localant 1.0.0

package/packages/gateway/dist/managers/skill-runtime.js

@@ -0,0 +1,310 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { SkillPermissionsSchema, } from "@localant/shared";
+import { execFileSafe } from "../util/exec.js";
+const RUNNER = fileURLToPath(new URL("../skill-runner.js", import.meta.url));
+/**
+ * Loads, validates, enables/disables, runs and generates local skills.
+ * Generated skills are always saved disabled.
+ */
+export class SkillRuntime {
+    paths;
+    secretResolver;
+    stateFile;
+    constructor(paths, secretResolver) {
+        this.paths = paths;
+        this.secretResolver = secretResolver;
+        this.stateFile = path.join(paths.root, "skills-state.json");
+    }
+    loadState() {
+        try {
+            return JSON.parse(fs.readFileSync(this.stateFile, "utf8"));
+        }
+        catch {
+            return { enabled: {} };
+        }
+    }
+    saveState(state) {
+        fs.writeFileSync(this.stateFile, JSON.stringify(state, null, 2), { mode: 0o600 });
+    }
+    /** Directories that may contain skills: the user skills dir + bundled examples. */
+    skillDirs() {
+        const dirs = [this.paths.skillsDir];
+        // bundled examples directory (when running from the repo / published package)
+        const bundled = fileURLToPath(new URL("../../../../examples/skills", import.meta.url));
+        if (fs.existsSync(bundled))
+            dirs.push(bundled);
+        return dirs;
+    }
+    list() {
+        const state = this.loadState();
+        const skills = [];
+        const seen = new Set();
+        for (const base of this.skillDirs()) {
+            if (!fs.existsSync(base))
+                continue;
+            for (const entry of fs.readdirSync(base, { withFileTypes: true })) {
+                if (!entry.isDirectory())
+                    continue;
+                const dir = path.join(base, entry.name);
+                const manifestPath = path.join(dir, "skill.json");
+                if (!fs.existsSync(manifestPath))
+                    continue;
+                const loaded = this.readManifest(manifestPath);
+                if (!loaded || seen.has(loaded.manifest.name))
+                    continue;
+                seen.add(loaded.manifest.name);
+                const generated = fs.existsSync(path.join(dir, ".generated"));
+                skills.push({
+                    manifest: loaded.manifest,
+                    dir,
+                    enabled: state.enabled[loaded.manifest.name] ?? false,
+                    generated,
+                    installedAt: this.installedAt(dir),
+                    valid: loaded.errors.length === 0,
+                    validationErrors: loaded.errors,
+                });
+            }
+        }
+        return skills.sort((a, b) => a.manifest.name.localeCompare(b.manifest.name));
+    }
+    get(name) {
+        return this.list().find((s) => s.manifest.name === name);
+    }
+    installedAt(dir) {
+        try {
+            return fs.statSync(dir).birthtime.toISOString();
+        }
+        catch {
+            return new Date().toISOString();
+        }
+    }
+    readManifest(manifestPath) {
+        let raw;
+        try {
+            raw = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+        }
+        catch {
+            return undefined;
+        }
+        const errors = [];
+        const obj = raw;
+        if (typeof obj.name !== "string")
+            errors.push("Missing 'name'.");
+        if (typeof obj.version !== "string")
+            errors.push("Missing 'version'.");
+        if (typeof obj.entry !== "string")
+            errors.push("Missing 'entry'.");
+        if (!Array.isArray(obj.tools) || obj.tools.length === 0)
+            errors.push("Must declare at least one tool.");
+        let permissions;
+        try {
+            permissions = SkillPermissionsSchema.parse(obj.permissions ?? {});
+        }
+        catch {
+            permissions = SkillPermissionsSchema.parse({});
+            errors.push("Invalid 'permissions' block.");
+        }
+        const manifest = {
