ghagga-core 3.0.0 → 3.2.0

package/dist/providers/cli-bridge.js

@@ -25,6 +25,17 @@ const CLAUDE_LEGACY_DEFAULT_MODEL = 'anthropic/claude-sonnet-4-5';
 const STDIN_THRESHOLD = 10_000;
 /** Regex for validating OpenCode cliModel format: `provider/model`. */
 const CLI_MODEL_REGEX = /^[^/]+\/.+$/;
+/**
+ * CLIs that can authenticate WITHOUT an env-var credential because they use
+ * an interactive OAuth login instead:
+ * - gemini: Google account OAuth (falls back to GEMINI_API_KEY if present)
+ * - copilot: GitHub login (falls back to COPILOT_GITHUB_TOKEN/GH_TOKEN if present)
+ *
+ * For these, a missing credential env var is NOT a configuration error — the CLI
+ * can still authenticate via its own login. opencode is NOT in this set: its
+ * provider models genuinely require the API key.
+ */
+const OAUTH_CAPABLE_CLIS = new Set(['gemini', 'copilot']);
 // ─── Env-Var Mapping ────────────────────────────────────────────
 /**
  * Maps OpenCode provider prefixes to the env var they need for authentication.
@@ -92,6 +103,7 @@ export class CLIConfigurationError extends Error {
  */
 function detectCLI(command) {
     try {
+        // nosemgrep: command-injection-node -- `command` is only ever the hardcoded literals 'opencode'/'copilot'/'gemini' (see adapters[].command); no external input.
         execSync(`which ${command}`, { timeout: 3000, stdio: 'pipe' });
         return true;
     }
@@ -308,6 +320,7 @@ const adapters = [
                 ? `opencode ${cmdArgs}`
                 : `opencode ${cmdArgs} ${JSON.stringify(fullPrompt)}`;
             try {
+                // nosemgrep: command-injection-node -- `cmd` is built from JSON.stringify-quoted args + config-derived cliModel validated against CLI_MODEL_REGEX; the prompt is passed via stdin, never interpolated into the shell command.
                 raw = execSync(cmd, {
                     ...execOptions,
                     ...(fullPrompt.length > STDIN_THRESHOLD ? { input: fullPrompt } : {}),
@@ -339,6 +352,7 @@ const adapters = [
             const tmpFile = join(tmpdir(), `ghagga-prompt-${process.pid}-${Date.now()}.txt`);
             try {
                 writeFileSync(tmpFile, prompt, 'utf8');
+                // nosemgrep: command-injection-node -- `tmpFile` is a server-constructed path (join(tmpdir(), `ghagga-prompt-${pid}-${Date.now()}.txt`)); the user prompt is written to that file, never interpolated into the shell command.
                 return execSync(`copilot -p "Read and analyze the file at ${tmpFile} and provide a code review"`, { ...CLI_EXEC_OPTIONS, ...(env ? { env } : {}) }).trim();
             }
             finally {
@@ -358,6 +372,7 @@ const adapters = [
         generate(prompt, systemPrompt, _cliModel, env) {
             // Gemini auto-detects non-TTY stdin and reads from it
             const fullPrompt = systemPrompt ? `${systemPrompt}\n\n${prompt}` : prompt;
+            // nosemgrep: command-injection-node -- literal constant command string; the user prompt is passed via stdin (input), never interpolated into the shell command.
             return execSync('gemini -p - --output-format text', {
                 ...CLI_EXEC_OPTIONS,
                 ...(env ? { env } : {}),
@@ -366,13 +381,37 @@ const adapters = [
         },
     },
 ];
+// ─── Availability Override (testing) ────────────────────────────
+/**
+ * Optional override for adapter availability, keyed by adapter name.
+ * `available` is frozen at module load via detectCLI(), so this seam lets tests
+ * deterministically exercise code paths (e.g. the gemini OAuth path) without a
+ * real CLI installed. Production code never sets this.
+ *
+ * @internal testing-only
+ */
+let availabilityOverride;
+/**
+ * Set (or clear with undefined) the availability override.
+ * @internal Exported for testing only.
+ */
+export function _setAvailabilityOverride(override) {
+    availabilityOverride = override;
+}
+/** Resolve whether an adapter is available, honoring the testing override. */
+function isAdapterAvailable(adapter) {
+    if (availabilityOverride && adapter.name in availabilityOverride) {
+        return availabilityOverride[adapter.name];
+    }
+    return adapter.available;
+}
 // ─── Public API ─────────────────────────────────────────────────
 /**
  * Get list of available CLI providers.
  * Returns names from the adapter list (opencode, copilot, gemini).
  */
 export function getAvailableCLIs() {
-    return adapters.filter((a) => a.available).map((a) => a.name);
+    return adapters.filter(isAdapterAvailable).map((a) => a.name);
 }
 /**
  * Generate text using CLI bridge.
@@ -408,16 +447,37 @@ export function generateViaCLI(prompt, systemPrompt, options) {
     // ── Resolve credential env var ──
     const credentialEnvName = resolveCredentialEnvVar(resolvedCLI, cliModel);
     // ── Validate credentials (configuration error = hard fail) ──
-    if (resolvedCLI && credentialEnvName) {
+    // OAuth-capable CLIs (gemini, copilot) skip the hard-fail: they can
+    // authenticate via Google/GitHub login when no env credential is present.
