ec-web 0.0.20 → 0.0.22

package/dist/sources/basic-settings.js

@@ -0,0 +1,818 @@
+import crypto from 'crypto';
+import fs from 'fs';
+import path from 'path';
+import { resolvePaths } from '../paths.js';
+import { detectBaseAgentDetails } from './baseagent-detector.js';
+import { resolveParentDistModule, toFileUrl } from './parent-package.js';
+const BASEAGENTS = ['claude', 'codex', 'gemini', 'ecagent'];
+const BASEAGENT_SET = new Set(BASEAGENTS);
+const EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max']);
+const PROHIBITED_PATH_SEGMENTS = new Set(['__proto__', 'prototype', 'constructor']);
+const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const AID_LABEL = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/;
+const AID_DOMAIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$/;
+const SERVICE_NAME = /^[a-z0-9_-]+$/;
+const SERVICE_SOURCES = new Set(['instance', 'static']);
+const SERVICE_TYPES = new Set(['http', 'websocket', 'ssh']);
+const SERVICE_VISIBILITIES = new Set(['public', 'private', 'aun-auth']);
+const SENSITIVE_METADATA_KEY = /(?:^|[_-])(endpoint|url|uri|token|access[_-]?token|authorization|cookie|secret|password|private[_-]?key|key|cert|certificate)(?:$|[_-])/i;
+const DAEMON_EXACT_PATHS = new Set([
+    'owners',
+    'fullaccess.enabled',
+    'aun.defaultAidDomain',
+    'aun.minEvolVersion',
+    'aun.menuTokenRequired',
+    'aun.defaultEncrypt',
+    'services',
+    'configSnapshots',
+    'idleMonitor.enabled',
+    'idleMonitor.timeout',
+    'idleMonitor.apiRetryTimeout',
+    'idleMonitor.maxExecutionTime',
+    'watch.logTypes',
+    'debug.logLevel',
+    'debug.aunTrace',
+    'debug.aunSdkLog',
+    'debug.upmsg',
+    'debug.eckSnapshots',
+]);
+const DEFAULTS_EXACT_PATHS = new Set([
+    'active_baseagent',
+    'projects.defaultPath',
+    'responseMode',
+    'responseModeParams.single-session.pre_tool_1stmsgchk',
+    'responseModeParams.single-session.tool_use_reminder',
+    'config.chatMode',
+    'config.mentionMode',
+    'config.show_activities',
+    'session_renew.enabled',
+    'session_renew.after_hours',
+    'session_renew.fallback_action',
+]);
+const BASEAGENT_COMMON_FIELDS = new Set([
+    'model',
+    'auxiliaryModel',
+    'auxiliaryEffort',
+    'fallbackModels',
+    'apiKey',
+]);
+const BASEAGENT_FIELDS = {
+    claude: new Set([
+        ...BASEAGENT_COMMON_FIELDS,
+        'effort',
+        'baseUrl',
+        'headers',
+        'queryParams',
+        'pathToClaudeCodeExecutable',
+        'useSettingSources',
+        'agentProgressSummaries',
+        'excludeDynamicSections',
+    ]),
+    codex: new Set([
+        ...BASEAGENT_COMMON_FIELDS,
+        'effort',
+        'baseUrl',
+        'headers',
+        'queryParams',
+        'enableRequestUserInput',
+        'approvalsReviewer',
+    ]),
+    gemini: new Set([
+        ...BASEAGENT_COMMON_FIELDS,
+        'cliPath',
+        'mode',
+        'useVertex',
+        'project',
+        'location',
+    ]),
+    ecagent: new Set([
+        ...BASEAGENT_COMMON_FIELDS,
+        'effort',
+        'baseUrl',
+        'headers',
+        'queryParams',
+        'timeoutMs',
+        'maxRetries',
+        'maxRetryDelayMs',
+    ]),
+};
+const BOOLEAN_PATHS = new Set([
+    'fullaccess.enabled',
+    'aun.menuTokenRequired',
+    'aun.defaultEncrypt',
+    'configSnapshots',
+    'idleMonitor.enabled',
+    'debug.aunTrace',
+    'debug.aunSdkLog',
+    'debug.upmsg',
+    'debug.eckSnapshots',
+    'responseModeParams.single-session.pre_tool_1stmsgchk',
+    'responseModeParams.single-session.tool_use_reminder',
+    'session_renew.enabled',
+]);
+const BASEAGENT_BOOLEAN_FIELDS = new Set([
+    'useSettingSources',
+    'agentProgressSummaries',
+    'excludeDynamicSections',
+    'enableRequestUserInput',
+    'useVertex',
+]);
+const RESTART_DAEMON_PREFIXES = [
+    'owners',
+    'aun.',
+    'services',
+    'configSnapshots',
+    'idleMonitor.',
+    'debug.',
+];
+const RESTART_DEFAULTS_PREFIXES = [
+    'active_baseagent',
+    'baseagents.',
+];
+let configManagerPromise = null;
+async function getConfigManager() {
+    if (!configManagerPromise) {
+        configManagerPromise = import(toFileUrl(resolveParentDistModule('config', 'config-manager.js')))
+            .then((mod) => {
+            if (!mod.ConfigTarget || typeof mod.read !== 'function' || typeof mod.mutateConfig !== 'function' || typeof mod.validateConfig !== 'function') {