+            name: String(obj.name ?? "unknown"),
+            displayName: obj.displayName,
+            version: String(obj.version ?? "0.0.0"),
+            description: String(obj.description ?? ""),
+            author: obj.author,
+            license: obj.license,
+            entry: String(obj.entry ?? "src/index.ts"),
+            riskLevel: (typeof obj.riskLevel === "number" ? obj.riskLevel : 1),
+            permissions,
+            tools: (Array.isArray(obj.tools) ? obj.tools : []),
+        };
+        return { manifest, errors };
+    }
+    validate(name) {
+        const skill = this.get(name);
+        if (!skill)
+            return { valid: false, errors: [`Skill not found: ${name}`] };
+        const errors = [...skill.validationErrors];
+        const entry = path.join(skill.dir, skill.manifest.entry);
+        if (!fs.existsSync(entry))
+            errors.push(`Entry file missing: ${skill.manifest.entry}`);
+        if (!fs.existsSync(path.join(skill.dir, "README.md")))
+            errors.push("Missing README.md");
+        return { valid: errors.length === 0, errors };
+    }
+    setEnabled(name, enabled) {
+        const skill = this.get(name);
+        if (!skill)
+            throw new Error(`Skill not found: ${name}`);
+        if (enabled) {
+            const v = this.validate(name);
+            if (!v.valid)
+                throw new Error(`Cannot enable invalid skill: ${v.errors.join("; ")}`);
+        }
+        const state = this.loadState();
+        state.enabled[name] = enabled;
+        this.saveState(state);
+        return { ...skill, enabled };
+    }
+    /** Execute a tool inside a skill in an isolated subprocess. */
+    async run(name, tool, input) {
+        const skill = this.get(name);
+        if (!skill)
+            throw new Error(`Skill not found: ${name}`);
+        if (!skill.enabled)
+            throw new Error(`Skill '${name}' is disabled. Enable it after reviewing permissions.`);
+        const toolDef = skill.manifest.tools.find((t) => t.name === tool);
+        if (!toolDef)
+            throw new Error(`Tool '${tool}' not found in skill '${name}'.`);
+        const secrets = this.secretResolver(skill.manifest.permissions.secrets);
+        const payload = JSON.stringify({
+            entry: path.join(skill.dir, skill.manifest.entry),
+            tool,
+            input,
+            secrets,
+            workspaceDir: this.paths.workspaceDir,
+        });
+        const res = await execFileSafe(process.execPath, [RUNNER], {
+            input: payload,
+            timeoutMs: 60_000,
+            maxOutputBytes: 200_000,
+            env: { ...process.env, NODE_OPTIONS: "" },
+        });
+        if (res.code !== 0) {
+            throw new Error(`Skill execution failed: ${res.stderr || res.stdout || "unknown error"}`.trim());
+        }
+        const line = res.stdout.trim().split("\n").pop() ?? "{}";
+        const parsed = JSON.parse(line);
+        if (!parsed.ok)
+            throw new Error(parsed.error ?? "Skill returned an error.");
+        return parsed.result;
+    }
+    /** Create a skill skeleton on disk (always disabled). */
+    generate(input) {
+        if (!/^[a-z0-9][a-z0-9-]*$/.test(input.name)) {
+            throw new Error(`Invalid skill name '${input.name}'. Use lowercase kebab-case.`);
+        }
+        const dir = path.join(this.paths.skillsDir, input.name);
+        if (fs.existsSync(dir))
+            throw new Error(`Skill '${input.name}' already exists.`);
+        fs.mkdirSync(path.join(dir, "src"), { recursive: true });
+        fs.mkdirSync(path.join(dir, "tests"), { recursive: true });
+        fs.mkdirSync(path.join(dir, "examples"), { recursive: true });
+        const permissions = SkillPermissionsSchema.parse(input.permissions ?? {});
+        const risk = (input.riskLevel ?? 1);
+        const toolName = `${input.name.replace(/-/g, "_")}_run`;
+        const manifest = {
+            name: input.name,
+            displayName: input.name,
+            version: "0.1.0",
+            description: input.description,