+    // The credential is still injected below when available.
+    if (resolvedCLI && credentialEnvName && !OAUTH_CAPABLE_CLIS.has(resolvedCLI)) {
         validateCredentials(credentialEnvName, credentials);
     }
     // ── Build subprocess environment ──
+    // When a credential is available, restrict the subprocess to the SAFE_ENV_VARS
+    // allowlist plus that one credential (never the full parent env).
     let subprocessEnv;
     if (credentials && credentialEnvName) {
-        const credentialValue = credentials[credentialEnvName];
-        subprocessEnv = buildSubprocessEnv(credentialEnvName, credentialValue);
+        subprocessEnv = buildSubprocessEnv(credentialEnvName, credentials[credentialEnvName]);
+    }
+    else if (resolvedCLI && OAUTH_CAPABLE_CLIS.has(resolvedCLI)) {
+        // OAuth-capable CLI (gemini/copilot) selected explicitly with NO injected key:
+        // still restrict to the allowlist so the CLI can read its own login state
+        // (HOME/XDG) WITHOUT inheriting the full parent env, which would leak unrelated
+        // server secrets. (This path is newly reachable because the OAuth-skip above no
+        // longer hard-fails on a missing key.)
+        // Known limitation: this restricted (allowlist-only) env also applies to any
+        // FALLBACK adapter tried later in the loop below, so a fallback that relies on
+        // ambient (non-allowlisted) keys will not see them on this path. Acceptable:
+        // choosing an OAuth CLI explicitly is a deliberate restriction, and before this
+        // change the no-key path hard-failed before reaching the loop at all. Per-adapter
+        // env resolution would be a larger refactor, tracked separately.
+        subprocessEnv = buildSubprocessEnv();
     }
-    const available = adapters.filter((a) => a.available);
+    // else: subprocessEnv stays undefined → preserves the PRE-EXISTING behavior for
+    // opencode / auto-mode (ambient-env inheritance). Closing that pre-existing path is
+    // tracked separately (PRE-LAUNCH backlog: fail-closed vs degradation) — out of scope here.
+    const available = adapters.filter(isAdapterAvailable);
     if (available.length === 0) {
         throw new Error('No CLI providers available. Install one of: opencode, copilot, gemini');
     }

package/dist/providers/cli-bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-bridge.js","sourceRoot":"","sources":["../../src/providers/cli-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,mEAAmE;AAEnE,+EAA+E;AAC/E,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AAElE,wFAAwF;AACxF,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,uEAAuE;AACvE,MAAM,eAAe,GAAG,aAAa,CAAC;AAEtC,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,QAAQ,EAAE,EAAE,EAAE,kCAAkC;IAChD,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,gBAAgB,EAAE,cAAc;IAChC,IAAI,EAAE,cAAc;IACpB,UAAU,EAAE,oBAAoB;CACjC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,aAAa,GAAsB;IACvC,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,UAAU;IACV,MAAM;IACN,QAAQ;IACR,KAAK;IACL,MAAM;IACN,UAAU;IACV,WAAW;IACX,qBAAqB;IACrB,YAAY;IACZ,aAAa;IACb,UAAU;IACV,YAAY;IACZ,aAAa;IACb,UAAU;IACV,eAAe;IACf,cAAc;IACd,8BAA8B;IAC9B,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,iBAAiB;CAClB,CAAC;AAgCF;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,mEAAmE;AAEnE;;;GAGG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC;QACH,QAAQ,CAAC,SAAS,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mEAAmE;AAEnE,MAAM,gBAAgB,GAAmE;IACvF,OAAO,EAAE,OAAO;IAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC3B,QAAQ,EAAE,MAAM;IAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,mEAAmE;AAEnE;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,YAAgC,EAChC,QAAiB;IAEjB,QAAQ,YAAY,EAAE,CAAC;QACrB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,QAAQ;YACX,OAAO,gBAAgB,CAAC;QAC1B,KAAK,SAAS;YACZ,OAAO,sBAAsB,CAAC;QAChC;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,mEAAmE;AAEnE;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,iBAA0B,EAC1B,eAAwB;IAExB,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,6CAA6C;IAC7C,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,IAAI,iBAAiB,IAAI,eAAe,EAAE,CAAC;QACzC,GAAG,CAAC,iBAAiB,CAAC,GAAG,eAAe,CAAC;IAC3C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAI7C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvE,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,MAAuD,CAAC;IAE5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;YAChD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,KAA0B,CAAC;gBAC7C,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;oBACzB,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBACxC,MAAM,WAAW,GAAG,KAAgC,CAAC;gBACrD,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAC7B,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,mEAAmE;AAEnE;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAsB;IAC1C,sBAAsB;IACtB,4BAA4B;IAC5B,sCAAsC;IACtC,sBAAsB;IACtB,gBAAgB;IAChB,yBAAyB;IACzB,8BAA8B;IAC9B,uBAAuB;IACvB,0CAA0C;IAC1C,+BAA+B;IAC/B,cAAc;IACd,uBAAuB;IACvB,sBAAsB;IACtB,+BAA+B;IAC/B,wCAAwC;IACxC,0BAA0B;IAC1B,6DAA6D;IAC7D,uBAAuB;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