tinybeeai 0.0.0-stage → 0.16.1

package/dist/connect/providers.js

@@ -0,0 +1,900 @@
+// Providers for native connections (KAT-66): what each service needs, how to test it, and the pickers
+// it serves. Every test runs against candidate values (the form) layered over the live settings, so
+// nothing is saved until it works. Messages never include a secret.
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { config, liveEnv, setting, settingSource } from '../config.js';
+import { reviewChildEnv } from '../review/backend-cli.js';
+import { deps, fetchT } from './deps.js';
+import { apiBase, appAuth, ghHeaders, installUrl } from './github-app.js';
+import { getMeta, setRuntimeValue } from './store.js';
+import { stopTunnel, tunnelState } from './tunnel.js';
+import { detectedActive } from './aivision-local.js';
+import { aivisionTokenFor, originOf, tokenWithheldReason, TOKEN_KEY } from './aivision-token.js';
+import { accessMessage, checkRepoWith } from './github-access.js';
+import { list } from '../db.js';
+const ANALYSIS_MODEL = 'claude-sonnet-5-5';
+const FAST_MODEL = 'claude-haiku-4-5-20251001';
+const ok = (message, account) => (account ? { ok: true, message, account } : { ok: true, message });
+const fail = (message) => ({ ok: false, message });
+function errText(err) {
+    if (err instanceof Error && err.name === 'TimeoutError')
+        return 'timed out';
+    return err instanceof Error ? err.message : String(err);
+}
+/** Runs `fn`, turning a thrown network error into a failed test with `what` in the message. */
+async function guarded(what, fn) {
+    try {
+        return await fn();
+    }
+    catch (err) {
+        return fail(`Could not reach ${what}: ${errText(err)}.`);
+    }
+}
+async function json(res) {
+    try {
+        return (await res.json());
+    }
+    catch {
+        return undefined;
+    }
+}
+// ---------- model ----------
+const anthropicBase = () => (liveEnv.ANTHROPIC_BASE_URL ?? 'https://api.anthropic.com').replace(/\/$/, '');
+async function anthropicModels(key) {
+    const res = await fetchT(`${anthropicBase()}/v1/models?limit=100`, { headers: { 'x-api-key': key, 'anthropic-version': '2023-06-01' } });
+    if (!res.ok)
+        return { status: res.status, models: [] };
+    const body = await json(res);
+    return { status: res.status, models: body?.data ?? [] };
+}
+/** Allowlisted env for a Claude CLI child, adjusted to test one method. */
+function cliEnv(get, method) {
+    const env = reviewChildEnv();
+    if (method === 'claude-token') {
+        const token = get('CLAUDE_CODE_OAUTH_TOKEN');
+        if (token)
+            env.CLAUDE_CODE_OAUTH_TOKEN = token;
+        // An API key in the env would win over the token, so the test would not prove the token works.
+        delete env.ANTHROPIC_API_KEY;
+    }
+    else if (settingSource('CLAUDE_CODE_OAUTH_TOKEN') !== 'env')
+        delete env.CLAUDE_CODE_OAUTH_TOKEN;
+    return env;
+}
+/** One tool-less turn through `claude -p`. Proves the login or token works end to end. */
+export async function claudeRoundTrip(get, method) {
+    const bin = get('LOCALDOST_CLAUDE_BIN')?.trim() || 'claude';
+    if (!deps.which(bin))
+        return fail(`The Claude CLI ("${bin}") is not installed on this server.`);
+    const model = get('LOCALDOST_FAST_MODEL')?.trim() || 'haiku';
+    const args = [
+        '-p',
+        '--output-format',
+        'json',
+        '--model',
+        model,
+        '--tools',
+        '',
+        '--strict-mcp-config',
+        '--setting-sources',
+        '',
+        '--no-session-persistence',
+        '--max-turns',
+        '1',
+    ];
+    const r = await deps.run(bin, args, { input: 'Reply with the single word OK.', env: cliEnv(get, method), timeoutMs: 90_000, tempCwd: true });
+    if (r.timedOut)
+        return fail('The Claude CLI did not answer within 90 seconds.');
+    let parsed;
+    try {
+        parsed = JSON.parse(r.stdout);
+    }
+    catch {
+        parsed = undefined;
+    }
+    if (r.code !== 0 || parsed?.is_error) {
+        const why = typeof parsed?.result === 'string' ? parsed.result : r.stderr;
+        if (/log ?in|auth|token|401|credential/i.test(why))
+            return fail(method === 'claude-token'
+                ? 'Claude rejected the token. Run claude setup-token again and paste the new token.'
