evolcore 0.0.39 → 0.0.40

package/dist/ecweb/basic-settings-service.js

@@ -0,0 +1,709 @@
+import crypto from 'node:crypto';
+import path from 'node:path';
+import { ConfigTarget, mutateConfig, read, validateConfig, } from '../config/config-manager.js';
+const BASEAGENTS = ['claude', 'codex', 'gemini', 'ecagent'];
+const BASEAGENT_SET = new Set(BASEAGENTS);
+const EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max']);
+const PROHIBITED_PATH_SEGMENTS = new Set(['__proto__', 'prototype', 'constructor']);
+const HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u;
+const AID_DOMAIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$/u;
+const SERVICE_NAME = /^[a-z0-9_-]+$/u;
+const SERVICE_SOURCES = new Set(['instance', 'static']);
+const SERVICE_TYPES = new Set(['http', 'websocket', 'ssh']);
+const SERVICE_VISIBILITIES = new Set(['public', 'private', 'aun-auth']);
+const SENSITIVE_METADATA_KEY = /(?:^|[_-])(endpoint|url|uri|token|access[_-]?token|authorization|cookie|secret|password|private[_-]?key|key|cert|certificate)(?:$|[_-])/iu;
+const DAEMON_EXACT_PATHS = new Set([
+    'aun.defaultAidDomain',
+    'aun.minEvolVersion',
+    'aun.menuTokenRequired',
+    'aun.defaultEncrypt',
+    'services',
+    'configSnapshots',
+    'restartRecovery.enabled',
+    'upgrade.autoOnStart',
+    'upgrade.testPackages',
+    'delegationDiagnostics.enabled',
+    'idleMonitor.enabled',
+    'idleMonitor.timeout',
+    'idleMonitor.apiRetryTimeout',
+    'idleMonitor.maxExecutionTime',
+    'watch.logTypes',
+    'debug.logLevel',
+    'debug.aunTrace',
+    'debug.aunSdkLog',
+    'debug.upmsg',
+    'debug.eckSnapshots',
+]);
+const DEFAULTS_EXACT_PATHS = new Set([
+    'active_baseagent',
+    'Services',
+    'projects.defaultPath',
+    'responseMode',
+    'responseModeParams.single-session.pre_tool_1stmsgchk',
+    'responseModeParams.single-session.tool_use_reminder',
+    'config.chatMode',
+    'config.mentionMode',
+    'config.show_activities',
+    'session_renew.enabled',
+    'session_renew.after_hours',
+    'session_renew.fallback_action',
+]);
+const BASEAGENT_COMMON_FIELDS = new Set([
+    'provider',
+    'providerServiceType',
+    'model',
+    'auxiliaryModel',
+    'auxiliaryEffort',
+    'fallback',
+]);
+const BASEAGENT_FIELDS = {
+    claude: new Set([
+        ...BASEAGENT_COMMON_FIELDS,
+        'effort',
+        'pathToClaudeCodeExecutable',
+        'useSettingSources',
+        'agentProgressSummaries',
+        'excludeDynamicSections',
+    ]),
+    codex: new Set([
+        ...BASEAGENT_COMMON_FIELDS,
+        'effort',
+        'enableRequestUserInput',
+        'approvalsReviewer',
+    ]),
+    gemini: new Set([
+        ...BASEAGENT_COMMON_FIELDS,
+        'cliPath',
+        'mode',
+        'useVertex',
+        'project',
+        'location',
+    ]),
+    ecagent: new Set([
+        ...BASEAGENT_COMMON_FIELDS,
+        'effort',
+        'timeoutMs',
+        'maxRetries',
+        'maxRetryDelayMs',
+    ]),
+};
+const BOOLEAN_PATHS = new Set([
+    'upgrade.autoOnStart',
+    'upgrade.testPackages',
+    'aun.menuTokenRequired',
+    'aun.defaultEncrypt',
+    'configSnapshots',
+    'restartRecovery.enabled',
+    'delegationDiagnostics.enabled',
+    'idleMonitor.enabled',
+    'debug.aunTrace',
+    'debug.aunSdkLog',
+    'debug.upmsg',
+    'debug.eckSnapshots',
+    'responseModeParams.single-session.pre_tool_1stmsgchk',
+    'responseModeParams.single-session.tool_use_reminder',
+    'session_renew.enabled',
+]);
+const BASEAGENT_BOOLEAN_FIELDS = new Set([
+    'useSettingSources',
+    'agentProgressSummaries',
+    'excludeDynamicSections',
+    'enableRequestUserInput',
+    'useVertex',
+]);
+const RESTART_DAEMON_PREFIXES = [
+    'aun.',
+    'services',
+    'configSnapshots',
+    'restartRecovery.',
+    'idleMonitor.',
+    'debug.',
+];
+const RESTART_DEFAULTS_PREFIXES = [
+    'active_baseagent',
+    'baseagents.',
+];
+function isRecord(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+function response(status, body) {
+    return { status, body };
+}
+function makeError(message, code, statusCode = 400) {
+    return Object.assign(new Error(message), { code, statusCode });
+}
+function stableValue(value) {
+    if (Array.isArray(value))
+        return value.map(stableValue);
