plan.js +140 -0
  272. package/server/lib/quota/providers/minimax-coding-plan.js +139 -0
  273. package/server/lib/quota/providers/nanogpt.js +124 -0
  274. package/server/lib/quota/providers/ollama-cloud.js +112 -0
  275. package/server/lib/quota/providers/openai.js +91 -0
  276. package/server/lib/quota/providers/openrouter.js +92 -0
  277. package/server/lib/quota/providers/zai.js +91 -0
  278. package/server/lib/quota/providers/zhipuai-coding-plan.js +133 -0
  279. package/server/lib/quota/providers/zhipuai.js +114 -0
  280. package/server/lib/quota/routes.js +27 -0
  281. package/server/lib/quota/utils/auth.js +50 -0
  282. package/server/lib/quota/utils/formatters.js +85 -0
  283. package/server/lib/quota/utils/formatters.test.js +54 -0
  284. package/server/lib/quota/utils/index.js +10 -0
  285. package/server/lib/quota/utils/transformers.js +55 -0
  286. package/server/lib/scheduled-tasks/DOCUMENTATION.md +44 -0
  287. package/server/lib/scheduled-tasks/routes.js +235 -0
  288. package/server/lib/scheduled-tasks/runtime.js +773 -0
  289. package/server/lib/scheduled-tasks/runtime.test.js +100 -0
  290. package/server/lib/security/request-security.js +115 -0
  291. package/server/lib/session-folders/routes.js +63 -0
  292. package/server/lib/session-folders/routes.test.js +102 -0
  293. package/server/lib/skills-catalog/DOCUMENTATION.md +178 -0
  294. package/server/lib/skills-catalog/cache.js +29 -0
  295. package/server/lib/skills-catalog/clawdhub/api.js +158 -0
  296. package/server/lib/skills-catalog/clawdhub/index.js +30 -0
  297. package/server/lib/skills-catalog/clawdhub/install.js +238 -0
  298. package/server/lib/skills-catalog/clawdhub/scan.js +113 -0
  299. package/server/lib/skills-catalog/curated-sources.js +21 -0
  300. package/server/lib/skills-catalog/git.js +77 -0
  301. package/server/lib/skills-catalog/index.js +42 -0
  302. package/server/lib/skills-catalog/install.js +294 -0
  303. package/server/lib/skills-catalog/scan.js +221 -0
  304. package/server/lib/skills-catalog/source.js +87 -0
  305. package/server/lib/terminal/DOCUMENTATION.md +76 -0
  306. package/server/lib/terminal/index.js +31 -0
  307. package/server/lib/terminal/output-replay-buffer.js +78 -0
  308. package/server/lib/terminal/output-replay-buffer.test.js +75 -0
  309. package/server/lib/terminal/runtime.js +850 -0
  310. package/server/lib/terminal/runtime.test.js +96 -0
  311. package/server/lib/terminal/terminal-ws-protocol.js +68 -0
  312. package/server/lib/terminal/terminal-ws-protocol.test.js +145 -0
  313. package/server/lib/text/DOCUMENTATION.md +35 -0
  314. package/server/lib/text/summarization.js +138 -0
  315. package/server/lib/text/summarization.test.js +34 -0
  316. package/server/lib/tts/DOCUMENTATION.md +146 -0
  317. package/server/lib/tts/base-url.js +62 -0
  318. package/server/lib/tts/capability-runtime.js +31 -0
  319. package/server/lib/tts/index.js +19 -0
  320. package/server/lib/tts/routes.js +261 -0
  321. package/server/lib/tts/routes.test.js +53 -0
  322. package/server/lib/tts/service.js +178 -0
  323. package/server/lib/tts/stt.js +75 -0
  324. package/server/lib/tunnels/DOCUMENTATION.md +18 -0
  325. package/server/lib/tunnels/index.js +166 -0
  326. package/server/lib/tunnels/managed-config.js +201 -0
  327. package/server/lib/tunnels/providers/cloudflare.js +260 -0
  328. package/server/lib/tunnels/registry.js +51 -0
  329. package/server/lib/tunnels/routes.js +605 -0
  330. package/server/lib/tunnels/types.js +219 -0
  331. package/server/lib/ui-auth/DOCUMENTATION.md +38 -0
  332. package/server/lib/ui-auth/ui-auth.js +673 -0
  333. package/server/lib/ui-auth/ui-passkeys.js +545 -0
  334. package/server/opencode-proxy.test.js +151 -0
  335. package/server/proxy-headers.js +61 -0
  336. package/server/proxy-headers.test.js +58 -0
  337. package/server/sse-routes.test.js +152 -0
@@ -0,0 +1,770 @@
1
+ export const createSettingsHelpers = (dependencies) => {
2
+ const {
3
+ normalizePathForPersistence,
4
+ normalizeDirectoryPath,
5
+ normalizeTunnelBootstrapTtlMs,
6