+                : 'The Claude CLI is not signed in. Run claude auth login on this server, or paste a token.');
+        return fail(`The Claude CLI failed (exit ${r.code ?? 'none'}).`);
+    }
+    return ok(method === 'claude-token' ? 'Claude answered with the subscription token.' : 'Claude answered through the signed-in CLI.');
+}
+/** `codex login status` on this server: spends no usage, proves a ChatGPT login exists. */
+export async function codexLoginCheck(get) {
+    const bin = get('LOCALDOST_CODEX_BIN')?.trim() || 'codex';
+    if (!deps.which(bin))
+        return fail(`The Codex CLI ("${bin}") is not installed on this server.`);
+    const r = await deps.run(bin, ['login', 'status'], { timeoutMs: 15_000 });
+    if (r.timedOut)
+        return fail('The Codex CLI did not answer within 15 seconds.');
+    if (r.code !== 0)
+        return fail('The Codex CLI is not signed in. Run codex login on this server.');
+    const model = get('LOCALDOST_CODEX_MODEL')?.trim();
+    return ok(`The Codex CLI is signed in${model ? `; dots use ${model}` : ''}.`);
+}
+const model = {
+    key: 'model',
+    label: 'Model',
+    methods: [
+        { id: 'claude-cli', label: 'Claude subscription (signed-in CLI)', description: 'Uses the Claude CLI that is signed in on this server.' },
+        { id: 'claude-token', label: 'Claude subscription (token)', description: 'Paste the token that claude setup-token prints.' },
+        { id: 'codex-cli', label: 'Codex subscription (signed-in CLI)', description: 'Uses the Codex CLI signed in with a ChatGPT login on this server.' },
+        { id: 'anthropic', label: 'Anthropic API key', description: 'Bills the Anthropic API per token.' },
+    ],
+    fields: [
+        { key: 'ANTHROPIC_API_KEY', name: 'apiKey', label: 'API key', secret: true, kind: 'secret', methods: ['anthropic'], required: true },
+        {
+            key: 'CLAUDE_CODE_OAUTH_TOKEN',
+            name: 'oauthToken',
+            label: 'Subscription token',
+            secret: true,
+            kind: 'secret',
+            methods: ['claude-token'],
+            required: true,
+        },
+        { key: 'LOCALDOST_MODEL', name: 'model', label: 'Main model', secret: false, kind: 'text', help: 'Verdicts, reviews, and chat.' },
+        { key: 'LOCALDOST_FAST_MODEL', name: 'fastModel', label: 'Fast model', secret: false, kind: 'text', help: 'Ticket scores and action review.' },
+        {
+            key: 'LOCALDOST_CODEX_MODEL',
+            name: 'codexModel',
+            label: 'Codex model',
+            secret: false,
+            kind: 'text',
+            methods: ['codex-cli'],
+            help: 'Unset: the Codex CLI default.',
+        },
+        { key: 'LOCALDOST_LLM', name: 'backend', label: 'Backend', secret: false, kind: 'text', hidden: true },
+    ],
+    optionKinds: ['models'],
+    implied: (m) => ({ LOCALDOST_LLM: m === 'anthropic' ? 'anthropic' : m === 'codex-cli' ? 'codex-cli' : 'claude-cli' }),
+    clears: (m) => (m === 'claude-cli' ? ['CLAUDE_CODE_OAUTH_TOKEN'] : []),
+    activeMethod(get) {
+        const pick = (get('LOCALDOST_LLM') ?? '').trim().toLowerCase();
+        if (pick === 'claude-cli')
+            return get('CLAUDE_CODE_OAUTH_TOKEN') ? 'claude-token' : 'claude-cli';
+        if (pick === 'codex-cli')
+            return 'codex-cli';
+        if (pick === 'mock')
+            return undefined;
+        return pick === 'anthropic' || get('ANTHROPIC_API_KEY') ? 'anthropic' : undefined;
+    },
+    validate(values, method) {
+        if (method === 'anthropic' && values.ANTHROPIC_API_KEY && !/^sk-ant-/.test(values.ANTHROPIC_API_KEY))
+            return 'Anthropic API keys start with sk-ant-.';
+        if (method === 'claude-token' && values.CLAUDE_CODE_OAUTH_TOKEN && !/^sk-ant-/.test(values.CLAUDE_CODE_OAUTH_TOKEN))
+            return 'Subscription tokens start with sk-ant-oat. Run claude setup-token to get one.';
+        return undefined;
+    },
+    async test(get, method) {
+        const m = method ?? this.activeMethod(get);
+        if (!m)
+            return fail('No model is connected. The dots use the mock model.');
+        if (m === 'codex-cli')
+            return codexLoginCheck(get);
+        if (m !== 'anthropic')
+            return claudeRoundTrip(get, m);
+        const key = get('ANTHROPIC_API_KEY');
+        if (!key)
+            return fail('Enter an Anthropic API key.');
+        return guarded('Anthropic', async () => {
+            const { status, models } = await anthropicModels(key);
+            if (status === 401 || status === 403)
+                return fail('Anthropic rejected the API key.');
+            if (status !== 200)
+                return fail(`Anthropic answered HTTP ${status}.`);
+            const ids = new Set(models.map((x) => x.id));
+            for (const k of ['LOCALDOST_MODEL', 'LOCALDOST_FAST_MODEL']) {
+                const want = get(k)?.trim();
+                if (want && ids.size && !ids.has(want))
+                    return fail(`The model ${want} is not available to this key.`);
+            }
+            return ok(`The API key works. ${models.length} models available.`);
+        });
+    },
+    async options(kind, get) {
+        if (kind !== 'models')
+            return [];
+        const key = get('ANTHROPIC_API_KEY');
+        if (key && this.activeMethod(get) !== 'claude-cli' && this.activeMethod(get) !== 'claude-token') {
+            try {
+                const { models } = await anthropicModels(key);
+                if (models.length)
+                    return models.map((m) => ({ value: m.id, label: m.display_name ?? m.id, hint: m.id }));
+            }
+            catch {
+                /* fall through to the defaults */
+            }
+        }
+        return [
+            { value: 'sonnet', label: 'Sonnet (latest)', hint: 'Claude CLI alias' },
+            { value: 'opus', label: 'Opus (latest)', hint: 'Claude CLI alias' },
+            { value: 'haiku', label: 'Haiku (latest)', hint: 'Claude CLI alias' },
+            { value: ANALYSIS_MODEL, label: ANALYSIS_MODEL, hint: 'Default main model' },
+            { value: FAST_MODEL, label: FAST_MODEL, hint: 'Default fast model' },
+        ];
+    },
+};
+// ---------- GitHub ----------
+/** Token from the gh CLI, or undefined. The token never leaves the server. */
+export async function ghToken() {
+    if (!deps.which('gh'))
+        return undefined;
+    const r = await deps.run('gh', ['auth', 'token'], { timeoutMs: 10_000 });
+    const tok = r.code === 0 ? r.stdout.trim() : '';
+    return tok || undefined;
+}
+/**
+ * With the gh-cli method nothing is stored: the token is read from gh at start and every 30 minutes,
+ * and held as a runtime value. An env GITHUB_TOKEN still wins.
