wtt-connect 0.1.0

package/src/service-manager.js

@@ -0,0 +1,510 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { normalizeAdapterName } from './adapters/index.js';
+
+const DEFAULT_BASE_URL = 'https://www.waxbyte.com';
+const DEFAULT_MODE = 'full-auto';
+const VALID_MODES = new Set(['suggest', 'auto-edit', 'full-auto', 'yolo']);
+
+export function resolveProfileEnvFile(profile) {
+  if (!profile) return '';
+  return profileEnvFile(sanitizeProfile(profile));
+}
+
+export async function up(argv) {
+  const [agentType, agentId, token] = argv._ || [];
+  const adapter = normalizeAdapterName(argv.adapter || agentType || '');
+  if (!adapter || !agentId || !token) {
+    throw new Error('usage: wtt-connect up <agenttype> <agent_id> <token> [--mode full-auto|auto-edit|suggest|yolo]');
+  }
+
+  const profile = sanitizeProfile(argv.profile || argv.name || `${agentId}-${adapter}`);
+  const mode = argv.mode || process.env.WTT_CONNECT_MODE || DEFAULT_MODE;
+  if (!VALID_MODES.has(mode)) throw new Error(`invalid --mode: ${mode}`);
+  if (mode === 'yolo' && !argv.allowYolo && !argv.yes) {
+    throw new Error('--mode yolo requires --allow-yolo or --yes');
+  }
+
+  const configDir = profilesDir();
+  const stateDir = path.resolve(argv.stateDir || defaultStateDir(profile));
+  const envFile = path.resolve(argv.envFile || profileEnvFile(profile));
+  const root = packageRoot();
+  const workDir = path.resolve(argv.workdir || argv.workDir || process.cwd());
+  const baseUrl = argv.baseUrl || process.env.WTT_BASE_URL || DEFAULT_BASE_URL;
+  const nodeBin = argv.nodeBin || process.execPath;
+  const codexBin = argv.codexBin || findBinary('codex');
+  const claudeBin = argv.claudeBin || findBinary('claude');
+
+  ensureSupportedPlatform();
+  ensureDir(configDir);
+  ensureDir(path.dirname(envFile));
+  ensureDir(stateDir);
+
+  const profileValues = {
+    WTT_BASE_URL: baseUrl,
+    WTT_AGENT_ID: agentId,
+    WTT_TOKEN: token,
+    WTT_CONNECT_ADAPTER: adapter,
+    WTT_CONNECT_ADAPTERS: adapter,
+    WTT_CONNECT_WORKDIR: workDir,
+    WTT_CONNECT_MODE: mode,
+    WTT_CONNECT_ALLOW_YOLO: mode === 'yolo' || argv.allowYolo || argv.yes ? '1' : '',
+    WTT_CONNECT_ENABLE_CHAT: '1',
+    WTT_CONNECT_PUBLISH_PROGRESS: argv.publishProgress ? '1' : '0',
+    WTT_CONNECT_TASK_TIMEOUT_SECONDS: String(argv.timeoutSeconds || (argv.timeout ? Math.round(argv.timeout / 1000) : 3600)),
+    WTT_CONNECT_STATE_DIR: stateDir,
+    WTT_REQUIRE_COMMIT_PUSH: '1',
+    WTT_CODEX_BIN: codexBin,
+    WTT_CLAUDE_BIN: claudeBin,
+  };
+  writeProfileEnv(envFile, {
+    ...profileValues,
+    ...passthroughEnv(process.env, new Set(Object.keys(profileValues))),
+  });
+
+  const service = installService({ profile, envFile, nodeBin, root, stateDir });
+  if (!argv.noStart) startService(profile);
+  if (argv.enableLinger && process.platform === 'linux') enableLinger();
+  if (argv.enableLinger && process.platform === 'darwin') {
+    console.warn('warning: --enable-linger is Linux-only; macOS LaunchAgents start at user login');
+  }
+
+  console.log(`profile: ${profile}`);
+  console.log(`env file: ${envFile}`);
+  console.log(`state dir: ${stateDir}`);
+  console.log(`service: ${service.name}`);
+  console.log(`${service.kind} file: ${service.path}`);
+  if (!argv.noStart) status({ _: [profile] });
+}
+
+export function listProfiles() {
+  const dir = profilesDir();
+  if (!fs.existsSync(dir)) {
+    console.log('no profiles');
+    return;
+  }
+  const files = fs.readdirSync(dir).filter((f) => f.endsWith('.env')).sort();
+  if (!files.length) {
+    console.log('no profiles');
+    return;
+  }