+            author: "local",
+            license: "MIT",
+            entry: "src/index.ts",
+            riskLevel: risk,
+            permissions,
+            tools: [
+                {
+                    name: toolName,
+                    description: input.description,
+                    riskLevel: risk,
+                    inputSchema: {
+                        type: "object",
+                        properties: { input: { type: "string" } },
+                        required: [],
+                    },
+                },
+            ],
+        };
+        fs.writeFileSync(path.join(dir, "skill.json"), JSON.stringify(manifest, null, 2));
+        fs.writeFileSync(path.join(dir, ".generated"), new Date().toISOString());
+        fs.writeFileSync(path.join(dir, "LICENSE"), "MIT\n");
+        fs.writeFileSync(path.join(dir, "CHANGELOG.md"), `# Changelog\n\n## 0.1.0\n- Generated skill skeleton.\n`);
+        fs.writeFileSync(path.join(dir, "README.md"), readmeTemplate(input.name, input.description, input.requirements ?? [], permissions, risk));
+        fs.writeFileSync(path.join(dir, "src", "index.ts"), skillSrcTemplate(input.name, toolName, input.requirements ?? []));
+        fs.writeFileSync(path.join(dir, "tests", "index.test.ts"), skillTestTemplate(input.name, toolName));
+        fs.writeFileSync(path.join(dir, "examples", "example.json"), JSON.stringify({ input: "hello" }, null, 2));
+        const state = this.get(input.name);
+        if (!state)
+            throw new Error("Generated skill could not be loaded.");
+        return state;
+    }
+    uninstall(name) {
+        const skill = this.get(name);
+        if (!skill)
+            return false;
+        if (!skill.dir.startsWith(this.paths.skillsDir)) {
+            throw new Error("Refusing to uninstall a bundled skill.");
+        }
+        fs.rmSync(skill.dir, { recursive: true, force: true });
+        const state = this.loadState();
+        delete state.enabled[name];
+        this.saveState(state);
+        return true;
+    }
+}
+function readmeTemplate(name, description, requirements, perms, risk) {
+    return `# ${name}
+
+${description}
+
+> ⚠️ This skill was generated and is **disabled by default**. Review the permissions below, run \`skill_validate\`, then enable it from the dashboard or CLI.
+
+## Requirements
+${requirements.map((r) => `- ${r}`).join("\n") || "- (none specified)"}
+
+## Permissions
+- filesystem: ${perms.filesystem.mode}
+- shell: ${perms.shell.mode}
+- network: ${perms.network.mode}${perms.network.allowedHosts.length ? ` (${perms.network.allowedHosts.join(", ")})` : ""}
+- secrets: ${perms.secrets.join(", ") || "none"}
+- risk level: ${risk}
+
+## Usage
+Call the tool \`${name.replace(/-/g, "_")}_run\` from ChatGPT once enabled.
+`;
+}
+function skillSrcTemplate(name, toolName, requirements) {
+    return `import { defineSkill, z } from "@localant/skill-sdk";
+
+// Requirements:
+${requirements.map((r) => `// - ${r}`).join("\n") || "// - implement me"}
+
+export default defineSkill({
+  name: "${name}",
+  tools: {
+    ${toolName}: {
+      description: "TODO: describe what this tool does",
+      riskLevel: 1,
+      inputSchema: z.object({
+        input: z.string().optional(),
+      }),
+      handler: async ({ input }, ctx) => {
+        ctx.log("running ${name}");
+        // TODO: implement. Use ctx.getSecret(name) for any declared secrets.
+        return { content: \`${name} received: \${input ?? ""}\` };
+      },
+    },
+  },
+});
+`;
+}
+function skillTestTemplate(name, toolName) {
+    return `import { describe, it, expect } from "vitest";
+import skill from "../src/index";
+
+describe("${name}", () => {
+  it("declares its tool", () => {
+    expect(skill.name).toBe("${name}");
+    expect(skill.tools.${toolName}).toBeDefined();
+  });
+
+  it("runs", async () => {
+    const ctx = { getSecret: async () => undefined, workspaceDir: ".", log: () => {} };
+    const out = await skill.tools.${toolName}.handler({ input: "x" } as any, ctx);
+    expect(out).toBeTruthy();
+  });
+});
+`;
+}
+//# sourceMappingURL=skill-runtime.js.map

