@xopcai/xopc 0.0.129 → 0.0.131

package/dist/src/mcp/gateway-http-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-http-client.js","names":["undiciFetch"],"sources":["../../../src/mcp/gateway-http-client.ts"],"sourcesContent":["import { fetch as undiciFetch } from 'undici';\nimport { resolveGatewayLocalClientHost } from '../config/gateway-bind.js';\nimport type { Config } from '../config/schema.js';\nimport { loadConfig } from '../config/loader.js';\nimport { createLogger } from '../utils/logger.js';\n\nconst log = createLogger('Mcp:GatewayClient');\n\nfunction resolveGatewayTokenFromConfig(cfg: Config): string | undefined {\n  const fromConfig = cfg.gateway?.auth?.token?.trim();\n  if (fromConfig) {\n    return fromConfig;\n  }\n  return process.env.XOPC_GATEWAY_TOKEN?.trim() || undefined;\n}\n\nexport type GatewayHttpClientOptions = {\n  baseUrl: string;\n  token?: string;\n};\n\nexport class GatewayHttpClient {\n  constructor(private readonly opts: GatewayHttpClientOptions) {}\n\n  private headers(extra?: Record<string, string>): Record<string, string> {\n    const h: Record<string, string> = { Accept: 'application/json', ...extra };\n    if (this.opts.token) {\n      h.Authorization = `Bearer ${this.opts.token}`;\n    }\n    return h;\n  }\n\n  async getJson<T>(path: string): Promise<T> {\n    const res = await undiciFetch(`${this.opts.baseUrl}${path}`, {\n      headers: this.headers(),\n    });\n    if (!res.ok) {\n      const em = `Gateway GET ${path} failed: ${res.status}`;\n      log.warn({ phase: 'mcp.gateway.http', method: 'GET', path, status: res.status }, em);\n      throw new Error(em);\n    }\n    const body = (await res.json()) as { ok?: boolean; payload?: T } | T;\n    if (body && typeof body === 'object' && 'payload' in body) {\n      return (body as { payload: T }).payload;\n    }\n    return body as T;\n  }\n\n  async postJson<T>(path: string, data: unknown): Promise<T> {\n    const res = await undiciFetch(`${this.opts.baseUrl}${path}`, {\n      method: 'POST',\n      headers: this.headers({ 'Content-Type': 'application/json' }),\n      body: JSON.stringify(data),\n    });\n    if (!res.ok) {\n      const em = `Gateway POST ${path} failed: ${res.status}`;\n      log.warn({ phase: 'mcp.gateway.http', method: 'POST', path, status: res.status }, em);\n      throw new Error(em);\n    }\n    const body = (await res.json()) as { ok?: boolean; payload?: T } | T;\n    if (body && typeof body === 'object' && 'payload' in body) {\n      return (body as { payload: T }).payload;\n    }\n    return body as T;\n  }\n}\n\nexport function resolveGatewayHttpBaseUrl(config: Config, override?: string): string {\n  if (override?.trim()) {\n    return override.replace(/\\/$/, '');\n  }\n  const host = resolveGatewayLocalClientHost(config);\n  const port = config.gateway?.port ?? 18790;\n  return `http://${host}:${port}`;\n}\n\nexport function createGatewayHttpClientFromConfig(params: {\n  config?: Config;\n  gatewayUrl?: string;\n  gatewayToken?: string;\n}): GatewayHttpClient {\n  const cfg = params.config ?? loadConfig();\n  const token = params.gatewayToken ?? resolveGatewayTokenFromConfig(cfg) ?? undefined;\n  return new GatewayHttpClient({\n    baseUrl: resolveGatewayHttpBaseUrl(cfg, params.gatewayUrl),\n    token,\n  });\n}\n"],"mappings":";;;;;;aAGiD;aACC;AAElD,MAAM,MAAM,aAAa,oBAAoB;AAE7C,SAAS,8BAA8B,KAAiC;CACtE,MAAM,aAAa,IAAI,SAAS,MAAM,OAAO,MAAM;AACnD,KAAI,WACF,QAAO;AAET,QAAO,QAAQ,IAAI,oBAAoB,MAAM,IAAI,KAAA;;AAQnD,IAAa,oBAAb,MAA+B;CAC7B,YAAY,MAAiD;AAAhC,OAAA,OAAA;;CAE7B,QAAgB,OAAwD;EACtE,MAAM,IAA4B;GAAE,QAAQ;GAAoB,GAAG;GAAO;AAC1E,MAAI,KAAK,KAAK,MACZ,GAAE,gBAAgB,UAAU,KAAK,KAAK;AAExC,SAAO;;CAGT,MAAM,QAAW,MAA0B;EACzC,MAAM,MAAM,MAAMA,MAAY,GAAG,KAAK,KAAK,UAAU,QAAQ,EAC3D,SAAS,KAAK,SAAS,EACxB,CAAC;AACF,MAAI,CAAC,IAAI,IAAI;GACX,MAAM,KAAK,eAAe,KAAK,WAAW,IAAI;AAC9C,OAAI,KAAK;IAAE,OAAO;IAAoB,QAAQ;IAAO;IAAM,QAAQ,IAAI;IAAQ,EAAE,GAAG;AACpF,SAAM,IAAI,MAAM,GAAG;;EAErB,MAAM,OAAQ,MAAM,IAAI,MAAM;AAC9B,MAAI,QAAQ,OAAO,SAAS,YAAY,aAAa,KACnD,QAAQ,KAAwB;AAElC,SAAO;;CAGT,MAAM,SAAY,MAAc,MAA2B;EACzD,MAAM,MAAM,MAAMA,MAAY,GAAG,KAAK,KAAK,UAAU,QAAQ;GAC3D,QAAQ;GACR,SAAS,KAAK,QAAQ,EAAE,gBAAgB,oBAAoB,CAAC;GAC7D,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;AACF,MAAI,CAAC,IAAI,IAAI;GACX,MAAM,KAAK,gBAAgB,KAAK,WAAW,IAAI;AAC/C,OAAI,KAAK;IAAE,OAAO;IAAoB,QAAQ;IAAQ;IAAM,QAAQ,IAAI;IAAQ,EAAE,GAAG;AACrF,SAAM,IAAI,MAAM,GAAG;;EAErB,MAAM,OAAQ,MAAM,IAAI,MAAM;AAC9B,MAAI,QAAQ,OAAO,SAAS,YAAY,aAAa,KACnD,QAAQ,KAAwB;AAElC,SAAO;;;AAIX,SAAgB,0BAA0B,QAAgB,UAA2B;AACnF,KAAI,UAAU,MAAM,CAClB,QAAO,SAAS,QAAQ,OAAO,GAAG;AAIpC,QAAO,UAFM,8BAA8B,OAEtB,CAAC,GADT,OAAO,SAAS,QAAQ;;AAIvC,SAAgB,kCAAkC,QAI5B;CACpB,MAAM,MAAM,OAAO,UAAU,YAAY;CACzC,MAAM,QAAQ,OAAO,gBAAgB,8BAA8B,IAAI,IAAI,KAAA;AAC3E,QAAO,IAAI,kBAAkB;EAC3B,SAAS,0BAA0B,KAAK,OAAO,WAAW;EAC1D;EACD,CAAC"}
+{"version":3,"file":"gateway-http-client.js","names":["undiciFetch"],"sources":["../../../src/mcp/gateway-http-client.ts"],"sourcesContent":["import { fetch as undiciFetch } from 'undici';\nimport { resolveGatewayLocalClientHost } from '../config/gateway-bind.js';\nimport type { Config } from '../config/schema.js';\nimport { loadConfig } from '../config/loader.js';\nimport {\n  createGatewayCredential,\n  gatewayCredentialAuthorization,\n  type GatewayCredential,\n} from '../gateway/credential.js';\nimport { createLogger } from '../utils/logger.js';\n\nconst log = createLogger('Mcp:GatewayClient');\n\nfunction resolveGatewayCredentialFromConfig(cfg: Config): GatewayCredential | undefined {\n  const auth = cfg.gateway?.auth;\n  if (auth?.mode === 'password') {\n    return createGatewayCredential('password', auth.password);\n  }\n  if (auth?.mode === 'token') {\n    return createGatewayCredential('token', auth.token ?? process.env.XOPC_GATEWAY_TOKEN);\n  }\n  return undefined;\n}\n\nexport type GatewayHttpClientOptions = {\n  baseUrl: string;\n  credential?: GatewayCredential;\n};\n\nexport class GatewayHttpClient {\n  constructor(private readonly opts: GatewayHttpClientOptions) {}\n\n  private headers(extra?: Record<string, string>): Record<string, string> {\n    const h: Record<string, string> = { Accept: 'application/json', ...extra };\n    const authorization = gatewayCredentialAuthorization(this.opts.credential);\n    if (authorization) {\n      h.Authorization = authorization;\n    }\n    return h;\n  }\n\n  async getJson<T>(path: string): Promise<T> {\n    const res = await undiciFetch(`${this.opts.baseUrl}${path}`, {\n      headers: this.headers(),\n    });\n    if (!res.ok) {\n      const em = `Gateway GET ${path} failed: ${res.status}`;\n      log.warn({ phase: 'mcp.gateway.http', method: 'GET', path, status: res.status }, em);\n      throw new Error(em);\n    }\n    const body = (await res.json()) as { ok?: boolean; payload?: T } | T;\n    if (body && typeof body === 'object' && 'payload' in body) {\n      return (body as { payload: T }).payload;\n    }\n    return body as T;\n  }\n\n  async postJson<T>(path: string, data: unknown): Promise<T> {\n    const res = await undiciFetch(`${this.opts.baseUrl}${path}`, {\n      