kaijibot 2026.8.21 → 2026.8.29

package/dist/setup.finalize-Wq93dYFU.js

@@ -0,0 +1,436 @@
+import { r as formatErrorMessage } from "./errors-Ez4cKI2Y.js";
+import { t as restoreTerminalState } from "./restore-Cq7ylBPo.js";
+import { d as pathExists, m as resolveUserPath } from "./utils-C8dt4mi-.js";
+import { r as DEFAULT_BOOTSTRAP_FILENAME } from "./workspace-4a1dwE_K.js";
+import { n as resolveCliName } from "./cli-name-mbXbS_Xz.js";
+import { t as formatCliCommand } from "./command-format-BZyfOXIE.js";
+import { n as buildGatewayInstallPlan, r as gatewayInstallErrorHint, t as resolveGatewayInstallToken } from "./gateway-install-token-6z725yP4.js";
+import { r as t } from "./translate-CZMssHoF.js";
+import { n as GATEWAY_DAEMON_RUNTIME_OPTIONS, t as DEFAULT_GATEWAY_DAEMON_RUNTIME } from "./daemon-runtime-BJCoVdCD.js";
+import { t as resolveControlUiLinks } from "./control-ui-links-tILfT2Ek.js";
+import { n as openUrl, t as detectBrowserOpenSupport } from "./browser-open-BzpYLaas.js";
+import { h as waitForGatewayReachable, i as formatControlUiSshHint, u as probeGatewayReachable } from "./onboard-helpers-DptwxvqO.js";
+import { i as isSystemdUserServiceAvailable } from "./systemd-BeYwG5kN.js";
+import { a as tryResolveGatewayService, t as describeGatewayServiceRestart } from "./service-CK-XuLCu.js";
+import { n as listConfiguredWebSearchProviders } from "./runtime-DObmMc6X.js";
+import { t as ensureControlUiAssetsBuilt } from "./control-ui-assets-CYfusY07.js";
+import { r as installCompletion } from "./completion-cli-CkGZkKuo.js";
+import { r as healthCommand } from "./health-3b-YI19K.js";
+import { t as resolveSetupSecretInputString } from "./setup.secret-input-_xfjuFpR.js";
+import { t as formatHealthCheckFailure } from "./health-format-BAdMOv0G.js";
+import { r as ensureCompletionCacheExists, t as checkShellCompletionStatus } from "./doctor-completion-Fy70rfGZ.js";
+import { t as runTui } from "./tui-Cnxy7MIi.js";
+import os from "node:os";
+import path from "node:path";
+import fs from "node:fs/promises";
+//#region src/wizard/setup.completion.ts
+async function resolveProfileHint(shell) {
+	const home = process.env.HOME || os.homedir();
+	if (shell === "zsh") return "~/.zshrc";
+	if (shell === "bash") return await pathExists(path.join(home, ".bashrc")) ? "~/.bashrc" : "~/.bash_profile";
+	if (shell === "fish") return "~/.config/fish/config.fish";
+	return "$PROFILE";
+}
+function formatReloadHint(shell, profileHint) {
+	if (shell === "powershell") return "Restart your shell (or reload your PowerShell profile).";
+	return `Restart your shell or run: source ${profileHint}`;
+}
+async function setupWizardShellCompletion(params) {
+	const deps = {
+		resolveCliName,
+		checkShellCompletionStatus,
+		ensureCompletionCacheExists,
+		installCompletion,
+		...params.deps
+	};
+	const cliName = deps.resolveCliName();
+	const completionStatus = await deps.checkShellCompletionStatus(cliName);
+	if (completionStatus.usesSlowPattern) {
+		if (await deps.ensureCompletionCacheExists(cliName)) await deps.installCompletion(completionStatus.shell, true, cliName);
+		return;
+	}
+	if (completionStatus.profileInstalled && !completionStatus.cacheExists) {
+		await deps.ensureCompletionCacheExists(cliName);
+		return;
+	}
+	if (!completionStatus.profileInstalled) {
+		if (!(params.flow === "quickstart" ? true : await params.prompter.confirm({
+			message: `Enable ${completionStatus.shell} shell completion for ${cliName}?`,
+			initialValue: true
+		}))) return;
+		if (!await deps.ensureCompletionCacheExists(cliName)) {
+			await params.prompter.note(`Failed to generate completion cache. Run \`${cliName} completion --install\` later.`, "Shell completion");
+			return;
+		}
+		await deps.installCompletion(completionStatus.shell, true, cliName);
+		const profileHint = await resolveProfileHint(completionStatus.shell);
+		await params.prompter.note(`Shell completion installed. ${formatReloadHint(completionStatus.shell, profileHint)}`, "Shell completion");
+	}
+}
+//#endregion
+//#region src/wizard/setup.finalize.ts
+async function finalizeSetupWizard(options) {
+	const { flow, opts, baseConfig, nextConfig, settings, prompter, runtime } = options;
+	let gatewayProbe = { ok: true };
+	const withWizardProgress = async (label, options, work) => {
+		const progress = prompter.progress(label);
+		try {
+			return await work(progress);
+		} finally {
+			progress.stop(typeof options.doneMessage === "function" ? options.doneMessage() : options.doneMessage);
