wunderland 0.72.0 → 0.72.2

package/dist/api/server.js

@@ -1,1065 +0,0 @@
-// @ts-nocheck
-/**
- * @fileoverview High-level HTTP server API for Wunderland.
- * @module wunderland/api/server
- *
- * Programmatic counterpart to `wunderland start`:
- * - Loads extension packs (tools + channels + webhook handlers)
- * - Starts an HTTP server with /health, /chat, /hitl, /pairing
- * - Enforces permission sets + tool access profiles
- * - Provides HITL approvals + pairing allowlist UI
- *
- * Note: This module starts real network listeners and should be used in trusted
- * environments only. Keep your permission set conservative by default.
- */
-import { existsSync } from 'node:fs';
-import { readFile } from 'node:fs/promises';
-import { randomUUID } from 'node:crypto';
-import { createServer } from 'node:http';
-import * as path from 'node:path';
-import { HumanInteractionManager } from '@framers/agentos';
-import { resolveDefaultSkillsDirs } from '../skills/index.js';
-import { resolveExtensionsByNames } from '../core/PresetExtensionResolver.js';
-import { PairingManager } from '../pairing/PairingManager.js';
-import { createWunderlandSeed, DEFAULT_INFERENCE_HIERARCHY, DEFAULT_SECURITY_PROFILE, DEFAULT_STEP_UP_AUTH_CONFIG, } from '../core/index.js';
-import { resolveSkillContext } from '../core/resolve-skill-context.js';
-import { buildDiscoveryOptionsFromAgentConfig, resolveEffectiveAgentConfig, } from '../config/effective-agent-config.js';
-import { resolveWunderlandProviderId, resolveWunderlandTextModel } from '../config/provider-defaults.js';
-import { loadDotEnvIntoProcessUpward } from '../cli/config/env-manager.js';
-import { resolveAgentWorkspaceBaseDir, sanitizeAgentWorkspaceId } from '../runtime/workspace.js';
-import { runToolCallingTurn, safeJsonStringify, } from '../runtime/tool-calling.js';
-import { WunderlandAdaptiveExecutionRuntime } from '../runtime/adaptive-execution.js';
-import { resolveStrictToolNames } from '../runtime/tool-function-names.js';
-import { createSchemaOnDemandTools } from '../runtime/schema-on-demand.js';
-import { startWunderlandOtel, shutdownWunderlandOtel } from '../observability/otel.js';
-import { filterToolMapByPolicy, getPermissionsForSet, normalizeRuntimePolicy, } from '../runtime/policy.js';
-import { createEnvSecretResolver } from '../security/env-secrets.js';
-import { resolveAgentDisplayName } from '../runtime/agent-identity.js';
-import { buildAgenticSystemPrompt } from '../runtime/system-prompt-builder.js';
-import { buildOllamaRuntimeOptions } from '../runtime/ollama-options.js';
-import { WunderlandDiscoveryManager } from '../discovery/index.js';
-import { createConfiguredRagTools } from '../rag/runtime-tools.js';
-import { maybeProxyAgentosRagRequest } from '../rag/http-proxy.js';
-import { mergeExtensionOverrides } from '../cli/extensions/settings.js';
-import { createSpeechExtensionEnvOverrides, getDefaultVoiceExtensions, } from '../voice/speech-catalog.js';
-import { getRecordedWunderlandSessionUsage, getRecordedWunderlandTokenUsage } from '../observability/token-usage.js';
-import { resolveWunderlandTextLogConfig, WunderlandSessionTextLogger } from '../observability/session-text-log.js';
-import { dispatchRoute } from './routes/index.js';
-// HTTP helpers extracted to server-helpers.ts
-export { consoleLogger, toToolInstance, readBody, sendJson, getHeaderString, extractHitlSecret, isHitlAuthorized, inferTurnApprovalMode, finiteNumber, HITL_PAGE_HTML, PAIRING_PAGE_HTML, } from "./server-helpers.js";
-import { consoleLogger, toToolInstance, sendJson, inferTurnApprovalMode, finiteNumber, } from "./server-helpers.js";
-export async function createWunderlandServer(opts) {
-    const logger = opts?.logger ?? consoleLogger();
-    const workingDirectory = opts?.workingDirectory ? path.resolve(opts.workingDirectory) : process.cwd();
-    if (opts?.loadEnv !== false) {
-        await loadDotEnvIntoProcessUpward({ startDir: workingDirectory, configDirOverride: opts?.configDirOverride });
-    }
-    const configPath = opts?.configPath
-        ? path.resolve(workingDirectory, opts.configPath)
-        : path.resolve(workingDirectory, 'agent.config.json');
-    let cfg;
-    if (opts?.agentConfig) {
-        cfg = opts.agentConfig;
-    }
-    else {
-        if (!existsSync(configPath)) {
-            throw new Error(`createWunderlandServer: missing config file: ${configPath}`);
-        }
-        cfg = JSON.parse(await readFile(configPath, 'utf8'));
-    }
-    const rawAgentConfig = JSON.parse(JSON.stringify(cfg));
-    const effectiveConfigResult = await resolveEffectiveAgentConfig({
-        agentConfig: cfg,
-        workingDirectory,
-        logger,
-    });
-    cfg = effectiveConfigResult.agentConfig;
-    const selectedPersona = effectiveConfigResult.selectedPersona;
-    const availablePersonas = effectiveConfigResult.availablePersonas;
-    const seedId = String(cfg.seedId || 'seed_local_agent');
-    const activePersonaId = typeof cfg.selectedPersonaId === 'string' && cfg.selectedPersonaId.trim()
-        ? cfg.selectedPersonaId.trim()
-        : seedId;
-    const displayName = resolveAgentDisplayName({
-        displayName: cfg.displayName,
-        agentName: cfg.agentName,
-        seedId,
-        fallback: 'My Agent',
-    });
-    const description = String(cfg.bio || 'Autonomous Wunderbot');
-    const p = cfg.personality || {};
-    const policy = normalizeRuntimePolicy(cfg);
-    const permissions = getPermissionsForSet(policy.permissionSet);
-    const turnApprovalMode = inferTurnApprovalMode(cfg);
-    const strictToolNames = resolveStrictToolNames(cfg?.toolCalling?.strictToolNames);
-    // Observability (OTEL) is opt-in, and config can override env.
