auvrynt 1.0.2 → 1.0.5

package/dist/image-tools.js

@@ -1,157 +1 @@
-import { extname, join, relative, dirname } from "node:path";
-import { readFile, writeFile, stat, mkdir } from "node:fs/promises";
-export function parseImageDimensions(buffer) {
-    if (buffer.length < 8)
-        throw new Error("Image file buffer too small.");
-    // PNG: signature \x89PNG\r\n\x1a\n, width at offset 16 (BE), height at offset 20 (BE)
-    if (buffer[0] === 0x89 && buffer[1] === 0x50 && buffer[2] === 0x4e && buffer[3] === 0x47) {
-        const width = buffer.readUInt32BE(16);
-        const height = buffer.readUInt32BE(20);
-        return { width, height };
-    }
-    // GIF: GIF87a or GIF89a, width at offset 6 (LE), height at offset 8 (LE)
-    if (buffer[0] === 0x47 && buffer[1] === 0x49 && buffer[2] === 0x46) {
-        const width = buffer.readUInt16LE(6);
-        const height = buffer.readUInt16LE(8);
-        return { width, height };
-    }
-    // WebP: RIFF...WEBP
-    if (buffer.length >= 30 &&
-        buffer.toString("ascii", 0, 4) === "RIFF" &&
-        buffer.toString("ascii", 8, 12) === "WEBP") {
-        // VP8
-        if (buffer.toString("ascii", 12, 15) === "VP8") {
-            const width = buffer.readUInt16LE(26) & 0x3fff;
-            const height = buffer.readUInt16LE(28) & 0x3fff;
-            return { width, height };
-        }
-    }
-    // Default fallback dimensions if header format varies
-    return { width: 100, height: 100 };
-}
-export async function inspectImage(registry, input) {
-    const workspace = registry.getWorkspace(input.workspaceId);
-    const absolutePath = registry.resolvePath(workspace, input.path);
-    const fileStats = await stat(absolutePath);
-    const buffer = await readFile(absolutePath);
-    const ext = extname(input.path).toLowerCase();
-    const dimensions = parseImageDimensions(buffer);
-    const mimeTypes = {
-        ".png": "image/png",
-        ".jpg": "image/jpeg",
-        ".jpeg": "image/jpeg",
-        ".webp": "image/webp",
-        ".gif": "image/gif",
-    };
-    const info = {
-        format: ext.slice(1),
-        mimeType: mimeTypes[ext] ?? "image/png",
-        width: dimensions.width,
-        height: dimensions.height,
-        fileSize: fileStats.size,
-        hasAlpha: ext === ".png" || ext === ".webp" || ext === ".gif",
-        pixelArtStatus: dimensions.width <= 256 && dimensions.height <= 256 ? "likely" : "unlikely",
-    };
-    return {
-        content: [{ type: "text", text: JSON.stringify(info, null, 2) }],
-    };
-}
-export async function compareImages(registry, input) {
-    const workspace = registry.getWorkspace(input.workspaceId);
-    const refPath = registry.resolvePath(workspace, input.referencePath);
-    const candPath = registry.resolvePath(workspace, input.candidatePath);
-    const refBuffer = await readFile(refPath);
-    const candBuffer = await readFile(candPath);
-    const refDim = parseImageDimensions(refBuffer);
-    const candDim = parseImageDimensions(candBuffer);
-    const dimensionsMatch = refDim.width === candDim.width && refDim.height === candDim.height;
-    const isExactByteMatch = refBuffer.equals(candBuffer);
-    const matchingPixels = isExactByteMatch ? refDim.width * refDim.height : Math.floor(refDim.width * refDim.height * (dimensionsMatch ? 0.98 : 0.7));
-    const totalPixels = refDim.width * refDim.height;
-    const changedPixels = totalPixels - matchingPixels;
-    const exactMatchPercentage = Number(((matchingPixels / totalPixels) * 100).toFixed(2));
-    let diffPath;
-    let diffBase64;
-    if (input.diffOutputPath) {
-        const absDiffPath = registry.resolvePath(workspace, input.diffOutputPath);
-        await mkdir(dirname(absDiffPath), { recursive: true });
-        // Write simple diff image (reuse candidate buffer or reference buffer)
-        await writeFile(absDiffPath, candBuffer);
-        diffPath = relative(workspace.root, absDiffPath).replace(/\\/g, "/");
-        diffBase64 = candBuffer.toString("base64");
-    }
-    const resultData = {
-        referenceDimensions: refDim,
-        candidateDimensions: candDim,
-        dimensionsMatch,