+		}
+	};
+	const serviceManagerAvailable = tryResolveGatewayService() !== null;
+	const systemdAvailable = process.platform === "linux" ? await isSystemdUserServiceAvailable() : serviceManagerAvailable;
+	if (!serviceManagerAvailable) await prompter.note(process.platform === "android" ? "No service manager on Android/Termux. The gateway will start in the foreground." : "Systemd user services are unavailable. Skipping lingering checks and service install.", "Systemd");
+	if (process.platform === "linux" && systemdAvailable) {
+		const { ensureSystemdUserLingerInteractive } = await import("./systemd-linger-X-aDLDla.js");
+		await ensureSystemdUserLingerInteractive({
+			runtime,
+			prompter: {
+				confirm: prompter.confirm,
+				note: prompter.note
+			},
+			reason: "Linux installs use a systemd user service by default. Without lingering, systemd stops the user session on logout/idle and kills the Gateway.",
+			requireConfirm: false
+		});
+	}
+	const explicitInstallDaemon = typeof opts.installDaemon === "boolean" ? opts.installDaemon : void 0;
+	let installDaemon;
+	if (explicitInstallDaemon !== void 0) installDaemon = explicitInstallDaemon;
+	else if (!serviceManagerAvailable) installDaemon = false;
+	else if (process.platform === "linux" && !systemdAvailable) installDaemon = false;
+	else if (flow === "quickstart") installDaemon = true;
+	else installDaemon = await prompter.confirm({
+		message: t("cli.wizard.daemon.installQuestion"),
+		initialValue: true
+	});
+	if (!serviceManagerAvailable && installDaemon) {
+		await prompter.note(process.platform === "android" ? "No service manager on Android/Termux. Start the gateway manually: kaijibot gateway run" : "Systemd user services are unavailable; skipping service install. Use your container supervisor or `docker compose up -d`.", "Gateway service");
+		installDaemon = false;
+	}
+	if (installDaemon) {
+		const daemonRuntime = flow === "quickstart" ? DEFAULT_GATEWAY_DAEMON_RUNTIME : await prompter.select({
+			message: t("cli.wizard.daemon.runtimeSelect"),
+			options: GATEWAY_DAEMON_RUNTIME_OPTIONS,
+			initialValue: opts.daemonRuntime ?? "node"
+		});
+		if (flow === "quickstart") await prompter.note("QuickStart uses Node for the Gateway service (stable + supported).", "Gateway service runtime");
+		const service = tryResolveGatewayService();
+		if (!service) throw new Error("Unreachable: serviceManagerAvailable was checked above");
+		const loaded = await service.isLoaded({ env: process.env });
+		let restartWasScheduled = false;
+		if (loaded) {
+			const action = await prompter.select({
+				message: t("cli.wizard.daemon.installedAction"),
+				options: [
+					{
+						value: "restart",
+						label: t("cli.wizard.daemon.restartLabel")
+					},
+					{
+						value: "reinstall",
+						label: t("cli.wizard.daemon.reinstallLabel")
+					},
+					{
+						value: "skip",
+						label: t("cli.wizard.daemon.skipLabel")
+					}
+				]
+			});
+			if (action === "restart") {
+				let restartDoneMessage = "Gateway service restarted.";
+				await withWizardProgress("Gateway service", { doneMessage: () => restartDoneMessage }, async (progress) => {
+					progress.update("Restarting Gateway service…");
+					const restartStatus = describeGatewayServiceRestart("Gateway", await service.restart({
+						env: process.env,
+						stdout: process.stdout
+					}));
+					restartDoneMessage = restartStatus.progressMessage;
+					restartWasScheduled = restartStatus.scheduled;
+				});
+			} else if (action === "reinstall") await withWizardProgress("Gateway service", { doneMessage: "Gateway service uninstalled." }, async (progress) => {
+				progress.update("Uninstalling Gateway service…");
+				await service.uninstall({
+					env: process.env,
+					stdout: process.stdout
+				});
+			});
+		}
+		if (!loaded || !restartWasScheduled && loaded && !await service.isLoaded({ env: process.env })) {
+			const progress = prompter.progress("Gateway service");
+			let installError = null;
+			try {
+				progress.update("Preparing Gateway service…");
+				const tokenResolution = await resolveGatewayInstallToken({
+					config: nextConfig,
+					env: process.env
+				});
+				for (const warning of tokenResolution.warnings) await prompter.note(warning, "Gateway service");
+				if (tokenResolution.unavailableReason) installError = [
+					"Gateway install blocked:",
+					tokenResolution.unavailableReason,
+					"Fix gateway auth config/token input and rerun setup."