+    if (!isRecord(value))
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, nested]) => [key, stableValue(nested)]));
+}
+function normalizeOwnerForRevision(value) {
+    if (!isRecord(value))
+        return value;
+    const normalized = { ...value };
+    const explicitOwner = typeof normalized.owner === 'string' ? normalized.owner.trim() : '';
+    const legacyOwner = Array.isArray(normalized.owners)
+        ? normalized.owners.find((item) => typeof item === 'string' && item.trim())?.trim() || ''
+        : '';
+    const owner = explicitOwner || legacyOwner;
+    delete normalized.owners;
+    if (owner)
+        normalized.owner = owner;
+    else
+        delete normalized.owner;
+    return normalized;
+}
+function settingsRevision(config) {
+    return crypto.createHash('sha256')
+        .update(JSON.stringify(stableValue(normalizeOwnerForRevision(config))))
+        .digest('hex');
+}
+function targetFor(file) {
+    return file === 'daemon' ? ConfigTarget.Process : ConfigTarget.Defaults;
+}
+function readSettingsFile(file) {
+    return read(targetFor(file), undefined, { cache: false, expand: false });
+}
+export function readBasicSettings() {
+    const rawDaemon = readSettingsFile('daemon');
+    const rawDefaults = readSettingsFile('defaults');
+    const daemon = rawDaemon ? clone(rawDaemon) : null;
+    if (daemon) {
+        delete daemon.owner;
+        delete daemon.owners;
+    }
+    return {
+        ok: true,
+        daemon,
+        defaults: rawDefaults,
+        revisions: {
+            daemon: settingsRevision(rawDaemon ?? { $schema_version: 8 }),
+            defaults: settingsRevision(rawDefaults ?? { $schema_version: 5 }),
+        },
+    };
+}
+function pathSegments(fieldPath) {
+    if (typeof fieldPath !== 'string' || !fieldPath || fieldPath.startsWith('.') || fieldPath.endsWith('.') || fieldPath.includes('..')) {
+        throw makeError(`Invalid settings path: ${typeof fieldPath === 'string' && fieldPath ? fieldPath : '(empty)'}`, 'INVALID_SETTINGS_PATH');
+    }
+    const segments = fieldPath.split('.');
+    if (segments.some(segment => !segment || PROHIBITED_PATH_SEGMENTS.has(segment))) {
+        throw makeError(`Unsafe settings path: ${fieldPath}`, 'UNSAFE_SETTINGS_PATH');
+    }
+    return segments;
+}
+function baseagentPath(fieldPath) {
+    const match = fieldPath.match(/^baseagents\.([a-z0-9_-]+)\.([A-Za-z][A-Za-z0-9]*)$/u);
+    return match ? { baseagent: match[1], field: match[2] } : null;
+}
+function baseagentBlockPath(fieldPath) {
+    const match = fieldPath.match(/^baseagents\.([a-z0-9_-]+)$/u);
+    return match?.[1] || null;
+}
+function isAllowedPath(file, fieldPath) {
+    try {
+        pathSegments(fieldPath);
+    }
+    catch {
+        return false;
+    }
+    if (file === 'daemon')
+        return DAEMON_EXACT_PATHS.has(fieldPath);
+    if (DEFAULTS_EXACT_PATHS.has(fieldPath))
+        return true;
+    const block = baseagentBlockPath(fieldPath);
+    if (block)
+        return BASEAGENT_SET.has(block);
+    const parsed = baseagentPath(fieldPath);
+    return !!parsed && BASEAGENT_SET.has(parsed.baseagent) && BASEAGENT_FIELDS[parsed.baseagent]?.has(parsed.field) === true;
+}
+function assertString(value, fieldPath, options = {}) {
+    if (typeof value !== 'string')
+        throw makeError(`${fieldPath} must be a string`, 'INVALID_SETTINGS_VALUE');
+    if (!options.allowEmpty && !value.trim())
+        throw makeError(`${fieldPath} cannot be empty`, 'INVALID_SETTINGS_VALUE');
+    if (value.length > (options.max ?? 4096))
+        throw makeError(`${fieldPath} is too long`, 'INVALID_SETTINGS_VALUE');
+    return value;
+}
+function assertBoolean(value, fieldPath) {
+    if (typeof value !== 'boolean')
+        throw makeError(`${fieldPath} must be a boolean`, 'INVALID_SETTINGS_VALUE');
+}
+function assertFiniteNumber(value, fieldPath, options = {}) {
+    if (typeof value !== 'number' || !Number.isFinite(value))
+        throw makeError(`${fieldPath} must be a finite number`, 'INVALID_SETTINGS_VALUE');
+    if (options.integer && !Number.isInteger(value))
+        throw makeError(`${fieldPath} must be an integer`, 'INVALID_SETTINGS_VALUE');
+    if (options.min !== undefined && value < options.min)
+        throw makeError(`${fieldPath} must be at least ${options.min}`, 'INVALID_SETTINGS_VALUE');
