openrod 0.0.0 → 0.1.0

package/server/setup-deployment.js

@@ -0,0 +1,299 @@
+import { SETUP_TARGETS, validateSetupTargets } from '../shared/setup-targets.js'
+import { setupPython } from './setup-python.js'
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { randomUUID } from 'node:crypto'
+import { gateway, sandboxView, contextKey, contextSelection, runWithContext, workspaceName } from './gateway.js'
+import { getSetupStore, resolveSetups, usableSetup, SETUP_ID } from './setups.js'
+import { fail, hash } from './setup-discovery.js'
+import { hostMatches } from '../src/lib/egress.js'
+import { readOrg, blockedBy, orgRoute, managedOpsFor, serializeOrgWrite, syncAll } from './org.js'
+import { listPolicies, blockedByPolicy, compileFor } from './egress.js'
+import { readSetupMembers, sandboxSetups, addSandboxSetups, removeSandboxSetups } from './setup-members.js'
+import { setupPolicyFor } from './setup-egress.js'
+
+import { withSandboxInput } from './setup-transfer.js'
+import { installArtifacts } from './setup-artifacts.js'
+const verifier = await fs.readFile(path.join(import.meta.dirname, 'setup-verifier.cjs'), 'utf8')
+const installer = setupPython('./setup-installer.py')
+const COMMAND = Object.fromEntries(SETUP_TARGETS.map(agent => [agent.id, agent.command]))
+const stateKey = Symbol.for('openshell.console.setup-deployments.v2')
+const contexts = globalThis[stateKey] ??= new Map()
+function deploymentState() {
+  const key = contextKey()
+  if (!contexts.has(key)) contexts.set(key, { previews: new Map(), jobs: new Map(), locks: new Set() })
+  return contexts.get(key)
+}
+const keyFor = (sandbox, id) => `${sandbox.name}:${id}`
+export const setupJobsForSandbox = (name, createdAt) => [...deploymentState().jobs.values()].filter(job => job.sandbox === name && (!createdAt || job.at >= createdAt))
+// Protobuf maps have no ordering guarantee. Preserve array order and every
+// value, but never treat a different object-key order as a permission change.
+export function setupAccessIdentity(value) {
+  const canonical = value => Array.isArray(value) ? value.map(canonical)
+    : value && typeof value === 'object' ? Object.fromEntries(Object.keys(value).sort().map(key => [key, canonical(value[key])])) : value
+  return hash(JSON.stringify(canonical(value)))
+}
+export function launchSetupAccess(setups, recipe, review, includeTemplateAccess = false) {
+  const approved = {}
+  for (const setup of setups) {
+    const inherited = recipe?.setups?.includes(setup.id)
+    const pinned = inherited && recipe.setupRevisions?.[setup.id]
+    if (inherited && pinned !== setup.revision) throw fail('A Setup baked into this template changed. Rebuild the image template before launching its new revision.')
+    if (review && review[setup.id] !== setup.revision) throw fail('A selected Setup changed. Review its runtime access again.')
+    // Choosing a template includes its pinned tools and their scoped runtime
+    // requirements. Additional tools still require their own reviewed revision.
+    if ((inherited && includeTemplateAccess) || review?.[setup.id] === setup.revision) approved[setup.id] = setup.revision
+  }
+  return approved
+}
+const narrow = (endpoint) => endpoint.tls === 1 || endpoint.allowedIps?.length || endpoint.denyRules?.length || endpoint.rules?.length || (endpoint.path && endpoint.path !== '/' && endpoint.path !== '/**')
+
+// This is deliberately a conservative policy preflight, not a reachability or
+// MCP tool test. A hostname match on its own must never mean "Ready".
+export function assessNetwork(requirement, policy, binaries, restrictions = []) {
+  if (!binaries.length) return { status: 'missing', reason: 'Target agent executable is missing.' }
+  if (restrictions.some((host) => hostMatches(host, requirement.host))) return { status: 'blocked', reason: 'Blocked by organization or scoped Egress policy.' }
+  const matches = Object.values(policy?.networkPolicies ?? {}).flatMap((rule) => (rule.endpoints ?? []).filter((e) => hostMatches(e.host, requirement.host) && (e.ports?.length ? e.ports : [e.port]).includes(requirement.port)).map((endpoint) => ({ endpoint, binaries: (rule.binaries ?? []).map((b) => b.path) })))
+  if (matches.some(({ endpoint }) => endpoint.denyRules?.length)) return { status: 'review', reason: 'A matching deny rule needs review in Egress.' }
+  const permitted = matches.find(({ endpoint: e, binaries: programs }) => binaries.every((binary) => programs.includes('/**') || programs.includes(binary)) && !narrow(e) && (!e.protocol || e.protocol === 'tcp' || (e.protocol === 'rest' && e.enforcement === 1 && [2, 3].includes(e.access))))
+  if (permitted) return { status: 'allowed', reason: 'Existing connection access matches. MCP tool access and sign-in are not verified.' }
+  if (matches.length) return { status: 'review', reason: 'Matching access is restricted by program, path, IP or protocol. Review the effective policy.' }
+  return { status: 'missing', reason: 'No matching runtime access. Add an approved, scoped rule in Egress, then check again.' }
+}
+
+// A Setup's egress policy also covers Quick-setup snapshots prepared from it.
+const memberIds = (setup) => [setup.id, setup.preparedFrom?.id].filter(Boolean)
+// The Setup's egress policy, when it will let these callers reach the
+// requirement once the sandbox joins it, on top of the sandbox's current rules.
+export function setupPolicyCoverage(requirement, setup, policies, callers = ['/**'], current = null) {
+  const policy = setupPolicyFor(policies, setup, requirement)
+  return policy && assessNetwork(requirement, { networkPolicies: { ...current?.networkPolicies, ...compileFor({ name: '', groups: [], setups: memberIds(setup) }, [policy]) } }, callers).status === 'allowed' ? policy : null
+}
+
+export async function executeInstaller(client, sandbox, setup, targets, operation) {
+  sandbox = { ...sandbox, workspace: sandbox.workspace || workspaceName() }
+  // A probe reads only names and launchers, so skill files (up to 64 MB) stay behind.
