agim-cli 1.2.67 → 1.2.69

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agim-cli",
-  "version": "1.2.67",
+  "version": "1.2.69",
   "description": "Agim (阿吉姆) — universal messenger-to-agent bridge. Connect WeChat / Feishu / DingTalk / Email to Claude Code / Codex / OpenCode, or any custom agent via ACP. Installs the `agim` command.",
   "type": "module",
   "bin": {

package/dist/web/public/assets/security-Cv5Tjnb3.js

@@ -1,7 +0,0 @@
-import{y as I,ad as T,U as e,c as M,I as u,S as h,l as g,m as j,j as _,k as d,r as w,a3 as p,E as y,p as B,s as U,B as S}from"./index-Dm4bHM0M.js";import{e as v}from"./react-C9F3QeMB.js";import{d as C,n as O}from"./use-settings-Dvc5WX17.js";import{L as V}from"./loader-circle-C8YCUz70.js";import{R as H}from"./refresh-ccw-BVkrjmyW.js";import{C as L}from"./circle-check-Bx222bW4.js";import"./useQuery-CwP843k0.js";/**
- * @license lucide-react v0.469.0 - ISC
- *
- * This source code is licensed under the ISC license.
- * See the LICENSE file in the root directory of this source tree.
- */const R=I("ShieldAlert",[["path",{d:"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z",key:"oel41y"}],["path",{d:"M12 8v4",key:"1got3b"}],["path",{d:"M12 16h.01",key:"1drbdi"}]]);function F(s){if(s==null)return!1;const a=s.toLowerCase();return a==="1"||a==="true"||a==="yes"||a==="on"}function K(){const{t:s}=T(["settings","common"]),a=C(),o=O(),[l,N]=v.useState(null),[b,E]=v.useState(!1);async function f(){E(!0);try{const t=await w.get("/api/security/diagnostics");N(t.diagnostics)}catch(t){p.error(y(t,s).message)}finally{E(!1)}}v.useEffect(()=>{f()},[]);async function r(t,i){try{await o.mutateAsync({updates:{[t]:i}}),p.success(s("security.savingToast")),await f()}catch(A){p.error(y(A,s).message)}}const n=a.data?.env??{};return e.jsxs("div",{className:"mx-auto flex max-w-4xl flex-col gap-4",children:[e.jsxs("header",{className:"flex flex-col gap-1",children:[e.jsxs("div",{className:"flex flex-wrap items-center gap-3",children:[e.jsx("h1",{className:"text-xl font-semibold",children:s("security.title")}),e.jsx(M,{variant:"ghost",size:"sm",className:"ml-auto",onClick:()=>{a.refetch(),f()},disabled:a.isFetching||b,"aria-label":s("actions.refresh",{ns:"common"}),children:a.isFetching||b?e.jsx(V,{className:"h-4 w-4 animate-spin"}):e.jsx(H,{className:"h-4 w-4"})})]}),e.jsx("p",{className:"text-sm text-muted",children:s("security.subtitle")})]}),e.jsxs("section",{className:"rounded-lg border border-border bg-card p-4",children:[e.jsxs("h2",{className:"mb-3 flex items-center gap-2 text-sm font-semibold",children:[e.jsx(R,{className:"h-4 w-4"}),s("security.diagnostics.title")]}),l?e.jsxs("ul",{className:"grid gap-2 text-sm sm:grid-cols-2",children:[e.jsx(x,{label:s("security.diagnostics.runningAsRoot"),ok:l.runningAsRoot===!1,text:l.runningAsRoot===!0?s("security.diagnostics.runningAsRootHelp"):"OK"}),e.jsx(x,{label:s("security.diagnostics.envFilePerms"),ok:l.envFile.exists&&!l.envFile.tooPermissive,text:l.envFile.exists?l.envFile.tooPermissive?`${l.envFile.mode} — ${s("security.diagnostics.envFilePermsLax")}`:s("security.diagnostics.envFilePermsOk"):"—"}),e.jsx(x,{label:s("security.diagnostics.bwrapAvailable"),ok:l.bwrapAvailable,text:l.bwrapAvailable?"/usr/bin/bwrap":s("security.diagnostics.bwrapMissing")}),e.jsx(x,{label:s("security.diagnostics.senderAllowlist"),ok:l.senderAllowlistConfigured,text:l.senderAllowlistConfigured?s("security.diagnostics.senderAllowlistOn"):s("security.diagnostics.senderAllowlistOff")}),e.jsx(x,{label:s("security.diagnostics.adminAllowlist"),ok:l.adminAllowlistConfigured,text:l.adminAllowlistConfigured?s("security.diagnostics.adminAllowlistOn"):s("security.diagnostics.adminAllowlistOff")})]}):e.jsx("p",{className:"text-sm text-muted",children:"…"})]}),e.jsx(m,{title:s("security.sender.title"),description:s("security.sender.description"),envKey:"IMHUB_ALLOWED_USERS",children:e.jsx(u,{defaultValue:n.IMHUB_ALLOWED_USERS??"",placeholder:s("security.sender.placeholder"),onBlur:t=>{const i=t.target.value.trim();r("IMHUB_ALLOWED_USERS",i===""?null:i)}})}),e.jsx(m,{title:s("security.exec.title"),description:s("security.exec.description"),children:e.jsxs("div",{className:"grid