+    if (options.exclusiveMin !== undefined && value <= options.exclusiveMin)
+        throw makeError(`${fieldPath} must be greater than ${options.exclusiveMin}`, 'INVALID_SETTINGS_VALUE');
+    if (options.max !== undefined && value > options.max)
+        throw makeError(`${fieldPath} must be at most ${options.max}`, 'INVALID_SETTINGS_VALUE');
+    return value;
+}
+function assertStringMap(value, fieldPath, headerMap) {
+    if (!isRecord(value))
+        throw makeError(`${fieldPath} must be an object`, 'INVALID_SETTINGS_VALUE');
+    if (Object.keys(value).length > 100)
+        throw makeError(`${fieldPath} has too many entries`, 'INVALID_SETTINGS_VALUE');
+    for (const [key, nested] of Object.entries(value)) {
+        if (!key || key.length > 256 || PROHIBITED_PATH_SEGMENTS.has(key))
+            throw makeError(`${fieldPath} contains an invalid key`, 'INVALID_SETTINGS_VALUE');
+        if (headerMap && !HEADER_NAME.test(key))
+            throw makeError(`${fieldPath} contains an invalid HTTP header name: ${key}`, 'INVALID_SETTINGS_VALUE');
+        if (typeof nested !== 'string')
+            throw makeError(`${fieldPath}.${key} must be a string`, 'INVALID_SETTINGS_VALUE');
+        if (nested.length > 8192)
+            throw makeError(`${fieldPath}.${key} is too long`, 'INVALID_SETTINGS_VALUE');
+        if (headerMap && /[\0\r\n]/u.test(nested))
+            throw makeError(`${fieldPath}.${key} cannot contain NUL or line breaks`, 'INVALID_SETTINGS_VALUE');
+    }
+}
+function assertServiceEndpoint(value, fieldPath) {
+    const raw = assertString(value, fieldPath, { max: 2048 }).trim();
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw makeError(`${fieldPath} must be a valid URL`, 'INVALID_SETTINGS_VALUE');
+    }
+    if (!['http:', 'https:', 'ws:', 'wss:'].includes(parsed.protocol))
+        throw makeError(`${fieldPath} must use http, https, ws, or wss`, 'INVALID_SETTINGS_VALUE');
+    const host = parsed.hostname.toLowerCase().replace(/^\[|\]$/gu, '');
+    if (host !== 'localhost' && !/^127(?:\.\d{1,3}){3}$/u.test(host))
+        throw makeError(`${fieldPath} must point to localhost or 127.0.0.0/8`, 'INVALID_SETTINGS_VALUE');
+}
+function assertServiceMetadata(value, fieldPath) {
+    assertStringMap(value, fieldPath, false);
+    for (const key of Object.keys(value)) {
+        if (SENSITIVE_METADATA_KEY.test(key))
+            throw makeError(`${fieldPath} cannot contain sensitive key: ${key}`, 'INVALID_SETTINGS_VALUE');
+    }
+}
+function assertServices(value) {
+    if (!Array.isArray(value))
+        throw makeError('services must be an array', 'INVALID_SETTINGS_VALUE');
+    if (value.length > 100)
+        throw makeError('services has too many entries', 'INVALID_SETTINGS_VALUE');
+    const names = new Set();
+    value.forEach((service, index) => {
+        if (!isRecord(service))
+            throw makeError(`services[${index}] must be an object`, 'INVALID_SETTINGS_VALUE');
+        const allowedKeys = new Set(['name', 'enabled', 'port', 'proxy']);
+        if (Object.keys(service).some(key => !allowedKeys.has(key)))
+            throw makeError(`services[${index}] contains an unsupported field`, 'INVALID_SETTINGS_VALUE');
+        const name = assertString(service.name, `services[${index}].name`, { max: 64 });
+        if (!SERVICE_NAME.test(name))
+            throw makeError(`services[${index}].name must contain only lowercase letters, digits, _ or -`, 'INVALID_SETTINGS_VALUE');
+        if (names.has(name))
+            throw makeError(`services contains duplicate name: ${name}`, 'INVALID_SETTINGS_VALUE');
+        names.add(name);
+        assertBoolean(service.enabled, `services[${index}].enabled`);
+        if (service.port !== undefined)
+            assertFiniteNumber(service.port, `services[${index}].port`, { integer: true, min: 1, max: 65535 });
+        if (service.proxy === undefined)
+            return;
+        if (!isRecord(service.proxy))
+            throw makeError(`services[${index}].proxy must be an object`, 'INVALID_SETTINGS_VALUE');
+        const allowedProxyKeys = new Set(['enabled', 'source', 'endpoint', 'serviceType', 'visibility', 'metadata']);
+        if (Object.keys(service.proxy).some(key => !allowedProxyKeys.has(key)))