-    const cfgOtelEnabled = cfg?.observability?.otel?.enabled;
-    if (typeof cfgOtelEnabled === 'boolean') {
-        process.env['WUNDERLAND_OTEL_ENABLED'] = cfgOtelEnabled ? 'true' : 'false';
-    }
-    const cfgOtelLogsEnabled = cfg?.observability?.otel?.exportLogs;
-    if (typeof cfgOtelLogsEnabled === 'boolean') {
-        process.env['WUNDERLAND_OTEL_LOGS_ENABLED'] = cfgOtelLogsEnabled ? 'true' : 'false';
-    }
-    await startWunderlandOtel({ serviceName: `wunderbot-${seedId}` });
-    const security = {
-        ...DEFAULT_SECURITY_PROFILE,
-        enablePreLLMClassifier: cfg?.security?.preLLMClassifier ?? cfg?.security?.preLlmClassifier ?? DEFAULT_SECURITY_PROFILE.enablePreLLMClassifier,
-        enableDualLLMAuditor: cfg?.security?.dualLLMAudit ?? cfg?.security?.dualLlmAuditor ?? DEFAULT_SECURITY_PROFILE.enableDualLLMAuditor,
-        enableOutputSigning: cfg?.security?.outputSigning ?? DEFAULT_SECURITY_PROFILE.enableOutputSigning,
-    };
-    const seed = createWunderlandSeed({
-        seedId,
-        name: displayName,
-        description,
-        hexacoTraits: {
-            honesty_humility: finiteNumber(p.honesty, 0.8),
-            emotionality: finiteNumber(p.emotionality, 0.5),
-            extraversion: finiteNumber(p.extraversion, 0.6),
-            agreeableness: finiteNumber(p.agreeableness, 0.7),
-            conscientiousness: finiteNumber(p.conscientiousness, 0.8),
-            openness: finiteNumber(p.openness, 0.7),
-        },
-        baseSystemPrompt: typeof cfg.systemPrompt === 'string' ? cfg.systemPrompt : undefined,
-        securityProfile: security,
-        inferenceHierarchy: DEFAULT_INFERENCE_HIERARCHY,
-        stepUpAuthConfig: DEFAULT_STEP_UP_AUTH_CONFIG,
-    });
-    const providerFromConfig = typeof cfg.llmProvider === 'string' ? String(cfg.llmProvider).trim() : '';
-    const providerIdRaw = String(opts?.llm?.providerId ?? providerFromConfig ?? 'openai').trim().toLowerCase();
-    let providerId;
-    try {
-        providerId = resolveWunderlandProviderId(providerIdRaw);
-    }
-    catch {
-        throw new Error(`createWunderlandServer: unsupported LLM provider "${providerIdRaw}". Supported: openai, openrouter, ollama, anthropic, gemini`);
-    }
-    const modelFromConfig = typeof cfg.llmModel === 'string' ? String(cfg.llmModel).trim() : '';
-    const model = resolveWunderlandTextModel({
-        providerId,
-        model: typeof opts?.llm?.model === 'string' && opts.llm.model.trim()
-            ? opts.llm.model.trim()
-            : modelFromConfig,
-    });
-    const port = Number.isFinite(opts?.port) ? Number(opts?.port) : (Number(process.env['PORT'] || '') || 3777);
-    const host = typeof opts?.host === 'string' && opts.host.trim() ? opts.host.trim() : '0.0.0.0';
-    const openrouterApiKey = process.env['OPENROUTER_API_KEY'] || '';
-    const openrouterFallback = opts?.openaiFallback ??