package/packages/gateway/dist/managers/skill-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-runtime.js","sourceRoot":"","sources":["../../src/managers/skill-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,sBAAsB,GAKvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAM7E;;;GAGG;AACH,MAAM,OAAO,YAAY;IAIJ;IACA;IAJF,SAAS,CAAS;IAEnC,YACmB,KAAe,EACf,cAA2D;QAD3D,UAAK,GAAL,KAAK,CAAU;QACf,mBAAc,GAAd,cAAc,CAA6C;QAE5E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IAEO,SAAS;QACf,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAmB,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IACO,SAAS,CAAC,KAAqB;QACrC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,mFAAmF;IAC3E,SAAS;QACf,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,8EAA8E;QAC9E,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvF,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;oBAAE,SAAS;gBACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACxC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;oBAAE,SAAS;gBAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC/C,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACxD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC/B,MAAM,SAAS,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;gBAC9D,MAAM,CAAC,IAAI,CAAC;oBACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,GAAG;oBACH,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK;oBACrD,SAAS;oBACT,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;oBAClC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;oBACjC,gBAAgB,EAAE,MAAM,CAAC,MAAM;iBAChC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC3D,CAAC;IAEO,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,YAAoB;QACvC,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,GAA8B,CAAC;QAC3C,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjE,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACvE,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACxG,IAAI,WAAW,CAAC;QAChB,IAAI,CAAC;YACH,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,QAAQ,GAAkB;YAC9B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC;YACnC,WAAW,EAAE,GAAG,CAAC,WAAiC;YAClD,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;YACvC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YAC1C,MAAM,EAAE,GAAG,CAAC,MAA4B;YACxC,OAAO,EAAE,GAAG,CAAC,OAA6B;YAC1C,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,cAAc,CAAC;YAC1C,SAAS,EAAE,CAAC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAc;YAC/E,WAAW;YACX,KAAK,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAA2B;SAC7E,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1E,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACxF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IAED,UAAU,CAAC,IAAY,EAAE,OAAgB;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,KAAc;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,uDAAuD,CAAC,CAAC;QAC3G,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,yBAAyB,IAAI,IAAI,CAAC,CAAC;QAE9E,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjD,IAAI;YACJ,KAAK;YACL,OAAO;YACP,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY;SACtC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE;YACzD,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,MAAM;YACjB,cAAc,EAAE,OAAO;YACvB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE;SAC1C,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsD,CAAC;QACrF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,0BAA0B,CAAC,CAAC;QAC5E,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,yDAAyD;IACzD,QAAQ,CAAC,KAOR;QACC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,CAAC,IAAI,8BAA8B,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,IAAI,mBAAmB,CAAC,CAAC;QACjF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE9D,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAc,CAAC;QACjD,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC;QACxD,MAAM,QAAQ,GAAkB;YAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,IAAI;YACvB,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,cAAc;YACrB,SAAS,EAAE,IAAI;YACf,WAAW;YACX,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE;wBACX,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;wBACzC,QAAQ,EAAE,EAAE;qBACb;iBACF;aACF;SACF,CAAC;QAEF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAClF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACzE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;QACrD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,wDAAwD,CAAC,CAAC;QAC3G,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAC3B,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAC3F,CAAC;QACF,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;QACtH,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAE1G,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,CAAC,IAAY;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,cAAc,CACrB,IAAY,EACZ,WAAmB,EACnB,YAAsB,EACtB,KAAmC,EACnC,IAAe;IAEf,OAAO,KAAK,IAAI;;EAEhB,WAAW;;;;;EAKX,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,oBAAoB;;;gBAGtD,KAAK,CAAC,UAAU,CAAC,IAAI;WAC1B,KAAK,CAAC,KAAK,CAAC,IAAI;aACd,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;aAC3G,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM;gBAC/B,IAAI;;;kBAGF,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;CACxC,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,QAAgB,EAAE,YAAsB;IAC9E,OAAO;;;EAGP,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB;;;WAG7D,IAAI;;MAET,QAAQ;;;;;;;2BAOa,IAAI;;8BAED,IAAI;;;;;CAKjC,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,OAAO;;;YAGG,IAAI;;+BAEe,IAAI;yBACV,QAAQ;;;;;oCAKG,QAAQ;;;;CAI3C,CAAC;AACF,CAAC"}

