create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/api/setup-wizard-handlers.js

@@ -0,0 +1,884 @@
+'use strict';
+
+// Landing-throughput WP-6 shard S15 (design doc §5 D-10 "move-only", §6 "Shard module
+// seam"): the 17 setup-wizard HTTP handlers move out of server.js VERBATIM into this module
+// behind the same configure(deps) seam as lib/api/setup.js (S2), lib/api/session-attach.js
+// (S6), lib/walle-history-serve.js (S8), lib/codex-rollout-history.js (S9),
+// lib/terminal-input-prepared.js (S10), lib/idle-notify.js (S11), lib/session-park.js (S12),
+// lib/terminal-draft-operation.js (S13) and lib/conversation-freshness-diagnostics.js (S14).
+// Bodies are identical to the server.js declarations except for the `_deps.` prefix on every
+// identifier that used to resolve to a server.js top-level binding (D-10 rule 1), proven by
+// `node bin/move-only-check.js`. Four inline requires were rebased to this module's own
+// directory (S8 precedent: one move-only DIFF per rebased require -- the remainder is proven
+// by re-running against a copy with the inverse sed applied).
+//
+// The module lives under lib/api/ (and NOT appended to lib/api/setup.js, which is already
+// 1,089 lines: itself plus these 807 would cross the 1,500-line new-file ceiling). It
+// registers no routes of its own: lib/api/setup.js keeps the route table and receives these
+// 17 functions through its own configure() call in server.js.
+//
+// Injected deps, per function:
+//   apiSetupStatus: CONFIG_DIR, HOSTNAME, __dirname, _buildHostedRuntimeContext, _controlSnapshot, _effectiveStorageBackends, _runCtmDbWorkerOp, fs, getActiveWalleProviderState, os, path, resolveEnvFilePath, serverConfig, setup, walleClient
+//   apiSetupDetectCodexCli: codingAgentAuth, readUserShellEnv
+//   apiSetupDetectGeminiCli: CONFIG_DIR, fs, hostIdentityAccessAllowed, path, serverConfig
+//   apiSetupDetectClaudeCli: codingAgentAuth, resolveAgentCliCommand
+//   apiSetupOauthProxyStart: oauthProxySupervisor
+//   apiSetupOauthProxyStop: oauthProxySupervisor
+//   apiSetupOauthProxyStatus: oauthProxySupervisor
+//   apiSetupProviders: SETUP_PROVIDER_ENV_KEYS, SETUP_PROVIDER_NAMES, collapseSetupProviderInstances, getWalleModelProviders, getWalleStatusData, loggedSetupProviderDuplicateSignatures, normalizeModelOverviewProviderCredentialState, providerRuntimeStateFromRow, sanitizeSetupProviderType, telemetry
+//   apiSetupSaveProvider: CONFIG_DIR, SETUP_PROVIDER_ENV_KEYS, SETUP_PROVIDER_NAMES, SETUP_PROVIDER_TYPES, __dirname, atomicWriteFileSync, fs, oauthProxySupervisor, path, resolveEnvFilePath, sanitizeSetupProviderType, serverConfig, setup, setupProviderAnswers, setupProviderTypeList, walleOwnerWrite, walleSupervisor
+//   apiSetupTestProvider: claudeCliAccountError, codingAgentAuth, firstModelLabel, getProviderRuntimeStateFromWalle, isSetupProviderType, listWalleModelsViaOwner, probeAnthropicOauthProxy, sanitizeSetupProviderType, setupProviderAnswers, shouldRouteOllamaTestViaOwner
+//   apiSetupSetDefault: getWalleDefaultModelSelection, resolveSetupDefaultSelection, sanitizeSetupProviderType, setup, walleOwnerWrite
+//   apiSetupCheckDir: fs, path
+//   apiSetupEmbeddings: walleClient
+//   apiSetupEmbeddingsSwitch: readBody, walleClient
+//   apiSetupEmbeddingsPolicy: readBody, walleClient
+//   apiSetupEmbeddingsDelete: readBody, walleClient
+//   apiSetupSaveDirs: CONFIG_DIR, __dirname, _closeDbForProcessExit, _ctmDbClosingForProcessExit, _dbCloseOutcome, _drainCtmDbWorkers, _exitForLaunchdRestart, atomicWriteFileSync, createWalleBrainBackupForCopy, dbModule, fs, os, path, resolveEnvFilePath, serverConfig
+//
+// Mutable module state (D-10 rule 2 / S9 lesson 7): _ctmDbClosingForProcessExit is a server.js
+// `let` that a moved body WRITES (apiSetupSaveDirs sets it before the launchd restart), so it is
+// injected as a get/set PAIR -- never copied. Every other dep is a `const` binding, a function
+// declaration or the CommonJS wrapper parameter, all passed by value.
+// `__dirname` is injected although it is NOT a server.js top-level binding: it is the CommonJS
+// wrapper parameter, so left bare in this file it would resolve to lib/api/ instead of server.js's
+// own directory and silently change resolveEnvFilePath's repoRoot (D-10 rule 9, "behaviour: none
+// changes"). It is passed by value, same as every immutable binding.
+// Calls between the 17 moved functions stay direct (no `_deps.`); none references another.