+  const data = Buffer.from(JSON.stringify({ setup: operation === 'probe' ? { ...setup, items: setup.items.map(({ files, ...item }) => item) } : setup, targets, operation }))
+  const result = await withSandboxInput(client, sandbox, data, file => client.sandbox.exec(sandbox.name, ['python3', '-c', `import sys;sys.stdin=open(sys.argv[1], 'r');\n${installer}`, file], { workspace: sandbox.workspace, noLoginShell: true, timeoutSecs: 60, signal: AbortSignal.timeout(65_000) }))
+  let output
+  try { output = JSON.parse(result.stdout.toString()) } catch { throw fail('The sandbox needs Python 3.11 or later and writable agent configuration folders.', 409) }
+  if (result.exitCode !== 0 || output.error) throw fail(output.error || 'Setup operation failed.', 409)
+  return output
+}
+function validateTargets(targets) { try { validateSetupTargets(targets) } catch (error) { throw fail(error.message) } }
+export function accessPolicyIdentity(policy) {
+  // Attaching an endpointless credential profile adds an inert provider rule.
+  // Ignore only those empty rules; every actual permission stays in the hash.
+  return { ...policy, networkPolicies: Object.fromEntries(Object.entries(policy?.networkPolicies || {}).filter(([name, rule]) => !(name.startsWith('_provider_') && !rule.endpoints?.length && !rule.binaries?.length))) }
+}
+function assertSandboxIdentity(sandbox, endpoint, expected) {
+  if (expected && (sandbox.id !== expected.id || endpoint !== expected.gateway)) throw fail('Sandbox was replaced or its gateway changed. Review the Setup for the new sandbox.', 409)
+}
+async function assertCurrentSandbox(plan) {
+  const expected = { id: plan.sandbox.id, gateway: plan.gateway }
+  const { target } = await gateway()
+  assertSandboxIdentity(plan.sandbox, target.endpoint, expected)
+  const current = sandboxView((await plan.client.raw.getSandbox({ name: plan.sandbox.name, workspaceScope: plan.workspaceScope })).sandbox)
+  assertSandboxIdentity(current, target.endpoint, expected)
+}
+async function inspectTarget(name, id, targets, expected) {
+  validateTargets(targets)
+  const snapshot = await getSetupStore().get(id)
+  const setup = usableSetup(snapshot)
+  const inactive = snapshot.items.filter(i => !setup.items.some(a => a.id === i.id)).map(i => ({ name: i.name, issues: i.issues }))
+  const { client, target, workspace, workspaceScope } = await gateway()
+  const sandbox = { ...sandboxView((await client.raw.getSandbox({ name, workspaceScope })).sandbox), workspace }
+  assertSandboxIdentity(sandbox, target.endpoint, expected)
+  if (sandbox.phase !== 'ready') throw fail('Start the sandbox before enabling or removing a Setup.', 409)
+  const [config, org, scoped, fleet, status] = await Promise.all([client.raw.getSandboxConfig({ name, workspaceScope }), readOrg(), listPolicies(), orgRoute('GET', ['org']), client.raw.getSandboxPolicyStatus({ sandbox: name, workspaceScope })])
+  const problems = setup.items.length ? [] : ['This Setup has no prepared items. Open Prepare setup to resolve requirements.']
+  if (config.configurationAdmitted === false || (!status.revision || status.revision.status !== 2 || status.activeVersion !== status.revision.version)) problems.push('The effective sandbox policy has not loaded successfully. Resolve it before enabling a Setup.')
+  let probe = null
+  try { probe = await executeInstaller(client, sandbox, setup, targets, 'probe') } catch (e) { problems.push(e.message) }
+  if (probe?.installed && JSON.stringify([...probe.targets].sort()) !== JSON.stringify([...targets].sort())) problems.push(`This Setup is assigned to ${probe.targets.join(', ')}. Select those agents to reapply or remove it.`)
+  const binaries = targets.map((t) => probe?.networkExecutables?.[COMMAND[t]] || 'unverified-script-caller')
+  if (probe) for (const [command, found] of Object.entries(probe.executables)) if (!found) problems.push(`${command} is missing. Rebuild the image with this executable installed.`)
+  if (setup.items.some(i => i.config?.url) && binaries.includes('unverified-script-caller')) problems.push('A selected harness has an unrecognized network launcher. Use a supported native or Node.js harness image.')
+  const member = { name, groups: fleet.assignments?.[name] ?? [], setups: [...(fleet.setupMembers?.[name] ?? []), ...memberIds(setup)] }
+  const grants = []
+  const network = setup.items.flatMap((item) => item.requirements.filter((r) => ['runtime', 'auth'].includes(r.phase)).map((requirement, index) => {
+    const callers = requirement.phase === 'auth' ? [...new Set(binaries.filter(b => b !== 'unverified-script-caller'))] : item.config?.command ? [probe?.networkExecutables?.[item.config.command]].filter(Boolean) : [...new Set([...binaries.filter(b => b !== 'unverified-script-caller'), probe?.networkExecutables?.node].filter(Boolean))]
+    const blocked = blockedBy(org, [requirement.host]) || blockedByPolicy(scoped, member, [requirement.host], hostMatches)
+    let assessment = assessNetwork(requirement, config.policy, callers, blocked ? [requirement.host] : [])
+    const ruleName = `setup-${setup.id.slice(0, 8)}-${item.id.slice(0, 8)}-${index}`
+    const path = requirement.phase === 'runtime' && item.config?.url && new URL(item.config.url).hostname === requirement.host ? new URL(item.config.url).pathname : requirement.phase === 'auth' ? requirement.path : undefined
+    const provider = requirement.phase === 'runtime' ? item.credentialRef?.provider : undefined
+    const endpoint = { host: requirement.host, port: requirement.port, protocol: 'rest', enforcement: 1, access: 2, ...(path ? { path } : {}), ...(provider ? { credentialBinding: { provider } } : {}) }
+    const own = config.policy?.networkPolicies?.[ruleName]
+    if (own && !blocked && callers.length && own.binaries?.length === callers.length && callers.every(p => own.binaries.some(b => b.path === p)) && own.endpoints?.length === 1) {
+      const e = own.endpoints[0]
+      if (e.host === endpoint.host && e.port === endpoint.port && e.protocol === 'rest' && e.enforcement === 1 && e.access === 2 && (e.path || '') === (path || '') && !e.denyRules?.length && !e.rules?.length && !e.allowedIps?.length && (e.credentialBinding?.provider || '') === (provider || '')) assessment = { status: 'allowed', reason: 'Reviewed Setup access is active.' }
+    }
+    // The Setup's own egress policy opens this once the sandbox joins it; credentials still need a reviewed grant.