method: 'POST',\n      headers: this.headers({ 'Content-Type': 'application/json' }),\n      body: JSON.stringify(data),\n    });\n    if (!res.ok) {\n      const em = `Gateway POST ${path} failed: ${res.status}`;\n      log.warn({ phase: 'mcp.gateway.http', method: 'POST', path, status: res.status }, em);\n      throw new Error(em);\n    }\n    const body = (await res.json()) as { ok?: boolean; payload?: T } | T;\n    if (body && typeof body === 'object' && 'payload' in body) {\n      return (body as { payload: T }).payload;\n    }\n    return body as T;\n  }\n}\n\nexport function resolveGatewayHttpBaseUrl(config: Config, override?: string): string {\n  if (override?.trim()) {\n    return override.replace(/\\/$/, '');\n  }\n  const host = resolveGatewayLocalClientHost(config);\n  const port = config.gateway?.port ?? 18790;\n  return `http://${host}:${port}`;\n}\n\nexport function createGatewayHttpClientFromConfig(params: {\n  config?: Config;\n  gatewayUrl?: string;\n  gatewayCredential?: GatewayCredential;\n}): GatewayHttpClient {\n  const cfg = params.config ?? loadConfig();\n  const credential = params.gatewayCredential ?? resolveGatewayCredentialFromConfig(cfg);\n  return new GatewayHttpClient({\n    baseUrl: resolveGatewayHttpBaseUrl(cfg, params.gatewayUrl),\n    credential,\n  });\n}\n"],"mappings":";;;;;;;aAGiD;aAMC;AAElD,MAAM,MAAM,aAAa,oBAAoB;AAE7C,SAAS,mCAAmC,KAA4C;CACtF,MAAM,OAAO,IAAI,SAAS;AAC1B,KAAI,MAAM,SAAS,WACjB,QAAO,wBAAwB,YAAY,KAAK,SAAS;AAE3D,KAAI,MAAM,SAAS,QACjB,QAAO,wBAAwB,SAAS,KAAK,SAAS,QAAQ,IAAI,mBAAmB;;AAUzF,IAAa,oBAAb,MAA+B;CAC7B,YAAY,MAAiD;AAAhC,OAAA,OAAA;;CAE7B,QAAgB,OAAwD;EACtE,MAAM,IAA4B;GAAE,QAAQ;GAAoB,GAAG;GAAO;EAC1E,MAAM,gBAAgB,+BAA+B,KAAK,KAAK,WAAW;AAC1E,MAAI,cACF,GAAE,gBAAgB;AAEpB,SAAO;;CAGT,MAAM,QAAW,MAA0B;EACzC,MAAM,MAAM,MAAMA,MAAY,GAAG,KAAK,KAAK,UAAU,QAAQ,EAC3D,SAAS,KAAK,SAAS,EACxB,CAAC;AACF,MAAI,CAAC,IAAI,IAAI;GACX,MAAM,KAAK,eAAe,KAAK,WAAW,IAAI;AAC9C,OAAI,KAAK;IAAE,OAAO;IAAoB,QAAQ;IAAO;IAAM,QAAQ,IAAI;IAAQ,EAAE,GAAG;AACpF,SAAM,IAAI,MAAM,GAAG;;EAErB,MAAM,OAAQ,MAAM,IAAI,MAAM;AAC9B,MAAI,QAAQ,OAAO,SAAS,YAAY,aAAa,KACnD,QAAQ,KAAwB;AAElC,SAAO;;CAGT,MAAM,SAAY,MAAc,MAA2B;EACzD,MAAM,MAAM,MAAMA,MAAY,GAAG,KAAK,KAAK,UAAU,QAAQ;GAC3D,QAAQ;GACR,SAAS,KAAK,QAAQ,EAAE,gBAAgB,oBAAoB,CAAC;GAC7D,MAAM,KAAK,UAAU,KAAK;GAC3B,CAAC;AACF,MAAI,CAAC,IAAI,IAAI;GACX,MAAM,KAAK,gBAAgB,KAAK,WAAW,IAAI;AAC/C,OAAI,KAAK;IAAE,OAAO;IAAoB,QAAQ;IAAQ;IAAM,QAAQ,IAAI;IAAQ,EAAE,GAAG;AACrF,SAAM,IAAI,MAAM,GAAG;;EAErB,MAAM,OAAQ,MAAM,IAAI,MAAM;AAC9B,MAAI,QAAQ,OAAO,SAAS,YAAY,aAAa,KACnD,QAAQ,KAAwB;AAElC,SAAO;;;AAIX,SAAgB,0BAA0B,QAAgB,UAA2B;AACnF,KAAI,UAAU,MAAM,CAClB,QAAO,SAAS,QAAQ,OAAO,GAAG;AAIpC,QAAO,UAFM,8BAA8B,OAEtB,CAAC,GADT,OAAO,SAAS,QAAQ;;AAIvC,SAAgB,kCAAkC,QAI5B;CACpB,MAAM,MAAM,OAAO,UAAU,YAAY;CACzC,MAAM,aAAa,OAAO,qBAAqB,mCAAmC,IAAI;AACtF,QAAO,IAAI,kBAAkB;EAC3B,SAAS,0BAA0B,KAAK,OAAO,WAAW;EAC1D;EACD,CAAC"}

package/dist/src/tui/backends/gateway-sse-backend.d.ts

@@ -3,9 +3,10 @@ import type { SessionTimelineItem } from '../../session/transcript-outline.js';
 import type { ChatSendOptions, HistoryMessage, TuiBackend, TuiCompactionResult, TuiEvent, TuiModelChoice, TuiShareRequest, TuiShareResult, TuiSessionStats, TuiSessionItem, TuiStartupResources, TuiTranscriptTreeEntry, TuiAgentInfo, TuiWorkspaceFileSearchEntry, TuiWorkflowRunStartRequest, TuiWorkflowRunStartResult, TuiStartupProjectResult } from '../tui-backend.js';
 import type { SessionInfo } from '../tui-types.js';
 import type { ReviewContext } from '../../review/review-git.js';