-        (openrouterApiKey
-            ? {
-                apiKey: openrouterApiKey,
-                model: 'auto',
-                baseUrl: 'https://openrouter.ai/api/v1',
-                extraHeaders: { 'HTTP-Referer': 'https://wunderland.sh', 'X-Title': 'Wunderbot' },
-            }
-            : undefined);
-    const dangerouslySkipPermissions = opts?.dangerouslySkipPermissions === true;
-    const dangerouslySkipCommandSafety = opts?.dangerouslySkipCommandSafety === true || dangerouslySkipPermissions;
-    const autoApproveToolCalls = opts?.autoApproveToolCalls === true || dangerouslySkipPermissions || policy.executionMode === 'autonomous';
-    const enableSkills = opts?.enableSkills !== false;
-    const lazyTools = opts?.lazyTools === true || cfg?.lazyTools === true;
-    const workspaceBaseDir = opts?.workspace?.baseDir ?? resolveAgentWorkspaceBaseDir();
-    const workspaceAgentId = sanitizeAgentWorkspaceId(opts?.workspace?.agentId ?? seedId);
-    const sessionTextLogger = new WunderlandSessionTextLogger(resolveWunderlandTextLogConfig({
-        agentConfig: cfg,
-        workingDirectory,
-        workspace: { agentId: workspaceAgentId, baseDir: workspaceBaseDir },
-        defaultAgentId: workspaceAgentId,
-        configBacked: true,
-    }), logger);
-    const ollamaBaseUrl = (() => {
-        if (opts?.llm?.baseUrl)
-            return opts.llm.baseUrl;
-        const configBaseUrl = typeof cfg?.ollama?.baseUrl === 'string'
-            ? String(cfg.ollama.baseUrl).trim()
-            : '';
-        const raw = String(process.env['OLLAMA_BASE_URL'] || '').trim() || configBaseUrl;
-        const base = raw || 'http://localhost:11434';
-        const normalized = base.endsWith('/') ? base.slice(0, -1) : base;
-        if (normalized.endsWith('/v1'))
-            return normalized;
-        return `${normalized}/v1`;
-    })();
-    const llmBaseUrl = providerId === 'openrouter'
-        ? (opts?.llm?.baseUrl ?? 'https://openrouter.ai/api/v1')
-        : providerId === 'ollama'
-            ? ollamaBaseUrl
-            : providerId === 'gemini'
-                ? (opts?.llm?.baseUrl ?? 'https://generativelanguage.googleapis.com/v1beta/openai')
-                : opts?.llm?.baseUrl;
-    const llmApiKey = typeof opts?.llm?.apiKey === 'string'
-        ? opts.llm.apiKey
-        : providerId === 'openrouter'
-            ? openrouterApiKey
-            : providerId === 'ollama'
-                ? 'ollama'
-                : providerId === 'openai'
-                    ? (process.env['OPENAI_API_KEY'] || '')
-                    : providerId === 'anthropic'
-                        ? (process.env['ANTHROPIC_API_KEY'] || '')
-                        : providerId === 'gemini'
-                            ? (process.env['GEMINI_API_KEY'] || '')
-                            : (process.env['OPENAI_API_KEY'] || '');
-    const canUseLLM = providerId === 'ollama'
-        ? true
-        : providerId === 'openrouter'
-            ? !!llmApiKey
-            : providerId === 'anthropic'
-                ? !!llmApiKey
-                : providerId === 'gemini'
-                    ? !!llmApiKey
-                    : !!llmApiKey || !!openrouterFallback;
-    const openaiFallbackEnabled = providerId === 'openai' && !!openrouterFallback;
-    const telemetryConfig = {
-        ...(cfg.taskOutcomeTelemetry ?? {}),
-        ...(opts?.taskOutcomeTelemetry ?? {}),
-        storage: {
-            ...(cfg.taskOutcomeTelemetry?.storage ?? {}),
-            ...(opts?.taskOutcomeTelemetry?.storage ?? {}),
-        },
-    };
-    const adaptiveConfig = {
-        ...(cfg.adaptiveExecution ?? {}),
-        ...(opts?.adaptiveExecution ?? {}),
-    };
-    const adaptiveRuntime = new WunderlandAdaptiveExecutionRuntime({
-        toolFailureMode: opts?.toolFailureMode ?? cfg.toolFailureMode,
-        taskOutcomeTelemetry: telemetryConfig,
-        adaptiveExecution: adaptiveConfig,
-        logger,
-    });
-    await adaptiveRuntime.initialize();
-    const defaultTenantId = typeof cfg?.organizationId === 'string' && String(cfg.organizationId).trim()
-        ? String(cfg.organizationId).trim()
-        : undefined;
-    const preloadedPackages = [];
-    let activePacks = [];
-    let allTools = [];
-    const loadedChannelAdapters = [];
-    const loadedHttpHandlers = [];
-    let schemaOnDemandSecrets;
-    let schemaOnDemandGetSecret;
-    let schemaOnDemandOptions;
-    const hitlSecret = typeof opts?.hitlSecret === 'string' && opts.hitlSecret.trim()
-        ? opts.hitlSecret.trim()
-        : (() => {
-            const fromCfg = cfg?.hitl && typeof cfg.hitl === 'object' && !Array.isArray(cfg.hitl)
-                ? String(cfg.hitl.secret || '').trim()
-                : '';
-            const fromEnv = String(process.env['WUNDERLAND_HITL_SECRET'] || '').trim();
-            return fromCfg || fromEnv || randomUUID();
-        })();
-    const toolApiSecret = String(process.env['WUNDERLAND_TOOL_API_KEY'] || '').trim();
-    const sseClients = new Set();
-    async function broadcastHitlUpdate(payload) {
-        const data = JSON.stringify(payload);
-        for (const client of Array.from(sseClients)) {
-            try {
-                client.write(`event: hitl\\ndata: ${data}\\n\\n`);
-            }
-            catch {
-                sseClients.delete(client);
-            }
-        }
-    }
-    const hitlManager = new HumanInteractionManager({
-        defaultTimeoutMs: 5 * 60_000,
-        autoRejectOnTimeout: true,
-        notificationHandler: async (notification) => {
-            await broadcastHitlUpdate({ type: 'notification', notification });
-        },
-    });
-    if (!lazyTools) {
-        const extensionsFromConfig = cfg.extensions;
-        let toolExtensions = [];
-        let voiceExtensions = [];
-        let productivityExtensions = [];
-        if (extensionsFromConfig) {
-            toolExtensions = extensionsFromConfig.tools || [];
-            voiceExtensions = extensionsFromConfig.voice || [];
-            productivityExtensions = extensionsFromConfig.productivity || [];
-        }
-        else {
-            toolExtensions = ['cli-executor', 'web-search', 'web-browser', 'browser-automation', 'content-extraction', 'credential-vault', 'giphy', 'image-search', 'news-search', 'weather', 'skills', 'deep-research', 'github'];
-            voiceExtensions = getDefaultVoiceExtensions();
-            productivityExtensions = [];
-        }
-        try {
-            const configOverrides = cfg?.extensionOverrides && typeof cfg.extensionOverrides === 'object' && !Array.isArray(cfg.extensionOverrides)
-                ? cfg.extensionOverrides
-                : {};
-            // Build filesystem roots: agent workspace + user's home directory + cwd.