+ */
+export async function refreshGhToken() {
+    if (getMeta('github').method !== 'gh-cli')
+        return;
+    const tok = await ghToken().catch(() => undefined);
+    setRuntimeValue('GITHUB_TOKEN', tok ?? null);
+}
+let ghTimer;
+export function startGhRefresh() {
+    if (ghTimer)
+        return;
+    void refreshGhToken();
+    ghTimer = setInterval(() => void refreshGhToken(), 30 * 60_000);
+    ghTimer.unref?.();
+}
+async function githubUser(token) {
+    const res = await fetchT(`${apiBase()}/user`, { headers: ghHeaders(token) });
+    if (res.status === 401)
+        return fail('GitHub rejected the token.');
+    if (!res.ok)
+        return fail(`GitHub answered HTTP ${res.status}.`);
+    const login = String((await json(res))?.login ?? '');
+    const scopes = res.headers.get('x-oauth-scopes');
+    // Classic tokens list their scopes; fine-grained tokens send no header and are checked per repo.
+    if (scopes !== null) {
+        const list = scopes.split(',').map((s) => s.trim());
+        if (!list.includes('repo'))
+            return fail(`The token is missing the repo scope (it has: ${list.filter(Boolean).join(', ') || 'none'}).`);
+    }
+    return ok(scopes === null ? `Connected as ${login}. Fine-grained token: grant it the repos the dots watch.` : `Connected as ${login}.`, login || undefined);
+}
+async function githubApp(get) {
+    const id = get('GITHUB_APP_ID');
+    const key = get('GITHUB_PRIVATE_KEY');
+    if (!id || !key)
+        return fail('A GitHub App needs both the App id and the private key.');
+    let jwt;
+    try {
+        jwt = (await (await appAuth(id, key))({ type: 'app' })).token;
+    }
+    catch {
+        return fail('The private key could not sign a GitHub App token.');
+    }
+    const res = await fetchT(`${apiBase()}/app`, { headers: ghHeaders(jwt) });
+    if (res.status === 401)
+        return fail('GitHub rejected the App id and private key.');
+    if (!res.ok)
+        return fail(`GitHub answered HTTP ${res.status}.`);
+    const app = await json(res);
+    const inst = await fetchT(`${apiBase()}/app/installations?per_page=100`, { headers: ghHeaders(jwt) });
+    const count = inst.ok ? ((await json(inst)) ?? []).length : 0;
+    const slug = app?.slug ?? get('GITHUB_APP_SLUG');
+    const name = app?.name ?? slug ?? 'GitHub App';
+    if (!count)
+        return ok(`${name} works. Install it on the repos the dots watch.`, slug);
+    return ok(`${name} works. Installed on ${count} account${count === 1 ? '' : 's'}.`, slug);
+}
+/** A token for one repo from the credentials being tested: the PAT or gh token, or an App installation token. */
+async function repoToken(get, method, full) {
+    if (method !== 'app') {
+        const token = get('GITHUB_TOKEN');
+        if (!token)
+            throw new Error('No token to test with.');
+        return token;
+    }
+    const id = get('GITHUB_APP_ID');
+    const key = get('GITHUB_PRIVATE_KEY');
+    if (!id || !key)
+        throw new Error('A GitHub App needs both the App id and the private key.');
+    const auth = await appAuth(id, key);
+    const jwt = (await auth({ type: 'app' })).token;
+    const res = await fetchT(`${apiBase()}/repos/${full}/installation`, { headers: ghHeaders(jwt) });
+    if (!res.ok)
+        throw new Error(`The GitHub App is not installed on ${full}. An organization owner has to install it on this repo.`);
+    const inst = await json(res);
+    if (!inst?.id)
+        throw new Error(`The GitHub App is not installed on ${full}.`);
+    return (await auth({ type: 'installation', installationId: inst.id })).token;
+}
+/**
+ * The Test button of the GitHub sheet after the identity check passed (KAT-357): every repo in the workspace is read, with its
+ * issues endpoint, using the credentials in the form. A repo it cannot read, or a token that needs SAML SSO, fails the test
+ * and says which repo and why. Connect does not run this, so saving a connection never waits on a repo.