+import { type GatewayCredential } from '../../gateway/credential.js';
 interface GatewaySSEOptions {
     url: string;
-    token?: string;
+    credential?: GatewayCredential;
 }
 export declare function normalizeGatewaySseEvent(evt: TuiEvent): TuiEvent;
 /**
@@ -17,7 +18,7 @@ export declare function normalizeGatewaySseEvent(evt: TuiEvent): TuiEvent;
  */
 export declare class GatewaySseBackend implements TuiBackend {
     private readonly baseUrl;
-    private readonly token;
+    private readonly credential;
     private eventAbort;
     private chatAbort;
     onEvent?: (evt: TuiEvent) => void;

package/dist/src/tui/backends/gateway-sse-backend.js

@@ -3,6 +3,7 @@ import { init_logger } from "../../utils/logger.js";
 import { prependEnvelopeTimestamp } from "../../channels/envelope-timestamp.js";
 import { transcriptRowsToClientHistory } from "../../session/client-history.js";
 import { parseModelRef } from "../../agent/models/selection.js";
+import { gatewayCredentialAuthorization } from "../../gateway/credential.js";
 import { consumeSSEStream, parseSSEData } from "../sse-consumer.js";
 import { buildTuiTranscriptTree, transcriptTreeEntryIdToRowNumber } from "../tui-transcript-tree.js";
 import { computeTuiSessionStats } from "../tui-session-stats.js";
@@ -31,10 +32,11 @@ function normalizeGatewaySseEvent(evt) {
 	};
 }
 /** Fetch wrapper that adds auth headers. */
-async function gatewayFetch(baseUrl, path, token, init) {
+async function gatewayFetch(baseUrl, path, credential, init) {
+	const authorization = gatewayCredentialAuthorization(credential);
 	const headers = {
 		"Content-Type": "application/json",
-		...token ? { Authorization: `Bearer ${token}` } : {},
+		...authorization ? { Authorization: authorization } : {},
 		...init?.headers
 	};
 	return fetch(`${baseUrl}${path}`, {
@@ -51,7 +53,7 @@ async function gatewayFetch(baseUrl, path, token, init) {
 */
 var GatewaySseBackend = class {
 	baseUrl;
-	token;
+	credential;
 	eventAbort = null;
 	chatAbort = null;
 	onEvent;
@@ -60,7 +62,7 @@ var GatewaySseBackend = class {
 	onGap;
 	constructor(opts) {
 		this.baseUrl = opts.url.replace(/\/+$/, "");
-		this.token = opts.token;
+		this.credential = opts.credential;
 	}
 	get connectionLabel() {
 		return this.baseUrl;
@@ -85,7 +87,7 @@ var GatewaySseBackend = class {
 		const runId = crypto.randomUUID();
 		(async () => {
 			try {
-				const res = await gatewayFetch(this.baseUrl, "/api/agent", this.token, {
+				const res = await gatewayFetch(this.baseUrl, "/api/agent", this.credential, {
 					method: "POST",
 					headers: { Accept: "text/event-stream" },
 					body: JSON.stringify({
@@ -211,7 +213,7 @@ var GatewaySseBackend = class {
 			params.set("q", query);
 			params.set("limit", String(options?.limit ?? 15));
 			params.set("sessionKey", sessionKey);
-			const res = await gatewayFetch(this.baseUrl, `/api/workspace/editor/files/search?${params.toString()}`, this.token);
+			const res = await gatewayFetch(this.baseUrl, `/api/workspace/editor/files/search?${params.toString()}`, this.credential);
 			if (!res.ok) return [];
 			return (await res.json()).payload?.entries ?? [];
 		} catch (err) {
@@ -226,14 +228,14 @@ var GatewaySseBackend = class {
 	}
 	async getReviewContext(sessionKey) {
 		const params = new URLSearchParams({ sessionKey });
-		const res = await gatewayFetch(this.baseUrl, `/api/review/context?${params.toString()}`, this.token);
+		const res = await gatewayFetch(this.baseUrl, `/api/review/context?${params.toString()}`, this.credential);