+ normalizeTunnelSessionTtlMs,
7
+ normalizeTunnelProvider,
8
+ normalizeTunnelMode,
9
+ normalizeOptionalPath,
10
+ normalizeManagedRemoteTunnelHostname,
11
+ normalizeManagedRemoteTunnelPresets,
12
+ normalizeManagedRemoteTunnelPresetTokens,
13
+ sanitizeTypographySizesPartial,
14
+ normalizeStringArray,
15
+ sanitizeModelRefs,
16
+ sanitizeSkillCatalogs,
17
+ sanitizeProjects,
18
+ } = dependencies;
19
+
20
+ const PWA_APP_NAME_MAX_LENGTH = 64;
21
+ const STT_SERVER_URL_MAX_LENGTH = 2048;
22
+ const STT_MODEL_MAX_LENGTH = 256;
23
+ const STT_LANGUAGE_MAX_LENGTH = 64;
24
+ const PWA_ORIENTATION_VALUES = new Set(['system', 'portrait', 'landscape']);
25
+ const MOBILE_KEYBOARD_MODE_VALUES = new Set(['native', 'resize-content']);
26
+
27
+ const normalizePwaAppName = (value, fallback = '') => {
28
+ if (typeof value !== 'string') {
29
+ return fallback;
30
+ }
31
+ const normalized = value.trim().replace(/\s+/g, ' ');
32
+ if (!normalized) {
33
+ return fallback;
34
+ }
35
+ return normalized.slice(0, PWA_APP_NAME_MAX_LENGTH);
36
+ };
37
+
38
+ const normalizePwaOrientation = (value, fallback = 'system') => {
39
+ if (typeof value !== 'string') {
40
+ return fallback;
41
+ }
42
+ const normalized = value.trim();
43
+ if (PWA_ORIENTATION_VALUES.has(normalized)) {
44
+ return normalized;
45
+ }
46
+ return fallback;
47
+ };
48
+
49
+ const normalizeMobileKeyboardMode = (value, fallback = 'native') => {
50
+ if (typeof value !== 'string') {
51
+ return fallback;
52
+ }
53
+ const normalized = value.trim();
54
+ if (MOBILE_KEYBOARD_MODE_VALUES.has(normalized)) {
55
+ return normalized;
56
+ }
57
+ return fallback;
58
+ };
59
+
60
+ const sanitizeSettingsUpdate = (payload) => {
61
+ if (!payload || typeof payload !== 'object') {
62
+ return {};
63
+ }
64
+
65
+ const candidate = payload;
66
+ const result = {};
67
+
68
+ if (typeof candidate.themeId === 'string' && candidate.themeId.length > 0) {
69
+ result.themeId = candidate.themeId;
70
+ }
71
+ if (typeof candidate.themeVariant === 'string' && (candidate.themeVariant === 'light' || candidate.themeVariant === 'dark')) {
72
+ result.themeVariant = candidate.themeVariant;
73
+ }
74
+ if (typeof candidate.useSystemTheme === 'boolean') {
75
+ result.useSystemTheme = candidate.useSystemTheme;
76
+ }
77
+ if (typeof candidate.lightThemeId === 'string' && candidate.lightThemeId.length > 0) {
78
+ result.lightThemeId = candidate.lightThemeId;
79
+ }
80
+ if (typeof candidate.darkThemeId === 'string' && candidate.darkThemeId.length > 0) {
81
+ result.darkThemeId = candidate.darkThemeId;
82
+ }
83
+ if (typeof candidate.splashBgLight === 'string' && candidate.splashBgLight.trim().length > 0) {
84
+ result.splashBgLight = candidate.splashBgLight.trim();
85
+ }
86
+ if (typeof candidate.splashFgLight === 'string' && candidate.splashFgLight.trim().length > 0) {
87
+ result.splashFgLight = candidate.splashFgLight.trim();
88
+ }
89
+ if (typeof candidate.splashBgDark === 'string' && candidate.splashBgDark.trim().length > 0) {
90
+ result.splashBgDark = candidate.splashBgDark.trim();
91
+ }
92
+ if (typeof candidate.splashFgDark === 'string' && candidate.splashFgDark.trim().length > 0) {
93
+ result.splashFgDark = candidate.splashFgDark.trim();
94
+ }
95
+ if (typeof candidate.lastDirectory === 'string' && candidate.lastDirectory.length > 0) {
96
+ const normalized = normalizePathForPersistence(candidate.lastDirectory);
97
+ if (typeof normalized === 'string' && normalized.length > 0) {
98
+ result.lastDirectory = normalized;
99
+ }
100
+ }
101
+ if (typeof candidate.homeDirectory === 'string' && candidate.homeDirectory.length > 0) {
102
+ const normalized = normalizePathForPersistence(candidate.homeDirectory);
103
+ if (typeof normalized === 'string' && normalized.length > 0) {
104
+ result.homeDirectory = normalized;
105
+ }
106
+ }
107
+
108
+ // Absolute path to the opencode CLI binary (optional override).
109
+ // Accept empty-string to clear (we persist an empty string sentinel so the running
110
+ // process can reliably drop a previously applied OPENCODE_BINARY override).