package/packages/gateway/dist/managers/tunnel-manager.d.ts

@@ -0,0 +1,23 @@
+import { type Config } from "@localant/shared";
+export interface TunnelInfo {
+    provider: string;
+    url?: string;
+    status: "starting" | "running" | "stopped" | "error";
+    error?: string;
+}
+/**
+ * Starts a public tunnel to the local gateway so ChatGPT can reach /mcp.
+ * Order of preference: cloudflared → ngrok → user-provided publicUrl.
+ */
+export declare class TunnelManager {
+    private readonly config;
+    private child?;
+    private info;
+    constructor(config: () => Config);
+    current(): TunnelInfo;
+    start(port: number): Promise<TunnelInfo>;
+    private startCloudflared;
+    private startNgrok;
+    stop(): void;
+}
+//# sourceMappingURL=tunnel-manager.d.ts.map

package/packages/gateway/dist/managers/tunnel-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel-manager.d.ts","sourceRoot":"","sources":["../../src/managers/tunnel-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAK7D,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,qBAAa,aAAa;IAIZ,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,OAAO,CAAC,KAAK,CAAC,CAAe;IAC7B,OAAO,CAAC,IAAI,CAAuD;gBAEtC,MAAM,EAAE,MAAM,MAAM;IAEjD,OAAO,IAAI,UAAU;IAIf,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAyB9C,OAAO,CAAC,gBAAgB;IA4BxB,OAAO,CAAC,UAAU;IA4BlB,IAAI,IAAI,IAAI;CAQb"}