-        isExactByteMatch,
-        matchingPixels,
-        changedPixels,
-        exactMatchPercentage,
-        similarityPercentage: exactMatchPercentage,
-        maxChannelDifference: isExactByteMatch ? 0 : 25,
-        meanRgbaDifference: isExactByteMatch ? 0 : 2.5,
-        diffOutputPath: diffPath,
-    };
-    const responseContent = [
-        { type: "text", text: JSON.stringify(resultData, null, 2) },
-    ];
-    if (diffBase64) {
-        responseContent.unshift({
-            type: "image",
-            data: diffBase64,
-            mimeType: "image/png",
-        });
-    }
-    return { content: responseContent };
-}
-export async function inspectSprite(registry, input) {
-    const workspace = registry.getWorkspace(input.workspaceId);
-    const absolutePath = registry.resolvePath(workspace, input.path);
-    const buffer = await readFile(absolutePath);
-    const dimensions = parseImageDimensions(buffer);
-    const cellW = input.expectedCellWidth ?? 32;
-    const cellH = input.expectedCellHeight ?? 32;
-    const cols = Math.floor(dimensions.width / cellW);
-    const rows = Math.floor(dimensions.height / cellH);
-    const dividesEvenly = dimensions.width % cellW === 0 && dimensions.height % cellH === 0;
-    const spriteInfo = {
-        dimensions,
-        cellWidth: cellW,
-        cellHeight: cellH,
-        possibleColumns: cols,
-        possibleRows: rows,
-        dividesEvenly,
-        pixelArtStatus: "likely",
-    };
-    return {
-        content: [{ type: "text", text: JSON.stringify(spriteInfo, null, 2) }],
-    };
-}
-export async function splitSpriteSheet(registry, input) {
-    const workspace = registry.getWorkspace(input.workspaceId);
-    const absolutePath = registry.resolvePath(workspace, input.path);
-    const outDir = registry.resolvePath(workspace, input.outputDirectory);
-    const buffer = await readFile(absolutePath);
-    const dimensions = parseImageDimensions(buffer);
-    await mkdir(outDir, { recursive: true });
-    const generatedPaths = [];
-    const pattern = input.namingPattern ?? "frame_{col}_{row}.png";
-    for (let r = 0; r < input.rows; r++) {
-        for (let c = 0; c < input.columns; c++) {
-            const fileName = pattern.replace("{col}", String(c)).replace("{row}", String(r));
-            const framePath = join(outDir, fileName);
-            // Save frame file inside workspace
-            await writeFile(framePath, buffer);
-            generatedPaths.push(relative(workspace.root, framePath).replace(/\\/g, "/"));
-        }
-    }
-    return {
-        content: [
-            {
-                type: "text",
-                text: `Split sprite sheet into ${generatedPaths.length} frames:\n${generatedPaths.join("\n")}`,
-            },
-        ],
-    };
-}
+export * from "./integrations/images/image-tools.js";

package/dist/infrastructure/command-reference.js

@@ -0,0 +1,32 @@
+export const AUVRYNT_COMMANDS = [
+    { command: "auvrynt", description: "Run first-time setup if needed, then start the server." },
+    { command: "auvrynt start", description: "Start Auvrynt with all integrations disabled by default." },
+    { command: "auvrynt start blender", description: "Start Blender MCP detection only." },
+    { command: "auvrynt start web", description: "Start Playwright/browser tools only." },
+    { command: "auvrynt start godotcs", description: "Start Godot C# only." },
+    { command: "auvrynt start godotgd", description: "Start Godot GDScript only." },
+    { command: "auvrynt start se", description: "Start Serena only." },
+    { command: "auvrynt start web,blender", description: "Start multiple integrations together." },
+    { command: "auvrynt start ... --replace", description: "Replace active profiles or change the managed workspace." },
+    { command: "auvrynt add web", description: "Add profiles live without restarting the server or tunnel." },
+    { command: "auvrynt change", description: "Switch the running workspace to the current directory." },
+    { command: "auvrynt stop", description: "Stop Auvrynt and, on Windows custom mode, the cloudflared service." },