+            throw makeError(`services[${index}].proxy contains an unsupported field`, 'INVALID_SETTINGS_VALUE');
+        if (service.proxy.enabled !== undefined)
+            assertBoolean(service.proxy.enabled, `services[${index}].proxy.enabled`);
+        if (service.proxy.source !== undefined && !SERVICE_SOURCES.has(String(service.proxy.source)))
+            throw makeError(`services[${index}].proxy.source must be instance or static`, 'INVALID_SETTINGS_VALUE');
+        if (service.proxy.endpoint !== undefined)
+            assertServiceEndpoint(service.proxy.endpoint, `services[${index}].proxy.endpoint`);
+        if (service.proxy.serviceType !== undefined && !SERVICE_TYPES.has(String(service.proxy.serviceType)))
+            throw makeError(`services[${index}].proxy.serviceType must be http, websocket, or ssh`, 'INVALID_SETTINGS_VALUE');
+        if (service.proxy.visibility !== undefined && !SERVICE_VISIBILITIES.has(String(service.proxy.visibility)))
+            throw makeError(`services[${index}].proxy.visibility is invalid`, 'INVALID_SETTINGS_VALUE');
+        if (service.proxy.metadata !== undefined)
+            assertServiceMetadata(service.proxy.metadata, `services[${index}].proxy.metadata`);
+        if (service.proxy.enabled === true && (!SERVICE_SOURCES.has(String(service.proxy.source)) || !service.proxy.visibility))
+            throw makeError(`services[${index}].proxy requires source and visibility when enabled`, 'INVALID_SETTINGS_VALUE');
+        if (service.proxy.enabled === true && service.proxy.source === 'static' && !service.proxy.endpoint)
+            throw makeError(`services[${index}].proxy.endpoint is required when source is static`, 'INVALID_SETTINGS_VALUE');
+    });
+}
+function assertStringArray(value, fieldPath) {
+    if (!Array.isArray(value))
+        throw makeError(`${fieldPath} must be an array`, 'INVALID_SETTINGS_VALUE');
+    if (value.length > 100)
+        throw makeError(`${fieldPath} has too many entries`, 'INVALID_SETTINGS_VALUE');
+    const strings = value.map(item => assertString(item, `${fieldPath}[]`, { max: 256 }).trim());
+    if (new Set(strings).size !== strings.length)
+        throw makeError(`${fieldPath} contains duplicate values`, 'INVALID_SETTINGS_VALUE');
+}
+function assertFallbackModels(value, fieldPath) {
+    if (!Array.isArray(value))
+        throw makeError(`${fieldPath} must be an array`, 'INVALID_SETTINGS_VALUE');
+    if (value.length > 3)
+        throw makeError(`${fieldPath} supports at most 3 models`, 'INVALID_SETTINGS_VALUE');
+    const models = new Set();
+    value.forEach((item, index) => {
+        if (!isRecord(item))
+            throw makeError(`${fieldPath}[${index}] must be an object`, 'INVALID_SETTINGS_VALUE');
+        if (Object.keys(item).some(key => !['provider', 'model', 'effort'].includes(key)))
+            throw makeError(`${fieldPath}[${index}] contains an unsupported field`, 'INVALID_SETTINGS_VALUE');
+        if (item.provider !== undefined)
+            validateBaseagentValue('', 'provider', `${fieldPath}[${index}].provider`, item.provider);
+        const model = assertString(item.model, `${fieldPath}[${index}].model`, { max: 512 }).trim();
+        const identity = `${String(item.provider || '').trim()}\0${model}`;
+        if (models.has(identity))
+            throw makeError(`${fieldPath} contains duplicate provider/model pairs`, 'INVALID_SETTINGS_VALUE');
+        models.add(identity);
+        if (item.effort !== undefined) {
+            const effort = assertString(item.effort, `${fieldPath}[${index}].effort`, { max: 16 });
+            if (!EFFORTS.has(effort))
+                throw makeError(`${fieldPath}[${index}].effort is invalid`, 'INVALID_SETTINGS_VALUE');
+        }
+    });
+}
+function assertHttpUrl(value, fieldPath) {
+    const raw = assertString(value, fieldPath, { max: 2048 }).trim();
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw makeError(`${fieldPath} must be a valid URL`, 'INVALID_SETTINGS_VALUE');
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        throw makeError(`${fieldPath} must use http or https`, 'INVALID_SETTINGS_VALUE');
+}
+function validateDaemonValue(fieldPath, value) {
+    if (BOOLEAN_PATHS.has(fieldPath))
+        return assertBoolean(value, fieldPath);
+    if (fieldPath === 'services')