 		const json = await res.json().catch(() => ({}));
 		if (!res.ok || !json.ok || !json.payload) throw new Error(json.error?.message ?? `Review context failed (${res.status})`);
 		return json.payload;
 	}
 	async startWorkflowRun(opts) {
 		const goal = opts.goal?.trim();
-		const res = await gatewayFetch(this.baseUrl, "/api/workflows/runs", this.token, {
+		const res = await gatewayFetch(this.baseUrl, "/api/workflows/runs", this.credential, {
 			method: "POST",
 			body: JSON.stringify({
 				definitionId: opts.definitionId,
@@ -256,7 +258,7 @@ var GatewaySseBackend = class {
 		};
 	}
 	async resolveStartupProject(opts) {
-		const res = await gatewayFetch(this.baseUrl, "/api/projects/resolve-workspace", this.token, {
+		const res = await gatewayFetch(this.baseUrl, "/api/projects/resolve-workspace", this.credential, {
 			method: "POST",
 			body: JSON.stringify(opts)
 		});
@@ -285,7 +287,7 @@ var GatewaySseBackend = class {
 		});
 		let res;
 		try {
-			res = await gatewayFetch(this.baseUrl, "/api/agent/resume", this.token, {
+			res = await gatewayFetch(this.baseUrl, "/api/agent/resume", this.credential, {
 				method: "POST",
 				headers: { Accept: "text/event-stream" },
 				body: JSON.stringify({
@@ -349,7 +351,7 @@ var GatewaySseBackend = class {
 		this.chatAbort?.abort();
 		this.chatAbort = null;
 		try {
-			return { ok: (await (await gatewayFetch(this.baseUrl, "/api/agent/abort", this.token, {
+			return { ok: (await (await gatewayFetch(this.baseUrl, "/api/agent/abort", this.credential, {
 				method: "POST",
 				body: JSON.stringify({ runId: opts.runId })
 			})).json()).ok ?? false };
@@ -359,7 +361,7 @@ var GatewaySseBackend = class {
 	}
 	async steerChat(opts) {
 		try {
-			const res = await gatewayFetch(this.baseUrl, "/api/agent/steer", this.token, {
+			const res = await gatewayFetch(this.baseUrl, "/api/agent/steer", this.credential, {
 				method: "POST",
 				body: JSON.stringify({
 					sessionKey: opts.sessionKey,
@@ -380,7 +382,7 @@ var GatewaySseBackend = class {
 			connectors: []
 		};
 		try {
-			const res = await gatewayFetch(this.baseUrl, `/api/tui/startup-resources?sessionKey=${encodeURIComponent(sessionKey)}`, this.token);
+			const res = await gatewayFetch(this.baseUrl, `/api/tui/startup-resources?sessionKey=${encodeURIComponent(sessionKey)}`, this.credential);
 			if (!res.ok) return empty;
 			const json = await res.json();
 			return {
@@ -401,7 +403,7 @@ var GatewaySseBackend = class {
 	}
 	async loadHistory(opts) {
 		try {
-			const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(opts.sessionKey)}?include=transcriptRows`, this.token);
+			const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(opts.sessionKey)}?include=transcriptRows`, this.credential);
 			if (!res.ok) return { messages: [] };
 			const json = await res.json();
 			return { messages: transcriptRowsToClientHistory(Array.isArray(json.session?.transcriptRows) ? json.session.transcriptRows : [], { limit: opts.limit }) };
@@ -421,7 +423,7 @@ var GatewaySseBackend = class {
 			after: String(opts.after ?? 120)
 		});
 		try {
-			const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(opts.sessionKey)}/transcript/window?${params.toString()}`, this.token);
+			const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(opts.sessionKey)}/transcript/window?${params.toString()}`, this.credential);
 			if (!res.ok) return {
 				messages: [],
 				startRowNumber: 0,
@@ -453,7 +455,7 @@ var GatewaySseBackend = class {
 	}
 	async loadTranscriptTree(sessionKey) {
