conductor-oss 0.2.20 → 0.3.1

package/web/.next/standalone/packages/web/.next/static/chunks/e8d146cc2723147b.js

@@ -0,0 +1 @@
+(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,81140,e=>{"use strict";function t(e,r,{checkForDefaultPrevented:n=!0}={}){return function(t){if(e?.(t),!1===n||!t.defaultPrevented)return r?.(t)}}"u">typeof window&&window.document&&window.document.createElement,e.s(["composeEventHandlers",()=>t])},20783,e=>{"use strict";var t=e.i(71645);function r(e,t){if("function"==typeof e)return e(t);null!=e&&(e.current=t)}function n(...e){return t=>{let n=!1,i=e.map(e=>{let i=r(e,t);return n||"function"!=typeof i||(n=!0),i});if(n)return()=>{for(let t=0;t<i.length;t++){let n=i[t];"function"==typeof n?n():r(e[t],null)}}}}function i(...e){return t.useCallback(n(...e),e)}e.s(["composeRefs",()=>n,"useComposedRefs",()=>i])},30030,e=>{"use strict";var t=e.i(71645),r=e.i(18050);function n(e,i=[]){let o=[],s=()=>{let r=o.map(e=>t.createContext(e));return function(n){let i=n?.[e]||r;return t.useMemo(()=>({[`__scope${e}`]:{...n,[e]:i}}),[n,i])}};return s.scopeName=e,[function(n,i){let s=t.createContext(i),a=o.length;o=[...o,i];let l=n=>{let{scope:i,children:o,...l}=n,u=i?.[e]?.[a]||s,c=t.useMemo(()=>l,Object.values(l));return(0,r.jsx)(u.Provider,{value:c,children:o})};return l.displayName=n+"Provider",[l,function(r,o){let l=o?.[e]?.[a]||s,u=t.useContext(l);if(u)return u;if(void 0!==i)return i;throw Error(`\`${r}\` must be used within \`${n}\``)}]},function(...e){let r=e[0];if(1===e.length)return r;let n=()=>{let n=e.map(e=>({useScope:e(),scopeName:e.scopeName}));return function(e){let i=n.reduce((t,{useScope:r,scopeName:n})=>{let i=r(e)[`__scope${n}`];return{...t,...i}},{});return t.useMemo(()=>({[`__scope${r.scopeName}`]:i}),[i])}};return n.scopeName=r.scopeName,n}(s,...i)]}e.s(["createContextScope",()=>n])},34620,e=>{"use strict";var t=e.i(71645),r=globalThis?.document?t.useLayoutEffect:()=>{};e.s(["useLayoutEffect",()=>r])},69340,e=>{"use strict";var t=e.i(71645),r=e.i(34620);t[" useEffectEvent ".trim().toString()],t[" useInsertionEffect ".trim().toString()];var n=t[" useInsertionEffect ".trim().toString()]||r.useLayoutEffect;function i({prop:e,defaultProp:r,onChange:i=()=>{},caller:o}){let[s,a,l]=function({defaultProp:e,onChange:r}){let[i,o]=t.useState(e),s=t.useRef(i),a=t.useRef(r);return n(()=>{a.current=r},[r]),t.useEffect(()=>{s.current!==i&&(a.current?.(i),s.current=i)},[i,s]),[i,o,a]}({defaultProp:r,onChange:i}),u=void 0!==e,c=u?e:s;{let r=t.useRef(void 0!==e);t.useEffect(()=>{let e=r.current;if(e!==u){let t=u?"controlled":"uncontrolled";console.warn(`${o} is changing from ${e?"controlled":"uncontrolled"} to ${t}. Components should not switch from controlled to uncontrolled (or vice versa). Decide between using a controlled or uncontrolled value for the lifetime of the component.`)}r.current=u},[u,o])}return[c,t.useCallback(t=>{if(u){let r="function"==typeof t?t(e):t;r!==e&&l.current?.(r)}else a(t)},[u,e,a,l])]}Symbol("RADIX:SYNC_STATE"),e.s(["useControllableState",()=>i],69340)},48425,e=>{"use strict";var t=e.i(71645),r=e.i(74080),n=e.i(20783),i=e.i(18050),o=Symbol("radix.slottable");function s(e){return t.isValidElement(e)&&"function"==typeof e.type&&"__radixId"in e.type&&e.type.__radixId===o}var a=["a","button","div","form","h2","h3","img","input","label","li","nav","ol","p","select","span","svg","ul"].reduce((e,r)=>{var o,a;let l,u,c,d=(a=o=`Primitive.${r}`,(l=t.forwardRef((e,r)=>{let{children:i,...o}=e;if(t.isValidElement(i)){var s;let e,a,l=(s=i,(a=(e=Object.getOwnPropertyDescriptor(s.props,"ref")?.get)&&"isReactWarning"in e&&e.isReactWarning)?s.ref:(a=(e=Object.getOwnPropertyDescriptor(s,"ref")?.get)&&"isReactWarning"in e&&e.isReactWarning)?s.props.ref:s.props.ref||s.ref),u=function(e,t){let r={...t};for(let n in t){let i=e[n],o=t[n];/^on[A-Z]/.test(n)?i&&o?r[n]=(...e)=>{let t=o(...e);return i(...e),t}:i&&(r[n]=i):"style"===n?r[n]={...i,...o}:"className"===n&&(r[n]=[i,o].filter(Boolean).join(" "))}return{...e,...r}}(o,i.props);return i.type!==t.Fragment&&(u.ref=r?(0,n.composeRefs)(r,l):l),t.cloneElement(i,u)}return t.Children.count(i)>1?t.Children.only(null):null})).displayName=`${a}.SlotClone`,u=l,(c=t.forwardRef((e,r)=>{let{children:n,...o}=e,a=t.Children.toArray(n),l=a.find(s);if(l){let e=l.props.children,n=a.map(r=>r!==l?r:t.Children.count(e)>1?t.Children.only(null):t.isValidElement(e)?e.props.children:null);return(0,i.jsx)(u,{...o,ref:r,children:t.isValidElement(e)?t.cloneElement(e,void 0,n):null})}return(0,i.jsx)(u,{...o,ref:r,children:n})})).displayName=`${o}.Slot`,c),f=t.forwardRef((e,t)=>{let{asChild:n,...o}=e;return"u">typeof window&&(window[Symbol.for("radix-ui")]=!0),(0,i.jsx)(n?d:r,{...o,ref:t})});return f.displayName=`Primitive.