+
+let _deps = null;
+
+function configure(deps = {}) {
+  _deps = deps;
+}
+
+async function apiSetupStatus(req, res, url) {
+    const envPath = _deps.resolveEnvFilePath({ repoRoot: _deps.path.resolve(_deps.__dirname, '..'), dataDir: _deps.CONFIG_DIR });
+    let hasApiKey = !!(_deps.serverConfig.ANTHROPIC_API_KEY || _deps.serverConfig.ANTHROPIC_BASE_URL);
+    let ownerName = _deps.serverConfig.WALLE_OWNER_NAME || '';
+    if (!hasApiKey) {
+      try {
+        const envContent = await _deps.fs.promises.readFile(envPath, 'utf8');
+        hasApiKey = /^ANTHROPIC_API_KEY=\S+/m.test(envContent);
+      } catch {}
+    }
+    let slackConnected = false;
+    let slackTeam = '';
+    try {
+      const tokPath = _deps.path.join(_deps.serverConfig.HOME, '.claude', 'wall-e-slack-token.json');
+      const tok = JSON.parse(await _deps.fs.promises.readFile(tokPath, 'utf8'));
+      // Check token exists, is non-empty, AND hasn't expired
+      if (tok.access_token && tok.access_token.length > 10) {
+        const expiresAt = tok.expiresAt || (tok.obtained_at ? tok.obtained_at + (tok.expires_in || 43200) * 1000 : 0);
+        slackConnected = !expiresAt || expiresAt > Date.now();
+      }
+      slackTeam = tok.team_name || '';
+    } catch {}
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    let version = '';
+    try { version = require('../../package.json').version; } catch {}
+    const ctmDataDir = require('../data-dir').getDataDir();
+    const walleDataDir = _deps.serverConfig.WALL_E_DATA_DIR || _deps.path.join(_deps.os.homedir(), '.walle', 'data');
+    let walleProvider = 'anthropic';
+    let walleModel = '';
+    let serviceAlerts = [];
+    let serviceAlertSummary = null;
+    try {
+      const upstream = await _deps.walleClient.requestJson('/api/wall-e/status');
+      const data = upstream.json?.data || {};
+      if (data.walle_provider) walleProvider = data.walle_provider;
+      if (data.walle_model) walleModel = data.walle_model;
+      if (data.owner && !ownerName) ownerName = data.owner;
+      if (typeof data.has_api_key === 'boolean') hasApiKey = hasApiKey || data.has_api_key;
+      serviceAlerts = Array.isArray(data.service_alerts) ? data.service_alerts : [];
+      if (data.service_alert_summary && typeof data.service_alert_summary === 'object') serviceAlertSummary = data.service_alert_summary;
+    } catch {}
+    // Also check env-based provider keys
+    if (!hasApiKey && walleProvider === 'openai' && _deps.serverConfig.OPENAI_API_KEY) hasApiKey = true;
+    if (!hasApiKey && walleProvider === 'google' && (_deps.serverConfig.GOOGLE_API_KEY || _deps.serverConfig.GEMINI_API_KEY)) hasApiKey = true;
+    if (!hasApiKey && walleProvider === 'deepseek' && _deps.serverConfig.DEEPSEEK_API_KEY) hasApiKey = true;
+    if (!hasApiKey && walleProvider === 'moonshot' && _deps.serverConfig.MOONSHOT_API_KEY) hasApiKey = true;
+    if (!hasApiKey && walleProvider === 'zai' && _deps.serverConfig.ZAI_API_KEY) hasApiKey = true;
+    if (!hasApiKey && (walleProvider === 'ollama' || walleProvider === 'mlx')) hasApiKey = true;
+    const providerState = _deps.getActiveWalleProviderState(walleProvider);
+    if (!hasApiKey && providerState.hasRuntimeAccess) hasApiKey = true;
+    const authMethod = providerState.authMethod || '';
+    const codingViaCli = _deps.serverConfig.WALLE_CODING_USE_CLI === 'true';
+    const deviceLabel = _deps._controlSnapshot.getSetting('ui_setup_device_label', 'Owner iPhone');
+    const {
+      instance,
+      sync,
+      workspaceBindings,
+      localEdge,
+      security,
+      hostedReadiness,
+    } = await _deps._buildHostedRuntimeContext();
+    const transcriptRetention = await require('../transcript-retention-check').collectTranscriptRetentionCheck({ runOwnerOp: _deps._runCtmDbWorkerOp });
+    res.end(JSON.stringify({ owner_name: ownerName, has_api_key: hasApiKey, slack_connected: slackConnected, slack_team: slackTeam, needs_setup: !hasApiKey && _deps.setup.needsSetup(), version, ctm_data_dir: ctmDataDir, walle_data_dir: walleDataDir, hostname: _deps.HOSTNAME, walle_model: walleModel, walle_provider: walleProvider, auth_method: authMethod, coding_via_cli: codingViaCli, service_alerts: serviceAlerts, service_alert_summary: serviceAlertSummary, device_label: deviceLabel, instance, storage_backend: { ..._deps._effectiveStorageBackends }, sync, workspaceBindings, localEdge, security, hostedReadiness, transcript_retention: transcriptRetention }));
+    return;
+  }
+
+async function apiSetupDetectCodexCli(req, res, url) {
+    const respond = (data) => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(data)); };
+    // The probe itself (which spawns `codex login status`, matches "logged in" on
+    // either stream, and reads plan/email from ~/.codex/auth.json) lives in
+    // lib/coding-agent-auth.js (WP-0).