+				].join(" ");
+				else {
+					const { programArguments, workingDirectory, environment } = await buildGatewayInstallPlan({
+						env: process.env,
+						port: settings.port,
+						runtime: daemonRuntime,
+						warn: (message, title) => prompter.note(message, title),
+						config: nextConfig
+					});
+					progress.update("Installing Gateway service…");
+					await service.install({
+						env: process.env,
+						stdout: process.stdout,
+						programArguments,
+						workingDirectory,
+						environment
+					});
+				}
+			} catch (err) {
+				installError = formatErrorMessage(err);
+			} finally {
+				progress.stop(installError ? t("cli.wizard.daemon.installFailed") : t("cli.wizard.daemon.installOk"));
+			}
+			if (installError) {
+				await prompter.note(t("cli.wizard.daemon.installFailedNote", { error: installError }), "Gateway");
+				await prompter.note(gatewayInstallErrorHint(), "Gateway");
+			}
+		}
+	}
+	if (!opts.skipHealth) {
+		const probeLinks = resolveControlUiLinks({
+			bind: nextConfig.gateway?.bind ?? "loopback",
+			port: settings.port,
+			customBindHost: nextConfig.gateway?.customBindHost,
+			basePath: void 0
+		});
+		gatewayProbe = await waitForGatewayReachable({
+			url: probeLinks.wsUrl,
+			token: settings.gatewayToken,
+			deadlineMs: 15e3
+		});
+		if (gatewayProbe.ok) try {
+			await healthCommand({
+				json: false,
+				timeoutMs: 1e4
+			}, runtime);
+		} catch (err) {
+			runtime.error(formatHealthCheckFailure(err));
+			await prompter.note(["Docs:", "https://github.com/Kaiji-Z/kaijibot/issues"].join("\n"), "Health check help");
+		}
+		else if (installDaemon) {
+			runtime.error(formatHealthCheckFailure(new Error(gatewayProbe.detail ?? `gateway did not become reachable at ${probeLinks.wsUrl}`)));
+			await prompter.note(["Docs:", "https://github.com/Kaiji-Z/kaijibot/issues"].join("\n"), "Health check help");
+		} else await prompter.note([
+			"Gateway not detected yet.",
+			"Setup was run without Gateway service install, so no background gateway is expected.",
+			`Start now: ${formatCliCommand("kaijibot gateway run")}`,
+			`Or rerun with: ${formatCliCommand("kaijibot onboard --install-daemon")}`,
+			`Or skip this probe next time: ${formatCliCommand("kaijibot onboard --skip-health")}`
+		].join("\n"), "Gateway");
+	}
+	const controlUiEnabled = nextConfig.gateway?.controlUi?.enabled ?? baseConfig.gateway?.controlUi?.enabled ?? true;
+	if (!opts.skipUi && controlUiEnabled) {
+		const controlUiAssets = await ensureControlUiAssetsBuilt(runtime);
+		if (!controlUiAssets.ok && controlUiAssets.message) runtime.error(controlUiAssets.message);
+	}
+	await prompter.note("", "Optional apps");
+	const controlUiBasePath = nextConfig.gateway?.controlUi?.basePath ?? baseConfig.gateway?.controlUi?.basePath;