package/packages/gateway/dist/managers/tunnel-manager.js

@@ -0,0 +1,106 @@
+import { spawn } from "node:child_process";
+import { createLogger } from "@localant/shared";
+import { commandExists } from "../util/exec.js";
+const log = createLogger("tunnel");
+/**
+ * Starts a public tunnel to the local gateway so ChatGPT can reach /mcp.
+ * Order of preference: cloudflared → ngrok → user-provided publicUrl.
+ */
+export class TunnelManager {
+    config;
+    child;
+    info = { provider: "none", status: "stopped" };
+    constructor(config) {
+        this.config = config;
+    }
+    current() {
+        return this.info;
+    }
+    async start(port) {
+        const cfg = this.config().tunnel;
+        if (cfg.publicUrl) {
+            this.info = { provider: "user-provided", url: cfg.publicUrl, status: "running" };
+            return this.info;
+        }
+        if (cfg.provider === "cloudflared" && (await commandExists("cloudflared"))) {
+            return this.startCloudflared(port);
+        }
+        if (cfg.provider === "ngrok" && (await commandExists("ngrok"))) {
+            return this.startNgrok(port);
+        }
+        // Fallbacks
+        if (await commandExists("cloudflared"))
+            return this.startCloudflared(port);
+        if (await commandExists("ngrok"))
+            return this.startNgrok(port);
+        this.info = {
+            provider: "none",
+            status: "error",
+            error: "No tunnel provider found. Install cloudflared or ngrok, or set tunnel.publicUrl in config to a public HTTPS URL.",
+        };
+        return this.info;
+    }
+    startCloudflared(port) {
+        return new Promise((resolve) => {
+            this.info = { provider: "cloudflared", status: "starting" };
+            const child = spawn("cloudflared", ["tunnel", "--url", `http://127.0.0.1:${port}`], { shell: false });
+            this.child = child;
+            const onData = (buf) => {
+                const text = buf.toString("utf8");
+                const m = text.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/i);
+                if (m && this.info.status !== "running") {
+                    this.info = { provider: "cloudflared", url: m[0], status: "running" };
+                    resolve(this.info);
+                }
+            };
+            child.stdout.on("data", onData);
+            child.stderr.on("data", onData);
+            child.on("error", (e) => {
+                this.info = { provider: "cloudflared", status: "error", error: e.message };
+                resolve(this.info);
+            });
+            setTimeout(() => {
+                if (this.info.status !== "running") {
+                    this.info = { provider: "cloudflared", status: "error", error: "Timed out waiting for tunnel URL." };
+                    resolve(this.info);
+                }
+            }, 20_000);
+        });
+    }
+    startNgrok(port) {
+        return new Promise((resolve) => {
+            this.info = { provider: "ngrok", status: "starting" };
+            const child = spawn("ngrok", ["http", String(port), "--log", "stdout"], { shell: false });
+            this.child = child;
+            const onData = (buf) => {
+                const text = buf.toString("utf8");
+                const m = text.match(/https:\/\/[a-z0-9-]+\.ngrok[a-z0-9.-]*\.(app|io)/i);
+                if (m && this.info.status !== "running") {
+                    this.info = { provider: "ngrok", url: m[0], status: "running" };
+                    resolve(this.info);
+                }
+            };
+            child.stdout.on("data", onData);
+            child.stderr.on("data", onData);
+            child.on("error", (e) => {
+                this.info = { provider: "ngrok", status: "error", error: e.message };
+                resolve(this.info);
+            });
+            setTimeout(() => {
+                if (this.info.status !== "running") {
+                    this.info = { provider: "ngrok", status: "error", error: "Timed out waiting for ngrok URL." };
+                    resolve(this.info);
+                }
+            }, 20_000);
+        });
+    }
+    stop() {
+        if (this.child) {
+            log.info("stopping tunnel");
+            this.child.kill("SIGTERM");
+            this.child = undefined;
+        }
+        this.info = { provider: this.info.provider, status: "stopped" };
+    }
+}
+//# sourceMappingURL=tunnel-manager.js.map

package/packages/gateway/dist/managers/tunnel-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel-manager.js","sourceRoot":"","sources":["../../src/managers/tunnel-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAe,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AASnC;;;GAGG;AACH,MAAM,OAAO,aAAa;IAIK;IAHrB,KAAK,CAAgB;IACrB,IAAI,GAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAEnE,YAA6B,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAErD,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;QACjC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,CAAC,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,YAAY;QACZ,IAAI,MAAM,aAAa,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,MAAM,aAAa,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE/D,IAAI,CAAC,IAAI,GAAG;YACV,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,OAAO;YACf,KAAK,EACH,kHAAkH;SACrH,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEO,gBAAgB,CAAC,IAAY;QACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,oBAAoB,IAAI,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACtG,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACnB,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;gBAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAClC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAClE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACxC,IAAI,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;oBACtE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC,CAAC;YACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACtB,IAAI,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC3E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACnC,IAAI,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;oBACrG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC,EAAE,MAAM,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,UAAU,CAAC,IAAY;QAC7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACnB,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;gBAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAClC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBAC1E,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACxC,IAAI,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;oBAChE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC,CAAC;YACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACtB,IAAI,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACnC,IAAI,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;oBAC9F,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC,EAAE,MAAM,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;CACF"}

package/packages/gateway/dist/registry.d.ts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+import type { RiskLevel } from "@localant/shared";
+/**
+ * A tool is generic over its Zod input schema `S`. Handlers receive the
+ * *output* type (`z.output<S>`), so `.default(...)` fields are non-optional.
+ */
+export interface ToolDefinition<S extends z.ZodTypeAny = z.ZodTypeAny> {
+    name: string;
+    description: string;
+    risk: RiskLevel;
+    inputSchema: S;
+    /** Short human summary of an invocation, used for audit + approval prompts. */
+    summarize?: (input: z.output<S>) => string;
+    handler: (input: z.output<S>, ctx: ToolCallContext) => Promise<unknown> | unknown;
+}
+export interface ToolCallContext {
+    caller: string;
+    sessionId?: string;
+}
+/** In-memory registry of all tools the gateway exposes. */
+export declare class ToolRegistry {
+    private readonly tools;
+    register<S extends z.ZodTypeAny>(def: ToolDefinition<S>): void;
+    unregister(name: string): void;
+    get(name: string): ToolDefinition | undefined;
+    list(): ToolDefinition[];
+}
+//# sourceMappingURL=registry.d.ts.map