gap-3 sm:grid-cols-2",children:[e.jsx(c,{label:s("security.exec.sandbox"),children:e.jsxs(h,{value:(n.IMHUB_EXEC_SANDBOX??"").toLowerCase(),onValueChange:t=>void r("IMHUB_EXEC_SANDBOX",t===""?null:t),children:[e.jsx(g,{children:e.jsx(j,{placeholder:"—"})}),e.jsxs(_,{children:[e.jsx(d,{value:"",children:s("security.exec.sandboxNone")}),e.jsxs(d,{value:"bwrap",disabled:!l?.bwrapAvailable,children:[s("security.exec.sandboxBwrap"),!l?.bwrapAvailable&&e.jsxs("span",{className:"ml-2 text-xs text-muted",children:["(",s("security.exec.sandboxBwrapMissing"),")"]})]})]})]})}),e.jsx(c,{label:s("security.exec.sandboxNet"),children:e.jsxs(h,{value:(n.IMHUB_EXEC_SANDBOX_NET??"").toLowerCase()==="off"?"off":"on",onValueChange:t=>void r("IMHUB_EXEC_SANDBOX_NET",t==="off"?"off":null),children:[e.jsx(g,{children:e.jsx(j,{})}),e.jsxs(_,{children:[e.jsx(d,{value:"on",children:s("security.exec.sandboxNetOn")}),e.jsx(d,{value:"off",children:s("security.exec.sandboxNetOff")})]})]})}),e.jsx(c,{label:s("security.exec.timeoutMs"),children:e.jsx(u,{type:"number",defaultValue:n.IMHUB_EXEC_TIMEOUT_MS??"",placeholder:"60000",onBlur:t=>{const i=t.target.value.trim();r("IMHUB_EXEC_TIMEOUT_MS",i===""?null:i)}})}),e.jsx(c,{label:s("security.exec.maxOutput"),children:e.jsx(u,{type:"number",defaultValue:n.IMHUB_EXEC_MAX_OUTPUT??"",placeholder:"32768",onBlur:t=>{const i=t.target.value.trim();r("IMHUB_EXEC_MAX_OUTPUT",i===""?null:i)}})})]})}),e.jsx(m,{title:s("security.web.title"),description:s("security.web.description"),children:e.jsxs("div",{className:"grid gap-3 sm:grid-cols-2",children:[e.jsx(c,{label:s("security.web.allowPrivate"),hint:s("security.web.allowPrivateHelp"),children:e.jsxs(h,{value:F(n.IMHUB_NATIVE_WEB_ALLOW_PRIVATE)?"1":"0",onValueChange:t=>void r("IMHUB_NATIVE_WEB_ALLOW_PRIVATE",t==="1"?"1":null),children:[e.jsx(g,{children:e.jsx(j,{})}),e.jsxs(_,{children:[e.jsx(d,{value:"0",children:"OFF"}),e.jsx(d,{value:"1",children:"ON"})]})]})}),e.jsx(c,{label:s("security.web.timeoutMs"),children:e.jsx(u,{type:"number",defaultValue:n.IMHUB_NATIVE_WEB_TIMEOUT_MS??"",placeholder:"30000",onBlur:t=>{const i=t.target.value.trim();r("IMHUB_NATIVE_WEB_TIMEOUT_MS",i===""?null:i)}})}),e.jsx("div",{className:"sm:col-span-2",children:e.jsx(c,{label:s("security.web.ssrfWhitelist"),children:e.jsx(u,{defaultValue:n.IMHUB_NATIVE_WEB_SSRF_WHITELIST??"",placeholder:s("security.web.ssrfWhitelistPlaceholder"),onBlur:t=>{const i=t.target.value.trim();r("IMHUB_NATIVE_WEB_SSRF_WHITELIST",i===""?null:i)}})})})]})}),e.jsx(m,{title:s("security.fs.title"),description:s("security.fs.description"),children:e.jsxs("div",{className:"grid gap-3 sm:grid-cols-2",children:[e.jsx(c,{label:s("security.fs.restrict"),children:e.jsxs(h,{value:(n.IMHUB_NATIVE_FS_RESTRICT??"1")==="0"?"0":"1",onValueChange:t=>void r("IMHUB_NATIVE_FS_RESTRICT",t==="0"?"0":null),children:[e.jsx(g,{children:e.jsx(j,{})}),e.jsxs(_,{children:[e.jsx(d,{value:"1",children:s("security.fs.restrictOn")}),e.jsx(d,{value:"0",children:s("security.fs.restrictOff")})]})]})}),e.jsx(c,{label:s("security.fs.timeoutMs"),children:e.jsx(u,{type:"number",defaultValue:n.IMHUB_NATIVE_FS_TIMEOUT_MS??"",placeholder:"60000",onBlur:t=>{const i=t.target.value.trim();r("IMHUB_NATIVE_FS_TIMEOUT_MS",i===""?null:i)}})})]})}),e.jsx(m,{title:s("security.delegation.title"),description:s("security.delegation.description"),envKey:"IMHUB_NATIVE_CALL_AGENT_MAX_PER_TURN",children:e.jsx(u,{type:"number",defaultValue:n.IMHUB_NATIVE_CALL_AGENT_MAX_PER_TURN??"",placeholder:"2",onBlur:t=>{const i=t.target.value.trim();r("IMHUB_NATIVE_CALL_AGENT_MAX_PER_TURN",i===""?null:i)}})})]})}function x({label:s,ok:a,text:o}){return e.jsxs("li",{className:"flex items-start gap-2",children:[a?e.jsx(L,{className:"mt-0.5 h-4 w-4 shrink-0 text-success"}):e.jsx(B,{className:"mt-0.5 h-4 w-4 shrink-0 text-warning"}),e.jsxs("div",{className:"flex-1",children:[e.jsx("div",{className:"font-medium",children:s}),e.jsx("div",{className:U("text-xs",a?"text-muted":"text-warning"),children:o})]})]})}function m({title:s,description:a,envKey:o,children:l}){return