-            const homeDir = (await import('node:os')).homedir();
-            const workspaceDir = path.resolve(workspaceBaseDir, workspaceAgentId);
-            const cwd = process.cwd();
-            const readRoots = [workspaceDir, homeDir, cwd, '/tmp'];
-            const writeRoots = [workspaceDir, homeDir, cwd, '/tmp'];
-            const runtimeOverrides = {
-                'cli-executor': {
-                    options: {
-                        workingDirectory: cwd,
-                        filesystem: {
-                            allowRead: permissions.filesystem.read,
-                            allowWrite: permissions.filesystem.write,
-                            readRoots: permissions.filesystem.read ? readRoots : undefined,
-                            writeRoots: permissions.filesystem.write ? writeRoots : undefined,
-                        },
-                        agentWorkspace: {
-                            agentId: workspaceAgentId,
-                            baseDir: workspaceBaseDir,
-                            createIfMissing: true,
-                            subdirs: ['assets', 'exports', 'tmp'],
-                        },
-                        dangerouslySkipSecurityChecks: dangerouslySkipCommandSafety,
-                    },
-                },
-                'web-search': {
-                    options: {
-                        serperApiKey: process.env['SERPER_API_KEY'],
-                        serpApiKey: process.env['SERPAPI_API_KEY'],
-                        braveApiKey: process.env['BRAVE_API_KEY'],
-                    },
-                },
-                'web-browser': {
-                    options: {
-                        headless: true,
-                        executablePath: process.env['PUPPETEER_EXECUTABLE_PATH'] ||
-                            process.env['CHROME_EXECUTABLE_PATH'] ||
-                            process.env['CHROME_PATH'],
-                    },
-                },
-                giphy: { options: { giphyApiKey: process.env['GIPHY_API_KEY'] } },
-                'image-search': {
-                    options: {
-                        pexelsApiKey: process.env['PEXELS_API_KEY'],
-                        unsplashApiKey: process.env['UNSPLASH_ACCESS_KEY'],
-                        pixabayApiKey: process.env['PIXABAY_API_KEY'],
-                    },
-                },
-                ...createSpeechExtensionEnvOverrides(),
-                'news-search': { options: { newsApiKey: process.env['NEWSAPI_API_KEY'] } },
-                'wunderbot-feeds': {
-                    options: {
-                        feeds: cfg?.feeds ?? {},
-                    },
-                },
-            };
-            function mergeOverride(base, extra) {
-                const out = { ...(base || {}), ...(extra || {}) };
-                if ((base && base.options) || (extra && extra.options)) {
-                    out.options = { ...(base?.options || {}), ...(extra?.options || {}) };
-                }
-                return out;
-            }
-            const mergedOverrides = mergeExtensionOverrides(configOverrides, {});
-            for (const [name, override] of Object.entries(runtimeOverrides)) {
-                mergedOverrides[name] = mergeOverride(mergedOverrides[name], override);
-            }
-            const cfgSecrets = cfg?.secrets && typeof cfg.secrets === 'object' && !Array.isArray(cfg.secrets)
-                ? cfg.secrets
-                : undefined;
-            const getSecret = createEnvSecretResolver({ configSecrets: cfgSecrets });
-            const secrets = new Proxy({}, {
-                get: (_target, prop) => (typeof prop === 'string' ? getSecret(prop) : undefined),
-            });
-            schemaOnDemandSecrets = cfgSecrets;
-            schemaOnDemandGetSecret = getSecret;
-            schemaOnDemandOptions = Object.fromEntries(Object.entries(mergedOverrides).map(([name, value]) => [
-                name,
-                value && typeof value === 'object' && !Array.isArray(value)
-                    ? value
-                    : {},
-            ]));
-            const channelsFromConfig = Array.isArray(cfg?.channels)
-                ? cfg.channels
-                : Array.isArray(cfg?.suggestedChannels)
-                    ? cfg.suggestedChannels
-                    : [];
-            const channelAliases = {
-                'blog-publisher': 'devto',
-                'blog publisher': 'devto',
-                'dev.to': 'devto',
-                hashnode: 'devto',
-                medium: 'devto',
-                wordpress: 'devto',
-            };
-            const channelsToLoad = Array.from(new Set(channelsFromConfig
-                .map((v) => String(v ?? '').trim().toLowerCase())
-                .filter((v) => v.length > 0)
-                .map((v) => channelAliases[v] ?? v)));
-            const CLI_REQUIRED_CHANNELS = new Set(['signal', 'zalouser']);
-            const allowedChannels = permissions.network.externalApis === true
-                ? channelsToLoad.filter((platform) => !CLI_REQUIRED_CHANNELS.has(platform) || permissions.system.cliExecution === true)
-                : [];
-            const resolved = await resolveExtensionsByNames(toolExtensions, voiceExtensions, productivityExtensions, mergedOverrides, { secrets: secrets, channels: allowedChannels.length > 0 ? allowedChannels : 'none' });
-            const packs = [];
-            for (const packEntry of resolved.manifest.packs) {
-                try {
-                    if (packEntry?.enabled === false)
-                        continue;
