@xopcai/xopc 0.0.86 → 0.0.88

package/dist/src/agent/workflow/subagent-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"subagent-runner.js","names":[],"sources":["../../../../src/agent/workflow/subagent-runner.ts"],"sourcesContent":["/**\n * Adapter: spawns one isolated child agent per `agent()` call from a workflow.\n *\n * Wraps the existing `createDelegateChildHandle` so the workflow runtime stays\n * decoupled from the LLM stack (it sees only the `SubagentRunner` interface).\n *\n * Key behaviour:\n * - When `opts.schema` is provided, we inject `structured_output` into the child\n *   tool set and unwrap the captured value on success. If the subagent finishes\n *   without ever calling `structured_output`, we treat it as failure (`null`).\n * - Failures and aborts resolve to `null`. The workflow runtime continues — this\n *   matches the pi-dynamic-workflows contract and keeps fan-out pipelines robust.\n * - We do NOT mutate `createDelegateChildHandle` — we just leverage its\n *   `buildChildTools` injection point.\n */\n\nimport type { AgentTool } from '@earendil-works/pi-agent-core';\nimport type { Api, Model } from '@earendil-works/pi-ai';\n\nimport type { Config } from '../../config/schema.js';\nimport type { MessageBus } from '../../infra/bus/index.js';\nimport { createLogger } from '../../utils/logger.js';\n\nimport {\n  type BuildChildToolsOptions,\n  createDelegateChildHandle,\n  type DelegateChildHandleOptions,\n} from '../child-agent-factory.js';\nimport {\n  DEFAULT_DELEGATE_TOOLS,\n  DELEGATE_BLOCKED_TOOLS,\n} from '../tools/delegate-tool.js';\nimport type { ToolExecutorConfig } from '../tools/executor.js';\n\nimport {\n  createStructuredOutputTool,\n  STRUCTURED_OUTPUT_TOOL_NAME,\n  type StructuredOutputCapture,\n} from './structured-output-tool.js';\nimport type { SubagentRunOptions, SubagentRunner } from './types.js';\n\nconst log = createLogger('workflow-subagent-runner');\n\nconst DEFAULT_MAX_ITERATIONS = 30;\n\nexport interface DelegateSubagentRunnerDeps {\n  workspace: string;\n  bus: MessageBus;\n  /** Resolves the default subagent model (typically the parent agent's primary model). */\n  getDefaultModel: () => Model<Api>;\n  getConfig: () => Config | undefined;\n  toolExecutorConfig?: Partial<ToolExecutorConfig>;\n  /**\n   * Provided by the workflow tool from `AgentToolsFactory` — mirrors how\n   * `delegate-tool` is wired (avoids importing `tools/factory.ts` here and\n   * breaking the existing factory ↔ delegate-tool ↔ child-agent-factory\n   * dependency contract).\n   */\n  buildChildTools: (opts: BuildChildToolsOptions) => AgentTool<any, any>[];\n}\n\nexport class DelegateSubagentRunner implements SubagentRunner {\n  constructor(private readonly deps: DelegateSubagentRunnerDeps) {}\n\n  async run<T = string>(prompt: string, opts: SubagentRunOptions<T>): Promise<T | null> {\n    if (opts.signal?.aborted) return null;\n\n    const capture: StructuredOutputCapture<T> = { called: false, value: undefined };\n    const wantStructured = Boolean(opts.schema);\n\n    const allowed = resolveAllowedToolNames(opts.allowedToolNames, wantStructured);\n    const model = opts.model ?? safeResolveDefaultModel(this.deps.getDefaultModel);\n    if (!model) {\n      log.warn({ label: opts.label }, 'subagent run skipped: no primary model resolved');\n      return null;\n    }\n\n    const fullPrompt = buildPrompt(prompt, opts, wantStructured);\n\n    const childOptions: DelegateChildHandleOptions = {\n      workspace: this.deps.workspace,\n      goal: fullPrompt,\n      allowedToolNames: allowed,\n      maxIterations: opts.maxIterations ?? DEFAULT_MAX_ITERATIONS,\n      model,\n      bus: this.deps.bus,\n      getConfig: this.deps.getConfig,\n      toolExecutorConfig: this.deps.toolExecutorConfig,\n      buildChildTools: (childOpts) => {\n        const base = this.deps.buildChildTools(childOpts);\n        if (!wantStructured || !opts.schema) return base;\n        // Replace any existing tool with the same name so the per-run capture wins.\n        const filtered = base.filter((t) => t.name !== STRUCTURED_OUTPUT_TOOL_NAME);\n        return [\n          ...filtered,\n          createStructuredOutputTool({ schema: opts.schema, capture }) as unknown as AgentTool<any, any>,\n        ];\n      },\n    };\n\n    const handle = createDelegateChildHandle(childOptions);\n    const onAbort = () => handle.abort();\n    opts.signal?.addEventListener('abort', onAbort, { once: true });\n\n    try {\n      const { summary } = await handle.run();\n      if (opts.signal?.aborted) return null;\n\n      if (wantStructured) {\n        if (!capture.called) {\n          log.warn({ label: opts.label }, 'subagent finished without calling structured_output');\n          return null;\n        }\n        return capture.value as T;\n      }\n      return summary as unknown as T;\n    } catch (e) {\n      if (opts.rethrow) throw e;\n      const msg = e instanceof Error ? e.message : String(e);\n      log.warn({ err: e, label: opts.label, errorMessage: msg }, `subagent run failed: ${msg}`);\n      return null;\n    } finally {\n      opts.signal?.removeEventListener('abort', onAbort);\n    }\n  }\n}\n\nfunction resolveAllowedToolNames(\n  requested: string[] | undefined,\n  wantStructured: boolean,\n): string[] {\n  const base = requested && requested.length > 0 ? requested : [...DEFAULT_DELEGATE_TOOLS];\n  const filtered = base\n    .map((s) => String(s).trim())\n    .filter((s) => s.length > 0)\n    .filter((s) => !DELEGATE_BLOCKED_TOOLS.has(s));\n  if (wantStructured && !filtered.includes(STRUCTURED_OUTPUT_TOOL_NAME)) {\n    filtered.push(STRUCTURED_OUTPUT_TOOL_NAME);\n  }\n  return [...new Set(filtered)];\n}\n\nfunction buildPrompt(prompt: string, opts: SubagentRunOptions<unknown>, structured: boolean): string {\n  const parts: string[] = [];\n  if (opts.instructions?.trim()) parts.push(opts.instructions.trim());\n  if (opts.label) parts.push(`Task label: ${opts.label}`);\n  if (opts.phase) parts.push(`Workflow phase: ${opts.phase}`);\n  parts.push(prompt);\n  if (structured) {\n    parts.push(\n      [\n        'Final output contract:',\n        '- Your final action MUST be a structured_output tool call.',\n        '- The structured_output arguments are the return value of this subagent.',\n        '- Do not emit a prose final answer instead of structured_output.',\n        '- If you need to inspect files or run commands first, do so, then call structured_output exactly once.',\n      ].join('\\n'),\n    );\n  }\n  return parts.join('\\n\\n');\n}\n\nfunction safeResolveDefaultModel(get: () => Model<Api>): Model<Api> | null {\n  try {\n    return get();\n  } catch (e) {\n    log.warn({ err: e }, 'failed to resolve default subagent model');\n    return null;\n  }\n}\n"],"mappings":";;;;;;aAqBqD;AAoBrD,MAAM,MAAM,aAAa,2BAA2B;AAEpD,MAAM,yBAAyB;AAkB/B,IAAa,yBAAb,MAA8D;CAC5D,YAAY,MAAmD;AAAlC,OAAA,OAAA;;CAE7B,MAAM,IAAgB,QAAgB,MAAgD;AACpF,MAAI,KAAK,QAAQ,QAAS,QAAO;EAEjC,MAAM,UAAsC;GAAE,QAAQ;GAAO,OAAO,KAAA;GAAW;EAC/E,MAAM,iBAAiB,QAAQ,KAAK,OAAO;EAE3C,MAAM,UAAU,wBAAwB,KAAK,kBAAkB,eAAe;EAC9E,MAAM,QAAQ,KAAK,SAAS,wBAAwB,KAAK,KAAK,gBAAgB;AAC9E,MAAI,CAAC,OAAO;AACV,OAAI,KAAK,EAAE,OAAO,KAAK,OAAO,EAAE,kDAAkD;AAClF,UAAO;;EAGT,MAAM,aAAa,YAAY,QAAQ,MAAM,eAAe;EAuB5D,MAAM,SAAS,0BAA0B;GApBvC,WAAW,KAAK,KAAK;GACrB,MAAM;GACN,kBAAkB;GAClB,eAAe,KAAK,iBAAiB;GACrC;GACA,KAAK,KAAK,KAAK;GACf,WAAW,KAAK,KAAK;GACrB,oBAAoB,KAAK,KAAK;GAC9B,kBAAkB,cAAc;IAC9B,MAAM,OAAO,KAAK,KAAK,gBAAgB,UAAU;AACjD,QAAI,CAAC,kBAAkB,CAAC,KAAK,OAAQ,QAAO;AAG5C,WAAO,CACL,GAFe,KAAK,QAAQ,MAAM,EAAE,SAAS,4BAElC,EACX,2BAA2B;KAAE,QAAQ,KAAK;KAAQ;KAAS,CAAC,CAC7D;;GAIgD,CAAC;EACtD,MAAM,gBAAgB,OAAO,OAAO;AACpC,OAAK,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM,CAAC;AAE/D,MAAI;GACF,MAAM,EAAE,YAAY,MAAM,OAAO,KAAK;AACtC,OAAI,KAAK,QAAQ,QAAS,QAAO;AAEjC,OAAI,gBAAgB;AAClB,QAAI,CAAC,QAAQ,QAAQ;AACnB,SAAI,KAAK,EAAE,OAAO,KAAK,OAAO,EAAE,sDAAsD;AACtF,YAAO;;AAET,WAAO,QAAQ;;AAEjB,UAAO;WACA,GAAG;AACV,OAAI,KAAK,QAAS,OAAM;GACxB,MAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE;AACtD,OAAI,KAAK;IAAE,KAAK;IAAG,OAAO,KAAK;IAAO,cAAc;IAAK,EAAE,wBAAwB,MAAM;AACzF,UAAO;YACC;AACR,QAAK,QAAQ,oBAAoB,SAAS,QAAQ;;;;AAKxD,SAAS,wBACP,WACA,gBACU;CAEV,MAAM,YADO,aAAa,UAAU,SAAS,IAAI,YAAY,CAAC,GAAG,uBAAuB,EAErF,KAAK,MAAM,OAAO,EAAE,CAAC,MAAM,CAAC,CAC5B,QAAQ,MAAM,EAAE,SAAS,EAAE,CAC3B,QAAQ,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC;AAChD,KAAI,kBAAkB,CAAC,SAAS,SAAA,oBAAqC,CACnE,UAAS,KAAK,4BAA4B;AAE5C,QAAO,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;;AAG/B,SAAS,YAAY,QAAgB,MAAmC,YAA6B;CACnG,MAAM,QAAkB,EAAE;AAC1B,KAAI,KAAK,cAAc,MAAM,CAAE,OAAM,KAAK,KAAK,aAAa,MAAM,CAAC;AACnE,KAAI,KAAK,MAAO,OAAM,KAAK,eAAe,KAAK,QAAQ;AACvD,KAAI,KAAK,MAAO,OAAM,KAAK,mBAAmB,KAAK,QAAQ;AAC3D,OAAM,KAAK,OAAO;AAClB,KAAI,WACF,OAAM,KACJ;EACE;EACA;EACA;EACA;EACA;EACD,CAAC,KAAK,KAAK,CACb;AAEH,QAAO,MAAM,KAAK,OAAO;;AAG3B,SAAS,wBAAwB,KAA0C;AACzE,KAAI;AACF,SAAO,KAAK;UACL,GAAG;AACV,MAAI,KAAK,EAAE,KAAK,GAAG,EAAE,2CAA2C;AAChE,SAAO"}
+{"version":3,"file":"subagent-runner.js","names":[],"sources":["../../../../src/agent/workflow/subagent-runner.ts"],"sourcesContent":["/**\n * Adapter: spawns one isolated child agent per `agent()` call from a workflow.\n *\n * Wraps the existing `createDelegateChildHandle` so the workflow runtime stays\n * decoupled from the LLM stack (it sees only the `SubagentRunner` interface).\n *\n * Key behaviour:\n * - When `opts.schema` is provided, we inject `structured_output` into the child\n *   tool set and unwrap the captured value on success. If the subagent finishes\n *   without ever calling `structured_output`, we treat it as failure (`null`).\n * - Failures and aborts resolve to `null`. The workflow runtime continues — this\n *   matches the pi-dynamic-workflows contract and keeps fan-out pipelines robust.\n * - We do NOT mutate `createDelegateChildHandle` — we just leverage its\n *   `buildChildTools` injection point.\n */\n\nimport type { AgentTool } from '@earendil-works/pi-agent-core';\nimport type { Api, Model } from '@earendil-works/pi-ai';\n\nimport type { Config } from '../../config/schema.js';\nimport type { MessageBus } from '../../infra/bus/index.js';\nimport { createLogger } from '../../utils/logger.js';\n\nimport {\n  type BuildChildToolsOptions,\n  createDelegateChildHandle,\n  type DelegateChildHandleOptions,\n} from '../child-agent-factory.js';\nimport {\n  DEFAULT_DELEGATE_TOOLS,\n  DELEGATE_BLOCKED_TOOLS,\n} from '../tools/delegate-tool.js';\nimport type { ToolExecutorConfig } from '../tools/executor.js';\n\nimport {\n  createStructuredOutputTool,\n  STRUCTURED_OUTPUT_TOOL_NAME,\n  type StructuredOutputCapture,\n} from './structured-output-tool.js';\nimport type { SubagentRunOptions, SubagentRunner, SubagentProgressEvent } from './types.js';\n\nconst log = createLogger('workflow-subagent-runner');\n\nconst DEFAULT_MAX_ITERATIONS = 30;\n\nexport interface DelegateSubagentRunnerDeps {\n  workspace: string;\n  bus: MessageBus;\n  /** Resolves the default subagent model (typically the parent agent's primary model). */\n  getDefaultModel: () => Model<Api>;\n  getConfig: () => Config | undefined;\n  toolExecutorConfig?: Partial<ToolExecutorConfig>;\n  /**\n   * Provided by the workflow tool from `AgentToolsFactory` — mirrors how\n   * `delegate-tool` is wired (avoids importing `tools/factory.ts` here and\n   * breaking the existing factory ↔ delegate-tool ↔ child-agent-factory\n   * dependency contract).\n   */\n  buildChildTools: (opts: BuildChildToolsOptions) => AgentTool<any, any>[];\n}\n\nexport class DelegateSubagentRunner implements SubagentRunner {\n  constructor(private readonly deps: DelegateSubagentRunnerDeps) {}\n\n  async run<T = string>(prompt: string, opts: SubagentRunOptions<T>): Promise<T | null> {\n    if (opts.signal?.aborted) return null;\n\n    const capture: StructuredOutputCapture<T> = { called: false, value: undefined };\n    const wantStructured = Boolean(opts.schema);\n\n    const allowed = resolveAllowedToolNames(opts.allowedToolNames, wantStructured);\n    const model = opts.model ?? safeResolveDefaultModel(this.deps.getDefaultModel);\n    if (!model) {\n      log.warn({ label: opts.label }, 'subagent run skipped: no primary model resolved');\n      return null;\n    }\n\n    const fullPrompt = buildPrompt(prompt, opts, wantStructured);\n    const streamMode = resolveSubagentStreamMode(this.deps.getConfig);\n\n    const childOptions: DelegateChildHandleOptions = {\n      workspace: this.deps.workspace,\n      goal: fullPrompt,\n      allowedToolNames: allowed,\n      maxIterations: opts.maxIterations ?? DEFAULT_MAX_ITERATIONS,\n      model,\n      bus: this.deps.bus,\n      getConfig: this.deps.getConfig,\n      toolExecutorConfig: this.deps.toolExecutorConfig,\n      buildChildTools: (childOpts) => {\n        const base = this.deps.buildChildTools(childOpts);\n        if (!wantStructured || !opts.schema) return base;\n        // Replace any existing tool with the same name so the per-run capture wins.\n        const filtered = base.filter((t) => t.name !== STRUCTURED_OUTPUT_TOOL_NAME);\n        return [\n          ...filtered,\n          createStructuredOutputTool({ schema: opts.schema, capture }) as unknown as AgentTool<any, any>,\n        ];\n      },\n      progressHooks:\n        opts.onProgress && streamMode !== 'off'\n          ? {\n              mode: streamMode === 'full' ? 'full' : 'steps',\n              onProgress: (event) => {\n                opts.onProgress?.(mapChildProgressEvent(event));\n              },\n            }\n          : undefined,\n    };\n\n    const handle = createDelegateChildHandle(childOptions);\n    const onAbort = () => handle.abort();\n    opts.signal?.addEventListener('abort', onAbort, { once: true });\n\n    try {\n      const { summary } = await handle.run();\n      if (opts.signal?.aborted) return null;\n\n      if (wantStructured) {\n        if (!capture.called) {\n          log.warn({ label: opts.label }, 'subagent finished without calling structured_output');\n          return null;\n        }\n        return capture.value as T;\n      }\n      return summary as unknown as T;\n    } catch (e) {\n      if (opts.rethrow) throw e;\n      const msg = e instanceof Error ? e.message : String(e);\n      log.warn({ err: e, label: opts.label, errorMessage: msg }, `subagent run failed: ${msg}`);\n      return null;\n    } finally {\n      opts.signal?.removeEventListener('abort', onAbort);\n    }\n  }\n}\n\nfunction resolveAllowedToolNames(\n  requested: string[] | undefined,\n  wantStructured: boolean,\n): string[] {\n  const base = requested && requested.length > 0 ? requested : [...DEFAULT_DELEGATE_TOOLS];\n  const filtered = base\n    .map((s) => String(s).trim())\n    .filter((s) => s.length > 0)\n    .filter((s) => !DELEGATE_BLOCKED_TOOLS.has(s));\n  if (wantStructured && !filtered.includes(STRUCTURED_OUTPUT_TOOL_NAME)) {\n    filtered.push(STRUCTURED_OUTPUT_TOOL_NAME);\n  }\n  return [...new Set(filtered)];\n}\n\nfunction buildPrompt(prompt: string, opts: SubagentRunOptions<unknown>, structured: boolean): string {\n  const parts: string[] = [];\n  if (opts.instructions?.trim()) parts.push(opts.instructions.trim());\n  if (opts.label) parts.push(`Task label: ${opts.label}`);\n  if (opts.phase) parts.push(`Workflow phase: ${opts.phase}`);\n  parts.push(prompt);\n  if (structured) {\n    parts.push(\n      [\n        'Final output contract:',\n        '- Your final action MUST be a structured_output tool call.',\n        '- The structured_output arguments are the return value of this subagent.',\n        '- Do not emit a prose final answer instead of structured_output.',\n        '- If you need to inspect files or run commands first, do so, then call structured_output exactly once.',\n      ].join('\\n'),\n    );\n  }\n  return parts.join('\\n\\n');\n}\n\nfunction safeResolveDefaultModel(get: () => Model<Api>): Model<Api> | null {\n  try {\n    return get();\n  } catch (e) {\n    log.warn({ err: e }, 'failed to resolve default subagent model');\n    return null;\n  }\n}\n\nfunction resolveSubagentStreamMode(\n  getConfig: () => Config | undefined,\n): 'off' | 'steps' | 'full' {\n  const mode = getConfig()?.agents?.defaults?.workflow?.subagentStream;\n  if (mode === 'off' || mode === 'steps' || mode === 'full') return mode;\n  return 'steps';\n}\n\nfunction mapChildProgressEvent(event: {\n  type: 'tool_start' | 'tool_end' | 'iteration' | 'text_delta' | 'thinking_delta';\n  toolCallId?: string;\n  toolName?: string;\n  args?: Record<string, unknown>;\n  isError?: boolean;\n  count?: number;\n  max?: number;\n  delta?: string;\n}): SubagentProgressEvent {\n  switch (event.type) {\n    case 'tool_start':\n      return {\n        type: 'tool_start',\n        toolCallId: event.toolCallId ?? '',\n        toolName: event.toolName ?? 'tool',\n        args: event.args ?? {},\n      };\n    case 'tool_end':\n      return {\n        type: 'tool_end',\n        toolCallId: event.toolCallId ?? '',\n        toolName: event.toolName ?? 'tool',\n        isError: Boolean(event.isError),\n      };\n    case 'iteration':\n      return {\n        type: 'iteration',\n        count: event.count ?? 0,\n        max: event.max ?? 0,\n      };\n    case 'text_delta':\n      return { type: 'text_delta', delta: event.delta ?? '' };\n    case 'thinking_delta':\n      return { type: 'thinking_delta', delta: event.delta ?? '' };\n    default:\n      return { type: 'text_delta', delta: '' };\n  }\n}\n"],"mappings":";;;;;;aAqBqD;AAoBrD,MAAM,MAAM,aAAa,2BAA2B;AAEpD,MAAM,yBAAyB;AAkB/B,IAAa,yBAAb,MAA8D;CAC5D,YAAY,MAAmD;AAAlC,OAAA,OAAA;;CAE7B,MAAM,IAAgB,QAAgB,MAAgD;AACpF,MAAI,KAAK,QAAQ,QAAS,QAAO;EAEjC,MAAM,UAAsC;GAAE,QAAQ;GAAO,OAAO,KAAA;GAAW;EAC/E,MAAM,iBAAiB,QAAQ,KAAK,OAAO;EAE3C,MAAM,UAAU,wBAAwB,KAAK,kBAAkB,eAAe;EAC9E,MAAM,QAAQ,KAAK,SAAS,wBAAwB,KAAK,KAAK,gBAAgB;AAC9E,MAAI,CAAC,OAAO;AACV,OAAI,KAAK,EAAE,OAAO,KAAK,OAAO,EAAE,kDAAkD;AAClF,UAAO;;EAGT,MAAM,aAAa,YAAY,QAAQ,MAAM,eAAe;EAC5D,MAAM,aAAa,0BAA0B,KAAK,KAAK,UAAU;EAgCjE,MAAM,SAAS,0BAA0B;GA7BvC,WAAW,KAAK,KAAK;GACrB,MAAM;GACN,kBAAkB;GAClB,eAAe,KAAK,iBAAiB;GACrC;GACA,KAAK,KAAK,KAAK;GACf,WAAW,KAAK,KAAK;GACrB,oBAAoB,KAAK,KAAK;GAC9B,kBAAkB,cAAc;IAC9B,MAAM,OAAO,KAAK,KAAK,gBAAgB,UAAU;AACjD,QAAI,CAAC,kBAAkB,CAAC,KAAK,OAAQ,QAAO;AAG5C,WAAO,CACL,GAFe,KAAK,QAAQ,MAAM,EAAE,SAAS,4BAElC,EACX,2BAA2B;KAAE,QAAQ,KAAK;KAAQ;KAAS,CAAC,CAC7D;;GAEH,eACE,KAAK,cAAc,eAAe,QAC9B;IACE,MAAM,eAAe,SAAS,SAAS;IACvC,aAAa,UAAU;AACrB,UAAK,aAAa,sBAAsB,MAAM,CAAC;;IAElD,GACD,KAAA;GAG6C,CAAC;EACtD,MAAM,gBAAgB,OAAO,OAAO;AACpC,OAAK,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM,CAAC;AAE/D,MAAI;GACF,MAAM,EAAE,YAAY,MAAM,OAAO,KAAK;AACtC,OAAI,KAAK,QAAQ,QAAS,QAAO;AAEjC,OAAI,gBAAgB;AAClB,QAAI,CAAC,QAAQ,QAAQ;AACnB,SAAI,KAAK,EAAE,OAAO,KAAK,OAAO,EAAE,sDAAsD;AACtF,YAAO;;AAET,WAAO,QAAQ;;AAEjB,UAAO;WACA,GAAG;AACV,OAAI,KAAK,QAAS,OAAM;GACxB,MAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,EAAE;AACtD,OAAI,KAAK;IAAE,KAAK;IAAG,OAAO,KAAK;IAAO,cAAc;IAAK,EAAE,wBAAwB,MAAM;AACzF,UAAO;YACC;AACR,QAAK,QAAQ,oBAAoB,SAAS,QAAQ;;;;AAKxD,SAAS,wBACP,WACA,gBACU;CAEV,MAAM,YADO,aAAa,UAAU,SAAS,IAAI,YAAY,CAAC,GAAG,uBAAuB,EAErF,KAAK,MAAM,OAAO,EAAE,CAAC,MAAM,CAAC,CAC5B,QAAQ,MAAM,EAAE,SAAS,EAAE,CAC3B,QAAQ,MAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC;AAChD,KAAI,kBAAkB,CAAC,SAAS,SAAA,oBAAqC,CACnE,UAAS,KAAK,4BAA4B;AAE5C,QAAO,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;;AAG/B,SAAS,YAAY,QAAgB,MAAmC,YAA6B;CACnG,MAAM,QAAkB,EAAE;AAC1B,KAAI,KAAK,cAAc,MAAM,CAAE,OAAM,KAAK,KAAK,aAAa,MAAM,CAAC;AACnE,KAAI,KAAK,MAAO,OAAM,KAAK,eAAe,KAAK,QAAQ;AACvD,KAAI,KAAK,MAAO,OAAM,KAAK,mBAAmB,KAAK,QAAQ;AAC3D,OAAM,KAAK,OAAO;AAClB,KAAI,WACF,OAAM,KACJ;EACE;EACA;EACA;EACA;EACA;EACD,CAAC,KAAK,KAAK,CACb;AAEH,QAAO,MAAM,KAAK,OAAO;;AAG3B,SAAS,wBAAwB,KAA0C;AACzE,KAAI;AACF,SAAO,KAAK;UACL,GAAG;AACV,MAAI,KAAK,EAAE,KAAK,GAAG,EAAE,2CAA2C;AAChE,SAAO;;;AAIX,SAAS,0BACP,WAC0B;CAC1B,MAAM,OAAO,WAAW,EAAE,QAAQ,UAAU,UAAU;AACtD,KAAI,SAAS,SAAS,SAAS,WAAW,SAAS,OAAQ,QAAO;AAClE,QAAO;;AAGT,SAAS,sBAAsB,OASL;AACxB,SAAQ,MAAM,MAAd;EACE,KAAK,aACH,QAAO;GACL,MAAM;GACN,YAAY,MAAM,cAAc;GAChC,UAAU,MAAM,YAAY;GAC5B,MAAM,MAAM,QAAQ,EAAE;GACvB;EACH,KAAK,WACH,QAAO;GACL,MAAM;GACN,YAAY,MAAM,cAAc;GAChC,UAAU,MAAM,YAAY;GAC5B,SAAS,QAAQ,MAAM,QAAQ;GAChC;EACH,KAAK,YACH,QAAO;GACL,MAAM;GACN,OAAO,MAAM,SAAS;GACtB,KAAK,MAAM,OAAO;GACnB;EACH,KAAK,aACH,QAAO;GAAE,MAAM;GAAc,OAAO,MAAM,SAAS;GAAI;EACzD,KAAK,iBACH,QAAO;GAAE,MAAM;GAAkB,OAAO,MAAM,SAAS;GAAI;EAC7D,QACE,QAAO;GAAE,MAAM;GAAc,OAAO;GAAI"}