+                throw new Error('Required ConfigManager exports are unavailable');
+            }
+            return mod;
+        });
+    }
+    return configManagerPromise;
+}
+function isRecord(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+function clone(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+function stableValue(value) {
+    if (Array.isArray(value))
+        return value.map(stableValue);
+    if (!isRecord(value))
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, nested]) => [key, stableValue(nested)]));
+}
+export function basicSettingsRevision(config) {
+    return crypto.createHash('sha256').update(JSON.stringify(stableValue(config))).digest('hex');
+}
+function pathSegments(fieldPath) {
+    if (!fieldPath || fieldPath.startsWith('.') || fieldPath.endsWith('.') || fieldPath.includes('..')) {
+        throw new Error(`Invalid settings path: ${fieldPath || '(empty)'}`);
+    }
+    const segments = fieldPath.split('.');
+    if (segments.some(segment => !segment || PROHIBITED_PATH_SEGMENTS.has(segment))) {
+        throw new Error(`Unsafe settings path: ${fieldPath}`);
+    }
+    return segments;
+}
+function baseagentPath(fieldPath) {
+    const match = fieldPath.match(/^baseagents\.([a-z0-9_-]+)\.([A-Za-z][A-Za-z0-9]*)$/);
+    if (!match)
+        return null;
+    return { baseagent: match[1], field: match[2] };
+}
+export function isAllowedBasicSettingsPath(file, fieldPath) {
+    try {
+        pathSegments(fieldPath);
+    }
+    catch {
+        return false;
+    }
+    if (file === 'daemon')
+        return DAEMON_EXACT_PATHS.has(fieldPath);
+    if (DEFAULTS_EXACT_PATHS.has(fieldPath))
+        return true;
+    const parsed = baseagentPath(fieldPath);
+    return !!parsed && BASEAGENT_SET.has(parsed.baseagent) && BASEAGENT_FIELDS[parsed.baseagent]?.has(parsed.field);
+}
+function assertString(value, fieldPath, options = {}) {
+    if (typeof value !== 'string')
+        throw new Error(`${fieldPath} must be a string`);
+    if (!options.allowEmpty && !value.trim())
+        throw new Error(`${fieldPath} cannot be empty`);
+    if (value.length > (options.max ?? 4096))
+        throw new Error(`${fieldPath} is too long`);
+    return value;
+}
+function assertBoolean(value, fieldPath) {
+    if (typeof value !== 'boolean')
+        throw new Error(`${fieldPath} must be a boolean`);
+}
+function assertFiniteNumber(value, fieldPath, options = {}) {
+    if (typeof value !== 'number' || !Number.isFinite(value))
+        throw new Error(`${fieldPath} must be a finite number`);
+    if (options.integer && !Number.isInteger(value))
+        throw new Error(`${fieldPath} must be an integer`);
+    if (options.min !== undefined && value < options.min)
+        throw new Error(`${fieldPath} must be at least ${options.min}`);
+    if (options.exclusiveMin !== undefined && value <= options.exclusiveMin)
+        throw new Error(`${fieldPath} must be greater than ${options.exclusiveMin}`);
+    if (options.max !== undefined && value > options.max)
+        throw new Error(`${fieldPath} must be at most ${options.max}`);
+    return value;
+}
+function isValidAid(value) {
+    const labels = value.split('.');
+    return labels.length >= 3 && labels.every(label => AID_LABEL.test(label));
+}
+function assertStringMap(value, fieldPath, headerMap) {
+    if (!isRecord(value))
+        throw new Error(`${fieldPath} must be an object`);
+    if (Object.keys(value).length > 100)
+        throw new Error(`${fieldPath} has too many entries`);
+    for (const [key, nested] of Object.entries(value)) {
+        if (!key || key.length > 256 || PROHIBITED_PATH_SEGMENTS.has(key))
+            throw new Error(`${fieldPath} contains an invalid key`);
+        if (headerMap && !HEADER_NAME.test(key))
+            throw new Error(`${fieldPath} contains an invalid HTTP header name: ${key}`);
+        if (typeof nested !== 'string')
+            throw new Error(`${fieldPath}.${key} must be a string`);
+        if (nested.length > 8192)
+            throw new Error(`${fieldPath}.${key} is too long`);
+        if (headerMap && /[\0\r\n]/.test(nested))
+            throw new Error(`${fieldPath}.${key} cannot contain NUL or line breaks`);
+    }
+}
+function assertServiceEndpoint(value, fieldPath) {
+    const raw = assertString(value, fieldPath, { max: 2048 }).trim();
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error(`${fieldPath} must be a valid URL`);