-                    if (typeof packEntry?.factory === 'function') {
-                        const pack = await packEntry.factory();
-                        if (pack) {
-                            packs.push(pack);
-                            if (typeof pack?.name === 'string')
-                                preloadedPackages.push(pack.name);
-                        }
-                        continue;
-                    }
-                    let packageName;
-                    if ('package' in packEntry)
-                        packageName = packEntry.package;
-                    else if ('module' in packEntry)
-                        packageName = packEntry.module;
-                    if (!packageName)
-                        continue;
-                    const extModule = await import(packageName);
-                    const factory = extModule.createExtensionPack ?? extModule.default?.createExtensionPack ?? extModule.default;
-                    if (typeof factory !== 'function')
-                        continue;
-                    const options = packEntry.options || {};
-                    const pack = await factory({ options, logger: console, getSecret });
-                    packs.push(pack);
-                    if (typeof pack?.name === 'string')
-                        preloadedPackages.push(pack.name);
-                }
-                catch (err) {
-                    logger.warn?.('[wunderland/api] Failed to load extension pack', {
-                        error: err instanceof Error ? err.message : String(err),
-                    });
-                }
-            }
-            // Activate all packs
-            await Promise.all(packs
-                .map((p2) => (typeof p2?.onActivate === 'function' ? p2.onActivate({ logger: console, getSecret }) : null))
-                .filter(Boolean));
-            activePacks = packs;
-            const adapters = packs
-                .flatMap((p2) => (p2?.descriptors || []))
-                .filter((d) => d?.kind === 'messaging-channel')
-                .map((d) => d.payload)
-                .filter(Boolean);
-            loadedChannelAdapters.push(...adapters);
-            const httpHandlers = packs
-                .flatMap((p2) => (p2?.descriptors || []))
-                .filter((d) => d?.kind === 'http-handler')
-                .map((d) => d.payload)
-                .filter(Boolean);
-            loadedHttpHandlers.push(...httpHandlers);
-            allTools = packs
-                .flatMap((p2) => (p2?.descriptors || []))
-                .filter((d) => d?.kind === 'tool')
-                .map((d) => d.payload)
-                .filter(Boolean);
-        }
-        catch (err) {
-            logger.warn?.('[wunderland/api] Extension loading failed, using empty toolset', {
-                error: err instanceof Error ? err.message : String(err),
-            });
-        }
-    }
-    const toolMap = new Map();
-    for (const tool of allTools) {
-        if (!tool?.name)
-            continue;
-        toolMap.set(tool.name, tool);
-    }
-    let discoveryManager;
-    for (const meta of createSchemaOnDemandTools({
-        toolMap,
-        runtimeDefaults: {
-            workingDirectory,
-            headlessBrowser: true,
-            dangerouslySkipCommandSafety,
-            agentWorkspace: { agentId: workspaceAgentId, baseDir: workspaceBaseDir },
-        },
-        initialEnabledPackages: preloadedPackages,
-        secrets: schemaOnDemandSecrets,
-        getSecret: schemaOnDemandGetSecret,
-        defaultExtensionOptions: schemaOnDemandOptions,
-        allowPackages: true,
-        logger: console,
-        onToolsChanged: () => {
-            if (!discoveryManager)
-                return;
-            discoveryManager.reindex?.({ toolMap }).catch(() => { });
-        },
-    })) {
-        toolMap.set(meta.name, meta);
-    }
-    for (const ragTool of createConfiguredRagTools(cfg)) {
-        if (!ragTool?.name)
-            continue;
-        toolMap.set(ragTool.name, toToolInstance(ragTool));
-    }
-    const filtered = filterToolMapByPolicy({
-        toolMap,
-        toolAccessProfile: policy.toolAccessProfile,
-        permissions,
-    });
-    toolMap.clear();
-    for (const [k, v] of filtered.toolMap.entries())
-        toolMap.set(k, v);
-    let skillsPrompt = '';
-    let skillEntries = [];
-    if (enableSkills) {
-        const resolvedSkills = await resolveSkillContext({
-            filesystemDirs: resolveDefaultSkillsDirs({ cwd: workingDirectory }),
-            curatedSkills: Array.isArray(cfg.skills) && cfg.skills.length > 0
-                ? cfg.skills
-                : undefined,
-            platform: process.platform,
-            logger: {
-                warn: (msg, meta) => logger.warn?.(msg, meta),
-            },
-            warningPrefix: '[wunderland/api]',
-        });
-        skillsPrompt = resolvedSkills.skillsPrompt;
-        skillEntries = resolvedSkills.skillEntries;
-    }
-    discoveryManager = new WunderlandDiscoveryManager(buildDiscoveryOptionsFromAgentConfig(cfg));
-    try {
-        await discoveryManager.initialize({
-            toolMap,
-            skillEntries: skillEntries.length > 0 ? skillEntries : undefined,
-            llmConfig: { providerId: providerId, apiKey: llmApiKey, baseUrl: llmBaseUrl },
-        });
-        const metaTool = discoveryManager.getMetaTool();
-        if (metaTool) {
-            toolMap.set(metaTool.name, toToolInstance(metaTool));
-        }
-    }
-    catch (err) {
-        logger.warn?.('[wunderland/api] Discovery initialization failed (continuing without)', {