+ */
+async function withRepoChecks(base, get, method) {
+    const repos = list('repos')
+        .map((r) => r.id)
+        .slice(0, 20);
+    if (!repos.length)
+        return base;
+    const rows = await Promise.all(repos.map(async (full) => {
+        try {
+            return await checkRepoWith(full, await repoToken(get, method, full));
+        }
+        catch (err) {
+            return { repo: full, ok: false, issues: null, message: err instanceof Error ? err.message : String(err) };
+        }
+    }));
+    const summary = accessMessage(rows);
+    const bad = rows.filter((r) => !r.ok);
+    if (!bad.length)
+        return ok(`${base.message} ${summary}`, base.account);
+    return fail(`${base.message} ${summary} ${bad
+        .slice(0, 3)
+        .map((r) => `${r.repo}: ${r.message}`)
+        .join(' ')}`);
+}
+async function githubRepos(get, q) {
+    const out = [];
+    const add = (r) => {
+        if (r.full_name && (!q || r.full_name.toLowerCase().includes(q.toLowerCase())))
+            out.push({ value: r.full_name, label: r.full_name, ...(r.private ? { hint: 'private' } : {}) });
+    };
+    const id = get('GITHUB_APP_ID');
+    const key = get('GITHUB_PRIVATE_KEY');
+    if (id && key) {
+        const auth = await appAuth(id, key);
+        const jwt = (await auth({ type: 'app' })).token;
+        const inst = await fetchT(`${apiBase()}/app/installations?per_page=100`, { headers: ghHeaders(jwt) });
+        for (const i of inst.ok ? ((await json(inst)) ?? []) : []) {
+            const tok = (await auth({ type: 'installation', installationId: i.id })).token;
+            const res = await fetchT(`${apiBase()}/installation/repositories?per_page=100`, { headers: ghHeaders(tok) });
+            for (const r of res.ok ? ((await json(res))?.repositories ?? []) : [])
+                add(r);
+        }
+        return out;
+    }
+    const token = get('GITHUB_TOKEN');
+    if (!token)
+        return out;
+    const res = await fetchT(`${apiBase()}/user/repos?per_page=100&sort=pushed`, { headers: ghHeaders(token) });
+    for (const r of res.ok ? ((await json(res)) ?? []) : [])
+        add(r);
+    return out;
+}
+const APP_KEYS = ['GITHUB_APP_ID', 'GITHUB_PRIVATE_KEY', 'GITHUB_APP_SLUG'];
+const github = {
+    key: 'github',
+    label: 'GitHub',
+    methods: [
+        { id: 'gh-cli', label: 'GitHub CLI login', description: 'Uses the token of the gh CLI signed in on this server.' },
+        { id: 'app', label: 'GitHub App', description: 'localdost creates an App for you on github.com.' },
+        { id: 'pat', label: 'Personal access token', description: 'Paste a fine-grained or classic token.' },
+    ],
+    fields: [
+        { key: 'GITHUB_TOKEN', name: 'token', label: 'Token', secret: true, kind: 'secret', methods: ['pat'], required: true },
+        { key: 'GITHUB_APP_ID', name: 'appId', label: 'App id', secret: false, kind: 'text', methods: ['app'], required: true },
+        { key: 'GITHUB_PRIVATE_KEY', name: 'privateKey', label: 'Private key', secret: true, kind: 'textarea', methods: ['app'], required: true },
+        { key: 'GITHUB_APP_SLUG', name: 'appSlug', label: 'App slug', secret: false, kind: 'text', methods: ['app'] },
+        { key: 'GITHUB_WEBHOOK_SECRET', name: 'webhookSecret', label: 'Webhook secret', secret: true, kind: 'secret' },
+    ],
+    optionKinds: ['repos'],
+    clears: (m) => (m === 'app' ? ['GITHUB_TOKEN'] : m === 'gh-cli' ? [...APP_KEYS, 'GITHUB_TOKEN'] : APP_KEYS),
+    activeMethod(get) {
+        if (get('GITHUB_APP_ID') && get('GITHUB_PRIVATE_KEY'))
+            return 'app';
+        if (!get('GITHUB_TOKEN'))
+            return undefined;
+        return settingSource('GITHUB_TOKEN') !== 'env' && getMeta('github').method === 'gh-cli' ? 'gh-cli' : 'pat';
+    },
+    async resolve(method, values) {
+        if (method !== 'gh-cli')
+            return values;
+        const tok = await ghToken();
+        if (!tok)
+            throw new Error('gh is not signed in on this server. Run gh auth login there, then try again.');
+        return { ...values, GITHUB_TOKEN: tok };
+    },
+    validate(values, method) {
+        if (method === 'pat' && values.GITHUB_TOKEN && !/^(ghp_|github_pat_|gho_|ghu_)/.test(values.GITHUB_TOKEN))
+            return 'GitHub tokens start with ghp_ or github_pat_.';
+        if (values.GITHUB_APP_ID && !/^\d+$/.test(values.GITHUB_APP_ID))
+            return 'The App id is a number.';
+        return undefined;
+    },
+    async test(get, method, opts) {
+        const m = method ?? this.activeMethod(get);
+        if (!m)
+            return fail('GitHub is not connected. Comments and check runs go to the outbox.');
+        return guarded('GitHub', async () => {
+            let base;
+            if (m === 'app')
+                base = await githubApp(get);
+            else {
+                const token = get('GITHUB_TOKEN');
+                if (!token)
+                    return fail(m === 'gh-cli' ? 'gh is not signed in on this server.' : 'Enter a token.');
+                base = await githubUser(token);
+            }
+            return base.ok && opts?.checkRepos ? withRepoChecks(base, get, m) : base;
+        });
+    },
+    options: (kind, get, q) => (kind === 'repos' ? githubRepos(get, q.q) : Promise.resolve([])),
+    links(get) {
+        const slug = get('GITHUB_APP_SLUG');
+        return slug ? { install: installUrl(slug) } : {};
+    },
+    async onDisconnect() {
+        setRuntimeValue('GITHUB_TOKEN', null);
+    },
+};
+// ---------- Linear ----------
+async function linearQuery(key, query, variables) {
+    const res = await fetchT(liveEnv.LINEAR_API_URL?.trim() || 'https://api.linear.app/graphql', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', authorization: key },
+        body: JSON.stringify({ query, variables }),
+    });
+    const body = await json(res);
+    return { status: res.status, data: body?.data, error: body?.errors?.[0]?.message };