+    const covered = !blocked && !provider && assessment.status !== 'allowed' && setupPolicyCoverage(requirement, setup, scoped, callers, config.policy)
+    if (covered) assessment = { status: 'policy', reason: `Allowed by the egress policy “${covered.name}”.` }
+    else if (!blocked && config.policySource !== 2 && callers.length && (assessment.status === 'missing' || (assessment.status === 'allowed' && provider && !own))) {
+      if (own) assessment = { status: 'review', reason: 'Managed access changed. Review this rule in Egress before replacing it.' }
+      else {
+        grants.push({ ruleName, rule: { name: ruleName, binaries: callers.map(path => ({ path })), endpoints: [endpoint] } })
+        assessment = { status: 'proposed', reason: 'Approve this destination for the listed executable. Other destinations remain governed by existing policy.' }
+      }
+    }
+    if (config.policySource === 2 && assessment.status !== 'allowed') assessment = { status: 'blocked', reason: 'Gateway global policy is authoritative. An administrator must update it.' }
+    if (!callers.length) assessment = { status: 'review', reason: 'The actual network executable could not be established for this tool.' }
+    return { ...requirement, item: item.name, binaries: callers, credentialProvider: provider, ...assessment }
+  }))
+  const identity = setupAccessIdentity({ gateway: target.endpoint, workspace, id: sandbox.id, createdAt: sandbox.createdAt, policy: accessPolicyIdentity(config.policy), org, scoped, group: member.group, revision: setup.revision, targets, executables: probe?.networkExecutables, grants })
+  return { client, gateway: target.endpoint, workspaceScope, sandbox, setup, targets, problems, network, grants, inactive, identity, installed: probe?.installed ?? false }
+}
+const ENABLEABLE = ['allowed', 'proposed', 'policy']
+function planView(plan) {
+  const notes = [
+    ...(plan.network.some((r) => r.status === 'policy') ? ['Websites allowed by the setup’s egress policy open to any program in this sandbox.'] : []),
+    ...(plan.grants.length ? ['Websites you approve here open only to the listed program.'] : []),
+    ...(plan.setup.items.some((i) => i.kind === 'skill') ? ['Skills use the sandbox’s existing network access.'] : []),
+  ]
+  return { name: plan.setup.name, sandbox: plan.sandbox.name, revision: plan.setup.revision, targets: plan.targets, problems: plan.problems, network: plan.network, inactive: plan.inactive, requiresApproval: plan.grants.length > 0, installed: plan.installed, canEnable: !plan.problems.length && plan.network.every((r) => ENABLEABLE.includes(r.status)), notes }
+}
+export async function deploymentRoute(method, parts, input, options = {}) {
+  return runWithContext(contextSelection(), () => runDeploymentRoute(method, parts, input, options))
+}
+async function runDeploymentRoute(method, parts, input, { expectedSandbox } = {}) {
+  const state = deploymentState()
+  if (parts[0] !== 'setups' || parts.length !== 3 || !SETUP_ID.test(parts[1])) return undefined
+  const [, id, action] = parts
+  if (method === 'GET' && action === 'jobs') return [...new Map([...state.jobs.values()].filter((j) => j.setup === id).map((j) => [j.sandbox, j])).values()]
+  if (method !== 'POST') return undefined
+  const name = String(input.sandbox ?? '')
+  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(name)) throw fail('Choose a sandbox.')
+  if (action === 'preview') {
+    for (const [key, p] of state.previews) if (p.expires < Date.now()) state.previews.delete(key)
+    if (state.previews.size >= 100) throw fail('Too many previews. Wait for old previews to expire.', 429)
+    const plan = await inspectTarget(name, id, input.targets, expectedSandbox)
+    const pinnedSandbox = { id: plan.sandbox.id, gateway: plan.gateway }
+    const token = randomUUID(); state.previews.set(token, { id, name, targets: input.targets, expectedSandbox: pinnedSandbox, identity: plan.identity, expires: Date.now() + 5 * 60_000 })
+    return { ...planView(plan), token }
+  }
+  if (action === 'enable' || action === 'remove') {
+    const preview = state.previews.get(input.token)
+    if (!preview || preview.expires < Date.now() || preview.id !== id || preview.name !== name) throw fail('Preview expired. Check the sandbox again.', 409)
+    const lock = name
+    if (state.locks.has(lock)) throw fail('Another Setup operation is running for this sandbox.', 409)
+    state.locks.add(lock)
+    try {
+      const [plan, members] = await Promise.all([inspectTarget(name, id, preview.targets, preview.expectedSandbox || expectedSandbox), readSetupMembers()])
+      if (preview.identity !== plan.identity) throw fail('The sandbox or its policy changed. Review a fresh preview.', 409)
+      if (action === 'enable' && !planView(plan).canEnable) throw fail('Resolve the missing requirements before enabling.', 409)
+      if (action === 'enable' && plan.grants.length && input.approveAccess !== true) throw fail('Approve the listed runtime access before enabling.', 409)
+      if (action === 'enable') { await assertCurrentSandbox(plan); await installArtifacts(plan.client, plan.sandbox, plan.setup.items) }
+      const joined = memberIds(plan.setup).filter((setupId) => !sandboxSetups(members, plan.sandbox, plan.gateway).includes(setupId))
+      let result
+      try {
+        if (action === 'enable') await activateAccess(plan)
+        await assertCurrentSandbox(plan)
+        result = await executeInstaller(plan.client, plan.sandbox, plan.setup, preview.targets, action === 'enable' ? 'apply' : 'remove')
+      } catch (e) {
+        // A failed enable takes the sandbox back out of the Setup policies it had just joined.
+        if (action === 'enable' && joined.length) await leaveSetup(plan, joined)
+        throw e
+      }
+      if (action === 'enable') result.checks = await verifySetup(plan)
+      else await leaveSetup(plan, memberIds(plan.setup))
+      result.inactive = plan.inactive
+      state.previews.delete(input.token)
+      const job = { setup: id, sandbox: name, targets: preview.targets, ...result, at: new Date().toISOString() }
+      state.jobs.set(keyFor(plan.sandbox, id), job)
+      return job
+    } finally { state.locks.delete(lock) }
+  }
+  return undefined
+}
+
+// Start with a shell for Setup-bearing templates. Imported code is not invoked
+// until after the operator opens/restarts the agent following reconciliation.