+    }
+    if (!['http:', 'https:', 'ws:', 'wss:'].includes(parsed.protocol)) {
+        throw new Error(`${fieldPath} must use http, https, ws, or wss`);
+    }
+    const host = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (host !== 'localhost' && !/^127(?:\.\d{1,3}){3}$/.test(host)) {
+        throw new Error(`${fieldPath} must point to localhost or 127.0.0.0/8`);
+    }
+}
+function assertServiceMetadata(value, fieldPath) {
+    assertStringMap(value, fieldPath, false);
+    for (const key of Object.keys(value)) {
+        if (SENSITIVE_METADATA_KEY.test(key))
+            throw new Error(`${fieldPath} cannot contain sensitive key: ${key}`);
+    }
+}
+function assertOwners(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        throw new Error('owners must contain at least one AID');
+    if (value.length > 100)
+        throw new Error('owners has too many entries');
+    const normalized = value.map(item => assertString(item, 'owners[]', { max: 253 }).trim());
+    if (normalized.some(owner => !isValidAid(owner)))
+        throw new Error('owners contains an invalid AID');
+    if (new Set(normalized).size !== normalized.length)
+        throw new Error('owners contains duplicate AIDs');
+}
+function assertServices(value) {
+    if (!Array.isArray(value))
+        throw new Error('services must be an array');
+    if (value.length > 100)
+        throw new Error('services has too many entries');
+    const names = new Set();
+    value.forEach((service, index) => {
+        if (!isRecord(service))
+            throw new Error(`services[${index}] must be an object`);
+        const allowedKeys = new Set(['name', 'enabled', 'port', 'proxy']);
+        if (Object.keys(service).some(key => !allowedKeys.has(key)))
+            throw new Error(`services[${index}] contains an unsupported field`);
+        const name = assertString(service.name, `services[${index}].name`, { max: 64 });
+        if (!SERVICE_NAME.test(name))
+            throw new Error(`services[${index}].name must contain only lowercase letters, digits, _ or -`);
+        if (names.has(name))
+            throw new Error(`services contains duplicate name: ${name}`);
+        names.add(name);
+        assertBoolean(service.enabled, `services[${index}].enabled`);
+        if (service.port !== undefined)
+            assertFiniteNumber(service.port, `services[${index}].port`, { integer: true, min: 1, max: 65535 });
+        if (service.proxy !== undefined) {
+            if (!isRecord(service.proxy))
+                throw new Error(`services[${index}].proxy must be an object`);
+            const allowedProxyKeys = new Set(['enabled', 'source', 'endpoint', 'serviceType', 'visibility', 'metadata']);
+            if (Object.keys(service.proxy).some(key => !allowedProxyKeys.has(key)))
+                throw new Error(`services[${index}].proxy contains an unsupported field`);
+            if (service.proxy.enabled !== undefined)
+                assertBoolean(service.proxy.enabled, `services[${index}].proxy.enabled`);
+            if (service.proxy.source !== undefined && !SERVICE_SOURCES.has(String(service.proxy.source)))
+                throw new Error(`services[${index}].proxy.source must be instance or static`);
+            if (service.proxy.endpoint !== undefined)
+                assertServiceEndpoint(service.proxy.endpoint, `services[${index}].proxy.endpoint`);
+            if (service.proxy.serviceType !== undefined && !SERVICE_TYPES.has(String(service.proxy.serviceType))) {
+                throw new Error(`services[${index}].proxy.serviceType must be http, websocket, or ssh`);
+            }
+            if (service.proxy.visibility !== undefined && !SERVICE_VISIBILITIES.has(String(service.proxy.visibility))) {
+                throw new Error(`services[${index}].proxy.visibility is invalid`);
+            }
+            if (service.proxy.metadata !== undefined)
+                assertServiceMetadata(service.proxy.metadata, `services[${index}].proxy.metadata`);
+            if (service.proxy.enabled === true && (!SERVICE_SOURCES.has(String(service.proxy.source)) || !service.proxy.visibility)) {
+                throw new Error(`services[${index}].proxy requires source and visibility when enabled`);
+            }
+            if (service.proxy.enabled === true && service.proxy.source === 'static' && !service.proxy.endpoint) {