${r}`,{...e,[r]:f}},{});function l(e,t){e&&r.flushSync(()=>e.dispatchEvent(t))}e.s(["Primitive",()=>a,"dispatchDiscreteCustomEvent",()=>l],48425)},75830,e=>{"use strict";var t=e.i(71645),r=e.i(30030),n=e.i(20783),i=e.i(18050);function o(e){var r;let o,s=(r=e,(o=t.forwardRef((e,r)=>{let{children:i,...o}=e;if(t.isValidElement(i)){var s;let e,a,l=(s=i,(a=(e=Object.getOwnPropertyDescriptor(s.props,"ref")?.get)&&"isReactWarning"in e&&e.isReactWarning)?s.ref:(a=(e=Object.getOwnPropertyDescriptor(s,"ref")?.get)&&"isReactWarning"in e&&e.isReactWarning)?s.props.ref:s.props.ref||s.ref),u=function(e,t){let r={...t};for(let n in t){let i=e[n],o=t[n];/^on[A-Z]/.test(n)?i&&o?r[n]=(...e)=>{let t=o(...e);return i(...e),t}:i&&(r[n]=i):"style"===n?r[n]={...i,...o}:"className"===n&&(r[n]=[i,o].filter(Boolean).join(" "))}return{...e,...r}}(o,i.props);return i.type!==t.Fragment&&(u.ref=r?(0,n.composeRefs)(r,l):l),t.cloneElement(i,u)}return t.Children.count(i)>1?t.Children.only(null):null})).displayName=`${r}.SlotClone`,o),l=t.forwardRef((e,r)=>{let{children:n,...o}=e,l=t.Children.toArray(n),u=l.find(a);if(u){let e=u.props.children,n=l.map(r=>r!==u?r:t.Children.count(e)>1?t.Children.only(null):t.isValidElement(e)?e.props.children:null);return(0,i.jsx)(s,{...o,ref:r,children:t.isValidElement(e)?t.cloneElement(e,void 0,n):null})}return(0,i.jsx)(s,{...o,ref:r,children:n})});return l.displayName=`${e}.Slot`,l}var s=Symbol("radix.slottable");function a(e){return t.isValidElement(e)&&"function"==typeof e.type&&"__radixId"in e.type&&e.type.__radixId===s}function l(e){let s=e+"CollectionProvider",[a,l]=(0,r.createContextScope)(s),[u,c]=a(s,{collectionRef:{current:null},itemMap:new Map}),d=e=>{let{scope:r,children:n}=e,o=t.default.useRef(null),s=t.default.useRef(new Map).current;return(0,i.jsx)(u,{scope:r,itemMap:s,collectionRef:o,children:n})};d.displayName=s;let f=e+"CollectionSlot",p=o(f),m=t.default.forwardRef((e,t)=>{let{scope:r,children:o}=e,s=c(f,r),a=(0,n.useComposedRefs)(t,s.collectionRef);return(0,i.jsx)(p,{ref:a,children:o})});m.displayName=f;let h=e+"CollectionItemSlot",g="data-radix-collection-item",y=o(h),v=t.default.forwardRef((e,r)=>{let{scope:o,children:s,...a}=e,l=t.default.useRef(null),u=(0,n.useComposedRefs)(r,l),d=c(h,o);return t.default.useEffect(()=>(d.itemMap.set(l,{ref:l,...a}),()=>void d.itemMap.delete(l))),(0,i.jsx)(y,{...{[g]:""},ref:u,children:s})});return v.displayName=h,[{Provider:d,Slot:m,ItemSlot:v},function(r){let n=c(e+"CollectionConsumer",r);return t.default.useCallback(()=>{let e=n.collectionRef.current;if(!e)return[];let t=Array.from(e.querySelectorAll(`[${g}]`));return Array.from(n.itemMap.values()).sort((e,r)=>t.indexOf(e.ref.current)-t.indexOf(r.ref.current))},[n.collectionRef,n.itemMap])},l]}var u=new WeakMap;function c(e,t){var r,n;let i,o,s;if("at"in Array.prototype)return Array.prototype.at.call(e,t);let a=(r=e,n=t,i=r.length,(s=(o=d(n))>=0?o:i+o)<0||s>=i?-1:s);return -1===a?void 0:e[a]}function d(e){return e!=e||0===e?0:Math.trunc(e)}(class e extends Map{#e;constructor(e){super(e),this.#e=[...super.keys()],u.set(this,!0)}set(e,t){return u.get(this)&&(this.has(e)?this.#e[this.#e.indexOf(e)]=e:this.#e.push(e)),super.set(e,t),this}insert(e,t,r){let n,i=this.has(t),o=this.#e.length,s=d(e),a=s>=0?s:o+s,l=a<0||a>=o?-1:a;if(l===this.size||i&&l===this.size-1||-1===l)return this.set(t,r),this;let u=this.size+ +!i;s<0&&a++;let c=[...this.#e],f=!1;for(let e=a;e<u;e++)if(a===e){let o=c[e];c[e]===t&&(o=c[e+1]),i&&this.delete(t),n=this.get(o),this.set(t,r)}else{f||c[e-1]!==t||(f=!0);let r=c[f?e:e-1],i=n;n=this.get(r),this.delete(r),this.set(r,i)}return this}with(t,r,n){let i=new e(this);return i.insert(t,r,n),i}before(e){let t=this.#e.indexOf(e)-1;if(!(t<0))return this.entryAt(t)}setBefore(e,t,r){let n=this.#e.indexOf(e);return -1===n?this:this.insert(n,t,r)}after(e){let t=this.#e.indexOf(e);if(-1!==(t=-1===t||t===this.size-1?-1:t+1))return this.entryAt(t)}setAfter(e,t,r){let n=this.#e.indexOf(e);return -1===n?this:this.insert(n+1,t,r)}first(){return this.entryAt(0)}last(){return this.entryAt(-1)}clear(){return this.#e=[],super.clear()}delete(e){let t=super.delete(e);return t&&this.#e.splice(this.#e.indexOf(e),1),t}deleteAt(e){let t=this.keyAt(e);return void 0!==t&&this.delete(t)}at(e){let t=c(this.#e,e);if(void 0!==t)return this.get(t)}entryAt(e){let t=c(this.#e,e);if(void 0!==t)return[t,this.get(t)]}indexOf(e){return this.#e.indexOf(e)}keyAt(e){return c(this.#e,e)}from(e,t){let r=this.indexOf(e);if(-1===r)return;let n=r+t;return n<0&&(n=0),n>=this.size&&(n=this.size-1),this.at(n)}keyFrom(e,t){let r=this.indexOf(e);if(-1===r)return;let n=r+t;return n<0&&(n=0),n>=this.size&&(n=this.size-1),this.keyAt(n)}find(e,t){let r=0;for(let n of this){if(Reflect.apply(e,t,[n,r,this]))return n;r++}}findIndex(e,t){let r=0;for(let n of this){if(Reflect.apply(e,t,[n,r,this]))return r;r++}return -1}filter(t,r){let n=[],i=0;for(let e of this)Reflect.apply(t,r,[e,i,this])&&n.push(e),i++;return new e(n)}map(t,r){let n=[],i=0;for(let e of this)n.push([e[0],Reflect.apply(t,r,[e,i,this])]),i++;return new e(n)}reduce(...e){let[t,r]=e,n=0,i=r??this.at(0);for(let r of this)i=0===n&&1===e.length?r:Reflect.apply(t,this,[i,r,n,this]),n++;return i}reduceRight(...e){let[t,r]=e,n=r??this.at(-1);for(let r=this.size-1;r>=0;r--){let i=this.at(r);n=r===this.size-1&&1===e.length?i:Reflect.apply(t,this,[n,i,r,this])}return n}toSorted(t){return new e([...this.entries()].sort(t))}toReversed(){let t=new e;for(let e=this.size-1;e>=0;e--){let r=this.keyAt(e),n=this.get(r);t.set(r,n)}return t}toSpliced(...t){let r=[...this.entries()];return r.splice(...t),new e(r)}slice(t,r){let n=new e,i=this.size-1;if(void 0===t)return n;t<0&&(t+=this.size),void 0!