+    const account = await _deps.codingAgentAuth.probeAccount('codex');
+    const loggedIn = account.signedIn === true;
+    // Also surface whether the user has a separate OPENAI_API_KEY (mode-mismatch nudge)
+    let alsoHasApiKey = false;
+    try {
+      const out = _deps.readUserShellEnv('OPENAI_API_KEY', 4);
+      alsoHasApiKey = !!(out && out.startsWith('sk-'));
+    } catch {}
+    respond({
+      found: account.reason !== 'cli_missing',
+      logged_in: loggedIn,
+      version: null, // `codex login status` prints no version; agent-versions owns that
+      email: account.email || null,
+      plan: account.plan || null,
+      also_has_api_key: alsoHasApiKey,
+      hint: loggedIn ? null
+        : (account.reason === 'cli_missing'
+          ? 'codex CLI not on PATH. Install Codex from https://chatgpt.com/codex'
+          : (account.reason === 'probe_unavailable'
+            ? 'codex login state is only probed by the primary instance'
+            : 'codex installed but not logged in — run `codex login`')),
+    });
+    return;
+  }
+
+async function apiSetupDetectGeminiCli(req, res, url) {
+    const GEMINI_CLI_CREDS = _deps.path.join(_deps.serverConfig.HOME, '.gemini', 'oauth_creds.json');
+    const GEMINI_CLIENT_ID = '681255809395-oo8ft2oprdrnp9e3aqf6av3hmdib135j.apps.googleusercontent.com';
+    const GEMINI_CLIENT_SECRET = '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';
+    const respond = (data) => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify(data)); };
+
+    // 1. Read Gemini CLI creds file
+    let creds;
+    try {
+      if (!_deps.hostIdentityAccessAllowed({ configDir: _deps.CONFIG_DIR })) throw new Error('host identity access not allowed');
+      creds = JSON.parse(_deps.fs.readFileSync(GEMINI_CLI_CREDS, 'utf8'));
+    } catch {
+      respond({ found: false, hint: 'Gemini CLI not installed. Get an API key from aistudio.google.com/apikey' });
+      return;
+    }
+    if (!creds.refresh_token) {
+      respond({ found: false, hint: 'Gemini CLI creds found but no refresh token. Re-run "gemini auth login"' });
+      return;
+    }
+
+    (async () => {
+      // 2. Refresh the OAuth access token
+      let accessToken;
+      try {
+        const tokenResp = await fetch('https://oauth2.googleapis.com/token', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body: new URLSearchParams({
+            client_id: GEMINI_CLIENT_ID,
+            client_secret: GEMINI_CLIENT_SECRET,
+            refresh_token: creds.refresh_token,
+            grant_type: 'refresh_token',
+          }),
+        });
+        const tokenData = await tokenResp.json();
+        if (!tokenData.access_token) throw new Error(tokenData.error_description || 'Token refresh failed');
+        accessToken = tokenData.access_token;
+      } catch (e) {
+        return respond({ found: true, error: 'Token refresh failed: ' + e.message });
+      }
+
+      // 3. Find a GCP project and enable required APIs
+      const authHeaders = { 'Authorization': `Bearer ${accessToken}` };
+      let projectId;
+      try {
+        const projResp = await fetch('https://cloudresourcemanager.googleapis.com/v1/projects?filter=lifecycleState%3AACTIVE&pageSize=10', {
+          headers: authHeaders,
+        });
+        const projData = await projResp.json();
+        projectId = projData.projects?.[0]?.projectId;
+      } catch {}
+      if (!projectId) {
+        return respond({ found: true, error: 'No active GCP project found. Get an API key from aistudio.google.com/apikey instead.' });
+      }
+      const projHeaders = { ...authHeaders, 'x-goog-user-project': projectId };
+
+      // Enable Generative Language API + API Keys API on the project
+      for (const svc of ['generativelanguage.googleapis.com', 'apikeys.googleapis.com']) {
+        try {
+          await fetch(`https://serviceusage.googleapis.com/v1/projects/${projectId}/services/${svc}:enable`, {
+            method: 'POST', headers: authHeaders,
+          });
+        } catch {}
+      }
+
+      // 4. Create a Gemini API key (permanent — no refresh needed)
+      let apiKey;
+      try {
+        // Check for existing Wall-E key first
+        const listResp = await fetch(`https://apikeys.googleapis.com/v2/projects/${projectId}/locations/global/keys`, {
+          headers: projHeaders,
+        });
+        const listData = await listResp.json();
+        const existing = (listData.keys || []).find(k => k.displayName === 'Wall-E Gemini Key (auto-created)');
+        if (existing) {
+          // Re-fetch with keyString
+          const getResp = await fetch(`https://apikeys.googleapis.com/v2/${existing.name}/keyString`, {
+            headers: projHeaders,
+          });
+          const getData = await getResp.json();
+          apiKey = getData.keyString;
+        }
+        if (!apiKey) {
+          // Create new key restricted to Gemini API
+          const createResp = await fetch(`https://apikeys.googleapis.com/v2/projects/${projectId}/locations/global/keys`, {
+            method: 'POST', headers: { ...projHeaders, 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              displayName: 'Wall-E Gemini Key (auto-created)',
+              restrictions: { apiTargets: [{ service: 'generativelanguage.googleapis.com' }] },
+            }),
+          });
+          const createData = await createResp.json();
+          if (createData.error) throw new Error(createData.error.message);
+          // Poll for completion (usually instant)
+          const opName = createData.name;
+          for (let i = 0; i < 10; i++) {
+            const opResp = await fetch(`https://apikeys.googleapis.com/v2/${opName}`, { headers: projHeaders });
+            const opData = await opResp.json();
+            if (opData.done) {
+              // GCP may redact keyString in the LRO response — fetch it via GetKeyString endpoint
+              if (opData.response?.keyString) {
+                apiKey = opData.response.keyString;
+              } else if (opData.response?.name) {
+                const ksResp = await fetch(`https://apikeys.googleapis.com/v2/${opData.response.name}/keyString`, { headers: projHeaders });
+                const ksData = await ksResp.json();
+                apiKey = ksData.keyString;
+              }
+              break;
+            }
+            if (opData.error) throw new Error(opData.error.message);
+            await new Promise(r => setTimeout(r, 1000));
+          }
+        }
+      } catch (e) {
+        return respond({ found: true, error: 'Failed to create API key: ' + e.message + '. Get one manually from aistudio.google.com/apikey' });
+      }
+      if (!apiKey) {
+        return respond({ found: true, error: 'API key creation timed out. Try again or get a key from aistudio.google.com/apikey' });
+      }
+
+      // 5. Test the API key against Gemini API
+      try {
+        const testResp = await fetch(`https://generativelanguage.googleapis.com/v1beta/models?key=${encodeURIComponent(apiKey)}&pageSize=1`);
+        if (testResp.ok) {
+          return respond({
+            found: true, source: 'Gemini CLI (auto-created API key)',
+            api_key: apiKey,
+            model: 'gemini-2.5-flash',
+          });
+        }
+        const errBody = await testResp.json().catch(() => ({}));
+        const errMsg = errBody?.error?.message || `HTTP ${testResp.status}`;
+        return respond({ found: true, error: errMsg });
+      } catch (e) {
+        return respond({ found: true, error: e.message });
+      }
+    })().catch(e => respond({ found: false, error: e.message }));
+    return;
+  }
+
+async function apiSetupDetectClaudeCli(req, res, url) {
+    const respond = (data) => {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(data));
+    };
+    const { spawn } = require('child_process');
+    let proc;
+    try {
+      // spawn (not exec) to avoid shell injection. Looks up `claude` on PATH;
+      // returns ENOENT if not installed.