-            error: err instanceof Error ? err.message : String(err),
-        });
-    }
-    const systemPrompt = buildAgenticSystemPrompt({
-        seed,
-        policy,
-        mode: 'server',
-        lazyTools,
-        autoApproveToolCalls,
-        channelNames: loadedChannelAdapters.length > 0
-            ? loadedChannelAdapters
-                .map((a) => a.displayName || a.platform)
-                .filter((name) => typeof name === 'string' && name.trim().length > 0)
-            : undefined,
-        skillsPrompt: skillsPrompt || undefined,
-        turnApprovalMode,
-    });
-    const sessions = new Map();
-    const channelSessions = new Map();
-    const channelQueues = new Map();
-    const channelUnsubs = [];
-    const pairingEnabled = cfg?.pairing?.enabled !== false;
-    const pairingGroupTrigger = (() => {
-        const raw = cfg?.pairing?.groupTrigger;
-        if (typeof raw === 'string')
-            return raw.trim();
-        return '!pair';
-    })();
-    const pairingGroupTriggerEnabled = pairingEnabled && !!pairingGroupTrigger && pairingGroupTrigger.toLowerCase() !== 'off';
-    const pairing = new PairingManager({
-        storeDir: path.join(workspaceBaseDir, workspaceAgentId, 'pairing'),
-        pendingTtlMs: Number.isFinite(cfg?.pairing?.pendingTtlMs) ? cfg.pairing.pendingTtlMs : undefined,
-        maxPending: Number.isFinite(cfg?.pairing?.maxPending) ? cfg.pairing.maxPending : undefined,
-        codeLength: Number.isFinite(cfg?.pairing?.codeLength) ? cfg.pairing.codeLength : undefined,
-    });
-    function toAgentosApprovalCategory(tool) {
-        const name = String(tool?.name || '').toLowerCase();
-        if (name.startsWith('file_') ||
-            name.includes('shell_') ||
-            name.includes('run_command') ||
-            name.includes('exec')) {
-            return 'system';
-        }
-        if (name.startsWith('browser_') || name.includes('web_'))
-            return 'external_api';
-        const cat = String(tool?.category || '').toLowerCase();
-        if (cat.includes('financial'))
-            return 'financial';
-        if (cat.includes('communication'))
-            return 'communication';
-        if (cat.includes('external') || cat.includes('api') || cat === 'research' || cat === 'search')
-            return 'external_api';
-        if (cat.includes('data'))
-            return 'data_modification';
-        if (cat.includes('system') || cat.includes('filesystem'))
-            return 'system';
-        return 'other';
-    }
-    // ── Channel Runtime (inbound/outbound) ────────────────────────────────────
-    const LOCAL_ONLY_CHANNELS = new Set(['webchat']);
-    const CLI_REQUIRED_CHANNELS = new Set(['signal', 'zalouser']);
-    const adapterByPlatform = new Map();
-    for (const adapter of loadedChannelAdapters) {
-        const platform = adapter?.platform;
-        if (typeof platform !== 'string' || !platform.trim())
-            continue;
-        if (!adapterByPlatform.has(platform))
-            adapterByPlatform.set(platform, adapter);
-    }
-    function enqueueChannelTurn(key, fn) {
-        const prev = channelQueues.get(key) ?? Promise.resolve();
-        const next = prev
-            .catch(() => undefined)
-            .then(fn)
-            .catch((err) => {
-            logger.warn?.('[wunderland/api][channels] turn failed', {
-                key,
-                error: err instanceof Error ? err.message : String(err),
-            });
-        })
-            .finally(() => {
-            if (channelQueues.get(key) === next)
-                channelQueues.delete(key);
-        });
-        channelQueues.set(key, next);
-    }
-    function chunkText(text, maxLen = 1800) {
-        const t = String(text ?? '');
-        if (t.length <= maxLen)
-            return [t];
-        const chunks = [];
-        let i = 0;
-        while (i < t.length) {
-            chunks.push(t.slice(i, i + maxLen));
-            i += maxLen;
-        }
-        return chunks;
-    }
-    function getSenderLabel(m) {
-        const d = m?.sender && typeof m.sender === 'object' ? m.sender : {};
-        const display = typeof d.displayName === 'string' && d.displayName.trim() ? d.displayName.trim() : '';
-        const user = typeof d.username === 'string' && d.username.trim() ? d.username.trim() : '';
-        return display || (user ? `@${user}` : '') || String(d.id || 'unknown');
-    }
-    function isChannelAllowedByPolicy(platform) {
-        if (LOCAL_ONLY_CHANNELS.has(platform))
-            return true;
-        if (permissions.network.externalApis !== true)
-            return false;
-        if (CLI_REQUIRED_CHANNELS.has(platform) && permissions.system.cliExecution !== true)
-            return false;
-        return true;
-    }
-    async function sendChannelText(sendOpts) {
-        if (!isChannelAllowedByPolicy(sendOpts.platform))
-            return;
-        const adapter = adapterByPlatform.get(sendOpts.platform);
-        if (!adapter)
-            return;
-        const parts = chunkText(sendOpts.text, 1800).filter((p2) => p2.trim().length > 0);
-        for (const part of parts) {
-            await adapter.sendMessage(sendOpts.conversationId, {
-                blocks: [{ type: 'text', text: part }],
-                ...(sendOpts.replyToMessageId ? { replyToMessageId: sendOpts.replyToMessageId } : null),
-            });
-        }
-    }
-    async function handleInboundChannelMessage(message) {
-        const platform = String(message?.platform || '').trim();
-        const conversationId = String(message?.conversationId || '').trim();
-        if (!platform || !conversationId)