==r&&r>0&&(i=r-1);for(let e=t;e<=i;e++){let t=this.keyAt(e),r=this.get(t);n.set(t,r)}return n}every(e,t){let r=0;for(let n of this){if(!Reflect.apply(e,t,[n,r,this]))return!1;r++}return!0}some(e,t){let r=0;for(let n of this){if(Reflect.apply(e,t,[n,r,this]))return!0;r++}return!1}}),e.s(["createCollection",()=>l],75830)},86318,e=>{"use strict";var t=e.i(71645);e.i(18050);var r=t.createContext(void 0);function n(e){let n=t.useContext(r);return e||n||"ltr"}e.s(["useDirection",()=>n])},30207,e=>{"use strict";var t=e.i(71645);function r(e){let r=t.useRef(e);return t.useEffect(()=>{r.current=e}),t.useMemo(()=>(...e)=>r.current?.(...e),[])}e.s(["useCallbackRef",()=>r])},10772,e=>{"use strict";var t=e.i(71645),r=e.i(34620),n=t[" useId ".trim().toString()]||(()=>void 0),i=0;function o(e){let[o,s]=t.useState(n());return(0,r.useLayoutEffect)(()=>{e||s(e=>e??String(i++))},[e]),e||(o?`radix-${o}`:"")}e.s(["useId",()=>o])},96626,e=>{"use strict";var t=e.i(71645),r=e.i(20783),n=e.i(34620),i=e=>{var i;let s,a,{present:l,children:u}=e,c=function(e){var r,i;let[s,a]=t.useState(),l=t.useRef(null),u=t.useRef(e),c=t.useRef("none"),[d,f]=(r=e?"mounted":"unmounted",i={mounted:{UNMOUNT:"unmounted",ANIMATION_OUT:"unmountSuspended"},unmountSuspended:{MOUNT:"mounted",ANIMATION_END:"unmounted"},unmounted:{MOUNT:"mounted"}},t.useReducer((e,t)=>i[e][t]??e,r));return t.useEffect(()=>{let e=o(l.current);c.current="mounted"===d?e:"none"},[d]),(0,n.useLayoutEffect)(()=>{let t=l.current,r=u.current;if(r!==e){let n=c.current,i=o(t);e?f("MOUNT"):"none"===i||t?.display==="none"?f("UNMOUNT"):r&&n!==i?f("ANIMATION_OUT"):f("UNMOUNT"),u.current=e}},[e,f]),(0,n.useLayoutEffect)(()=>{if(s){let e,t=s.ownerDocument.defaultView??window,r=r=>{let n=o(l.current).includes(CSS.escape(r.animationName));if(r.target===s&&n&&(f("ANIMATION_END"),!u.current)){let r=s.style.animationFillMode;s.style.animationFillMode="forwards",e=t.setTimeout(()=>{"forwards"===s.style.animationFillMode&&(s.style.animationFillMode=r)})}},n=e=>{e.target===s&&(c.current=o(l.current))};return s.addEventListener("animationstart",n),s.addEventListener("animationcancel",r),s.addEventListener("animationend",r),()=>{t.clearTimeout(e),s.removeEventListener("animationstart",n),s.removeEventListener("animationcancel",r),s.removeEventListener("animationend",r)}}f("ANIMATION_END")},[s,f]),{isPresent:["mounted","unmountSuspended"].includes(d),ref:t.useCallback(e=>{l.current=e?getComputedStyle(e):null,a(e)},[])}}(l),d="function"==typeof u?u({present:c.isPresent}):t.Children.only(u),f=(0,r.useComposedRefs)(c.ref,(i=d,(a=(s=Object.getOwnPropertyDescriptor(i.props,"ref")?.get)&&"isReactWarning"in s&&s.isReactWarning)?i.ref:(a=(s=Object.getOwnPropertyDescriptor(i,"ref")?.get)&&"isReactWarning"in s&&s.isReactWarning)?i.props.ref:i.props.ref||i.ref));return"function"==typeof u||c.isPresent?t.cloneElement(d,{ref:f}):null};function o(e){return e?.animationName||"none"}i.displayName="Presence",e.s(["Presence",()=>i])},42727,e=>{"use strict";var t=e.i(71645),r=e.i(81140),n=e.i(75830),i=e.i(20783),o=e.i(30030),s=e.i(10772),a=e.i(48425),l=e.i(30207),u=e.i(69340),c=e.i(86318),d=e.i(18050),f="rovingFocusGroup.onEntryFocus",p={bubbles:!1,cancelable:!0},m="RovingFocusGroup",[h,g,y]=(0,n.createCollection)(m),[v,x]=(0,o.createContextScope)(m,[y]),[w,C]=v(m),b=t.forwardRef((e,t)=>(0,d.jsx)(h.Provider,{scope:e.__scopeRovingFocusGroup,children:(0,d.jsx)(h.Slot,{scope:e.__scopeRovingFocusGroup,children:(0,d.jsx)(A,{...e,ref:t})})}));b.displayName=m;var A=t.forwardRef((e,n)=>{let{__scopeRovingFocusGroup:o,orientation:s,loop:h=!1,dir:y,currentTabStopId:v,defaultCurrentTabStopId:x,onCurrentTabStopIdChange:C,onEntryFocus:b,preventScrollOnEntryFocus:A=!1,...k}=e,R=t.useRef(null),S=(0,i.useComposedRefs)(n,R),P=(0,c.useDirection)(y),[M,O]=(0,u.useControllableState)({prop:v,defaultProp:x??null,onChange:C,caller:m}),[T,N]=t.useState(!1),I=(0,l.useCallbackRef)(b),G=g(o),j=t.useRef(!1),[D,F]=t.useState(0);return t.useEffect(()=>{let e=R.current;if(e)return e.addEventListener(f,I),()=>e.removeEventListener(f,I)},[I]),(0,d.jsx)(w,{scope:o,orientation:s,dir:P,loop:h,currentTabStopId:M,onItemFocus:t.useCallback(e=>O(e),[O]),onItemShiftTab:t.useCallback(()=>N(!0),[]),onFocusableItemAdd:t.useCallback(()=>F(e=>e+1),[]),onFocusableItemRemove:t.useCallback(()=>F(e=>e-1),[]),children:(0,d.jsx)(a.Primitive.div,{tabIndex:T||0===D?