e.jsxs("section",{className:"rounded-lg border border-border bg-card p-4",children:[e.jsxs("div",{className:"mb-2 flex flex-wrap items-baseline gap-2",children:[e.jsx("h2",{className:"text-sm font-semibold",children:s}),o&&e.jsx(S,{variant:"outline",className:"font-mono text-[10px]",children:o})]}),e.jsx("p",{className:"mb-3 text-xs text-muted",children:a}),l]})}function c({label:s,hint:a,children:o}){return e.jsxs("div",{className:"flex flex-col gap-1",children:[e.jsx("label",{className:"text-xs font-medium text-muted",children:s}),o,a&&e.jsx("p",{className:"text-[10px] text-muted",children:a})]})}export{K as default};
-//# sourceMappingURL=security-Cv5Tjnb3.js.map

package/dist/web/public/assets/security-Cv5Tjnb3.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-Cv5Tjnb3.js","sources":["../../node_modules/lucide-react/dist/esm/icons/shield-alert.js","../../src/routes/settings/security.tsx"],"sourcesContent":["/**\n * @license lucide-react v0.469.0 - ISC\n *\n * This source code is licensed under the ISC license.\n * See the LICENSE file in the root directory of this source tree.\n */\n\nimport createLucideIcon from '../createLucideIcon.js';\n\nconst ShieldAlert = createLucideIcon(\"ShieldAlert\", [\n  [\n    \"path\",\n    {\n      d: \"M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z\",\n      key: \"oel41y\"\n    }\n  ],\n  [\"path\", { d: \"M12 8v4\", key: \"1got3b\" }],\n  [\"path\", { d: \"M12 16h.01\", key: \"1drbdi\" }]\n]);\n\nexport { ShieldAlert as default };\n//# sourceMappingURL=shield-alert.js.map\n","/**\n * /settings/security — central console for v1.2.66 security controls.\n *\n * Lays out:\n *   • Diagnostics card (read-only) — uid 0? env file perms? bwrap? allowlists configured?\n *   • Sender allowlist (IMHUB_ALLOWED_USERS)\n *   • Native exec (IMHUB_EXEC_SANDBOX, IMHUB_EXEC_SANDBOX_NET, IMHUB_EXEC_TIMEOUT_MS, IMHUB_EXEC_MAX_OUTPUT)\n *   • Native web (IMHUB_NATIVE_WEB_ALLOW_PRIVATE, IMHUB_NATIVE_WEB_SSRF_WHITELIST, IMHUB_NATIVE_WEB_TIMEOUT_MS)\n *   • Native fs  (IMHUB_NATIVE_FS_RESTRICT, IMHUB_NATIVE_FS_TIMEOUT_MS)\n *   • Delegation (IMHUB_NATIVE_CALL_AGENT_MAX_PER_TURN)\n *\n * All writes go through PUT /api/env (admin-gated). Most knobs are\n * hot-reloaded (read process.env per tool call); the exec sandbox +\n * sender allowlist apply at boot — service restart required.\n */\n\nimport { useEffect, useState } from 'react'\nimport { useTranslation } from 'react-i18next'\nimport { toast } from 'sonner'\nimport { AlertTriangle, CheckCircle2, Loader2, RefreshCcw, ShieldAlert } from 'lucide-react'\n\nimport { Badge } from '@/components/ui/badge'\nimport { Button } from '@/components/ui/button'\nimport { Input } from '@/components/ui/input'\nimport {\n  Select,\n  SelectContent,\n  SelectItem,\n  SelectTrigger,\n  SelectValue,\n} from '@/components/ui/select'\nimport { useEnv, useUpdateEnv } from '@/hooks/use-settings'\nimport { client } from '@/lib/api/client'\nimport { describeError } from '@/lib/api/errors'\nimport { cn } from '@/lib/utils'\n\ninterface Diagnostics {\n  runningAsRoot: boolean | null\n  envFile: { exists: boolean; mode: string | null; tooPermissive: boolean }\n  bwrapAvailable: boolean\n  senderAllowlistConfigured: boolean\n  adminAllowlistConfigured: boolean\n  liveEnv: Record<string, string | null>\n}\n\nfunction envBool(v: string | undefined): boolean {\n  if (v == null) return false\n  const t = v.toLowerCase()\n  return t === '1' || t === 'true' || t === 'yes' || t === 'on'\n}\n\nexport default function SettingsSecurityRoute(): JSX.Element {\n  const { t } = useTranslation(['settings', 'common'])\n  const envQuery = useEnv()\n  const updateEnv = useUpdateEnv()\n  const [diagnostics, setDiagnostics] = useState<Diagnostics | null>(null)\n  const [diagLoading, setDiagLoading] = useState(false)\n\n  async function loadDiagnostics(): Promise<void> {\n    setDiagLoading(true)\n    try {\n      const res = await client.get<{ diagnostics: Diagnostics }>('/api/security/diagnostics')\n      setDiagnostics(res.diagnostics)\n    } catch (err) {\n      toast.error(describeError(err, t).message)\n    } finally {\n      