+                throw new Error(`services[${index}].proxy.endpoint is required when source is static`);
+            }
+        }
+    });
+}
+function assertStringArray(value, fieldPath) {
+    if (!Array.isArray(value))
+        throw new Error(`${fieldPath} must be an array`);
+    if (value.length > 100)
+        throw new Error(`${fieldPath} has too many entries`);
+    const strings = value.map(item => assertString(item, `${fieldPath}[]`, { max: 256 }).trim());
+    if (new Set(strings).size !== strings.length)
+        throw new Error(`${fieldPath} contains duplicate values`);
+}
+function assertFallbackModels(value, fieldPath) {
+    if (!Array.isArray(value))
+        throw new Error(`${fieldPath} must be an array`);
+    if (value.length > 3)
+        throw new Error(`${fieldPath} supports at most 3 models`);
+    const models = new Set();
+    value.forEach((item, index) => {
+        if (!isRecord(item))
+            throw new Error(`${fieldPath}[${index}] must be an object`);
+        if (Object.keys(item).some(key => key !== 'model' && key !== 'effort'))
+            throw new Error(`${fieldPath}[${index}] contains an unsupported field`);
+        const model = assertString(item.model, `${fieldPath}[${index}].model`, { max: 512 }).trim();
+        if (models.has(model))
+            throw new Error(`${fieldPath} contains duplicate models`);
+        models.add(model);
+        if (item.effort !== undefined) {
+            const effort = assertString(item.effort, `${fieldPath}[${index}].effort`, { max: 16 });
+            if (!EFFORTS.has(effort))
+                throw new Error(`${fieldPath}[${index}].effort is invalid`);
+        }
+    });
+}
+function assertHttpUrl(value, fieldPath) {
+    const raw = assertString(value, fieldPath, { max: 2048 }).trim();
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error(`${fieldPath} must be a valid URL`);
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        throw new Error(`${fieldPath} must use http or https`);
+}
+function validateDaemonValue(fieldPath, value) {
+    if (BOOLEAN_PATHS.has(fieldPath))
+        return assertBoolean(value, fieldPath);
+    if (fieldPath === 'owners')
+        return assertOwners(value);
+    if (fieldPath === 'services')
+        return assertServices(value);
+    if (fieldPath === 'watch.logTypes')
+        return assertStringArray(value, fieldPath);
+    if (fieldPath === 'aun.defaultAidDomain') {
+        const domain = assertString(value, fieldPath, { max: 253 }).trim();
+        if (!AID_DOMAIN.test(domain) || /^(?:\d{1,3}\.){3}\d{1,3}$/.test(domain) || domain.toLowerCase().endsWith('.localhost')) {
+            throw new Error(`${fieldPath} must be a valid multi-level domain`);
+        }
+        return;
+    }
+    if (fieldPath === 'aun.minEvolVersion') {
+        const version = assertString(value, fieldPath, { max: 64 }).trim();
+        if (!/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/.test(version))
+            throw new Error(`${fieldPath} must be a semantic version such as 1.6.0`);
+        return;
+    }
+    if (fieldPath === 'debug.logLevel') {
+        if (!['DEBUG', 'INFO', 'WARN', 'ERROR'].includes(String(value)))
+            throw new Error(`${fieldPath} is invalid`);
+        return;
+    }
+    if (fieldPath === 'idleMonitor.timeout' || fieldPath === 'idleMonitor.apiRetryTimeout') {
+        assertFiniteNumber(value, fieldPath, { exclusiveMin: 0 });
+        return;
+    }
+    if (fieldPath === 'idleMonitor.maxExecutionTime') {
+        assertFiniteNumber(value, fieldPath, { min: 0 });
+        return;
+    }
+    throw new Error(`Unsupported daemon settings path: ${fieldPath}`);
+}
+function validateBaseagentValue(baseagent, field, fieldPath, value) {
+    if (BASEAGENT_BOOLEAN_FIELDS.has(field))
+        return assertBoolean(value, fieldPath);
+    if (field === 'model' || field === 'auxiliaryModel' || field === 'apiKey' || field === 'pathToClaudeCodeExecutable' || field === 'cliPath' || field === 'project' || field === 'location') {
+        const stringValue = assertString(value, fieldPath, { max: field === 'apiKey' ? 8192 : 4096 });
+        if (field === 'apiKey' && ['<redacted>', '******'].includes(stringValue))
+            throw new Error(`${fieldPath} must contain a replacement secret, not the redacted placeholder`);
+        return;
+    }
+    if (field === 'effort' || field === 'auxiliaryEffort') {