-1:0,"data-orientation":s,...k,ref:S,style:{outline:"none",...e.style},onMouseDown:(0,r.composeEventHandlers)(e.onMouseDown,()=>{j.current=!0}),onFocus:(0,r.composeEventHandlers)(e.onFocus,e=>{let t=!j.current;if(e.target===e.currentTarget&&t&&!T){let t=new CustomEvent(f,p);if(e.currentTarget.dispatchEvent(t),!t.defaultPrevented){let e=G().filter(e=>e.focusable);E([e.find(e=>e.active),e.find(e=>e.id===M),...e].filter(Boolean).map(e=>e.ref.current),A)}}j.current=!1}),onBlur:(0,r.composeEventHandlers)(e.onBlur,()=>N(!1))})})}),k="RovingFocusGroupItem",R=t.forwardRef((e,n)=>{let{__scopeRovingFocusGroup:i,focusable:o=!0,active:l=!1,tabStopId:u,children:c,...f}=e,p=(0,s.useId)(),m=u||p,y=C(k,i),v=y.currentTabStopId===m,x=g(i),{onFocusableItemAdd:w,onFocusableItemRemove:b,currentTabStopId:A}=y;return t.useEffect(()=>{if(o)return w(),()=>b()},[o,w,b]),(0,d.jsx)(h.ItemSlot,{scope:i,id:m,focusable:o,active:l,children:(0,d.jsx)(a.Primitive.span,{tabIndex:v?0:-1,"data-orientation":y.orientation,...f,ref:n,onMouseDown:(0,r.composeEventHandlers)(e.onMouseDown,e=>{o?y.onItemFocus(m):e.preventDefault()}),onFocus:(0,r.composeEventHandlers)(e.onFocus,()=>y.onItemFocus(m)),onKeyDown:(0,r.composeEventHandlers)(e.onKeyDown,e=>{if("Tab"===e.key&&e.shiftKey)return void y.onItemShiftTab();if(e.target!==e.currentTarget)return;let t=function(e,t,r){var n;let i=(n=e.key,"rtl"!==r?n:"ArrowLeft"===n?"ArrowRight":"ArrowRight"===n?"ArrowLeft":n);if(!("vertical"===t&&["ArrowLeft","ArrowRight"].includes(i))&&!("horizontal"===t&&["ArrowUp","ArrowDown"].includes(i)))return S[i]}(e,y.orientation,y.dir);if(void 0!==t){if(e.metaKey||e.ctrlKey||e.altKey||e.shiftKey)return;e.preventDefault();let i=x().filter(e=>e.focusable).map(e=>e.ref.current);if("last"===t)i.reverse();else if("prev"===t||"next"===t){var r,n;"prev"===t&&i.reverse();let o=i.indexOf(e.currentTarget);i=y.loop?(r=i,n=o+1,r.map((e,t)=>r[(n+t)%r.length])):i.slice(o+1)}setTimeout(()=>E(i))}}),children:"function"==typeof c?c({isCurrentTabStop:v,hasTabStop:null!=A}):c})})});R.displayName=k;var S={ArrowLeft:"prev",ArrowUp:"prev",ArrowRight:"next",ArrowDown:"next",PageUp:"first",Home:"first",PageDown:"last",End:"last"};function E(e,t=!1){let r=document.activeElement;for(let n of e)if(n===r||(n.focus({preventScroll:t}),document.activeElement!==r))return}e.s(["Item",()=>R,"Root",()=>b,"createRovingFocusGroupScope",()=>x])},37766,e=>{"use strict";let t=["claude-code","codex","gemini","qwen-code"],r={claudeCode:"pro",codex:"chatgpt",gemini:"oauth",qwenCode:"oauth"},n={"claude-code":{agent:"claude-code",label:"Claude Code",accessKey:"claudeCode",defaultAccess:"pro",accessOptions:[{id:"pro",label:"Claude Pro",description:"Shows the current Sonnet models that Claude Code documents for Pro usage."},{id:"max",label:"Claude Max",description:"Unlocks both Sonnet and Opus model choices in Claude Code."},{id:"api",label:"Anthropic API",description:"Use direct Anthropic API credentials instead of a Claude subscription."}]},codex:{agent:"codex",label:"Codex",accessKey:"codex",defaultAccess:"chatgpt",accessOptions:[{id:"chatgpt",label:"ChatGPT Plan",description:"Use the ChatGPT-backed Codex login flow for paid ChatGPT workspaces."},{id:"api",label:"OpenAI API",description:"Use direct OpenAI API credentials when Codex is pointed at the API."}]},gemini:{agent:"gemini",label:"Gemini",accessKey:"gemini",defaultAccess:"oauth",accessOptions:[{id:"oauth",label:"Google Login",description:"Use the built-in Google account flow that Gemini CLI ships with."},{id:"api",label:"Gemini API",description:"Use a Gemini API key or Vertex AI project for broader model control."}]},"qwen-code":{agent:"qwen-code",label:"Qwen Code",accessKey:"qwenCode",defaultAccess:"oauth",accessOptions:[{id:"oauth",label:"Qwen OAuth",description:"Use Qwen Code's built-in browser login and bundled provider defaults."},{id:"api",label:"DashScope / Custom API",description:"Use DashScope or another OpenAI-compatible endpoint configured for Qwen Code."}]}},i=[{id:"low",label:"Low",description:"Fast responses with lighter reasoning."},{id:"medium",label:"Medium",description:"Balanced speed and reasoning depth for everyday tasks."},{id:"high",label:"High",description:"Deeper reasoning for more complex tasks."}],o=[...i,{id:"xhigh",label:"Extra High",description:"Maximum reasoning depth for the hardest tasks."}];function s(e,t,r,n=function(e){return e.trim().split(/[-_]+/g).filter(Boolean).map(e=>"gpt"===e.toLowerCase()?"GPT":e[0]?.toUpperCase()+e.slice(1)).join(" ")}(e)){return{id:e,label:n,description:t,access:r}}let a={"claude-code":{modelsByAccess:{pro:[s("claude-sonnet-4-6","Balanced Claude Code model for day-to-day coding tasks.",["pro","max","api"],"Claude Sonnet 4.6"),s("claude-haiku-4-5","Fast Claude model for lightweight tasks.",["pro","max","api"],"Claude Haiku 4.5")],max:[s("claude-sonnet-4-6","Balanced Claude Code model for day-to-day coding tasks.",["pro","max","api"],"Claude Sonnet 4.6"),s("claude-opus-4-6","Highest-capability Claude Code model for deeper reasoning.",["max","api"],"Claude Opus 4.6"),s("claude-haiku-4-5","Fast Claude model for lightweight