comisai 1.0.4

package/node_modules/@comis/daemon/dist/wiring/setup-gateway.js

@@ -0,0 +1,690 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Gateway setup: RPC bridge (deferred dispatch), RPC adapter wiring, dynamic
+ * method registration, webhook mounting, OpenAI-compatible route mounting,
+ * and gateway server creation/start.
+ * Extracted from daemon.ts to isolate the single
+ * largest inline block from the main wiring sequence. Covers the full
+ * gateway lifecycle from RPC bridge creation through server start.
+ * @module
+ */
+import { registerRpcMethods } from "./setup-gateway-rpc.js";
+import { mountGatewayRoutes } from "./setup-gateway-routes.js";
+import { formatSessionKey, runWithContext, safePath, createDeliveryOrigin, } from "@comis/core";
+import { suppressError } from "@comis/shared";
+import { readFileSync, existsSync } from "node:fs";
+import { parseSlashCommand, createCommandHandler, createGreetingGenerator, } from "@comis/agent";
+import { createDynamicMethodRouter, createRpcAdapters, createTokenStore, WsConnectionManager, } from "@comis/gateway";
+import { randomUUID } from "node:crypto";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createRpcDispatch, classifyRpcError } from "../rpc/rpc-dispatch.js";
+/**
+ * Create the rpcCall wrapper and deferred dispatch mechanism.
+ * The returned rpcCall can be passed to setupTools immediately. After
+ * setupMonitoring resolves the heartbeatRunner TDZ, call wireDispatch()
+ * with the full RpcDispatchDeps to wire the real dispatch function.
+ * @param deps.gatewayLogger - Logger for RPC call tracing
+ * @returns rpcCall function and wireDispatch callback
+ */
+export function setupRpcBridge(deps) {
+    const { gatewayLogger } = deps;
+    // Deferred inner dispatch -- assigned by wireDispatch() after all deps are ready
+    let rpcCallInner;
+    const rpcCall = async (method, params) => {
+        const rpcStartMs = Date.now();
+        try {
+            return await rpcCallInner(method, params);
+        }
+        catch (err) {
+            const errMsg = err instanceof Error ? err.message : String(err);
+            const classified = classifyRpcError(errMsg);
+            gatewayLogger.debug({
+                method,
+                err: errMsg,
+                durationMs: Date.now() - rpcStartMs,
+                hint: classified.hint,
+                errorKind: classified.errorKind,
+            }, "[rpcCall] failed");
+            throw err;
+        }
+    };
+    const wireDispatch = (dispatchDeps) => {
+        rpcCallInner = createRpcDispatch(dispatchDeps);
+    };
+    return { rpcCall, wireDispatch };
+}
+/**
+ * Read the pi-agent JSONL session file and extract gateway attachment markers.
+ * Returns `<!-- attachment:... -->` content strings for each successful
+ * `message.attach` tool call targeting the gateway channel type.
+ */
+function extractAttachmentMarkers(workspaceDir, agentId, channelId, logger) {
+    if (!workspaceDir)
+        return [];
+    const jsonlPath = join(workspaceDir, "sessions", agentId, channelId, "default.jsonl");
+    if (!existsSync(jsonlPath))
+        return [];
+    try {
+        const raw = readFileSync(jsonlPath, "utf-8");
+        const lines = raw.split("\n").filter(Boolean);
+        const parsed = lines.map((l) => { try {
+            return JSON.parse(l);
+        }
+        catch {
+            return null;
+        } }).filter(Boolean);
+        // Collect attachment tool calls (toolCall blocks with name "message", action "attach")
+        const attachCalls = new Map();
+        const attachResults = new Map(); // toolCallId → mediaId
+        for (const obj of parsed) {
+            if (obj.type !== "message")
+                continue;
+            const msg = obj.message;
+            if (!msg)
+                continue;
+            if (msg.role === "assistant" && Array.isArray(msg.content)) {
+                for (const block of msg.content) {
+                    if ((block.type === "toolCall" || block.type === "tool_use") && block.name === "message") {
+                        const args = block.arguments ?? block.input;
+                        if (args?.action === "attach" && args?.channel_type === "gateway") {
+                            attachCalls.set(block.id, {
+                                type: args.attachment_type ?? "file",
+                                mimeType: args.mime_type ?? "application/octet-stream",
+                                fileName: args.file_name ?? "attachment",
+                                caption: args.caption ?? "",
+                            });
+                        }
+                    }
+                }
+            }
+            if (msg.role === "toolResult" || msg.role === "tool") {