111
+ if (typeof candidate.opencodeBinary === 'string') {
112
+ const normalized = normalizeDirectoryPath(candidate.opencodeBinary).trim();
113
+ result.opencodeBinary = normalized;
114
+ }
115
+ if (typeof candidate.klipyAppKey === 'string') {
116
+ result.klipyAppKey = candidate.klipyAppKey.trim();
117
+ }
118
+ if (typeof candidate.imageGenApiKey === 'string') {
119
+ result.imageGenApiKey = candidate.imageGenApiKey.trim();
120
+ }
121
+ if (typeof candidate.elevenlabsApiKey === 'string') {
122
+ result.elevenlabsApiKey = candidate.elevenlabsApiKey.trim();
123
+ }
124
+ if (candidate.extraEnvVars && typeof candidate.extraEnvVars === 'object' && !Array.isArray(candidate.extraEnvVars)) {
125
+ const sanitized = {};
126
+ for (const [key, value] of Object.entries(candidate.extraEnvVars)) {
127
+ if (typeof key === 'string' && typeof value === 'string' && key.trim()) {
128
+ sanitized[key.trim()] = value.trim();
129
+ }
130
+ }
131
+ result.extraEnvVars = sanitized;
132
+ }
133
+ if (typeof candidate.desktopLanAccessEnabled === 'boolean') {
134
+ result.desktopLanAccessEnabled = candidate.desktopLanAccessEnabled;
135
+ }
136
+ if (Array.isArray(candidate.projects)) {
137
+ const projects = sanitizeProjects(candidate.projects);
138
+ if (projects) {
139
+ result.projects = projects;
140
+ }
141
+ }
142
+ if (typeof candidate.activeProjectId === 'string' && candidate.activeProjectId.length > 0) {
143
+ result.activeProjectId = candidate.activeProjectId;
144
+ }
145
+
146
+ if (Array.isArray(candidate.approvedDirectories)) {
147
+ result.approvedDirectories = normalizeStringArray(
148
+ candidate.approvedDirectories
149
+ .map((entry) => (typeof entry === 'string' ? normalizePathForPersistence(entry) : entry))
150
+ .filter((entry) => typeof entry === 'string' && entry.length > 0)
151
+ );
152
+ }
153
+ if (Array.isArray(candidate.securityScopedBookmarks)) {
154
+ result.securityScopedBookmarks = normalizeStringArray(candidate.securityScopedBookmarks);
155
+ }
156
+ if (Array.isArray(candidate.pinnedDirectories)) {
157
+ result.pinnedDirectories = normalizeStringArray(
158
+ candidate.pinnedDirectories
159
+ .map((entry) => (typeof entry === 'string' ? normalizePathForPersistence(entry) : entry))
160
+ .filter((entry) => typeof entry === 'string' && entry.length > 0)
161
+ );
162
+ }
163
+
164
+
165
+ if (typeof candidate.uiFont === 'string' && candidate.uiFont.length > 0) {
166
+ result.uiFont = candidate.uiFont;
167
+ }
168
+ if (typeof candidate.monoFont === 'string' && candidate.monoFont.length > 0) {
169
+ result.monoFont = candidate.monoFont;
170
+ }
171
+ if (typeof candidate.markdownDisplayMode === 'string' && candidate.markdownDisplayMode.length > 0) {
172
+ result.markdownDisplayMode = candidate.markdownDisplayMode;
173
+ }
174
+ if (typeof candidate.githubClientId === 'string') {
175
+ const trimmed = candidate.githubClientId.trim();
176
+ if (trimmed.length > 0) {
177
+ result.githubClientId = trimmed;
178
+ }
179
+ }
180
+ if (typeof candidate.githubScopes === 'string') {
181
+ const trimmed = candidate.githubScopes.trim();
182
+ if (trimmed.length > 0) {
183
+ result.githubScopes = trimmed;
184
+ }
185
+ }
186
+ if (typeof candidate.showReasoningTraces === 'boolean') {
187
+ result.showReasoningTraces = candidate.showReasoningTraces;
188
+ }
189
+ if (typeof candidate.collapsibleThinkingBlocks === 'boolean') {
190
+ result.collapsibleThinkingBlocks = candidate.collapsibleThinkingBlocks;
191
+ }
192
+ if (typeof candidate.showTextJustificationActivity === 'boolean') {
193
+ result.showTextJustificationActivity = candidate.showTextJustificationActivity;
194
+ }
195
+ if (typeof candidate.showDeletionDialog === 'boolean') {
196
+ result.showDeletionDialog = candidate.showDeletionDialog;
197
+ }
198
+ if (typeof candidate.nativeNotificationsEnabled === 'boolean') {
199
+ result.nativeNotificationsEnabled = candidate.nativeNotificationsEnabled;
200
+ }
201
+ if (typeof candidate.notificationMode === 'string') {
202
+ const mode = candidate.notificationMode.trim();
203
+ if (mode === 'always' || mode === 'hidden-only') {
204
+ result.notificationMode = mode;
205
+ }
206
+ }
207
+ if (typeof candidate.notifyOnSubtasks === 'boolean') {
208
+ result.notifyOnSubtasks = candidate.notifyOnSubtasks;
209
+ }
210
+ if (typeof candidate.notifyOnCompletion === 'boolean') {
211
+ result.notifyOnCompletion = candidate.notifyOnCompletion;
212
+ }
213
+ if (typeof candidate.notifyOnError === 'boolean') {
214
+ result.notifyOnError = candidate.notifyOnError;
215
+ }
216
+ if (typeof candidate.notifyOnQuestion === 'boolean') {
217
+ result.notifyOnQuestion = candidate.notifyOnQuestion;
218
+ }
219