+      proc = spawn(_deps.resolveAgentCliCommand('claude'), ['--version'], { stdio: ['ignore', 'pipe', 'pipe'], timeout: 5000 });
+    } catch (err) {
+      return respond({ found: false, hint: 'Could not spawn claude: ' + err.message });
+    }
+    let stdout = '';
+    let stderr = '';
+    proc.stdout.on('data', (d) => { stdout += d.toString(); });
+    proc.stderr.on('data', (d) => { stderr += d.toString(); });
+    proc.on('error', (err) => {
+      respond({
+        found: false,
+        hint: err.code === 'ENOENT'
+          ? 'claude CLI not on PATH. Install Claude Code from https://claude.com/claude-code, then run `claude login`.'
+          : 'claude failed: ' + err.message,
+      });
+    });
+    proc.on('close', (code) => {
+      if (code !== 0) {
+        return respond({
+          found: false,
+          hint: 'claude --version exited ' + code + (stderr ? ': ' + stderr.slice(0, 200) : ''),
+        });
+      }
+      // claude --version prints something like "2.1.119 (Claude Code)" — pull the first version-shaped token.
+      const versionMatch = stdout.match(/\d+\.\d+\.\d+/);
+      // WP-0: the login facts come from `claude auth status` (lib/coding-agent-auth).
+      _deps.codingAgentAuth.probeAccount('claude-code').then((account) => {
+        respond({
+          found: true,
+          version: versionMatch ? versionMatch[0] : stdout.trim().slice(0, 40),
+          logged_in: account.signedIn,
+          email: account.email || null,
+          plan: account.plan || null,
+        });
+      }, (error) => {
+        // HANDLE: probeAccount resolves rather than rejects; this keeps a thrown promise from hanging the response.
+        respond({
+          found: true,
+          version: versionMatch ? versionMatch[0] : stdout.trim().slice(0, 40),
+          logged_in: null,
+          email: null,
+          plan: null,
+          hint: 'claude login probe failed: ' + ((error && error.message) || 'unknown error'),
+        });
+      });
+    });
+    return;
+  }
+
+async function apiSetupOauthProxyStart(req, res, url) {
+    const out = _deps.oauthProxySupervisor.start();
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(out));
+    return;
+  }
+
+async function apiSetupOauthProxyStop(req, res, url) {
+    const out = _deps.oauthProxySupervisor.stop();
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(out));
+    return;
+  }
+
+async function apiSetupOauthProxyStatus(req, res, url) {
+    const out = await _deps.oauthProxySupervisor.status();
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(out));
+    return;
+  }
+
+async function apiSetupProviders(req, res, url) {
+    try {
+      const [providersSettled, statusSettled] = await Promise.allSettled([
+        _deps.getWalleModelProviders(2500),
+        _deps.getWalleStatusData(2500),
+      ]);
+      const rows = providersSettled.status === 'fulfilled' ? providersSettled.value : [];
+      const status = statusSettled.status === 'fulfilled' ? statusSettled.value : {};
+      const defaultProvider = _deps.sanitizeSetupProviderType(status.walle_provider || 'anthropic') || 'anthropic';
+      const defaultModel = status.walle_model || '';
+      const providerInstances = rows.map(row => {
+        const envKey = _deps.SETUP_PROVIDER_ENV_KEYS[row.type];
+        const runtime = _deps.providerRuntimeStateFromRow(row.type, row);
+        const authMethod = runtime.authMethod || 'api_key';
+        const hasStoredKey = runtime.hasStoredKey;
+        const hasKey = runtime.hasRuntimeAccess || (envKey ? !!process.env[envKey] : false);
+        const credentialState = _deps.normalizeModelOverviewProviderCredentialState({
+          ...row,
+          auth_method: authMethod,
+          has_key: hasStoredKey,
+          has_stored_key: hasStoredKey,
+        });
+        let status = 'unknown', lastTested = null, error = null;
+        return {
+          id: row.id, type: row.type, name: _deps.SETUP_PROVIDER_NAMES[row.type] || row.name,
+          enabled: !!row.enabled, is_default: row.type === defaultProvider,
+          has_key: hasKey, model: row.type === defaultProvider ? (defaultModel || null) : null,
+          has_stored_key: hasStoredKey,
+          has_api_key: hasKey,
+          has_runtime_access: hasKey,
+          credential_set: hasKey,
+          credential_status: hasKey ? credentialState.credential_status : 'missing',
+          credential_source: credentialState.credential_source || (hasKey ? 'runtime' : ''),
+          base_url: row.base_url || null,
+          auth_method: authMethod,
+          status, last_tested: lastTested, error,
+          created_at: row.created_at,
+          updated_at: row.updated_at,
+        };
+      });
+      const { providers, duplicateDiagnostics, invalidProviderCount } = _deps.collapseSetupProviderInstances(providerInstances, { defaultProvider });
+      if (duplicateDiagnostics.length || invalidProviderCount) {
+        const signature = JSON.stringify({ duplicateDiagnostics, invalidProviderCount });