+export async function startSetupInstall(name, ids, targets, expectedId, approvedRevisions = {}, expectedGateway) {
+  return runWithContext(contextSelection(), () => startInstall(name, ids, targets, expectedId, approvedRevisions, expectedGateway))
+}
+async function startInstall(name, ids, targets, expectedId, approvedRevisions, expectedGateway) {
+  const state = deploymentState()
+  const expectedSandbox = { id: expectedId, gateway: expectedGateway ?? (await gateway()).target.endpoint }
+  const setups = await resolveSetups(ids)
+  validateTargets(targets)
+  for (const setup of setups) state.jobs.set(`${name}:${setup.id}`, { setup: setup.id, sandbox: name, targets, status: 'waiting', at: new Date().toISOString() })
+  void (async () => {
+    const { client, workspaceScope } = await gateway()
+    let ready = false
+    for (let i = 0; i < 60; i++) {
+      const box = sandboxView((await client.raw.getSandbox({ name, workspaceScope })).sandbox)
+      assertSandboxIdentity(box, (await gateway()).target.endpoint, expectedSandbox)
+      if (box.phase === 'ready') { ready = true; break }
+      if (['error', 'deleting', 'stopped'].includes(box.phase)) break
+      await new Promise((resolve) => setTimeout(resolve, 2000))
+    }
+    for (const setup of setups) {
+      let result
+      try {
+        if (!ready) throw fail('Sandbox is not ready. Retry from its Setups tab.')
+        if ((await getSetupStore().get(setup.id)).revision !== setup.revision) throw fail('Setup changed after creation. Review the updated version before enabling.')
+        const preview = await deploymentRoute('POST', ['setups', setup.id, 'preview'], { sandbox: name, targets }, { expectedSandbox })
+        if (!preview.canEnable) result = { status: 'blocked', error: [...preview.problems, ...preview.network.filter((r) => !ENABLEABLE.includes(r.status)).map((r) => `${r.host}: ${r.reason}`)].join(' ') }
+        else result = await deploymentRoute('POST', ['setups', setup.id, 'enable'], { sandbox: name, token: preview.token, approveAccess: approvedRevisions[setup.id] === setup.revision }, { expectedSandbox })
+      } catch (e) { result = { status: 'failed', error: e.message } }
+      state.jobs.set(`${name}:${setup.id}`, { setup: setup.id, sandbox: name, targets, ...result, at: new Date().toISOString() })
+    }
+  })().catch(() => { for (const setup of setups) state.jobs.set(`${name}:${setup.id}`, { setup: setup.id, sandbox: name, status: 'failed', error: 'Could not reach the sandbox. Retry from its Setups tab.' }) })
+}
+
+// Leaving takes the Setup's egress policy out of the sandbox now rather than on the next sweep.
+async function leaveSetup({ sandbox, gateway: endpoint }, ids) {
+  await removeSandboxSetups({ ...sandbox, gateway: endpoint }, ids)
+  try { await syncAll({ only: (s) => s.id === sandbox.id, force: false }) } catch { /* stored revocation is applied by the next policy sync */ }
+}
+async function activateAccess(plan) {
+  const { client, workspaceScope, sandbox, setup } = plan
+  const expected = { id: sandbox.id, gateway: plan.gateway }
+  // Policy snapshots and their gateway effects share the mutation queue, so
+  // a concurrent revocation cannot be overwritten by this enable.
+  await serializeOrgWrite(async () => {
+    await assertCurrentSandbox(plan)
+    for (const provider of new Set(setup.items.map(i => i.credentialRef?.provider).filter(Boolean))) {
+      // Recheck the profile: attaching a changed profile must not introduce grants.
+      const found = (await client.raw.getProvider({ name: provider, workspaceScope })).provider
+      const profile = (await client.raw.getProviderProfile({ id: found.type, workspaceScope })).profile
+      if (!profile || profile.endpoints?.length) throw fail('The credential profile changed. Reconnect a dedicated MCP secret.', 409)
+      await client.raw.attachSandboxProvider({ sandbox: sandbox.name, provider, workspaceScope, requestId: randomUUID() })
+    }
+    const resource = (await client.raw.getSandbox({ name: sandbox.name, workspaceScope })).sandbox
+    const fresh = await inspectTarget(sandbox.name, setup.id, plan.targets, expected)
+    if (fresh.identity !== plan.identity) throw fail('Sandbox access changed while preparing. Review a fresh preview before enabling.',409)
+    // Joined only after that check: the 15-second policy sync would otherwise apply the Setup's policy mid-review.