+ if (candidate.notificationTemplates && typeof candidate.notificationTemplates === 'object') {
220
+ result.notificationTemplates = candidate.notificationTemplates;
221
+ }
222
+ if (typeof candidate.summarizeLastMessage === 'boolean') {
223
+ result.summarizeLastMessage = candidate.summarizeLastMessage;
224
+ }
225
+ if (typeof candidate.summaryThreshold === 'number' && Number.isFinite(candidate.summaryThreshold)) {
226
+ result.summaryThreshold = Math.max(0, Math.round(candidate.summaryThreshold));
227
+ }
228
+ if (typeof candidate.summaryLength === 'number' && Number.isFinite(candidate.summaryLength)) {
229
+ result.summaryLength = Math.max(10, Math.round(candidate.summaryLength));
230
+ }
231
+ if (typeof candidate.maxLastMessageLength === 'number' && Number.isFinite(candidate.maxLastMessageLength)) {
232
+ result.maxLastMessageLength = Math.max(10, Math.round(candidate.maxLastMessageLength));
233
+ }
234
+ if (typeof candidate.usageAutoRefresh === 'boolean') {
235
+ result.usageAutoRefresh = candidate.usageAutoRefresh;
236
+ }
237
+ if (typeof candidate.usageRefreshIntervalMs === 'number' && Number.isFinite(candidate.usageRefreshIntervalMs)) {
238
+ result.usageRefreshIntervalMs = Math.max(30000, Math.min(300000, Math.round(candidate.usageRefreshIntervalMs)));
239
+ }
240
+ if (candidate.usageDisplayMode === 'usage' || candidate.usageDisplayMode === 'remaining') {
241
+ result.usageDisplayMode = candidate.usageDisplayMode;
242
+ }
243
+ if (Array.isArray(candidate.usageDropdownProviders)) {
244
+ result.usageDropdownProviders = normalizeStringArray(candidate.usageDropdownProviders);
245
+ }
246
+ if (typeof candidate.autoDeleteEnabled === 'boolean') {
247
+ result.autoDeleteEnabled = candidate.autoDeleteEnabled;
248
+ }
249
+ if (typeof candidate.autoDeleteAfterDays === 'number' && Number.isFinite(candidate.autoDeleteAfterDays)) {
250
+ const normalizedDays = Math.max(1, Math.min(365, Math.round(candidate.autoDeleteAfterDays)));
251
+ result.autoDeleteAfterDays = normalizedDays;
252
+ }
253
+ if (candidate.tunnelBootstrapTtlMs === null) {
254
+ result.tunnelBootstrapTtlMs = null;
255
+ } else if (typeof candidate.tunnelBootstrapTtlMs === 'number' && Number.isFinite(candidate.tunnelBootstrapTtlMs)) {
256
+ result.tunnelBootstrapTtlMs = normalizeTunnelBootstrapTtlMs(candidate.tunnelBootstrapTtlMs);
257
+ }
258
+ if (typeof candidate.tunnelSessionTtlMs === 'number' && Number.isFinite(candidate.tunnelSessionTtlMs)) {
259
+ result.tunnelSessionTtlMs = normalizeTunnelSessionTtlMs(candidate.tunnelSessionTtlMs);
260
+ }
261
+ if (typeof candidate.tunnelProvider === 'string') {
262
+ const provider = normalizeTunnelProvider(candidate.tunnelProvider);
263
+ if (provider) {
264
+ result.tunnelProvider = provider;
265
+ }
266
+ }
267
+ if (typeof candidate.tunnelMode === 'string') {
268
+ result.tunnelMode = normalizeTunnelMode(candidate.tunnelMode);
269
+ }
270
+ if (candidate.managedLocalTunnelConfigPath === null) {
271
+ result.managedLocalTunnelConfigPath = null;
272
+ } else if (typeof candidate.managedLocalTunnelConfigPath === 'string') {
273
+ const trimmed = candidate.managedLocalTunnelConfigPath.trim();
274
+ result.managedLocalTunnelConfigPath = trimmed.length > 0 ? normalizeOptionalPath(trimmed) : null;
275
+ }
276
+ if (typeof candidate.managedRemoteTunnelHostname === 'string') {
277
+ const hostname = normalizeManagedRemoteTunnelHostname(candidate.managedRemoteTunnelHostname);
278
+ result.managedRemoteTunnelHostname = hostname;
279
+ }
280
+ if (candidate.managedRemoteTunnelToken === null) {
281
+ result.managedRemoteTunnelToken = null;
282
+ } else if (typeof candidate.managedRemoteTunnelToken === 'string') {
283
+ result.managedRemoteTunnelToken = candidate.managedRemoteTunnelToken.trim();
284
+ }
285
+ const managedRemoteTunnelPresets = normalizeManagedRemoteTunnelPresets(candidate.managedRemoteTunnelPresets);
286
+ if (managedRemoteTunnelPresets) {
287
+ result.managedRemoteTunnelPresets = managedRemoteTunnelPresets;
288
+ }
289
+ const managedRemoteTunnelPresetTokens = normalizeManagedRemoteTunnelPresetTokens(candidate.managedRemoteTunnelPresetTokens);
290
+ if (managedRemoteTunnelPresetTokens) {
291
+ result.managedRemoteTunnelPresetTokens = managedRemoteTunnelPresetTokens;
292
+ }
293
+ if (typeof candidate.managedRemoteTunnelSelectedPresetId === 'string') {
294
+ const id = candidate.managedRemoteTunnelSelectedPresetId.trim();
295
+ result.managedRemoteTunnelSelectedPresetId = id || undefined;
296
+ }
297
+
298
+ const typography = sanitizeTypographySizesPartial(candidate.typographySizes);
299
+ if (typography) {
300
+ result.typographySizes = typography;
301
+ }
302
+
303
+ if (typeof candidate.defaultModel === 'string') {
304
+ const trimmed = candidate.defaultModel.trim();