,qCAAqC;QACrC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mEAAmE;AAEnE;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,qBAAqB,CAC7B,6BAA6B,QAAQ,qEAAqE,CAC3G,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACvC,IAAI,CAAC,CAAC,MAAM,IAAI,sBAAsB,CAAC,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,IAAI,qBAAqB,CAC7B,0CAA0C,MAAM,0BAA0B,SAAS,GAAG,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,iBAAqC,EACrC,WAAoC;IAEpC,IAAI,CAAC,iBAAiB;QAAE,OAAO,CAAC,kDAAkD;IAElF,mCAAmC;IACnC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC7C,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,0BAA0B;IACnE,CAAC;IAED,uCAAuC;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,4BAA4B;IAE/E,MAAM,IAAI,qBAAqB,CAC7B,sDAAsD,iBAAiB,eAAe;QACpF,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED,mEAAmE;AAEnE,MAAM,QAAQ,GAAiB;IAC7B;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC;QAChC,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAE1E,yEAAyE;YACzE,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE7D,MAAM,WAAW,GAAmE;gBAClF,GAAG,gBAAgB;gBACnB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxB,CAAC;YAEF,IAAI,GAAW,CAAC;YAChB,MAAM,GAAG,GACP,UAAU,CAAC,MAAM,GAAG,eAAe;gBACjC,CAAC,CAAC,YAAY,OAAO,EAAE;gBACvB,CAAC,CAAC,YAAY,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAE1D,IAAI,CAAC;gBACH,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE;oBAClB,GAAG,WAAW;oBACd,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtE,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,SAAkB,EAAE,CAAC;gBAC5B,oEAAoE;gBACpE,MAAM,GAAG,GAAG,SAIX,CAAC;gBACF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;gBAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;gBAC3E,MAAM,IAAI,KAAK,CACb,+BAA+B,GAAG,CAAC,MAAM,IAAI,SAAS,aAAa,oBAAoB,CAAC,MAAM,CAAC,aAAa,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAC3I,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,+CAA+C;gBAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,kEAAkE,OAAO,EAAE,CAC5E,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;KACF;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,SAAS;QAClB,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC;QAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG;YAC5C,8EAA8E;YAC9E,kDAAkD;YAClD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACjF,IAAI,CAAC;gBACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBACvC,OAAO,QAAQ,CACb,4CAA4C,OAAO,6BAA6B,EAChF,EAAE,GAAG,gBAAgB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACjD,CAAC,IAAI,EAAE,CAAC;YACX,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC;oBACH,UAAU,CAAC,OAAO,CAAC,CAAC;gBACtB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;QACH,CAAC;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG;YAC3C,sDAAsD;YACtD,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1E,OAAO,QAAQ,CAAC,kCAAkC,EAAE;gBAClD,GAAG,gBAAgB;gBACnB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvB,KAAK,EAAE,UAAU;aAClB,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,CAAC;KACF;CACF,CAAC;AAEF,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,YAAqB,EACrB,OAA0B;IAE1B,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAE5F,+DAA+D;IAC/D,IAAI,WAAW,GAAG,eAAe,CAAC;IAClC,IAAI,QAAQ,GAAG,WAAW,CAAC;IAE3B,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;QACjC,WAAW,GAAG,UAAU,CAAC;QACzB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,2BAA2B,CAAC;QACzC,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,WAAW,KAAK,UAAU,IAAI,QAAQ,EAAE,CAAC;QAC3C,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,mCAAmC;IACnC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAEzE,+DAA+D;IAC/D,IAAI,WAAW,IAAI,iBAAiB,EAAE,CAAC;QACrC,mBAAmB,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,qCAAqC;IACrC,IAAI,aAA4C,CAAC;IACjD,IAAI,WAAW,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,eAAe,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;QACvD,aAAa,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IAED,sCAAsC;IACtC,MAAM,OAAO,GAAG,WAAW;QACzB,CAAC,CAAC;YACE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC;YAClD,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC;SACnD;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,gEAAgE;YAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC7E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,kFAAkF;YAClF,yEAAyE;YACzE,6DAA6D;YAC7D,MAAM,WAAW,GAAI,KAAe,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9D,MAAM,SAAS,GACb,WAAW,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC;YACzF,OAAO,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,IAAI,YAAY,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"cli-bridge.js","sourceRoot":"","sources":["../../src/providers/cli-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,mEAAmE;AAEnE,+EAA+E;AAC/E,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AAElE,wFAAwF;AACxF,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,uEAAuE;AACvE,MAAM,eAAe,GAAG,aAAa,CAAC;AAEtC;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAElE,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,QAAQ,EAAE,EAAE,EAAE,kCAAkC;IAChD,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,gBAAgB,EAAE,cAAc;IAChC,IAAI,EAAE,cAAc;IACpB,UAAU,EAAE,oBAAoB;CACjC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,aAAa,GAAsB;IACvC,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,UAAU;IACV,MAAM;IACN,QAAQ;IACR,KAAK;IACL,MAAM;IACN,UAAU;IACV,WAAW;IACX,qBAAqB;IACrB,YAAY;IACZ,aAAa;IACb,UAAU;IACV,YAAY;IACZ,aAAa;IACb,UAAU;IACV,eAAe;IACf,cAAc;IACd,8BAA8B;IAC9B,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,iBAAiB;CAClB,CAAC;AAgCF;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,mEAAmE;AAEnE;;;GAGG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC;QACH,gKAAgK;QAChK,QAAQ,CAAC,SAAS,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mEAAmE;AAEnE,MAAM,gBAAgB,GAAmE;IACvF,OAAO,EAAE,OAAO;IAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC3B,QAAQ,EAAE,MAAM;IAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,mEAAmE;AAEnE;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,YAAgC,EAChC,QAAiB;IAEjB,QAAQ,YAAY,EAAE,CAAC;QACrB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,QAAQ;YACX,OAAO,gBAAgB,CAAC;QAC1B,KAAK,SAAS;YACZ,OAAO,sBAAsB,CAAC;QAChC;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,mEAAmE;AAEnE;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,iBAA0B,EAC1B,eAAwB;IAExB,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,6CAA6C;IAC7C,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,IAAI,iBAAiB,IAAI,eAAe,EAAE,CAAC;QACzC,GAAG,CAAC,iBAAiB,CAAC,GAAG,eAAe,CAAC;IAC3C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAI7C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvE,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,MAAuD,CAAC;IAE5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;YAChD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,KAA0B,CAAC;gBAC7C,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;oBACzB,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBACxC,MAAM,WAAW,GAAG,KAAgC,CAAC;gBACrD,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAC7B,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,mEAAmE;AAEnE;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAsB;IAC1C,sBAAsB;IACtB,4BAA4B;IAC5B,sCAAsC;IACtC,sBAAsB;IACtB,gBAAgB;IAChB,yBAAyB;IACzB,8BAA8B;IAC9B,uBAAuB;IACvB,0CAA0C;IAC1C,+BAA+B;IAC/B,cAAc;IACd,uBAAuB;IACvB,sBAAsB;IACtB,+BAA+B;IAC/B,wCAAwC;IACxC,0BAA0B;IAC1B,6DAA6D;IAC7D,uBAAuB;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,qCAAqC;QACrC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mEAAmE;AAEnE;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,qBAAqB,CAC7B,6BAA6B,QAAQ,qEAAqE,CAC3G,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACvC,IAAI,CAAC,CAAC,MAAM,IAAI,sBAAsB,CAAC,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,IAAI,qBAAqB,CAC7B,0CAA0C,MAAM,0BAA0B,SAAS,GAAG,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,iBAAqC,EACrC,WAAoC;IAEpC,IAAI,CAAC,iBAAiB;QAAE,OAAO,CAAC,kDAAkD;IAElF,mCAAmC;IACnC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC7C,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,0BAA0B;IACnE,CAAC;IAED,uCAAuC;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,4BAA4B;IAE/E,MAAM,IAAI,qBAAqB,CAC7B,sDAAsD,iBAAiB,eAAe;QACpF,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED,mEAAmE;AAEnE,MAAM,QAAQ,GAAiB;IAC7B;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC;QAChC,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAE1E,yEAAyE;YACzE,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE7D,MAAM,WAAW,GAAmE;gBAClF,GAAG,gBAAgB;gBACnB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxB,CAAC;YAEF,IAAI,GAAW,CAAC;YAChB,MAAM,GAAG,GACP,UAAU,CAAC,MAAM,GAAG,eAAe;gBACjC,CAAC,CAAC,YAAY,OAAO,EAAE;gBACvB,CAAC,CAAC,YAAY,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAE1D,IAAI,CAAC;gBACH,8NAA8N;gBAC9N,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE;oBAClB,GAAG,WAAW;oBACd,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtE,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,SAAkB,EAAE,CAAC;gBAC5B,oEAAoE;gBACpE,MAAM,GAAG,GAAG,SAIX,CAAC;gBACF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;gBAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;gBAC3E,MAAM,IAAI,KAAK,CACb,+BAA+B,GAAG,CAAC,MAAM,IAAI,SAAS,aAAa,oBAAoB,CAAC,MAAM,CAAC,aAAa,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAC3I,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,+CAA+C;gBAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,kEAAkE,OAAO,EAAE,CAC5E,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;KACF;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,SAAS;QAClB,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC;QAC/B,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG;YAC5C,8EAA8E;YAC9E,kDAAkD;YAClD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACjF,IAAI,CAAC;gBACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;gBACvC,8NAA8N;gBAC9N,OAAO,QAAQ,CACb,4CAA4C,OAAO,6BAA6B,EAChF,EAAE,GAAG,gBAAgB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACjD,CAAC,IAAI,EAAE,CAAC;YACX,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC;oBACH,UAAU,CAAC,OAAO,CAAC,CAAC;gBACtB,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;QACH,CAAC;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG;YAC3C,sDAAsD;YACtD,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1E,gKAAgK;YAChK,OAAO,QAAQ,CAAC,kCAAkC,EAAE;gBAClD,GAAG