-            return;
-        const text = String(message?.text || '').trim();
-        if (!text)
-            return;
-        const senderId = String(message?.sender?.id || '').trim() || 'unknown';
-        const isGroupPairingRequest = (() => {
-            if (!pairingGroupTriggerEnabled)
-                return false;
-            if (message?.conversationType === 'direct')
-                return false;
-            const t = text.trim();
-            if (!t)
-                return false;
-            const trig = pairingGroupTrigger;
-            const lowerT = t.toLowerCase();
-            const lowerTrig = trig.toLowerCase();
-            if (lowerT === lowerTrig)
-                return true;
-            if (lowerT.startsWith(`${lowerTrig} `))
-                return true;
-            return false;
-        })();
-        if (pairingEnabled) {
-            const isAllowed = await pairing.isAllowed(platform, senderId);
-            if (!isAllowed) {
-                if (message?.conversationType !== 'direct' && !isGroupPairingRequest) {
-                    return;
-                }
-                const meta = { sender: getSenderLabel(message), platform, conversationId };
-                const { code, created } = await pairing.upsertRequest(platform, senderId, meta);
-                if (created) {
-                    void broadcastHitlUpdate({ type: 'pairing_request', platform, senderId, conversationId });
-                }
-                const prompt = code && code.trim()
-                    ? (isGroupPairingRequest
-                        ? `Pairing requested.\\n\\nCode: ${code}\\n\\nAsk the assistant owner to approve this code.`
-                        : `Pairing required.\\n\\nCode: ${code}\\n\\nAsk the assistant owner to approve this code, then retry.`)
-                    : 'Pairing queue is full. Ask the assistant owner to clear/approve pending requests, then retry.';
-                await sendChannelText({ platform, conversationId, text: prompt, replyToMessageId: message?.messageId });
-                return;
-            }
-        }
-        const sessionKey = `${platform}:${conversationId}`;
-        let messages = channelSessions.get(sessionKey);
-        if (!messages) {
-            messages = [{ role: 'system', content: systemPrompt }];
-            channelSessions.set(sessionKey, messages);
-        }
-        if (messages.length > 200) {
-            messages = [messages[0], ...messages.slice(-120)];
-            channelSessions.set(sessionKey, messages);
-        }
-        const userPrefix = message?.conversationType === 'direct' ? '' : `[${getSenderLabel(message)}] `;
-        messages.push({ role: 'user', content: `${userPrefix}${text}` });
-        try {
-            const adapter = adapterByPlatform.get(platform);
-            if (adapter)
-                await adapter.sendTypingIndicator?.(conversationId, true);
-        }
-        catch {
-            // ignore
-        }
-        const tenantId = (typeof message?.organizationId === 'string' && String(message.organizationId).trim())
-            || defaultTenantId;
-        const adaptiveDecision = adaptiveRuntime.resolveTurnDecision({
-            scope: {
-                sessionId: sessionKey,
-                userId: senderId,
-                personaId: activePersonaId,
-                tenantId: tenantId || undefined,
-            },
-        });
-        let reply = '';
-        let turnFailed = false;
-        let fallbackTriggered = false;
-        let toolCallCount = 0;
-        try {
-            if (canUseLLM) {
-                const toolContext = {
-                    gmiId: `wunderland-channel-${sessionKey}`,
-                    sessionId: sessionKey,
-                    personaId: activePersonaId,
-                    userContext: {
-                        userId: senderId,
-                        platform,
-                        conversationId,
-                        ...(tenantId ? { organizationId: tenantId } : null),
-                    },
-                    ...(opts?.configDirOverride ? { wunderlandConfigDir: opts.configDirOverride } : null),
-                    agentWorkspace: { agentId: workspaceAgentId, baseDir: workspaceBaseDir },
-                    permissionSet: policy.permissionSet,
-                    securityTier: policy.securityTier,
-                    executionMode: policy.executionMode,
-                    toolAccessProfile: policy.toolAccessProfile,
-                    interactiveSession: false,
-                    turnApprovalMode,
-                    toolFailureMode: adaptiveDecision.toolFailureMode,
-                    adaptiveExecution: {
-                        degraded: adaptiveDecision.degraded,
-                        reason: adaptiveDecision.reason,
-                        actions: adaptiveDecision.actions,
-                        kpi: adaptiveDecision.kpi ?? undefined,
-                    },
-                    ...(policy.folderPermissions ? { folderPermissions: policy.folderPermissions } : null),
-                    wrapToolOutputs: policy.wrapToolOutputs,
-                    strictToolNames,
-                };
-                reply = await runToolCallingTurn({
-                    providerId,
-                    apiKey: llmApiKey,
-                    model,
-                    messages,
-                    toolMap,
-                    toolContext,
-                    maxRounds: 8,
-                    dangerouslySkipPermissions: autoApproveToolCalls,
-                    strictToolNames,
-                    toolFailureMode: adaptiveDecision.toolFailureMode,