package/dist/src/agent/workflow/types.d.ts

@@ -22,12 +22,24 @@ export interface JsonSchema {
 export interface WorkflowMetaPhase {
     title: string;
     detail?: string;
+    /** Default model for this phase: `provider/model` or configured typed id. */
     model?: string;
 }
 export interface WorkflowMetaEstimatedAgents {
     min: number;
     max: number;
 }
+/** One-click starter text in the gateway start dialog; `field` is `goal` or an `args` key. */
+export interface WorkflowMetaExamplePrompt {
+    field: string;
+    text: string;
+}
+/** Locale-specific copy overrides; top-level `description` / `whenToUse` / `examplePrompts` are English defaults. */
+export interface WorkflowMetaLocale {
+    description?: string;
+    whenToUse?: string;
+    examplePrompts?: WorkflowMetaExamplePrompt[];
+}
 export interface WorkflowMeta {
     name: string;
     description: string;
@@ -37,8 +49,24 @@ export interface WorkflowMeta {
     tags?: string[];
     /** Rough subagent count range for UX / cost hints. */
     estimatedAgents?: WorkflowMetaEstimatedAgents;
+    /** English-default example prompts for the gateway start dialog. */
+    examplePrompts?: WorkflowMetaExamplePrompt[];
+    /** Non-English locale bundles keyed by BCP-47 language tag (e.g. `zh`). */
+    i18n?: Record<string, WorkflowMetaLocale>;
 }
 export type WorkflowAgentStatus = 'queued' | 'running' | 'done' | 'error' | 'skipped';
+export type WorkflowAgentStepStatus = 'running' | 'done' | 'error';
+export interface WorkflowAgentStep {
+    id: string;
+    kind: 'tool' | 'llm' | 'thinking';
+    /** Original tool name when `kind === 'tool'` (for chat UI reuse). */
+    toolName?: string;
+    label: string;
+    detail?: string;
+    status: WorkflowAgentStepStatus;
+    startedAtMs?: number;
+    durationMs?: number;
+}
 export interface WorkflowAgentSnapshot {
     id: number;
     label: string;
@@ -47,6 +75,15 @@ export interface WorkflowAgentSnapshot {
     status: WorkflowAgentStatus;
     resultPreview?: string;
     error?: string;
+    startedAtMs?: number;
+    durationMs?: number;
+    steps?: WorkflowAgentStep[];
+    /** One-line summary for inline agent rows. */
+    currentStep?: string;
+    iteration?: number;
+    maxIterations?: number;
+    /** Accumulated assistant/thinking text when subagentStream is `full`. */
+    streamText?: string;
 }
 export interface WorkflowSnapshot {
     name: string;
@@ -79,12 +116,35 @@ export interface SubagentRunOptions<T = unknown> {
     rethrow?: boolean;
     /** Hint about which phase this agent belongs to (passed through for logging). */
     phase?: string;
+    /** Live progress from the child agent loop (workflow tool binds per agent id). */
+    onProgress?: (event: SubagentProgressEvent) => void;
     /** Pre-bound capture for structured output (internal: created by the adapter when schema present). */
     __capture?: {
         called: boolean;
         value?: T;
     };
 }
+export type SubagentProgressEvent = {
+    type: 'tool_start';
+    toolCallId: string;
+    toolName: string;
+    args: Record<string, unknown>;
+} | {
+    type: 'tool_end';
+    toolCallId: string;
+    toolName: string;
+    isError: boolean;
+} | {
+    type: 'iteration';
+    count: number;
+    max: number;
+} | {
+    type: 'text_delta';
+    delta: string;
+} | {
+    type: 'thinking_delta';
+    delta: string;
+};
 /**
  * Spawns a single fresh subagent and returns its result.
  *
@@ -102,7 +162,9 @@ export interface AgentScriptOptions {
     label?: string;
     phase?: string;
     schema?: JsonSchema;
-    /** Model id; currently passed as text guidance, runner may resolve in future. */
+    /**
+     * Model ref: `provider/model` or a configured typed id (e.g. `small`, `@large`).
+     */
     model?: string;
     /** Subagent tool allowlist override (forwarded to the runner). */
     toolset?: string[];
@@ -121,6 +183,12 @@ export interface WorkflowRunOptions {
     maxSubagents?: number;
     onLog?: (message: string) => void;
     onPhase?: (title: string) => void;
+    onAgentQueued?: (event: {
+        id: number;
+        label: string;
+        phase?: string;
+        prompt: string;
+    }) => void;
     onAgentStart?: (event: {
         id: number;
         label: string;
@@ -134,6 +202,13 @@ export interface WorkflowRunOptions {
         result: unknown;
         status: WorkflowAgentStatus;
     }) => void;
+    /** Merge extra subagent run options (e.g. progress callbacks) per agent id. */
+    enhanceSubagentRun?: (ctx: {
+        id: number;
+        label: string;
+        phase?: string;
+        prompt: string;
+    }) => Partial<SubagentRunOptions<unknown>>;
 }
 export interface WorkflowRunResult<T = unknown> {
     meta: WorkflowMeta;