+    await addSandboxSetups({ ...sandbox, gateway: plan.gateway }, memberIds(setup))
+    if (plan.grants.length || plan.network.some((r) => r.status === 'policy')) {
+      const managed = await managedOpsFor(client, workspaceScope, sandbox.name, plan.grants.flatMap(g => g.rule.endpoints.map(e => e.port)), plan.gateway)
+      await client.raw.updateConfig({ sandbox: sandbox.name, workspaceScope, global: false, expectedResourceVersion: resource.metadata?.resourceVersion, mergeOperations: [...plan.grants.map(g => ({ operation: { case: 'addRule', value: g } })), ...managed], annotations: { 'openshell.console/setup-revision': setup.revision }, requestId: randomUUID() })
+    }
+  })
+  for (let i = 0; i < 20; i++) {
+    const status = await client.raw.getSandboxPolicyStatus({ sandbox: sandbox.name, workspaceScope })
+    if (status.revision?.status === 2 && status.activeVersion === status.revision.version) {
+      const applied = await inspectTarget(sandbox.name, setup.id, plan.targets, expected)
+      if (applied.problems.length || applied.network.some(r => r.status !== 'allowed')) throw fail('Effective access no longer matches the reviewed Setup. Check requirements again.',409)
+      return
+    }
+    await new Promise(resolve => setTimeout(resolve, 500))
+  }
+  throw fail('Access was submitted but has not loaded. Check requirements again; configuration was not installed.', 409)
+}
+async function verifySetup({ client, sandbox, setup }) {
+  const checks = []
+  for (const item of setup.items) {
+    if (item.kind === 'skill') { checks.push({ item: item.name, status: 'files-verified', reason: 'Scripts were not executed.' }); continue }
+    if (item.auth?.mode === 'agent-session') { checks.push({item:item.name,status:'sign-in-in-agent',reason:'Configuration installed. Authenticate and check tool availability in the selected agent; the console does not read its OAuth session.'}); continue }
+    try {
+      const result = await client.sandbox.exec(sandbox.name, ['node', '-e', verifier], { workspace: sandbox.workspace, noLoginShell: true, stdin: Buffer.from(JSON.stringify({ config: item.config })), timeoutSecs: 35 })
+      const check = JSON.parse(result.stdout.toString())
+      checks.push({ item: item.name, ...check })
+    } catch { checks.push({ item: item.name, status: 'unverified', reason: 'Check needs Node.js 22 or later and compatible runtime access. Files are installed.' }) }
+  }
+  return checks
+}

package/server/setup-discovery.js

@@ -0,0 +1,289 @@
+import fs from 'node:fs/promises'
+import { constants } from 'node:fs'
+import path from 'node:path'
+import os from 'node:os'
+import { unzipSync } from 'fflate'
+import { createHash, randomUUID } from 'node:crypto'
+import { parse } from 'smol-toml'
+import { packageLaunch, packageRuntimeRequirements } from './setup-packages.js'
+import { PACKAGE_PENDING } from '../shared/setup-launch.js'
+
+export const SOURCES = ['codex', 'claude', 'cursor']
+export const hash = (value) => createHash('sha256').update(value).digest('hex')
+export const fail = (message, status = 400) => Object.assign(new Error(message), { status })
+const MAX_FILE = 512 * 1024
+// Agent config files (notably ~/.claude.json) also hold history and grow over time.
+const MAX_CONFIG = 4 * 1024 * 1024
+const MAX_BUNDLE = 4 * 1024 * 1024
+const ID = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,100}$/
+const secret = /(?:-----BEGIN [\w ]*PRIVATE KEY-----|\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[A-Z0-9]{16})|(?:api[_-]?key|token|password|secret|authorization)\s*[:=]\s*["']?(?!\$|<|\{|YOUR_|your_|example|placeholder|process\.env|os\.environ)[A-Za-z0-9_+/.=-]{16,})/i
+const textExtensions = new Set(['.md', '.txt', '.json', '.yaml', '.yml', '.toml', '.py', '.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.sh', '.bash', '.css', '.html', '.csv', '.svg', '.xml'])
+const inside = (root, file) => file === root || file.startsWith(root + path.sep)
+// Source MCP keys are display names, not paths or destination identifiers.
+// The installer generates its own collision-safe IDs for each harness.
+const validMcpName = value => typeof value === 'string' && value.trim().length > 0 && value.length <= 200 && !/[\p{C}]/u.test(value) && !secret.test(value)
+const safeLabel = value => validMcpName(value) ? value : 'Unrecognized item'
+
+async function readBounded(file, limit = MAX_FILE) {
+  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+  const size = limit % (1024 * 1024) ? `${limit / 1024} KB` : `${limit / 1024 / 1024} MB`
+  try {
+    const stat = await handle.stat()
+    if (!stat.isFile() || stat.size > limit) throw fail(`File is not a regular file or exceeds ${size}.`)
+    const data = await handle.readFile()
+    if (data.length > limit) throw fail(`File exceeds ${size}.`)
+    return data
+  } finally { await handle.close() }
+}
+
+// Plain-text guidance (no markdown). Echo only a short basename that cannot carry a secret.
+const commandLabel = command => { const base = path.basename(command); return /^[A-Za-z0-9._+ -]{1,60}$/.test(base) && !secret.test(base) ? `“${base}”` : null }
+const SCRIPT_EXTENSIONS = new Set(['.sh', '.bash', '.zsh', '.py', '.js', '.mjs', '.cjs', '.ts', '.rb', '.pl'])
+function launcherIssue(command) {
+  const base = path.basename(command), name = commandLabel(command) ?? 'This command', is = (...names) => names.includes(base)
+  if (!command.trim()) return 'No command or URL is set for this MCP, so there’s nothing to import.'
+  if (command.includes('.app/')) return `${name} belongs to a desktop app on this computer. Sandboxes run Linux, so this MCP can’t be imported.`
+  if (is('npx', 'npm')) return `This “${base}” command can’t be imported: it points to a local path, includes something that looks like a secret, or doesn’t name an npm package. Use “npx -y <package>@<version>” with plain arguments.`
+  if (is('sh', 'bash', 'zsh', 'fish', 'cmd', 'powershell')) return `This MCP starts through “${base}”, which runs a script on this computer. Sandboxes can’t run local scripts. To import it, change its command to start the npm package directly, like “npx -y <package>@<version>”.`
+  if (is('node', 'python', 'python3', 'ruby', 'perl')) return `This MCP runs a file from this computer with “${base}”. Local files aren’t copied into sandboxes. If the MCP is published on npm, change its command to “npx -y <package>@<version>”.`
+  if (is('uv', 'uvx', 'pip')) return `Python launchers like “${base}” aren’t supported yet. Only npm packages started with npx, and remote MCPs, can be imported.`
+  if (is('docker')) return '“docker” isn’t available inside sandboxes. If this MCP is published on npm, change its command to “npx -y <package>@<version>”.'
+  if (is('curl', 'wget')) return `This MCP downloads code with “${base}” when it starts, which isn’t allowed. Use a published npm package instead.`
+  if (SCRIPT_EXTENSIONS.has(path.extname(base).toLowerCase())) return `${name} is a script on this computer. Sandboxes can’t run local scripts. To import this MCP, change its command in your agent settings to start the npm package directly, like “npx -y <package>@<version>”.`
+  return `${name} is a program on this computer, not an npm package, so it can’t be copied into a sandbox. If it’s published on npm, change the command to “npx -y <package>@<version>”.`
+}
+
+// Never return values of env, headers, tokens or arbitrary configuration fields.