305
+ result.defaultModel = trimmed.length > 0 ? trimmed : undefined;
306
+ }
307
+ if (typeof candidate.defaultVariant === 'string') {
308
+ const trimmed = candidate.defaultVariant.trim();
309
+ result.defaultVariant = trimmed.length > 0 ? trimmed : undefined;
310
+ }
311
+ if (typeof candidate.defaultAgent === 'string') {
312
+ const trimmed = candidate.defaultAgent.trim();
313
+ result.defaultAgent = trimmed.length > 0 ? trimmed : undefined;
314
+ }
315
+ if (typeof candidate.defaultGitIdentityId === 'string') {
316
+ const trimmed = candidate.defaultGitIdentityId.trim();
317
+ result.defaultGitIdentityId = trimmed.length > 0 ? trimmed : undefined;
318
+ }
319
+ if (typeof candidate.queueModeEnabled === 'boolean') {
320
+ result.queueModeEnabled = candidate.queueModeEnabled;
321
+ }
322
+ if (typeof candidate.autoCreateWorktree === 'boolean') {
323
+ result.autoCreateWorktree = candidate.autoCreateWorktree;
324
+ }
325
+ if (typeof candidate.gitmojiEnabled === 'boolean') {
326
+ result.gitmojiEnabled = candidate.gitmojiEnabled;
327
+ }
328
+ if (typeof candidate.defaultFileViewerPreview === 'boolean') {
329
+ result.defaultFileViewerPreview = candidate.defaultFileViewerPreview;
330
+ }
331
+ if (typeof candidate.zenModel === 'string') {
332
+ const trimmed = candidate.zenModel.trim();
333
+ result.zenModel = trimmed.length > 0 ? trimmed : undefined;
334
+ }
335
+ if (typeof candidate.gitProviderId === 'string') {
336
+ const trimmed = candidate.gitProviderId.trim();
337
+ result.gitProviderId = trimmed.length > 0 ? trimmed : undefined;
338
+ }
339
+ if (typeof candidate.gitModelId === 'string') {
340
+ const trimmed = candidate.gitModelId.trim();
341
+ result.gitModelId = trimmed.length > 0 ? trimmed : undefined;
342
+ }
343
+ if (typeof candidate.pwaAppName === 'string') {
344
+ result.pwaAppName = normalizePwaAppName(candidate.pwaAppName, undefined);
345
+ }
346
+ if (typeof candidate.pwaOrientation === 'string') {
347
+ result.pwaOrientation = normalizePwaOrientation(candidate.pwaOrientation, undefined);
348
+ }
349
+ if (typeof candidate.mobileKeyboardMode === 'string') {
350
+ const mode = normalizeMobileKeyboardMode(candidate.mobileKeyboardMode, undefined);
351
+ if (mode) {
352
+ result.mobileKeyboardMode = mode;
353
+ }
354
+ }
355
+ if (typeof candidate.toolCallExpansion === 'string') {
356
+ const mode = candidate.toolCallExpansion.trim();
357
+ if (mode === 'collapsed' || mode === 'activity' || mode === 'detailed' || mode === 'changes') {
358
+ result.toolCallExpansion = mode;
359
+ }
360
+ }
361
+ if (typeof candidate.inputSpellcheckEnabled === 'boolean') {
362
+ result.inputSpellcheckEnabled = candidate.inputSpellcheckEnabled;
363
+ }
364
+ if (typeof candidate.showToolFileIcons === 'boolean') {
365
+ result.showToolFileIcons = candidate.showToolFileIcons;
366
+ }
367
+ if (typeof candidate.showExpandedBashTools === 'boolean') {
368
+ result.showExpandedBashTools = candidate.showExpandedBashTools;
369
+ }
370
+ if (typeof candidate.showExpandedEditTools === 'boolean') {
371
+ result.showExpandedEditTools = candidate.showExpandedEditTools;
372
+ }
373
+ if (typeof candidate.timeFormatPreference === 'string') {
374
+ const mode = candidate.timeFormatPreference.trim();
375
+ if (mode === 'auto' || mode === '12h' || mode === '24h') {
376
+ result.timeFormatPreference = mode;
377
+ }
378
+ }
379
+ if (typeof candidate.weekStartPreference === 'string') {
380
+ const mode = candidate.weekStartPreference.trim();
381
+ if (mode === 'auto' || mode === 'sunday' || mode === 'monday') {
382
+ result.weekStartPreference = mode;
383
+ }
384
+ }
385
+ if (typeof candidate.chatRenderMode === 'string') {
386
+ const mode = candidate.chatRenderMode.trim();
387
+ if (mode === 'sorted' || mode === 'live') {
388
+ result.chatRenderMode = mode;
389
+ }
390
+ }
391
+ if (typeof candidate.messageStreamTransport === 'string') {
392
+ const mode = candidate.messageStreamTransport.trim();
393
+ if (mode === 'auto' || mode === 'ws' || mode === 'sse') {
394
+ result.messageStreamTransport = mode;
395
+ }
396
+ }
397
+ if (typeof candidate.activityRenderMode === 'string') {
398
+ const mode = candidate.activityRenderMode.trim();
399
+ if (mode === 'collapsed' || mode === 'summary') {
400
+ result.activityRenderMode = mode;
401
+ }
402
+ }
403
+ if (typeof candidate.mermaidRenderingMode === 'string') {
404
+ const mode = candidate.mermaidRenderingMode.trim();
405
+ if (mode === 'svg' || mode === 'ascii') {
406
+ result.mermaidRenderingMode = mode;
407
+ }
408
+ }
409
+ if (typeof candidate.userMessageRenderingMode === 'string') {
410
+ const mode = candidate.userMessageRenderingMode.trim();
411
+ if (mode === 'markdown' || mode === 'plain') {