+}
+const linear = {
+    key: 'linear',
+    label: 'Linear',
+    methods: [{ id: 'api-key', label: 'API key', description: 'A personal API key from Linear settings.' }],
+    fields: [
+        { key: 'LINEAR_API_KEY', name: 'apiKey', label: 'API key', secret: true, kind: 'secret', required: true },
+        { key: 'LINEAR_WEBHOOK_SECRET', name: 'webhookSecret', label: 'Webhook secret', secret: true, kind: 'secret' },
+    ],
+    optionKinds: ['teams', 'projects'],
+    activeMethod: (get) => (get('LINEAR_API_KEY') ? 'api-key' : undefined),
+    validate: (v) => (v.LINEAR_API_KEY && !/^lin_api_/.test(v.LINEAR_API_KEY) ? 'Linear API keys start with lin_api_.' : undefined),
+    async test(get) {
+        const key = get('LINEAR_API_KEY');
+        if (!key)
+            return fail('Linear is not connected. Ticket comments go to the outbox.');
+        return guarded('Linear', async () => {
+            const r = await linearQuery(key, '{ viewer { name } organization { name } }');
+            if (r.status === 401 || r.status === 400 || !r.data?.viewer)
+                return fail(`Linear rejected the API key${r.error ? `: ${r.error}` : ''}.`);
+            const org = r.data.organization?.name;
+            return ok(`Connected as ${r.data.viewer.name ?? 'unknown'}${org ? ` in ${org}` : ''}.`, org ?? r.data.viewer.name);
+        });
+    },
+    async options(kind, get, q) {
+        const key = get('LINEAR_API_KEY');
+        if (!key)
+            return [];
+        if (kind === 'teams') {
+            const r = await linearQuery(key, '{ teams(first: 100) { nodes { id key name } } }');
+            return (r.data?.teams?.nodes ?? []).map((t) => ({ value: t.id, label: t.name, hint: t.key }));
+        }
+        if (kind === 'projects') {
+            if (q.parent) {
+                const r = await linearQuery(key, 'query($id: String!) { team(id: $id) { projects(first: 100) { nodes { id name } } } }', { id: q.parent });
+                return (r.data?.team?.projects?.nodes ?? []).map((p) => ({ value: p.id, label: p.name }));
+            }
+            const r = await linearQuery(key, '{ projects(first: 100) { nodes { id name } } }');
+            return (r.data?.projects?.nodes ?? []).map((p) => ({ value: p.id, label: p.name }));
+        }
+        return [];
+    },
+};
+// ---------- Jira ----------
+/** "acme.atlassian.net" or a full URL -> "https://acme.atlassian.net". Undefined when not a URL. */
+export function normalizeSite(v) {
+    const t = v.trim();
+    if (!t)
+        return undefined;
+    try {
+        return new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(t) ? t : `https://${t}`).origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+function jiraAuth(get) {
+    const base = get('JIRA_BASE_URL')?.replace(/\/$/, '');
+    const email = get('JIRA_EMAIL');
+    const token = get('JIRA_API_TOKEN');
+    if (!base || !email || !token)
+        return undefined;
+    return { base, headers: { Authorization: `Basic ${Buffer.from(`${email}:${token}`).toString('base64')}`, Accept: 'application/json' } };
+}
+const jira = {
+    key: 'jira',
+    label: 'Jira',
+    methods: [{ id: 'api-token', label: 'API token', description: 'An Atlassian API token for the account the dots comment as.' }],
+    fields: [
+        { key: 'JIRA_BASE_URL', name: 'baseUrl', label: 'Site', secret: false, kind: 'url', required: true },
+        { key: 'JIRA_EMAIL', name: 'email', label: 'Email', secret: false, kind: 'email', required: true },
+        { key: 'JIRA_API_TOKEN', name: 'apiToken', label: 'API token', secret: true, kind: 'secret', required: true },
+        { key: 'JIRA_WEBHOOK_SECRET', name: 'webhookSecret', label: 'Webhook secret', secret: true, kind: 'secret' },
+    ],
+    optionKinds: ['projects'],
+    activeMethod: (get) => (get('JIRA_BASE_URL') && get('JIRA_EMAIL') && get('JIRA_API_TOKEN') ? 'api-token' : undefined),
+    validate(values) {
+        if (values.JIRA_BASE_URL !== undefined) {
+            const site = normalizeSite(values.JIRA_BASE_URL);
+            if (!site)
+                return 'Enter a site address such as acme.atlassian.net.';
+            if (!site.startsWith('https://'))
+                return 'Jira sites use https.';
+            values.JIRA_BASE_URL = site;
+        }
+        if (values.JIRA_EMAIL !== undefined && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(values.JIRA_EMAIL.trim()))
+            return 'Enter a valid email.';
+        return undefined;
+    },
+    async test(get) {
+        const a = jiraAuth(get);
+        if (!a)
+            return fail('Jira needs the site, the email, and an API token.');
+        return guarded('Jira', async () => {
+            const res = await fetchT(`${a.base}/rest/api/3/myself`, { headers: a.headers });
+            if (res.status === 401 || res.status === 403)
+                return fail('Jira rejected the email and API token.');
+            if (!res.ok)
+                return fail(`Jira answered HTTP ${res.status}.`);
+            const me = await json(res);
+            const host = new URL(a.base).host;
+            return ok(`Connected to ${host} as ${me?.displayName ?? 'unknown'}.`, host);
+        });
+    },
+    async options(kind, get) {
+        const a = jiraAuth(get);
+        if (kind !== 'projects' || !a)
+            return [];
+        const res = await fetchT(`${a.base}/rest/api/3/project/search?maxResults=100&orderBy=name`, { headers: a.headers });
+        const body = res.ok ? await json(res) : undefined;
+        return (body?.values ?? []).map((p) => ({ value: p.key, label: p.name, hint: p.key }));
+    },
+};
+// ---------- Slack ----------
+/**
+ * Scopes and events for docs/SLACK.md: answer mentions, post notices, list channels for the picker. Interactivity
+ * carries Approve and Reject on a dot's decision message over Socket Mode; the Messages tab holds direct-message updates.