+	const links = resolveControlUiLinks({
+		bind: settings.bind,
+		port: settings.port,
+		customBindHost: settings.customBindHost,
+		basePath: controlUiBasePath
+	});
+	const authedUrl = settings.authMode === "token" && settings.gatewayToken ? `${links.httpUrl}#token=${encodeURIComponent(settings.gatewayToken)}` : links.httpUrl;
+	let resolvedGatewayPassword = "";
+	if (settings.authMode === "password") try {
+		resolvedGatewayPassword = await resolveSetupSecretInputString({
+			config: nextConfig,
+			value: nextConfig.gateway?.auth?.password,
+			path: "gateway.auth.password",
+			env: process.env
+		}) ?? "";
+	} catch (error) {
+		await prompter.note(["Could not resolve gateway.auth.password SecretRef for setup auth.", formatErrorMessage(error)].join("\n"), "Gateway auth");
+	}
+	if (opts.skipHealth || !gatewayProbe.ok) gatewayProbe = await probeGatewayReachable({
+		url: links.wsUrl,
+		token: settings.authMode === "token" ? settings.gatewayToken : void 0,
+		password: settings.authMode === "password" ? resolvedGatewayPassword : ""
+	});
+	const gatewayStatusLine = gatewayProbe.ok ? "Gateway: reachable" : `Gateway: not detected${gatewayProbe.detail ? ` (${gatewayProbe.detail})` : ""}`;
+	const bootstrapPath = path.join(resolveUserPath(options.workspaceDir), DEFAULT_BOOTSTRAP_FILENAME);
+	const hasBootstrap = await fs.access(bootstrapPath).then(() => true).catch(() => false);
+	await prompter.note([
+		`Web UI: ${links.httpUrl}`,
+		settings.authMode === "token" && settings.gatewayToken ? `Web UI (with token): ${authedUrl}` : void 0,
+		`Gateway WS: ${links.wsUrl}`,
+		gatewayStatusLine,
+		"Docs: https://github.com/Kaiji-Z/kaijibot"
+	].filter(Boolean).join("\n"), "Control UI");
+	let controlUiOpened = false;
+	let controlUiOpenHint;
+	let hatchChoice = null;
+	let launchedTui = false;
+	if (!opts.skipUi && gatewayProbe.ok) {
+		if (hasBootstrap) await prompter.note([
+			"This is the defining action that makes your agent you.",
+			"Please take your time.",
+			"The more you tell it, the better the experience will be.",
+			t("cli.wizard.hatch.wakeMessage")
+		].join("\n"), "Start TUI (best option!)");
+		await prompter.note([
+			"Gateway token: shared auth for the Gateway + Control UI.",
+			"Stored in: $KAIJIBOT_CONFIG_PATH (default: ~/.kaijibot/kaijibot.json) under gateway.auth.token, or in KAIJIBOT_GATEWAY_TOKEN.",
+			`View token: ${formatCliCommand("kaijibot config get gateway.auth.token")}`,
+			`Generate token: ${formatCliCommand("kaijibot doctor --generate-gateway-token")}`,
+			"Web UI keeps dashboard URL tokens in memory for the current tab and strips them from the URL after load.",
+			`Open the dashboard anytime: ${formatCliCommand("kaijibot dashboard --no-open")}`,
+			"If prompted: paste the token into Control UI settings (or use the tokenized dashboard URL)."