+        return assertServices(value);
+    if (fieldPath === 'watch.logTypes')
+        return assertStringArray(value, fieldPath);
+    if (fieldPath === 'aun.defaultAidDomain') {
+        const domain = assertString(value, fieldPath, { max: 253 }).trim();
+        if (!AID_DOMAIN.test(domain) || /^(?:\d{1,3}\.){3}\d{1,3}$/u.test(domain) || domain.toLowerCase().endsWith('.localhost'))
+            throw makeError(`${fieldPath} must be a valid multi-level domain`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (fieldPath === 'aun.minEvolVersion') {
+        const version = assertString(value, fieldPath, { max: 64 }).trim();
+        if (!/^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/u.test(version))
+            throw makeError(`${fieldPath} must be a semantic version such as 1.6.0`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (fieldPath === 'debug.logLevel') {
+        if (!['DEBUG', 'INFO', 'WARN', 'ERROR'].includes(String(value)))
+            throw makeError(`${fieldPath} is invalid`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (fieldPath === 'idleMonitor.timeout' || fieldPath === 'idleMonitor.apiRetryTimeout')
+        return void assertFiniteNumber(value, fieldPath, { exclusiveMin: 0 });
+    if (fieldPath === 'idleMonitor.maxExecutionTime')
+        return void assertFiniteNumber(value, fieldPath, { min: 0 });
+    throw makeError(`Unsupported daemon settings path: ${fieldPath}`, 'INVALID_SETTINGS_PATH');
+}
+function validateBaseagentValue(baseagent, field, fieldPath, value) {
+    if (field === 'provider' || field === 'providerServiceType') {
+        const provider = assertString(value, fieldPath, { max: 256 });
+        if (!/^[A-Za-z0-9_-]+$/u.test(provider) || PROHIBITED_PATH_SEGMENTS.has(provider))
+            throw makeError(`${fieldPath} is invalid`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (BASEAGENT_BOOLEAN_FIELDS.has(field))
+        return assertBoolean(value, fieldPath);
+    if (field === 'model' || field === 'auxiliaryModel' || field === 'apiKey' || field === 'pathToClaudeCodeExecutable' || field === 'cliPath' || field === 'project' || field === 'location') {
+        const stringValue = assertString(value, fieldPath, { max: field === 'apiKey' ? 8192 : 4096 });
+        if (field === 'apiKey' && ['<redacted>', '******'].includes(stringValue))
+            throw makeError(`${fieldPath} must contain a replacement secret, not the redacted placeholder`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (field === 'effort' || field === 'auxiliaryEffort') {
+        const effort = assertString(value, fieldPath, { max: 16 });
+        if (!EFFORTS.has(effort))
+            throw makeError(`${fieldPath} is invalid`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (field === 'baseUrl')
+        return assertHttpUrl(value, fieldPath);
+    if (field === 'headers')
+        return assertStringMap(value, fieldPath, true);
+    if (field === 'queryParams')
+        return assertStringMap(value, fieldPath, false);
+    if (field === 'fallback')
+        return assertFallbackModels(value, fieldPath);
+    if (field === 'approvalsReviewer') {
+        if (!['user', 'auto_review', 'guardian_subagent'].includes(String(value)))
+            throw makeError(`${fieldPath} is invalid`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (field === 'mode') {
+        if (baseagent !== 'gemini' || !['cli', 'sdk'].includes(String(value)))
+            throw makeError(`${fieldPath} is invalid`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (field === 'timeoutMs')
+        return void assertFiniteNumber(value, fieldPath, { integer: true, min: 1, max: 3_600_000 });
+    if (field === 'maxRetries')
+        return void assertFiniteNumber(value, fieldPath, { integer: true, min: 0, max: 100 });
+    if (field === 'maxRetryDelayMs')
+        return void assertFiniteNumber(value, fieldPath, { integer: true, min: 0, max: 3_600_000 });
+    throw makeError(`Unsupported Base Agent settings path: ${fieldPath}`, 'INVALID_SETTINGS_PATH');
+}
+function validateDefaultsValue(fieldPath, value) {
+    if (fieldPath === 'Services') {
+        if (!isRecord(value))
+            throw makeError('Services must be an object', 'INVALID_SETTINGS_VALUE');
+        for (const [serviceType, selection] of Object.entries(value)) {