412
+ result.userMessageRenderingMode = mode;
413
+ }
414
+ }
415
+ if (typeof candidate.stickyUserHeader === 'boolean') {
416
+ result.stickyUserHeader = candidate.stickyUserHeader;
417
+ }
418
+ if (typeof candidate.showSplitAssistantMessageActions === 'boolean') {
419
+ result.showSplitAssistantMessageActions = candidate.showSplitAssistantMessageActions;
420
+ }
421
+ if (typeof candidate.fontSize === 'number' && Number.isFinite(candidate.fontSize)) {
422
+ result.fontSize = Math.max(50, Math.min(200, Math.round(candidate.fontSize)));
423
+ }
424
+ if (typeof candidate.terminalFontSize === 'number' && Number.isFinite(candidate.terminalFontSize)) {
425
+ result.terminalFontSize = Math.max(9, Math.min(52, Math.round(candidate.terminalFontSize)));
426
+ }
427
+ if (typeof candidate.padding === 'number' && Number.isFinite(candidate.padding)) {
428
+ result.padding = Math.max(50, Math.min(200, Math.round(candidate.padding)));
429
+ }
430
+ if (typeof candidate.cornerRadius === 'number' && Number.isFinite(candidate.cornerRadius)) {
431
+ result.cornerRadius = Math.max(0, Math.min(32, Math.round(candidate.cornerRadius)));
432
+ }
433
+ if (typeof candidate.inputBarOffset === 'number' && Number.isFinite(candidate.inputBarOffset)) {
434
+ result.inputBarOffset = Math.max(0, Math.min(100, Math.round(candidate.inputBarOffset)));
435
+ }
436
+
437
+ const favoriteModels = sanitizeModelRefs(candidate.favoriteModels, 64);
438
+ if (favoriteModels) {
439
+ result.favoriteModels = favoriteModels;
440
+ }
441
+
442
+ const recentModels = sanitizeModelRefs(candidate.recentModels, 16);
443
+ if (recentModels) {
444
+ result.recentModels = recentModels;
445
+ }
446
+ if (typeof candidate.diffLayoutPreference === 'string') {
447
+ const mode = candidate.diffLayoutPreference.trim();
448
+ if (mode === 'dynamic' || mode === 'inline' || mode === 'side-by-side') {
449
+ result.diffLayoutPreference = mode;
450
+ }
451
+ }
452
+ if (typeof candidate.diffViewMode === 'string') {
453
+ const mode = candidate.diffViewMode.trim();
454
+ if (mode === 'single' || mode === 'stacked') {
455
+ result.diffViewMode = mode;
456
+ }
457
+ }
458
+ if (typeof candidate.gitChangesViewMode === 'string') {
459
+ const mode = candidate.gitChangesViewMode.trim();
460
+ if (mode === 'flat' || mode === 'tree') {
461
+ result.gitChangesViewMode = mode;
462
+ }
463
+ }
464
+ if (typeof candidate.directoryShowHidden === 'boolean') {
465
+ result.directoryShowHidden = candidate.directoryShowHidden;
466
+ }
467
+ if (typeof candidate.filesViewShowGitignored === 'boolean') {
468
+ result.filesViewShowGitignored = candidate.filesViewShowGitignored;
469
+ }
470
+ if (typeof candidate.openInAppId === 'string') {
471
+ const trimmed = candidate.openInAppId.trim();
472
+ if (trimmed.length > 0) {
473
+ result.openInAppId = trimmed;
474
+ }
475
+ }
476
+
477
+ // Message limit — single setting for fetch / trim / Load More chunk
478
+ if (typeof candidate.messageLimit === 'number' && Number.isFinite(candidate.messageLimit)) {
479
+ result.messageLimit = Math.max(10, Math.min(500, Math.round(candidate.messageLimit)));
480
+ }
481
+
482
+ const skillCatalogs = sanitizeSkillCatalogs(candidate.skillCatalogs);
483
+ if (skillCatalogs) {
484
+ result.skillCatalogs = skillCatalogs;
485
+ }
486
+
487
+ // Usage model selections - which models appear in dropdown
488
+ if (candidate.usageSelectedModels && typeof candidate.usageSelectedModels === 'object') {
489
+ const sanitized = {};
490
+ for (const [providerId, models] of Object.entries(candidate.usageSelectedModels)) {
491
+ if (typeof providerId === 'string' && Array.isArray(models)) {
492
+ const validModels = models.filter((m) => typeof m === 'string' && m.length > 0);
493
+ if (validModels.length > 0) {
494
+ sanitized[providerId] = validModels;
495
+ }
496
+ }
497
+ }
498
+ if (Object.keys(sanitized).length > 0) {
499
+ result.usageSelectedModels = sanitized;
500
+ }
501
+ }
502
+
503
+ // Usage page collapsed families - for "Other Models" section
504
+ if (candidate.usageCollapsedFamilies && typeof candidate.usageCollapsedFamilies === 'object') {
505
+ const sanitized = {};
506
+ for (const [providerId, families] of Object.entries(candidate.usageCollapsedFamilies)) {
507
+ if (typeof providerId === 'string' && Array.isArray(families)) {
508
+ const validFamilies = families.filter((f) => typeof f === 'string' && f.length > 0);
509
+ if (validFamilies.length > 0) {
510
+ sanitized[providerId] = validFamilies;
511
+ }
512
+ }
513
+ }
514
+ if (Object.keys(sanitized).length > 0) {
515
+ result.usageCollapsedFamilies = sanitized;
516
+ }
517
+ }
518
+
519
+ // Header dropdown expanded families (inverted - stores EXPANDED, default all collapsed)