setDiagLoading(false)\n    }\n  }\n\n  useEffect(() => { void loadDiagnostics() }, [])\n\n  async function setValue(key: string, value: string | null): Promise<void> {\n    try {\n      await updateEnv.mutateAsync({ updates: { [key]: value } })\n      toast.success(t('security.savingToast'))\n      await loadDiagnostics()\n    } catch (err) {\n      toast.error(describeError(err, t).message)\n    }\n  }\n\n  const env = envQuery.data?.env ?? {}\n\n  return (\n    <div className=\"mx-auto flex max-w-4xl flex-col gap-4\">\n      <header className=\"flex flex-col gap-1\">\n        <div className=\"flex flex-wrap items-center gap-3\">\n          <h1 className=\"text-xl font-semibold\">{t('security.title')}</h1>\n          <Button\n            variant=\"ghost\"\n            size=\"sm\"\n            className=\"ml-auto\"\n            onClick={() => { void envQuery.refetch(); void loadDiagnostics() }}\n            disabled={envQuery.isFetching || diagLoading}\n            aria-label={t('actions.refresh', { ns: 'common' })}\n          >\n            {envQuery.isFetching || diagLoading\n              ? <Loader2 className=\"h-4 w-4 animate-spin\" />\n              : <RefreshCcw className=\"h-4 w-4\" />\n            }\n          </Button>\n        </div>\n        <p className=\"text-sm text-muted\">{t('security.subtitle')}</p>\n      </header>\n\n      {/* Diagnostics card */}\n      <section className=\"rounded-lg border border-border bg-card p-4\">\n        <h2 className=\"mb-3 flex items-center gap-2 text-sm font-semibold\">\n          <ShieldAlert className=\"h-4 w-4\" />\n          {t('security.diagnostics.title')}\n        </h2>\n        {diagnostics ? (\n          <ul className=\"grid gap-2 text-sm sm:grid-cols-2\">\n            <DiagRow\n              label={t('security.diagnostics.runningAsRoot')}\n              ok={diagnostics.runningAsRoot === false}\n              text={diagnostics.runningAsRoot === true ? t('security.diagnostics.runningAsRootHelp') : 'OK'}\n            />\n            <DiagRow\n              label={t('security.diagnostics.envFilePerms')}\n              ok={diagnostics.envFile.exists && !diagnostics.envFile.tooPermissive}\n              text={\n                !diagnostics.envFile.exists\n                  ? '—'\n                  : diagnostics.envFile.tooPermissive\n                    ? `${diagnostics.envFile.mode} — ${t('security.diagnostics.envFilePermsLax')}`\n                    : t('security.diagnostics.envFilePermsOk')\n              }\n            />\n            <DiagRow\n              label={t('security.diagnostics.bwrapAvailable')}\n              ok={diagnostics.bwrapAvailable}\n              text={diagnostics.bwrapAvailable ? '/usr/bin/bwrap' : t('security.diagnostics.bwrapMissing')}\n            />\n            <DiagRow\n              label={t('security.diagnostics.senderAllowlist')}\n              ok={diagnostics.senderAllowlistConfigured}\n              text={diagnostics.senderAllowlistConfigured\n                ? t('security.diagnostics.senderAllowlistOn')\n                : t('security.diagnostics.senderAllowlistOff')\n              }\n            />\n            <DiagRow\n              label={t('security.diagnostics.adminAllowlist')}\n              ok={diagnostics.adminAllowlistConfigured}\n              text={diagnostics.adminAllowlistConfigured\n                ? t('security.diagnostics.adminAllowlistOn')\n                : t('security.diagnostics.adminAllowlistOff')\n              }\n            />\n          </ul>\n        ) : (\n          <p className=\"text-sm text-muted\">…</p>\n        )}\n      </section>\n\n      {/* Sender allowlist */}\n      <ControlCard\n        title={t('security.sender.title')}\n        description={t('security.sender.description')}\n        envKey=\"IMHUB_ALLOWED_USERS\"\n      >\n        <Input\n          defaultValue={env.IMHUB_ALLOWED_USERS ?? ''}\n          placeholder={t('security.sender.placeholder')}\n          onBlur={(e) => {\n            const v = e.target.value.trim()\n            void setValue('IMHUB_ALLOWED_USERS', v === '' ? null : v)\n          }}\n        />\n      </ControlCard>\n\n      {/* Exec sandbox */}\n      <ControlCard\n        title={t('security.exec.title')}\n        description={t('security.exec.description')}\n      >\n        <div className=\"grid gap-3 sm:grid-cols-2\">\n          <LabeledField label={t('security.exec.sandbox')}>\n            <Select\n              value={(env.IMHUB_EXEC_SANDBOX ?? '').toLowerCase()}\n              onValueChange={(v) => void setValue('IMHUB_EXEC_SANDBOX', v === '' ? null : v)}\n            >\n              <SelectTrigger><SelectValue placeholder=\"—\" /></SelectTrigger>\n              <SelectContent>\n                <SelectItem value=\"\">{t('security.exec.sandboxNone')}</SelectItem>\n                <SelectItem\n                  value=\"bwrap\"\n                  disabled={!diagnostics?.bwrapAvailable}\n                >\n                  {t('security.exec.sandboxBwrap')}\n                  {!diagnostics?.bwrapAvailable && (\n                    <span className=\"ml-2 text-xs text-muted\">\n                      ({t('security.exec.sandboxBwrapMissing')})\n                    </span>\n                  )}\n                </SelectItem>\n              </SelectContent>\n            </Select>\n          </LabeledField>\n\n          <LabeledField label={t('security.exec.sandboxNet')}>\n            <Select\n              value={(env.IMHUB_EXEC_SANDBOX_NET ?? '').toLowerCase() === 'off' ? 'off' : 'on'}\n              onValueChange={(v) => void setValue('IMHUB_EXEC_SANDBOX_NET', v === 'off' ? 'off' : null)}\n            >\n              <SelectTrigger><SelectValue /></SelectTrigger>\n              <SelectContent>\n                <SelectItem value=\"on\">{t('security.exec.sandboxNetOn')}</SelectItem>\n                <SelectItem value=\"off\">{t('security.exec.sandboxNetOff')}</SelectItem>\n              </SelectContent>\n            </Select>\n          </LabeledField>\n\n          <LabeledField label={t('security.exec.timeoutMs')}>\n            <Input\n              type=\"number\"\n              defaultValue={env.IMHUB_EXEC_TIMEOUT_MS ?? ''}\n              placeholder=\"60000\"\n              onBlur={(e) => {\n                const v = e.target.value.trim()\n                void setValue('IMHUB_EXEC_TIMEOUT_MS', v === '' ? null : v)\n              }}\n            />\n          </LabeledField>\n\n          <LabeledField label={t('security.exec.maxOutput')}>\n            <Input\n              type=\"number\"\n              defaultValue={env.IMHUB_EXEC_MAX_OUTPUT ?? ''}\n              placeholder=\"32768\"\n              onBlur={(e) => {\n                const v = e.target.value.trim()\n                void setValue('IMHUB_EXEC_MAX_OUTPUT', v === '' ? null : v)\n              }}\n            />\n          </LabeledField>\n        </div>\n      </ControlCard>\n\n      {/* Web SSRF */}\n      <ControlCard\n        title={t('security.web.title')}\n        description={t('security.web.description')}\n      >\n        <div className=\"grid gap-3 sm:grid-cols-2\">\n          <LabeledField label={t('security.web.allowPrivate')} hint={t('security.web.allowPrivateHelp')}>\n            <Select\n              value={envBool(env.IMHUB_NATIVE_WEB_ALLOW_PRIVATE) ? '1' : '0'}\n              onValueChange={(v) => void setValue('IMHUB_NATIVE_WEB_ALLOW_PRIVATE', v === '1' ? '1' : null)}\n            >\n              <SelectTrigger><SelectValue /></SelectTrigger>\n              <SelectContent>\n                <SelectItem value=\"0\">OFF</SelectItem>\n                <SelectItem value=\"1\">ON</SelectItem>\n              </SelectContent>\n            </Select>\n          </LabeledField>\n\n          <LabeledField label={t('security.web.timeoutMs')}>\n            <Input\n              type=\"number\"\n              defaultValue={env.IMHUB_NATIVE_WEB_TIMEOUT_MS ?? ''}\n              placeholder=\"30000\"\n              onBlur={(e) => {\n                const v = e.target.value.trim()\n                void setValue('IMHUB_NATIVE_WEB_TIMEOUT_MS', v === '' ? null : v)\n              }}\n            />\n          </LabeledField>\n\n          <div className=\"sm:col-span-2\">\n            <LabeledField