+            if (!/^[A-Za-z0-9_-]+$/u.test(serviceType) || PROHIBITED_PATH_SEGMENTS.has(serviceType) || !isRecord(selection))
+                throw makeError('Invalid service selection', 'INVALID_SETTINGS_VALUE');
+            if (Object.keys(selection).some(field => !['provider', 'model', 'effort', 'fallback'].includes(field)))
+                throw makeError('Invalid service selection field', 'INVALID_SETTINGS_VALUE');
+            validateBaseagentValue('', 'provider', `Services.${serviceType}.provider`, selection.provider);
+            assertString(selection.model, `Services.${serviceType}.model`);
+            if (selection.effort !== undefined)
+                validateBaseagentValue('', 'effort', `Services.${serviceType}.effort`, selection.effort);
+            if (selection.fallback !== undefined)
+                assertFallbackModels(selection.fallback, `Services.${serviceType}.fallback`);
+        }
+        return;
+    }
+    if (BOOLEAN_PATHS.has(fieldPath))
+        return assertBoolean(value, fieldPath);
+    const parsed = baseagentPath(fieldPath);
+    if (parsed)
+        return validateBaseagentValue(parsed.baseagent, parsed.field, fieldPath, value);
+    if (baseagentBlockPath(fieldPath)) {
+        if (!isRecord(value) || Object.keys(value).length > 0)
+            throw makeError(`${fieldPath} must be an empty object`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (fieldPath === 'active_baseagent') {
+        if (!BASEAGENT_SET.has(String(value)))
+            throw makeError(`${fieldPath} is invalid`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (fieldPath === 'projects.defaultPath') {
+        const configuredPath = assertString(value, fieldPath, { max: 4096 }).trim();
+        if (!path.isAbsolute(configuredPath))
+            throw makeError(`${fieldPath} must be an absolute path`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (fieldPath === 'responseMode') {
+        if (value !== 'single-session')
+            throw makeError(`${fieldPath} must be single-session`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (fieldPath === 'config.chatMode') {
+        if (!['interactive', 'proactive'].includes(String(value)))
+            throw makeError(`${fieldPath} is invalid`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (fieldPath === 'config.mentionMode') {
+        if (!['disabled', 'mention-only', 'auto'].includes(String(value)))
+            throw makeError(`${fieldPath} is invalid`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (fieldPath === 'config.show_activities') {
+        if (!['all', 'text', 'none'].includes(String(value)))
+            throw makeError(`${fieldPath} is invalid`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    if (fieldPath === 'session_renew.after_hours')
+        return void assertFiniteNumber(value, fieldPath, { exclusiveMin: 0 });
+    if (fieldPath === 'session_renew.fallback_action') {
+        if (!['continue', 'new'].includes(String(value)))
+            throw makeError(`${fieldPath} is invalid`, 'INVALID_SETTINGS_VALUE');
+        return;
+    }
+    throw makeError(`Unsupported defaults settings path: ${fieldPath}`, 'INVALID_SETTINGS_PATH');
+}
+function validateChange(file, change) {
+    if (!isRecord(change) || typeof change.path !== 'string')
+        throw makeError('Each change must be an object', 'INVALID_SETTINGS_CHANGE');
+    if (file === 'daemon' && (change.path === 'owner' || change.path === 'owners')) {
+        throw makeError('Daemon Owner is managed by Evol App; use ownership binding instead', 'OWNER_MANAGED_BY_EVOL_APP', 403);
+    }
+    if (!isAllowedPath(file, change.path))
+        throw makeError(`Settings path is not editable: ${change.path}`, 'SETTINGS_PATH_NOT_EDITABLE');
+    if (change.op !== 'set' && change.op !== 'unset')
+        throw makeError(`Invalid operation for ${change.path}`, 'INVALID_SETTINGS_CHANGE');
+    if (change.op === 'unset') {
+        if (change.path === 'active_baseagent' || change.path === 'services')
+            throw makeError(`${change.path} cannot be unset`, 'INVALID_SETTINGS_CHANGE');
+        return;
+    }
+    if (!Object.prototype.hasOwnProperty.call(change, 'value'))
+        throw makeError(`Missing value for ${change.path}`, 'INVALID_SETTINGS_CHANGE');