+  for (const file of files) {
+    const profile = file.slice(0, -4);
+    const env = readEnv(path.join(dir, file));
+    console.log(`${profile}\t${env.WTT_CONNECT_ADAPTER || ''}\t${env.WTT_AGENT_ID || ''}`);
+  }
+}
+
+export function status(argv) {
+  const profiles = targetProfiles(argv);
+  if (!profiles.length) {
+    console.log('no profiles');
+    return;
+  }
+  for (const profile of profiles) {
+    console.log(`${profile}: ${serviceStatus(profile)}`);
+  }
+}
+
+export function restart(argv) {
+  const profiles = targetProfiles(argv);
+  for (const profile of profiles) restartService(profile);
+  status({ _: profiles });
+}
+
+export function logs(argv) {
+  const [profile = ''] = argv._ || [];
+  if (!profile) throw new Error('usage: wtt-connect logs <profile> [--lines 100]');
+  const lines = String(argv.lines || 100);
+  if (process.platform === 'linux') {
+    const result = spawnSync('journalctl', ['--user', '-u', unitName(sanitizeProfile(profile)), '-n', lines, '--no-pager'], {
+      stdio: 'inherit',
+    });
+    if (result.status !== 0) process.exitCode = result.status || 1;
+    return;
+  }
+  if (process.platform === 'darwin') {
+    const safe = sanitizeProfile(profile);
+    const files = [launchdLogPath(safe, 'out'), launchdLogPath(safe, 'err')].filter((f) => fs.existsSync(f));
+    if (!files.length) {
+      console.log(`no launchd logs found for ${safe}`);
+      return;
+    }
+    const result = spawnSync('tail', ['-n', lines, ...files], { stdio: 'inherit' });
+    if (result.status !== 0) process.exitCode = result.status || 1;
+    return;
+  }
+  throw new Error(`unsupported platform: ${process.platform}`);
+}
+
+export function down(argv) {
+  const [profile = ''] = argv._ || [];
+  if (!profile) throw new Error('usage: wtt-connect down <profile>');
+  const safe = sanitizeProfile(profile);
+  stopAndDisableService(safe);
+  const servicePath = serviceFilePath(safe);
+  if (fs.existsSync(servicePath)) fs.rmSync(servicePath);
+  if (process.platform === 'linux') runSystemctl(['daemon-reload']);
+  console.log(`removed service: ${serviceName(safe)}`);
+  console.log(`kept profile env: ${profileEnvFile(safe)}`);
+  console.log(`kept state dir: ${defaultStateDir(safe)}`);
+}
+
+function targetProfiles(argv) {
+  const requested = argv._ || [];
+  if (requested.length && requested[0] !== 'all') return requested.map(sanitizeProfile);
+  const profiles = discoverProfiles();
+  if (!profiles.length && requested[0] === 'all') return [];
+  if (!profiles.length) throw new Error('no wtt-connect profiles found');
+  return profiles;
+}
+
+function discoverProfiles() {
+  const dir = profilesDir();
+  if (!fs.existsSync(dir)) return [];
+  return fs.readdirSync(dir).filter((f) => f.endsWith('.env')).map((f) => sanitizeProfile(f.slice(0, -4))).sort();
+}
+
+function writeProfileEnv(file, values) {
+  const lines = [
+    '# wtt-connect profile',
+    '# Keep this file local; it contains agent secrets.',
+  ];
+  for (const [key, value] of Object.entries(values)) {
+    if (value === undefined || value === null || value === '') continue;
+    lines.push(`${key}=${quoteEnv(value)}`);
+  }
+  fs.writeFileSync(file, `${lines.join('\n')}\n`, { mode: 0o600 });
+  fs.chmodSync(file, 0o600);
+}
+
+function installService(options) {
+  if (process.platform === 'linux') return installSystemdService(options);
+  if (process.platform === 'darwin') return installLaunchdService(options);
+  throw new Error(`unsupported platform: ${process.platform}`);
+}
+
+function startService(profile) {
+  if (process.platform === 'linux') {
+    runSystemctl(['daemon-reload']);