 		try {
-			const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}?include=transcriptRows`, this.token);
+			const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}?include=transcriptRows`, this.credential);
 			if (!res.ok) return [];
 			const json = await res.json();
 			return buildTuiTranscriptTree(Array.isArray(json.session?.transcriptRows) ? json.session.transcriptRows : []);
@@ -469,7 +471,7 @@ var GatewaySseBackend = class {
 	}
 	async loadTimeline(sessionKey) {
 		try {
-			const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/timeline`, this.token);
+			const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/timeline`, this.credential);
 			if (!res.ok) return [];
 			const json = await res.json();
 			return Array.isArray(json.items) ? json.items : [];
@@ -485,7 +487,7 @@ var GatewaySseBackend = class {
 	}
 	async getSessionStats(sessionKey) {
 		try {
-			const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}?include=transcriptRows`, this.token);
+			const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}?include=transcriptRows`, this.credential);
 			if (!res.ok) return computeTuiSessionStats([]);
 			const json = await res.json();
 			return computeTuiSessionStats(Array.isArray(json.session?.transcriptRows) ? json.session.transcriptRows : []);
@@ -501,7 +503,7 @@ var GatewaySseBackend = class {
 	}
 	async listSessions() {
 		try {
-			const res = await gatewayFetch(this.baseUrl, "/api/sessions", this.token);
+			const res = await gatewayFetch(this.baseUrl, "/api/sessions", this.credential);
 			if (!res.ok) return [];
 			return ((await res.json()).items ?? []).map((s) => ({
 				key: s.key,
@@ -520,7 +522,7 @@ var GatewaySseBackend = class {
 	async listAgents() {
 		const agents = /* @__PURE__ */ new Map();
 		try {
-			const res = await gatewayFetch(this.baseUrl, "/api/agents", this.token);
+			const res = await gatewayFetch(this.baseUrl, "/api/agents", this.credential);
 			if (res.ok) {
 				const json = await res.json();
 				for (const row of json.payload?.agents ?? []) {
@@ -544,7 +546,7 @@ var GatewaySseBackend = class {
 	}
 	async setTuiDefaultAgent(agentId) {
 		const target = agentId.trim().toLowerCase();
-		const res = await gatewayFetch(this.baseUrl, "/api/config", this.token, {
+		const res = await gatewayFetch(this.baseUrl, "/api/config", this.credential, {
 			method: "PATCH",
 			body: JSON.stringify({ tui: { defaultAgent: target } })
 		});
@@ -560,7 +562,7 @@ var GatewaySseBackend = class {
 		const out = {};
 		try {
 			const sessionPath = `/api/sessions/${encodeURIComponent(sessionKey)}`;
-			const [sessionRes, agentCfgRes] = await Promise.all([gatewayFetch(this.baseUrl, sessionPath, this.token), gatewayFetch(this.baseUrl, `${sessionPath}/agent-config`, this.token)]);
+			const [sessionRes, agentCfgRes] = await Promise.all([gatewayFetch(this.baseUrl, sessionPath, this.credential), gatewayFetch(this.baseUrl, `${sessionPath}/agent-config`, this.credential)]);
 			let session;
 			if (sessionRes.ok) {
 				session = (await sessionRes.json()).session;
@@ -608,7 +610,7 @@ var GatewaySseBackend = class {
 	}
 	async listModels() {
 		try {
-			const res = await gatewayFetch(this.baseUrl, "/api/models", this.token);
+			const res = await gatewayFetch(this.baseUrl, "/api/models", this.credential);
 			if (!res.ok) return [];
 			return ((await res.json()).payload?.models ?? []).map(normalizeGatewayModelChoice);
 		} catch {
@@ -616,11 +618,11 @@ var GatewaySseBackend = class {
 		}