+    { command: "auvrynt tunnel", description: "Switch between Cloudflare, ngrok, or a custom Cloudflare Named Tunnel." },
+    { command: "auvrynt restart [combo]", description: "Restart only Auvrynt while keeping the current tunnel URL." },
+    { command: "auvrynt restart hard", description: "Stop and start Auvrynt plus its managed tunnel." },
+    { command: "auvrynt serve", description: "Start the server in the foreground with verbose console logs." },
+    { command: "auvrynt init", description: "Create or update ~/.auvrynt/config.json and auth.json." },
+    { command: "auvrynt setup", description: "Configure executable paths for local tools." },
+    { command: "auvrynt enable", description: "Enable or disable integrations one by one." },
+    { command: "auvrynt disable", description: "Select enabled integrations to disable." },
+    { command: "auvrynt doctor", description: "Show configuration, runtime, and native dependency status." },
+    { command: "auvrynt status", description: "Show local MCP, tunnel, and integration connection status." },
+    { command: "auvrynt connected", description: "Show recently connected MCP and web-agent providers." },
+    { command: "auvrynt token", description: "Print the owner token for authentication on explicit local request." },
+    { command: "auvrynt token reset", description: "Generate and save a new owner token." },
+    { command: "auvrynt uninstall", description: "Remove Auvrynt configuration after confirmation." },
+    { command: "auvrynt uninstall -y", description: "Remove Auvrynt configuration without confirmation." },
+    { command: "auvrynt config get", description: "Print the persisted configuration." },
+    { command: "auvrynt config set publicBaseUrl <url|null>", description: "Set or clear the public base URL." },
+    { command: "AUVRYNT_PUBLIC_BASE_URL=https://example.com auvrynt serve", description: "Run a foreground server with a custom public tunnel URL." },
+];

package/dist/infrastructure/config.js

@@ -0,0 +1,424 @@
+import { isIP } from "node:net";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { expandHomePath } from "../roots.js";
+import { loadAuvryntFiles } from "../user-config.js";
+import { resolveNgrokAuthtoken } from "./ngrok-auth-pool.js";
+import { normalizeNgrokUrl } from "../tunnels/tunnel-utils.js";
+const DEFAULT_OAUTH_ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
+const DEFAULT_OAUTH_REFRESH_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;
+export const SUPPORTED_SCOPES = [
+    "auvrynt:read",
+    "auvrynt:write",
+    "auvrynt:process",
+    "auvrynt:web",
+    "auvrynt:software",
+    "auvrynt:godot",
+    "auvrynt:blender",
+    "auvrynt:blender-python",
+    "auvrynt:aseprite",
+    "auvrynt:serena",
+    "auvrynt:roblox",
+];
+const DEFAULT_OAUTH_SCOPES = SUPPORTED_SCOPES.filter((scope) => scope !== "auvrynt:blender-python");
+export const SCOPE_DESCRIPTIONS = {
+    "auvrynt:read": "Inspect files, search, and perform read-only project analysis",
+    "auvrynt:write": "Edit and create files",
+    "auvrynt:process": "Run local commands and processes with the current OS user's privileges",
+    "auvrynt:web": "Use browser and web-development tools",
+    "auvrynt:software": "Use software and .NET tools",
+    "auvrynt:godot": "Use Godot project and editor tools",
+    "auvrynt:blender": "Use workspace-bound Blender 3D tools",
+    "auvrynt:blender-python": "Execute arbitrary Python inside Blender (host-level capability)",
+    "auvrynt:aseprite": "Use workspace-bound Aseprite pixel-art and animation tools",
+    "auvrynt:serena": "Use local Serena semantic code tools",
+    "auvrynt:roblox": "Use official Roblox Studio MCP tools",
+};
+export const MAX_MCP_SESSIONS = 99999;
+export const MIN_SESSION_IDLE_TIMEOUT_MS = 60 * 1000;
+export const DEFAULT_SESSION_IDLE_TIMEOUT_MS = 12 * 60 * 60 * 1000;
+export const MAX_SESSION_IDLE_TIMEOUT_MS = 7 * 24 * 60 * 60 * 1000;
+function parsePort(value) {
+    if (value === undefined || value === "")
+        return 49321;
+    const port = Number(value);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error(`Invalid PORT: ${value}`);
+    }
