remoteclaw 0.1.0-next.2abd2fa → 0.1.0-next.2e9a6cd

package/dist/constants-BbAEYzFC.js

@@ -0,0 +1,70 @@
+//#region src/daemon/constants.ts
+const GATEWAY_LAUNCH_AGENT_LABEL = "org.remoteclaw.gateway";
+const GATEWAY_SYSTEMD_SERVICE_NAME = "remoteclaw-gateway";
+const GATEWAY_WINDOWS_TASK_NAME = "RemoteClaw Gateway";
+const GATEWAY_SERVICE_MARKER = "remoteclaw";
+const GATEWAY_SERVICE_KIND = "gateway";
+const NODE_LAUNCH_AGENT_LABEL = "org.remoteclaw.node";
+const NODE_SYSTEMD_SERVICE_NAME = "remoteclaw-node";
+const NODE_WINDOWS_TASK_NAME = "RemoteClaw Node";
+const NODE_SERVICE_MARKER = "remoteclaw";
+const NODE_SERVICE_KIND = "node";
+const NODE_WINDOWS_TASK_SCRIPT_NAME = "node.cmd";
+const LEGACY_GATEWAY_LAUNCH_AGENT_LABELS = ["ai.remoteclaw.gateway"];
+const LEGACY_GATEWAY_SYSTEMD_SERVICE_NAMES = [];
+function normalizeGatewayProfile(profile) {
+	const trimmed = profile?.trim();
+	if (!trimmed || trimmed.toLowerCase() === "default") return null;
+	return trimmed;
+}
+function resolveGatewayProfileSuffix(profile) {
+	const normalized = normalizeGatewayProfile(profile);
+	return normalized ? `-${normalized}` : "";
+}
+function resolveGatewayLaunchAgentLabel(profile) {
+	const normalized = normalizeGatewayProfile(profile);
+	if (!normalized) return GATEWAY_LAUNCH_AGENT_LABEL;
+	return `org.remoteclaw.${normalized}`;
+}
+function resolveLegacyGatewayLaunchAgentLabels(profile) {
+	const normalized = normalizeGatewayProfile(profile);
+	if (!normalized) return [...LEGACY_GATEWAY_LAUNCH_AGENT_LABELS];
+	return [`ai.remoteclaw.${normalized}`];
+}
+function resolveGatewaySystemdServiceName(profile) {
+	const suffix = resolveGatewayProfileSuffix(profile);
+	if (!suffix) return GATEWAY_SYSTEMD_SERVICE_NAME;
+	return `remoteclaw-gateway${suffix}`;
+}
+function resolveGatewayWindowsTaskName(profile) {
+	const normalized = normalizeGatewayProfile(profile);
+	if (!normalized) return GATEWAY_WINDOWS_TASK_NAME;
+	return `RemoteClaw Gateway (${normalized})`;
+}
+function formatGatewayServiceDescription(params) {
+	const profile = normalizeGatewayProfile(params?.profile);
+	const version = params?.version?.trim();
+	const parts = [];
+	if (profile) parts.push(`profile: ${profile}`);
+	if (version) parts.push(`v${version}`);
+	if (parts.length === 0) return "RemoteClaw Gateway";
+	return `RemoteClaw Gateway (${parts.join(", ")})`;
+}
+function resolveGatewayServiceDescription(params) {
+	return params.description ?? formatGatewayServiceDescription({
+		profile: params.env.REMOTECLAW_PROFILE,
+		version: params.environment?.REMOTECLAW_SERVICE_VERSION ?? params.env.REMOTECLAW_SERVICE_VERSION
+	});
+}
+function resolveNodeLaunchAgentLabel() {
+	return NODE_LAUNCH_AGENT_LABEL;
+}
+function resolveNodeSystemdServiceName() {
+	return NODE_SYSTEMD_SERVICE_NAME;
+}
+function resolveNodeWindowsTaskName() {
+	return NODE_WINDOWS_TASK_NAME;
+}
+
+//#endregion