label={t('security.web.ssrfWhitelist')}>\n              <Input\n                defaultValue={env.IMHUB_NATIVE_WEB_SSRF_WHITELIST ?? ''}\n                placeholder={t('security.web.ssrfWhitelistPlaceholder')}\n                onBlur={(e) => {\n                  const v = e.target.value.trim()\n                  void setValue('IMHUB_NATIVE_WEB_SSRF_WHITELIST', v === '' ? null : v)\n                }}\n              />\n            </LabeledField>\n          </div>\n        </div>\n      </ControlCard>\n\n      {/* FS */}\n      <ControlCard\n        title={t('security.fs.title')}\n        description={t('security.fs.description')}\n      >\n        <div className=\"grid gap-3 sm:grid-cols-2\">\n          <LabeledField label={t('security.fs.restrict')}>\n            <Select\n              value={(env.IMHUB_NATIVE_FS_RESTRICT ?? '1') === '0' ? '0' : '1'}\n              onValueChange={(v) => void setValue('IMHUB_NATIVE_FS_RESTRICT', v === '0' ? '0' : null)}\n            >\n              <SelectTrigger><SelectValue /></SelectTrigger>\n              <SelectContent>\n                <SelectItem value=\"1\">{t('security.fs.restrictOn')}</SelectItem>\n                <SelectItem value=\"0\">{t('security.fs.restrictOff')}</SelectItem>\n              </SelectContent>\n            </Select>\n          </LabeledField>\n\n          <LabeledField label={t('security.fs.timeoutMs')}>\n            <Input\n              type=\"number\"\n              defaultValue={env.IMHUB_NATIVE_FS_TIMEOUT_MS ?? ''}\n              placeholder=\"60000\"\n              onBlur={(e) => {\n                const v = e.target.value.trim()\n                void setValue('IMHUB_NATIVE_FS_TIMEOUT_MS', v === '' ? null : v)\n              }}\n            />\n          </LabeledField>\n        </div>\n      </ControlCard>\n\n      {/* Delegation cap */}\n      <ControlCard\n        title={t('security.delegation.title')}\n        description={t('security.delegation.description')}\n        envKey=\"IMHUB_NATIVE_CALL_AGENT_MAX_PER_TURN\"\n      >\n        <Input\n          type=\"number\"\n          defaultValue={env.IMHUB_NATIVE_CALL_AGENT_MAX_PER_TURN ?? ''}\n          placeholder=\"2\"\n          onBlur={(e) => {\n            const v = e.target.value.trim()\n            void setValue('IMHUB_NATIVE_CALL_AGENT_MAX_PER_TURN', v === '' ? null : v)\n          }}\n        />\n      </ControlCard>\n    </div>\n  )\n}\n\nfunction DiagRow({ label, ok, text }: { label: string; ok: boolean; text: string }): JSX.Element {\n  return (\n    <li className=\"flex items-start gap-2\">\n      {ok\n        ? <CheckCircle2 className=\"mt-0.5 h-4 w-4 shrink-0 text-success\" />\n        : <AlertTriangle className=\"mt-0.5 h-4 w-4 shrink-0 text-warning\" />\n      }\n      <div className=\"flex-1\">\n        <div className=\"font-medium\">{label}</div>\n        <div className={cn('text-xs', ok ? 'text-muted' : 'text-warning')}>{text}</div>\n      </div>\n    </li>\n  )\n}\n\nfunction ControlCard({\n  title, description, envKey, children,\n}: { title: string; description: string; envKey?: string; children: React.ReactNode }): JSX.Element {\n  return (\n    <section className=\"rounded-lg border border-border bg-card p-4\">\n      <div className=\"mb-2 flex flex-wrap items-baseline gap-2\">\n        <h2 className=\"text-sm font-semibold\">{title}</h2>\n        {envKey && <Badge variant=\"outline\" className=\"font-mono text-[10px]\">{envKey}</Badge>}\n      </div>\n      <p className=\"mb-3 text-xs text-muted\">{description}</p>\n      {children}\n    </section>\n  )\n}\n\nfunction LabeledField({\n  label, hint, children,\n}: { label: string; hint?: string; children: React.ReactNode }): JSX.Element {\n  return (\n    <div className=\"flex flex-col gap-1\">\n      <label className=\"text-xs font-medium text-muted\">{label}</label>\n      {children}\n      {hint && <p className=\"text-[10px] text-muted\">{hint}</p>}\n    </div>\n  )\n}\n"],"names":["ShieldAlert","createLucideIcon","envBool","v","t","SettingsSecurityRoute","useTranslation","envQuery","useEnv","updateEnv","useUpdateEnv","diagnostics","setDiagnostics","useState","diagLoading","setDiagLoading","loadDiagnostics","res","client","err","toast","describeError","useEffect","setValue","key","value","env","jsxs","jsx","Button","Loader2","RefreshCcw","DiagRow","ControlCard","Input","e","LabeledField","Select","SelectTrigger","SelectValue","SelectContent","SelectItem","label","ok","text","CheckCircle2","AlertTriangle","cn","title","description","envKey","children","Badge","hint"],"mappings":"6ZAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GASA,MAAMA,EAAcC,EAAiB,cAAe,CAClD,CACE,OACA,CACE,EAAG,qKACH,IAAK,QACX,CACA,EACE,CAAC,OAAQ,CAAE,EAAG,UAAW,IAAK,QAAQ,CAAE,EACxC,CAAC,OAAQ,CAAE,EAAG,aAAc,IAAK,QAAQ,CAAE,CAC7C,CAAC,EC0BD,SAASC,EAAQC,EAAgC,CAC/C,GAAIA,GAAK,KAAM,MAAO,GACtB,MAAMC,EAAID,EAAE,YAAA,EACZ,OAAOC,IAAM,KAAOA,IAAM,QAAUA,IAAM,OAASA,IAAM,IAC3D,CAEA,SAAwBC,GAAqC,CAC3D,KAAM,CAAE,EAAAD,CAAA,EAAME,EAAe,CAAC,WAAY,QAAQ,CAAC,EAC7CC,EAAWC,EAAA,EACXC,EAAYC,EAAA,EACZ,CAACC,EAAaC,CAAc,EAAIC,EAAAA,SAA6B,IAAI,EACjE,CAACC,EAAaC,CAAc,EAAIF,EAAAA,SAAS,EAAK,EAEpD,eAAeG,GAAiC,CAC9CD,EAAe,EAAI,EACnB,GAAI,CACF,MAAME,EAAM,MAAMC,EAAO,IAAkC,2BAA2B,EACtFN,EAAeK,EAAI,WAAW,CAChC,OAASE,EAAK,CACZC,EAAM,MAAMC,EAAcF,EAAKf,CAAC,EAAE,OAAO,CAC3C,QAAA,CACEW,EAAe,EAAK,CACtB,CACF,CAEAO,EAAAA,UAAU,IAAM,CAAON,EAAA,CAAkB,EAAG,CAAA,CAAE,EAE9C,eAAeO,EAASC,EAAaC,EAAqC,CACxE,GAAI,CACF,MAAMhB,EAAU,YAAY,CAAE,QAAS,CAAE,CAACe,CAAG,EAAGC,CAAA,EAAS,EACzDL,EAAM,QAAQhB,EAAE,sBAAsB,CAAC,EACvC,MAAMY,EAAA,CACR,OAASG,EAAK,CACZC,EAAM,MAAMC,EAAcF,EAAKf,CAAC,EAAE,OAAO,CAC3C,CACF,CAEA,MAAMsB,EAAMnB,EAAS,MAAM,KAAO,CAAA,EAElC,OACEoB,EAAAA,KAAC,MAAA,CAAI,UAAU,wCACb,SAAA,CAAAA,EAAAA,KAAC,SAAA,CAAO,UAAU,sBAChB,SAAA,CAAAA,EAAAA,KAAC,MAAA,CAAI,UAAU,oCACb,SAAA,CAAAC,MAAC,KAAA,CAAG,UAAU,wBAAyB,SAAAxB,EAAE,gBAAgB,EAAE,EAC3DwB,EAAAA,IAACC,EAAA,CACC,QAAQ,QACR,KAAK,KACL,UAAU,UACV,QAAS,IAAM,CAAOtB,EAAS,QAAA,EAAgBS,EAAA,CAAkB,EACjE,SAAUT,EAAS,YAAcO,EACjC,aAAYV,EAAE,kBAAmB,CAAE,GAAI,SAAU,EAEhD,SAAAG,EAAS,YAAcO,EACpBc,EAAAA,IAACE,EAAA,CAAQ,UAAU,sBAAA,CAAuB,EAC1CF,EAAAA,IAACG,EAAA,CAAW,UAAU,SAAA,CAAU,CAAA,CAAA,CAEtC,EACF,QACC,IAAA,CAAE,UAAU,qBAAsB,SAAA3B,EAAE,mBAAmB,CAAA,CAAE,CAAA,EAC5D,EAGAuB,EAAAA,KAAC,UAAA,CAAQ,UAAU,8CACjB,SAAA,CAAAA,EAAAA,KAAC,KAAA,CAAG,UAAU,qDACZ,SAAA,CAAAC,EAAAA,IAAC5B,EAAA,CAAY,UAAU,SAAA,CAAU,EAChCI,EAAE,4BAA4B,CAAA,EACjC,EACCO,EACCgB,EAAAA,KAAC,KAAA,CAAG,UAAU,oCACZ,SAAA,CAAAC,EAAAA,IAACI,EAAA,CACC,MAAO5B,EAAE,oCAAoC,EAC7C,GAAIO,EAAY,gBAAkB,GAClC,KAAMA,EAAY,gBAAkB,GAAOP,EAAE,wCAAwC,EAAI,IAAA,CAAA,EAE3FwB,EAAAA,IAACI,EAAA,CACC,MAAO5B,EAAE,mCAAmC,EAC5C,GAAIO,EAAY,QAAQ,QAAU,CAACA,EAAY,QAAQ,cACvD,KACGA,EAAY,QAAQ,OAEjBA,EAAY,QAAQ,cAClB,GAAGA,EAAY,QAAQ,IAAI,MAAMP,EAAE,sCAAsC,CAAC,GAC1EA,EAAE,qCAAqC,EAHzC,GAGyC,CAAA,EAGjDwB,EAAAA,IAACI,EAAA,CACC,MAAO5B,EAAE,qCAAqC,EAC9C,GAAIO,EAAY,eAChB,KAAMA,EAAY,eAAiB,iBAAmBP,EAAE,mCAAmC,CAAA,CAAA,EAE7FwB,EAAAA,IAACI,EAAA,CACC,MAAO5B,EAAE,sCAAsC,EAC/C,GAAIO,EAAY,0BAChB,KAAMA,EAAY,0BACdP,EAAE,wCAAwC,EAC1CA,EAAE,yCAAyC,CAAA,CAAA,EAGjDwB,EAAAA,IAACI,EAAA,CACC,MAAO5B,EAAE,qCAAqC,EAC9C,GAAIO,EAAY,yBAChB,KAAMA,EAAY,yBACdP,EAAE,uCAAuC,EACzCA,EAAE,wCAAwC,CAAA,CAAA,CAEhD,CAAA,CACF,EAEAwB,EAAAA,IAAC,IAAA,CAAE,UAAU,qBAAqB,SAAA,GAAA,CAAC,CAAA,EAEvC,EAGAA,EAAAA,IAACK,EAAA,CACC,MAAO7B,EAAE,uBAAuB,EAChC,YAAaA,EAAE,6BAA6B,EAC5C,OAAO,sBAEP,SAAAwB,EAAAA,IAACM,EAAA,CACC,aAAcR,EAAI,qBAAuB,GACzC,YAAatB,EAAE,6BAA6B,EAC5C,OAAS+B,GAAM,CACb,MAAMhC,EAAIgC,EAAE,OAAO,MAAM,KAAA,EACpBZ,EAAS,sBAAuBpB,IAAM,GAAK,KAAOA,CAAC,CAC1D,CAAA,CAAA,CACF,CAAA,EAIFyB,EAAAA,IAACK,EAAA,CACC,MAAO7B,EAAE,qBAAqB,EAC9B,YAAaA,EAAE,2BAA2B,EAE1C,SAAAuB,EAAAA,KAAC,MAAA,CAAI,UAAU,4BACb,SAAA,CAAAC,EAAAA,IAACQ,EAAA,CAAa,MAAOhC,EAAE,uBAAuB,EAC5C,SAAAuB,EAAAA,KAACU,EAAA,CACC,OAAQX,EAAI,oBAAsB,IAAI,YAAA,EACtC,cAAgBvB,GAAM,KAAKoB,EAAS,qBAAsBpB,IAAM,GAAK,KAAOA,CAAC,EAE7E,SAAA,CAAAyB,MAACU,EAAA,CAAc,SAAAV,EAAAA,IAACW,EAAA,CAAY,YAAY,IAAI,EAAE,SAC7CC,EAAA,CACC,SAAA,CAAAZ,MAACa,EAAA,CAAW,MAAM,GAAI,SAAArC,EAAE,2BAA2B,EAAE,EACrDuB,EAAAA,KAACc,EAAA,CACC,MAAM,QACN,SAAU,CAAC9B,GAAa,eAEvB,SAAA,CAAAP,EAAE,4BAA4B,EAC9B,CAACO,GAAa,gBACbgB,EAAAA,KAAC,OAAA,CAAK,UAAU,0BAA0B,SAAA,CAAA,IACtCvB,EAAE,mCAAmC,EAAE,GAAA,CAAA,CAC3C,CAAA,CAAA,CAAA,CAEJ,CAAA,CACF,CAAA,CAAA,CAAA,EAEJ,EAEAwB,EAAAA,IAACQ,EAAA,CAAa,MAAOhC,EAAE,0BAA0B,EAC/C,SAAAuB,EAAAA,KAACU