+    runSystemctl(['enable', unitName(profile)]);
+    runSystemctl(['restart', unitName(profile)]);
+    return;
+  }
+  if (process.platform === 'darwin') {
+    const plist = launchdPlistPath(profile);
+    const label = launchdLabel(profile);
+    runLaunchctl(['bootout', launchdTarget(), plist], { check: false });
+    runLaunchctl(['bootstrap', launchdTarget(), plist]);
+    runLaunchctl(['enable', `${launchdTarget()}/${label}`], { check: false });
+    runLaunchctl(['kickstart', '-k', `${launchdTarget()}/${label}`], { check: false });
+    return;
+  }
+  throw new Error(`unsupported platform: ${process.platform}`);
+}
+
+function restartService(profile) {
+  if (process.platform === 'linux') {
+    runSystemctl(['restart', unitName(profile)]);
+    return;
+  }
+  if (process.platform === 'darwin') {
+    const label = launchdLabel(profile);
+    const kick = runLaunchctl(['kickstart', '-k', `${launchdTarget()}/${label}`], { check: false });
+    if (kick.status !== 0) startService(profile);
+    return;
+  }
+  throw new Error(`unsupported platform: ${process.platform}`);
+}
+
+function stopAndDisableService(profile) {
+  if (process.platform === 'linux') {
+    runSystemctl(['disable', '--now', unitName(profile)], { check: false });
+    return;
+  }
+  if (process.platform === 'darwin') {
+    const plist = launchdPlistPath(profile);
+    const label = launchdLabel(profile);
+    runLaunchctl(['disable', `${launchdTarget()}/${label}`], { check: false });
+    runLaunchctl(['bootout', launchdTarget(), plist], { check: false });
+    runLaunchctl(['remove', label], { check: false });
+    return;
+  }
+  throw new Error(`unsupported platform: ${process.platform}`);
+}
+
+function serviceStatus(profile) {
+  if (process.platform === 'linux') {
+    const result = runSystemctl(['is-active', unitName(profile)], { check: false });
+    return String(result.stdout || result.stderr).trim() || 'unknown';
+  }
+  if (process.platform === 'darwin') {
+    const result = runLaunchctl(['print', `${launchdTarget()}/${launchdLabel(profile)}`], { check: false });
+    if (result.status !== 0) return 'inactive';
+    const output = result.stdout || '';
+    const state = output.match(/\bstate = ([^\n]+)/)?.[1]?.trim();
+    const pid = output.match(/\bpid = (\d+)/)?.[1]?.trim();
+    return pid ? `${state || 'running'} pid=${pid}` : (state || 'loaded');
+  }
+  throw new Error(`unsupported platform: ${process.platform}`);
+}
+
+function installSystemdService({ profile, envFile, nodeBin, root }) {
+  const servicePath = systemdServicePath(profile);
+  ensureDir(path.dirname(servicePath));
+  const nodeArgs = nodeMajor(nodeBin) < 22 ? ' --experimental-websocket' : '';
+  const bin = path.join(root, 'bin', 'wtt-connect.js');
+  const pathEnv = runtimePath();
+  const content = `[Unit]
+Description=WTT Connect Agent (${profile})
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=${root}
+Environment=PATH=${pathEnv}
+EnvironmentFile=${envFile}
+ExecStart=${nodeBin}${nodeArgs} ${bin} start --profile ${profile}
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+`;
+  fs.writeFileSync(servicePath, content, { mode: 0o644 });
+  return { kind: 'systemd', name: unitName(profile), path: servicePath };
+}
+
+function installLaunchdService({ profile, nodeBin, root, stateDir }) {
+  const plistPath = launchdPlistPath(profile);
+  ensureDir(path.dirname(plistPath));
+  ensureDir(path.dirname(launchdLogPath(profile, 'out')));
+  const nodeArgs = nodeMajor(nodeBin) < 22 ? ['--experimental-websocket'] : [];
+  const bin = path.join(root, 'bin', 'wtt-connect.js');