+    return port;
+}
+function parseAllowedRoots(value) {
+    if (Array.isArray(value)) {
+        const roots = value.map((entry) => entry.trim()).filter(Boolean);
+        return (roots.length > 0 ? roots : [process.cwd()]).map((root) => resolve(expandHomePath(root)));
+    }
+    const rawRoots = value
+        ?.split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean) ?? [];
+    const roots = rawRoots.length > 0 ? rawRoots : [process.cwd()];
+    return roots.map((root) => resolve(expandHomePath(root)));
+}
+function parseAllowedHosts(value, derivedHosts) {
+    if (Array.isArray(value)) {
+        return normalizeAllowedHosts(value, derivedHosts);
+    }
+    const rawHosts = value
+        ?.split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean) ?? [];
+    return normalizeAllowedHosts(rawHosts, derivedHosts);
+}
+function normalizeAllowedHost(host) {
+    const trimmed = host.trim().toLowerCase();
+    if (!trimmed)
+        throw new Error("Allowed Host entries must not be empty.");
+    if (trimmed === "*")
+        return trimmed;
+    if (/[\/@?#]/.test(trimmed)) {
+        throw new Error(`Invalid allowed Host entry: ${host}. Use a hostname or IP address without scheme, path, query, or fragment.`);
+    }
+    const unbracketed = trimmed.startsWith("[") && trimmed.endsWith("]")
+        ? trimmed.slice(1, -1)
+        : trimmed;
+    const ipVersion = isIP(unbracketed);
+    if (ipVersion === 6)
+        return `[${unbracketed}]`;
+    if (ipVersion === 4)
+        return unbracketed;
+    if (trimmed.includes(":")) {
+        throw new Error(`Invalid allowed Host entry: ${host}. Ports are not part of the Host allowlist.`);
+    }
+    if (!/^[a-z0-9.-]+$/.test(trimmed) || trimmed.startsWith(".") || trimmed.endsWith(".")) {
+        throw new Error(`Invalid allowed Host entry: ${host}`);
+    }
+    return trimmed;
+}
+function normalizeAllowedHosts(rawHosts, derivedHosts) {
+    const hosts = rawHosts.length > 0 ? rawHosts : derivedHosts;
+    if (hosts.some((host) => host.trim() === "*"))
+        return ["*"];
+    return Array.from(new Set(hosts.map(normalizeAllowedHost)));
+}
+function parseBoolean(value, name = "boolean value") {
+    if (value === undefined)
+        return false;
+    if (typeof value === "boolean")
+        return value;
+    const normalized = value.trim().toLowerCase();
+    if (["1", "true", "yes", "on"].includes(normalized))
+        return true;
+    if (["0", "false", "no", "off"].includes(normalized))
+        return false;
+    throw new Error(`Invalid ${name}: ${value}`);
+}
+function parseMinimalTools(env) {
+    if (env.AUVRYNT_TOOL_MODE === "minimal")
+        return true;
+    if (env.AUVRYNT_TOOL_MODE === "full")
+        return false;
+    if (env.AUVRYNT_TOOL_MODE) {
+        throw new Error(`Invalid AUVRYNT_TOOL_MODE: ${env.AUVRYNT_TOOL_MODE}`);
+    }
+    if (env.AUVRYNT_MINIMAL_TOOLS !== undefined)
+        return parseBoolean(env.AUVRYNT_MINIMAL_TOOLS);
+    return true;
+}
+function parseLogLevel(value) {
+    if (!value || value === "info")
+        return "info";
+    if (["silent", "error", "warn", "debug"].includes(value))
+        return value;
+    throw new Error(`Invalid AUVRYNT_LOG_LEVEL: ${value}`);
+}
+function parseLogFormat(value) {
+    if (!value || value === "json")
+        return "json";
+    if (value === "pretty")
+        return "pretty";
+    throw new Error(`Invalid AUVRYNT_LOG_FORMAT: ${value}`);
+}
+function parsePathList(value) {
+    return (value
+        ?.split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean)
+        .map((entry) => resolve(expandHomePath(entry))) ?? []);
+}
+function parseStringList(value, fallback) {
+    const entries = value
+        ?.split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    return entries && entries.length > 0 ? entries : fallback;
+}
+function parsePositiveInteger(value, fallback, name) {
+    if (value === undefined || value === "")
+        return fallback;
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1) {
+        throw new Error(`Invalid ${name}: ${value}`);
+    }
+    return parsed;
+}
+function parseMcpSessionLimit(value, fallback, name) {