 	}
 	async resetSession(sessionKey) {
-		await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/reset`, this.token, { method: "POST" }).catch(() => {});
+		await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/reset`, this.credential, { method: "POST" }).catch(() => {});
 	}
 	async compactSession(sessionKey, options) {
 		try {
-			const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/compaction/run`, this.token, {
+			const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/compaction/run`, this.credential, {
 				method: "POST",
 				body: JSON.stringify({
 					force: options?.force ?? true,
@@ -652,12 +654,12 @@ var GatewaySseBackend = class {
 	}
 	async exportSession(sessionKey, format) {
 		const params = new URLSearchParams({ format });
-		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/export?${params.toString()}`, this.token);
+		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/export?${params.toString()}`, this.credential);
 		if (!res.ok) throw new Error(`Export failed (${res.status})`);
 		return (await res.json()).content ?? "";
 	}
 	async importSession(targetSessionKey, jsonContent) {
-		const res = await gatewayFetch(this.baseUrl, "/api/sessions/import", this.token, {
+		const res = await gatewayFetch(this.baseUrl, "/api/sessions/import", this.credential, {
 			method: "POST",
 			body: JSON.stringify({
 				targetKey: targetSessionKey,
@@ -672,7 +674,7 @@ var GatewaySseBackend = class {
 		};
 	}
 	async createShare(sessionKey, request, options) {
-		const res = await gatewayFetch(this.baseUrl, "/api/shares/auto", this.token, {
+		const res = await gatewayFetch(this.baseUrl, "/api/shares/auto", this.credential, {
 			method: "POST",
 			body: JSON.stringify({
 				path: request.path,
@@ -702,7 +704,7 @@ var GatewaySseBackend = class {
 		};
 	}
 	async btwQuery(sessionKey, question) {
-		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/btw`, this.token, {
+		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/btw`, this.credential, {
 			method: "POST",
 			body: JSON.stringify({ question })
 		});
@@ -713,7 +715,7 @@ var GatewaySseBackend = class {
 		return await res.json();
 	}
 	async forkSession(sourceSessionKey, targetSessionKey) {
-		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sourceSessionKey)}/fork`, this.token, {
+		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sourceSessionKey)}/fork`, this.credential, {
 			method: "POST",
 			body: JSON.stringify({ targetKey: targetSessionKey })
 		});
@@ -727,7 +729,7 @@ var GatewaySseBackend = class {
 	async forkSessionAt(sourceSessionKey, targetSessionKey, entryId) {
 		const throughRow = transcriptTreeEntryIdToRowNumber(entryId);
 		if (throughRow == null) throw new Error(`Invalid transcript entry: ${entryId}`);
-		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sourceSessionKey)}/fork-row`, this.token, {
+		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sourceSessionKey)}/fork-row`, this.credential, {
 			method: "POST",
 			body: JSON.stringify({
 				targetKey: targetSessionKey,
@@ -742,7 +744,7 @@ var GatewaySseBackend = class {
 		};
 	}
 	async setTranscriptLabel(sessionKey, entryId, label) {
-		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/transcript/label`, this.token, {
+		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/transcript/label`, this.credential, {
 			method: "POST",
 			body: JSON.stringify({
 				targetId: entryId,
@@ -754,7 +756,7 @@ var GatewaySseBackend = class {
 		return { ok: true };
 	}