+                const toolId = msg.toolCallId ?? msg.tool_use_id;
+                if (toolId && attachCalls.has(toolId)) {
+                    let resultText = "";
+                    if (typeof msg.content === "string")
+                        resultText = msg.content;
+                    else if (Array.isArray(msg.content)) {
+                        for (const part of msg.content) {
+                            if (part.type === "text" && typeof part.text === "string")
+                                resultText += part.text;
+                        }
+                    }
+                    try {
+                        const result = JSON.parse(resultText);
+                        if (typeof result.messageId === "string") {
+                            attachResults.set(toolId, result.messageId);
+                        }
+                    }
+                    catch { /* skip */ }
+                }
+            }
+        }
+        // Build markers for resolved attachments
+        const markers = [];
+        for (const [toolId, mediaId] of attachResults) {
+            const att = attachCalls.get(toolId);
+            const url = `/media/${mediaId}`;
+            const json = JSON.stringify({ url, type: att.type, mimeType: att.mimeType, fileName: att.fileName });
+            const marker = att.caption
+                ? `${att.caption}\n\n<!-- attachment:${json} -->`
+                : `<!-- attachment:${json} -->`;
+            markers.push({ content: marker, timestamp: Date.now() });
+        }
+        if (markers.length > 0) {
+            logger.debug({ agentId, channelId, count: markers.length }, "Extracted attachment markers from JSONL session");
+        }
+        return markers;
+    }
+    catch {
+        return [];
+    }
+}
+// ---------------------------------------------------------------------------
+// Trust level derivation
+// ---------------------------------------------------------------------------
+/**
+ * Derive user trust level from token scopes.
+ * Admin scope or wildcard grants admin trust. All others default to user
+ * (fail-closed). This matches the checkScope wildcard behavior in token-auth.ts.
+ */
+export function deriveTrustLevel(scopes) {
+    if (scopes?.includes("admin") || scopes?.includes("*"))
+        return "admin";
+    return "user";
+}
+// ---------------------------------------------------------------------------
+// /config chat command handler
+// ---------------------------------------------------------------------------
+/**
+ * Handle /config chat command via RPC dispatch.
+ * Supports: show [section], set <path> <value>, history
+ */
+export async function handleConfigChatCommand(args, rpcCall, scopes) {
+    const subcommand = args[0] ?? "show";
+    try {
+        // Trust gate: config read operations require admin trust
+        if (subcommand === "show" || subcommand === "history") {
+            const trustLevel = deriveTrustLevel(scopes);
+            if (trustLevel !== "admin") {
+                return {
+                    handled: true,
+                    response: "Config read requires admin trust. Your token does not have admin scope.",
+                };
+            }
+        }
+        if (subcommand === "show") {
+            const section = args[1];
+            const result = await rpcCall("config.read", { section });
+            if (section) {
+                // Format single section as key: value pairs
+                const lines = [`**Config: ${section}**`, ""];
+                for (const [key, value] of Object.entries(result)) {
+                    const display = typeof value === "object" ? JSON.stringify(value) : String(value);
+                    lines.push(`${key}: ${display}`);
+                }
+                return { handled: true, response: lines.join("\n") };
+            }
+            // Full config: list sections with key counts
+            const config = result.config;
+            const sections = result.sections;
+            const lines = ["**Config Sections**", ""];
+            for (const sec of sections) {
+                const sectionData = config[sec];
+                const keyCount = sectionData && typeof sectionData === "object" ? Object.keys(sectionData).length : 0;
+                lines.push(`${sec} (${keyCount} keys)`);
+            }
+            return { handled: true, response: lines.join("\n") };
+        }
+        if (subcommand === "set") {
+            // Trust gate: only admin trust can modify config
+            const trustLevel = deriveTrustLevel(scopes);
+            if (trustLevel !== "admin") {
+                return { handled: true, response: "Config modification requires admin trust. Your token does not have admin scope." };