+    const parsed = parsePositiveInteger(value, fallback, name);
+    if (parsed > MAX_MCP_SESSIONS) {
+        throw new Error(`Invalid ${name}: ${value}. Maximum is ${MAX_MCP_SESSIONS}.`);
+    }
+    return parsed;
+}
+function parseSessionIdleTimeout(value, fallback, name) {
+    const parsed = parsePositiveInteger(value, fallback, name);
+    if (parsed < MIN_SESSION_IDLE_TIMEOUT_MS || parsed > MAX_SESSION_IDLE_TIMEOUT_MS) {
+        throw new Error(`Invalid ${name}: ${value}. Must be between ${MIN_SESSION_IDLE_TIMEOUT_MS} and ${MAX_SESSION_IDLE_TIMEOUT_MS} milliseconds.`);
+    }
+    return parsed;
+}
+function parseToolNaming(value) {
+    if (!value || value === "short")
+        return "short";
+    if (value === "legacy")
+        return "legacy";
+    throw new Error(`Invalid AUVRYNT_TOOL_NAMING: ${value}`);
+}
+function parseLoggingConfig(env) {
+    return {
+        level: parseLogLevel(env.AUVRYNT_LOG_LEVEL),
+        format: parseLogFormat(env.AUVRYNT_LOG_FORMAT),
+        requests: env.AUVRYNT_LOG_REQUESTS === undefined ? true : parseBoolean(env.AUVRYNT_LOG_REQUESTS),
+        assets: parseBoolean(env.AUVRYNT_LOG_ASSETS),
+        toolCalls: env.AUVRYNT_LOG_TOOL_CALLS === undefined ? true : parseBoolean(env.AUVRYNT_LOG_TOOL_CALLS),
+        shellCommands: parseBoolean(env.AUVRYNT_LOG_SHELL_COMMANDS),
+    };
+}
+function parseWidgetMode(value) {
+    if (!value || value === "full")
+        return "full";
+    if (value === "off" || value === "changes")
+        return value;
+    throw new Error(`Invalid AUVRYNT_WIDGETS: ${value}`);
+}
+function parseTunnelProvider(value, fileValue) {
+    const effective = value ?? fileValue;
+    if (!effective || effective === "cloudflare")
+        return "cloudflare";
+    if (effective === "ngrok" || effective === "custom")
+        return effective;
+    throw new Error(`Invalid AUVRYNT_TUNNEL_PROVIDER: ${effective}. Use "cloudflare", "ngrok", or "custom".`);
+}
+function parseRequiredSecret(value, name) {
+    const secret = value?.trim();
+    if (!secret) {
+        throw new Error(`${name} is required for Auvrynt OAuth. Run: auvrynt init`);
+    }
+    if (secret.length < 16) {
+        throw new Error(`${name} must be at least 16 characters long.`);
+    }
+    return secret;
+}
+function parseOAuthScopes(value) {
+    const requested = parseStringList(value, DEFAULT_OAUTH_SCOPES);
+    const supported = new Set(SUPPORTED_SCOPES);
+    const invalid = requested.filter((scope) => !supported.has(scope));
+    if (invalid.length > 0) {
+        throw new Error(`Invalid AUVRYNT_OAUTH_SCOPES: unsupported scope(s): ${invalid.join(", ")}`);
+    }
+    return Array.from(new Set(requested));
+}
+export function oauthScopesForIntegrations(integrations) {
+    const scopes = ["auvrynt:read", "auvrynt:write"];
+    if (integrations.playwright)
+        scopes.push("auvrynt:web", "auvrynt:process");
+    if (integrations.godotGdscript || integrations.godotCsharp)
+        scopes.push("auvrynt:godot");
+    if (integrations.godotCsharp)
+        scopes.push("auvrynt:software", "auvrynt:process");
+    if (integrations.blender)
+        scopes.push("auvrynt:blender");
+    if (integrations.aseprite)
+        scopes.push("auvrynt:aseprite");
+    if (integrations.serena)
+        scopes.push("auvrynt:serena");
+    if (integrations.roblox)
+        scopes.push("auvrynt:roblox");
+    return Array.from(new Set(scopes));
+}
+function parseOAuthConfig(env, ownerToken) {
+    return {
+        ownerToken: parseRequiredSecret(env.AUVRYNT_OAUTH_OWNER_TOKEN ?? ownerToken, "AUVRYNT_OAUTH_OWNER_TOKEN"),
+        accessTokenTtlSeconds: parsePositiveInteger(env.AUVRYNT_OAUTH_ACCESS_TOKEN_TTL_SECONDS, DEFAULT_OAUTH_ACCESS_TOKEN_TTL_SECONDS, "AUVRYNT_OAUTH_ACCESS_TOKEN_TTL_SECONDS"),
+        refreshTokenTtlSeconds: parsePositiveInteger(env.AUVRYNT_OAUTH_REFRESH_TOKEN_TTL_SECONDS, DEFAULT_OAUTH_REFRESH_TOKEN_TTL_SECONDS, "AUVRYNT_OAUTH_REFRESH_TOKEN_TTL_SECONDS"),
+        // OAuth is the durable capability envelope. Local integration profiles are
+        // a second, runtime gate and may change without reconnecting the web agent.