+  const args = [nodeBin, ...nodeArgs, bin, 'start', '--profile', profile];
+  const content = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${xmlEscape(launchdLabel(profile))}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args.map((arg) => `    <string>${xmlEscape(arg)}</string>`).join('\n')}
+  </array>
+  <key>WorkingDirectory</key>
+  <string>${xmlEscape(root)}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>${xmlEscape(runtimePath())}</string>
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${xmlEscape(launchdLogPath(profile, 'out'))}</string>
+  <key>StandardErrorPath</key>
+  <string>${xmlEscape(launchdLogPath(profile, 'err'))}</string>
+</dict>
+</plist>
+`;
+  ensureDir(stateDir);
+  fs.writeFileSync(plistPath, content, { mode: 0o644 });
+  return { kind: 'launchd', name: launchdLabel(profile), path: plistPath };
+}
+
+function ensureSupportedPlatform() {
+  if (process.platform === 'linux') {
+    const result = spawnSync('systemctl', ['--user', 'is-system-running'], { encoding: 'utf8' });
+    if (result.error) throw new Error('systemctl --user is required but was not found');
+    return;
+  }
+  if (process.platform === 'darwin') {
+    const result = spawnSync('launchctl', ['version'], { encoding: 'utf8' });
+    if (result.error) throw new Error('launchctl is required but was not found');
+    return;
+  }
+  throw new Error(`unsupported platform: ${process.platform}`);
+}
+
+function runSystemctl(args, options = {}) {
+  const result = spawnSync('systemctl', ['--user', ...args], { encoding: 'utf8' });
+  if (result.status !== 0 && options.check !== false) {
+    throw new Error(`systemctl --user ${args.join(' ')} failed: ${result.stderr || result.stdout}`);
+  }
+  return result;
+}
+
+function runLaunchctl(args, options = {}) {
+  const result = spawnSync('launchctl', args, { encoding: 'utf8' });
+  if (result.status !== 0 && options.check !== false) {
+    throw new Error(`launchctl ${args.join(' ')} failed: ${result.stderr || result.stdout}`);
+  }
+  return result;
+}
+
+function enableLinger() {
+  const result = spawnSync('loginctl', ['enable-linger', os.userInfo().username], { encoding: 'utf8' });
+  if (result.status !== 0) console.warn(`warning: failed to enable linger: ${result.stderr || result.stdout}`);
+}
+
+function readEnv(file) {
+  const env = {};
+  if (!fs.existsSync(file)) return env;
+  for (const raw of fs.readFileSync(file, 'utf8').split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith('#') || !line.includes('=')) continue;
+    const idx = line.indexOf('=');
+    env[line.slice(0, idx)] = line.slice(idx + 1).replace(/^['"]|['"]$/g, '');
+  }
+  return env;
+}
+
+function quoteEnv(value) {
+  return `"${String(value).replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\$/g, '\\$')}"`;
+}
+
+function passthroughEnv(env, existingKeys) {
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (!value || existingKeys.has(key)) continue;
+    if (shouldPreserveEnvKey(key)) out[key] = value;
+  }
+  return out;
+}
+
+function shouldPreserveEnvKey(key) {
+  return (
+    key === 'HTTP_PROXY' ||
+    key === 'HTTPS_PROXY' ||
+    key === 'ALL_PROXY' ||
+    key === 'NO_PROXY' ||
+    key === 'DISABLE_TELEMETRY' ||
+    key === 'DISABLE_COST_WARNINGS' ||
+    key === 'API_TIMEOUT_MS' ||
+    key.startsWith('WTT_CONNECT_AGENT_') ||
+    key.startsWith('WTT_CONNECT_STT_') ||
+    key.startsWith('WTT_CONNECT_TTS_') ||
+    key.startsWith('WTT_CONNECT_CLAUDE_') ||
+    key.startsWith('WTT_CONNECT_CODEX_') ||
+    key.startsWith('ANTHROPIC_') ||
+    key.startsWith('OPENAI_') ||
+    key.startsWith('CLAUDE_CODE_')