package/dist/src/auth/credentials.d.ts

@@ -54,6 +54,11 @@ export declare class CredentialResolver {
         id: string;
         source: 'agent' | 'global';
     }>>;
+    /**
+     * Plaintext API key from global auth profiles only (no env/oauth fallback).
+     * Used by the gateway console reveal endpoint.
+     */
+    revealGatewayStoredApiKey(provider: string): Promise<string | null>;
     /**
      * Save an API key profile
      */

package/dist/src/auth/credentials.js

@@ -1,11 +1,11 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
+import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
-import { init_write_file_atomic, writeTextAtomic } from "../infra/write-file-atomic.js";
 import { getApiKeyFromEnv, init_env_keys } from "../providers/env-keys.js";
-import { dirname, join } from "path";
+import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveCredentialsDir, resolveOAuthPath } from "../config/paths.js";
 import { mkdir, readFile } from "fs/promises";
+import { dirname, join } from "path";
 //#region src/auth/credentials.ts
 function getCredentialResolver(options) {
 	return new CredentialResolver(options);
@@ -117,6 +117,15 @@ var init_credentials = __esmMin((() => {
 			return profiles;
 		}
 		/**
+		* Plaintext API key from global auth profiles only (no env/oauth fallback).
+		* Used by the gateway console reveal endpoint.
+		*/
+		async revealGatewayStoredApiKey(provider) {
+			const normalizedProvider = provider.toLowerCase();
+			const profiles = await this.loadAuthProfilesFile();
+			return this.findProfileForProvider(profiles, normalizedProvider)?.key?.trim() || null;
+		}
+		/**
 		* Save an API key profile
 		*/
 		async saveApiKey(provider, key, options = {}) {