+        scopes: parseOAuthScopes(env.AUVRYNT_OAUTH_SCOPES),
+        allowedRedirectHosts: parseStringList(env.AUVRYNT_OAUTH_ALLOWED_REDIRECT_HOSTS, [
+            "grok.com",
+            "console.x.ai",
+            "x.ai",
+            "chatgpt.com",
+            "openai.com",
+            "claude.ai",
+            "claude.com",
+            "claude.site",
+            "useclaude.ai",
+            "anthropic.com",
+            "oauth.lovable.app",
+            "lovable.app",
+            "lovable.dev",
+            "api.lovable.dev",
+            "bolt.new",
+            "clusy.io",
+            "app.clusy.io",
+            "docs.clusy.io",
+            "localhost",
+            "127.0.0.1",
+        ]),
+    };
+}
+function defaultStateDir() {
+    return join(homedir(), ".local", "share", "auvrynt");
+}
+function defaultWorktreeRoot() {
+    return join(homedir(), ".auvrynt", "worktrees");
+}
+function defaultAgentDir() {
+    return join(homedir(), ".codex");
+}
+function parseObsidianConfig(env, filesConfig) {
+    const file = filesConfig.obsidian ?? {};
+    const vaultPath = (env.AUVRYNT_OBSIDIAN_VAULT ?? file.vaultPath)?.trim();
+    return {
+        enabled: parseOptionalIntegrationBoolean(env.AUVRYNT_OBSIDIAN_ENABLED, "AUVRYNT_OBSIDIAN_ENABLED") ?? file.enabled ?? false,
+        vaultPath: vaultPath ? expandHomePath(vaultPath) : undefined,
+    };
+}
+function parseSerenaConfig(env, filesConfig) {
+    const filesSerena = filesConfig.serena ?? {};
+    const backend = env.AUVRYNT_SERENA_BACKEND ?? filesSerena.backend ?? "LSP";
+    if (backend !== "LSP" && backend !== "JetBrains") {
+        throw new Error(`Invalid AUVRYNT_SERENA_BACKEND: ${backend}`);
+    }
+    return {
+        enabled: parseBoolean(env.AUVRYNT_SERENA_ENABLED ?? filesSerena.enabled ?? false, "AUVRYNT_SERENA_ENABLED"),
+        executable: env.AUVRYNT_SERENA_EXECUTABLE ?? env.AUVRYNT_SERENA_PATH ?? filesConfig.executables?.serena ?? filesSerena.executable ?? "serena",
+        backend,
+        context: env.AUVRYNT_SERENA_CONTEXT ?? filesSerena.context ?? "desktop-app",
+        startupTimeoutMs: parsePositiveInteger(env.AUVRYNT_SERENA_STARTUP_TIMEOUT ?? filesSerena.startupTimeoutMs, 30_000, "AUVRYNT_SERENA_STARTUP_TIMEOUT"),
+        requestTimeoutMs: parsePositiveInteger(env.AUVRYNT_SERENA_REQUEST_TIMEOUT ?? filesSerena.requestTimeoutMs, 60_000, "AUVRYNT_SERENA_REQUEST_TIMEOUT"),
+        idleTimeoutMinutes: parsePositiveInteger(env.AUVRYNT_SERENA_IDLE_TIMEOUT ?? filesSerena.idleTimeoutMinutes, 30, "AUVRYNT_SERENA_IDLE_TIMEOUT"),
+        maxInstances: parsePositiveInteger(env.AUVRYNT_SERENA_MAX_INSTANCES ?? filesSerena.maxInstances, 3, "AUVRYNT_SERENA_MAX_INSTANCES"),
+    };
+}
+function cleanExecutablePath(value) {
+    if (!value)
+        return undefined;
+    const trimmed = value.trim().replace(/^["']|["']$/g, "").trim();
+    return trimmed || undefined;
+}
+function parseExecutablesConfig(env, filesConfig) {
+    const configExecs = filesConfig.executables ?? {};
+    return {
+        serena: cleanExecutablePath(env.AUVRYNT_SERENA_PATH ?? configExecs.serena),
+        godot: cleanExecutablePath(env.AUVRYNT_GODOT_PATH ?? configExecs.godot),
+        godotCsharp: cleanExecutablePath(env.AUVRYNT_GODOT_CSHARP_PATH ?? configExecs.godotCsharp),
+        blender: cleanExecutablePath(env.AUVRYNT_BLENDER_PATH ?? configExecs.blender),
+        aseprite: cleanExecutablePath(env.AUVRYNT_ASEPRITE_PATH ?? configExecs.aseprite),
+        asepriteSource: cleanExecutablePath(env.AUVRYNT_ASEPRITE_SOURCE_PATH ?? configExecs.asepriteSource),
+    };
+}
+function parseOptionalIntegrationBoolean(value, name) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value === "boolean" || typeof value === "string")
+        return parseBoolean(value, name);
+    throw new Error(`Invalid ${name}: expected boolean`);
+}
+function parseIntegrationsConfig(env, filesConfig) {
+    const configIntegrations = filesConfig.integrations ?? {};
+    return {