+export { NODE_SERVICE_KIND as a, resolveGatewayLaunchAgentLabel as c, resolveGatewaySystemdServiceName as d, resolveGatewayWindowsTaskName as f, resolveNodeWindowsTaskName as g, resolveNodeSystemdServiceName as h, LEGACY_GATEWAY_SYSTEMD_SERVICE_NAMES as i, resolveGatewayProfileSuffix as l, resolveNodeLaunchAgentLabel as m, GATEWAY_SERVICE_KIND as n, NODE_SERVICE_MARKER as o, resolveLegacyGatewayLaunchAgentLabels as p, GATEWAY_SERVICE_MARKER as r, NODE_WINDOWS_TASK_SCRIPT_NAME as s, GATEWAY_LAUNCH_AGENT_LABEL as t, resolveGatewayServiceDescription as u };

package/dist/constants-tLOgmZZ1.js

@@ -0,0 +1,70 @@
+//#region src/daemon/constants.ts
+const GATEWAY_LAUNCH_AGENT_LABEL = "org.remoteclaw.gateway";
+const GATEWAY_SYSTEMD_SERVICE_NAME = "remoteclaw-gateway";
+const GATEWAY_WINDOWS_TASK_NAME = "RemoteClaw Gateway";
+const GATEWAY_SERVICE_MARKER = "remoteclaw";
+const GATEWAY_SERVICE_KIND = "gateway";
+const NODE_LAUNCH_AGENT_LABEL = "org.remoteclaw.node";
+const NODE_SYSTEMD_SERVICE_NAME = "remoteclaw-node";
+const NODE_WINDOWS_TASK_NAME = "RemoteClaw Node";
+const NODE_SERVICE_MARKER = "remoteclaw";
+const NODE_SERVICE_KIND = "node";
+const NODE_WINDOWS_TASK_SCRIPT_NAME = "node.cmd";
+const LEGACY_GATEWAY_LAUNCH_AGENT_LABELS = ["ai.remoteclaw.gateway"];
+const LEGACY_GATEWAY_SYSTEMD_SERVICE_NAMES = [];
+function normalizeGatewayProfile(profile) {
+	const trimmed = profile?.trim();
+	if (!trimmed || trimmed.toLowerCase() === "default") return null;
+	return trimmed;
+}
+function resolveGatewayProfileSuffix(profile) {
+	const normalized = normalizeGatewayProfile(profile);
+	return normalized ? `-${normalized}` : "";
+}
+function resolveGatewayLaunchAgentLabel(profile) {
+	const normalized = normalizeGatewayProfile(profile);
+	if (!normalized) return GATEWAY_LAUNCH_AGENT_LABEL;
+	return `org.remoteclaw.${normalized}`;
+}
+function resolveLegacyGatewayLaunchAgentLabels(profile) {
+	const normalized = normalizeGatewayProfile(profile);
+	if (!normalized) return [...LEGACY_GATEWAY_LAUNCH_AGENT_LABELS];
+	return [`ai.remoteclaw.${normalized}`];
+}
+function resolveGatewaySystemdServiceName(profile) {
+	const suffix = resolveGatewayProfileSuffix(profile);
+	if (!suffix) return GATEWAY_SYSTEMD_SERVICE_NAME;
+	return `remoteclaw-gateway${suffix}`;
+}
+function resolveGatewayWindowsTaskName(profile) {
+	const normalized = normalizeGatewayProfile(profile);
+	if (!normalized) return GATEWAY_WINDOWS_TASK_NAME;
+	return `RemoteClaw Gateway (${normalized})`;
+}
+function formatGatewayServiceDescription(params) {
+	const profile = normalizeGatewayProfile(params?.profile);
+	const version = params?.version?.trim();
+	const parts = [];
+	if (profile) parts.push(`profile: ${profile}`);
+	if (version) parts.push(`v${version}`);
+	if (parts.length === 0) return "RemoteClaw Gateway";
+	return `RemoteClaw Gateway (${parts.join(", ")})`;
+}
+function resolveGatewayServiceDescription(params) {