package/dist/src/auth/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","names":[],"sources":["../../../src/auth/credentials.ts"],"sourcesContent":["import { readFile, mkdir } from 'fs/promises';\nimport { writeTextAtomic } from '../infra/write-file-atomic.js';\nimport { join, dirname } from 'path';\nimport { createLogger } from '../utils/logger.js';\nimport { getApiKeyFromEnv } from '../providers/env-keys.js';\nimport {\n  resolveCredentialsDir,\n  resolveAuthProfilesPath,\n  resolveAgentAuthProfilesPath,\n  resolveOAuthPath,\n} from '../config/paths.js';\nimport type { Config } from '../config/schema.js';\n\nconst log = createLogger('Credentials');\n\n// ============================================\n// Types\n// ============================================\n\nexport type CredentialType = 'api_key' | 'oauth';\n\nexport interface ApiKeyProfile {\n  type: 'api_key';\n  provider: string;\n  profileName?: string;\n  envVar?: string | null;\n  key: string | null;\n}\n\nexport interface OAuthToken {\n  type: 'oauth';\n  provider: string;\n  access: string;\n  refresh?: string;\n  expiresAt?: number;\n  scope?: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport type CredentialProfile = ApiKeyProfile;\n\nexport interface AuthProfilesFile {\n  version: number;\n  profiles: Record<string, ApiKeyProfile>;\n}\n\n// ============================================\n// Credential Resolver\n// ============================================\n\nexport interface CredentialResolverOptions {\n  stateDir?: string;\n  /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */\n  agentId?: string;\n  /** Required when `agentId` is set. */\n  appConfig?: Config;\n}\n\nexport class CredentialResolver {\n  private readonly credentialsDir: string;\n  private readonly agentId?: string;\n  private readonly appConfig?: Config;\n\n  constructor(options: CredentialResolverOptions = {}) {\n    this.credentialsDir = options.stateDir\n      ? join(options.stateDir, 'credentials')\n      : resolveCredentialsDir();\n    this.agentId = options.agentId;\n    this.appConfig = options.appConfig;\n    if (this.agentId && !this.appConfig) {\n      throw new Error('CredentialResolver: appConfig is required when agentId is set');\n    }\n  }\n\n  /**\n   * Resolve API key for a provider\n   * Priority: Agent private > Global > OAuth > Environment\n   */\n  async resolveApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    // 1. Try agent private credentials\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) {\n        log.debug({ provider, source: 'agent' }, 'Resolved API key from agent credentials');\n        return agentKey;\n      }\n    }\n\n    // 2. Try global credentials\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) {\n      log.debug({ provider, source: 'global' }, 'Resolved API key from global credentials');\n      return globalKey;\n    }\n\n    // 3. Try OAuth token (convert to Bearer)\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) {\n      log.debug({ provider, source: 'oauth' }, 'Resolved API key from OAuth token');\n      return oauthToken.access;\n    }\n\n    // 4. Environment variables (see `src/providers/env-keys.ts`)\n    const envKey = getApiKeyFromEnv(normalizedProvider);\n    if (envKey) {\n      log.debug({ provider, source: 'env' }, 'Resolved API key from environment');\n      return envKey;\n    }\n\n    log.debug({ provider }, 'No API key found');\n    return null;\n  }\n\n  /**\n   * Check if a provider has credentials configured\n   */\n  async hasCredentials(provider: string): Promise<boolean> {\n    const key = await this.resolveApiKey(provider);\n    return key !== null;\n  }\n\n  /**\n   * Which step in {@link resolveApiKey} would supply the key (no secret material).\n   */\n  async resolveApiKeySource(\n    provider: string,\n  ): Promise<'agent' | 'global' | 'oauth' | 'env' | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) return 'agent';\n    }\n\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) return 'global';\n\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) return 'oauth';\n\n    if (getApiKeyFromEnv(normalizedProvider)) return 'env';\n\n    return null;\n  }\n\n  /**\n   * List all available credential profiles\n   */\n  async listProfiles(): Promise<Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }>> {\n    const profiles: Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }> = [];\n\n    // Global profiles\n    const globalProfiles = await this.loadAuthProfilesFile();\n    for (const [id, profile] of Object.entries(globalProfiles.profiles)) {\n      profiles.push({ ...profile, id, source: 'global' });\n    }\n\n    // Agent private profiles\n    if (this.agentId) {\n      const agentProfiles = await this.loadAgentAuthProfilesFile();\n      for (const [id, profile] of Object.entries(agentProfiles.profiles)) {\n        profiles.push({ ...profile, id, source: 'agent' });\n      }\n    }\n\n    return profiles;\n  }\n\n  /**\n   * Save an API key profile\n   */\n  async saveApiKey(\n    provider: string,\n    key: string,\n    options: {\n      profileName?: string;\n      envVar?: string | null;\n      agentPrivate?: boolean;\n    } = {}\n  ): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const profileId = options.profileName\n      ? `${normalizedProvider}:${options.profileName}`\n      : `${normalizedProvider}:default`;\n\n    const profile: ApiKeyProfile = {\n      type: 'api_key',\n      provider: normalizedProvider,\n      profileName: options.profileName,\n      envVar: options.envVar ?? null,\n      key,\n    };\n\n    if (options.agentPrivate && this.agentId) {\n      await this.saveAgentAuthProfile(profileId, profile);\n    } else {\n      await this.saveGlobalAuthProfile(profileId, profile);\n    }\n\n    log.info({ provider, profileId, agentPrivate: options.agentPrivate }, 'Saved API key');\n  }\n\n  /**\n   * Delete a credential profile\n   */\n  async deleteProfile(profileId: string, options: { agentPrivate?: boolean } = {}): Promise<void> {\n    if (options.agentPrivate && this.agentId) {\n      await this.deleteAgentAuthProfile(profileId);\n    } else {\n      await this.deleteGlobalAuthProfile(profileId);\n    }\n\n    log.info({ profileId, agentPrivate: options.agentPrivate }, 'Deleted credential profile');\n  }\n\n  /**\n   * Load OAuth token for a provider\n   */\n  async loadOAuthToken(provider: string): Promise<OAuthToken | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    try {\n      const content = await readFile(oauthPath, 'utf-8');\n      const token = JSON.parse(content) as OAuthToken;\n\n      // Check if token is expired\n      if (token.expiresAt && token.expiresAt < Date.now()) {\n        log.warn({ provider, expiresAt: token.expiresAt }, 'OAuth token is expired');\n        // TODO: Implement token refresh\n        return null;\n      }\n\n      return token;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Save OAuth token for a provider\n   */\n  async saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    await mkdir(dirname(oauthPath), { recursive: true });\n\n    const fullToken: OAuthToken = {\n      ...token,\n      type: 'oauth',\n      provider: normalizedProvider,\n      updatedAt: new Date().toISOString(),\n    };\n\n    await writeTextAtomic(oauthPath, JSON.stringify(fullToken, null, 2));\n    log.info({ provider }, 'Saved OAuth token');\n  }\n\n  // ============================================\n  // Private Methods\n  // ============================================\n\n  private async loadFromAgentCredentials(provider: string): Promise<string | null> {\n    if (!this.agentId) return null;\n\n    const profiles = await this.loadAgentAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private async loadFromGlobalCredentials(provider: string): Promise<string | null> {\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private loadFromEnv(envVarName: string): string | null {\n    return process.env[envVarName] || null;\n  }\n\n  private findProfileForProvider(\n    file: AuthProfilesFile,\n    provider: string\n  ): ApiKeyProfile | null {\n    const normalizedProvider = provider.toLowerCase();\n\n    // Look for exact match first\n    for (const [, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        return profile;\n      }\n    }\n\n    return null;\n  }\n\n  private async loadAuthProfilesFile(): Promise<AuthProfilesFile> {\n    const path = resolveAuthProfilesPath();\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async loadAgentAuthProfilesFile(): Promise<AuthProfilesFile> {\n    if (!this.agentId || !this.appConfig) return { version: 2, profiles: {} };\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async saveGlobalAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async saveAgentAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAgentAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteGlobalAuthProfile(profileId: string): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    const file = await this.loadAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteAgentAuthProfile(profileId: string): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    const file = await this.loadAgentAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n}\n\n// ============================================\n// Convenience Functions\n// ============================================\n\nlet defaultResolver: CredentialResolver | null = null;\n\nexport function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver {\n  if (!defaultResolver || options) {\n    return new CredentialResolver(options);\n  }\n  return defaultResolver;\n}\n\nexport async function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null> {\n  const resolver = getCredentialResolver(options);\n  return resolver.resolveApiKey(provider);\n}\n\nexport async function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean> {\n  const resolver = getCredentialResolver(options);\n  return resolver.hasCredentials(provider);\n}\n"],"mappings":";;;;;;;;;AAmYA,SAAgB,sBAAsB,SAAyD;AAE3F,QAAO,IAAI,mBAAmB,QAAQ;;AAK1C,eAAsB,cAAc,UAAkB,SAA6D;AAEjH,QADiB,sBAAsB,QACxB,CAAC,cAAc,SAAS;;AAGzC,eAAsB,eAAe,UAAkB,SAAuD;AAE5G,QADiB,sBAAsB,QACxB,CAAC,eAAe,SAAS;;;;yBAhZsB;cAEd;gBACU;aAMhC;AAGtB,OAAM,aAAa,cAAc;AA8C1B,sBAAb,MAAgC;EAC9B;EACA;EACA;EAEA,YAAY,UAAqC,EAAE,EAAE;AACnD,QAAK,iBAAiB,QAAQ,WAC1B,KAAK,QAAQ,UAAU,cAAc,GACrC,uBAAuB;AAC3B,QAAK,UAAU,QAAQ;AACvB,QAAK,YAAY,QAAQ;AACzB,OAAI,KAAK,WAAW,CAAC,KAAK,UACxB,OAAM,IAAI,MAAM,gEAAgE;;;;;;EAQpF,MAAM,cAAc,UAA0C;GAC5D,MAAM,qBAAqB,SAAS,aAAa;AAGjD,OAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,yBAAyB,mBAAmB;AACxE,QAAI,UAAU;AACZ,SAAI,MAAM;MAAE;MAAU,QAAQ;MAAS,EAAE,0CAA0C;AACnF,YAAO;;;GAKX,MAAM,YAAY,MAAM,KAAK,0BAA0B,mBAAmB;AAC1E,OAAI,WAAW;AACb,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAU,EAAE,2CAA2C;AACrF,WAAO;;GAIT,MAAM,aAAa,MAAM,KAAK,eAAe,mBAAmB;AAChE,OAAI,YAAY;AACd,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAS,EAAE,oCAAoC;AAC7E,WAAO,WAAW;;GAIpB,MAAM,SAAS,iBAAiB,mBAAmB;AACnD,OAAI,QAAQ;AACV,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAO,EAAE,oCAAoC;AAC3E,WAAO;;AAGT,OAAI,MAAM,EAAE,UAAU,EAAE,mBAAmB;AAC3C,UAAO;;;;;EAMT,MAAM,eAAe,UAAoC;AAEvD,UAAO,MADW,KAAK,cAAc,SAAS,KAC/B;;;;;EAMjB,MAAM,oBACJ,UACsD;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,OAAI,KAAK;QAEH,MADmB,KAAK,yBAAyB,mBAAmB,CAC1D,QAAO;;AAIvB,OAAI,MADoB,KAAK,0BAA0B,mBAAmB,CAC3D,QAAO;AAGtB,OAAI,MADqB,KAAK,eAAe,mBAAmB,CAChD,QAAO;AAEvB,OAAI,iBAAiB,mBAAmB,CAAE,QAAO;AAEjD,UAAO;;;;;EAMT,MAAM,eAA2F;GAC/F,MAAM,WAA8E,EAAE;GAGtF,MAAM,iBAAiB,MAAM,KAAK,sBAAsB;AACxD,QAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,eAAe,SAAS,CACjE,UAAS,KAAK;IAAE,GAAG;IAAS;IAAI,QAAQ;IAAU,CAAC;AAIrD,OAAI,KAAK,SAAS;IAChB,MAAM,gBAAgB,MAAM,KAAK,2BAA2B;AAC5D,SAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,cAAc,SAAS,CAChE,UAAS,KAAK;KAAE,GAAG;KAAS;KAAI,QAAQ;KAAS,CAAC;;AAItD,UAAO;;;;;EAMT,MAAM,WACJ,UACA,KACA,UAII,EAAE,EACS;GACf,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,QAAQ,cACtB,GAAG,mBAAmB,GAAG,QAAQ,gBACjC,GAAG,mBAAmB;GAE1B,MAAM,UAAyB;IAC7B,MAAM;IACN,UAAU;IACV,aAAa,QAAQ;IACrB,QAAQ,QAAQ,UAAU;IAC1B;IACD;AAED,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,qBAAqB,WAAW,QAAQ;OAEnD,OAAM,KAAK,sBAAsB,WAAW,QAAQ;AAGtD,OAAI,KAAK;IAAE;IAAU;IAAW,cAAc,QAAQ;IAAc,EAAE,gBAAgB;;;;;EAMxF,MAAM,cAAc,WAAmB,UAAsC,EAAE,EAAiB;AAC9F,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,uBAAuB,UAAU;OAE5C,OAAM,KAAK,wBAAwB,UAAU;AAG/C,OAAI,KAAK;IAAE;IAAW,cAAc,QAAQ;IAAc,EAAE,6BAA6B;;;;;EAM3F,MAAM,eAAe,UAA8C;GAEjE,MAAM,YAAY,iBADS,SAAS,aACiB,CAAC;AAEtD,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;IAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;AAGjC,QAAI,MAAM,aAAa,MAAM,YAAY,KAAK,KAAK,EAAE;AACnD,SAAI,KAAK;MAAE;MAAU,WAAW,MAAM;MAAW,EAAE,yBAAyB;AAE5E,YAAO;;AAGT,WAAO;WACD;AACN,WAAO;;;;;;EAOX,MAAM,eAAe,UAAkB,OAA2E;GAChH,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;GAEpD,MAAM,YAAwB;IAC5B,GAAG;IACH,MAAM;IACN,UAAU;IACV,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,SAAM,gBAAgB,WAAW,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC;AACpE,OAAI,KAAK,EAAE,UAAU,EAAE,oBAAoB;;EAO7C,MAAc,yBAAyB,UAA0C;AAC/E,OAAI,CAAC,KAAK,QAAS,QAAO;GAE1B,MAAM,WAAW,MAAM,KAAK,2BAA2B;GACvD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,MAAc,0BAA0B,UAA0C;GAChF,MAAM,WAAW,MAAM,KAAK,sBAAsB;GAClD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,YAAoB,YAAmC;AACrD,UAAO,QAAQ,IAAI,eAAe;;EAGpC,uBACE,MACA,UACsB;GACtB,MAAM,qBAAqB,SAAS,aAAa;AAGjD,QAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,KAAK,SAAS,CACrD,KAAI,QAAQ,aAAa,mBACvB,QAAO;AAIX,UAAO;;EAGT,MAAc,uBAAkD;GAC9D,MAAM,OAAO,yBAAyB;AAEtC,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,4BAAuD;AACnE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,QAAO;IAAE,SAAS;IAAG,UAAU,EAAE;IAAE;GAEzE,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AAEvE,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,sBAAsB,WAAmB,SAAuC;GAC5F,MAAM,OAAO,yBAAyB;AACtC,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,qBAAqB,WAAmB,SAAuC;AAC3F,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AACvE,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,2BAA2B;AACnD,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,wBAAwB,WAAkC;GACtE,MAAM,OAAO,yBAAyB;GACtC,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAE9C,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,uBAAuB,WAAkC;AACrE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;GACvE,MAAM,OAAO,MAAM,KAAK,2BAA2B;AAEnD,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC"}
+{"version":3,"file":"credentials.js","names":[],"sources":["../../../src/auth/credentials.ts"],"sourcesContent":["import { readFile, mkdir } from 'fs/promises';\nimport { writeTextAtomic } from '../infra/write-file-atomic.js';\nimport { join, dirname } from 'path';\nimport { createLogger } from '../utils/logger.js';\nimport { getApiKeyFromEnv } from '../providers/env-keys.js';\nimport {\n  resolveCredentialsDir,\n  resolveAuthProfilesPath,\n  resolveAgentAuthProfilesPath,\n  resolveOAuthPath,\n} from '../config/paths.js';\nimport type { Config } from '../config/schema.js';\n\nconst log = createLogger('Credentials');\n\n// ============================================\n// Types\n// ============================================\n\nexport type CredentialType = 'api_key' | 'oauth';\n\nexport interface ApiKeyProfile {\n  type: 'api_key';\n  provider: string;\n  profileName?: string;\n  envVar?: string | null;\n  key: string | null;\n}\n\nexport interface OAuthToken {\n  type: 'oauth';\n  provider: string;\n  access: string;\n  refresh?: string;\n  expiresAt?: number;\n  scope?: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport type CredentialProfile = ApiKeyProfile;\n\nexport interface AuthProfilesFile {\n  version: number;\n  profiles: Record<string, ApiKeyProfile>;\n}\n\n// ============================================\n// Credential Resolver\n// ============================================\n\nexport interface CredentialResolverOptions {\n  stateDir?: string;\n  /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */\n  agentId?: string;\n  /** Required when `agentId` is set. */\n  appConfig?: Config;\n}\n\nexport class CredentialResolver {\n  private readonly credentialsDir: string;\n  private readonly agentId?: string;\n  private readonly appConfig?: Config;\n\n  constructor(options: CredentialResolverOptions = {}) {\n    this.credentialsDir = options.stateDir\n      ? join(options.stateDir, 'credentials')\n      : resolveCredentialsDir();\n    this.agentId = options.agentId;\n    this.appConfig = options.appConfig;\n    if (this.agentId && !this.appConfig) {\n      throw new Error('CredentialResolver: appConfig is required when agentId is set');\n    }\n  }\n\n  /**\n   * Resolve API key for a provider\n   * Priority: Agent private > Global > OAuth > Environment\n   */\n  async resolveApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    // 1. Try agent private credentials\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) {\n        log.debug({ provider, source: 'agent' }, 'Resolved API key from agent credentials');\n        return agentKey;\n      }\n    }\n\n    // 2. Try global credentials\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) {\n      log.debug({ provider, source: 'global' }, 'Resolved API key from global credentials');\n      return globalKey;\n    }\n\n    // 3. Try OAuth token (convert to Bearer)\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) {\n      log.debug({ provider, source: 'oauth' }, 'Resolved API key from OAuth token');\n      return oauthToken.access;\n    }\n\n    // 4. Environment variables (see `src/providers/env-keys.ts`)\n    const envKey = getApiKeyFromEnv(normalizedProvider);\n    if (envKey) {\n      log.debug({ provider, source: 'env' }, 'Resolved API key from environment');\n      return envKey;\n    }\n\n    log.debug({ provider }, 'No API key found');\n    return null;\n  }\n\n  /**\n   * Check if a provider has credentials configured\n   */\n  async hasCredentials(provider: string): Promise<boolean> {\n    const key = await this.resolveApiKey(provider);\n    return key !== null;\n  }\n\n  /**\n   * Which step in {@link resolveApiKey} would supply the key (no secret material).\n   */\n  async resolveApiKeySource(\n    provider: string,\n  ): Promise<'agent' | 'global' | 'oauth' | 'env' | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) return 'agent';\n    }\n\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) return 'global';\n\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) return 'oauth';\n\n    if (getApiKeyFromEnv(normalizedProvider)) return 'env';\n\n    return null;\n  }\n\n  /**\n   * List all available credential profiles\n   */\n  async listProfiles(): Promise<Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }>> {\n    const profiles: Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }> = [];\n\n    // Global profiles\n    const globalProfiles = await this.loadAuthProfilesFile();\n    for (const [id, profile] of Object.entries(globalProfiles.profiles)) {\n      profiles.push({ ...profile, id, source: 'global' });\n    }\n\n    // Agent private profiles\n    if (this.agentId) {\n      const agentProfiles = await this.loadAgentAuthProfilesFile();\n      for (const [id, profile] of Object.entries(agentProfiles.profiles)) {\n        profiles.push({ ...profile, id, source: 'agent' });\n      }\n    }\n\n    return profiles;\n  }\n\n  /**\n   * Plaintext API key from global auth profiles only (no env/oauth fallback).\n   * Used by the gateway console reveal endpoint.\n   */\n  async revealGatewayStoredApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, normalizedProvider);\n    const key = profile?.key?.trim();\n    return key || null;\n  }\n\n  /**\n   * Save an API key profile\n   */\n  async saveApiKey(\n    provider: string,\n    key: string,\n    options: {\n      profileName?: string;\n      envVar?: string | null;\n      agentPrivate?: boolean;\n    } = {}\n  ): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const profileId = options.profileName\n      ? `${normalizedProvider}:${options.profileName}`\n      : `${normalizedProvider}:default`;\n\n    const profile: ApiKeyProfile = {\n      type: 'api_key',\n      provider: normalizedProvider,\n      profileName: options.profileName,\n      envVar: options.envVar ?? null,\n      key,\n    };\n\n    if (options.agentPrivate && this.agentId) {\n      await this.saveAgentAuthProfile(profileId, profile);\n    } else {\n      await this.saveGlobalAuthProfile(profileId, profile);\n    }\n\n    log.info({ provider, profileId, agentPrivate: options.agentPrivate }, 'Saved API key');\n  }\n\n  /**\n   * Delete a credential profile\n   */\n  async deleteProfile(profileId: string, options: { agentPrivate?: boolean } = {}): Promise<void> {\n    if (options.agentPrivate && this.agentId) {\n      await this.deleteAgentAuthProfile(profileId);\n    } else {\n      await this.deleteGlobalAuthProfile(profileId);\n    }\n\n    log.info({ profileId, agentPrivate: options.agentPrivate }, 'Deleted credential profile');\n  }\n\n  /**\n   * Load OAuth token for a provider\n   */\n  async loadOAuthToken(provider: string): Promise<OAuthToken | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    try {\n      const content = await readFile(oauthPath, 'utf-8');\n      const token = JSON.parse(content) as OAuthToken;\n\n      // Check if token is expired\n      if (token.expiresAt && token.expiresAt < Date.now()) {\n        log.warn({ provider, expiresAt: token.expiresAt }, 'OAuth token is expired');\n        // TODO: Implement token refresh\n        return null;\n      }\n\n      return token;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Save OAuth token for a provider\n   */\n  async saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    await mkdir(dirname(oauthPath), { recursive: true });\n\n    const fullToken: OAuthToken = {\n      ...token,\n      type: 'oauth',\n      provider: normalizedProvider,\n      updatedAt: new Date().toISOString(),\n    };\n\n    await writeTextAtomic(oauthPath, JSON.stringify(fullToken, null, 2));\n    log.info({ provider }, 'Saved OAuth token');\n  }\n\n  // ============================================\n  // Private Methods\n  // ============================================\n\n  private async loadFromAgentCredentials(provider: string): Promise<string | null> {\n    if (!this.agentId) return null;\n\n    const profiles = await this.loadAgentAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private async loadFromGlobalCredentials(provider: string): Promise<string | null> {\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private loadFromEnv(envVarName: string): string | null {\n    return process.env[envVarName] || null;\n  }\n\n  private findProfileForProvider(\n    file: AuthProfilesFile,\n    provider: string\n  ): ApiKeyProfile | null {\n    const normalizedProvider = provider.toLowerCase();\n\n    // Look for exact match first\n    for (const [, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        return profile;\n      }\n    }\n\n    return null;\n  }\n\n  private async loadAuthProfilesFile(): Promise<AuthProfilesFile> {\n    const path = resolveAuthProfilesPath();\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async loadAgentAuthProfilesFile(): Promise<AuthProfilesFile> {\n    if (!this.agentId || !this.appConfig) return { version: 2, profiles: {} };\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async saveGlobalAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async saveAgentAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAgentAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteGlobalAuthProfile(profileId: string): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    const file = await this.loadAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteAgentAuthProfile(profileId: string): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    const file = await this.loadAgentAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n}\n\n// ============================================\n// Convenience Functions\n// ============================================\n\nlet defaultResolver: CredentialResolver | null = null;\n\nexport function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver {\n  if (!defaultResolver || options) {\n    return new CredentialResolver(options);\n  }\n  return defaultResolver;\n}\n\nexport async function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null> {\n  const resolver = getCredentialResolver(options);\n  return resolver.resolveApiKey(provider);\n}\n\nexport async function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean> {\n  const resolver = getCredentialResolver(options);\n  return resolver.hasCredentials(provider);\n}\n"],"mappings":";;;;;;;;;AA+YA,SAAgB,sBAAsB,SAAyD;AAE3F,QAAO,IAAI,mBAAmB,QAAQ;;AAK1C,eAAsB,cAAc,UAAkB,SAA6D;AAEjH,QADiB,sBAAsB,QACxB,CAAC,cAAc,SAAS;;AAGzC,eAAsB,eAAe,UAAkB,SAAuD;AAE5G,QADiB,sBAAsB,QACxB,CAAC,eAAe,SAAS;;;;yBA5ZsB;cAEd;gBACU;aAMhC;AAGtB,OAAM,aAAa,cAAc;AA8C1B,sBAAb,MAAgC;EAC9B;EACA;EACA;EAEA,YAAY,UAAqC,EAAE,EAAE;AACnD,QAAK,iBAAiB,QAAQ,WAC1B,KAAK,QAAQ,UAAU,cAAc,GACrC,uBAAuB;AAC3B,QAAK,UAAU,QAAQ;AACvB,QAAK,YAAY,QAAQ;AACzB,OAAI,KAAK,WAAW,CAAC,KAAK,UACxB,OAAM,IAAI,MAAM,gEAAgE;;;;;;EAQpF,MAAM,cAAc,UAA0C;GAC5D,MAAM,qBAAqB,SAAS,aAAa;AAGjD,OAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,yBAAyB,mBAAmB;AACxE,QAAI,UAAU;AACZ,SAAI,MAAM;MAAE;MAAU,QAAQ;MAAS,EAAE,0CAA0C;AACnF,YAAO;;;GAKX,MAAM,YAAY,MAAM,KAAK,0BAA0B,mBAAmB;AAC1E,OAAI,WAAW;AACb,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAU,EAAE,2CAA2C;AACrF,WAAO;;GAIT,MAAM,aAAa,MAAM,KAAK,eAAe,mBAAmB;AAChE,OAAI,YAAY;AACd,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAS,EAAE,oCAAoC;AAC7E,WAAO,WAAW;;GAIpB,MAAM,SAAS,iBAAiB,mBAAmB;AACnD,OAAI,QAAQ;AACV,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAO,EAAE,oCAAoC;AAC3E,WAAO;;AAGT,OAAI,MAAM,EAAE,UAAU,EAAE,mBAAmB;AAC3C,UAAO;;;;;EAMT,MAAM,eAAe,UAAoC;AAEvD,UAAO,MADW,KAAK,cAAc,SAAS,KAC/B;;;;;EAMjB,MAAM,oBACJ,UACsD;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,OAAI,KAAK;QAEH,MADmB,KAAK,yBAAyB,mBAAmB,CAC1D,QAAO;;AAIvB,OAAI,MADoB,KAAK,0BAA0B,mBAAmB,CAC3D,QAAO;AAGtB,OAAI,MADqB,KAAK,eAAe,mBAAmB,CAChD,QAAO;AAEvB,OAAI,iBAAiB,mBAAmB,CAAE,QAAO;AAEjD,UAAO;;;;;EAMT,MAAM,eAA2F;GAC/F,MAAM,WAA8E,EAAE;GAGtF,MAAM,iBAAiB,MAAM,KAAK,sBAAsB;AACxD,QAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,eAAe,SAAS,CACjE,UAAS,KAAK;IAAE,GAAG;IAAS;IAAI,QAAQ;IAAU,CAAC;AAIrD,OAAI,KAAK,SAAS;IAChB,MAAM,gBAAgB,MAAM,KAAK,2BAA2B;AAC5D,SAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,cAAc,SAAS,CAChE,UAAS,KAAK;KAAE,GAAG;KAAS;KAAI,QAAQ;KAAS,CAAC;;AAItD,UAAO;;;;;;EAOT,MAAM,0BAA0B,UAA0C;GACxE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,WAAW,MAAM,KAAK,sBAAsB;AAGlD,UAFgB,KAAK,uBAAuB,UAAU,mBACnC,EAAE,KAAK,MAAM,IAClB;;;;;EAMhB,MAAM,WACJ,UACA,KACA,UAII,EAAE,EACS;GACf,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,QAAQ,cACtB,GAAG,mBAAmB,GAAG,QAAQ,gBACjC,GAAG,mBAAmB;GAE1B,MAAM,UAAyB;IAC7B,MAAM;IACN,UAAU;IACV,aAAa,QAAQ;IACrB,QAAQ,QAAQ,UAAU;IAC1B;IACD;AAED,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,qBAAqB,WAAW,QAAQ;OAEnD,OAAM,KAAK,sBAAsB,WAAW,QAAQ;AAGtD,OAAI,KAAK;IAAE;IAAU;IAAW,cAAc,QAAQ;IAAc,EAAE,gBAAgB;;;;;EAMxF,MAAM,cAAc,WAAmB,UAAsC,EAAE,EAAiB;AAC9F,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,uBAAuB,UAAU;OAE5C,OAAM,KAAK,wBAAwB,UAAU;AAG/C,OAAI,KAAK;IAAE;IAAW,cAAc,QAAQ;IAAc,EAAE,6BAA6B;;;;;EAM3F,MAAM,eAAe,UAA8C;GAEjE,MAAM,YAAY,iBADS,SAAS,aACiB,CAAC;AAEtD,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;IAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;AAGjC,QAAI,MAAM,aAAa,MAAM,YAAY,KAAK,KAAK,EAAE;AACnD,SAAI,KAAK;MAAE;MAAU,WAAW,MAAM;MAAW,EAAE,yBAAyB;AAE5E,YAAO;;AAGT,WAAO;WACD;AACN,WAAO;;;;;;EAOX,MAAM,eAAe,UAAkB,OAA2E;GAChH,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;GAEpD,MAAM,YAAwB;IAC5B,GAAG;IACH,MAAM;IACN,UAAU;IACV,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,SAAM,gBAAgB,WAAW,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC;AACpE,OAAI,KAAK,EAAE,UAAU,EAAE,oBAAoB;;EAO7C,MAAc,yBAAyB,UAA0C;AAC/E,OAAI,CAAC,KAAK,QAAS,QAAO;GAE1B,MAAM,WAAW,MAAM,KAAK,2BAA2B;GACvD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,MAAc,0BAA0B,UAA0C;GAChF,MAAM,WAAW,MAAM,KAAK,sBAAsB;GAClD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,YAAoB,YAAmC;AACrD,UAAO,QAAQ,IAAI,eAAe;;EAGpC,uBACE,MACA,UACsB;GACtB,MAAM,qBAAqB,SAAS,aAAa;AAGjD,QAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,KAAK,SAAS,CACrD,KAAI,QAAQ,aAAa,mBACvB,QAAO;AAIX,UAAO;;EAGT,MAAc,uBAAkD;GAC9D,MAAM,OAAO,yBAAyB;AAEtC,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,4BAAuD;AACnE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,QAAO;IAAE,SAAS;IAAG,UAAU,EAAE;IAAE;GAEzE,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AAEvE,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,sBAAsB,WAAmB,SAAuC;GAC5F,MAAM,OAAO,yBAAyB;AACtC,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,qBAAqB,WAAmB,SAAuC;AAC3F,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AACvE,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,2BAA2B;AACnD,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,wBAAwB,WAAkC;GACtE,MAAM,OAAO,yBAAyB;GACtC,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAE9C,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,uBAAuB,WAAkC;AACrE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;GACvE,MAAM,OAAO,MAAM,KAAK,2BAA2B;AAEnD,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC"}