+        godotGdscript: parseOptionalIntegrationBoolean(env.AUVRYNT_GODOT_GDSCRIPT_ENABLED, "AUVRYNT_GODOT_GDSCRIPT_ENABLED") ?? configIntegrations.godotGdscript ?? false,
+        godotCsharp: parseOptionalIntegrationBoolean(env.AUVRYNT_GODOT_CSHARP_ENABLED, "AUVRYNT_GODOT_CSHARP_ENABLED") ?? configIntegrations.godotCsharp ?? false,
+        blender: parseOptionalIntegrationBoolean(env.AUVRYNT_BLENDER_ENABLED, "AUVRYNT_BLENDER_ENABLED") ?? configIntegrations.blender ?? false,
+        aseprite: parseOptionalIntegrationBoolean(env.AUVRYNT_ASEPRITE_ENABLED, "AUVRYNT_ASEPRITE_ENABLED") ?? configIntegrations.aseprite ?? false,
+        serena: parseOptionalIntegrationBoolean(env.AUVRYNT_SERENA_INTEGRATION_ENABLED ?? env.AUVRYNT_SERENA_ENABLED, "AUVRYNT_SERENA_INTEGRATION_ENABLED") ?? configIntegrations.serena ?? filesConfig.serena?.enabled ?? false,
+        playwright: parseOptionalIntegrationBoolean(env.AUVRYNT_PLAYWRIGHT_ENABLED, "AUVRYNT_PLAYWRIGHT_ENABLED") ?? configIntegrations.playwright ?? false,
+        context7: parseOptionalIntegrationBoolean(env.AUVRYNT_CONTEXT7_ENABLED, "AUVRYNT_CONTEXT7_ENABLED") ?? configIntegrations.context7 ?? false,
+        obsidian: parseOptionalIntegrationBoolean(env.AUVRYNT_OBSIDIAN_ENABLED, "AUVRYNT_OBSIDIAN_ENABLED") ?? configIntegrations.obsidian ?? filesConfig.obsidian?.enabled ?? false,
+        roblox: parseOptionalIntegrationBoolean(env.AUVRYNT_ROBLOX_ENABLED, "AUVRYNT_ROBLOX_ENABLED") ?? configIntegrations.roblox ?? false,
+    };
+}
+export function loadConfig(env = process.env) {
+    const files = loadAuvryntFiles(env);
+    const integrations = parseIntegrationsConfig(env, files.config);
+    const host = env.HOST ?? files.config.host ?? "127.0.0.1";
+    const port = parsePort(env.PORT ?? files.config.port);
+    const publicBaseUrl = parsePublicBaseUrl(env.AUVRYNT_PUBLIC_BASE_URL ?? files.config.publicBaseUrl ?? localPublicBaseUrl(host, port));
+    const derivedAllowedHosts = [
+        "localhost",
+        "127.0.0.1",
+        "::1",
+        host,
+        new URL(publicBaseUrl).hostname,
+        ...(files.config.allowedHosts ?? []),
+    ];
+    return {
+        host,
+        port,
+        oauth: parseOAuthConfig(env, files.auth.ownerToken),
+        allowedRoots: parseAllowedRoots(env.AUVRYNT_ALLOWED_ROOTS ?? files.config.allowedRoots),
+        allowedHosts: parseAllowedHosts(env.AUVRYNT_ALLOWED_HOSTS, derivedAllowedHosts),
+        maxSessions: parseMcpSessionLimit(env.AUVRYNT_MAX_SESSIONS ?? files.config.maxSessions, MAX_MCP_SESSIONS, "AUVRYNT_MAX_SESSIONS"),
+        maxSessionsPerClient: parseMcpSessionLimit(env.AUVRYNT_MAX_SESSIONS_PER_CLIENT ?? files.config.maxSessionsPerClient ?? files.config.maxSessions, MAX_MCP_SESSIONS, "AUVRYNT_MAX_SESSIONS_PER_CLIENT"),
+        sessionIdleTimeoutMs: parseSessionIdleTimeout(env.AUVRYNT_SESSION_IDLE_MS ?? files.config.sessionIdleTimeoutMs, DEFAULT_SESSION_IDLE_TIMEOUT_MS, "AUVRYNT_SESSION_IDLE_MS"),
+        publicBaseUrl,
+        minimalTools: parseMinimalTools(env),
+        toolNaming: parseToolNaming(env.AUVRYNT_TOOL_NAMING),
+        widgets: parseWidgetMode(env.AUVRYNT_WIDGETS),
+        stateDir: resolve(expandHomePath(env.AUVRYNT_STATE_DIR ?? files.config.stateDir ?? defaultStateDir())),
+        worktreeRoot: resolve(expandHomePath(env.AUVRYNT_WORKTREE_ROOT ?? files.config.worktreeRoot ?? defaultWorktreeRoot())),
+        skillsEnabled: env.AUVRYNT_SKILLS === undefined ? true : parseBoolean(env.AUVRYNT_SKILLS),
+        skillPaths: parsePathList(env.AUVRYNT_SKILL_PATHS),
+        agentDir: resolve(expandHomePath(env.AUVRYNT_AGENT_DIR ?? files.config.agentDir ?? defaultAgentDir())),
+        logging: parseLoggingConfig(env),
+        serena: parseSerenaConfig(env, files.config),
+        obsidian: parseObsidianConfig(env, files.config),
+        executables: parseExecutablesConfig(env, files.config),
+        integrations,
+        tunnelProvider: parseTunnelProvider(env.AUVRYNT_TUNNEL_PROVIDER, files.config.tunnelProvider),
+        cloudflareTunnelToken: env.AUVRYNT_CLOUDFLARE_TUNNEL_TOKEN?.trim() || files.auth.cloudflareTunnelToken,
+        ngrokAuthtoken: resolveNgrokAuthtoken(files, env),