+ */
+export function slackManifest(name = 'localdost') {
+    return {
+        display_information: { name, description: 'Always-on QA agents. Mention the bot to ask a dot.' },
+        features: { bot_user: { display_name: name, always_online: true }, app_home: { messages_tab_enabled: true, messages_tab_read_only_enabled: true } },
+        oauth_config: { scopes: { bot: ['app_mentions:read', 'chat:write', 'channels:read', 'groups:read'] } },
+        settings: {
+            event_subscriptions: { bot_events: ['app_mention'] },
+            interactivity: { is_enabled: true },
+            org_deploy_enabled: false,
+            socket_mode_enabled: true,
+            token_rotation_enabled: false,
+        },
+    };
+}
+export function slackCreateUrl(manifest = slackManifest()) {
+    return `https://api.slack.com/apps?new_app=1&manifest_json=${encodeURIComponent(JSON.stringify(manifest))}`;
+}
+const slackApi = () => (liveEnv.SLACK_API_URL ?? 'https://slack.com/api').replace(/\/$/, '');
+async function slackCall(method, token, params = {}) {
+    const res = await fetchT(`${slackApi()}/${method}`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams(params).toString(),
+    });
+    return ((await json(res)) ?? { ok: false, error: `HTTP ${res.status}` });
+}
+const SLACK_CHANNEL_PAGES = 20;
+const SLACK_CHANNEL_TTL_MS = 5 * 60_000;
+let slackChannelCache;
+/**
+ * Every channel the bot can see, for the picker. The picker searches only what it loaded, and a large
+ * workspace has thousands of channels, so this pages through conversations.list (1,000 a page, 20 pages
+ * at most) instead of stopping at the first page. Channels the bot is in come first. Cached for 5 minutes
+ * per bot token, so typing in the picker does not hit Slack's rate limit. A page that fails rejects the whole load.
+ */
+export async function slackChannelOptions(bot, now = Date.now()) {
+    const cached = slackChannelCache && slackChannelCache.bot === bot && now - slackChannelCache.at < SLACK_CHANNEL_TTL_MS;
+    const options = cached ? slackChannelCache.options : await listSlackChannels(bot, now);
+    // Channels where the bot was mentioned, which a list without groups:read leaves out (private ones).
+    // Read on every call, so a new mention shows at once even while the Slack list is cached.
+    const listed = new Set(options.map((o) => o.value));
+    const seen = (getMeta('slack').seenChannels ?? []).filter((c) => !listed.has(c.id));
+    return [...seen.map((c) => ({ value: c.id, label: c.name ? `#${c.name}` : c.id, hint: 'bot was mentioned here' })), ...options];
+}
+async function listSlackChannels(bot, now) {
+    const all = [];
+    let cursor = '';
+    for (let page = 0; page < SLACK_CHANNEL_PAGES; page++) {
+        const r = await slackCall('conversations.list', bot, {
+            types: 'public_channel,private_channel',
+            exclude_archived: 'true',
+            limit: '1000',
+            ...(cursor ? { cursor } : {}),
+        });
+        // A failed page on any request is an error, never a shorter list: a partial list would hide the channels
+        // on later pages with no explanation (KAT-236). Nothing is cached, so the next open reads every page.
+        if (r.ok === false)
+            throw new Error(`Slack answered ${r.error ?? 'an error'}`);
+        all.push(...(r.channels ?? []));
+        cursor = r.response_metadata?.next_cursor ?? '';
+        if (!cursor)
+            break;
+    }
+    const options = all
+        .sort((a, b) => Number(!!b.is_member) - Number(!!a.is_member) || a.name.localeCompare(b.name))
+        .map((c) => {
+        const hint = [c.is_private ? 'private' : '', c.is_member ? 'bot is in it' : ''].filter(Boolean).join(', ');
+        return { value: c.id, label: `#${c.name}`, ...(hint ? { hint } : {}) };
+    });
+    slackChannelCache = { bot, at: now, options };
+    return options;
+}
+/** Test hook: forget the cached channel list. */
+export function resetSlackChannelCache() {
+    slackChannelCache = undefined;
+}
+const slack = {
+    key: 'slack',
+    label: 'Slack',
+    methods: [{ id: 'socket', label: 'Socket Mode app', description: 'A Slack app from the manifest. No public URL needed.' }],
+    fields: [
+        { key: 'SLACK_BOT_TOKEN', name: 'botToken', label: 'Bot token', secret: true, kind: 'secret', required: true },
+        { key: 'SLACK_APP_TOKEN', name: 'appToken', label: 'App-level token', secret: true, kind: 'secret', required: true },
+        { key: 'SLACK_ALLOWED_TEAM', name: 'allowedTeam', label: 'Allowed workspace ids', secret: false, kind: 'text' },
+        { key: 'SLACK_ALLOWED_USERS', name: 'allowedUsers', label: 'Allowed user ids', secret: false, kind: 'text' },
+    ],
+    optionKinds: ['channels'],
+    activeMethod: (get) => (get('SLACK_BOT_TOKEN') && get('SLACK_APP_TOKEN') ? 'socket' : undefined),
+    validate(v) {
+        if (v.SLACK_BOT_TOKEN && !/^xoxb-/.test(v.SLACK_BOT_TOKEN))
+            return 'Bot tokens start with xoxb-.';
+        if (v.SLACK_APP_TOKEN && !/^xapp-/.test(v.SLACK_APP_TOKEN))
+            return 'App-level tokens start with xapp-.';
+        return undefined;
+    },
+    async test(get) {
+        const bot = get('SLACK_BOT_TOKEN');
+        const appTok = get('SLACK_APP_TOKEN');
+        if (!bot || !appTok)
+            return fail('Slack needs the bot token and the app-level token.');
+        return guarded('Slack', async () => {