+  );
+}
+
+function sanitizeProfile(value) {
+  const safe = String(value || '').trim().replace(/[^A-Za-z0-9_.@-]+/g, '-').replace(/^-+|-+$/g, '');
+  if (!safe) throw new Error('invalid profile name');
+  return safe;
+}
+
+function profilesDir() {
+  return path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'), 'wtt-connect', 'profiles');
+}
+
+function profileEnvFile(profile) {
+  return path.join(profilesDir(), `${profile}.env`);
+}
+
+function defaultStateDir(profile) {
+  return path.join(process.env.XDG_STATE_HOME || path.join(os.homedir(), '.local', 'state'), 'wtt-connect', profile);
+}
+
+function systemdServicePath(profile) {
+  return path.join(os.homedir(), '.config', 'systemd', 'user', unitName(profile));
+}
+
+function unitName(profile) {
+  return `wtt-connect@${profile}.service`;
+}
+
+function serviceName(profile) {
+  if (process.platform === 'darwin') return launchdLabel(profile);
+  return unitName(profile);
+}
+
+function serviceFilePath(profile) {
+  if (process.platform === 'darwin') return launchdPlistPath(profile);
+  return systemdServicePath(profile);
+}
+
+function launchdLabel(profile) {
+  return `com.wtt.connect.${profile}`;
+}
+
+function launchdPlistPath(profile) {
+  return path.join(os.homedir(), 'Library', 'LaunchAgents', `${launchdLabel(profile)}.plist`);
+}
+
+function launchdLogPath(profile, stream) {
+  return path.join(defaultStateDir(profile), 'logs', `${stream}.log`);
+}
+
+function launchdTarget() {
+  return `gui/${process.getuid()}`;
+}
+
+function packageRoot() {
+  return path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+}
+
+function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true });
+}
+
+function findBinary(name) {
+  const result = spawnSync('which', [name], { encoding: 'utf8', env: { ...process.env, PATH: runtimePath() } });
+  return result.status === 0 ? result.stdout.trim() : '';
+}
+
+function runtimePath() {
+  const home = os.homedir();
+  return unique([
+    ...(process.env.PATH || '').split(path.delimiter),
+    path.join(home, '.local', 'bin'),
+    path.join(home, '.npm-global', 'bin'),
+    path.join(home, '.bun', 'bin'),
+    path.join(home, '.volta', 'bin'),
+    path.join(home, '.asdf', 'shims'),
+    path.join(home, '.local', 'share', 'pnpm'),
+    '/opt/homebrew/bin',
+    '/opt/homebrew/sbin',
+    '/usr/local/bin',
+    '/usr/bin',
+    '/bin',
+    '/usr/sbin',
+    '/sbin',
+  ].filter(Boolean)).join(path.delimiter);
+}
+
+function unique(values) {
+  const seen = new Set();
+  const out = [];
+  for (const value of values) {
+    if (!value || seen.has(value)) continue;
+    seen.add(value);
+    out.push(value);
+  }
+  return out;
+}
+
+function nodeMajor(nodeBin) {
+  const result = spawnSync(nodeBin, ['-p', 'Number(process.versions.node.split(".")[0])'], { encoding: 'utf8' });
+  return Number.parseInt(result.stdout, 10) || 0;
+}
+
+function xmlEscape(value) {
+  return String(value)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;');
+}

package/src/session-manager.js

@@ -0,0 +1,31 @@
+import { log } from './logger.js';
+
+export class SessionManager {
+  constructor(adapter) {
+    this.adapter = adapter;
+    this.sessions = new Map();
+  }
+
+  enqueue(sessionKey, job) {
+    let state = this.sessions.get(sessionKey);
+    if (!state) {
+      state = { queue: [], running: false };
+      this.sessions.set(sessionKey, state);
+    }
+    state.queue.push(job);
+    if (!state.running) this.drain(sessionKey, state).catch((err) => log('error', 'session drain failed', { sessionKey, error: err.message }));
+    return state.queue.length;
+  }
+