+	return params.description ?? formatGatewayServiceDescription({
+		profile: params.env.REMOTECLAW_PROFILE,
+		version: params.environment?.REMOTECLAW_SERVICE_VERSION ?? params.env.REMOTECLAW_SERVICE_VERSION
+	});
+}
+function resolveNodeLaunchAgentLabel() {
+	return NODE_LAUNCH_AGENT_LABEL;
+}
+function resolveNodeSystemdServiceName() {
+	return NODE_SYSTEMD_SERVICE_NAME;
+}
+function resolveNodeWindowsTaskName() {
+	return NODE_WINDOWS_TASK_NAME;
+}
+
+//#endregion
+export { NODE_SERVICE_KIND as a, resolveGatewayLaunchAgentLabel as c, resolveGatewaySystemdServiceName as d, resolveGatewayWindowsTaskName as f, resolveNodeWindowsTaskName as g, resolveNodeSystemdServiceName as h, LEGACY_GATEWAY_SYSTEMD_SERVICE_NAMES as i, resolveGatewayProfileSuffix as l, resolveNodeLaunchAgentLabel as m, GATEWAY_SERVICE_KIND as n, NODE_SERVICE_MARKER as o, resolveLegacyGatewayLaunchAgentLabels as p, GATEWAY_SERVICE_MARKER as r, NODE_WINDOWS_TASK_SCRIPT_NAME as s, GATEWAY_LAUNCH_AGENT_LABEL as t, resolveGatewayServiceDescription as u };

package/dist/control-auth-BFbDXKLK.js

@@ -0,0 +1,397 @@
+import { u as resolveGatewayPort } from "./paths-BTaH3rLn.js";
+import { i as loadConfig, l as writeConfigFile } from "./config-CHDaGquZ.js";
+import { r as isLoopbackHost } from "./net-COL170MG.js";
+import { a as DEFAULT_BROWSER_EVALUATE_ENABLED, c as DEFAULT_REMOTECLAW_BROWSER_PROFILE_NAME, i as DEFAULT_BROWSER_DEFAULT_PROFILE_NAME, o as DEFAULT_REMOTECLAW_BROWSER_COLOR, s as DEFAULT_REMOTECLAW_BROWSER_ENABLED } from "./constants-DNWjlxZ5.js";
+import { a as resolveGatewayAuth } from "./auth-VItd2pwK.js";
+import crypto from "node:crypto";
+
+//#region src/config/port-defaults.ts
+function isValidPort(port) {
+	return Number.isFinite(port) && port > 0 && port <= 65535;
+}
+function clampPort(port, fallback) {
+	return isValidPort(port) ? port : fallback;
+}
+function derivePort(base, offset, fallback) {
+	return clampPort(base + offset, fallback);
+}
+const DEFAULT_BROWSER_CONTROL_PORT = 18791;
+const DEFAULT_BROWSER_CDP_PORT_RANGE_START = 18800;
+const DEFAULT_BROWSER_CDP_PORT_RANGE_END = 18899;
+function deriveDefaultBrowserControlPort(gatewayPort) {
+	return derivePort(gatewayPort, 2, DEFAULT_BROWSER_CONTROL_PORT);
+}
+function deriveDefaultBrowserCdpPortRange(browserControlPort) {
+	const start = derivePort(browserControlPort, 9, DEFAULT_BROWSER_CDP_PORT_RANGE_START);
+	const end = clampPort(start + (DEFAULT_BROWSER_CDP_PORT_RANGE_END - DEFAULT_BROWSER_CDP_PORT_RANGE_START), DEFAULT_BROWSER_CDP_PORT_RANGE_END);
+	if (end < start) return {
+		start,
+		end: start
+	};
+	return {
+		start,
+		end
+	};
+}
+
+//#endregion
+//#region src/browser/profiles.ts
+/**
+* CDP port allocation for browser profiles.
+*
+* Default port range: 18800-18899 (100 profiles max)
+* Ports are allocated once at profile creation and persisted in config.
+* Multi-instance: callers may pass an explicit range to avoid collisions.