+            const who = await slackCall('auth.test', bot);
+            if (!who.ok)
+                return fail(`Slack rejected the bot token (${who.error ?? 'unknown error'}).`);
+            const open = await slackCall('apps.connections.open', appTok);
+            if (!open.ok || !open.url)
+                return fail(`Slack rejected the app-level token (${open.error ?? 'no socket URL'}). It needs the connections:write scope.`);
+            if (!(await deps.socketHello(open.url, 8000)))
+                return fail('Slack gave a socket URL, but the socket did not say hello. Check that Socket Mode is on.');
+            return ok(`Connected to ${who.team ?? 'the workspace'} as @${who.user ?? 'bot'}. Socket Mode answered.`, who.team);
+        });
+    },
+    async options(kind, get) {
+        const bot = get('SLACK_BOT_TOKEN');
+        if (kind !== 'channels' || !bot)
+            return [];
+        return slackChannelOptions(bot);
+    },
+    links: () => ({ createApp: slackCreateUrl() }),
+};
+// ---------- Voice ----------
+const voice = {
+    key: 'voice',
+    label: 'Voice',
+    methods: [{ id: 'openai', label: 'OpenAI Realtime', description: 'Realtime voice calls with a dot.' }],
+    fields: [{ key: 'OPENAI_API_KEY', name: 'apiKey', label: 'API key', secret: true, kind: 'secret', required: true }],
+    activeMethod: (get) => (get('OPENAI_API_KEY') ? 'openai' : undefined),
+    validate: (v) => (v.OPENAI_API_KEY && !/^sk-/.test(v.OPENAI_API_KEY) ? 'OpenAI API keys start with sk-.' : undefined),
+    async test(get) {
+        const key = get('OPENAI_API_KEY');
+        if (!key)
+            return fail('Voice uses browser speech. Connect OpenAI for realtime voice.');
+        return guarded('OpenAI', async () => {
+            const res = await fetchT('https://api.openai.com/v1/models', { headers: { Authorization: `Bearer ${key}` } });
+            if (res.status === 401 || res.status === 403)
+                return fail('OpenAI rejected the API key.');
+            if (!res.ok)
+                return fail(`OpenAI answered HTTP ${res.status}.`);
+            return ok(config.token
+                ? 'The OpenAI key works. Calls use realtime voice.'
+                : 'The OpenAI key works. Realtime voice turns on once LOCALDOST_TOKEN is set; until then calls use browser speech.');
+        });
+    },
+};
+// ---------- AI-Vision ----------
+/** http or https origin plus path, no trailing slash, no credentials. Undefined for anything else. */
+function aivisionUrl(raw) {
+    try {
+        const u = new URL((raw ?? '').trim());
+        if ((u.protocol !== 'http:' && u.protocol !== 'https:') || u.username || u.password)
+            return undefined;
+        return `${u.origin}${u.pathname.replace(/\/+$/, '')}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+const aivision = {
+    key: 'aivision',
+    label: 'AI-Vision',
+    methods: [{ id: 'server', label: 'AI-Vision server', description: 'Runs vision tests that check what a user sees.' }],
+    fields: [
+        {
+            key: 'AIVISION_SERVER_URL',
+            name: 'serverUrl',
+            label: 'Server address',
+            secret: false,
+            kind: 'url',
+            required: true,
+            help: 'For example http://localhost:5880.',
+        },
+        {
+            key: 'AIVISION_INTERNAL_TOKEN',
+            name: 'token',
+            label: 'Access token',
+            secret: true,
+            kind: 'secret',
+            help: 'Only when the server asks for sign-in.',
+        },
+        {
+            key: 'AIVISION_CHECKOUT',
+            name: 'checkout',
+            label: 'AI-Vision folder',
+            secret: false,
+            kind: 'text',
+            help: 'Where AI-Vision is installed on this machine. Lets dots use its tools in chat.',
+        },
+    ],
+    detected: async () => detectedActive(),
+    activeMethod: (get) => (get('AIVISION_SERVER_URL') ? 'server' : undefined),
+    validate(values) {
+        if (values.AIVISION_SERVER_URL !== undefined) {
+            const url = aivisionUrl(values.AIVISION_SERVER_URL);
+            if (!url)
+                return 'Enter an http or https URL without a user name or password.';
+            values.AIVISION_SERVER_URL = url;
+        }
+        if (values.AIVISION_CHECKOUT && !path.isAbsolute(values.AIVISION_CHECKOUT))
+            return 'The checkout path must be absolute.';
+        return undefined;
+    },
+    async test(get) {
+        const url = aivisionUrl(get('AIVISION_SERVER_URL'));
+        if (!url)
+            return fail('Enter the AI-Vision server address.');
+        const checkout = get('AIVISION_CHECKOUT')?.trim();
+        if (checkout && !existsSync(path.join(checkout, 'apps/playground/demo/veesan-mcp.mts')))
+            return fail(`${checkout} is not an AI-Vision folder.`);
+        // The token goes through the one gate (KAT-119). A token typed in this form is bound to the
+        // address under test; a saved token (an empty field) only to the origin it was saved for.
+        const typed = get.fromForm?.(TOKEN_KEY) ? get(TOKEN_KEY) : undefined;
+        const token = typed ? aivisionTokenFor(url, [{ token: typed, origin: originOf(url) }]) : aivisionTokenFor(url);
+        const withheld = typed ? undefined : tokenWithheldReason(url);
+        return guarded('the AI-Vision server', async () => {
+            // No redirects: the token header would follow to a host the user did not enter.