+    if (file === 'daemon')
+        validateDaemonValue(change.path, change.value);
+    else
+        validateDefaultsValue(change.path, change.value);
+}
+function clone(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+function applyChanges(config, file, changes) {
+    if (!Array.isArray(changes) || changes.length === 0)
+        throw makeError('changes must be a non-empty array', 'INVALID_SETTINGS_CHANGES');
+    if (changes.length > 200)
+        throw makeError('Too many settings changes', 'INVALID_SETTINGS_CHANGES');
+    const seen = new Set();
+    for (const change of changes) {
+        validateChange(file, change);
+        if (seen.has(change.path))
+            throw makeError(`Duplicate settings path: ${change.path}`, 'DUPLICATE_SETTINGS_PATH');
+        seen.add(change.path);
+        if (change.path === 'owner' || change.path === 'owners')
+            throw makeError('Daemon Owner is managed by Evol App; use ownership binding instead', 'OWNER_MANAGED_BY_EVOL_APP', 403);
+        const segments = pathSegments(change.path);
+        if (change.op === 'unset') {
+            let cursor = config;
+            for (const segment of segments.slice(0, -1)) {
+                if (!isRecord(cursor?.[segment])) {
+                    cursor = undefined;
+                    break;
+                }
+                cursor = cursor[segment];
+            }
+            if (cursor)
+                delete cursor[segments[segments.length - 1]];
+            continue;
+        }
+        let cursor = config;
+        for (const segment of segments.slice(0, -1)) {
+            if (!isRecord(cursor[segment]))
+                cursor[segment] = {};
+            cursor = cursor[segment];
+        }
+        cursor[segments[segments.length - 1]] = clone(change.value);
+    }
+}
+async function validateBaseagentAvailability(file, changes, currentConfig) {
+    if (file !== 'defaults')
+        return;
+    const { getBaseagentSnapshot } = await import('../agents/baseagent-availability.js');
+    const snapshot = await getBaseagentSnapshot({ probe: true });
+    const probes = Array.isArray(snapshot.baseagents) ? snapshot.baseagents : [];
+    const detected = new Set(probes.filter(item => item.detected === true).map(item => item.id));
+    const configured = new Set(isRecord(currentConfig.baseagents) ? Object.keys(currentConfig.baseagents) : []);
+    for (const change of changes) {
+        if (change.path === 'active_baseagent' && change.op === 'set' && !detected.has(String(change.value))) {
+            throw makeError(`active_baseagent is not available on this machine: ${String(change.value)}`, 'BASEAGENT_UNAVAILABLE');
+        }
+        const parsed = baseagentPath(change.path);
+        if (parsed && !detected.has(parsed.baseagent) && !configured.has(parsed.baseagent)) {
+            throw makeError(`Base Agent is not available on this machine: ${parsed.baseagent}`, 'BASEAGENT_UNAVAILABLE');
+        }
+        const block = baseagentBlockPath(change.path);
+        if (block && change.op === 'set' && !detected.has(block) && !configured.has(block)) {
+            throw makeError(`Base Agent is not available on this machine: ${block}`, 'BASEAGENT_UNAVAILABLE');
+        }
+    }
+}
+function restartRequiredForChanges(file, changes) {
+    const prefixes = file === 'daemon' ? RESTART_DAEMON_PREFIXES : RESTART_DEFAULTS_PREFIXES;
+    return changes.map(change => change.path)
+        .filter(fieldPath => prefixes.some(prefix => fieldPath === prefix || fieldPath.startsWith(prefix)));
+}
+export async function mutateBasicSettings(input) {
+    try {
+        if (!isRecord(input) || (input.file !== 'daemon' && input.file !== 'defaults')
+            || typeof input.revision !== 'string' || !/^[a-f0-9]{64}$/u.test(input.revision)
+            || !Array.isArray(input.changes)) {
+            throw makeError('Invalid Basic Settings mutation request', 'INVALID_REQUEST');
+        }
+        const file = input.file;
+        const changes = input.changes;
+        if (changes.length === 0)
+            throw makeError('changes must be a non-empty array', 'INVALID_SETTINGS_CHANGES');
+        if (changes.length > 200)
+            throw makeError('Too many settings changes', 'INVALID_SETTINGS_CHANGES');
+        for (const change of changes)