520
+ if (candidate.usageExpandedFamilies && typeof candidate.usageExpandedFamilies === 'object') {
521
+ const sanitized = {};
522
+ for (const [providerId, families] of Object.entries(candidate.usageExpandedFamilies)) {
523
+ if (typeof providerId === 'string' && Array.isArray(families)) {
524
+ const validFamilies = families.filter((f) => typeof f === 'string' && f.length > 0);
525
+ if (validFamilies.length > 0) {
526
+ sanitized[providerId] = validFamilies;
527
+ }
528
+ }
529
+ }
530
+ if (Object.keys(sanitized).length > 0) {
531
+ result.usageExpandedFamilies = sanitized;
532
+ }
533
+ }
534
+
535
+ // Custom model groups configuration
536
+ if (candidate.usageModelGroups && typeof candidate.usageModelGroups === 'object') {
537
+ const sanitized = {};
538
+ for (const [providerId, config] of Object.entries(candidate.usageModelGroups)) {
539
+ if (typeof providerId !== 'string') continue;
540
+
541
+ const providerConfig = {};
542
+
543
+ // customGroups: array of {id, label, models, order}
544
+ if (Array.isArray(config.customGroups)) {
545
+ const validGroups = config.customGroups
546
+ .filter((g) => g && typeof g.id === 'string' && typeof g.label === 'string')
547
+ .map((g) => ({
548
+ id: g.id.slice(0, 64),
549
+ label: g.label.slice(0, 128),
550
+ models: Array.isArray(g.models)
551
+ ? g.models.filter((m) => typeof m === 'string').slice(0, 500)
552
+ : [],
553
+ order: typeof g.order === 'number' ? g.order : 0,
554
+ }));
555
+ if (validGroups.length > 0) {
556
+ providerConfig.customGroups = validGroups;
557
+ }
558
+ }
559
+
560
+ // modelAssignments: Record<modelName, groupId>
561
+ if (config.modelAssignments && typeof config.modelAssignments === 'object') {
562
+ const assignments = {};
563
+ for (const [model, groupId] of Object.entries(config.modelAssignments)) {
564
+ if (typeof model === 'string' && typeof groupId === 'string') {
565
+ assignments[model] = groupId;
566
+ }
567
+ }
568
+ if (Object.keys(assignments).length > 0) {
569
+ providerConfig.modelAssignments = assignments;
570
+ }
571
+ }
572
+
573
+ // renamedGroups: Record<groupId, label>
574
+ if (config.renamedGroups && typeof config.renamedGroups === 'object') {
575
+ const renamed = {};
576
+ for (const [groupId, label] of Object.entries(config.renamedGroups)) {
577
+ if (typeof groupId === 'string' && typeof label === 'string') {
578
+ renamed[groupId] = label.slice(0, 128);
579
+ }
580
+ }
581
+ if (Object.keys(renamed).length > 0) {
582
+ providerConfig.renamedGroups = renamed;
583
+ }
584
+ }
585
+
586
+ if (Object.keys(providerConfig).length > 0) {
587
+ sanitized[providerId] = providerConfig;
588
+ }
589
+ }
590
+ if (Object.keys(sanitized).length > 0) {
591
+ result.usageModelGroups = sanitized;
592
+ }
593
+ }
594
+
595
+ // Usage reporting opt-out (default: true/enabled)
596
+ if (typeof candidate.reportUsage === 'boolean') {
597
+ result.reportUsage = candidate.reportUsage;
598
+ }
599
+
600
+ // Global behavior prompt — synced to ~/.config/opencode/AGENTS.md
601
+ if (typeof candidate.globalBehaviorPrompt === 'string') {
602
+ const value = candidate.globalBehaviorPrompt;
603
+ if (value.length <= 1024 * 1024) {
604
+ result.globalBehaviorPrompt = value;
605
+ }
606
+ }
607
+
608
+ if (typeof candidate.responseStyleEnabled === 'boolean') {
609
+ result.responseStyleEnabled = candidate.responseStyleEnabled;
610
+ }
611
+
612
+ if (
613
+ typeof candidate.responseStylePreset === 'string' &&
614
+ ['concise', 'detailed', 'mentor', 'pushback', 'noFiller', 'matchEnergy', 'warmPeer', 'custom'].includes(candidate.responseStylePreset)
615
+ ) {
616
+ result.responseStylePreset = candidate.responseStylePreset;
617
+ }
618
+
619
+ if (typeof candidate.responseStyleCustomInstructions === 'string') {
620
+ const value = candidate.responseStyleCustomInstructions;
621
+ if (value.length <= 50_000) {
622
+ result.responseStyleCustomInstructions = value;
623
+ }
624
+ }
625
+
626
+ if (typeof candidate.sttProvider === 'string') {
627
+ const provider = candidate.sttProvider.trim();
628
+ if (provider === 'browser' || provider === 'server' || provider === 'wasm') {
629
+ result.sttProvider = provider;
630
+ }
631
+ }
632
+ if (typeof candidate.sttServerUrl === 'string') {
633
+ const trimmed = candidate.sttServerUrl.trim();
634
+ if (trimmed.length <= STT_SERVER_URL_MAX_LENGTH) {
635
+ result.sttServerUrl = trimmed;
636
+ }
637
+ }
638
+ if (typeof candidate.sttModel === 'string') {
639
+ const trimmed = candidate.sttModel.trim();
640
+ if (trimmed.length <= STT_MODEL_MAX_LENGTH) {
641
+ result.sttModel = trimmed;
642
+ }
643
+ }
644
+ if (typeof candidate.wasmSttModel === 'string') {
645
+ const trimmed = candidate.wasmSttModel.trim();
646