,gBAAgB;gBACnB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvB,KAAK,EAAE,UAAU;aAClB,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,CAAC;KACF;CACF,CAAC;AAEF,mEAAmE;AAEnE;;;;;;;GAOG;AACH,IAAI,oBAAyD,CAAC;AAE9D;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAA6C;IACpF,oBAAoB,GAAG,QAAQ,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,SAAS,kBAAkB,CAAC,OAAmB;IAC7C,IAAI,oBAAoB,IAAI,OAAO,CAAC,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACjE,OAAO,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAE,CAAC;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC,SAAS,CAAC;AAC3B,CAAC;AAED,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,YAAqB,EACrB,OAA0B;IAE1B,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAE5F,+DAA+D;IAC/D,IAAI,WAAW,GAAG,eAAe,CAAC;IAClC,IAAI,QAAQ,GAAG,WAAW,CAAC;IAE3B,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;QACjC,WAAW,GAAG,UAAU,CAAC;QACzB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,GAAG,2BAA2B,CAAC;QACzC,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,IAAI,WAAW,KAAK,UAAU,IAAI,QAAQ,EAAE,CAAC;QAC3C,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,mCAAmC;IACnC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAEzE,+DAA+D;IAC/D,oEAAoE;IACpE,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,WAAW,IAAI,iBAAiB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7E,mBAAmB,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,qCAAqC;IACrC,+EAA+E;IAC/E,kEAAkE;IAClE,IAAI,aAA4C,CAAC;IACjD,IAAI,WAAW,IAAI,iBAAiB,EAAE,CAAC;QACrC,aAAa,GAAG,kBAAkB,CAAC,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxF,CAAC;SAAM,IAAI,WAAW,IAAI,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9D,+EAA+E;QAC/E,0EAA0E;QAC1E,gFAAgF;QAChF,gFAAgF;QAChF,uCAAuC;QACvC,6EAA6E;QAC7E,+EAA+E;QAC/E,6EAA6E;QAC7E,gFAAgF;QAChF,kFAAkF;QAClF,iEAAiE;QACjE,aAAa,GAAG,kBAAkB,EAAE,CAAC;IACvC,CAAC;IACD,gFAAgF;IAChF,oFAAoF;IACpF,2FAA2F;IAE3F,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAEtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IAED,sCAAsC;IACtC,MAAM,OAAO,GAAG,WAAW;QACzB,CAAC,CAAC;YACE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC;YAClD,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC;SACnD;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,gEAAgE;YAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC7E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oEAAoE;YACpE,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,kFAAkF;YAClF,yEAAyE;YACzE,6DAA6D;YAC7D,MAAM,WAAW,GAAI,KAAe,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9D,MAAM,SAAS,GACb,WAAW,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC;YACzF,OAAO,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,IAAI,YAAY,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,mEAAmE;AAEnE;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/providers/gateway-discovery.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Gateway discovery — query what the bridge actually exposes.
+ *
+ * The bridge advertises its live providers and models via GET /v1/providers
+ * and GET /v1/models. `validateProviderChain` can check a provider chain
+ * against them so a misconfigured voice (unknown/unavailable provider, or a
+ * model that provider doesn't serve) is caught up front.
+ *
+ * STATUS: this is an available capability, NOT yet wired into the review
+ * pipeline — callers must invoke validateProviderChain themselves. Until that
+ * wiring lands the chain is sent unvalidated (tracked as a follow-up).
+ *
+ * SECURITY: the fetch helpers take a raw gatewayUrl and attach the bearer
+ * token. They route through `pinnedFetch` (gateway.ts) — the SAME SSRF /
+ * DNS-rebinding-pinning policy as the generation path (SEC-001): the hostname
+ * is resolved ONCE, every A/AAAA answer is validated, and the socket is pinned
+ * to an approved IP with Host header + TLS SNI preserved. Discovery and generate
+ * therefore share one pinning policy; a rebound host can never receive the token.
+ */
+import type { ProviderChainEntry } from '../types.js';
+/** One entry from GET /v1/models (`data[]`). */
+export interface GatewayModelEntry {
+    id: string;
+    name?: string;
+    provider?: string;
+    max_tokens?: number;
+}
+/** One entry from GET /v1/providers (`providers[]`). */
+export interface GatewayProviderStatus {
+    id: string;
+    name: string;
+    type: string;
+    available: boolean;
+}
+/** Fetch the bridge's advertised models (GET /v1/models). */
+export declare function fetchGatewayModels(gatewayUrl: string, gatewayToken: string): Promise<GatewayModelEntry[]>;
+/** Fetch the bridge's provider statuses (GET /v1/providers). */
+export declare function fetchGatewayProviders(gatewayUrl: string, gatewayToken: string): Promise<GatewayProviderStatus[]>;
+export interface ChainValidationResult {
+    /** Entries safe to send. */
+    valid: ProviderChainEntry[];
+    /** Entries that should NOT be sent, with a human-readable reason. */
+    invalid: Array<{
+        entry: ProviderChainEntry;
+        reason: string;
+    }>;
+}
+/**
+ * Validate gateway provider-chain entries against what the bridge actually
+ * exposes — so ghagga never sends a voice it only ASSUMES exists.