+            }
+            const path = args[1];
+            const rawValue = args.slice(2).join(" ");
+            if (!path || !rawValue) {
+                return { handled: true, response: "Usage: /config set <section.key> <value>" };
+            }
+            const dotIdx = path.indexOf(".");
+            if (dotIdx === -1) {
+                return { handled: true, response: "Path must include section.key (e.g., agent.budget.maxTokens)" };
+            }
+            const section = path.slice(0, dotIdx);
+            const key = path.slice(dotIdx + 1);
+            let value;
+            try {
+                value = JSON.parse(rawValue);
+            }
+            catch {
+                value = rawValue;
+            }
+            const patchResult = await rpcCall("config.patch", { section, key, value, _trustLevel: trustLevel });
+            if (patchResult.patched) {
+                return { handled: true, response: `Config updated: ${path} = ${JSON.stringify(value)}. Daemon is restarting.` };
+            }
+            return { handled: true, response: "Config update failed" };
+        }
+        if (subcommand === "history") {
+            const result = await rpcCall("config.history", { limit: 5 });
+            if (result.error) {
+                return { handled: true, response: result.error };
+            }
+            if (!result.entries || result.entries.length === 0) {
+                return { handled: true, response: "No config history found" };
+            }
+            const lines = ["**Config History**", ""];
+            for (const entry of result.entries) {
+                const sha = entry.sha.slice(0, 7);
+                const date = new Date(entry.date).toLocaleString();
+                lines.push(`${sha} | ${date} | ${entry.message}`);
+            }
+            return { handled: true, response: lines.join("\n") };
+        }
+        return { handled: true, response: `Unknown config subcommand: ${subcommand}. Available: show, set, history` };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { handled: true, response: `Config command failed: ${msg}` };
+    }
+}
+// ---------------------------------------------------------------------------
+// Setup function
+// ---------------------------------------------------------------------------
+/**
+ * Set up the gateway server: RPC adapters, dynamic method router, webhooks,
+ * OpenAI-compatible routes, and server start.
+ * @param deps - Gateway dependencies (all services the gateway block needs)
+ * @returns Gateway handle and active execution tracker
+ */
+export async function setupGateway(deps) {
+    const { container, gwConfig, webhooksConfig, agents, defaultAgentId, configPaths, gatewayLogger, embeddingQueue: _embeddingQueue, memoryAdapter: _memoryAdapter, memoryApi, cachedPort, sessionStore, getExecutor, assembleToolsForAgent, preprocessMessageText, rpcCall, costTrackers, workspaceDirs, _createGatewayServer, piSessionAdapters, instanceId, startupStartMs, } = deps;
+    // Track in-flight gateway executions for shutdown observability
+    const activeExecutions = new Map();
+    if (!gwConfig.enabled) {
+        return { gatewayHandle: undefined, activeExecutions, getActiveConnectionCount: () => 0, wsConnections: new WsConnectionManager() };
+    }
+    // Use pre-resolved tokens (with secrets from config/env/auto-gen)
+    const tokensForStore = deps.resolvedTokens;
+    const tokenStore = createTokenStore(tokensForStore);
+    const wsConnections = new WsConnectionManager();
+    // Create greeting generator for LLM-powered session reset messages
+    let greetingGenerator;
+    const defaultConfig = agents[defaultAgentId];
+    if (defaultConfig) {
+        const greetingApiKey = container.secretManager.get(`${defaultConfig.provider.toUpperCase()}_API_KEY`) ?? "";
+        if (greetingApiKey) {
+            greetingGenerator = createGreetingGenerator({
+                provider: defaultConfig.provider,
+                modelId: defaultConfig.model,
+                apiKey: greetingApiKey,
+                timeoutMs: 5000,
+            });
+        }
+    }
+    // Create RPC adapter deps wired to real memory and agent services.
+    const rpcAdapterDeps = {
+        isValidAgentId: (agentId) => !!agents[agentId],
+        executeAgent: async (params) => {
+            // Resolve agent ID from params or default
+            const requestedAgentId = params.agentId ?? defaultAgentId;
+            // Fall back to default agent if the requested agent is unknown (getExecutor also falls back)
+            const execAgentId = agents[requestedAgentId] ? requestedAgentId : defaultAgentId;
+            const connectionId = params.connectionId;
+            // Derive trust level from token scopes.