+export function normalizeMcp(name, raw, source) {
+  const item = { kind: 'mcp', name: safeLabel(name), sources: [source], transport: raw?.url ? 'http' : 'stdio', requirements: [], issues: [], credentialFields: [], credentialBindings: {}, config: null }
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw) || !validMcpName(name)) { item.issues.push('Unsupported configuration or server name.'); return item }
+  if (raw.enabled === false || raw.disabled === true) { item.disabled = true; item.issues.push('Disabled in the source harness. Enable it there before importing.') }
+  const values = {}, environment = {}, ordinaryHeaders = {}, localPaths = []
+  for (const [key, value] of Object.entries(raw.env || {})) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]{0,100}$/.test(key) || typeof value !== 'string') { item.issues.push('Unsupported environment setting.'); continue }
+    if (/token|password|secret|api.?key|authorization|credential|session|cookie|bearer/i.test(key) || secret.test(value)) { item.credentialFields.push(key); if (!/^\$\{|^openshell:resolve:env:/.test(value)) values[key] = value }
+    else if (/^(?:\/|~\/)|\/Users\/|\/Applications\//.test(value) || /(?:PATH|DIR|HOME|SOCKET|TRUSTED)/i.test(key)) localPaths.push(key)
+    else if (value.length <= 2048 && !/[\x00-\x1f]/.test(value)) environment[key] = value
+  }
+  for (const [key, value] of Object.entries(raw.http_headers || raw.headers || {})) {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{1,80}$/.test(key)) { item.issues.push('Unsupported HTTP header.'); continue }
+    if (/^(host|connection|content-length|transfer-encoding|proxy-authorization)$/i.test(key)) { item.issues.push('Unsupported transport-control header was not copied.'); continue }
+    if (/^(accept|content-type|user-agent|x-api-version|mcp-protocol-version)$/i.test(key) && !secret.test(value) && !/[\r\n\x00]/.test(value) && value.length <= 512) { ordinaryHeaders[key] = value; continue }
+    const field = key.replace(/-/g, '_').toUpperCase()
+    item.credentialFields.push(field)
+    const prefix = /^Bearer /i.test(value) ? 'Bearer ' : ''
+    item.credentialBindings[field] = { header: key, prefix }; values[field] = prefix ? value.slice(7) : value
+  }
+  for (const [header, envName] of Object.entries(raw.env_http_headers || {})) {
+    if (!/^[A-Za-z0-9_-]{1,80}$/.test(header) || typeof envName !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]{0,100}$/.test(envName)) { item.issues.push('Unsupported credential mapping.'); continue }
+    item.credentialFields.push(envName); item.credentialBindings[envName] = { header, prefix: '' }
+    // Do not consult the console process environment or shell profiles.
+  }
+  if (raw.bearer_token_env_var) {
+    const key = raw.bearer_token_env_var
+    if (typeof key === 'string' && /^[A-Za-z_][A-Za-z0-9_]{0,100}$/.test(key)) { item.credentialFields.push(key); item.credentialBindings[key] = { header: 'Authorization', prefix: 'Bearer ' } }
+  }
+  if (raw.oauth || raw.bearer_token) item.auth = {mode:'agent-session',status:'sign-in-required'}
+  item.credentialFields = [...new Set(item.credentialFields)]
+  if (item.credentialFields.length) item.issues.push(`Connect credentials (${item.credentialFields.join(', ')}) to use this MCP. They’re kept in the gateway, never in the setup.`)
+  if (Object.keys(values).length) item._sourceCredentials = values
+  if (raw.cwd || raw.envFile || raw.env_file) item.issues.push('Working directories and environment files need manual packaging. They were not imported.')
+  if (raw.url) {
+    try {
+      const url = new URL(raw.url)
+      if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || secret.test(raw.url) || !url.hostname.includes('.') || /^(localhost|127\.|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2\d|3[01])\.)/.test(url.hostname)) throw Error()
+      item.requirements.push({ phase: 'runtime', host: url.hostname, port: Number(url.port || 443), path: url.pathname, reason: 'The MCP server.' })
+      if (raw.type && !['http', 'streamable-http'].includes(raw.type)) item.issues.push('Only Streamable HTTP is supported for remote MCPs.')
+      item.config = { url: url.href }
+    } catch { item.issues.push('Endpoint needs review: use a public HTTPS URL without embedded credentials. Local and private services require a dedicated connection adapter.') }
+  } else {
+    const command = typeof raw.command === 'string' ? raw.command : ''
+    const args = raw.args ?? []
+    const dependency = packageLaunch(command, args)
+    if (dependency) {
+      item.package = dependency
+      item.requirements.push(...packageRuntimeRequirements(dependency))
+      item.requirements.push({ phase: 'build', host: 'registry.npmjs.org', port: 443, reason: 'Downloads the npm package during import, in a temporary sandbox with install scripts off. Your sandboxes don’t get this access.' })
+      item.issues.push(PACKAGE_PENDING)
+    } else if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,60}$/.test(command) || ['sh','bash','zsh','fish','cmd','powershell','node','python','python3','ruby','perl','npx','npm','uv','uvx','pip','docker','curl','wget'].includes(command)) {
+      item.issues.push(launcherIssue(command))
+    } else if (!Array.isArray(args) || args.length > 32 || args.some((arg) => typeof arg !== 'string' || !/^[a-zA-Z0-9_.=-]{1,128}$/.test(arg) || /token|password|secret|key|eval|exec/i.test(arg) || secret.test(arg))) item.issues.push(`Some arguments for ${commandLabel(command) ?? 'this command'} can’t be copied. Arguments may only contain letters, numbers and . _ = - (no paths, quotes or secrets).`)
+    else item.config = { command, args }
+  }
+  // Unrunnable items keep only their launcher message; path settings matter once the MCP can start.
+  if (localPaths.length && (item.config || item.package)) item.issues.push(localPaths.length === 1 ? `Local setting ${localPaths[0]} points to a folder on this computer and wasn’t copied. Set a sandbox path for it if the MCP needs it.` : `Local settings ${localPaths.join(', ')} point to folders on this computer and weren’t copied. Set sandbox paths for them if the MCP needs them.`)
+  if (item.config?.url && Object.keys(ordinaryHeaders).length) item.config.headers = ordinaryHeaders
+  if (item.config && Object.keys(environment).length) item.config.env = environment
+  else if (Object.keys(environment).length) item.environment = environment
+  return item
+}
+
+// Inspect archive contents in memory; never extract or execute imported files.