+        if (!_deps.loggedSetupProviderDuplicateSignatures.has(signature)) {
+          _deps.loggedSetupProviderDuplicateSignatures.add(signature);
+          console.warn('[setup] Collapsed duplicate provider instances for setup health:', {
+            duplicateDiagnostics,
+            invalidProviderCount,
+          });
+        }
+        try {
+          _deps.telemetry.track('setup_provider_instances_collapsed', {
+            duplicate_types: duplicateDiagnostics.map((item) => item.type).join(','),
+            duplicate_groups: duplicateDiagnostics.length,
+            invalid_provider_count: invalidProviderCount,
+          });
+        } catch {}
+      }
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ providers, default_provider: defaultProvider, duplicate_providers: duplicateDiagnostics }));
+    } catch (e) {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ providers: [], default_provider: null, error: e.message }));
+    }
+    return;
+  }
+
+async function apiSetupSaveProvider(req, res, url) {
+    let body = '';
+    let bodyLen = 0;
+    req.on('data', c => { bodyLen += c.length; if (bodyLen > 8192) { req.destroy(); return; } body += c; });
+    req.on('end', async () => {
+      try {
+        const data = JSON.parse(body);
+        const type = _deps.sanitizeSetupProviderType(data.type);
+        if (!_deps.SETUP_PROVIDER_TYPES.includes(type)) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Invalid provider type. Must be one of: ' + _deps.setupProviderTypeList() }));
+          return;
+        }
+        const apiKey = typeof data.api_key === 'string' ? data.api_key.replace(/[\r\n\s]/g, '').slice(0, 200) : '';
+        const hasBaseUrl = Object.prototype.hasOwnProperty.call(data, 'base_url') || Object.prototype.hasOwnProperty.call(data, 'baseUrl');
+        const rawBaseUrl = typeof data.base_url === 'string' ? data.base_url : (typeof data.baseUrl === 'string' ? data.baseUrl : '');
+        const baseUrl = hasBaseUrl ? rawBaseUrl.replace(/[\r\n]/g, '').trim().slice(0, 500) : undefined;
+        const model = typeof data.model === 'string' ? data.model.replace(/[\r\n\s]/g, '').slice(0, 100) : '';
+        const enabled = data.enabled !== false;
+        const setDefault = !!data.set_default;
+        const VALID_AUTH_METHODS = new Set(['api_key', 'claude_cli', 'oauth_proxy', 'codex_cli', 'gemini_cli', 'devbox']);
+        const authMethod = typeof data.auth_method === 'string' && VALID_AUTH_METHODS.has(data.auth_method) ? data.auth_method : null;
+
+        const ownerBody = {
+          type,
+          name: _deps.SETUP_PROVIDER_NAMES[type] || type,
+          api_key: apiKey,
+          model,
+          enabled,
+          set_default: setDefault,
+          auth_method: authMethod,
+        };
+        if (hasBaseUrl) ownerBody.base_url = baseUrl || null;
+        if (typeof data.caCert === 'string' && data.caCert.trim()) ownerBody.caCert = data.caCert.trim();
+
+        const ownerWrite = await _deps.walleOwnerWrite('/api/wall-e/setup/provider', {
+          method: 'POST',
+          body: ownerBody,
+        });
+
+        // Persist .env updates: API key (if provided), WALLE_AUTH_METHOD (if
+        // set for an auth-capable provider), and (set_default is Wall-E-owned, never written here). Note we run this branch even when no apiKey is
+        // present — auth_method=oauth_proxy (and similar CLI methods) do
+        // not require an API key but still need WALLE_AUTH_METHOD wired
+        // into the daemon's env so its provider factory routes correctly.
+        const writesEnv = !!(apiKey && _deps.SETUP_PROVIDER_ENV_KEYS[type])
+          || (authMethod && (type === 'anthropic' || type === 'openai'));
+        if (writesEnv) {
+          const envPath = _deps.resolveEnvFilePath({ repoRoot: _deps.path.resolve(_deps.__dirname, '..'), dataDir: _deps.CONFIG_DIR });
+          const envVar = _deps.SETUP_PROVIDER_ENV_KEYS[type];
+          const lines = [];
+          const keysToReplace = new Set();
+          if (apiKey && envVar) {
+            keysToReplace.add(envVar);
+            if (type === 'google') keysToReplace.add('GEMINI_API_KEY');
+          }
+          if (authMethod && (type === 'anthropic' || type === 'openai')) {
+            keysToReplace.add('WALLE_AUTH_METHOD');
+          }
+          // Auth methods that use keychain/CLI/proxy must NOT leave the old
+          // ANTHROPIC_API_KEY / OPENAI_API_KEY in .env — those env vars
+          // become a conflict source for child processes (e.g. `claude` CLI
+          // emits "Auth conflict: Both a token (claude.ai) and an API key
+          // (ANTHROPIC_API_KEY) are set" because both are present after
+          // we switch to oauth_proxy or claude_cli). Strip the auth env
+          // entirely on those methods so newly-spawned PTY sessions don't
+          // inherit them via process.env. Also clears the legacy gateway
+          // variables that piggyback on ANTHROPIC_*.