package/dist/src/auth/profiles/store.js

@@ -1,6 +1,6 @@
 import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
-import path from "node:path";
 import { chmodSync, existsSync, mkdirSync, readFileSync } from "node:fs";
+import path from "node:path";
 import { homedir } from "os";
 //#region src/auth/profiles/store.ts
 /**

package/dist/src/auth/sync-provider-auth.js

@@ -1,7 +1,7 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { init_paths, resolveAgentAuthProfilesPath, resolveAuthProfilesPath, resolveOAuthPath } from "../config/paths.js";
 import { init_loader, loadConfig } from "../config/loader.js";
+import { getDefaultAgentId, init_resolve_route } from "../routing/resolve-route.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/auth/sync-provider-auth.ts
 /**

package/dist/src/browser/cache-dir-policy.js

@@ -1,6 +1,6 @@
 import { __esmMin } from "../../_virtual/_rolldown/runtime.js";
-import { homedir } from "node:os";
 import { isAbsolute, relative, resolve, sep } from "node:path";
+import { homedir } from "node:os";
 //#region src/browser/cache-dir-policy.ts
 function expandHome(input) {
 	if (input === "~") return homedir();

package/dist/src/browser/cdp-local-launcher.js

@@ -2,10 +2,10 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { loadPlaywrightCoreModule } from "./providers/playwright-doctor.js";
 import { pickFreePort } from "./free-port.js";
-import { homedir, platform } from "node:os";
-import { join } from "node:path";
 import { existsSync } from "node:fs";
 import { mkdir, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { homedir, platform } from "node:os";
 import { spawn } from "node:child_process";
 //#region src/browser/cdp-local-launcher.ts
 /**

package/dist/src/browser/index.js

@@ -1,12 +1,12 @@
-import { resolveBrowserCommandTimeoutMs } from "./browser-command-timeout.js";
-import { BrowserBackSchema, BrowserCdpSchema, BrowserClickSchema, BrowserCloseSchema, BrowserConsoleSchema, BrowserDialogSchema, BrowserGetImagesSchema, BrowserNavigateSchema, BrowserPressSchema, BrowserScreenshotSchema, BrowserScrollSchema, BrowserSnapshotSchema, BrowserTypeSchema, BrowserVisionSchema } from "./schemas.js";
-import { assertBrowserUrlAllowed, checkPostRedirectUrl, containsApiKeyPattern, isAlwaysBlockedUrl } from "./url-policy.js";
-import { snapshotSummaryHeader, truncateSnapshotAtBoundary } from "./snapshot-helpers.js";
 import { BrowserManager } from "./manager.js";
 import { resolveBrowserBackendFromConfig } from "./backend-from-config.js";
+import { resolveBrowserCommandTimeoutMs } from "./browser-command-timeout.js";
 import { BrowserNotReadyError, buildBrowserSetupDeepLink, checkBrowserReadiness } from "./readiness.js";
+import { assertBrowserUrlAllowed, checkPostRedirectUrl, containsApiKeyPattern, isAlwaysBlockedUrl } from "./url-policy.js";
 import { CdpSupervisor } from "./cdp-supervisor.js";
+import { snapshotSummaryHeader, truncateSnapshotAtBoundary } from "./snapshot-helpers.js";
 import { checkBotDetection, cleanupOrphanProcesses, startTracing, stopTracing } from "./session-lifecycle.js";
+import { BrowserBackSchema, BrowserCdpSchema, BrowserClickSchema, BrowserCloseSchema, BrowserConsoleSchema, BrowserDialogSchema, BrowserGetImagesSchema, BrowserNavigateSchema, BrowserPressSchema, BrowserScreenshotSchema, BrowserScrollSchema, BrowserSnapshotSchema, BrowserTypeSchema, BrowserVisionSchema } from "./schemas.js";
 import { generateMousePath, generateScrollPlan, generateTypingPlan, humanizedClick, humanizedFill, humanizedPress, humanizedScroll, resolveHumanConfig } from "./humanize.js";
 import { WEBDRIVER_OVERRIDE_SCRIPT, buildLocalStealthArgs, buildStealthArgs, generateFingerprintSeed, makeExecutable, removeQuarantineAttr } from "./stealth.js";
 import { createBrowserActionRegistry } from "./actions/registry.js";

package/dist/src/browser/manager.d.ts

@@ -1,4 +1,4 @@
-import type { BrowserContext, Page } from 'playwright-core';
+import type { Page } from 'playwright-core';
 import type { BrowserBackend } from './providers/types.js';
 import type { ExtensionBrowserProvider } from './providers/extension.js';
 export interface BrowserManagerOptions {
@@ -37,8 +37,6 @@ export declare class BrowserManager {
      * Extension mode does not create a Playwright {@link BrowserContext}.
      */
     ensureConnected(): Promise<void>;
-    /** @deprecated Use {@link ensureConnected}. */
-    ensureBrowser(): Promise<BrowserContext>;
     private _launchLocal;
     private _connectViaCdp;
     private _connectViaCloud;

package/dist/src/browser/manager.js

@@ -118,12 +118,6 @@ var BrowserManager = class {
 		this.activeBackendMode = backend.mode;
 		if (this.browser) this._wireBrowserLifecycle(this.browser);
 	}
-	/** @deprecated Use {@link ensureConnected}. */
-	async ensureBrowser() {
-		await this.ensureConnected();
-		if (!this.context) throw new Error("ensureBrowser: no Playwright context (extension backend uses ensureConnected + registry bridge)");
-		return this.context;
-	}
 	async _launchLocal(headless) {
 		const pw = await loadPlaywrightCoreModule();
 		const chromium = pw.chromium ?? pw.default?.chromium;