+        const effort = assertString(value, fieldPath, { max: 16 });
+        if (!EFFORTS.has(effort))
+            throw new Error(`${fieldPath} is invalid`);
+        return;
+    }
+    if (field === 'baseUrl')
+        return assertHttpUrl(value, fieldPath);
+    if (field === 'headers')
+        return assertStringMap(value, fieldPath, true);
+    if (field === 'queryParams')
+        return assertStringMap(value, fieldPath, false);
+    if (field === 'fallbackModels')
+        return assertFallbackModels(value, fieldPath);
+    if (field === 'approvalsReviewer') {
+        if (!['user', 'auto_review', 'guardian_subagent'].includes(String(value)))
+            throw new Error(`${fieldPath} is invalid`);
+        return;
+    }
+    if (field === 'mode') {
+        if (baseagent !== 'gemini' || !['cli', 'sdk'].includes(String(value)))
+            throw new Error(`${fieldPath} is invalid`);
+        return;
+    }
+    if (field === 'timeoutMs')
+        return void assertFiniteNumber(value, fieldPath, { integer: true, min: 1, max: 3_600_000 });
+    if (field === 'maxRetries')
+        return void assertFiniteNumber(value, fieldPath, { integer: true, min: 0, max: 100 });
+    if (field === 'maxRetryDelayMs')
+        return void assertFiniteNumber(value, fieldPath, { integer: true, min: 0, max: 3_600_000 });
+    throw new Error(`Unsupported Base Agent settings path: ${fieldPath}`);
+}
+function validateDefaultsValue(fieldPath, value) {
+    if (BOOLEAN_PATHS.has(fieldPath))
+        return assertBoolean(value, fieldPath);
+    const parsed = baseagentPath(fieldPath);
+    if (parsed)
+        return validateBaseagentValue(parsed.baseagent, parsed.field, fieldPath, value);
+    if (fieldPath === 'active_baseagent') {
+        if (!BASEAGENT_SET.has(String(value)))
+            throw new Error(`${fieldPath} is invalid`);
+        return;
+    }
+    if (fieldPath === 'projects.defaultPath') {
+        const configuredPath = assertString(value, fieldPath, { max: 4096 }).trim();
+        if (!path.isAbsolute(configuredPath))
+            throw new Error(`${fieldPath} must be an absolute path`);
+        return;
+    }
+    if (fieldPath === 'responseMode') {
+        if (value !== 'single-session')
+            throw new Error(`${fieldPath} must be single-session`);
+        return;
+    }
+    if (fieldPath === 'config.chatMode') {
+        if (!['interactive', 'proactive'].includes(String(value)))
+            throw new Error(`${fieldPath} is invalid`);
+        return;
+    }
+    if (fieldPath === 'config.mentionMode') {
+        if (!['disabled', 'mention-only'].includes(String(value)))
+            throw new Error(`${fieldPath} is invalid`);
+        return;
+    }
+    if (fieldPath === 'config.show_activities') {
+        if (!['all', 'text', 'none'].includes(String(value)))
+            throw new Error(`${fieldPath} is invalid`);
+        return;
+    }
+    if (fieldPath === 'session_renew.after_hours')
+        return void assertFiniteNumber(value, fieldPath, { exclusiveMin: 0 });
+    if (fieldPath === 'session_renew.fallback_action') {
+        if (!['continue', 'new'].includes(String(value)))
+            throw new Error(`${fieldPath} is invalid`);
+        return;
+    }
+    throw new Error(`Unsupported defaults settings path: ${fieldPath}`);
+}
+export function validateBasicSettingsChange(file, change) {
+    if (!isRecord(change))
+        throw new Error('Each change must be an object');
+    if (!isAllowedBasicSettingsPath(file, change.path))
+        throw new Error(`Settings path is not editable: ${change.path}`);
+    if (change.op !== 'set' && change.op !== 'unset')
+        throw new Error(`Invalid operation for ${change.path}`);
+    if (change.op === 'unset') {
+        if (change.path === 'owners' || change.path === 'active_baseagent' || change.path === 'services') {
+            throw new Error(`${change.path} cannot be unset`);
+        }
+        return;
+    }
+    if (!Object.prototype.hasOwnProperty.call(change, 'value'))
+        throw new Error(`Missing value for ${change.path}`);
+    if (file === 'daemon')
+        validateDaemonValue(change.path, change.value);
+    else
+        validateDefaultsValue(change.path, change.value);
+}
+function validateBaseagentAvailability(config, changes) {
+    const details = detectBaseAgentDetails(config);
+    const detected = new Set(details.filter(item => item.detected).map(item => item.id));