tasks.",["pro","max","api"],"Claude Haiku 4.5")],api:[s("claude-sonnet-4-6","Balanced Claude Code model for day-to-day coding tasks.",["pro","max","api"],"Claude Sonnet 4.6"),s("claude-opus-4-6","Highest-capability Claude Code model for deeper reasoning.",["max","api"],"Claude Opus 4.6"),s("claude-haiku-4-5","Fast Claude model for lightweight tasks.",["pro","max","api"],"Claude Haiku 4.5")]},defaultModelByAccess:{pro:"claude-sonnet-4-6",max:"claude-opus-4-6",api:"claude-sonnet-4-6"},reasoningOptionsByAccess:{pro:i,max:i,api:i},defaultReasoningByAccess:{pro:"medium",max:"high",api:"medium"}},codex:{modelsByAccess:{chatgpt:[s("gpt-5.4","Latest frontier coding model exposed by Codex.",["chatgpt","api"],"GPT-5.4"),s("gpt-5.3-codex","Balanced Codex coding model.",["chatgpt","api"],"GPT-5.3-Codex"),s("gpt-5.3-codex-spark","Fast Codex model optimized for rapid iteration.",["chatgpt"],"GPT-5.3-Codex-Spark"),s("gpt-5.2-codex","Previous generation Codex coding model.",["chatgpt","api"],"GPT-5.2-Codex"),s("gpt-5.1-codex-max","High-capability legacy Codex model.",["chatgpt","api"],"GPT-5.1-Codex-Max"),s("gpt-5.1-codex-mini","Smaller Codex model for quick tasks.",["chatgpt","api"],"GPT-5.1-Codex-Mini")],api:[s("gpt-5.4","Latest frontier coding model exposed by Codex.",["chatgpt","api"],"GPT-5.4"),s("gpt-5.3-codex","Balanced Codex coding model.",["chatgpt","api"],"GPT-5.3-Codex"),s("gpt-5.2-codex","Previous generation Codex coding model.",["chatgpt","api"],"GPT-5.2-Codex"),s("gpt-5.1-codex-max","High-capability legacy Codex model.",["chatgpt","api"],"GPT-5.1-Codex-Max"),s("gpt-5.1-codex-mini","Smaller Codex model for quick tasks.",["chatgpt","api"],"GPT-5.1-Codex-Mini")]},defaultModelByAccess:{chatgpt:"gpt-5.4",api:"gpt-5.4"},reasoningOptionsByAccess:{chatgpt:o,api:o},defaultReasoningByAccess:{chatgpt:"high",api:"high"}},gemini:{modelsByAccess:{oauth:[s("gemini-3.1-pro-preview","High-capability Gemini model discovered in local Gemini sessions.",["oauth","api"],"Gemini 3.1 Pro Preview"),s("gemini-3-flash-preview","Fast Gemini model discovered in local Gemini sessions.",["oauth","api"],"Gemini 3 Flash Preview")],api:[s("gemini-3.1-pro-preview","High-capability Gemini model discovered in local Gemini sessions.",["oauth","api"],"Gemini 3.1 Pro Preview"),s("gemini-3-flash-preview","Fast Gemini model discovered in local Gemini sessions.",["oauth","api"],"Gemini 3 Flash Preview")]},defaultModelByAccess:{oauth:"gemini-3.1-pro-preview",api:"gemini-3.1-pro-preview"}},"qwen-code":{modelsByAccess:{oauth:[s("coder-model","Model discovered in the local Qwen Code installation.",["oauth","api"],"Coder Model")],api:[s("coder-model","Model discovered in the local Qwen Code installation.",["oauth","api"],"Coder Model")]},defaultModelByAccess:{oauth:"coder-model",api:"coder-model"}}};function l(e){let r=e.trim().toLowerCase().replace(/[_\s]+/g,"-");return t.includes(r)?r:null}function u(){return{...r}}function c(e){return null!==l(e)}function d(e){let t=l(e);return t?n[t]:null}function f(e,t){let r=d(e);if(!r)return null;let n=t?.[r.accessKey];return"string"==typeof n&&r.accessOptions.some(e=>e.id===n)?n:r.defaultAccess}function p(e,t){let r=l(e);if(!r)return[];let n=f(r,t);if(!n)return[];let i=a[r],o=i.modelsByAccess[n]??[];if(o.length>0)return[...o];let s=[],u=new Set;for(let e of Object.values(i.modelsByAccess))if(Array.isArray(e))for(let t of e)u.has(t.id)||(u.add(t.id),s.push(t));return s}function m(e,t){let r=l(e);if(!r)return null;let n=f(r,t);return n?a[r].defaultModelByAccess[n]??null:null}function h(e,t){let r=l(e);if(!r)return[];let n=f(r,t);return n?a[r].reasoningOptionsByAccess?.[n]??[]:[]}function g(e,t){let r=l(e);if(!r)return null;let n=f(r,t);return n?a[r].defaultReasoningByAccess?.[n]??null:null}e.s(["getAgentModelCatalog",()=>d,"getAvailableAgentModels",()=>p,"getAvailableAgentReasoningEfforts",()=>h,"getDefaultAgentModel",()=>m,"getDefaultAgentReasoningEffort",()=>g,"getDefaultModelAccessPreferences",()=>u,"resolveAgentModelAccess",()=>f,"supportsAgentModelSelection",()=>c])},43531,e=>{"use strict";let t=(0,e.i(75254).default)("check",[["path",{d:"M20 6 9 17l-5-5",key:"1gmf2c"}]]);e.s(["Check",()=>t],43531)},64659,e=>{"use strict";let t=(0,e.i(75254).default)("chevron-down",[["path",{d:"m6 9 6 6 6-6",key:"qrunsl"}]]);e.s(["ChevronDown",()=>t],64659)},74886,e=>{"use strict";let t=(0,e.i(75254).default)("copy",[["rect",{width:"14",height:"14",x:"8",y:"8",rx:"2",ry:"2",key:"17jyea"}],["path",{d:"M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2",key:"zix9uf"}]]);e.s(["Copy",()=>t],74886)},75505,e=>{"use strict";let t=(0,e.i(75254).default)("folder-open",[["path",{d:"m6 14 1.5-2.9A2 2 0 0 1 9.24 10H20a2 2 0 0 1 1.94 2.5l-1.54 6a2 2 0 0 1-1.95 1.5H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h3.9a2 2 0 0 1 1.69.9l.81 1.2a2 2 0 0 0 1.67.9H18a2 2 0 0 1 2 2v2",key:"usdka0"}]]);e.s(["FolderOpen",()=>t],75505)},90272,e=>{"use strict";let t=(0,e.i(75254).default)("folder-git-2",[["path",{d:"M18 19a5 5 0 0 1-5-5v8",key:"sz5oeg"}],["path",{d:"M9 20H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h3.9a2 2 0 0 1 1.69.9l.81 1.2a2 2 0 0 0 1.67.9H20a2 2 0 0 1 2 2v5",key:"1w6njk"}],["circle",{cx:"13",cy:"12",r:"2",key:"1j92g6"}],["circle",{cx:"20",cy:"19",r:"2",key:"1obnsp"}]]);e.s(["FolderGit2",()=>t],90272)},37727,e=>{"use strict";let t=(0,e.i(75254).default)("x",[["path",{d:"M18 6 6 18",key:"1bl5f8"}],["path",{d:"m6 6 12 12",key:"d8bk6v"}]]);e.s(["X",()=>t],37727)},81633,e=>{"use strict";function t(e){return e.trim().toLowerCase().replace(/[_\s]+/g,"-")}e.s(["normalizeAgentName",()=>t])},97878,e=>{"use strict";let t=new Set,r=null,n=null;function i(e){return Array.isArray(e)?