+            // Admin scope or wildcard -> admin trust; otherwise -> user trust (fail-closed).
+            const trustLevel = deriveTrustLevel(params.scopes);
+            gatewayLogger.debug({ scopes: params.scopes, trustLevel, agentId: execAgentId }, "Trust level derived from token scopes");
+            const rawMsg = params.message ?? "";
+            const truncated = rawMsg.length > 200;
+            gatewayLogger.info({
+                agentId: execAgentId,
+                message: rawMsg.slice(0, 200),
+                ...(truncated && { messageTruncated: true }),
+                ...(connectionId && { connectionId }),
+            }, "Agent execution requested");
+            // Link understanding preprocessing: enrich message text with fetched URL content
+            const enrichedText = await preprocessMessageText(params.message);
+            const msg = {
+                id: randomUUID(),
+                channelId: params.sessionKey?.channelId ?? "gateway",
+                channelType: "gateway",
+                senderId: params.sessionKey?.peerId ?? "rpc-client",
+                text: enrichedText,
+                timestamp: Date.now(),
+                attachments: [],
+                metadata: {},
+            };
+            const sk = {
+                tenantId: container.config.tenantId,
+                userId: params.sessionKey?.userId ?? "rpc-client",
+                channelId: params.sessionKey?.channelId ?? "gateway",
+            };
+            // Wrap in runWithContext so traceId propagates to all downstream logs
+            return runWithContext({
+                traceId: randomUUID(),
+                tenantId: sk.tenantId,
+                userId: sk.userId,
+                sessionKey: formatSessionKey(sk),
+                startedAt: Date.now(),
+                trustLevel,
+                deliveryOrigin: createDeliveryOrigin({
+                    channelType: "gateway",
+                    channelId: sk.channelId,
+                    userId: sk.userId,
+                    tenantId: sk.tenantId,
+                }),
+            }, async () => {
+                // Assemble per-agent tools via three-tier pipeline (builtin + platform + skills)
+                const tools = await assembleToolsForAgent(execAgentId);
+                gatewayLogger.debug({ agentId: execAgentId, toolCount: tools.length, ...(connectionId && { connectionId }) }, "Tools assembled for agent");
+                const execStartMs = Date.now();
+                const execKey = msg.id;
+                activeExecutions.set(execKey, { agentId: execAgentId, startedAt: execStartMs });
+                let result;
+                try {
+                    result = await getExecutor(execAgentId).execute(msg, sk, tools, params.onDelta, execAgentId, params.directives);
+                }
+                finally {
+                    activeExecutions.delete(execKey);
+                }
+                gatewayLogger.debug({
+                    agentId: execAgentId,
+                    durationMs: Date.now() - execStartMs,
+                    tokensIn: result.tokensUsed.input,
+                    tokensOut: result.tokensUsed.output,
+                    tokensTotal: result.tokensUsed.total,
+                    finishReason: result.finishReason,
+                    responseLen: result.response?.length ?? 0,
+                    toolCalls: result.stepsExecuted,
+                    llmCalls: result.llmCalls,
+                    sessionKey: formatSessionKey(sk),
+                    estimatedCostUsd: result.cost.total,
+                    ...(connectionId && { connectionId }),
+                }, "Agent execution complete");
+                // Bridge session history: persist conversation turn to SQLite sessionStore
+                // so that session.history RPC and REST /chat/history can read it.
+                // Also extract gateway attachment tool calls from the JSONL session so
+                // that images/files persist across page navigations.