+// Keep the original bytes so scripts referencing the ZIP still work.
+function inspectSkillZip(content, archivePath) {
+  let expandedBytes = 0, entries = 0
+  const names = new Set()
+  let unpacked
+  try {
+    unpacked = unzipSync(content, { filter: ({ name, originalSize }) => {
+      if (++entries > 200) throw fail(`ZIP ${archivePath} exceeds the 200 entry limit.`)
+      const parts = name.replace(/\/$/, '').split('/')
+      if (!name || name.startsWith('/') || name.includes('\\') || parts.some(p => !p || p === '..' || p === '.') || !/^[a-zA-Z0-9_ ./@+-]+$/.test(name) || name.length > 200 || names.has(name)) throw fail(`ZIP ${archivePath} contains an unsafe or duplicate path.`)
+      names.add(name)
+      expandedBytes += originalSize
+      if (originalSize > MAX_FILE || expandedBytes > MAX_BUNDLE) throw fail(`ZIP ${archivePath} exceeds the 512 KB per file / 4 MB expanded limit.`)
+      return true
+    } })
+  } catch (error) {
+    if (error.status) throw error
+    throw fail(`ZIP ${archivePath} could not be read. Use an unencrypted, valid ZIP.`)
+  }
+  const archiveEntries = []
+  for (const [name, data] of Object.entries(unpacked)) {
+    if (name.endsWith('/')) continue
+    // Finder resource forks are packaging metadata, not skill source files.
+    if (name.startsWith('__MACOSX/')) continue
+    if (!textExtensions.has(path.extname(name).toLowerCase())) throw fail(`ZIP ${archivePath} contains an unsupported file: ${name}.`)
+    const buffer = Buffer.from(data), text = buffer.toString('utf8')
+    if (!buffer.equals(Buffer.from(text)) || buffer.includes(0) || secret.test(text)) throw fail(`Potential credentials or binary content in ZIP ${archivePath}. Nothing from this skill was imported.`)
+    archiveEntries.push({ path: name, bytes: data.length })
+  }
+  return { archiveEntries, expandedBytes, entries }
+}
+
+export async function readSkill(root, home = os.homedir()) {
+  const resolved = await fs.realpath(root)
+  if (resolved !== root || !inside(await fs.realpath(home), resolved)) throw fail('Skill location changed. Discover it again.')
+  const files = []; let bytes = 0, inspectedEntries = 0
+  async function visit(dir, prefix = '') {
+    const entries = await fs.readdir(dir, { withFileTypes: true })
+    if (entries.length > 200) throw fail('Skill has too many files.')
+    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      if (entry.name.startsWith('.') || ['node_modules', '__pycache__'].includes(entry.name)) continue
+      const relative = prefix + entry.name
+      if (!/^[a-zA-Z0-9_ ./@+-]+$/.test(relative) || relative.length > 200) throw fail('Skill has an unsupported filename.')
+      const file = path.join(dir, entry.name)
+      const stat = await fs.lstat(file)
+      if (stat.isSymbolicLink() || !inside(resolved, await fs.realpath(file))) throw fail('Skill contains a link outside its reviewed bundle. Links are not copied.')
+      if (stat.isDirectory()) { if (prefix.split('/').length > 8) throw fail('Skill is nested too deeply.'); await visit(file, relative + '/'); continue }
+      const isZip = path.extname(entry.name).toLowerCase() === '.zip'
+      if (!isZip && !textExtensions.has(path.extname(entry.name).toLowerCase())) throw fail(`Unsupported skill file: ${relative}.`)
+      const content = await readBounded(file)
+      bytes += content.length
+      if (bytes > MAX_BUNDLE || ++inspectedEntries > 200) throw fail('Skill exceeds the 4 MB / 200 file limit.')
+      if (isZip) {
+        const { archiveEntries, expandedBytes, entries } = inspectSkillZip(content, relative)
+        bytes += expandedBytes; inspectedEntries += entries
+        if (bytes > MAX_BUNDLE || inspectedEntries > 200) throw fail('Skill exceeds the 4 MB / 200 file limit including ZIP contents.')
+        files.push({ path: relative, content: content.toString('base64'), encoding: 'base64', archiveEntries, executable: false })
+        continue
+      }
+      const text = content.toString('utf8')
+      if (!content.equals(Buffer.from(text)) || content.includes(0) || secret.test(text)) throw fail('Potential credentials or binary content found. Nothing from this skill was imported.')
+      files.push({ path: relative, content: text, executable: Boolean(stat.mode & 0o111) })
+    }
+  }
+  await visit(resolved)
+  if (!files.some((f) => f.path === 'SKILL.md')) throw fail('SKILL.md is missing.')
+  files.sort((a, b) => a.path.localeCompare(b.path))
+  return { files, bytes, digest: hash(JSON.stringify(files)) }
+}
+
+// Resolve npm-installed executables from metadata only. Never run the local
+// command or copy its platform-specific files into a Linux sandbox.
+export async function portableMcpConfig(raw, home) {
+  if (!raw || raw.url || typeof raw.command !== 'string' || !path.isAbsolute(raw.command) || packageLaunch(raw.command, raw.args)) return raw
+  try {
+    const root = await fs.realpath(home)
+    const executable = await fs.realpath(raw.command)
+    if (!inside(root, executable) || !(await fs.stat(executable)).isFile()) return raw
+    let directory = path.dirname(executable)
+    for (let depth = 0; depth < 12 && inside(root, directory) && directory !== root; depth++, directory = path.dirname(directory)) {
+      const parent = path.dirname(directory)
+      const isPackage = path.basename(parent) === 'node_modules' || (path.basename(parent).startsWith('@') && path.basename(path.dirname(parent)) === 'node_modules')
+      if (!isPackage) continue
+      const metadata = JSON.parse((await readBounded(path.join(directory, 'package.json'))).toString())
+      if (!/^\d+\.\d+\.\d+(?:-[a-zA-Z0-9.-]+)?(?:\+[a-zA-Z0-9.-]+)?$/.test(metadata.version || '')) return raw
+      const plan = packageLaunch('npx', [`${metadata.name}@${metadata.version}`, ...(raw.args ?? [])])
+      if (!plan || path.relative(path.basename(parent) === 'node_modules' ? parent : path.dirname(parent), directory) !== plan.name) return raw
+      const bins = typeof metadata.bin === 'string' ? { [plan.name.split('/').pop()]: metadata.bin } : metadata.bin || {}
+      const preferred = plan.name.split('/').pop()
+      const bin = bins[preferred] || (Object.keys(bins).length === 1 ? Object.values(bins)[0] : null)
+      if (typeof bin !== 'string' || !inside(directory, path.resolve(directory, bin)) || await fs.realpath(path.resolve(directory, bin)) !== executable) return raw
+      return { ...raw, command: 'npx', args: [`${plan.name}@${plan.requested}`, ...plan.args] }
+    }
+  } catch { /* Unverifiable local commands retain their actionable import issue. */ }
+  return raw
+}
+
+const canonical = value => Array.isArray(value) ? value.map(canonical)
+  : value && typeof value === 'object' ? Object.fromEntries(Object.keys(value).sort().map(key => [key, canonical(value[key])])) : value
+
+// Discovery is opt-in and restricted to standard user-owned locations. No
+// project recursion, plugin code, shell profiles, credentials stores or network.