+    const configured = new Set(details.filter(item => item.configured).map(item => item.id));
+    for (const change of changes) {
+        if (change.path === 'active_baseagent' && change.op === 'set' && !detected.has(String(change.value))) {
+            throw Object.assign(new Error(`active_baseagent is not available on this machine: ${String(change.value)}`), { statusCode: 400 });
+        }
+        const parsed = baseagentPath(change.path);
+        if (parsed && !detected.has(parsed.baseagent) && !configured.has(parsed.baseagent)) {
+            throw Object.assign(new Error(`Base Agent is not available on this machine: ${parsed.baseagent}`), { statusCode: 400 });
+        }
+    }
+}
+function setAtPath(root, segments, value) {
+    let cursor = root;
+    for (const segment of segments.slice(0, -1)) {
+        if (!isRecord(cursor[segment]))
+            cursor[segment] = {};
+        cursor = cursor[segment];
+    }
+    cursor[segments[segments.length - 1]] = clone(value);
+}
+function unsetAtPath(root, segments) {
+    let cursor = root;
+    for (const segment of segments.slice(0, -1)) {
+        if (!isRecord(cursor[segment]))
+            return;
+        cursor = cursor[segment];
+    }
+    delete cursor[segments[segments.length - 1]];
+}
+export function applyBasicSettingsChanges(config, file, changes) {
+    if (!Array.isArray(changes) || changes.length === 0)
+        throw new Error('changes must be a non-empty array');
+    if (changes.length > 200)
+        throw new Error('Too many settings changes');
+    const seen = new Set();
+    for (const change of changes) {
+        validateBasicSettingsChange(file, change);
+        if (seen.has(change.path))
+            throw new Error(`Duplicate settings path: ${change.path}`);
+        seen.add(change.path);
+        const segments = pathSegments(change.path);
+        if (change.op === 'set')
+            setAtPath(config, segments, change.value);
+        else
+            unsetAtPath(config, segments);
+    }
+    return config;
+}
+export function restartRequiredForChanges(file, changes) {
+    const prefixes = file === 'daemon' ? RESTART_DAEMON_PREFIXES : RESTART_DEFAULTS_PREFIXES;
+    return changes.map(change => change.path).filter(fieldPath => prefixes.some(prefix => fieldPath === prefix || fieldPath.startsWith(prefix)));
+}
+function redactSecrets(config, file, secrets, secretRefs, options = {}) {
+    const redacted = clone(config);
+    if (file !== 'defaults' || !isRecord(redacted.baseagents))
+        return redacted;
+    for (const [name, raw] of Object.entries(redacted.baseagents)) {
+        if (!isRecord(raw))
+            continue;
+        if (Object.prototype.hasOwnProperty.call(raw, 'apiKey')) {
+            const keyPath = `defaults.baseagents.${name}.apiKey`;
+            const value = typeof raw.apiKey === 'string' ? raw.apiKey.trim() : '';
+            const envMatch = value.match(/^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/) || value.match(/^\$ENV:([A-Za-z_][A-Za-z0-9_]*)$/);
+            if (envMatch) {
+                secretRefs[keyPath] = envMatch[1];
+                raw.apiKey = envMatch[1];
+            }
+            else {
+                secrets[keyPath] = true;
+                raw.apiKey = '******';
+            }
+        }
+        // Headers and query parameters are also common credential channels. They
+        // remain visible to local callers for editing, but remote snapshots must
+        // not disclose any map value, including values under custom key names.
+        if (options.redactConnectionMaps) {
+            for (const field of ['headers', 'queryParams']) {
+                if (!Object.prototype.hasOwnProperty.call(raw, field))
+                    continue;
+                const fieldPath = `defaults.baseagents.${name}.${field}`;
+                if (isRecord(raw[field])) {
+                    raw[field] = Object.fromEntries(Object.keys(raw[field]).map(key => {
+                        secrets[`${fieldPath}.${key}`] = true;
+                        return [key, '******'];
+                    }));
+                }
+                else {
+                    secrets[fieldPath] = true;
+                    raw[field] = '******';
+                }
+            }
+        }
+    }
+    return redacted;
+}
+const WATCH_LOG_FILE = /\.(?:log|jsonl|out)(?:\..+)?$/;
+/**
+ * Keep this normalization aligned with `ec watch log`'s shortLogName().