+  async drain(sessionKey, state) {
+    state.running = true;
+    try {
+      while (state.queue.length) {
+        const job = state.queue.shift();
+        await job();
+      }
+    } finally {
+      state.running = false;
+    }
+  }
+}

package/src/setup.js

@@ -0,0 +1,71 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { WTTApi } from './wtt-api.js';
+import { redact } from './logger.js';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const ENV_PATH = path.join(ROOT, '.env');
+
+export async function setup(config, argv = {}) {
+  const env = readEnv(ENV_PATH);
+  let agentId = argv.agentId || config.agentId || env.WTT_AGENT_ID || '';
+  let token = argv.token || config.token || env.WTT_TOKEN || env.WTT_AGENT_TOKEN || '';
+  const api = new WTTApi({ ...config, httpToken: config.httpToken || '' });
+  if ((!agentId || !token) && !argv.noRegister) {
+    const registered = await api.registerAgent(argv.displayName || config.setupDisplayName || 'wtt-connect');
+    agentId = registered.agent_id;
+    token = registered.agent_token;
+  }
+  if (!agentId || !token) throw new Error('agent id/token missing. Provide WTT_AGENT_ID/WTT_TOKEN or omit --no-register.');
+  const next = {
+    ...env,
+    WTT_BASE_URL: config.wttBaseUrl,
+    WTT_AGENT_ID: agentId,
+    WTT_TOKEN: token,
+    WTT_CONNECT_ADAPTERS: env.WTT_CONNECT_ADAPTERS || config.adapters.join(','),
+    WTT_CONNECT_WORKDIR: env.WTT_CONNECT_WORKDIR || config.workDir,
+    WTT_CONNECT_MODE: env.WTT_CONNECT_MODE || config.mode,
+    WTT_CONNECT_ENABLE_CHAT: env.WTT_CONNECT_ENABLE_CHAT || '1',
+    WTT_REQUIRE_COMMIT_PUSH: env.WTT_REQUIRE_COMMIT_PUSH || '1',
+  };
+  writeEnv(ENV_PATH, next);
+  console.log('✅ wtt-connect configured');
+  console.log(`env: ${ENV_PATH}`);
+  console.log(`agent_id: ${agentId}`);
+  console.log(`agent_token: ${redact(token)} (saved only in .env)`);
+  if (argv.claimCode) {
+    const code = await new WTTApi({ ...config, agentId, token }).claimCode(agentId, token);
+    console.log('claim_code:');
+    console.log(code.claim_code || code.code || JSON.stringify(code));
+  }
+}
+
+export function readEnv(file = ENV_PATH) {
+  const data = {};
+  if (!fs.existsSync(file)) return data;
+  for (const raw of fs.readFileSync(file, 'utf8').split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith('#') || !line.includes('=')) continue;
+    const idx = line.indexOf('=');
+    data[line.slice(0, idx).trim()] = line.slice(idx + 1).trim().replace(/^['"]|['"]$/g, '');
+  }
+  return data;
+}
+
+export function writeEnv(file, data) {
+  const ordered = [
+    'WTT_BASE_URL', 'WTT_AGENT_ID', 'WTT_TOKEN', 'WTT_HTTP_TOKEN',
+    'WTT_CONNECT_ADAPTERS', 'WTT_CONNECT_ADAPTER', 'WTT_CONNECT_WORKDIR', 'WTT_CONNECT_MODE', 'WTT_CONNECT_ALLOW_YOLO',
+    'WTT_CONNECT_REASONING_EFFORT', 'WTT_CONNECT_ENABLE_CHAT', 'WTT_CONNECT_PUBLISH_PROGRESS',
+    'WTT_CONNECT_TASK_TIMEOUT_SECONDS', 'WTT_CONNECT_STATE_DIR', 'WTT_CONNECT_UPLOAD_ARTIFACTS',
+    'WTT_CONNECT_TTS_PROVIDER', 'WTT_CONNECT_TTS_VOICE', 'WTT_CONNECT_STT_PROVIDER', 'WTT_CONNECT_STT_COMMAND',
+    'WTT_REQUIRE_COMMIT_PUSH', 'WTT_SMOKE_SENDER_AGENT_ID', 'WTT_SMOKE_SENDER_TOKEN',
+  ];
+  const lines = ['# wtt-connect config', '# Keep local; contains agent secrets.'];
+  for (const k of ordered) if (data[k] !== undefined && data[k] !== '') lines.push(`${k}=${data[k]}`);
+  for (const k of Object.keys(data).sort()) if (!ordered.includes(k) && data[k] !== undefined && data[k] !== '') lines.push(`${k}=${data[k]}`);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `${lines.join('\n')}\n`);
+  try { fs.chmodSync(file, 0o600); } catch {}
+}