package/dist/src/browser/manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"manager.js","names":[],"sources":["../../../src/browser/manager.ts"],"sourcesContent":["import type { Browser, BrowserContext, Page } from 'playwright-core';\n\nimport { createLogger } from '../utils/logger.js';\n\nimport { loadPlaywrightCoreModule } from './providers/playwright-doctor.js';\nimport type { BrowserBackend, CloudBrowserProvider, CloudBrowserProviderConfig, ExtensionConnectionConfig } from './providers/types.js';\nimport type { ExtensionBrowserProvider } from './providers/extension.js';\n\nconst log = createLogger('browser-manager');\n\nconst MAX_PAGES = 3;\nconst PAGE_IDLE_TIMEOUT_MS = 5 * 60 * 1000;\n\nexport interface BrowserManagerOptions {\n  getHeadless: () => boolean;\n  /** Backend connection mode. Default: local Playwright. */\n  getBackend?: () => BrowserBackend;\n}\n\n/**\n * Multi-backend browser manager — supports local Playwright, direct CDP, and cloud providers.\n *\n * One browser context shared by all sessions; one {@link Page} per task/session key (max {@link MAX_PAGES}).\n * Backend is selected at first connection based on {@link BrowserManagerOptions.getBackend}.\n */\nexport class BrowserManager {\n  private browser: Browser | null = null;\n  private context: BrowserContext | null = null;\n  private cloudProvider: CloudBrowserProvider | null = null;\n  private extensionProvider: ExtensionBrowserProvider | null = null;\n  private extensionRelease: (() => Promise<void>) | null = null;\n  private cloakChildProcess: import('node:child_process').ChildProcess | null = null;\n  private cloakTempProfileDir: string | null = null;\n  private pages = new Map<string, { page: Page; lastUsed: number }>();\n  private readonly options: BrowserManagerOptions;\n  private activeBackendMode: BrowserBackend['mode'] | null = null;\n\n  constructor(options: BrowserManagerOptions) {\n    this.options = options;\n  }\n\n  /** Current backend mode (null if not yet connected). */\n  get backendMode(): string | null {\n    return this.activeBackendMode;\n  }\n\n  private evictIdlePages(): void {\n    const now = Date.now();\n    for (const [id, entry] of this.pages) {\n      if (entry.page.isClosed() || now - entry.lastUsed > PAGE_IDLE_TIMEOUT_MS) {\n        void entry.page.close().catch(() => {});\n        this.pages.delete(id);\n        log.debug({ taskId: id }, 'Evicted idle or closed browser page');\n      }\n    }\n  }\n\n  private _isPlaywrightConnectionAlive(): boolean {\n    if (!this.browser || !this.context) return false;\n    try {\n      if (typeof this.browser.isConnected === 'function' && !this.browser.isConnected()) {\n        return false;\n      }\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private _wireBrowserLifecycle(browser: Browser): void {\n    browser.on('disconnected', () => {\n      log.warn({ mode: this.activeBackendMode }, 'Browser disconnected — clearing stale session');\n      this._clearPlaywrightSessionRefs();\n    });\n  }\n\n  /** Drop Playwright handles without tearing down extension bridge. */\n  private _clearPlaywrightSessionRefs(): void {\n    this.pages.clear();\n    this.context = null;\n    this.browser = null;\n    this.cloakChildProcess = null;\n    this.cloakTempProfileDir = null;\n    if (this.cloudProvider) {\n      void this.cloudProvider.disconnect().catch(() => {});\n      this.cloudProvider = null;\n    }\n  }\n\n  private async _resetStalePlaywrightSession(): Promise<void> {\n    for (const [, entry] of this.pages) {\n      await entry.page.close().catch(() => {});\n    }\n    this.pages.clear();\n\n    if (this.cloudProvider) {\n      await this.cloudProvider.disconnect().catch(() => {});\n      this.cloudProvider = null;\n    }\n\n    if (this.cloakChildProcess || this.cloakTempProfileDir) {\n      const { cleanupCloakBrowser } = await import('./providers/cloakbrowser.js');\n      await cleanupCloakBrowser(this.cloakChildProcess, this.cloakTempProfileDir).catch(() => {});\n      this.cloakChildProcess = null;\n      this.cloakTempProfileDir = null;\n    }\n\n    await this.context?.close().catch(() => {});\n    await this.browser?.close().catch(() => {});\n    this.context = null;\n    this.browser = null;\n  }\n\n  /**\n   * Ensure Playwright context or Chrome Extension provider is ready.\n   * Extension mode does not create a Playwright {@link BrowserContext}.\n   */\n  async ensureConnected(): Promise<void> {\n    if (this.extensionProvider) return;\n\n    if (this.context && this._isPlaywrightConnectionAlive()) {\n      return;\n    }\n\n    if (this.context || this.browser) {\n      log.warn({ mode: this.activeBackendMode }, 'Browser session unavailable — reconnecting');\n      await this._resetStalePlaywrightSession();\n    }\n\n    const backend = this.options.getBackend?.() ?? { mode: 'local' as const, headless: false };\n\n    switch (backend.mode) {\n      case 'cdp':\n        await this._connectViaCdp(backend.config.wsEndpoint);\n        break;\n      case 'cloud':\n        await this._connectViaCloud(backend.config);\n        break;\n      case 'extension':\n        await this._connectViaExtension(backend.config);\n        break;\n      case 'cloakbrowser':\n        await this._connectViaCloakBrowser(backend.config);\n        break;\n      case 'local':\n      default:\n        await this._launchLocal(backend.mode === 'local' ? backend.headless : this.options.getHeadless() === true);\n        break;\n    }\n\n    this.activeBackendMode = backend.mode;\n    if (this.browser) {\n      this._wireBrowserLifecycle(this.browser);\n    }\n  }\n\n  /** @deprecated Use {@link ensureConnected}. */\n  async ensureBrowser(): Promise<BrowserContext> {\n    await this.ensureConnected();\n    if (!this.context) {\n      throw new Error('ensureBrowser: no Playwright context (extension backend uses ensureConnected + registry bridge)');\n    }\n    return this.context;\n  }\n\n  private async _launchLocal(headless: boolean): Promise<void> {\n    const pw = await loadPlaywrightCoreModule();\n    const chromium = pw.chromium ?? (pw as { default?: { chromium?: (typeof pw)['chromium'] } }).default?.chromium;\n    if (!chromium?.launch) {\n      throw new Error(\n        'playwright-core did not expose chromium (try reinstall: pnpm install playwright-core; install browser: npx playwright install chromium)',\n      );\n    }\n    this.browser = await chromium.launch({\n      headless,\n      ...(headless ? { channel: 'chromium' } : {}),\n      args: ['--no-sandbox', '--disable-setuid-sandbox'],\n    });\n    this.context = await this.browser.newContext({\n      viewport: { width: 1280, height: 720 },\n      userAgent:\n        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',\n    });\n    log.info({ headless, mode: 'local' }, 'Browser launched (local)');\n  }\n\n  private async _connectViaCdp(wsEndpoint: string): Promise<void> {\n    const pw = await loadPlaywrightCoreModule();\n    const chromium = pw.chromium ?? (pw as { default?: { chromium?: (typeof pw)['chromium'] } }).default?.chromium;\n    if (!chromium?.connectOverCDP) {\n      throw new Error('playwright-core does not support connectOverCDP');\n    }\n    this.browser = await chromium.connectOverCDP(wsEndpoint);\n    const contexts = this.browser.contexts();\n    this.context = contexts.length > 0 ? contexts[0] : await this.browser.newContext();\n    log.info({ mode: 'cdp', wsEndpoint }, 'Browser connected (CDP)');\n  }\n\n  private async _connectViaCloud(config: CloudBrowserProviderConfig): Promise<void> {\n    const { BrowserbaseProvider } = await import('./providers/browserbase.js');\n    const { BrowserUseProvider } = await import('./providers/browser-use.js');\n\n    const provider = config.type === 'browserbase'\n      ? new BrowserbaseProvider(config)\n      : new BrowserUseProvider(config);\n\n    const { browser, context } = await provider.connect();\n    this.browser = browser;\n    this.context = context;\n    this.cloudProvider = provider;\n    log.info({ mode: 'cloud', provider: config.type }, `Browser connected (${config.type})`);\n  }\n\n  private async _connectViaExtension(config?: ExtensionConnectionConfig): Promise<void> {\n    const { acquireExtensionBrowserServer } = await import('./providers/extension-ws-acquire.js');\n    const { provider, release } = await acquireExtensionBrowserServer(config);\n    this.extensionProvider = provider;\n    this.extensionRelease = release;\n    log.info({ port: config?.port ?? 19820 }, 'Extension WS server ready, waiting for Chrome Extension...');\n    await provider.waitForConnection();\n    // Extension mode does not use Playwright — context stays null.\n    // The action registry dispatches directly via extensionProvider.sendCommand().\n    log.info({ mode: 'extension' }, 'Browser connected (Chrome Extension)');\n  }\n\n  private async _connectViaCloakBrowser(config?: import('./providers/types.js').CloakBrowserConfig): Promise<void> {\n    const { launchCloakBrowser } = await import('./providers/cloakbrowser.js');\n    const result = await launchCloakBrowser(config);\n    if (!result.browser || !result.context) {\n      throw new Error('BrowserManager: CloakBrowser launch did not return a Playwright connection');\n    }\n    this.browser = result.browser;\n    this.context = result.context;\n    this.cloakChildProcess = result.childProcess;\n    this.cloakTempProfileDir = result.temporaryProfileDir;\n    log.info({ mode: 'cloakbrowser' }, 'Browser connected (CloakBrowser)');\n  }\n\n  async getPage(taskId: string): Promise<Page> {\n    if (this.extensionProvider) {\n      throw new Error('BrowserManager.getPage is not used in Chrome Extension backend mode');\n    }\n\n    this.evictIdlePages();\n    await this.ensureConnected();\n\n    const existing = this.pages.get(taskId);\n    if (existing && !existing.page.isClosed()) {\n      existing.lastUsed = Date.now();\n      return existing.page;\n    }\n    if (existing) {\n      this.pages.delete(taskId);\n    }\n\n    if (this.pages.size >= MAX_PAGES) {\n      const oldest = [...this.pages.entries()].sort((a, b) => a[1].lastUsed - b[1].lastUsed)[0];\n      if (oldest) {\n        await oldest[1].page.close().catch(() => {});\n        this.pages.delete(oldest[0]);\n      }\n    }\n\n    const ctx = this.context;\n    if (!ctx) {\n      throw new Error('BrowserManager: Playwright context missing after ensureConnected');\n    }\n    const page = await ctx.newPage();\n    this.pages.set(taskId, { page, lastUsed: Date.now() });\n    return page;\n  }\n\n  async closePage(taskId: string): Promise<void> {\n    if (this.extensionProvider) {\n      return;\n    }\n    const entry = this.pages.get(taskId);\n    if (entry) {\n      await entry.page.close().catch(() => {});\n      this.pages.delete(taskId);\n    }\n  }\n\n  /** Get the extension provider (only available in extension mode). */\n  getExtensionProvider(): ExtensionBrowserProvider | null {\n    return this.extensionProvider;\n  }\n\n  async shutdown(): Promise<void> {\n    for (const [, entry] of this.pages) {\n      await entry.page.close().catch(() => {});\n    }\n    this.pages.clear();\n\n    if (this.cloudProvider) {\n      await this.cloudProvider.disconnect().catch(() => {});\n      this.cloudProvider = null;\n    }\n\n    if (this.extensionRelease) {\n      await this.extensionRelease().catch(() => {});\n      this.extensionRelease = null;\n    }\n    this.extensionProvider = null;\n\n    // CloakBrowser cleanup — kill child process and remove temp profile\n    if (this.cloakChildProcess || this.cloakTempProfileDir) {\n      const { cleanupCloakBrowser } = await import('./providers/cloakbrowser.js');\n      await cleanupCloakBrowser(this.cloakChildProcess, this.cloakTempProfileDir).catch(() => {});\n      this.cloakChildProcess = null;\n      this.cloakTempProfileDir = null;\n    }\n\n    await this.context?.close().catch(() => {});\n    await this.browser?.close().catch(() => {});\n    this.context = null;\n    this.browser = null;\n    this.activeBackendMode = null;\n    log.info('Browser shut down');\n  }\n}\n"],"mappings":";;;;aAEkD;AAMlD,MAAM,MAAM,aAAa,kBAAkB;AAE3C,MAAM,YAAY;AAClB,MAAM,uBAAuB,MAAS;;;;;;;AActC,IAAa,iBAAb,MAA4B;CAC1B,UAAkC;CAClC,UAAyC;CACzC,gBAAqD;CACrD,oBAA6D;CAC7D,mBAAyD;CACzD,oBAA8E;CAC9E,sBAA6C;CAC7C,wBAAgB,IAAI,KAA+C;CACnE;CACA,oBAA2D;CAE3D,YAAY,SAAgC;AAC1C,OAAK,UAAU;;;CAIjB,IAAI,cAA6B;AAC/B,SAAO,KAAK;;CAGd,iBAA+B;EAC7B,MAAM,MAAM,KAAK,KAAK;AACtB,OAAK,MAAM,CAAC,IAAI,UAAU,KAAK,MAC7B,KAAI,MAAM,KAAK,UAAU,IAAI,MAAM,MAAM,WAAW,sBAAsB;AACnE,SAAM,KAAK,OAAO,CAAC,YAAY,GAAG;AACvC,QAAK,MAAM,OAAO,GAAG;AACrB,OAAI,MAAM,EAAE,QAAQ,IAAI,EAAE,sCAAsC;;;CAKtE,+BAAgD;AAC9C,MAAI,CAAC,KAAK,WAAW,CAAC,KAAK,QAAS,QAAO;AAC3C,MAAI;AACF,OAAI,OAAO,KAAK,QAAQ,gBAAgB,cAAc,CAAC,KAAK,QAAQ,aAAa,CAC/E,QAAO;AAET,UAAO;UACD;AACN,UAAO;;;CAIX,sBAA8B,SAAwB;AACpD,UAAQ,GAAG,sBAAsB;AAC/B,OAAI,KAAK,EAAE,MAAM,KAAK,mBAAmB,EAAE,gDAAgD;AAC3F,QAAK,6BAA6B;IAClC;;;CAIJ,8BAA4C;AAC1C,OAAK,MAAM,OAAO;AAClB,OAAK,UAAU;AACf,OAAK,UAAU;AACf,OAAK,oBAAoB;AACzB,OAAK,sBAAsB;AAC3B,MAAI,KAAK,eAAe;AACjB,QAAK,cAAc,YAAY,CAAC,YAAY,GAAG;AACpD,QAAK,gBAAgB;;;CAIzB,MAAc,+BAA8C;AAC1D,OAAK,MAAM,GAAG,UAAU,KAAK,MAC3B,OAAM,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG;AAE1C,OAAK,MAAM,OAAO;AAElB,MAAI,KAAK,eAAe;AACtB,SAAM,KAAK,cAAc,YAAY,CAAC,YAAY,GAAG;AACrD,QAAK,gBAAgB;;AAGvB,MAAI,KAAK,qBAAqB,KAAK,qBAAqB;GACtD,MAAM,EAAE,wBAAwB,MAAM,OAAO;AAC7C,SAAM,oBAAoB,KAAK,mBAAmB,KAAK,oBAAoB,CAAC,YAAY,GAAG;AAC3F,QAAK,oBAAoB;AACzB,QAAK,sBAAsB;;AAG7B,QAAM,KAAK,SAAS,OAAO,CAAC,YAAY,GAAG;AAC3C,QAAM,KAAK,SAAS,OAAO,CAAC,YAAY,GAAG;AAC3C,OAAK,UAAU;AACf,OAAK,UAAU;;;;;;CAOjB,MAAM,kBAAiC;AACrC,MAAI,KAAK,kBAAmB;AAE5B,MAAI,KAAK,WAAW,KAAK,8BAA8B,CACrD;AAGF,MAAI,KAAK,WAAW,KAAK,SAAS;AAChC,OAAI,KAAK,EAAE,MAAM,KAAK,mBAAmB,EAAE,6CAA6C;AACxF,SAAM,KAAK,8BAA8B;;EAG3C,MAAM,UAAU,KAAK,QAAQ,cAAc,IAAI;GAAE,MAAM;GAAkB,UAAU;GAAO;AAE1F,UAAQ,QAAQ,MAAhB;GACE,KAAK;AACH,UAAM,KAAK,eAAe,QAAQ,OAAO,WAAW;AACpD;GACF,KAAK;AACH,UAAM,KAAK,iBAAiB,QAAQ,OAAO;AAC3C;GACF,KAAK;AACH,UAAM,KAAK,qBAAqB,QAAQ,OAAO;AAC/C;GACF,KAAK;AACH,UAAM,KAAK,wBAAwB,QAAQ,OAAO;AAClD;GAEF;AACE,UAAM,KAAK,aAAa,QAAQ,SAAS,UAAU,QAAQ,WAAW,KAAK,QAAQ,aAAa,KAAK,KAAK;AAC1G;;AAGJ,OAAK,oBAAoB,QAAQ;AACjC,MAAI,KAAK,QACP,MAAK,sBAAsB,KAAK,QAAQ;;;CAK5C,MAAM,gBAAyC;AAC7C,QAAM,KAAK,iBAAiB;AAC5B,MAAI,CAAC,KAAK,QACR,OAAM,IAAI,MAAM,kGAAkG;AAEpH,SAAO,KAAK;;CAGd,MAAc,aAAa,UAAkC;EAC3D,MAAM,KAAK,MAAM,0BAA0B;EAC3C,MAAM,WAAW,GAAG,YAAa,GAA4D,SAAS;AACtG,MAAI,CAAC,UAAU,OACb,OAAM,IAAI,MACR,0IACD;AAEH,OAAK,UAAU,MAAM,SAAS,OAAO;GACnC;GACA,GAAI,WAAW,EAAE,SAAS,YAAY,GAAG,EAAE;GAC3C,MAAM,CAAC,gBAAgB,2BAA2B;GACnD,CAAC;AACF,OAAK,UAAU,MAAM,KAAK,QAAQ,WAAW;GAC3C,UAAU;IAAE,OAAO;IAAM,QAAQ;IAAK;GACtC,WACE;GACH,CAAC;AACF,MAAI,KAAK;GAAE;GAAU,MAAM;GAAS,EAAE,2BAA2B;;CAGnE,MAAc,eAAe,YAAmC;EAC9D,MAAM,KAAK,MAAM,0BAA0B;EAC3C,MAAM,WAAW,GAAG,YAAa,GAA4D,SAAS;AACtG,MAAI,CAAC,UAAU,eACb,OAAM,IAAI,MAAM,kDAAkD;AAEpE,OAAK,UAAU,MAAM,SAAS,eAAe,WAAW;EACxD,MAAM,WAAW,KAAK,QAAQ,UAAU;AACxC,OAAK,UAAU,SAAS,SAAS,IAAI,SAAS,KAAK,MAAM,KAAK,QAAQ,YAAY;AAClF,MAAI,KAAK;GAAE,MAAM;GAAO;GAAY,EAAE,0BAA0B;;CAGlE,MAAc,iBAAiB,QAAmD;EAChF,MAAM,EAAE,wBAAwB,MAAM,OAAO;EAC7C,MAAM,EAAE,uBAAuB,MAAM,OAAO;EAE5C,MAAM,WAAW,OAAO,SAAS,gBAC7B,IAAI,oBAAoB,OAAO,GAC/B,IAAI,mBAAmB,OAAO;EAElC,MAAM,EAAE,SAAS,YAAY,MAAM,SAAS,SAAS;AACrD,OAAK,UAAU;AACf,OAAK,UAAU;AACf,OAAK,gBAAgB;AACrB,MAAI,KAAK;GAAE,MAAM;GAAS,UAAU,OAAO;GAAM,EAAE,sBAAsB,OAAO,KAAK,GAAG;;CAG1F,MAAc,qBAAqB,QAAmD;EACpF,MAAM,EAAE,kCAAkC,MAAM,OAAO;EACvD,MAAM,EAAE,UAAU,YAAY,MAAM,8BAA8B,OAAO;AACzE,OAAK,oBAAoB;AACzB,OAAK,mBAAmB;AACxB,MAAI,KAAK,EAAE,MAAM,QAAQ,QAAQ,OAAO,EAAE,6DAA6D;AACvG,QAAM,SAAS,mBAAmB;AAGlC,MAAI,KAAK,EAAE,MAAM,aAAa,EAAE,uCAAuC;;CAGzE,MAAc,wBAAwB,QAA2E;EAC/G,MAAM,EAAE,uBAAuB,MAAM,OAAO;EAC5C,MAAM,SAAS,MAAM,mBAAmB,OAAO;AAC/C,MAAI,CAAC,OAAO,WAAW,CAAC,OAAO,QAC7B,OAAM,IAAI,MAAM,6EAA6E;AAE/F,OAAK,UAAU,OAAO;AACtB,OAAK,UAAU,OAAO;AACtB,OAAK,oBAAoB,OAAO;AAChC,OAAK,sBAAsB,OAAO;AAClC,MAAI,KAAK,EAAE,MAAM,gBAAgB,EAAE,mCAAmC;;CAGxE,MAAM,QAAQ,QAA+B;AAC3C,MAAI,KAAK,kBACP,OAAM,IAAI,MAAM,sEAAsE;AAGxF,OAAK,gBAAgB;AACrB,QAAM,KAAK,iBAAiB;EAE5B,MAAM,WAAW,KAAK,MAAM,IAAI,OAAO;AACvC,MAAI,YAAY,CAAC,SAAS,KAAK,UAAU,EAAE;AACzC,YAAS,WAAW,KAAK,KAAK;AAC9B,UAAO,SAAS;;AAElB,MAAI,SACF,MAAK,MAAM,OAAO,OAAO;AAG3B,MAAI,KAAK,MAAM,QAAQ,WAAW;GAChC,MAAM,SAAS,CAAC,GAAG,KAAK,MAAM,SAAS,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,WAAW,EAAE,GAAG,SAAS,CAAC;AACvF,OAAI,QAAQ;AACV,UAAM,OAAO,GAAG,KAAK,OAAO,CAAC,YAAY,GAAG;AAC5C,SAAK,MAAM,OAAO,OAAO,GAAG;;;EAIhC,MAAM,MAAM,KAAK;AACjB,MAAI,CAAC,IACH,OAAM,IAAI,MAAM,mEAAmE;EAErF,MAAM,OAAO,MAAM,IAAI,SAAS;AAChC,OAAK,MAAM,IAAI,QAAQ;GAAE;GAAM,UAAU,KAAK,KAAK;GAAE,CAAC;AACtD,SAAO;;CAGT,MAAM,UAAU,QAA+B;AAC7C,MAAI,KAAK,kBACP;EAEF,MAAM,QAAQ,KAAK,MAAM,IAAI,OAAO;AACpC,MAAI,OAAO;AACT,SAAM,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG;AACxC,QAAK,MAAM,OAAO,OAAO;;;;CAK7B,uBAAwD;AACtD,SAAO,KAAK;;CAGd,MAAM,WAA0B;AAC9B,OAAK,MAAM,GAAG,UAAU,KAAK,MAC3B,OAAM,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG;AAE1C,OAAK,MAAM,OAAO;AAElB,MAAI,KAAK,eAAe;AACtB,SAAM,KAAK,cAAc,YAAY,CAAC,YAAY,GAAG;AACrD,QAAK,gBAAgB;;AAGvB,MAAI,KAAK,kBAAkB;AACzB,SAAM,KAAK,kBAAkB,CAAC,YAAY,GAAG;AAC7C,QAAK,mBAAmB;;AAE1B,OAAK,oBAAoB;AAGzB,MAAI,KAAK,qBAAqB,KAAK,qBAAqB;GACtD,MAAM,EAAE,wBAAwB,MAAM,OAAO;AAC7C,SAAM,oBAAoB,KAAK,mBAAmB,KAAK,oBAAoB,CAAC,YAAY,GAAG;AAC3F,QAAK,oBAAoB;AACzB,QAAK,sBAAsB;;AAG7B,QAAM,KAAK,SAAS,OAAO,CAAC,YAAY,GAAG;AAC3C,QAAM,KAAK,SAAS,OAAO,CAAC,YAAY,GAAG;AAC3C,OAAK,UAAU;AACf,OAAK,UAAU;AACf,OAAK,oBAAoB;AACzB,MAAI,KAAK,oBAAoB"}