,EAAA,CACC,OAAQX,EAAI,wBAA0B,IAAI,gBAAkB,MAAQ,MAAQ,KAC5E,cAAgBvB,GAAM,KAAKoB,EAAS,yBAA0BpB,IAAM,MAAQ,MAAQ,IAAI,EAExF,SAAA,CAAAyB,EAAAA,IAACU,EAAA,CAAc,SAAAV,EAAAA,IAACW,EAAA,CAAA,CAAY,EAAE,SAC7BC,EAAA,CACC,SAAA,CAAAZ,MAACa,EAAA,CAAW,MAAM,KAAM,SAAArC,EAAE,4BAA4B,EAAE,QACvDqC,EAAA,CAAW,MAAM,MAAO,SAAArC,EAAE,6BAA6B,CAAA,CAAE,CAAA,CAAA,CAC5D,CAAA,CAAA,CAAA,EAEJ,EAEAwB,EAAAA,IAACQ,EAAA,CAAa,MAAOhC,EAAE,yBAAyB,EAC9C,SAAAwB,EAAAA,IAACM,EAAA,CACC,KAAK,SACL,aAAcR,EAAI,uBAAyB,GAC3C,YAAY,QACZ,OAASS,GAAM,CACb,MAAMhC,EAAIgC,EAAE,OAAO,MAAM,KAAA,EACpBZ,EAAS,wBAAyBpB,IAAM,GAAK,KAAOA,CAAC,CAC5D,CAAA,CAAA,EAEJ,EAEAyB,EAAAA,IAACQ,EAAA,CAAa,MAAOhC,EAAE,yBAAyB,EAC9C,SAAAwB,EAAAA,IAACM,EAAA,CACC,KAAK,SACL,aAAcR,EAAI,uBAAyB,GAC3C,YAAY,QACZ,OAASS,GAAM,CACb,MAAMhC,EAAIgC,EAAE,OAAO,MAAM,KAAA,EACpBZ,EAAS,wBAAyBpB,IAAM,GAAK,KAAOA,CAAC,CAC5D,CAAA,CAAA,CACF,CACF,CAAA,CAAA,CACF,CAAA,CAAA,EAIFyB,EAAAA,IAACK,EAAA,CACC,MAAO7B,EAAE,oBAAoB,EAC7B,YAAaA,EAAE,0BAA0B,EAEzC,SAAAuB,EAAAA,KAAC,MAAA,CAAI,UAAU,4BACb,SAAA,CAAAC,EAAAA,IAACQ,EAAA,CAAa,MAAOhC,EAAE,2BAA2B,EAAG,KAAMA,EAAE,+BAA+B,EAC1F,SAAAuB,EAAAA,KAACU,EAAA,CACC,MAAOnC,EAAQwB,EAAI,8BAA8B,EAAI,IAAM,IAC3D,cAAgBvB,GAAM,KAAKoB,EAAS,iCAAkCpB,IAAM,IAAM,IAAM,IAAI,EAE5F,SAAA,CAAAyB,EAAAA,IAACU,EAAA,CAAc,SAAAV,EAAAA,IAACW,EAAA,CAAA,CAAY,EAAE,SAC7BC,EAAA,CACC,SAAA,CAAAZ,EAAAA,IAACa,EAAA,CAAW,MAAM,IAAI,SAAA,MAAG,EACzBb,EAAAA,IAACa,EAAA,CAAW,MAAM,IAAI,SAAA,IAAA,CAAE,CAAA,CAAA,CAC1B,CAAA,CAAA,CAAA,EAEJ,EAEAb,EAAAA,IAACQ,EAAA,CAAa,MAAOhC,EAAE,wBAAwB,EAC7C,SAAAwB,EAAAA,IAACM,EAAA,CACC,KAAK,SACL,aAAcR,EAAI,6BAA+B,GACjD,YAAY,QACZ,OAASS,GAAM,CACb,MAAMhC,EAAIgC,EAAE,OAAO,MAAM,KAAA,EACpBZ,EAAS,8BAA+BpB,IAAM,GAAK,KAAOA,CAAC,CAClE,CAAA,CAAA,EAEJ,EAEAyB,EAAAA,IAAC,OAAI,UAAU,gBACb,eAACQ,EAAA,CAAa,MAAOhC,EAAE,4BAA4B,EACjD,SAAAwB,EAAAA,IAACM,EAAA,CACC,aAAcR,EAAI,iCAAmC,GACrD,YAAatB,EAAE,uCAAuC,EACtD,OAAS+B,GAAM,CACb,MAAMhC,EAAIgC,EAAE,OAAO,MAAM,KAAA,EACpBZ,EAAS,kCAAmCpB,IAAM,GAAK,KAAOA,CAAC,CACtE,CAAA,CAAA,EAEJ,CAAA,CACF,CAAA,CAAA,CACF,CAAA,CAAA,EAIFyB,EAAAA,IAACK,EAAA,CACC,MAAO7B,EAAE,mBAAmB,EAC5B,YAAaA,EAAE,yBAAyB,EAExC,SAAAuB,EAAAA,KAAC,MAAA,CAAI,UAAU,4BACb,SAAA,CAAAC,EAAAA,IAACQ,EAAA,CAAa,MAAOhC,EAAE,sBAAsB,EAC3C,SAAAuB,EAAAA,KAACU,EAAA,CACC,OAAQX,EAAI,0BAA4B,OAAS,IAAM,IAAM,IAC7D,cAAgBvB,GAAM,KAAKoB,EAAS,2BAA4BpB,IAAM,IAAM,IAAM,IAAI,EAEtF,SAAA,CAAAyB,EAAAA,IAACU,EAAA,CAAc,SAAAV,EAAAA,IAACW,EAAA,CAAA,CAAY,EAAE,SAC7BC,EAAA,CACC,SAAA,CAAAZ,MAACa,EAAA,CAAW,MAAM,IAAK,SAAArC,EAAE,wBAAwB,EAAE,QAClDqC,EAAA,CAAW,MAAM,IAAK,SAAArC,EAAE,yBAAyB,CAAA,CAAE,CAAA,CAAA,CACtD,CAAA,CAAA,CAAA,EAEJ,EAEAwB,EAAAA,IAACQ,EAAA,CAAa,MAAOhC,EAAE,uBAAuB,EAC5C,SAAAwB,EAAAA,IAACM,EAAA,CACC,KAAK,SACL,aAAcR,EAAI,4BAA8B,GAChD,YAAY,QACZ,OAASS,GAAM,CACb,MAAMhC,EAAIgC,EAAE,OAAO,MAAM,KAAA,EACpBZ,EAAS,6BAA8BpB,IAAM,GAAK,KAAOA,CAAC,CACjE,CAAA,CAAA,CACF,CACF,CAAA,CAAA,CACF,CAAA,CAAA,EAIFyB,EAAAA,IAACK,EAAA,CACC,MAAO7B,EAAE,2BAA2B,EACpC,YAAaA,EAAE,iCAAiC,EAChD,OAAO,uCAEP,SAAAwB,EAAAA,IAACM,EAAA,CACC,KAAK,SACL,aAAcR,EAAI,sCAAwC,GAC1D,YAAY,IACZ,OAASS,GAAM,CACb,MAAMhC,EAAIgC,EAAE,OAAO,MAAM,KAAA,EACpBZ,EAAS,uCAAwCpB,IAAM,GAAK,KAAOA,CAAC,CAC3E,CAAA,CAAA,CACF,CAAA,CACF,EACF,CAEJ,CAEA,SAAS6B,EAAQ,CAAE,MAAAU,EAAO,GAAAC,EAAI,KAAAC,GAAmE,CAC/F,OACEjB,EAAAA,KAAC,KAAA,CAAG,UAAU,yBACX,SAAA,CAAAgB,EACGf,EAAAA,IAACiB,GAAa,UAAU,sCAAA,CAAuC,EAC/DjB,EAAAA,IAACkB,EAAA,CAAc,UAAU,sCAAA,CAAuC,EAEpEnB,EAAAA,KAAC,MAAA,CAAI,UAAU,SACb,SAAA,CAAAC,EAAAA,IAAC,MAAA,CAAI,UAAU,cAAe,SAAAc,EAAM,EACpCd,EAAAA,IAAC,OAAI,UAAWmB,EAAG,UAAWJ,EAAK,aAAe,cAAc,EAAI,SAAAC,CAAA,CAAK,CAAA,CAAA,CAC3E,CAAA,EACF,CAEJ,CAEA,SAASX,EAAY,CACnB,MAAAe,EAAO,YAAAC,EAAa,OAAAC,EAAQ,SAAAC,CAC9B,EAAoG,CAClG,OACExB,EAAAA,KAAC,UAAA,CAAQ,UAAU,8CACjB,SAAA,CAAAA,EAAAA,KAAC,MAAA,CAAI,UAAU,2CACb,SAAA,CAAAC,EAAAA,IAAC,KAAA,CAAG,UAAU,wBAAyB,SAAAoB,EAAM,EAC5CE,GAAUtB,EAAAA,IAACwB,EAAA,CAAM,QAAQ,UAAU,UAAU,wBAAyB,SAAAF,CAAA,CAAO,CAAA,EAChF,EACAtB,EAAAA,IAAC,IAAA,CAAE,UAAU,0BAA2B,SAAAqB,EAAY,EACnDE,CAAA,EACH,CAEJ,CAEA,SAASf,EAAa,CACpB,MAAAM,EAAO,KAAAW,EAAM,SAAAF,CACf,EAA6E,CAC3E,OACExB,EAAAA,KAAC,MAAA,CAAI,UAAU,sBACb,SAAA,CAAAC,EAAAA,IAAC,QAAA,CAAM,UAAU,iCAAkC,SAAAc,EAAM,EACxDS,EACAE,GAAQzB,EAAAA,IAAC,IAAA,CAAE,UAAU,yBAA0B,SAAAyB,CAAA,CAAK,CAAA,EACvD,CAEJ","x_google_ignoreList":[0]}