+ *
+ * Checks, per `provider === 'gateway'` entry:
+ * - `targetProvider` (if set) is a known, available bridge provider;
+ * - `model` (if not 'auto') is advertised — by that targetProvider when set,
+ *   otherwise by any provider.
+ *
+ * Non-gateway entries pass through unchecked (they don't go to the bridge).
+ */
+export declare function validateProviderChain(chain: ProviderChainEntry[], models: GatewayModelEntry[], providers: GatewayProviderStatus[]): ChainValidationResult;
+//# sourceMappingURL=gateway-discovery.d.ts.map

package/dist/providers/gateway-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-discovery.d.ts","sourceRoot":"","sources":["../../src/providers/gateway-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAKtD,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wDAAwD;AACxD,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;CACpB;AAoCD,6DAA6D;AAC7D,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAS9B;AAED,gEAAgE;AAChE,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CASlC;AAID,MAAM,WAAW,qBAAqB;IACpC,4BAA4B;IAC5B,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,qEAAqE;IACrE,OAAO,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,kBAAkB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,kBAAkB,EAAE,EAC3B,MAAM,EAAE,iBAAiB,EAAE,EAC3B,SAAS,EAAE,qBAAqB,EAAE,GACjC,qBAAqB,CAkBvB"}

package/dist/providers/gateway-discovery.js

@@ -0,0 +1,118 @@
+/**
+ * Gateway discovery — query what the bridge actually exposes.
+ *
+ * The bridge advertises its live providers and models via GET /v1/providers
+ * and GET /v1/models. `validateProviderChain` can check a provider chain
+ * against them so a misconfigured voice (unknown/unavailable provider, or a
+ * model that provider doesn't serve) is caught up front.
+ *
+ * STATUS: this is an available capability, NOT yet wired into the review
+ * pipeline — callers must invoke validateProviderChain themselves. Until that
+ * wiring lands the chain is sent unvalidated (tracked as a follow-up).
+ *
+ * SECURITY: the fetch helpers take a raw gatewayUrl and attach the bearer
+ * token. They route through `pinnedFetch` (gateway.ts) — the SAME SSRF /
+ * DNS-rebinding-pinning policy as the generation path (SEC-001): the hostname
+ * is resolved ONCE, every A/AAAA answer is validated, and the socket is pinned
+ * to an approved IP with Host header + TLS SNI preserved. Discovery and generate
+ * therefore share one pinning policy; a rebound host can never receive the token.
+ */
+import { pinnedFetch } from './gateway.js';
+// ─── Fetch helpers ──────────────────────────────────────────────
+async function gatewayGet(gatewayUrl, gatewayToken, path) {
+    if (!gatewayUrl) {
+        throw new Error('Gateway URL not configured — set it in the dashboard provider chain settings');
+    }
+    if (!gatewayToken) {
+        throw new Error('Gateway token not configured — set the API key in the dashboard provider chain settings');
+    }
+    // SSRF: pinnedFetch resolves once, validates every DNS answer, and pins the
+    // socket to a non-forbidden IP (same policy as generateViaGateway). Node's
+    // http/https client never follows a 3xx, so a redirect surfaces as a non-ok
+    // response below and can never chase a Location to an unvalidated host.
+    const response = await pinnedFetch(`${gatewayUrl}${path}`, {
+        method: 'GET',
+        headers: { Authorization: `Bearer ${gatewayToken}` },
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (!response.ok) {
+        const error = await response.text().catch(() => 'unknown error');
+        throw new Error(`Gateway error (${response.status}): ${error}`);
+    }
+    return response.json();
+}
+/** Fetch the bridge's advertised models (GET /v1/models). */
+export async function fetchGatewayModels(gatewayUrl, gatewayToken) {
+    const body = await gatewayGet(gatewayUrl, gatewayToken, '/v1/models');
+    const data = body.data;
+    if (!Array.isArray(data))
+        return [];
+    // Only trust entries that actually carry a string id — a malformed payload
+    // must not coerce into typed garbage that skews validation.
+    return data.filter((m) => typeof m?.id === 'string');
+}
+/** Fetch the bridge's provider statuses (GET /v1/providers). */
+export async function fetchGatewayProviders(gatewayUrl, gatewayToken) {
+    const body = await gatewayGet(gatewayUrl, gatewayToken, '/v1/providers');
+    const providers = body.providers;
+    if (!Array.isArray(providers))
+        return [];
+    return providers.filter((p) => typeof p?.id === 'string' &&
+        typeof p?.available === 'boolean');
+}
+/**
+ * Validate gateway provider-chain entries against what the bridge actually
+ * exposes — so ghagga never sends a voice it only ASSUMES exists.
+ *
+ * Checks, per `provider === 'gateway'` entry:
+ * - `targetProvider` (if set) is a known, available bridge provider;
+ * - `model` (if not 'auto') is advertised — by that targetProvider when set,
+ *   otherwise by any provider.