+*
+* Reserved ports (do not use for CDP):
+*   18789 - Gateway WebSocket
+*   18790 - Bridge
+*   18791 - Browser control server
+*   18792-18799 - Reserved for future one-off services (canvas at 18793)
+*/
+const CDP_PORT_RANGE_START = 18800;
+const CDP_PORT_RANGE_END = 18899;
+const PROFILE_NAME_REGEX = /^[a-z0-9][a-z0-9-]*$/;
+function isValidProfileName(name) {
+	if (!name || name.length > 64) return false;
+	return PROFILE_NAME_REGEX.test(name);
+}
+function allocateCdpPort(usedPorts, range) {
+	const start = range?.start ?? CDP_PORT_RANGE_START;
+	const end = range?.end ?? CDP_PORT_RANGE_END;
+	if (!Number.isFinite(start) || !Number.isFinite(end) || start <= 0 || end <= 0) return null;
+	if (start > end) return null;
+	for (let port = start; port <= end; port++) if (!usedPorts.has(port)) return port;
+	return null;
+}
+function getUsedPorts(profiles) {
+	if (!profiles) return /* @__PURE__ */ new Set();
+	const used = /* @__PURE__ */ new Set();
+	for (const profile of Object.values(profiles)) {
+		if (typeof profile.cdpPort === "number") {
+			used.add(profile.cdpPort);
+			continue;
+		}
+		const rawUrl = profile.cdpUrl?.trim();
+		if (!rawUrl) continue;
+		try {
+			const parsed = new URL(rawUrl);
+			const port = parsed.port && Number.parseInt(parsed.port, 10) > 0 ? Number.parseInt(parsed.port, 10) : parsed.protocol === "https:" ? 443 : 80;
+			if (!Number.isNaN(port) && port > 0 && port <= 65535) used.add(port);
+		} catch {}
+	}
+	return used;
+}
+const PROFILE_COLORS = [
+	"#FF4500",
+	"#0066CC",
+	"#00AA00",
+	"#9933FF",
+	"#FF6699",
+	"#00CCCC",
+	"#FF9900",
+	"#6666FF",
+	"#CC3366",
+	"#339966"
+];
+function allocateColor(usedColors) {
+	for (const color of PROFILE_COLORS) if (!usedColors.has(color.toUpperCase())) return color;
+	return PROFILE_COLORS[usedColors.size % PROFILE_COLORS.length] ?? PROFILE_COLORS[0];
+}
+function getUsedColors(profiles) {
+	if (!profiles) return /* @__PURE__ */ new Set();
+	return new Set(Object.values(profiles).map((p) => p.color.toUpperCase()));
+}
+
+//#endregion
+//#region src/browser/config.ts
+function normalizeHexColor(raw) {
+	const value = (raw ?? "").trim();
+	if (!value) return DEFAULT_REMOTECLAW_BROWSER_COLOR;
+	const normalized = value.startsWith("#") ? value : `#${value}`;
+	if (!/^#[0-9a-fA-F]{6}$/.test(normalized)) return DEFAULT_REMOTECLAW_BROWSER_COLOR;
+	return normalized.toUpperCase();
+}
+function normalizeTimeoutMs(raw, fallback) {
+	const value = typeof raw === "number" && Number.isFinite(raw) ? Math.floor(raw) : fallback;
+	return value < 0 ? fallback : value;
+}
+function normalizeStringList(raw) {
+	if (!Array.isArray(raw) || raw.length === 0) return;
+	const values = raw.map((value) => value.trim()).filter((value) => value.length > 0);
+	return values.length > 0 ? values : void 0;
+}
+function resolveBrowserSsrFPolicy(cfg) {
+	const allowPrivateNetwork = cfg?.ssrfPolicy?.allowPrivateNetwork;
+	const dangerouslyAllowPrivateNetwork = cfg?.ssrfPolicy?.dangerouslyAllowPrivateNetwork;
+	const allowedHostnames = normalizeStringList(cfg?.ssrfPolicy?.allowedHostnames);
+	const hostnameAllowlist = normalizeStringList(cfg?.ssrfPolicy?.hostnameAllowlist);
+	const hasExplicitPrivateSetting = allowPrivateNetwork !== void 0 || dangerouslyAllowPrivateNetwork !== void 0;
+	const resolvedAllowPrivateNetwork = dangerouslyAllowPrivateNetwork === true || allowPrivateNetwork === true || !hasExplicitPrivateSetting;
+	if (!resolvedAllowPrivateNetwork && !hasExplicitPrivateSetting && !allowedHostnames && !hostnameAllowlist) return;
+	return {
+		...resolvedAllowPrivateNetwork ? { dangerouslyAllowPrivateNetwork: true } : {},
+		...allowedHostnames ? { allowedHostnames } : {},
+		...hostnameAllowlist ? { hostnameAllowlist } : {}
+	};
+}
+function parseHttpUrl(raw, label) {
+	const trimmed = raw.trim();
+	const parsed = new URL(trimmed);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`${label} must be http(s), got: ${parsed.protocol.replace(":", "")}`);
+	const port = parsed.port && Number.parseInt(parsed.port, 10) > 0 ? Number.parseInt(parsed.port, 10) : parsed.protocol === "https:" ? 443 : 80;
+	if (Number.isNaN(port) || port <= 0 || port > 65535) throw new Error(`${label} has invalid port: ${parsed.port}`);
+	return {
+		parsed,
+		port,
+		normalized: parsed.toString().replace(/\/$/, "")
+	};
+}
+/**
+* Ensure the default "remoteclaw" profile exists in the profiles map.