{type:"snapshot",sessions:e}:e&&"object"==typeof e&&"snapshot"===e.type&&Array.isArray(e.sessions)?e:null}function o(e){for(let r of t)r(e)}async function s(){if("function"!=typeof fetch)return;let e=(async()=>{try{let e=await fetch("/api/sessions");if(!e.ok)return;let t=await e.json().catch(()=>null),r=i(t);if(!r)return;o(r)}catch{}})();n=e.finally(()=>{n===e&&(n=null)}),await e}function a(e){return t.add(e),!r&&"u">typeof EventSource&&((r=new EventSource("/api/events")).onmessage=e=>{try{let t=i(JSON.parse(e.data));if(!t)return;o(t)}catch{}},r.addEventListener("refresh",()=>{n||s()}),r.onerror=()=>{0===t.size&&(r?.close(),r=null)}),()=>{t.delete(e),0===t.size&&r&&(r.close(),r=null)}}e.s(["subscribeToSnapshotEvents",()=>a])},78818,e=>{"use strict";var t=e.i(71645);let r=new Set,n=[],i=!0,o=0,s=null,a=null;function l(){for(let e of r)e()}function u(){return{agents:n,loading:i}}function c(){return n.length>0&&Date.now()-o<3e4}function d(){null===a&&(a=window.setTimeout(()=>{a=null,f(!0)},1e4))}async function f(e=!1){if(!e&&c()){i&&(i=!1,l());return}return s||(i=!0,l(),s=(async()=>{try{var e;let t=await fetch("/api/agents",{cache:"no-store"});if(!t.ok)throw Error(`Failed to fetch agents: ${t.status}`);let r=(e=await t.json(),Array.isArray(e)?e:e&&"object"==typeof e&&"agents"in e&&Array.isArray(e.agents)?e.agents:[]);r.length>0?(n=r,o=Date.now(),null!==a&&(window.clearTimeout(a),a=null)):d()}catch{d()}finally{i=!1,s=null,l()}})())}function p(){let[e,n]=(0,t.useState)(()=>u());return(0,t.useEffect)(()=>{let e=()=>n(u());r.add(e),e(),f();let t=()=>{c()||f(!0)},i=()=>{"visible"!==document.visibilityState||c()||f(!0)};return window.addEventListener("focus",t),document.addEventListener("visibilitychange",i),()=>{r.delete(e),window.removeEventListener("focus",t),document.removeEventListener("visibilitychange",i)}},[]),e}e.s(["useAgents",()=>p])},52808,e=>{"use strict";let t=new Set(["archived","done","killed","errored","terminated","merged","cleanup"]);function r(e){return"merged"===e.status||"archived"===e.status||"killed"===e.status||"errored"===e.status||"cleanup"===e.status||"done"===e.status||"terminated"===e.status||e.pr&&("merged"===e.pr.state||"closed"===e.pr.state)?"done":"mergeable"===e.status||"approved"===e.status||e.pr?.mergeability.mergeable?"merge":"waiting_input"===e.activity||"blocked"===e.activity||"needs_input"===e.status||"stuck"===e.status||"exited"===e.activity?"respond":"ci_failed"===e.status||"changes_requested"===e.status||e.pr&&("failing"===e.pr.ciStatus||"changes_requested"===e.pr.reviewDecision||!e.pr.mergeability.noConflicts)?"review":"review_pending"===e.status||e.pr&&!e.pr.isDraft&&("pending"===e.pr.reviewDecision||"none"===e.pr.reviewDecision)?"pending":"working"}e.s(["TERMINAL_STATUSES",0,t,"getAttentionLevel",()=>r])},55716,e=>{"use strict";let t=(0,e.i(75254).default)("git-branch",[["path",{d:"M15 6a9 9 0 0 0-9 9V3",key:"1cii5b"}],["circle",{cx:"18",cy:"6",r:"3",key:"1h7g24"}],["circle",{cx:"6",cy:"18",r:"3",key:"fqmcym"}]]);e.s(["GitBranch",()=>t],55716)},17442,e=>{"use strict";var t=e.i(18050),r=e.i(18620);let n={default:"border-[var(--vk-border)] bg-[var(--vk-bg-panel)] text-[var(--vk-text-muted)]",success:"border-transparent bg-transparent text-[var(--vk-green)]",warning:"border-transparent bg-transparent text-[var(--vk-orange)]",error:"border-transparent bg-transparent text-[var(--vk-red)]",info:"border-transparent bg-transparent text-[var(--vk-text-muted)]",outline:"border-[var(--vk-border)] bg-transparent text-[var(--vk-text-muted)]"};function i({variant:e="default",className:i,children:o}){return(0,t.jsx)("span",{className:(0,r.cn)("inline-flex items-center gap-1 rounded-[3px] border px-1.5 py-0.5 text-[11px] leading-none",n[e],i),children:o})}e.s(["Badge",()=>i])},90993,e=>{"use strict";var t=e.i(18050),r=e.i(18620);let n=(0,e.i(71645).forwardRef)(({className:e,...n},i)=>(0,t.jsx)("div",{ref:i,className:(0,r.cn)("surface-card rounded-[var(--radius-md)] border",e),...n}));function i({className:e,...n}){return(0,t.jsx)("div",{className:(0,r.cn)("flex items-center gap-2 border-b border-[var(--vk-border)] px-3 py-2",e),...n})}function o({className:e,...n}){return(0,t.jsx)("div",{className:(0,r.cn)("px-3 py-2",e),...n})}n.displayName="Card",e.s(["Card",0,n,"CardContent",()=>o,"CardHeader",()=>i])}]);