+ * Configured values may already be shortened names or rotated names without
+ * a file extension, so both forms use the same date/hour suffix rules.
+ */
+function shortLogName(fileName) {
+    const baseName = path.basename(fileName.trim());
+    const stem = baseName.replace(WATCH_LOG_FILE, '');
+    return stem
+        .replace(/-\d{8}-\d{2}$/, '')
+        .replace(/-\d{8}$/, '')
+        .replace(/-\d{4}-\d{2}-\d{2}(?:-\d{2})?$/, '');
+}
+function logicalLogType(fileName) {
+    const baseName = path.basename(fileName);
+    return WATCH_LOG_FILE.test(baseName) ? shortLogName(baseName) : null;
+}
+export function collectLogTypeStats(configured, logsDir = resolvePaths().logs) {
+    const counts = new Map();
+    if (Array.isArray(configured)) {
+        configured
+            .filter(item => typeof item === 'string' && item.trim())
+            .forEach(item => {
+            const type = shortLogName(item);
+            if (type)
+                counts.set(type, counts.get(type) || 0);
+        });
+    }
+    try {
+        for (const entry of fs.readdirSync(logsDir, { withFileTypes: true })) {
+            if (!entry.isFile())
+                continue;
+            const type = logicalLogType(entry.name);
+            if (type)
+                counts.set(type, (counts.get(type) || 0) + 1);
+        }
+    }
+    catch {
+        // An empty or not-yet-created logs directory is a valid state.
+    }
+    const types = [...counts.keys()].sort((left, right) => left.localeCompare(right));
+    return { types, counts: Object.fromEntries(types.map(type => [type, counts.get(type) || 0])) };
+}
+export function collectLogTypes(configured, logsDir = resolvePaths().logs) {
+    return collectLogTypeStats(configured, logsDir).types;
+}
+async function readSnapshot(options = {}) {
+    const modules = await getConfigManager();
+    const daemonFile = modules.read(modules.ConfigTarget.Process, undefined, { cache: false, expand: false });
+    const defaultsFile = modules.read(modules.ConfigTarget.Defaults, undefined, { cache: false, expand: false });
+    // mutateConfig starts a missing file from the schema skeleton. Use the same
+    // logical value for the optimistic-concurrency revision so first save works.
+    const rawDaemon = daemonFile ?? { $schema_version: 6 };
+    const rawDefaults = defaultsFile ?? { $schema_version: 5 };
+    const secrets = {};
+    const secretRefs = {};
+    const logTypeStats = collectLogTypeStats(rawDaemon?.watch?.logTypes);
+    return {
+        daemon: redactSecrets(rawDaemon, 'daemon', secrets, secretRefs, options),
+        defaults: redactSecrets(rawDefaults, 'defaults', secrets, secretRefs, options),
+        revisions: {
+            daemon: basicSettingsRevision(rawDaemon),
+            defaults: basicSettingsRevision(rawDefaults),
+        },
+        secrets,
+        secretRefs,
+        baseagents: detectBaseAgentDetails(rawDefaults),
+        logTypes: logTypeStats.types,
+        logTypeCounts: logTypeStats.counts,
+    };
+}
+function sendJson(res, status, payload) {
+    res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify(payload));
+}
+function readJsonBody(req, maxBytes = 512 * 1024) {
+    return new Promise((resolve, reject) => {
+        let body = '';
+        req.on('data', (chunk) => {
+            body += chunk.toString();
+            if (body.length > maxBytes) {
+                reject(Object.assign(new Error('Request body too large'), { statusCode: 413 }));
+                req.destroy();
+            }
+        });
+        req.on('end', () => {
+            try {
+                resolve(body.trim() ? JSON.parse(body) : {});
+            }
+            catch {
+                reject(Object.assign(new Error('Request body must be valid JSON'), { statusCode: 400 }));
+            }
+        });
+        req.on('error', reject);
+    });
+}
+function errorStatus(error) {
+    if (Number.isInteger(error?.statusCode))
+        return error.statusCode;
+    if (error?.code === 'BASIC_SETTINGS_REVISION_CONFLICT')
+        return 409;
+    if (error?.code === 'SCHEMA_INVALID' || error?.code === 'AUN_GATEWAY_URL_REMOVED')
+        return 400;
+    if (error instanceof Error && /settings|changes|must|cannot|invalid|unsupported|duplicate|empty|value|path/i.test(error.message))
+        return 400;
+    return 500;
+}
+function requestedSecretPath(file, fieldPath) {
+    if (file !== 'defaults')
+        return false;
+    const match = fieldPath.match(/^baseagents\.([a-z0-9_-]+)\.apiKey$/);
+    return !!match && BASEAGENT_SET.has(match[1]);
+}
+function readAtPath(root, fieldPath) {
+    return fieldPath.split('.').reduce((current, segment) => {
+        if (!isRecord(current))
+            return undefined;
+        return current[segment];
+    }, root);
+}
+/**
+ * Normalize the API pathname before matching it. Service proxies may forward
+ * either origin-form or absolute-form request targets, and some proxy layers
+ * append a trailing slash to nested resources.