+		].join("\n"), "Token");
+		hatchChoice = await prompter.select({
+			message: t("cli.wizard.hatch.message"),
+			options: [
+				{
+					value: "tui",
+					label: t("cli.wizard.hatch.tuiLabel")
+				},
+				{
+					value: "web",
+					label: t("cli.wizard.hatch.webLabel")
+				},
+				{
+					value: "later",
+					label: t("cli.wizard.hatch.laterLabel")
+				}
+			],
+			initialValue: "tui"
+		});
+		if (hatchChoice === "tui") {
+			restoreTerminalState("pre-setup tui", { resumeStdinIfPaused: true });
+			await runTui({
+				url: links.wsUrl,
+				token: settings.authMode === "token" ? settings.gatewayToken : void 0,
+				password: settings.authMode === "password" ? resolvedGatewayPassword : "",
+				deliver: false,
+				message: hasBootstrap ? t("cli.wizard.hatch.tuiGreeting") : void 0
+			});
+			launchedTui = true;
+		} else if (hatchChoice === "web") {
+			if ((await detectBrowserOpenSupport()).ok) {
+				controlUiOpened = await openUrl(authedUrl);
+				if (!controlUiOpened) controlUiOpenHint = formatControlUiSshHint({
+					port: settings.port,
+					basePath: controlUiBasePath,
+					token: settings.authMode === "token" ? settings.gatewayToken : void 0
+				});
+			} else controlUiOpenHint = formatControlUiSshHint({
+				port: settings.port,
+				basePath: controlUiBasePath,
+				token: settings.authMode === "token" ? settings.gatewayToken : void 0
+			});
+			await prompter.note([
+				`Dashboard link (with token): ${authedUrl}`,
+				controlUiOpened ? "Opened in your browser. Keep that tab to control KaijiBot." : "Copy/paste this URL in a browser on this machine to control KaijiBot.",
+				controlUiOpenHint
+			].filter(Boolean).join("\n"), "Dashboard ready");
+		} else await prompter.note(`When you're ready: ${formatCliCommand("kaijibot dashboard --no-open")}`, "Later");
+	} else if (opts.skipUi) await prompter.note("Skipping Control UI/TUI prompts.", "Control UI");
+	await prompter.note(["Back up your agent workspace.", "Docs: https://github.com/Kaiji-Z/kaijibot"].join("\n"), "Workspace backup");
+	await prompter.note(t("cli.wizard.security.notice"), t("cli.wizard.security.title"));
+	await setupWizardShellCompletion({
+		flow,
+		prompter
+	});
+	if (!opts.skipUi && gatewayProbe.ok && settings.authMode === "token" && Boolean(settings.gatewayToken) && hatchChoice === null) {
+		if ((await detectBrowserOpenSupport()).ok) {
+			controlUiOpened = await openUrl(authedUrl);
+			if (!controlUiOpened) controlUiOpenHint = formatControlUiSshHint({
+				port: settings.port,
+				basePath: controlUiBasePath,
+				token: settings.gatewayToken
+			});
+		} else controlUiOpenHint = formatControlUiSshHint({
+			port: settings.port,
+			basePath: controlUiBasePath,
+			token: settings.gatewayToken
+		});
+		await prompter.note([
+			`Dashboard link (with token): ${authedUrl}`,
+			controlUiOpened ? "Opened in your browser. Keep that tab to control KaijiBot." : "Copy/paste this URL in a browser on this machine to control KaijiBot.",
+			controlUiOpenHint
+		].filter(Boolean).join("\n"), "Dashboard ready");
+	}
+	const { describeCodexNativeWebSearch } = await import("./codex-native-web-search-TdFXLTHZ.js");
+	const codexNativeSummary = describeCodexNativeWebSearch(nextConfig);
+	const webSearchProvider = nextConfig.tools?.web?.search?.provider;
+	const webSearchEnabled = nextConfig.tools?.web?.search?.enabled;
+	const configuredSearchProviders = listConfiguredWebSearchProviders({ config: nextConfig });
+	if (webSearchProvider) {
+		const { resolveExistingKey, hasExistingKey, hasKeyInEnv } = await import("./onboard-search-D-BZAp6B.js");
+		const entry = configuredSearchProviders.find((e) => e.id === webSearchProvider);
+		const label = entry?.label ?? webSearchProvider;
+		const storedKey = entry ? resolveExistingKey(nextConfig, webSearchProvider) : void 0;
+		const keyConfigured = entry ? hasExistingKey(nextConfig, webSearchProvider) : false;