+ *
+ * Non-gateway entries pass through unchecked (they don't go to the bridge).
+ */
+export function validateProviderChain(chain, models, providers) {
+    const result = { valid: [], invalid: [] };
+    for (const entry of chain) {
+        if (entry.provider !== 'gateway') {
+            result.valid.push(entry);
+            continue;
+        }
+        const reason = validateGatewayEntry(entry, models, providers);
+        if (reason) {
+            result.invalid.push({ entry, reason });
+        }
+        else {
+            result.valid.push(entry);
+        }
+    }
+    return result;
+}
+function validateGatewayEntry(entry, models, providers) {
+    // Fail-open per dimension: an EMPTY discovery list means "couldn't discover"
+    // (bridge unreachable / transient), not "nothing exists" — so we skip that
+    // check rather than nuke an otherwise-valid chain on a blip.
+    if (entry.targetProvider && providers.length > 0) {
+        const status = providers.find((p) => p.id === entry.targetProvider);
+        if (!status) {
+            return `unknown bridge provider '${entry.targetProvider}'`;
+        }
+        if (!status.available) {
+            return `bridge provider '${entry.targetProvider}' is unavailable`;
+        }
+    }
+    // 'auto' lets the bridge choose — nothing to validate.
+    if (entry.model && entry.model !== 'auto' && models.length > 0) {
+        // The bridge always attributes a model's provider (GET /v1/models), so when
+        // targetProvider is set we require an exact provider match — no lenient
+        // "missing provider matches anything" escape hatch.
+        const known = models.some((m) => m.id === entry.model && (!entry.targetProvider || m.provider === entry.targetProvider));
+        if (!known) {
+            return entry.targetProvider
+                ? `model '${entry.model}' not advertised by provider '${entry.targetProvider}'`
+                : `model '${entry.model}' not advertised by the bridge`;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=gateway-discovery.js.map

package/dist/providers/gateway-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-discovery.js","sourceRoot":"","sources":["../../src/providers/gateway-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAoB3C,mEAAmE;AAEnE,KAAK,UAAU,UAAU,CACvB,UAAkB,EAClB,YAAoB,EACpB,IAAY;IAEZ,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,UAAU,GAAG,IAAI,EAAE,EAAE;QACzD,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE;QACpD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,MAAM,MAAM,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkB,EAClB,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;IACtE,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,2EAA2E;IAC3E,4DAA4D;IAC5D,OAAO,IAAI,CAAC,MAAM,CAChB,CAAC,CAAC,EAA0B,EAAE,CAAC,OAAQ,CAAuB,EAAE,EAAE,KAAK,QAAQ,CAChF,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAkB,EAClB,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;IACzE,MAAM,SAAS,GAAI,IAAgC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,SAAS,CAAC,MAAM,CACrB,CAAC,CAAC,EAA8B,EAAE,CAChC,OAAQ,CAA2B,EAAE,EAAE,KAAK,QAAQ;QACpD,OAAQ,CAA2B,EAAE,SAAS,KAAK,SAAS,CAC/D,CAAC;AACJ,CAAC;AAWD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAA2B,EAC3B,MAA2B,EAC3B,SAAkC;IAElC,MAAM,MAAM,GAA0B,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAEjE,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAyB,EACzB,MAA2B,EAC3B,SAAkC;IAElC,6EAA6E;IAC7E,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,KAAK,CAAC,cAAc,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,4BAA4B,KAAK,CAAC,cAAc,GAAG,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,OAAO,oBAAoB,KAAK,CAAC,cAAc,kBAAkB,CAAC;QACpE,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,4EAA4E;QAC5E,wEAAwE;QACxE,oDAAoD;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,cAAc,CAAC,CAC9F,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,cAAc;gBACzB,CAAC,CAAC,UAAU,KAAK,CAAC,KAAK,iCAAiC,KAAK,CAAC,cAAc,GAAG;gBAC/E,CAAC,CAAC,UAAU,KAAK,CAAC,KAAK,gCAAgC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/providers/gateway.d.ts

@@ -9,14 +9,47 @@
  *   Request:  { prompt, system, provider?, model?, project? }
  *   Response: { text, provider, model, tokensUsed }
  *
+ * When `provider` is set, the bridge short-circuits its model-based routing
+ * and selects that provider directly (the model is passed through verbatim).
+ *
  * This provider bypasses the AI SDK entirely — the gateway handles model
  * selection, provider routing, and token management internally.
+ *
+ * ─── SSRF / DNS-rebinding defense (SEC-001) ─────────────────────────────────
+ *
+ * The gateway URL is user-supplied (dashboard provider chain). A naive
+ * `fetch(url)` re-resolves the hostname at connection time, so an attacker who
+ * controls the hostname's DNS can pass a persist-time/validation-time check
+ * (resolving to a public IP) and then rebind the record to loopback, cloud
+ * metadata (169.254.169.254), or an RFC-1918 host before the actual request.