+{"version":3,"file":"manager.js","names":[],"sources":["../../../src/browser/manager.ts"],"sourcesContent":["import type { Browser, BrowserContext, Page } from 'playwright-core';\n\nimport { createLogger } from '../utils/logger.js';\n\nimport { loadPlaywrightCoreModule } from './providers/playwright-doctor.js';\nimport type { BrowserBackend, CloudBrowserProvider, CloudBrowserProviderConfig, ExtensionConnectionConfig } from './providers/types.js';\nimport type { ExtensionBrowserProvider } from './providers/extension.js';\n\nconst log = createLogger('browser-manager');\n\nconst MAX_PAGES = 3;\nconst PAGE_IDLE_TIMEOUT_MS = 5 * 60 * 1000;\n\nexport interface BrowserManagerOptions {\n  getHeadless: () => boolean;\n  /** Backend connection mode. Default: local Playwright. */\n  getBackend?: () => BrowserBackend;\n}\n\n/**\n * Multi-backend browser manager — supports local Playwright, direct CDP, and cloud providers.\n *\n * One browser context shared by all sessions; one {@link Page} per task/session key (max {@link MAX_PAGES}).\n * Backend is selected at first connection based on {@link BrowserManagerOptions.getBackend}.\n */\nexport class BrowserManager {\n  private browser: Browser | null = null;\n  private context: BrowserContext | null = null;\n  private cloudProvider: CloudBrowserProvider | null = null;\n  private extensionProvider: ExtensionBrowserProvider | null = null;\n  private extensionRelease: (() => Promise<void>) | null = null;\n  private cloakChildProcess: import('node:child_process').ChildProcess | null = null;\n  private cloakTempProfileDir: string | null = null;\n  private pages = new Map<string, { page: Page; lastUsed: number }>();\n  private readonly options: BrowserManagerOptions;\n  private activeBackendMode: BrowserBackend['mode'] | null = null;\n\n  constructor(options: BrowserManagerOptions) {\n    this.options = options;\n  }\n\n  /** Current backend mode (null if not yet connected). */\n  get backendMode(): string | null {\n    return this.activeBackendMode;\n  }\n\n  private evictIdlePages(): void {\n    const now = Date.now();\n    for (const [id, entry] of this.pages) {\n      if (entry.page.isClosed() || now - entry.lastUsed > PAGE_IDLE_TIMEOUT_MS) {\n        void entry.page.close().catch(() => {});\n        this.pages.delete(id);\n        log.debug({ taskId: id }, 'Evicted idle or closed browser page');\n      }\n    }\n  }\n\n  private _isPlaywrightConnectionAlive(): boolean {\n    if (!this.browser || !this.context) return false;\n    try {\n      if (typeof this.browser.isConnected === 'function' && !this.browser.isConnected()) {\n        return false;\n      }\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  private _wireBrowserLifecycle(browser: Browser): void {\n    browser.on('disconnected', () => {\n      log.warn({ mode: this.activeBackendMode }, 'Browser disconnected — clearing stale session');\n      this._clearPlaywrightSessionRefs();\n    });\n  }\n\n  /** Drop Playwright handles without tearing down extension bridge. */\n  private _clearPlaywrightSessionRefs(): void {\n    this.pages.clear();\n    this.context = null;\n    this.browser = null;\n    this.cloakChildProcess = null;\n    this.cloakTempProfileDir = null;\n    if (this.cloudProvider) {\n      void this.cloudProvider.disconnect().catch(() => {});\n      this.cloudProvider = null;\n    }\n  }\n\n  private async _resetStalePlaywrightSession(): Promise<void> {\n    for (const [, entry] of this.pages) {\n      await entry.page.close().catch(() => {});\n    }\n    this.pages.clear();\n\n    if (this.cloudProvider) {\n      await this.cloudProvider.disconnect().catch(() => {});\n      this.cloudProvider = null;\n    }\n\n    if (this.cloakChildProcess || this.cloakTempProfileDir) {\n      const { cleanupCloakBrowser } = await import('./providers/cloakbrowser.js');\n      await cleanupCloakBrowser(this.cloakChildProcess, this.cloakTempProfileDir).catch(() => {});\n      this.cloakChildProcess = null;\n      this.cloakTempProfileDir = null;\n    }\n\n    await this.context?.close().catch(() => {});\n    await this.browser?.close().catch(() => {});\n    this.context = null;\n    this.browser = null;\n  }\n\n  /**\n   * Ensure Playwright context or Chrome Extension provider is ready.\n   * Extension mode does not create a Playwright {@link BrowserContext}.\n   */\n  async ensureConnected(): Promise<void> {\n    if (this.extensionProvider) return;\n\n    if (this.context && this._isPlaywrightConnectionAlive()) {\n      return;\n    }\n\n    if (this.context || this.browser) {\n      log.warn({ mode: this.activeBackendMode }, 'Browser session unavailable — reconnecting');\n      await this._resetStalePlaywrightSession();\n    }\n\n    const backend = this.options.getBackend?.() ?? { mode: 'local' as const, headless: false };\n\n    switch (backend.mode) {\n      case 'cdp':\n        await this._connectViaCdp(backend.config.wsEndpoint);\n        break;\n      case 'cloud':\n        await this._connectViaCloud(backend.config);\n        break;\n      case 'extension':\n        await this._connectViaExtension(backend.config);\n        break;\n      case 'cloakbrowser':\n        await this._connectViaCloakBrowser(backend.config);\n        break;\n      case 'local':\n      default:\n        await this._launchLocal(backend.mode === 'local' ? backend.headless : this.options.getHeadless() === true);\n        break;\n    }\n\n    this.activeBackendMode = backend.mode;\n    if (this.browser) {\n      this._wireBrowserLifecycle(this.browser);\n    }\n  }\n\n  private async _launchLocal(headless: boolean): Promise<void> {\n    const pw = await loadPlaywrightCoreModule();\n    const chromium = pw.chromium ?? (pw as { default?: { chromium?: (typeof pw)['chromium'] } }).default?.chromium;\n    if (!chromium?.launch) {\n      throw new Error(\n        'playwright-core did not expose chromium (try reinstall: pnpm install playwright-core; install browser: npx playwright install chromium)',\n      );\n    }\n    this.browser = await chromium.launch({\n      headless,\n      ...(headless ? { channel: 'chromium' } : {}),\n      args: ['--no-sandbox', '--disable-setuid-sandbox'],\n    });\n    this.context = await this.browser.newContext({\n      viewport: { width: 1280, height: 720 },\n      userAgent:\n        'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',\n    });\n    log.info({ headless, mode: 'local' }, 'Browser launched (local)');\n  }\n\n  private async _connectViaCdp(wsEndpoint: string): Promise<void> {\n    const pw = await loadPlaywrightCoreModule();\n    const chromium = pw.chromium ?? (pw as { default?: { chromium?: (typeof pw)['chromium'] } }).default?.chromium;\n    if (!chromium?.connectOverCDP) {\n      throw new Error('playwright-core does not support connectOverCDP');\n    }\n    this.browser = await chromium.connectOverCDP(wsEndpoint);\n    const contexts = this.browser.contexts();\n    this.context = contexts.length > 0 ? contexts[0] : await this.browser.newContext();\n    log.info({ mode: 'cdp', wsEndpoint }, 'Browser connected (CDP)');\n  }\n\n  private async _connectViaCloud(config: CloudBrowserProviderConfig): Promise<void> {\n    const { BrowserbaseProvider } = await import('./providers/browserbase.js');\n    const { BrowserUseProvider } = await import('./providers/browser-use.js');\n\n    const provider = config.type === 'browserbase'\n      ? new BrowserbaseProvider(config)\n      : new BrowserUseProvider(config);\n\n    const { browser, context } = await provider.connect();\n    this.browser = browser;\n    this.context = context;\n    this.cloudProvider = provider;\n    log.info({ mode: 'cloud', provider: config.type }, `Browser connected (${config.type})`);\n  }\n\n  private async _connectViaExtension(config?: ExtensionConnectionConfig): Promise<void> {\n    const { acquireExtensionBrowserServer } = await import('./providers/extension-ws-acquire.js');\n    const { provider, release } = await acquireExtensionBrowserServer(config);\n    this.extensionProvider = provider;\n    this.extensionRelease = release;\n    log.info({ port: config?.port ?? 19820 }, 'Extension WS server ready, waiting for Chrome Extension...');\n    await provider.waitForConnection();\n    // Extension mode does not use Playwright — context stays null.\n    // The action registry dispatches directly via extensionProvider.sendCommand().\n    log.info({ mode: 'extension' }, 'Browser connected (Chrome Extension)');\n  }\n\n  private async _connectViaCloakBrowser(config?: import('./providers/types.js').CloakBrowserConfig): Promise<void> {\n    const { launchCloakBrowser } = await import('./providers/cloakbrowser.js');\n    const result = await launchCloakBrowser(config);\n    if (!result.browser || !result.context) {\n      throw new Error('BrowserManager: CloakBrowser launch did not return a Playwright connection');\n    }\n    this.browser = result.browser;\n    this.context = result.context;\n    this.cloakChildProcess = result.childProcess;\n    this.cloakTempProfileDir = result.temporaryProfileDir;\n    log.info({ mode: 'cloakbrowser' }, 'Browser connected (CloakBrowser)');\n  }\n\n  async getPage(taskId: string): Promise<Page> {\n    if (this.extensionProvider) {\n      throw new Error('BrowserManager.getPage is not used in Chrome Extension backend mode');\n    }\n\n    this.evictIdlePages();\n    await this.ensureConnected();\n\n    const existing = this.pages.get(taskId);\n    if (existing && !existing.page.isClosed()) {\n      existing.lastUsed = Date.now();\n      return existing.page;\n    }\n    if (existing) {\n      this.pages.delete(taskId);\n    }\n\n    if (this.pages.size >= MAX_PAGES) {\n      const oldest = [...this.pages.entries()].sort((a, b) => a[1].lastUsed - b[1].lastUsed)[0];\n      if (oldest) {\n        await oldest[1].page.close().catch(() => {});\n        this.pages.delete(oldest[0]);\n      }\n    }\n\n    const ctx = this.context;\n    if (!ctx) {\n      throw new Error('BrowserManager: Playwright context missing after ensureConnected');\n    }\n    const page = await ctx.newPage();\n    this.pages.set(taskId, { page, lastUsed: Date.now() });\n    return page;\n  }\n\n  async closePage(taskId: string): Promise<void> {\n    if (this.extensionProvider) {\n      return;\n    }\n    const entry = this.pages.get(taskId);\n    if (entry) {\n      await entry.page.close().catch(() => {});\n      this.pages.delete(taskId);\n    }\n  }\n\n  /** Get the extension provider (only available in extension mode). */\n  getExtensionProvider(): ExtensionBrowserProvider | null {\n    return this.extensionProvider;\n  }\n\n  async shutdown(): Promise<void> {\n    for (const [, entry] of this.pages) {\n      await entry.page.close().catch(() => {});\n    }\n    this.pages.clear();\n\n    if (this.cloudProvider) {\n      await this.cloudProvider.disconnect().catch(() => {});\n      this.cloudProvider = null;\n    }\n\n    if (this.extensionRelease) {\n      await this.extensionRelease().catch(() => {});\n      this.extensionRelease = null;\n    }\n    this.extensionProvider = null;\n\n    // CloakBrowser cleanup — kill child process and remove temp profile\n    if (this.cloakChildProcess || this.cloakTempProfileDir) {\n      const { cleanupCloakBrowser } = await import('./providers/cloakbrowser.js');\n      await cleanupCloakBrowser(this.cloakChildProcess, this.cloakTempProfileDir).catch(() => {});\n      this.cloakChildProcess = null;\n      this.cloakTempProfileDir = null;\n    }\n\n    await this.context?.close().catch(() => {});\n    await this.browser?.close().catch(() => {});\n    this.context = null;\n    this.browser = null;\n    this.activeBackendMode = null;\n    log.info('Browser shut down');\n  }\n}\n"],"mappings":";;;;aAEkD;AAMlD,MAAM,MAAM,aAAa,kBAAkB;AAE3C,MAAM,YAAY;AAClB,MAAM,uBAAuB,MAAS;;;;;;;AActC,IAAa,iBAAb,MAA4B;CAC1B,UAAkC;CAClC,UAAyC;CACzC,gBAAqD;CACrD,oBAA6D;CAC7D,mBAAyD;CACzD,oBAA8E;CAC9E,sBAA6C;CAC7C,wBAAgB,IAAI,KAA+C;CACnE;CACA,oBAA2D;CAE3D,YAAY,SAAgC;AAC1C,OAAK,UAAU;;;CAIjB,IAAI,cAA6B;AAC/B,SAAO,KAAK;;CAGd,iBAA+B;EAC7B,MAAM,MAAM,KAAK,KAAK;AACtB,OAAK,MAAM,CAAC,IAAI,UAAU,KAAK,MAC7B,KAAI,MAAM,KAAK,UAAU,IAAI,MAAM,MAAM,WAAW,sBAAsB;AACnE,SAAM,KAAK,OAAO,CAAC,YAAY,GAAG;AACvC,QAAK,MAAM,OAAO,GAAG;AACrB,OAAI,MAAM,EAAE,QAAQ,IAAI,EAAE,sCAAsC;;;CAKtE,+BAAgD;AAC9C,MAAI,CAAC,KAAK,WAAW,CAAC,KAAK,QAAS,QAAO;AAC3C,MAAI;AACF,OAAI,OAAO,KAAK,QAAQ,gBAAgB,cAAc,CAAC,KAAK,QAAQ,aAAa,CAC/E,QAAO;AAET,UAAO;UACD;AACN,UAAO;;;CAIX,sBAA8B,SAAwB;AACpD,UAAQ,GAAG,sBAAsB;AAC/B,OAAI,KAAK,EAAE,MAAM,KAAK,mBAAmB,EAAE,gDAAgD;AAC3F,QAAK,6BAA6B;IAClC;;;CAIJ,8BAA4C;AAC1C,OAAK,MAAM,OAAO;AAClB,OAAK,UAAU;AACf,OAAK,UAAU;AACf,OAAK,oBAAoB;AACzB,OAAK,sBAAsB;AAC3B,MAAI,KAAK,eAAe;AACjB,QAAK,cAAc,YAAY,CAAC,YAAY,GAAG;AACpD,QAAK,gBAAgB;;;CAIzB,MAAc,+BAA8C;AAC1D,OAAK,MAAM,GAAG,UAAU,KAAK,MAC3B,OAAM,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG;AAE1C,OAAK,MAAM,OAAO;AAElB,MAAI,KAAK,eAAe;AACtB,SAAM,KAAK,cAAc,YAAY,CAAC,YAAY,GAAG;AACrD,QAAK,gBAAgB;;AAGvB,MAAI,KAAK,qBAAqB,KAAK,qBAAqB;GACtD,MAAM,EAAE,wBAAwB,MAAM,OAAO;AAC7C,SAAM,oBAAoB,KAAK,mBAAmB,KAAK,oBAAoB,CAAC,YAAY,GAAG;AAC3F,QAAK,oBAAoB;AACzB,QAAK,sBAAsB;;AAG7B,QAAM,KAAK,SAAS,OAAO,CAAC,YAAY,GAAG;AAC3C,QAAM,KAAK,SAAS,OAAO,CAAC,YAAY,GAAG;AAC3C,OAAK,UAAU;AACf,OAAK,UAAU;;;;;;CAOjB,MAAM,kBAAiC;AACrC,MAAI,KAAK,kBAAmB;AAE5B,MAAI,KAAK,WAAW,KAAK,8BAA8B,CACrD;AAGF,MAAI,KAAK,WAAW,KAAK,SAAS;AAChC,OAAI,KAAK,EAAE,MAAM,KAAK,mBAAmB,EAAE,6CAA6C;AACxF,SAAM,KAAK,8BAA8B;;EAG3C,MAAM,UAAU,KAAK,QAAQ,cAAc,IAAI;GAAE,MAAM;GAAkB,UAAU;GAAO;AAE1F,UAAQ,QAAQ,MAAhB;GACE,KAAK;AACH,UAAM,KAAK,eAAe,QAAQ,OAAO,WAAW;AACpD;GACF,KAAK;AACH,UAAM,KAAK,iBAAiB,QAAQ,OAAO;AAC3C;GACF,KAAK;AACH,UAAM,KAAK,qBAAqB,QAAQ,OAAO;AAC/C;GACF,KAAK;AACH,UAAM,KAAK,wBAAwB,QAAQ,OAAO;AAClD;GAEF;AACE,UAAM,KAAK,aAAa,QAAQ,SAAS,UAAU,QAAQ,WAAW,KAAK,QAAQ,aAAa,KAAK,KAAK;AAC1G;;AAGJ,OAAK,oBAAoB,QAAQ;AACjC,MAAI,KAAK,QACP,MAAK,sBAAsB,KAAK,QAAQ;;CAI5C,MAAc,aAAa,UAAkC;EAC3D,MAAM,KAAK,MAAM,0BAA0B;EAC3C,MAAM,WAAW,GAAG,YAAa,GAA4D,SAAS;AACtG,MAAI,CAAC,UAAU,OACb,OAAM,IAAI,MACR,0IACD;AAEH,OAAK,UAAU,MAAM,SAAS,OAAO;GACnC;GACA,GAAI,WAAW,EAAE,SAAS,YAAY,GAAG,EAAE;GAC3C,MAAM,CAAC,gBAAgB,2BAA2B;GACnD,CAAC;AACF,OAAK,UAAU,MAAM,KAAK,QAAQ,WAAW;GAC3C,UAAU;IAAE,OAAO;IAAM,QAAQ;IAAK;GACtC,WACE;GACH,CAAC;AACF,MAAI,KAAK;GAAE;GAAU,MAAM;GAAS,EAAE,2BAA2B;;CAGnE,MAAc,eAAe,YAAmC;EAC9D,MAAM,KAAK,MAAM,0BAA0B;EAC3C,MAAM,WAAW,GAAG,YAAa,GAA4D,SAAS;AACtG,MAAI,CAAC,UAAU,eACb,OAAM,IAAI,MAAM,kDAAkD;AAEpE,OAAK,UAAU,MAAM,SAAS,eAAe,WAAW;EACxD,MAAM,WAAW,KAAK,QAAQ,UAAU;AACxC,OAAK,UAAU,SAAS,SAAS,IAAI,SAAS,KAAK,MAAM,KAAK,QAAQ,YAAY;AAClF,MAAI,KAAK;GAAE,MAAM;GAAO;GAAY,EAAE,0BAA0B;;CAGlE,MAAc,iBAAiB,QAAmD;EAChF,MAAM,EAAE,wBAAwB,MAAM,OAAO;EAC7C,MAAM,EAAE,uBAAuB,MAAM,OAAO;EAE5C,MAAM,WAAW,OAAO,SAAS,gBAC7B,IAAI,oBAAoB,OAAO,GAC/B,IAAI,mBAAmB,OAAO;EAElC,MAAM,EAAE,SAAS,YAAY,MAAM,SAAS,SAAS;AACrD,OAAK,UAAU;AACf,OAAK,UAAU;AACf,OAAK,gBAAgB;AACrB,MAAI,KAAK;GAAE,MAAM;GAAS,UAAU,OAAO;GAAM,EAAE,sBAAsB,OAAO,KAAK,GAAG;;CAG1F,MAAc,qBAAqB,QAAmD;EACpF,MAAM,EAAE,kCAAkC,MAAM,OAAO;EACvD,MAAM,EAAE,UAAU,YAAY,MAAM,8BAA8B,OAAO;AACzE,OAAK,oBAAoB;AACzB,OAAK,mBAAmB;AACxB,MAAI,KAAK,EAAE,MAAM,QAAQ,QAAQ,OAAO,EAAE,6DAA6D;AACvG,QAAM,SAAS,mBAAmB;AAGlC,MAAI,KAAK,EAAE,MAAM,aAAa,EAAE,uCAAuC;;CAGzE,MAAc,wBAAwB,QAA2E;EAC/G,MAAM,EAAE,uBAAuB,MAAM,OAAO;EAC5C,MAAM,SAAS,MAAM,mBAAmB,OAAO;AAC/C,MAAI,CAAC,OAAO,WAAW,CAAC,OAAO,QAC7B,OAAM,IAAI,MAAM,6EAA6E;AAE/F,OAAK,UAAU,OAAO;AACtB,OAAK,UAAU,OAAO;AACtB,OAAK,oBAAoB,OAAO;AAChC,OAAK,sBAAsB,OAAO;AAClC,MAAI,KAAK,EAAE,MAAM,gBAAgB,EAAE,mCAAmC;;CAGxE,MAAM,QAAQ,QAA+B;AAC3C,MAAI,KAAK,kBACP,OAAM,IAAI,MAAM,sEAAsE;AAGxF,OAAK,gBAAgB;AACrB,QAAM,KAAK,iBAAiB;EAE5B,MAAM,WAAW,KAAK,MAAM,IAAI,OAAO;AACvC,MAAI,YAAY,CAAC,SAAS,KAAK,UAAU,EAAE;AACzC,YAAS,WAAW,KAAK,KAAK;AAC9B,UAAO,SAAS;;AAElB,MAAI,SACF,MAAK,MAAM,OAAO,OAAO;AAG3B,MAAI,KAAK,MAAM,QAAQ,WAAW;GAChC,MAAM,SAAS,CAAC,GAAG,KAAK,MAAM,SAAS,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,GAAG,WAAW,EAAE,GAAG,SAAS,CAAC;AACvF,OAAI,QAAQ;AACV,UAAM,OAAO,GAAG,KAAK,OAAO,CAAC,YAAY,GAAG;AAC5C,SAAK,MAAM,OAAO,OAAO,GAAG;;;EAIhC,MAAM,MAAM,KAAK;AACjB,MAAI,CAAC,IACH,OAAM,IAAI,MAAM,mEAAmE;EAErF,MAAM,OAAO,MAAM,IAAI,SAAS;AAChC,OAAK,MAAM,IAAI,QAAQ;GAAE;GAAM,UAAU,KAAK,KAAK;GAAE,CAAC;AACtD,SAAO;;CAGT,MAAM,UAAU,QAA+B;AAC7C,MAAI,KAAK,kBACP;EAEF,MAAM,QAAQ,KAAK,MAAM,IAAI,OAAO;AACpC,MAAI,OAAO;AACT,SAAM,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG;AACxC,QAAK,MAAM,OAAO,OAAO;;;;CAK7B,uBAAwD;AACtD,SAAO,KAAK;;CAGd,MAAM,WAA0B;AAC9B,OAAK,MAAM,GAAG,UAAU,KAAK,MAC3B,OAAM,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG;AAE1C,OAAK,MAAM,OAAO;AAElB,MAAI,KAAK,eAAe;AACtB,SAAM,KAAK,cAAc,YAAY,CAAC,YAAY,GAAG;AACrD,QAAK,gBAAgB;;AAGvB,MAAI,KAAK,kBAAkB;AACzB,SAAM,KAAK,kBAAkB,CAAC,YAAY,GAAG;AAC7C,QAAK,mBAAmB;;AAE1B,OAAK,oBAAoB;AAGzB,MAAI,KAAK,qBAAqB,KAAK,qBAAqB;GACtD,MAAM,EAAE,wBAAwB,MAAM,OAAO;AAC7C,SAAM,oBAAoB,KAAK,mBAAmB,KAAK,oBAAoB,CAAC,YAAY,GAAG;AAC3F,QAAK,oBAAoB;AACzB,QAAK,sBAAsB;;AAG7B,QAAM,KAAK,SAAS,OAAO,CAAC,YAAY,GAAG;AAC3C,QAAM,KAAK,SAAS,OAAO,CAAC,YAAY,GAAG;AAC3C,OAAK,UAAU;AACf,OAAK,UAAU;AACf,OAAK,oBAAoB;AACzB,MAAI,KAAK,oBAAoB"}