+ */
+function basicSettingsPath(rawUrl) {
+    try {
+        const pathname = new URL(rawUrl || '/', 'http://localhost').pathname;
+        return pathname.replace(/\/+$/, '') || '/';
+    }
+    catch {
+        return rawUrl.split('?')[0].replace(/\/+$/, '') || '/';
+    }
+}
+export async function handleBasicSettingsApi(req, res, options = {}) {
+    try {
+        const url = new URL(req.url || '', 'http://localhost');
+        const pathname = basicSettingsPath(req.url || '');
+        if (req.method === 'GET' && pathname === '/api/basic-settings') {
+            sendJson(res, 200, { success: true, data: await readSnapshot(options) });
+            return;
+        }
+        if (req.method === 'GET' && pathname === '/api/basic-settings/secret') {
+            const file = url.searchParams.get('file') || 'defaults';
+            const fieldPath = url.searchParams.get('path') || '';
+            if (!requestedSecretPath(file, fieldPath)) {
+                throw Object.assign(new Error('Only Base Agent apiKey fields can be revealed'), { statusCode: 400 });
+            }
+            const modules = await getConfigManager();
+            const rawDefaults = modules.read(modules.ConfigTarget.Defaults, undefined, { cache: false, expand: false });
+            const value = readAtPath(rawDefaults, fieldPath);
+            if (typeof value !== 'string' || !value.trim()) {
+                throw Object.assign(new Error('API Key is not configured'), { statusCode: 404 });
+            }
+            sendJson(res, 200, { success: true, data: { file, path: fieldPath, value } });
+            return;
+        }
+        if (req.method === 'PATCH' && pathname === '/api/basic-settings') {
+            const body = await readJsonBody(req);
+            if (!isRecord(body) || (body.file !== 'daemon' && body.file !== 'defaults'))
+                throw new Error('file must be daemon or defaults');
+            if (typeof body.revision !== 'string' || !/^[a-f0-9]{64}$/.test(body.revision))
+                throw new Error('revision is required');
+            if (!Array.isArray(body.changes))
+                throw new Error('changes must be an array');
+            const file = body.file;
+            const changes = body.changes;
+            changes.forEach(change => validateBasicSettingsChange(file, change));
+            const modules = await getConfigManager();
+            const target = file === 'daemon' ? modules.ConfigTarget.Process : modules.ConfigTarget.Defaults;
+            const mutation = modules.mutateConfig(target, undefined, config => {
+                if (basicSettingsRevision(config) !== body.revision) {
+                    throw Object.assign(new Error('Configuration changed after it was loaded. Reload and try again.'), {
+                        code: 'BASIC_SETTINGS_REVISION_CONFLICT',
+                    });
+                }
+                if (file === 'defaults')
+                    validateBaseagentAvailability(config, changes);
+                applyBasicSettingsChanges(config, file, changes);
+                const errors = modules.validateConfig(target, config);
+                if (errors.length > 0) {
+                    throw Object.assign(new Error(errors.join('; ')), { code: 'SCHEMA_INVALID' });
+                }
+            });
+            const restartPaths = restartRequiredForChanges(file, changes);
+            sendJson(res, 200, {
+                success: true,
+                changed: mutation.changed,
+                restartRequired: mutation.changed && restartPaths.length > 0,
+                restartPaths: mutation.changed ? restartPaths : [],
+                data: await readSnapshot(options),
+            });
+            return;
+        }
+        sendJson(res, 405, { success: false, error: 'Method not allowed' });
+    }
+    catch (error) {
+        const status = errorStatus(error);
+        if (status >= 500)
+            console.error('[basic-settings] API error:', error);
+        sendJson(res, status, {
+            success: false,
+            code: error?.code,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}