+ if (trimmed.length <= 256) {
647
+ result.wasmSttModel = trimmed;
648
+ }
649
+ }
650
+ if (typeof candidate.sttLanguage === 'string') {
651
+ const trimmed = candidate.sttLanguage.trim();
652
+ if (trimmed.length <= STT_LANGUAGE_MAX_LENGTH) {
653
+ result.sttLanguage = trimmed;
654
+ }
655
+ }
656
+ if (typeof candidate.sttSilenceThresholdDb === 'number' && Number.isFinite(candidate.sttSilenceThresholdDb)) {
657
+ result.sttSilenceThresholdDb = Math.max(-100, Math.min(0, candidate.sttSilenceThresholdDb));
658
+ }
659
+ if (typeof candidate.sttSilenceHoldMs === 'number' && Number.isFinite(candidate.sttSilenceHoldMs)) {
660
+ result.sttSilenceHoldMs = Math.max(250, Math.min(10000, Math.round(candidate.sttSilenceHoldMs)));
661
+ }
662
+ if (typeof candidate.sttTranscribeOnStop === 'boolean') {
663
+ result.sttTranscribeOnStop = candidate.sttTranscribeOnStop;
664
+ }
665
+
666
+ return result;
667
+ };
668
+
669
+ const mergePersistedSettings = (current, changes) => {
670
+ const baseApproved = Array.isArray(changes.approvedDirectories)
671
+ ? changes.approvedDirectories
672
+ : Array.isArray(current.approvedDirectories)
673
+ ? current.approvedDirectories
674
+ : [];
675
+
676
+ const additionalApproved = [];
677
+ if (typeof changes.lastDirectory === 'string' && changes.lastDirectory.length > 0) {
678
+ additionalApproved.push(changes.lastDirectory);
679
+ }
680
+ if (typeof changes.homeDirectory === 'string' && changes.homeDirectory.length > 0) {
681
+ additionalApproved.push(changes.homeDirectory);
682
+ }
683
+ const projectEntries = Array.isArray(changes.projects)
684
+ ? changes.projects
685
+ : Array.isArray(current.projects)
686
+ ? current.projects
687
+ : [];
688
+ projectEntries.forEach((project) => {
689
+ if (project && typeof project.path === 'string' && project.path.length > 0) {
690
+ additionalApproved.push(project.path);
691
+ }
692
+ });
693
+ const approvedSource = [...baseApproved, ...additionalApproved];
694
+
695
+ const baseBookmarks = Array.isArray(changes.securityScopedBookmarks)
696
+ ? changes.securityScopedBookmarks
697
+ : Array.isArray(current.securityScopedBookmarks)
698
+ ? current.securityScopedBookmarks
699
+ : [];
700
+
701
+ const nextTypographySizes = changes.typographySizes
702
+ ? {
703
+ ...(current.typographySizes || {}),
704
+ ...changes.typographySizes
705
+ }
706
+ : current.typographySizes;
707
+
708
+ const next = {
709
+ ...current,
710
+ ...changes,
711
+ approvedDirectories: Array.from(
712
+ new Set(
713
+ approvedSource.filter((entry) => typeof entry === 'string' && entry.length > 0)
714
+ )
715
+ ),
716
+ securityScopedBookmarks: Array.from(
717
+ new Set(
718
+ baseBookmarks.filter((entry) => typeof entry === 'string' && entry.length > 0)
719
+ )
720
+ ),
721
+ typographySizes: nextTypographySizes
722
+ };
723
+
724
+ return next;
725
+ };
726
+
727
+ const formatSettingsResponse = (settings) => {
728
+ const sanitized = sanitizeSettingsUpdate(settings);
729
+ delete sanitized.managedRemoteTunnelToken;
730
+ const approved = normalizeStringArray(settings.approvedDirectories);
731
+ const bookmarks = normalizeStringArray(settings.securityScopedBookmarks);
732
+ const hasManagedRemoteTunnelToken = typeof settings?.managedRemoteTunnelToken === 'string' && settings.managedRemoteTunnelToken.trim().length > 0;
733
+ const pwaAppName = normalizePwaAppName(settings?.pwaAppName, '');
734
+ const pwaOrientation = normalizePwaOrientation(settings?.pwaOrientation, 'system');
735
+ const mobileKeyboardMode = normalizeMobileKeyboardMode(settings?.mobileKeyboardMode, 'native');
736
+
737
+ return {
738
+ ...sanitized,
739
+ hasManagedRemoteTunnelToken,
740
+ ...(pwaAppName ? { pwaAppName } : {}),
741
+ pwaOrientation,
742
+ mobileKeyboardMode,
743
+ approvedDirectories: approved,
744
+ securityScopedBookmarks: bookmarks,
745
+ pinnedDirectories: normalizeStringArray(settings.pinnedDirectories),
746
+ typographySizes: sanitizeTypographySizesPartial(settings.typographySizes),
747
+ showReasoningTraces:
748
+ typeof settings.showReasoningTraces === 'boolean'
749
+ ? settings.showReasoningTraces
750
+ : typeof sanitized.showReasoningTraces === 'boolean'
751
+ ? sanitized.showReasoningTraces
752
+ : false,
753
+ collapsibleThinkingBlocks:
754
+ typeof settings.collapsibleThinkingBlocks === 'boolean'
755
+ ? settings.collapsibleThinkingBlocks
756
+ : typeof sanitized.collapsibleThinkingBlocks === 'boolean'
757
+ ? sanitized.collapsibleThinkingBlocks
758
+ : true,
759
+ };
760
+ };
761
+
762
+ return {
763
+ normalizePwaAppName,
764
+ normalizePwaOrientation,
765
+ normalizeMobileKeyboardMode,
766
+ sanitizeSettingsUpdate,
767
+ mergePersistedSettings,
768
+ formatSettingsResponse,
769
+ };
770
+ };