+* Auto-creates it with the legacy CDP port (from browser.cdpUrl) or first port if missing.
+*/
+function ensureDefaultProfile(profiles, defaultColor, legacyCdpPort, derivedDefaultCdpPort) {
+	const result = { ...profiles };
+	if (!result[DEFAULT_REMOTECLAW_BROWSER_PROFILE_NAME]) result[DEFAULT_REMOTECLAW_BROWSER_PROFILE_NAME] = {
+		cdpPort: legacyCdpPort ?? derivedDefaultCdpPort ?? CDP_PORT_RANGE_START,
+		color: defaultColor
+	};
+	return result;
+}
+/**
+* Ensure a built-in "chrome" profile exists for the Chrome extension relay.
+*
+* Note: this is an RemoteClaw browser profile (routing config), not a Chrome user profile.
+* It points at the local relay CDP endpoint (controlPort + 1).
+*/
+function ensureDefaultChromeExtensionProfile(profiles, controlPort) {
+	const result = { ...profiles };
+	if (result.chrome) return result;
+	const relayPort = controlPort + 1;
+	if (!Number.isFinite(relayPort) || relayPort <= 0 || relayPort > 65535) return result;
+	if (getUsedPorts(result).has(relayPort)) return result;
+	result.chrome = {
+		driver: "extension",
+		cdpUrl: `http://127.0.0.1:${relayPort}`,
+		color: "#00AA00"
+	};
+	return result;
+}
+function resolveBrowserConfig(cfg, rootConfig) {
+	const enabled = cfg?.enabled ?? DEFAULT_REMOTECLAW_BROWSER_ENABLED;
+	const evaluateEnabled = cfg?.evaluateEnabled ?? DEFAULT_BROWSER_EVALUATE_ENABLED;
+	const controlPort = deriveDefaultBrowserControlPort(resolveGatewayPort(rootConfig) ?? DEFAULT_BROWSER_CONTROL_PORT);
+	const defaultColor = normalizeHexColor(cfg?.color);
+	const remoteCdpTimeoutMs = normalizeTimeoutMs(cfg?.remoteCdpTimeoutMs, 1500);
+	const remoteCdpHandshakeTimeoutMs = normalizeTimeoutMs(cfg?.remoteCdpHandshakeTimeoutMs, Math.max(2e3, remoteCdpTimeoutMs * 2));
+	const derivedCdpRange = deriveDefaultBrowserCdpPortRange(controlPort);
+	const rawCdpUrl = (cfg?.cdpUrl ?? "").trim();
+	let cdpInfo;
+	if (rawCdpUrl) cdpInfo = parseHttpUrl(rawCdpUrl, "browser.cdpUrl");
+	else {
+		const derivedPort = controlPort + 1;
+		if (derivedPort > 65535) throw new Error(`Derived CDP port (${derivedPort}) is too high; check gateway port configuration.`);
+		const derived = new URL(`http://127.0.0.1:${derivedPort}`);
+		cdpInfo = {
+			parsed: derived,
+			port: derivedPort,
+			normalized: derived.toString().replace(/\/$/, "")
+		};
+	}
+	const headless = cfg?.headless === true;
+	const noSandbox = cfg?.noSandbox === true;
+	const attachOnly = cfg?.attachOnly === true;
+	const executablePath = cfg?.executablePath?.trim() || void 0;
+	const defaultProfileFromConfig = cfg?.defaultProfile?.trim() || void 0;
+	const legacyCdpPort = rawCdpUrl ? cdpInfo.port : void 0;
+	const profiles = ensureDefaultChromeExtensionProfile(ensureDefaultProfile(cfg?.profiles, defaultColor, legacyCdpPort, derivedCdpRange.start), controlPort);
+	const cdpProtocol = cdpInfo.parsed.protocol === "https:" ? "https" : "http";
+	const defaultProfile = defaultProfileFromConfig ?? (profiles[DEFAULT_BROWSER_DEFAULT_PROFILE_NAME] ? DEFAULT_BROWSER_DEFAULT_PROFILE_NAME : DEFAULT_REMOTECLAW_BROWSER_PROFILE_NAME);
+	const extraArgs = Array.isArray(cfg?.extraArgs) ? cfg.extraArgs.filter((a) => typeof a === "string" && a.trim().length > 0) : [];