package/web/.next/standalone/packages/web/package.json

@@ -8,7 +8,7 @@
   "scripts": {
     "dev": "next dev -p ${PORT:-3000}",
     "build": "next build",
-    "start": "PORT=${PORT:-3000} HOSTNAME=${HOSTNAME:-0.0.0.0} node .next/standalone/packages/web/server.js",
+    "start": "next start",
     "typecheck": "tsc --noEmit",
     "clean": "rm -rf .next"
   },

package/web/.next/standalone/packages/web/src/app/api/access/route.ts

@@ -1,214 +1,6 @@
-import { type NextRequest, NextResponse } from "next/server";
-import { readFile, writeFile } from "node:fs/promises";
-import { parse, stringify } from "yaml";
-import type { DashboardAccessConfig, DashboardRoleBindings } from "@conductor-oss/core/types";
-import { getDashboardAccess, guardApiAccess, guardApiActionAccess } from "@/lib/auth";
-import { getServices, invalidateServicesCache } from "@/lib/services";
-import { normalizeRootProjectPaths } from "@/lib/projectConfigSync";
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-type MutableConfig = Record<string, unknown>;
-
-type AccessPatchBody = {
-  requireAuth?: unknown;
-  defaultRole?: unknown;
-  trustedHeaders?: unknown;
-  roles?: unknown;
-};
-
-function toObject(value: unknown): Record<string, unknown> {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
-  return { ...(value as Record<string, unknown>) };
-}
-
-function asOptionalRole(value: unknown): DashboardAccessConfig["defaultRole"] | undefined {
-  if (value === "viewer" || value === "operator" || value === "admin") {
-    return value;
-  }
-  return undefined;
-}
-
-function normalizeStringList(value: unknown): string[] {
-  if (Array.isArray(value)) {
-    return value
-      .filter((item): item is string => typeof item === "string")
-      .map((item) => item.trim())
-      .filter(Boolean);
-  }
-  if (typeof value !== "string") return [];
-  return value
-    .split(/[\n,]+/g)
-    .map((item) => item.trim())
-    .filter(Boolean);
-}
-
-function normalizeRoles(value: unknown): DashboardRoleBindings | undefined {
-  const root = toObject(value);
-  const next: DashboardRoleBindings = {};
-
-  const viewers = normalizeStringList(root["viewers"]);
-  const operators = normalizeStringList(root["operators"]);
-  const admins = normalizeStringList(root["admins"]);
-  const viewerDomains = normalizeStringList(root["viewerDomains"]);
-  const operatorDomains = normalizeStringList(root["operatorDomains"]);
-  const adminDomains = normalizeStringList(root["adminDomains"]);
-
-  if (viewers.length > 0) next.viewers = viewers;
-  if (operators.length > 0) next.operators = operators;
-  if (admins.length > 0) next.admins = admins;
-  if (viewerDomains.length > 0) next.viewerDomains = viewerDomains;
-  if (operatorDomains.length > 0) next.operatorDomains = operatorDomains;
-  if (adminDomains.length > 0) next.adminDomains = adminDomains;
-
-  return Object.keys(next).length > 0 ? next : undefined;
-}
-
-function normalizeAccessConfig(value: unknown): DashboardAccessConfig {
-  const root = toObject(value);
-  const trustedHeaders = toObject(root["trustedHeaders"]);
-  const defaultRole = asOptionalRole(root["defaultRole"]);
-
-  const next: DashboardAccessConfig = {
-    requireAuth: root["requireAuth"] === true,
-    trustedHeaders: {
-      enabled: trustedHeaders["enabled"] === true,
-      provider:
-        trustedHeaders["provider"] === "generic"
-          ? "generic"
-          : "cloudflare-access",
-      emailHeader:
-        (typeof trustedHeaders["emailHeader"] === "string" && trustedHeaders["emailHeader"].trim().length > 0
-          ? trustedHeaders["emailHeader"].trim()
-          : "Cf-Access-Authenticated-User-Email"),
-      jwtHeader:
-        (typeof trustedHeaders["jwtHeader"] === "string" && trustedHeaders["jwtHeader"].trim().length > 0
-          ? trustedHeaders["jwtHeader"].trim()
-          : "Cf-Access-Jwt-Assertion"),
-    },
-  };
-
-  if (typeof trustedHeaders["teamDomain"] === "string" && trustedHeaders["teamDomain"].trim().length > 0) {
-    next.trustedHeaders!.teamDomain = trustedHeaders["teamDomain"].trim();
-  }
-
-  if (typeof trustedHeaders["audience"] === "string" && trustedHeaders["audience"].trim().length > 0) {
-    next.trustedHeaders!.audience = trustedHeaders["audience"].trim();
-  }
-
-  if (defaultRole) {
-    next.defaultRole = defaultRole;
-  }
-
-  const roles = normalizeRoles(root["roles"]);
-  if (roles) {
-    next.roles = roles;
-  }
-
-  return next;
-}
-
-export async function GET(request: NextRequest) {
-  const denied = await guardApiAccess(request, "viewer");
-  if (denied) return denied;
-
-  try {
-    const { config } = await getServices();
-    const access = normalizeAccessConfig(config.access);
-    const current = await getDashboardAccess(request);
-
-    return NextResponse.json({
-      access,
-      current: {
-        authenticated: current.authenticated,
-        role: current.role ?? null,
-        email: current.email ?? null,
-        provider: current.provider ?? null,
-      },
-    });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to load access settings";
-    return NextResponse.json({ error: message }, { status: 500 });
-  }
-}
-
-export async function PUT(request: NextRequest) {
-  const denied = await guardApiAccess(request, "admin");
-  if (denied) return denied;
-  const deniedAction = guardApiActionAccess(request);
-  if (deniedAction) return deniedAction;
-
-  const body = (await request.json().catch(() => null)) as AccessPatchBody | null;
-  if (!body || typeof body !== "object") {
-    return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
-  }
-
-  try {
-    const { config } = await getServices();
-    const configPath = config.configPath;
-    if (!configPath) {
-      return NextResponse.json({ error: "Unable to resolve conductor config path" }, { status: 500 });
-    }
-
-    const originalConfigRaw = await readFile(configPath, "utf8");
-    const parsed = (parse(originalConfigRaw) ?? {}) as MutableConfig;
-    const nextRoot: MutableConfig =
-      parsed && typeof parsed === "object" && !Array.isArray(parsed)
-        ? { ...parsed }
-        : {};
-
-    const nextAccess = normalizeAccessConfig(nextRoot["access"]);
-
-    if (typeof body.requireAuth === "boolean") {
-      nextAccess.requireAuth = body.requireAuth;
-    }
-
-    if (body.defaultRole !== undefined) {
-      nextAccess.defaultRole = asOptionalRole(body.defaultRole);
-    }
-
-    if (body.trustedHeaders !== undefined) {
-      const nextTrusted = toObject(body.trustedHeaders);
-      nextAccess.trustedHeaders = {
-        enabled: nextTrusted["enabled"] === true,
-        emailHeader:
-          (typeof nextTrusted["emailHeader"] === "string" && nextTrusted["emailHeader"].trim().length > 0
-            ? nextTrusted["emailHeader"].trim()
-            : "Cf-Access-Authenticated-User-Email"),
-      };
-    }
-
-    if (body.roles !== undefined) {
-      nextAccess.roles = normalizeRoles(body.roles);
-    }
-
-    nextRoot["access"] = nextAccess;
-    await normalizeRootProjectPaths(nextRoot);
-
-    const updatedYaml = stringify(nextRoot, { lineWidth: 0 });
-    await writeFile(configPath, updatedYaml, "utf8");
-
-    try {
-      invalidateServicesCache("access updated");
-      await getServices();
-    } catch (err) {
-      await writeFile(configPath, originalConfigRaw, "utf8");
-      invalidateServicesCache("access update rollback");
-      throw err;
-    }
-
-    const current = await getDashboardAccess(request);
-    return NextResponse.json({
-      access: nextAccess,
-      current: {
-        authenticated: current.authenticated,
-        role: current.role ?? null,
-        email: current.email ?? null,
-        provider: current.provider ?? null,
-      },
-    });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Failed to update access settings";
-    return NextResponse.json({ error: message }, { status: 500 });
-  }
-}
+export const GET = guardedProxyRoute("/api/access", { role: "viewer" });
+export const PUT = guardedProxyRoute("/api/access", { role: "admin", requireActionGuard: true });

package/web/.next/standalone/packages/web/src/app/api/agents/route.ts

@@ -0,0 +1,5 @@
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
+
+export const dynamic = "force-dynamic";
+
+export const GET = guardedProxyRoute("/api/agents", { role: "viewer" });

package/web/.next/standalone/packages/web/src/app/api/attachments/route.ts

@@ -1,169 +1,5 @@
-import { type NextRequest, NextResponse } from "next/server";
-import { randomBytes } from "node:crypto";
-import { mkdir, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { dirname, relative, resolve, sep } from "node:path";
-import type { OrchestratorConfig } from "@conductor-oss/core";
-import { guardApiAccess, guardApiActionAccess } from "@/lib/auth";
-import { getServices } from "@/lib/services";
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
 
 export const dynamic = "force-dynamic";
 