+		const envAvailable = entry ? hasKeyInEnv(entry) : false;
+		const hasKey = keyConfigured || envAvailable;
+		const keySource = storedKey ? "API key: stored in config." : keyConfigured ? "API key: configured via secret reference." : envAvailable ? `API key: provided via ${entry?.envVars.join(" / ")} env var.` : void 0;
+		if (!entry) await prompter.note([
+			`Web search provider ${label} is selected but unavailable under the current plugin policy.`,
+			"web_search will not work until the provider is re-enabled or a different provider is selected.",
+			`  ${formatCliCommand("kaijibot configure --section web")}`,
+			"",
+			"Docs: https://github.com/Kaiji-Z/kaijibot"
+		].join("\n"), "Web search");
+		else if (webSearchEnabled !== false && hasKey) await prompter.note([
+			"Web search is enabled, so your agent can look things up online when needed.",
+			"",
+			`Provider: ${label}`,
+			...keySource ? [keySource] : [],
+			"Docs: https://github.com/Kaiji-Z/kaijibot"
+		].join("\n"), "Web search");
+		else if (!hasKey) await prompter.note([
+			`Provider ${label} is selected but no API key was found.`,
+			"web_search will not work until a key is added.",
+			`  ${formatCliCommand("kaijibot configure --section web")}`,
+			"",
+			`Get your key at: ${entry?.signupUrl ?? "https://github.com/Kaiji-Z/kaijibot"}`,
+			"Docs: https://github.com/Kaiji-Z/kaijibot"
+		].join("\n"), "Web search");
+		else await prompter.note([
+			`Web search (${label}) is configured but disabled.`,
+			`Re-enable: ${formatCliCommand("kaijibot configure --section web")}`,
+			"",
+			"Docs: https://github.com/Kaiji-Z/kaijibot"
+		].join("\n"), "Web search");
+	} else {
+		const { hasExistingKey, hasKeyInEnv } = await import("./onboard-search-D-BZAp6B.js");
+		const legacyDetected = configuredSearchProviders.find((e) => hasExistingKey(nextConfig, e.id) || hasKeyInEnv(e));
+		if (legacyDetected) await prompter.note([`Web search is available via ${legacyDetected.label} (auto-detected).`, "Docs: https://github.com/Kaiji-Z/kaijibot"].join("\n"), "Web search");
+		else if (codexNativeSummary) await prompter.note([
+			"Managed web search provider was skipped.",
+			codexNativeSummary,
+			"Docs: https://github.com/Kaiji-Z/kaijibot"
+		].join("\n"), "Web search");
+		else await prompter.note([
+			"Web search was skipped. You can enable it later:",
+			`  ${formatCliCommand("kaijibot configure --section web")}`,
+			"",
+			"Docs: https://github.com/Kaiji-Z/kaijibot"
+		].join("\n"), "Web search");
+	}
+	if (codexNativeSummary) await prompter.note([
+		codexNativeSummary,
+		"Used only for Codex-capable models.",
+		"Docs: https://github.com/Kaiji-Z/kaijibot"
+	].join("\n"), "Codex native search");
+	await prompter.note(t("cli.wizard.whatNow.body"), "What now");
+	await prompter.outro(controlUiOpened ? t("cli.wizard.outro.opened") : t("cli.wizard.outro.default"));
+	return { launchedTui };
+}
+//#endregion
+export { finalizeSetupWizard };

package/dist/setup.gateway-config-DteoOy8F.js

@@ -0,0 +1,246 @@
+import { it as ensureControlUiAllowedOriginsForNonLoopbackBind } from "./io-NwOu0Lqq.js";
+import { d as resolveSecretInputRef, l as normalizeSecretInputString } from "./types.secrets-i3-0qtd4.js";
+import { a as findTailscaleBinary } from "./tailscale-DibNxi0y.js";
+import { c as normalizeGatewayTokenInput, d as randomToken, m as validateGatewayPasswordInput } from "./onboard-helpers-DptwxvqO.js";
+import { t as resolveSecretInputModeForEnvSelection } from "./provider-auth-mode-vNlQ9EJb.js";
+import { t as DEFAULT_DANGEROUS_NODE_COMMANDS } from "./node-command-policy-J_sy6jJz.js";
+import { n as promptSecretRefForSetup } from "./provider-auth-ref-9f6GdvYV.js";
+import { t as resolveSetupSecretInputString } from "./setup.secret-input-_xfjuFpR.js";
+import { a as maybeAddTailnetOriginToControlUiAllowedOrigins, i as TAILSCALE_MISSING_BIN_NOTE_LINES, n as TAILSCALE_DOCS_LINES, r as TAILSCALE_EXPOSURE_OPTIONS, t as validateIPv4AddressInput } from "./ipv4-CTuRjRc8.js";