+                try {
+                    const existingSession = sessionStore.load(sk);
+                    const messages = existingSession?.messages ?? [];
+                    messages.push({ role: "user", content: msg.text, timestamp: msg.timestamp });
+                    // Extract attachment markers from JSONL session (if available)
+                    const attachmentMarkers = extractAttachmentMarkers(workspaceDirs.get(execAgentId), execAgentId, sk.channelId, gatewayLogger);
+                    // Deduplicate: only insert markers whose /media/ URL is not already in existing messages
+                    const existingText = messages.map((m) => m.content ?? "").join("\n");
+                    for (const marker of attachmentMarkers) {
+                        // Extract the /media/... URL from the marker to check for duplicates
+                        const urlMatch = marker.content.match(/\/media\/[^"]+/);
+                        if (urlMatch && existingText.includes(urlMatch[0]))
+                            continue;
+                        messages.push({ role: "assistant", content: marker.content, timestamp: marker.timestamp });
+                    }
+                    if (result.response) {
+                        messages.push({ role: "assistant", content: result.response, timestamp: Date.now() });
+                    }
+                    sessionStore.save(sk, messages);
+                    gatewayLogger.debug({ agentId: execAgentId, sessionKey: formatSessionKey(sk), messageCount: messages.length, attachments: attachmentMarkers.length }, "Session history bridged to SQLite store");
+                }
+                catch {
+                    // Session history bridging is non-fatal
+                }
+                // Token usage now captured by tokenTracker's bus subscription (quick-138):
+                // PiEventBridge emits observability:token_usage at turn_end -> tokenTracker
+                // bus handler stores it. No direct record() call needed here.
+                // Conversation memory persistence now handled by PiExecutor
+                // Emit message events for activity tracking (REST/WebSocket parity with channels)
+                container.eventBus.emit("message:received", { message: msg, sessionKey: sk });
+                if (result.response) {
+                    container.eventBus.emit("message:sent", {
+                        channelId: sk.channelId,
+                        messageId: randomUUID(),
+                        content: result.response,
+                    });
+                }
+                return {
+                    response: result.response,
+                    tokensUsed: result.tokensUsed,
+                    finishReason: result.finishReason,
+                    sessionKey: params.sessionKey?.channelId ?? "gateway",
+                };
+            });
+        },
+        searchMemory: async (params) => {
+            const results = await memoryApi.search(params.query, {
+                limit: params.limit,
+                tenantId: params.tenantId ?? container.config.tenantId,
+            });
+            return {
+                results: results.map((r) => ({
+                    id: r.entry.id,
+                    content: r.entry.content,
+                    memoryType: r.entry.memoryType ?? "semantic",
+                    trustLevel: r.entry.trustLevel,
+                    score: r.score ?? 0,
+                    createdAt: r.entry.createdAt,
+                })),
+            };
+        },
+        inspectMemory: async (params) => {
+            if (params.id) {
+                const entries = memoryApi.inspect({ limit: 1 });
+                const entry = entries.find((e) => e.id === params.id);
+                return {
+                    entry: entry
+                        ? {
+                            id: entry.id,
+                            content: entry.content,
+                            trustLevel: entry.trustLevel,
+                            createdAt: entry.createdAt,
+                        }
+                        : undefined,
+                };
+            }
+            const stats = memoryApi.stats(params.tenantId ?? container.config.tenantId);
+            return { stats: stats };
+        },
+        getConfig: async (params) => {
+            // Return sanitized config (no secrets)
+            const section = params?.section;
+            if (section && section in container.config) {
+                return { [section]: container.config[section] };
+            }
+            return {
+                tenantId: container.config.tenantId,
+                logLevel: container.config.logLevel,
+                gateway: { enabled: gwConfig.enabled, host: gwConfig.host, port: gwConfig.port },
+            };
+        },
+        getSessionHistory: async (params) => {
+            const sk = {
+                tenantId: container.config.tenantId,
+                userId: "rpc-client",
+                channelId: params.channelId ?? "gateway",
+            };
+            const data = sessionStore.load(sk);
+            if (!data) {
+                return { messages: [] };
+            }
+            // Extract user/assistant messages from pi-agent-core format
+            const messages = [];
+            for (const msg of data.messages) {
+                const m = msg;