package/dist/src/browser/providers/browser-ext-install.d.ts

@@ -1,6 +1,6 @@
 /**
- * Install bundled Chrome extension artifacts into {resolveBinDir()}/browser-ext/{version}/.
- * Single version directory per install — direct overwrite, no `current` symlink.
+ * Install bundled Chrome extension artifacts into {resolveBinDir()}/browser-ext/.
+ * Fixed path — gateway upgrades overwrite in place so Chrome sideload paths stay stable.
  */
 export declare const BROWSER_EXT_REQUIRED_FILES: readonly ["manifest.json", "popup.html", "dist/background.js", "dist/content.js", "dist/popup.js"];
 export type BrowserExtBundledFrom = 'npm-dist' | 'git-dev' | 'electron-asar' | 'env-override';
@@ -32,8 +32,8 @@ export interface EnsureBrowserExtResult {
 }
 /** Validate a directory contains a loadable extension tree. */
 export declare function validateBrowserExtLayout(dir: string): boolean;
-/** Resolve the installed extension directory (version folder, not a symlink). */
-export declare function resolveInstalledExtensionPath(cacheDir: string, meta: BrowserExtInstallMeta | null): string | null;
+/** Resolve the installed extension directory (fixed `browser-ext/` root). */
+export declare function resolveInstalledExtensionPath(cacheDir: string, _meta: BrowserExtInstallMeta | null): string | null;
 /**
  * Resolve the bundled extension source directory (read-only).
  */