+          const KEYCHAIN_AUTH_METHODS = new Set(['oauth_proxy', 'claude_cli']);
+          const stripAnthropicEnv = type === 'anthropic' && authMethod && KEYCHAIN_AUTH_METHODS.has(authMethod);
+          if (stripAnthropicEnv) {
+            keysToReplace.add('ANTHROPIC_API_KEY');
+            keysToReplace.add('ANTHROPIC_AUTH_TOKEN');
+            keysToReplace.add('ANTHROPIC_BASE_URL');
+            keysToReplace.add('ANTHROPIC_CUSTOM_HEADERS_B64');
+          }
+          const stripOpenaiEnv = type === 'openai' && authMethod === 'codex_cli';
+          if (stripOpenaiEnv) {
+            keysToReplace.add('OPENAI_API_KEY');
+            keysToReplace.add('OPENAI_BASE_URL');
+          }
+          try {
+            const existing = _deps.fs.readFileSync(envPath, 'utf8');
+            for (const line of existing.split('\n')) {
+              const m = line.match(/^\s*#?\s*([A-Z0-9_]+)\s*=/);
+              if (m && keysToReplace.has(m[1])) continue;
+              lines.push(line);
+            }
+          } catch { lines.push('# Wall-E configuration'); lines.push(''); }
+          while (lines.length > 0 && lines[lines.length - 1].trim() === '') lines.pop();
+          lines.push('');
+          if (apiKey && envVar) {
+            lines.push(`${envVar}=${apiKey}`);
+            _deps.serverConfig.override(envVar, apiKey, 'provider-api-key-save'); // WP-4: seam, never process.env directly
+          }
+          if (authMethod && (type === 'anthropic' || type === 'openai')) {
+            lines.push(`WALLE_AUTH_METHOD=${authMethod}`);
+            _deps.serverConfig.override("WALLE_AUTH_METHOD", authMethod, 'ctm-config-seam: migrated write site (WP-4 AC-4c)');
+          }
+          // Mirror the strip into process.env so newly-spawned PTY children
+          // don't inherit the conflicting vars. (The .env edit alone only
+          // affects FUTURE CTM boots; live process.env still has them.)
+          if (stripAnthropicEnv) {
+            delete _deps.serverConfig.ANTHROPIC_API_KEY;
+            delete _deps.serverConfig.ANTHROPIC_AUTH_TOKEN;
+            delete _deps.serverConfig.ANTHROPIC_BASE_URL;
+            delete _deps.serverConfig.ANTHROPIC_CUSTOM_HEADERS_B64;
+          }
+          if (stripOpenaiEnv) {
+            delete _deps.serverConfig.OPENAI_API_KEY;
+            delete process.env.OPENAI_BASE_URL;
+          }
+          _deps.atomicWriteFileSync(envPath, lines.join('\n') + '\n', { mode: 0o600 });
+        }
+
+        // OAuth proxy lifecycle: when the user picks auth_method=oauth_proxy
+        // for Anthropic, start the local proxy so the daemon can route
+        // through it on its next restart. When they pick anything else AND
+        // we previously had it set, stop the proxy. Idempotent on both
+        // sides — supervisor returns alreadyRunning/alreadyStopped.
+        if (type === 'anthropic') {
+          try {
+            if (authMethod === 'oauth_proxy') {
+              _deps.oauthProxySupervisor.start();
+            } else if (authMethod && authMethod !== 'oauth_proxy') {
+              if (_deps.oauthProxySupervisor.isRunning()) _deps.oauthProxySupervisor.stop();
+            }
+          } catch (_) { /* supervisor errors don't block save */ }
+        }
+
+        // WP-2 (delegated-implementation-workers-2026-09-24.html §5 D-4, §9 S-5): re-push
+        // the model-proxy route table -- best-effort, never blocks the save response.
+        _deps.oauthProxySupervisor.pushRoutesNow().catch(() => { /* expected: best-effort route re-push -- a proxy that is not running yet must never block a provider save */ });
+
+        // Sync model registry and restart
+        _deps.setup.clearSetupCache();
+        _deps.walleSupervisor.restartQuiet();
+
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(_deps.setupProviderAnswers.providerSaveBody(ownerWrite)));
+      } catch (e) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: e.message }));
+      }
+    });
+    return;
+  }
+
+async function apiSetupTestProvider(req, res, url) {
+    let body = '';
+    let bodyLen = 0;
+    req.on('data', c => { bodyLen += c.length; if (bodyLen > 8192) { req.destroy(); return; } body += c; });
+    req.on('end', async () => {
+      try {
+        const data = JSON.parse(body);
+        const type = _deps.sanitizeSetupProviderType(data.type);
+        const startMs = Date.now();
+        const rawBodyApiKey = typeof data.api_key === 'string' ? data.api_key : (typeof data.apiKey === 'string' ? data.apiKey : '');
+        const bodyApiKey = rawBodyApiKey
+          ? rawBodyApiKey.replace(/[\r\n\s]/g, '').slice(0, 500)
+          : '';
+        const rawBaseUrl = typeof data.base_url === 'string' ? data.base_url : (typeof data.baseUrl === 'string' ? data.baseUrl : '');
+        const bodyBaseUrl = rawBaseUrl.replace(/[\r\n]/g, '').trim().slice(0, 500);
+        const VALID_AUTH_METHODS = new Set(['api_key', 'claude_cli', 'oauth_proxy', 'codex_cli', 'gemini_cli', 'devbox']);
+        const bodyAuthMethod = typeof data.auth_method === 'string' && VALID_AUTH_METHODS.has(data.auth_method)
+          ? data.auth_method
+          : null;
+        const bodyCaCert = typeof data.caCert === 'string' ? data.caCert.trim() : ''; // R-2: Test threads caCert like Save does
+        const respondOwnerProviderTest = async (providerType) => {
+          try {
+            const models = await _deps.listWalleModelsViaOwner({ provider: providerType, apiKey: bodyApiKey, baseUrl: bodyBaseUrl, authMethod: bodyAuthMethod, caCert: bodyCaCert || undefined });
+            const latency = Date.now() - startMs;
+            if (models.length) {
+              res.writeHead(200, { 'Content-Type': 'application/json' });
+              res.end(JSON.stringify({ ok: true, model: _deps.firstModelLabel(models, providerType), latency_ms: latency }));
+            } else {
+              res.writeHead(200, { 'Content-Type': 'application/json' });
+              res.end(JSON.stringify({ ok: false, error: 'No accessible model found' }));