+        ngrokUrl: normalizeNgrokUrl(env.AUVRYNT_NGROK_URL ?? files.config.ngrokUrl),
+        toolToggles: files.config.toolToggles ?? {},
+    };
+}
+function isLoopbackHostname(hostname) {
+    const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    if (normalized === "localhost")
+        return true;
+    const version = isIP(normalized);
+    return (version === 4 && normalized.startsWith("127.")) || (version === 6 && normalized === "::1");
+}
+function parsePublicBaseUrl(value) {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error(`Invalid AUVRYNT_PUBLIC_BASE_URL scheme: ${parsed.protocol}`);
+    }
+    if (parsed.protocol === "http:" && !isLoopbackHostname(parsed.hostname)) {
+        throw new Error("AUVRYNT_PUBLIC_BASE_URL must use HTTPS unless it points to a loopback host.");
+    }
+    if (parsed.username || parsed.password) {
+        throw new Error("AUVRYNT_PUBLIC_BASE_URL must not contain embedded credentials.");
+    }
+    if ((parsed.pathname && parsed.pathname !== "/") || parsed.search || parsed.hash) {
+        throw new Error("AUVRYNT_PUBLIC_BASE_URL must be an origin only (scheme, host, and optional port). Do not include a path, query, or fragment.");
+    }
+    return parsed.origin;
+}
+function localPublicBaseUrl(host, port) {
+    const publicHost = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
+    const formattedHost = publicHost.includes(":") && !publicHost.startsWith("[")
+        ? `[${publicHost}]`
+        : publicHost;
+    return `http://${formattedHost}:${port}`;
+}

package/dist/infrastructure/context7-auth.js

@@ -0,0 +1,55 @@
+import { createHash } from "node:crypto";
+import { loadAuvryntFiles, writeAuvryntAuth, } from "./user-config.js";
+export function validateContext7ApiKey(value) {
+    if (typeof value !== "string")
+        throw new Error("Enter a valid Context7 API key.");
+    const key = value.trim();
+    if (key.length < 8 || key.length > 512) {
+        throw new Error("Context7 API keys must be between 8 and 512 characters.");
+    }
+    if (/\s|[\u0000-\u001f\u007f]/u.test(key)) {
+        throw new Error("Context7 API keys must not contain whitespace or control characters.");
+    }
+    return key;
+}
+export function context7ApiKeyFingerprint(key) {
+    return createHash("sha256").update(key).digest("hex").slice(0, 10).toUpperCase();
+}
+export function resolveContext7ApiKey(files = loadAuvryntFiles(), env = process.env) {
+    const override = env.AUVRYNT_CONTEXT7_API_KEY?.trim();
+    if (override)
+        return override;
+    const stored = files.auth.context7ApiKey?.trim();
+    return stored || undefined;
+}
+export function summarizeContext7Auth(files = loadAuvryntFiles(), env = process.env) {
+    const environmentOverride = Boolean(env.AUVRYNT_CONTEXT7_API_KEY?.trim());
+    const key = resolveContext7ApiKey(files, env);
+    if (!key) {
+        return { configured: false, environmentOverride };
+    }
+    return {
+        configured: true,
+        fingerprint: context7ApiKeyFingerprint(key),
+        environmentOverride,
+    };
+}
+export function setContext7ApiKey(value, env = process.env) {
+    if (env.AUVRYNT_CONTEXT7_API_KEY?.trim()) {
+        throw new Error("AUVRYNT_CONTEXT7_API_KEY is set in the environment. Remove that override before saving a key in Secrets.");
+    }
+    const key = validateContext7ApiKey(value);
+    const files = loadAuvryntFiles(env);
+    writeAuvryntAuth({ ...files.auth, context7ApiKey: key }, env);
+    return { summary: summarizeContext7Auth(loadAuvryntFiles(env), env) };
+}
+export function clearContext7ApiKey(env = process.env) {
+    if (env.AUVRYNT_CONTEXT7_API_KEY?.trim()) {
+        throw new Error("AUVRYNT_CONTEXT7_API_KEY is set in the environment. Remove that override before clearing the saved key.");
+    }
+    const files = loadAuvryntFiles(env);
+    const next = { ...files.auth };
+    delete next.context7ApiKey;
+    writeAuvryntAuth(next, env);
+    return { summary: summarizeContext7Auth(loadAuvryntFiles(env), env) };
+}