+	const ssrfPolicy = resolveBrowserSsrFPolicy(cfg);
+	return {
+		enabled,
+		evaluateEnabled,
+		controlPort,
+		cdpProtocol,
+		cdpHost: cdpInfo.parsed.hostname,
+		cdpIsLoopback: isLoopbackHost(cdpInfo.parsed.hostname),
+		remoteCdpTimeoutMs,
+		remoteCdpHandshakeTimeoutMs,
+		color: defaultColor,
+		executablePath,
+		headless,
+		noSandbox,
+		attachOnly,
+		defaultProfile,
+		profiles,
+		ssrfPolicy,
+		extraArgs
+	};
+}
+/**
+* Resolve a profile by name from the config.
+* Returns null if the profile doesn't exist.
+*/
+function resolveProfile(resolved, profileName) {
+	const profile = resolved.profiles[profileName];
+	if (!profile) return null;
+	const rawProfileUrl = profile.cdpUrl?.trim() ?? "";
+	let cdpHost = resolved.cdpHost;
+	let cdpPort = profile.cdpPort ?? 0;
+	let cdpUrl = "";
+	const driver = profile.driver === "extension" ? "extension" : "remoteclaw";
+	if (rawProfileUrl) {
+		const parsed = parseHttpUrl(rawProfileUrl, `browser.profiles.${profileName}.cdpUrl`);
+		cdpHost = parsed.parsed.hostname;
+		cdpPort = parsed.port;
+		cdpUrl = parsed.normalized;
+	} else if (cdpPort) cdpUrl = `${resolved.cdpProtocol}://${resolved.cdpHost}:${cdpPort}`;
+	else throw new Error(`Profile "${profileName}" must define cdpPort or cdpUrl.`);
+	return {
+		name: profileName,
+		cdpPort,
+		cdpUrl,
+		cdpHost,
+		cdpIsLoopback: isLoopbackHost(cdpHost),
+		color: profile.color,
+		driver
+	};
+}
+
+//#endregion
+//#region src/gateway/startup-auth.ts
+function mergeGatewayTailscaleConfig(base, override) {
+	const merged = { ...base };
+	if (!override) return merged;
+	if (override.mode !== void 0) merged.mode = override.mode;
+	if (override.resetOnExit !== void 0) merged.resetOnExit = override.resetOnExit;
+	return merged;
+}
+function resolveGatewayAuthFromConfig(params) {
+	const tailscaleConfig = mergeGatewayTailscaleConfig(params.cfg.gateway?.tailscale, params.tailscaleOverride);
+	return resolveGatewayAuth({
+		authConfig: params.cfg.gateway?.auth,
+		authOverride: params.authOverride,
+		env: params.env,
+		tailscaleMode: tailscaleConfig.mode ?? "off"
+	});
+}
+function shouldPersistGeneratedToken(params) {
+	if (!params.persistRequested) return false;
+	if (params.resolvedAuth.modeSource === "override") return false;
+	return true;
+}
+async function ensureGatewayStartupAuth(params) {
+	const env = params.env ?? process.env;
+	const persistRequested = params.persist === true;
+	const resolved = resolveGatewayAuthFromConfig({
+		cfg: params.cfg,
+		env,
+		authOverride: params.authOverride,
+		tailscaleOverride: params.tailscaleOverride
+	});
+	if (resolved.mode !== "token" || (resolved.token?.trim().length ?? 0) > 0) {
+		assertHooksTokenSeparateFromGatewayAuth({
+			cfg: params.cfg,
+			auth: resolved
+		});
+		return {
+			cfg: params.cfg,
+			auth: resolved,
+			persistedGeneratedToken: false
+		};
+	}
+	const generatedToken = crypto.randomBytes(24).toString("hex");
+	const nextCfg = {
+		...params.cfg,
+		gateway: {
+			...params.cfg.gateway,
+			auth: {
+				...params.cfg.gateway?.auth,
+				mode: "token",
+				token: generatedToken
+			}
+		}
+	};
+	const persist = shouldPersistGeneratedToken({
+		persistRequested,
+		resolvedAuth: resolved
+	});