+export async function discover({ sources, home = os.homedir() }) {
+  if (!Array.isArray(sources) || !sources.length || sources.some((s) => !SOURCES.includes(s))) throw fail('Select Codex, Claude Code or Cursor.')
+  const items = [], warnings = [], seen = new Map(), skillDigests = new Map()
+  const skillDigest = async root => {
+    if (!skillDigests.has(root)) skillDigests.set(root, readSkill(root, home).then(value => value.digest).catch(() => null))
+    return skillDigests.get(root)
+  }
+  const configPaths = { codex: '.codex/config.toml', claude: '.claude.json', cursor: '.cursor/mcp.json' }, labels = { codex: 'Codex', claude: 'Claude Code', cursor: 'Cursor' }
+  for (const source of [...new Set(sources)]) {
+    try {
+      const file = path.join(home, configPaths[source])
+      const resolved = await fs.realpath(file)
+      if (!inside(await fs.realpath(home), resolved)) throw fail('Configuration links outside the home directory are not read.')
+      const raw = await readBounded(resolved, MAX_CONFIG)
+      const data = source === 'codex' ? parse(raw.toString()) : JSON.parse(raw)
+      const entries = Object.entries(data[source === 'codex' ? 'mcp_servers' : 'mcpServers'] ?? {})
+      if (entries.length > 200) throw fail('More than 200 MCP configurations; narrow the source first.')
+      for (const [name, cfg] of entries) {
+        const item = normalizeMcp(name, await portableMcpConfig(cfg, home), source)
+        const digest = hash(JSON.stringify(canonical({ config: item.config, issues: [...item.issues].sort(), credentialFields: [...item.credentialFields].sort(), credentialBindings: item.credentialBindings, package: item.package, environment: item.environment, auth: item.auth, disabled: item.disabled })))
+        // Account values participate only in the private comparison key, never
+        // in the digest returned to the browser. Unresolved launchers must not
+        // collapse merely because they have the same generic error.
+        const key = 'mcp:' + digest + ':' + hash(JSON.stringify(canonical({ credentials: item._sourceCredentials, unresolved: !item.config && !item.package ? cfg : undefined })))
+        const existing = seen.get(key)
+        if (existing) { if (!existing.sources.includes(source)) existing.sources.push(source); continue }
+        const record = { ...item, id: randomUUID(), digest }
+        seen.set(key, record); items.push(record)
+      }
+    } catch (error) { warnings.push(`${labels[source]}: ${error.code === 'ENOENT' ? `no MCP config found at ~/${configPaths[source]}.` : error.status ? error.message : `couldn’t read ~/${configPaths[source]}. Check that it’s valid ${source === 'codex' ? 'TOML' : 'JSON'}.`}`) }
+    const roots = [path.join(home, source === 'claude' ? '.claude/skills' : `.${source}/skills`), ...(source === 'codex' ? [path.join(home, '.agents/skills')] : [])]
+    for (const root of roots) {
+      const entries = await fs.readdir(root, { withFileTypes: true }).catch(() => [])
+      for (const entry of entries.slice(0, 500)) {
+        if (entry.name.startsWith('.') || !ID.test(entry.name)) continue
+        const dir = path.join(root, entry.name)
+        let resolved
+        try { resolved = await fs.realpath(dir); if (!inside(await fs.realpath(home), resolved)) continue; if (!(await fs.stat(path.join(resolved, 'SKILL.md'))).isFile()) continue } catch { continue }
+        const key = 'skill:' + resolved
+        if (seen.has(key)) { const item = seen.get(key); if (!item.sources.includes(source)) item.sources.push(source); continue }
+        // Compare complete contents only for same-name copies in different
+        // locations. Different versions stay separate; review reads them again.
+        const candidates = items.filter(item => item.kind === 'skill' && item.name === entry.name)
+        let duplicate = null
+        if (candidates.length) {
+          const digest = await skillDigest(resolved)
+          if (digest) for (const candidate of candidates) {
+            if (await skillDigest(candidate.root) === digest) { duplicate = candidate; break }
+          }
+        }
+        if (duplicate) {
+          if (!duplicate.sources.includes(source)) duplicate.sources.push(source)
+          seen.set(key, duplicate); continue
+        }
+        const record = { id: randomUUID(), kind: 'skill', name: entry.name, sources: [source], root: resolved, issues: [], requirements: [], credentialFields: [] }
+        seen.set(key, record); items.push(record)
+      }
+    }
+  }
+  return { items, warnings: [...warnings, 'Only your personal MCPs and skills are listed. Project-level MCPs and plugin skills aren’t included.'] }
+}
+
+export function publicItem(item) {
+  const { root, config, files, _sourceCredentials, ...rest } = item
+  return { ...rest, sourceCredentialFields: item.sourceCredentialFields || Object.keys(_sourceCredentials || {}), ...(config ? { configuration: config.url ? { endpoint: config.url } : { command: config.command, args: config.args } } : {}), ...(files ? { files: files.map(({ path, content, encoding, archiveEntries }) => ({ path, bytes: Buffer.byteLength(content, encoding === 'base64' ? 'base64' : 'utf8'), ...(encoding ? { encoding, archiveEntries } : {}) })) } : {}) }
+}