+                const role = m.role;
+                if (role !== "user" && role !== "assistant")
+                    continue;
+                // Extract text content from content array or string
+                let text = "";
+                if (typeof m.content === "string") {
+                    text = m.content;
+                }
+                else if (Array.isArray(m.content)) {
+                    for (const part of m.content) {
+                        if (part.type === "text" && typeof part.text === "string") {
+                            text += part.text;
+                        }
+                    }
+                }
+                if (text) {
+                    messages.push({
+                        role,
+                        content: text,
+                        timestamp: m.timestamp ?? data.updatedAt,
+                    });
+                }
+            }
+            return { messages };
+        },
+        setConfig: async (params) => {
+            // Forward to config.patch RPC handler (handles validation, rate limiting, persistence)
+            const result = await rpcCall("config.patch", {
+                section: params.section,
+                key: params.key,
+                value: params.value,
+                _trustLevel: "admin",
+            });
+            return { ok: result.ok !== false, previous: result.previous };
+        },
+        handleSlashCommand: async (params) => {
+            const execAgentId = params.agentId ?? defaultAgentId;
+            const execAgentConfig = agents[execAgentId] ?? agents[defaultAgentId];
+            const sk = {
+                tenantId: container.config.tenantId,
+                userId: params.sessionKey?.userId ?? "rpc-client",
+                channelId: params.sessionKey?.channelId ?? "gateway",
+            };
+            const parsed = parseSlashCommand(params.message);
+            if (!parsed.found)
+                return { handled: false };
+            // Handle /config command
+            if (parsed.command === "config") {
+                return handleConfigChatCommand(parsed.args, rpcCall, params.scopes);
+            }
+            // getAvailableThinkingLevels is intentionally not provided here: at RPC gateway
+            // time no AgentSession exists yet (created inside executor). Command-handler falls
+            // back to hardcoded set for pre-session validation. SDK-native clamping happens
+            // post-session via session.setThinkingLevel() in the executor.
+            const cmdDeps = {
+                getSessionInfo: (key) => {
+                    const adapter = piSessionAdapters?.get(execAgentId);
+                    if (adapter) {
+                        const stats = adapter.getSessionStats(key);
+                        return {
+                            messageCount: stats?.messageCount ?? 0,
+                            createdAt: stats?.createdAt,
+                            tokensUsed: stats?.tokens,
+                        };
+                    }
+                    return { messageCount: 0 };
+                },
+                getAgentConfig: () => ({
+                    name: execAgentConfig?.name ?? "Unknown",
+                    model: execAgentConfig?.model ?? "unknown",
+                    provider: execAgentConfig?.provider ?? "unknown",
+                    maxSteps: execAgentConfig?.maxSteps ?? 10,
+                }),
+                destroySession: (key) => {
+                    const adapter = piSessionAdapters?.get(execAgentId);
+                    if (adapter) {
+                        suppressError(adapter.destroySession(key), "fire-and-forget session destroy");
+                        return;
+                    }
+                },
+                getAvailableModels: () => [],
+                getUsageBreakdown: () => {
+                    const tracker = costTrackers.get(execAgentId) ?? costTrackers.get(defaultAgentId);
+                    return tracker?.getByProvider() ?? [];
+                },
+                getSessionCost: (key) => {
+                    const tracker = costTrackers.get(execAgentId) ?? costTrackers.get(defaultAgentId);
+                    return tracker?.getBySession(formatSessionKey(key)) ?? { totalTokens: 0, totalCost: 0 };
+                },
+                getBootstrapInfo: () => {
+                    const wsDir = workspaceDirs.get(execAgentId);
+                    if (!wsDir)
+                        return [];
+                    const NAMES = ["SOUL.md", "IDENTITY.md", "USER.md", "AGENTS.md", "TOOLS.md", "HEARTBEAT.md", "BOOTSTRAP.md"];
+                    const results = [];
+                    for (const name of NAMES) {
+                        try {
+                            const filePath = safePath(wsDir, name);
+                            const content = readFileSync(filePath, "utf-8");
+                            results.push({ name, sizeChars: content.length });
+                        }
+                        catch { /* file missing, skip */ }
+                    }
+                    return results;
+                },
+                getToolInfo: () => {
+                    // Tool schemas are assembled async; not available synchronously here.
+                    // Return empty — /context will show "Tool schemas: Not available".