+            validateChange(file, change);
+        const currentConfig = readSettingsFile(file) ?? { $schema_version: file === 'daemon' ? 8 : 5 };
+        await validateBaseagentAvailability(file, changes, currentConfig);
+        const result = mutateConfig(targetFor(file), undefined, config => {
+            const latest = readSettingsFile(file) ?? { $schema_version: file === 'daemon' ? 8 : 5 };
+            if (settingsRevision(latest) !== input.revision) {
+                throw makeError('Configuration changed after it was loaded. Reload and try again.', 'BASIC_SETTINGS_REVISION_CONFLICT', 409);
+            }
+            applyChanges(config, file, changes);
+            const errors = validateConfig(targetFor(file), config);
+            if (errors.length > 0)
+                throw makeError(errors.join('; '), 'SCHEMA_INVALID');
+        });
+        const restartPaths = restartRequiredForChanges(file, changes);
+        return {
+            ok: true,
+            changed: result.changed,
+            restartRequired: result.changed && restartPaths.length > 0,
+            restartPaths: result.changed ? restartPaths : [],
+        };
+    }
+    catch (caught) {
+        return {
+            ok: false,
+            code: caught?.code || 'BASIC_SETTINGS_UPDATE_FAILED',
+            error: caught instanceof Error ? caught.message : String(caught),
+            statusCode: caught?.statusCode || 400,
+        };
+    }
+}
+function requestBody(value) {
+    if (!isRecord(value))
+        throw makeError('Basic Settings request must be a JSON object', 'INVALID_REQUEST');
+    return value;
+}
+export async function handleBasicSettingsService(input) {
+    try {
+        if (!isRecord(input) || typeof input.method !== 'string' || typeof input.pathname !== 'string'
+            || !input.pathname.startsWith('/api/basic-settings')) {
+            throw makeError('Invalid Basic Settings service request', 'INVALID_REQUEST');
+        }
+        const query = input.query ?? {};
+        if (!isRecord(query) || Object.values(query).some(value => typeof value !== 'string'))
+            throw makeError('Invalid Basic Settings query', 'INVALID_REQUEST');
+        const pathname = input.pathname.replace(/\/+$/u, '');
+        if (input.method === 'GET' && pathname === '/api/basic-settings') {
+            return response(200, { success: true, data: readBasicSettings() });
+        }
+        if (input.method === 'GET' && pathname === '/api/basic-settings/secret') {
+            const file = typeof query.file === 'string' ? query.file : 'defaults';
+            const fieldPath = typeof query.path === 'string' ? query.path : '';
+            if (file !== 'defaults' || !/^baseagents\.(claude|codex|gemini|ecagent)\.apiKey$/u.test(fieldPath)) {
+                throw makeError('Only Base Agent apiKey fields can be revealed', 'INVALID_SECRET_PATH');
+            }
+            const config = readSettingsFile('defaults');
+            const value = fieldPath.split('.').reduce((current, segment) => isRecord(current) ? current[segment] : undefined, config);
+            if (typeof value !== 'string' || !value.trim())
+                return response(404, { success: false, code: 'SECRET_NOT_CONFIGURED', error: 'API Key is not configured' });
+            return response(200, { success: true, data: { file, path: fieldPath, value } });
+        }
+        if (input.method === 'PATCH' && pathname === '/api/basic-settings') {
+            const result = await mutateBasicSettings(requestBody(input.body));
+            if (!result.ok)
+                return response(result.statusCode || 400, { success: false, code: result.code, error: result.error });
+            return response(200, {
+                success: true,
+                changed: result.changed,
+                restartRequired: result.restartRequired,
+                restartPaths: result.restartPaths || [],
+            });
+        }
+        return response(405, { success: false, error: 'Method not allowed' });
+    }
+    catch (caught) {
+        return response(caught?.statusCode || 400, {
+            success: false,
+            ...(caught?.code ? { code: caught.code } : {}),
+            error: caught instanceof Error ? caught.message : String(caught),
+        });
+    }
+}