-const MAX_UPLOAD_FILES = 20;
-const MAX_UPLOAD_BYTES = 25 * 1024 * 1024; // 25MB per file
-
-const IMAGE_EXTENSIONS = new Set([
-  ".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".bmp", ".ico", ".tiff",
-]);
-
-function asNonEmptyString(value: unknown): string | null {
-  if (typeof value !== "string") return null;
-  const trimmed = value.trim();
-  return trimmed.length > 0 ? trimmed : null;
-}
-
-function expandHome(value: string): string {
-  if (value.startsWith("~/")) {
-    return resolve(homedir(), value.slice(2));
-  }
-  return resolve(value);
-}
-
-function resolveWorkspacePath(config: OrchestratorConfig): string {
-  if (process.env["CONDUCTOR_WORKSPACE"]?.trim()) {
-    return expandHome(process.env["CONDUCTOR_WORKSPACE"]);
-  }
-  if (config.configPath) {
-    return dirname(config.configPath);
-  }
-  return resolve(process.cwd());
-}
-
-function normalizeToken(value: string): string {
-  const input = value.trim().toLowerCase();
-  let out = "";
-  let prevDash = false;
-  for (const ch of input) {
-    const code = ch.charCodeAt(0);
-    const isDigit = code >= 48 && code <= 57;
-    const isLowerAlpha = code >= 97 && code <= 122;
-    const isSafe = isDigit || isLowerAlpha || ch === "." || ch === "_";
-    if (isSafe) {
-      out += ch;
-      prevDash = false;
-      continue;
-    }
-    if (!prevDash && out.length > 0) {
-      out += "-";
-      prevDash = true;
-    }
-  }
-  while (out.endsWith("-")) out = out.slice(0, -1);
-  return out || "project";
-}
-
-function sanitizeFileName(value: string): string {
-  const trimmed = value.trim();
-  if (!trimmed) return "upload.bin";
-  const normalized = trimmed
-    .replaceAll("\\", "/")
-    .split("/")
-    .filter(Boolean)
-    .pop() ?? "upload.bin";
-  const safe = normalized
-    .replace(/[^A-Za-z0-9._-]+/g, "-")
-    .replace(/-+/g, "-")
-    .replace(/^\.+/, "")
-    .replace(/^-+/, "");
-  return safe || "upload.bin";
-}
-
-function isImagePath(path: string): boolean {
-  const lower = path.toLowerCase();
-  for (const ext of IMAGE_EXTENSIONS) {
-    if (lower.endsWith(ext)) return true;
-  }
-  return false;
-}
-
-export async function POST(request: NextRequest) {
-  const denied = await guardApiAccess(request, "operator");
-  if (denied) return denied;
-  const deniedAction = guardApiActionAccess(request);
-  if (deniedAction) return deniedAction;
-
-  try {
-    const form = await request.formData();
-    const projectId = asNonEmptyString(form.get("projectId"));
-    if (!projectId) {
-      return NextResponse.json({ error: "projectId is required" }, { status: 400 });
-    }
-
-    const incoming = form.getAll("files").filter((item): item is File => item instanceof File);
-    if (incoming.length === 0) {
-      return NextResponse.json({ error: "No files uploaded" }, { status: 400 });
-    }
-    if (incoming.length > MAX_UPLOAD_FILES) {
-      return NextResponse.json(
-        { error: `Too many files. Max ${MAX_UPLOAD_FILES} files per request.` },
-        { status: 400 },
-      );
-    }
-
-    const { config } = await getServices();
-    if (!config.projects[projectId]) {
-      return NextResponse.json({ error: `Unknown project: ${projectId}` }, { status: 404 });
-    }
-
-    const workspaceRoot = resolveWorkspacePath(config);
-    const projectSegment = normalizeToken(projectId);
-    const targetDir = resolve(workspaceRoot, "attachments", projectSegment);
-    const workspacePrefix = workspaceRoot.endsWith(sep) ? workspaceRoot : `${workspaceRoot}${sep}`;
-    if (targetDir !== workspaceRoot && !targetDir.startsWith(workspacePrefix)) {
-      return NextResponse.json({ error: "Upload path escapes workspace" }, { status: 400 });
-    }
-    await mkdir(targetDir, { recursive: true });
-
-    const uploaded: Array<{
-      path: string;
-      name: string;
-      size: number;
-      mimeType: string | null;
-      kind: "image" | "file";
-    }> = [];
-
-    for (const [index, file] of incoming.entries()) {
-      if (file.size > MAX_UPLOAD_BYTES) {
-        return NextResponse.json(
-          { error: `File "${file.name}" exceeds 25MB limit.` },
-          { status: 413 },
-        );
-      }
-      const safeName = sanitizeFileName(file.name);
-      const uniquePrefix = `${Date.now()}-${index}-${randomBytes(3).toString("hex")}`;
-      const fileName = `${uniquePrefix}-${safeName}`;
-      const absolutePath = resolve(targetDir, fileName);
-      if (absolutePath !== workspaceRoot && !absolutePath.startsWith(workspacePrefix)) {
-        return NextResponse.json({ error: "Resolved upload path escapes workspace" }, { status: 400 });
-      }
-
-      const bytes = Buffer.from(await file.arrayBuffer());
-      await writeFile(absolutePath, bytes);
-      const relPath = relative(workspaceRoot, absolutePath).replaceAll("\\", "/");
-      uploaded.push({
-        path: relPath,
-        name: file.name || safeName,
-        size: file.size,
-        mimeType: file.type || null,
-        kind: isImagePath(relPath) ? "image" : "file",
-      });
-    }
-
-    return NextResponse.json({ files: uploaded }, { status: 201 });
-  } catch (err) {
-    return NextResponse.json(
-      { error: err instanceof Error ? err.message : "Failed to upload files" },
-      { status: 500 },
-    );
-  }
-}
+export const POST = guardedProxyRoute("/api/attachments", { role: "operator", requireActionGuard: true });

package/web/.next/standalone/packages/web/src/app/api/auth/session/route.ts

@@ -1,54 +1,6 @@
-import { type NextRequest, NextResponse } from "next/server";
-import {
-  BUILTIN_REMOTE_SESSION_COOKIE,
-  createBuiltinRemoteSessionValue,
-  getBuiltinRemoteSessionCookieOptions,
-  isBuiltinRemoteAuthEnabled,
-  isValidBuiltinAccessToken,
-} from "@/lib/remoteAuth";
+import { openProxyRoute } from "@/lib/proxyRoutes";
 
-type SessionRequestBody = {
-  token?: unknown;
-};
+export const dynamic = "force-dynamic";
 
-function clearSession(response: NextResponse): void {
-  response.cookies.set(BUILTIN_REMOTE_SESSION_COOKIE, "", {
-    ...getBuiltinRemoteSessionCookieOptions(false),
-    maxAge: 0,
-  });
-}
-
-export async function POST(request: NextRequest): Promise<NextResponse> {
-  if (!isBuiltinRemoteAuthEnabled()) {
-    return NextResponse.json({ error: "Built-in remote auth is not enabled" }, { status: 404 });
-  }
-
-  const body = (await request.json().catch(() => null)) as SessionRequestBody | null;
-  const token = typeof body?.token === "string" ? body.token.trim() : "";
-  if (!isValidBuiltinAccessToken(token)) {
-    return NextResponse.json({ error: "Invalid access token" }, { status: 403 });
-  }
-
-  const response = NextResponse.json({ ok: true });
-  response.cookies.set(
-    BUILTIN_REMOTE_SESSION_COOKIE,
-    await createBuiltinRemoteSessionValue(),
-    getBuiltinRemoteSessionCookieOptions(request.nextUrl.protocol === "https:"),
-  );
-  return response;
-}
-
-export async function DELETE(request: NextRequest): Promise<NextResponse> {
-  const response = NextResponse.json({ ok: true });
-  clearSession(response);
-
-  if (!isBuiltinRemoteAuthEnabled()) {
-    return response;
-  }
-
-  response.cookies.set(BUILTIN_REMOTE_SESSION_COOKIE, "", {
-    ...getBuiltinRemoteSessionCookieOptions(request.nextUrl.protocol === "https:"),
-    maxAge: 0,
-  });
-  return response;
-}
+export const POST = openProxyRoute("/api/auth/session");
+export const DELETE = openProxyRoute("/api/auth/session");