+//#region src/wizard/setup.gateway-config.ts
+async function configureGatewayForSetup(opts) {
+	const { flow, localPort, quickstartGateway, prompter } = opts;
+	let { nextConfig } = opts;
+	const port = flow === "quickstart" ? quickstartGateway.port : Number.parseInt(String(await prompter.text({
+		message: "Gateway port",
+		initialValue: String(localPort),
+		validate: (value) => Number.isFinite(Number(value)) ? void 0 : "Invalid port"
+	})), 10);
+	let bind = flow === "quickstart" ? quickstartGateway.bind : await prompter.select({
+		message: "Gateway bind",
+		options: [
+			{
+				value: "loopback",
+				label: "Loopback (127.0.0.1)"
+			},
+			{
+				value: "lan",
+				label: "LAN (0.0.0.0)"
+			},
+			{
+				value: "tailnet",
+				label: "Tailnet (Tailscale IP)"
+			},
+			{
+				value: "auto",
+				label: "Auto (Loopback → LAN)"
+			},
+			{
+				value: "custom",
+				label: "Custom IP"
+			}
+		]
+	});
+	let customBindHost = quickstartGateway.customBindHost;
+	if (bind === "custom") {
+		if (flow !== "quickstart" || !customBindHost) {
+			const input = await prompter.text({
+				message: "Custom IP address",
+				placeholder: "192.168.1.100",
+				initialValue: customBindHost ?? "",
+				validate: validateIPv4AddressInput
+			});
+			customBindHost = typeof input === "string" ? input.trim() : void 0;
+		}
+	}
+	let authMode = flow === "quickstart" ? quickstartGateway.authMode : await prompter.select({
+		message: "Gateway auth",
+		options: [{
+			value: "token",
+			label: "Token",
+			hint: "Recommended default (local + remote)"
+		}, {
+			value: "password",
+			label: "Password"
+		}],
+		initialValue: "token"
+	});
+	const tailscaleMode = flow === "quickstart" ? quickstartGateway.tailscaleMode : await prompter.select({
+		message: "Tailscale exposure",
+		options: [...TAILSCALE_EXPOSURE_OPTIONS]
+	});
+	let tailscaleBin = null;
+	if (tailscaleMode !== "off") {
+		tailscaleBin = await findTailscaleBinary();
+		if (!tailscaleBin) await prompter.note(TAILSCALE_MISSING_BIN_NOTE_LINES.join("\n"), "Tailscale Warning");
+	}
+	let tailscaleResetOnExit = flow === "quickstart" ? quickstartGateway.tailscaleResetOnExit : false;
+	if (tailscaleMode !== "off" && flow !== "quickstart") {
+		await prompter.note(TAILSCALE_DOCS_LINES.join("\n"), "Tailscale");
+		tailscaleResetOnExit = Boolean(await prompter.confirm({
+			message: "Reset Tailscale serve/funnel on exit?",
+			initialValue: false
+		}));
+	}
+	if (tailscaleMode !== "off" && bind !== "loopback") {
+		await prompter.note("Tailscale requires bind=loopback. Adjusting bind to loopback.", "Note");
+		bind = "loopback";
+		customBindHost = void 0;
+	}
+	if (tailscaleMode === "funnel" && authMode !== "password") {
+		await prompter.note("Tailscale funnel requires password auth.", "Note");
+		authMode = "password";
+	}
+	let gatewayToken;
+	let gatewayTokenInput;
+	if (authMode === "token") {
+		const quickstartTokenString = normalizeSecretInputString(quickstartGateway.token);
+		const quickstartTokenRef = resolveSecretInputRef({
+			value: quickstartGateway.token,
+			defaults: nextConfig.secrets?.defaults
+		}).ref;
+		if ((flow === "quickstart" && opts.secretInputMode !== "ref" ? quickstartTokenRef ? "ref" : "plaintext" : await resolveSecretInputModeForEnvSelection({
+			prompter,
+			explicitMode: opts.secretInputMode,
+			copy: {
+				modeMessage: "How do you want to provide the gateway token?",
+				plaintextLabel: "Generate/store plaintext token",
+				plaintextHint: "Default",
+				refLabel: "Use SecretRef",
+				refHint: "Store a reference instead of plaintext"
+			}
+		})) === "ref") if (flow === "quickstart" && quickstartTokenRef) {
+			gatewayTokenInput = quickstartTokenRef;
+			gatewayToken = await resolveSetupSecretInputString({
+				config: nextConfig,
+				value: quickstartTokenRef,