 	async appendCustomEntry(sessionKey, customType, data) {
-		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/transcript/custom`, this.token, {
+		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/transcript/custom`, this.credential, {
 			method: "POST",
 			body: JSON.stringify({
 				customType,
@@ -766,7 +768,7 @@ var GatewaySseBackend = class {
 		return { ok: true };
 	}
 	async appendCustomMessage(sessionKey, message) {
-		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/transcript/custom-message`, this.token, {
+		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/transcript/custom-message`, this.credential, {
 			method: "POST",
 			body: JSON.stringify(message)
 		});
@@ -775,7 +777,7 @@ var GatewaySseBackend = class {
 		return { ok: true };
 	}
 	async appendBashExecution(sessionKey, entry) {
-		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/transcript/bash`, this.token, {
+		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/transcript/bash`, this.credential, {
 			method: "POST",
 			body: JSON.stringify(entry)
 		});
@@ -784,7 +786,7 @@ var GatewaySseBackend = class {
 		return { ok: true };
 	}
 	async patchSession(sessionKey, patch) {
-		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/agent-config`, this.token, {
+		const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/agent-config`, this.credential, {
 			method: "PATCH",
 			body: JSON.stringify(patch)
 		});
@@ -792,7 +794,7 @@ var GatewaySseBackend = class {
 		if (!res.ok || json.ok === false) throw new Error(json.error ?? `Session config patch failed (${res.status})`);
 		const projectId = typeof patch.projectId === "string" ? patch.projectId.trim() : "";
 		if (projectId) {
-			const metaRes = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}`, this.token, {
+			const metaRes = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}`, this.credential, {
 				method: "PATCH",
 				body: JSON.stringify({ projectId })
 			});
@@ -802,7 +804,7 @@ var GatewaySseBackend = class {
 	}
 	async renameSession(sessionKey, name) {
 		try {
-			return { ok: (await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/rename`, this.token, {
+			return { ok: (await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}/rename`, this.credential, {
 				method: "POST",
 				body: JSON.stringify({ name })
 			})).ok };
@@ -812,7 +814,7 @@ var GatewaySseBackend = class {
 	}
 	async deleteSession(sessionKey) {
 		try {
-			const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}`, this.token, { method: "DELETE" });
+			const res = await gatewayFetch(this.baseUrl, `/api/sessions/${encodeURIComponent(sessionKey)}`, this.credential, { method: "DELETE" });
 			if (!res.ok) return { ok: false };
 			return { ok: (await res.json()).deleted !== false };
 		} catch {
@@ -823,12 +825,14 @@ var GatewaySseBackend = class {
 		this.eventAbort?.abort();
 		this.eventAbort = new AbortController();
 		const url = new URL(`${this.baseUrl}/api/events`);
-		if (this.token) url.searchParams.set("token", this.token);
 		const connect = async () => {
 			try {
 				const res = await fetch(url.toString(), {
 					signal: this.eventAbort.signal,
-					headers: { Accept: "text/event-stream" }
+					headers: {
+						Accept: "text/event-stream",
+						...gatewayCredentialAuthorization(this.credential) ? { Authorization: gatewayCredentialAuthorization(this.credential) } : {}
+					}
 				});
 				if (!res.ok || !res.body) {
 					this.onDisconnected?.(`event stream error: ${res.status}`);