+            const res = await fetchT(`${url}/aivision/tests`, { headers: token ? { 'x-veesan-internal': token } : {}, redirect: 'manual' });
+            if (res.status >= 300 && res.status < 400)
+                return fail(`The AI-Vision server answered with a redirect (HTTP ${res.status}). Enter the address it redirects to.`);
+            if (res.status === 401 || res.status === 403)
+                return fail(`The AI-Vision server asked for sign-in. ${withheld ?? 'Add an access token.'}`);
+            if (!res.ok)
+                return fail(`The AI-Vision server answered HTTP ${res.status}.`);
+            const body = await json(res);
+            if (!Array.isArray(body?.tests))
+                return fail(`${new URL(url).origin} answered, but not like an AI-Vision server.`);
+            return ok(`The AI-Vision server answered with ${body.tests.length} test${body.tests.length === 1 ? '' : 's'}.`, new URL(url).host);
+        });
+    },
+};
+// ---------- Public URL ----------
+async function reachable(url) {
+    const headers = config.token ? { Authorization: `Bearer ${config.token}` } : {};
+    let last = 'no answer';
+    for (let attempt = 0; attempt < 3; attempt++) {
+        if (attempt)
+            await deps.sleep(2000);
+        try {
+            const res = await fetchT(`${url.replace(/\/$/, '')}/api/setup`, { headers }, 8000);
+            const body = (await json(res)) ?? {};
+            if (res.ok && body.services)
+                return ok(`${new URL(url).origin} reaches this server.`, new URL(url).origin);
+            // Without LOCALDOST_TOKEN the API refuses a foreign Host: that answer still proves the URL reaches localdost.
+            if (res.status === 403 && /localhost only/.test(body.error ?? ''))
+                return ok(`${new URL(url).origin} reaches this server. The API stays closed to it until LOCALDOST_TOKEN is set. Webhooks need their secrets (GITHUB_WEBHOOK_SECRET, JIRA_WEBHOOK_SECRET, LINEAR_WEBHOOK_SECRET).`, new URL(url).origin);
+            last = `HTTP ${res.status}`;
+        }
+        catch (err) {
+            last = errText(err);
+        }
+    }
+    return fail(`${url} does not reach this server (${last}).`);
+}
+const publicUrl = {
+    key: 'publicUrl',
+    label: 'Public URL',
+    methods: [
+        { id: 'tunnel', label: 'Quick tunnel', description: 'Starts a free cloudflared tunnel. The address changes on every restart.' },
+        { id: 'url', label: 'Your own URL', description: 'The HTTPS address of a reverse proxy or a deployed server.' },
+    ],
+    fields: [{ key: 'LOCALDOST_PUBLIC_URL', name: 'url', label: 'Public URL', secret: false, kind: 'url', methods: ['url'], required: true }],
+    activeMethod(get) {
+        if (tunnelState().running && settingSource('LOCALDOST_PUBLIC_URL') !== 'env')
+            return 'tunnel';
+        return get('LOCALDOST_PUBLIC_URL') ? 'url' : undefined;
+    },
+    validate(v) {
+        if (v.LOCALDOST_PUBLIC_URL === undefined)
+            return undefined;
+        let u;
+        try {
+            u = new URL(v.LOCALDOST_PUBLIC_URL.trim());
+        }
+        catch {
+            return 'Enter a full address, for example https://qa.example.com.';
+        }
+        if (u.protocol !== 'https:' && u.hostname !== 'localhost' && u.hostname !== '127.0.0.1')
+            return 'Use https. Push and webhooks need it.';
+        v.LOCALDOST_PUBLIC_URL = `${u.origin}${u.pathname.replace(/\/+$/, '')}`;
+        return undefined;
+    },
+    async test(get) {
+        const url = get('LOCALDOST_PUBLIC_URL');
+        if (!url)
+            return fail('No public URL. Links in comments and pushes have no run page.');
+        return reachable(url);
+    },
+    async onDisconnect() {
+        await stopTunnel();
+    },
+};
+// ---------- Sandbox and push ----------
+async function dockerWithRetry() {
+    let r = { ok: false };
+    for (let i = 0; i < 3; i++) {
+        if (i)
+            await deps.sleep(1000);
+        r = await deps.dockerPing();
+        if (r.ok)
+            return r;
+    }
+    return r;
+}
+const sandbox = {
+    key: 'sandbox',
+    label: 'Docker runner',
+    methods: [{ id: 'docker', label: 'Docker', description: 'Runs tests in containers when Docker answers.' }],
+    fields: [],
+    activeMethod: () => 'docker',
+    async test() {
+        const r = await dockerWithRetry();
+        return r.ok
+            ? ok(`${r.detail ?? 'Docker'} is reachable. Runner mode docker is available.`, r.detail)
+            : fail(`Docker is not reachable (${r.detail ?? 'no answer'}). Start Docker, then retry.`);
+    },
+    detected: async () => (await deps.dockerPing()).ok,
+};
+const vapidFile = () => existsSync(path.join(config.dataDir, 'vapid.json'));
+const push = {
+    key: 'push',
+    label: 'Push',
+    methods: [{ id: 'web-push', label: 'Web push', description: 'Keys are made on first start.' }],
+    fields: [],
+    activeMethod: () => 'web-push',
+    async test(get) {
+        if ((get('VAPID_PUBLIC_KEY') && get('VAPID_PRIVATE_KEY')) || vapidFile())
+            return ok('Web push keys are ready. Turn on alerts per device in Settings.');
+        if (get('NTFY_TOPIC'))
+            return ok('ntfy is set. Web push keys are made on first start.');
+        return fail('Web push keys are made on first start. Restart the server once.');
+    },
+    detected: async () => vapidFile(),
+};
+/** Server order, same as GET /api/setup. */
+export const PROVIDERS = [model, github, jira, linear, slack, push, publicUrl, sandbox, voice, aivision];
+export function providerFor(key) {
+    return PROVIDERS.find((p) => p.key === key);
+}
+/** Live value of a setting, for code that cannot import config (kept for symmetry with Getter). */
+export const live = (k) => setting(k);
+//# sourceMappingURL=providers.js.map