+            }
+          } catch (e) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(_deps.setupProviderAnswers.providerTestFailureBody(e)));
+          }
+        };
+
+        if (type === 'anthropic') {
+          const runtime = await _deps.getProviderRuntimeStateFromWalle('anthropic');
+          const authMethod = bodyAuthMethod
+            ? bodyAuthMethod
+            : runtime.authMethod || 'api_key';
+          if (authMethod === 'claude_cli') {
+            const account = await _deps.codingAgentAuth.probeAccount('claude-code');
+            const result = account.signedIn === true
+              ? {
+                ok: true,
+                model: [account.email, account.plan].filter(Boolean).join(' · ') || 'claude.ai',
+                reply: account.authMethod || 'subscription',
+              }
+              : { ok: false, error: _deps.claudeCliAccountError(account) };
+            const latency = Date.now() - startMs;
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ...result, latency_ms: latency, auth_method: authMethod }));
+            return;
+          }
+          if (authMethod === 'oauth_proxy') {
+            const result = await _deps.probeAnthropicOauthProxy();
+            const latency = Date.now() - startMs;
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ...result, latency_ms: latency, auth_method: authMethod }));
+            return;
+          }
+          await respondOwnerProviderTest('anthropic');
+          return;
+        }
+
+        if (type === 'ollama') {
+          // R-2: a remote/CA'd row routes via the owner-test path (honors baseUrl+caCert); default local keeps the raw probe below
+          if (_deps.shouldRouteOllamaTestViaOwner({ baseUrl: bodyBaseUrl, caCert: bodyCaCert })) {
+            await respondOwnerProviderTest('ollama');
+            return;
+          }
+          try {
+            const resp = await fetch('http://localhost:11434/api/tags', { signal: AbortSignal.timeout(5000) });
+            const latency = Date.now() - startMs;
+            if (resp.ok) {
+              const result = await resp.json();
+              const modelCount = result.models ? result.models.length : 0;
+              res.writeHead(200, { 'Content-Type': 'application/json' });
+              res.end(JSON.stringify({ ok: true, model: `${modelCount} model(s) available`, latency_ms: latency }));
+            } else {
+              res.writeHead(200, { 'Content-Type': 'application/json' });
+              res.end(JSON.stringify({ ok: false, error: `Ollama returned HTTP ${resp.status}` }));
+            }
+          } catch (e) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: false, error: 'Ollama not reachable at localhost:11434', diagnosis: 'Make sure Ollama is running (ollama serve)' }));
+          }
+          return;
+        }
+
+        if (_deps.isSetupProviderType(type)) {
+          await respondOwnerProviderTest(type);
+          return;
+        }
+
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Unknown provider type: ' + type }));
+      } catch (e) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: e.message }));
+      }
+    });
+    return;
+  }
+
+async function apiSetupSetDefault(req, res, url) {
+    let body = '';
+    let bodyLen = 0;
+    req.on('data', c => { bodyLen += c.length; if (bodyLen > 8192) { req.destroy(); return; } body += c; });
+    req.on('end', async () => {
+      try {
+        const data = JSON.parse(body);
+        const type = _deps.sanitizeSetupProviderType(data.type);
+        const currentDefault = await _deps.getWalleDefaultModelSelection();
+        const storedModel = currentDefault.model_provider === type ? currentDefault.model_id : '';
+        const selection = _deps.resolveSetupDefaultSelection({ type, model: data.model, storedModel });
+        if (!selection.ok) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: selection.error }));
+          return;
+        }
+
+        const { requestedModel, targetModel } = selection;
+        const ownerWrite = await _deps.walleOwnerWrite('/api/wall-e/setup/default-provider', {
+          method: 'POST',
+          body: { type, requested_model: requestedModel, target_model: targetModel || '' },
+        });
+
+        _deps.setup.clearSetupCache();
+        const liveUpdated = ownerWrite.owner_write === 'wall-e-api';
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: true, live_updated: liveUpdated, restart_scheduled: false, owner_write: ownerWrite.owner_write }));
+      } catch (e) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: e.message }));
+      }
+    });
+    return;
+  }
+
+async function apiSetupCheckDir(req, res, url) {
+    let body = '', bodyLen = 0;
+    req.on('data', c => { bodyLen += c.length; if (bodyLen > 4096) { req.destroy(); return; } body += c; });
+    req.on('end', () => {
+      try {
+        const data = JSON.parse(body);
+        const dir = (data.dir || '').replace(/[\r\n]/g, '').trim();
+        if (!dir) { res.writeHead(400, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: 'No directory' })); return; }
+        const exists = _deps.fs.existsSync(dir);
+        const hasCtmDb = _deps.fs.existsSync(_deps.path.join(dir, 'task-manager.db'));
+        const hasBrainDb = _deps.fs.existsSync(_deps.path.join(dir, 'wall-e-brain.db'));
+        const hasBackups = _deps.fs.existsSync(_deps.path.join(dir, 'backups'));
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ exists, has_ctm_db: hasCtmDb, has_brain_db: hasBrainDb, has_backups: hasBackups }));
+      } catch (e) { res.writeHead(400, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: e.message })); }
+    });
+    return;
+  }
+
+async function apiSetupEmbeddings(req, res, url) {
+    try {
+      const upstream = await _deps.walleClient.requestJson('/api/wall-e/setup/embeddings');
+      res.writeHead(upstream.status || 200, { 'Content-Type': 'application/json' });
+      res.end(upstream.body || JSON.stringify({ providers: [], stats: {}, totalMemories: 0 }));