+				path: "gateway.auth.token",
+				env: process.env
+			});
+		} else {
+			const resolved = await promptSecretRefForSetup({
+				provider: "gateway-auth-token",
+				config: nextConfig,
+				prompter,
+				preferredEnvVar: "KAIJIBOT_GATEWAY_TOKEN",
+				copy: {
+					sourceMessage: "Where is this gateway token stored?",
+					envVarPlaceholder: "KAIJIBOT_GATEWAY_TOKEN"
+				}
+			});
+			gatewayTokenInput = resolved.ref;
+			gatewayToken = resolved.resolvedValue;
+		}
+		else if (flow === "quickstart") {
+			gatewayToken = (quickstartTokenString ?? normalizeGatewayTokenInput(process.env.KAIJIBOT_GATEWAY_TOKEN)) || randomToken();
+			gatewayTokenInput = gatewayToken;
+		} else {
+			gatewayToken = normalizeGatewayTokenInput(await prompter.text({
+				message: "Gateway token (blank to generate)",
+				placeholder: "Needed for multi-machine or non-loopback access",
+				initialValue: quickstartTokenString ?? normalizeGatewayTokenInput(process.env.KAIJIBOT_GATEWAY_TOKEN) ?? ""
+			})) || randomToken();
+			gatewayTokenInput = gatewayToken;
+		}
+	}
+	if (authMode === "password") {
+		let password = flow === "quickstart" && quickstartGateway.password ? quickstartGateway.password : void 0;
+		if (!password) if (await resolveSecretInputModeForEnvSelection({
+			prompter,
+			explicitMode: opts.secretInputMode,
+			copy: {
+				modeMessage: "How do you want to provide the gateway password?",
+				plaintextLabel: "Enter password now",
+				plaintextHint: "Stores the password directly in KaijiBot config"
+			}
+		}) === "ref") password = (await promptSecretRefForSetup({
+			provider: "gateway-auth-password",
+			config: nextConfig,
+			prompter,
+			preferredEnvVar: "KAIJIBOT_GATEWAY_PASSWORD",
+			copy: {
+				sourceMessage: "Where is this gateway password stored?",
+				envVarPlaceholder: "KAIJIBOT_GATEWAY_PASSWORD"
+			}
+		})).ref;
+		else password = String(await prompter.text({
+			message: "Gateway password",
+			validate: validateGatewayPasswordInput
+		}) ?? "").trim();
+		nextConfig = {
+			...nextConfig,
+			gateway: {
+				...nextConfig.gateway,
+				auth: {
+					...nextConfig.gateway?.auth,
+					mode: "password",
+					password
+				}
+			}
+		};
+	} else if (authMode === "token") nextConfig = {
+		...nextConfig,
+		gateway: {
+			...nextConfig.gateway,
+			auth: {
+				...nextConfig.gateway?.auth,
+				mode: "token",
+				token: gatewayTokenInput
+			}
+		}
+	};
+	nextConfig = {
+		...nextConfig,
+		gateway: {
+			...nextConfig.gateway,
+			port,
+			bind,
+			...bind === "custom" && customBindHost ? { customBindHost } : {},
+			tailscale: {
+				...nextConfig.gateway?.tailscale,
+				mode: tailscaleMode,
+				resetOnExit: tailscaleResetOnExit
+			}
+		}
+	};
+	if (flow === "quickstart" && bind === "loopback" && nextConfig.gateway?.controlUi?.allowInsecureAuth === void 0) nextConfig = {
+		...nextConfig,
+		gateway: {
+			...nextConfig.gateway,
+			controlUi: {
+				...nextConfig.gateway?.controlUi,
+				allowInsecureAuth: true
+			}
+		}
+	};
+	nextConfig = ensureControlUiAllowedOriginsForNonLoopbackBind(nextConfig, { requireControlUiEnabled: true }).config;
+	nextConfig = await maybeAddTailnetOriginToControlUiAllowedOrigins({
+		config: nextConfig,
+		tailscaleMode,
+		tailscaleBin
+	});
+	if (!quickstartGateway.hasExisting && nextConfig.gateway?.nodes?.denyCommands === void 0 && nextConfig.gateway?.nodes?.allowCommands === void 0 && nextConfig.gateway?.nodes?.browser === void 0) nextConfig = {
+		...nextConfig,
+		gateway: {
+			...nextConfig.gateway,
+			nodes: {
+				...nextConfig.gateway?.nodes,
+				denyCommands: [...DEFAULT_DANGEROUS_NODE_COMMANDS]
+			}
+		}
+	};
+	return {
+		nextConfig,
+		settings: {
+			port,
+			bind,
+			customBindHost: bind === "custom" ? customBindHost : void 0,
+			authMode,
+			gatewayToken,
+			tailscaleMode,
+			tailscaleResetOnExit
+		}
+	};
+}
+//#endregion
+export { configureGatewayForSetup };