+	if (persist) await writeConfigFile(nextCfg);
+	const nextAuth = resolveGatewayAuthFromConfig({
+		cfg: nextCfg,
+		env,
+		authOverride: params.authOverride,
+		tailscaleOverride: params.tailscaleOverride
+	});
+	assertHooksTokenSeparateFromGatewayAuth({
+		cfg: nextCfg,
+		auth: nextAuth
+	});
+	return {
+		cfg: nextCfg,
+		auth: nextAuth,
+		generatedToken,
+		persistedGeneratedToken: persist
+	};
+}
+function assertHooksTokenSeparateFromGatewayAuth(params) {
+	if (params.cfg.hooks?.enabled !== true) return;
+	const hooksToken = typeof params.cfg.hooks.token === "string" ? params.cfg.hooks.token.trim() : "";
+	if (!hooksToken) return;
+	const gatewayToken = params.auth.mode === "token" && typeof params.auth.token === "string" ? params.auth.token.trim() : "";
+	if (!gatewayToken) return;
+	if (hooksToken !== gatewayToken) return;
+	throw new Error("Invalid config: hooks.token must not match gateway auth token. Set a distinct hooks.token for hook ingress.");
+}
+
+//#endregion
+//#region src/browser/control-auth.ts
+function resolveBrowserControlAuth(cfg, env = process.env) {
+	const auth = resolveGatewayAuth({
+		authConfig: cfg?.gateway?.auth,
+		env,
+		tailscaleMode: cfg?.gateway?.tailscale?.mode
+	});
+	const token = typeof auth.token === "string" ? auth.token.trim() : "";
+	const password = typeof auth.password === "string" ? auth.password.trim() : "";
+	return {
+		token: token || void 0,
+		password: password || void 0
+	};
+}
+function shouldAutoGenerateBrowserAuth(env) {
+	if ((env.NODE_ENV ?? "").trim().toLowerCase() === "test") return false;
+	const vitest = (env.VITEST ?? "").trim().toLowerCase();
+	if (vitest && vitest !== "0" && vitest !== "false" && vitest !== "off") return false;
+	return true;
+}
+async function ensureBrowserControlAuth(params) {
+	const env = params.env ?? process.env;
+	const auth = resolveBrowserControlAuth(params.cfg, env);
+	if (auth.token || auth.password) return { auth };
+	if (!shouldAutoGenerateBrowserAuth(env)) return { auth };
+	if (params.cfg.gateway?.auth?.mode === "password") return { auth };
+	if (params.cfg.gateway?.auth?.mode === "none") return { auth };
+	if (params.cfg.gateway?.auth?.mode === "trusted-proxy") return { auth };
+	const latestCfg = loadConfig();
+	const latestAuth = resolveBrowserControlAuth(latestCfg, env);
+	if (latestAuth.token || latestAuth.password) return { auth: latestAuth };
+	if (latestCfg.gateway?.auth?.mode === "password") return { auth: latestAuth };
+	if (latestCfg.gateway?.auth?.mode === "none") return { auth: latestAuth };
+	if (latestCfg.gateway?.auth?.mode === "trusted-proxy") return { auth: latestAuth };
+	const ensured = await ensureGatewayStartupAuth({
+		cfg: latestCfg,
+		env,
+		persist: true
+	});
+	return {
+		auth: resolveBrowserControlAuth(ensured.cfg, env),
+		generatedToken: ensured.generatedToken
+	};
+}
+
+//#endregion
+export { parseHttpUrl as a, allocateCdpPort as c, getUsedPorts as d, isValidProfileName as f, mergeGatewayTailscaleConfig as i, allocateColor as l, resolveBrowserControlAuth as n, resolveBrowserConfig as o, deriveDefaultBrowserCdpPortRange as p, ensureGatewayStartupAuth as r, resolveProfile as s, ensureBrowserControlAuth as t, getUsedColors as u };