+    } catch (e) {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ providers: [], stats: {}, totalMemories: 0, error: e.message }));
+    }
+    return;
+  }
+
+async function apiSetupEmbeddingsSwitch(req, res, url) {
+    _deps.readBody(req).then(async (body) => {
+      const upstream = await _deps.walleClient.requestJson('/api/wall-e/setup/embeddings/switch', { method: 'POST', body });
+      res.writeHead(upstream.status || 200, { 'Content-Type': 'application/json' });
+      res.end(upstream.body || JSON.stringify({ ok: false }));
+    }).catch((e) => {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, message: e.message }));
+    });
+    return;
+  }
+
+async function apiSetupEmbeddingsPolicy(req, res, url) {
+    _deps.readBody(req).then(async (body) => {
+      const upstream = await _deps.walleClient.requestJson('/api/wall-e/setup/embeddings/policy', { method: 'POST', body });
+      res.writeHead(upstream.status || 200, { 'Content-Type': 'application/json' });
+      res.end(upstream.body || JSON.stringify({ ok: false }));
+    }).catch((e) => {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, message: e.message }));
+    });
+    return;
+  }
+
+async function apiSetupEmbeddingsDelete(req, res, url) {
+    _deps.readBody(req).then(async (body) => {
+      const upstream = await _deps.walleClient.requestJson('/api/wall-e/setup/embeddings/delete', { method: 'POST', body });
+      res.writeHead(upstream.status || 200, { 'Content-Type': 'application/json' });
+      res.end(upstream.body || JSON.stringify({ ok: false }));
+    }).catch((e) => {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: e.message }));
+    });
+    return;
+  }
+
+async function apiSetupSaveDirs(req, res, url) {
+    let body = '', bodyLen = 0;
+    req.on('data', c => { bodyLen += c.length; if (bodyLen > 4096) { req.destroy(); return; } body += c; });
+    req.on('end', async () => {
+      try {
+        const data = JSON.parse(body);
+        const ctmDir = (data.ctm_data_dir || '').replace(/[\r\n]/g, '').trim();
+        const walleDir = (data.walle_data_dir || '').replace(/[\r\n]/g, '').trim();
+        const copyData = !!data.copy_data;
+        const envPath = _deps.resolveEnvFilePath({ repoRoot: _deps.path.resolve(_deps.__dirname, '..'), dataDir: _deps.CONFIG_DIR });
+        // Create directories
+        if (ctmDir) try { _deps.fs.mkdirSync(ctmDir, { recursive: true }); } catch {}
+        if (walleDir) try { _deps.fs.mkdirSync(walleDir, { recursive: true }); } catch {}
+        // Copy current databases if requested
+        if (copyData) {
+          const curCtmDir = require('../data-dir').getDataDir();
+          const curWalleDir = _deps.serverConfig.WALL_E_DATA_DIR || _deps.path.join(_deps.os.homedir(), '.walle', 'data');
+          if (ctmDir && ctmDir !== curCtmDir) {
+            const dst = _deps.path.join(ctmDir, 'task-manager.db');
+            if (!_deps.fs.existsSync(dst)) {
+              await _deps._drainCtmDbWorkers('setup-save-dirs-copy', 5000);
+              await _deps.dbModule.copyLiveDatabaseTo(dst);
+            }
+          }
+          if (walleDir && walleDir !== curWalleDir) {
+            const dst = _deps.path.join(walleDir, 'wall-e-brain.db');
+            if (!_deps.fs.existsSync(dst)) {
+              const backup = await _deps.createWalleBrainBackupForCopy();
+              _deps.fs.copyFileSync(backup.backupPath, dst);
+            }
+          }
+        }
+        const lines = [];
+        try {
+          const existing = _deps.fs.readFileSync(envPath, 'utf8');
+          for (const line of existing.split('\n')) {
+            const m = line.match(/^\s*#?\s*([A-Z0-9_]+)\s*=/);
+            if (m && (m[1] === 'CTM_DATA_DIR' || m[1] === 'WALL_E_DATA_DIR')) continue;
+            lines.push(line);
+          }
+        } catch { lines.push('# Wall-E configuration'); lines.push(''); }
+        while (lines.length > 0 && lines[lines.length - 1].trim() === '') lines.pop();
+        lines.push('');
+        if (ctmDir) lines.push('CTM_DATA_DIR=' + ctmDir);
+        if (walleDir) lines.push('WALL_E_DATA_DIR=' + walleDir);
+        _deps.atomicWriteFileSync(envPath, lines.join('\n') + '\n', { mode: 0o600 });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: true }));
+        // Restart everything after a brief delay
+        setTimeout(async () => {
+          // Restart CTM itself. Exit with code 42 — launchd KeepAlive restarts
+          // on non-zero exit. No bash watcher needed (EDR flags detached kill-0
+          // loops as malware).
+          try {
+            _deps._ctmDbClosingForProcessExit = true; // nothing on the serving path may write past the door
+            const dbExit = await _deps._closeDbForProcessExit('data-dir-change'); _deps._exitForLaunchdRestart('data-dir-change', null, { dbClose: _deps._dbCloseOutcome(dbExit) }); // D-7/D-3
+          } catch (e) { // D-3/D-7: as in _scheduleTransportRestart -- a throwing close exits through the door with `post_failed`, never through the fatal/unhandledRejection path
+            console.error('[restart] data-dir-change db close threw: ' + e.message); _deps._exitForLaunchdRestart('data-dir-change', null, { dbClose: 'post_failed' });
+          }
+        }, 1000);
+      } catch (e) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: e.message }));
+      }
+    });
+    return;
+  }
+// WP-6 shard S15: the 17 verbatim bodies above are appended here by
+// bin/move-only-check.js's proof (identical to server.js's declarations up to the `_deps.`
+// prefix and the four rebased requires).
+module.exports = {
+  configure,
+  apiSetupStatus,
+  apiSetupDetectCodexCli,
+  apiSetupDetectGeminiCli,
+  apiSetupDetectClaudeCli,
+  apiSetupOauthProxyStart,
+  apiSetupOauthProxyStop,
+  apiSetupOauthProxyStatus,
+  apiSetupProviders,
+  apiSetupSaveProvider,
+  apiSetupTestProvider,
+  apiSetupSetDefault,
+  apiSetupCheckDir,
+  apiSetupEmbeddings,
+  apiSetupEmbeddingsSwitch,
+  apiSetupEmbeddingsPolicy,
+  apiSetupEmbeddingsDelete,
+  apiSetupSaveDirs,
+};