+ *
+ * `pinnedFetch` (below) closes that TOCTOU: it resolves the hostname EXACTLY
+ * ONCE, validates EVERY A/AAAA answer against the forbidden ranges, rejects
+ * mixed public/private answer sets, picks one approved IP, and PINS the socket
+ * to that IP via a custom `lookup` fed to Node's built-in http/https client —
+ * while preserving the original Host header and TLS SNI (servername). Both the
+ * generation path (this file) AND the discovery path (gateway-discovery.ts)
+ * route through the SAME `pinnedFetch`, so they share one pinning policy.
+ *
+ * Node's http/https client never auto-follows redirects, so a 3xx surfaces as a
+ * non-ok response (the old `redirect: 'manual'` posture) and can never chase a
+ * Location header to an unvalidated address.
+ *
+ * Self-hosted escape hatch: `GHAGGA_ALLOW_PRIVATE_GATEWAY=true` skips the
+ * IP-range checks (for gateways that legitimately live on a private network) —
+ * the connection is STILL pinned to the resolved address, and the protocol /
+ * userinfo checks are always enforced.
  */
 export interface GatewayOptions {
     /** Gateway base URL (e.g., "https://llm-gateway.javierzader.com") */
     gatewayUrl: string;
     /** Bearer token for gateway authentication */
     gatewayToken: string;
+    /**
+     * Bridge-side provider id to route to (e.g. 'codex-cli'). When set, the
+     * bridge selects this provider directly and skips model-based routing.
+     */
+    provider?: string;
     /** Model to request (optional — gateway can auto-select) */
     model?: string;
     /** Project identifier for gateway tracking/routing */
@@ -28,6 +61,67 @@ export interface GatewayResponse {
     model: string;
     tokensUsed?: number;
 }
+/** A hostname resolved and validated to a single approved, pinned address. */
+export interface PinnedHost {
+    /** Parsed, protocol-checked URL. */
+    url: URL;
+    /** Hostname (brackets stripped for IPv6) — used for Host header + SNI. */
+    hostname: string;
+    /** The approved IP the socket is pinned to. */
+    ip: string;
+    /** IP family of the pinned address (4 or 6). */
+    family: 4 | 6;
+    /** Effective port. */
+    port: number;
+}
+/** An address record returned by DNS lookup. */
+interface LookupAddress {
+    address: string;
+    family: number;
+}
+/** DNS resolver signature — injectable for tests. */
+export type ResolveAllFn = (hostname: string) => Promise<LookupAddress[]>;
+/**
+ * Resolve a user-supplied gateway URL to exactly ONE approved, pinned IP.
+ *
+ * SECURITY: never echoes the hostname/address in thrown messages — the URL IS
+ * the SSRF target. Callers log the category only.
+ *
+ * @throws {Error} with a generic reason if the URL is unusable or forbidden.
+ */
+export declare function resolveAndPinHost(rawUrl: string, resolveAll?: ResolveAllFn, opts?: {
+    signal?: AbortSignal;
+    dnsTimeoutMs?: number;
+}): Promise<PinnedHost>;
+/** Minimal fetch-like response returned by pinnedFetch. */
+export interface PinnedResponse {
+    ok: boolean;
+    status: number;
+    text(): Promise<string>;
+    json(): Promise<unknown>;
+}
+interface PinnedRequestInit {
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+    /** Abort signal (e.g. AbortSignal.timeout(...)). */
+    signal?: AbortSignal;
+    /** Injectable resolver for tests. */
+    resolveAll?: ResolveAllFn;
+}
+/**
+ * Perform an HTTP(S) request to a user-supplied gateway URL with the connection
+ * PINNED to a validated, non-forbidden IP (SEC-001). See the module header.
+ *
+ * Both the generation and discovery paths call this, so they share one policy.
+ *
+ * ERROR SHAPE: on failure this rejects with a PLAIN `Error` (e.g. 'request
+ * aborted', 'request timed out', 'gateway host DNS resolution timed out'), NOT a
+ * fetch-shaped `TypeError`/`AbortError`. Callers must not branch on error type
+ * (`err.name === 'AbortError'`); inspect the message or treat any rejection as a
+ * failed request.
+ */
+export declare function pinnedFetch(rawUrl: string, init: PinnedRequestInit): Promise<PinnedResponse>;
 /**
  * Generate text via the LLM Gateway.
  *
@@ -37,4 +131,5 @@ export interface GatewayResponse {
  * @returns Gateway response with generated text and metadata
  */
 export declare function generateViaGateway(prompt: string, systemPrompt?: string, options?: GatewayOptions): Promise<GatewayResponse>;
+export {};
 //# sourceMappingURL=gateway.d.ts.map

package/dist/providers/gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/providers/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,eAAe,CAAC,CAyC1B"}
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/providers/gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AASH,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAkID,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,oCAAoC;IACpC,GAAG,EAAE,GAAG,CAAC;IACT,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IACd,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,gDAAgD;AAChD,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qDAAqD;AACrD,MAAM,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;AA8D1E;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,UAAU,GAAE,YAAgC,EAC5C,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACrD,OAAO,CAAC,UAAU,CAAC,CA+ErB;AAID,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B;AAED,UAAU,iBAAiB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,qCAAqC;IACrC,UAAU,CAAC,EAAE,YAAY,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CAwFzB;AAID;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,eAAe,CAAC,CAsC1B"}