+                    return [];
+                },
+                getSDKSessionStats: (key) => {
+                    const adapter = piSessionAdapters?.get(execAgentId);
+                    if (!adapter)
+                        return undefined;
+                    const stats = adapter.getSessionStats(key);
+                    if (!stats)
+                        return undefined;
+                    return {
+                        userMessages: stats.userMessages ?? 0,
+                        assistantMessages: stats.assistantMessages ?? 0,
+                        toolCalls: stats.toolCalls ?? 0,
+                        toolResults: stats.toolResults ?? 0,
+                        totalMessages: stats.messageCount,
+                        tokens: {
+                            input: stats.tokens?.input ?? 0,
+                            output: stats.tokens?.output ?? 0,
+                            cacheRead: stats.tokens?.cacheRead ?? 0,
+                            cacheWrite: stats.tokens?.cacheWrite ?? 0,
+                            total: stats.tokens?.total ?? 0,
+                        },
+                        cost: stats.cost ?? 0,
+                    };
+                },
+                getContextUsage: (_key) => {
+                    // Context usage requires a live AgentSession which isn't available
+                    // outside execution. Return undefined -- /status will show "N/A".
+                    // During execution, live context usage is tracked by the PiEventBridge
+                    // context guard. Between executions, showing N/A
+                    // is acceptable since context is only meaningful during active sessions.
+                    return undefined;
+                },
+                getBudgetInfo: () => {
+                    // Budget config stores token limits, not dollar amounts.
+                    // Return undefined until we have token-to-cost estimation wiring.
+                    // Future: convert via cost-per-token rates from provider config.
+                    return undefined;
+                },
+            };
+            const handler = createCommandHandler(cmdDeps);
+            const result = handler.handle(parsed, sk);
+            // If session reset command succeeded, try LLM greeting
+            if (result.handled && (parsed.command === "new" || parsed.command === "reset") && greetingGenerator) {
+                const greetingAgentConfig = agents[params.agentId ?? defaultAgentId] ?? agents[defaultAgentId];
+                const greetingResult = await greetingGenerator.generate(greetingAgentConfig?.name ?? "Comis");
+                if (greetingResult.ok) {
+                    return { handled: true, response: greetingResult.value };
+                }
+                // Fallback to static string on LLM failure
+            }
+            return { handled: result.handled, response: result.response, directives: result.directives };
+        },
+        logger: gatewayLogger,
+    };
+    const dynamicRouter = createDynamicMethodRouter(createRpcAdapters(rpcAdapterDeps), gatewayLogger);
+    // Register all RPC methods as gateway-to-rpcCall passthroughs.
+    // All business logic is in domain handler modules (rpc/*.ts) via rpc-dispatch.
+    // skill/audio/config/ping handlers extracted to domain modules.
+    registerRpcMethods({
+        dynamicRouter,
+        container,
+        configPaths,
+        rpcCall,
+    });
+    const rpcServer = dynamicRouter.server;
+    // Resolve web dist path relative to daemon package
+    // setup-gateway.ts is in wiring/ subdir, so go up 3 levels: wiring/ -> src/ -> daemon/ -> web/dist
+    const __dirname = dirname(fileURLToPath(import.meta.url));
+    const webDistPath = resolve(__dirname, "../../../web/dist");
+    const gatewayHandle = _createGatewayServer({
+        config: gwConfig,
+        logger: gatewayLogger,
+        tokenStore,
+        rpcServer,
+        wsConnections,
+        webDeps: {
+            eventBus: container.eventBus,
+            rpcAdapterDeps,
+            webDistPath,
+            suspendedAgents: deps.suspendedAgents,
+        },
+        fingerprint: {
+            instanceId,
+            startedAt: new Date(startupStartMs).toISOString(),
+        },
+    });
+    // Mount all HTTP routes (webhooks, media, OpenAI-compatible API)
+    mountGatewayRoutes({
+        gatewayHandle,
+        webhooksConfig,
+        container,
+        defaultAgentId,
+        agents,
+        gatewayLogger,
+        gwConfig,
+        tokenStore,
+        getExecutor,
+        assembleToolsForAgent,
+        preprocessMessageText,
+        cachedPort,
+        workspaceDirs,
+        defaultWorkspaceDir: workspaceDirs.get(defaultAgentId),
+    });
+    await gatewayHandle.start();
+    gatewayLogger.debug({ host: gwConfig.host, port: gwConfig.port }, "Gateway server started");
+    return { gatewayHandle, activeExecutions, getActiveConnectionCount: () => wsConnections.size, wsConnections };
+}