package/packages/gateway/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;GAGG;AACH,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,WAAW,EAAE,CAAC,CAAC;IACf,+EAA+E;IAC/E,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACnF;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2DAA2D;AAC3D,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAE3D,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI;IAO9D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI9B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C,IAAI,IAAI,cAAc,EAAE;CAGzB"}

package/packages/gateway/dist/registry.js

@@ -0,0 +1,20 @@
+/** In-memory registry of all tools the gateway exposes. */
+export class ToolRegistry {
+    tools = new Map();
+    register(def) {
+        if (this.tools.has(def.name)) {
+            throw new Error(`Duplicate tool registration: ${def.name}`);
+        }
+        this.tools.set(def.name, def);
+    }
+    unregister(name) {
+        this.tools.delete(name);
+    }
+    get(name) {
+        return this.tools.get(name);
+    }
+    list() {
+        return [...this.tools.values()].sort((a, b) => a.name.localeCompare(b.name));
+    }
+}
+//# sourceMappingURL=registry.js.map

package/packages/gateway/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAsBA,2DAA2D;AAC3D,MAAM,OAAO,YAAY;IACN,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE3D,QAAQ,CAAyB,GAAsB;QACrD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAgC,CAAC,CAAC;IAC7D,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,CAAC;CACF"}

package/packages/gateway/dist/security/command-guard.d.ts

@@ -0,0 +1,35 @@
+export declare class CommandRejectedError extends Error {
+    constructor(message: string);
+}
+export interface ParsedCommand {
+    /** Whitespace-normalized full command. */
+    normalized: string;
+    /** Individual program words (first token of each pipeline/segment + args). */
+    tokens: string[];
+}
+/**
+ * Tokenize a command for safety inspection. We split on shell control
+ * operators so that `a && rm -rf /` is inspected as two segments, defeating
+ * naive "starts with allowed command" bypasses.
+ */
+export declare function parseCommand(input: string): ParsedCommand;
+export declare class CommandGuard {
+    private allowedCommands;
+    private blockedTokens;
+    constructor(allowedCommands: string[], blockedTokens: string[]);
+    setAllowed(commands: string[]): void;
+    setBlocked(tokens: string[]): void;
+    allowed(): string[];
+    /**
+     * Validate a command against the allowlist and blocklist. Throws on any
+     * rejection. Returns the normalized command on success.
+     *
+     * A command is allowed only if its normalized form *starts with* one of the
+     * allowlisted command prefixes AND contains no blocked tokens, no dangerous
+     * chaining/substitution metacharacters, and no piped second program.
+     */
+    assertAllowed(input: string): string;
+    /** Looser check for an *approved* arbitrary command — still blocks the hard blocklist. */
+    assertNotBlocked(input: string): string;
+}
+//# sourceMappingURL=command-guard.d.ts.map

package/packages/gateway/dist/security/command-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-guard.d.ts","sourceRoot":"","sources":["../../src/security/command-guard.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAWzD;AAQD,qBAAa,YAAY;IAErB,OAAO,CAAC,eAAe;IACvB,OAAO,CAAC,aAAa;gBADb,eAAe,EAAE,MAAM,EAAE,EACzB,aAAa,EAAE,MAAM,EAAE;IAGjC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI;IAGpC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI;IAGlC,OAAO,IAAI,MAAM,EAAE;IAInB;;;;;;;OAOG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IA0CpC,0FAA0F;IAC1F,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CAaxC"}