-                    ollamaOptions: buildOllamaRuntimeOptions(cfg?.ollama),
-                    onToolCall: () => {
-                        toolCallCount += 1;
-                    },
-                    askPermission: async (tool, args) => {
-                        if (autoApproveToolCalls)
-                            return true;
-                        const preview = safeJsonStringify(args, 1800);
-                        const effectLabel = tool.hasSideEffects === true ? 'side effects' : 'read-only';
-                        const actionId = `tool-${seedId}-${randomUUID()}`;
-                        const decision = await hitlManager.requestApproval({
-                            actionId,
-                            description: `Allow ${tool.name} (${effectLabel})?\\n\\n${preview}`,
-                            severity: tool.hasSideEffects === true ? 'high' : 'low',
-                            category: toAgentosApprovalCategory(tool),
-                            agentId: seed.seedId,
-                            context: { toolName: tool.name, args, sessionId: sessionKey, platform, conversationId },
-                            reversible: tool.hasSideEffects !== true,
-                            requestedAt: new Date(),
-                            timeoutMs: 5 * 60_000,
-                        });
-                        return decision.approved === true;
-                    },
-                    askCheckpoint: turnApprovalMode === 'off'
-                        ? undefined
-                        : async ({ round, toolCalls }) => {
-                            if (autoApproveToolCalls)
-                                return true;
-                            const checkpointId = `checkpoint-${seedId}-${sessionKey}-${round}-${randomUUID()}`;
-                            const completedWork = toolCalls.map((c) => {
-                                const effect = c.hasSideEffects ? 'side effects' : 'read-only';
-                                const preview = safeJsonStringify(c.args, 800);
-                                return `${c.toolName} (${effect})\\n${preview}`;
-                            });
-                            const timeoutMs = 5 * 60_000;
-                            const checkpointPromise = hitlManager
-                                .checkpoint({
-                                checkpointId,
-                                workflowId: `channel-${sessionKey}`,
-                                currentPhase: `tool-round-${round}`,
-                                progress: Math.min(1, (round + 1) / 8),
-                                completedWork,
-                                upcomingWork: ['Continue to next LLM round'],
-                                issues: [],
-                                notes: 'Continue?',
-                                checkpointAt: new Date(),
-                            })
-                                .catch(() => ({ decision: 'abort' }));
-                            const timeoutPromise = new Promise((resolve) => setTimeout(() => resolve({ decision: 'abort' }), timeoutMs));
-                            const decision = (await Promise.race([checkpointPromise, timeoutPromise]));
-                            if (decision?.decision !== 'continue') {
-                                try {
-                                    await hitlManager.cancelRequest(checkpointId, 'checkpoint_timeout_or_abort');
-                                }
-                                catch {
-                                    // ignore
-                                }
-                            }
-                            return decision?.decision === 'continue';
-                        },
-                    baseUrl: llmBaseUrl,
-                    fallback: providerId === 'openai' ? openrouterFallback : undefined,
-                    onFallback: (err, provider) => {
-                        fallbackTriggered = true;
-                        logger.warn?.('[wunderland/api] fallback activated', { error: err.message, provider });
-                    },
-                });
-            }
-            else {
-                reply = `No LLM credentials configured. You said: ${text}`;
-                messages.push({ role: 'assistant', content: reply });
-            }
-        }
-        catch (error) {
-            turnFailed = true;
-            throw error;
-        }
-        finally {
-            try {
-                await adaptiveRuntime.recordTurnOutcome({
-                    scope: {
-                        sessionId: sessionKey,
-                        userId: senderId,
-                        personaId: activePersonaId,
-                        tenantId: tenantId || undefined,
-                    },
-                    degraded: adaptiveDecision.degraded || fallbackTriggered,
-                    replyText: reply,
-                    didFail: turnFailed,
-                    toolCallCount,
-                });
-            }
-            catch (error) {
-                logger.warn?.('[wunderland/api][channels] failed to record adaptive outcome', {
-                    error: error instanceof Error ? error.message : String(error),
-                });
-            }
-            try {
-                const adapter = adapterByPlatform.get(platform);
-                if (adapter)
-                    await adapter.sendTypingIndicator?.(conversationId, false);
-            }
-            catch {
-                // ignore
-            }
-        }
-        if (typeof reply === 'string' && reply.trim()) {
-            await sendChannelText({ platform, conversationId, text: reply.trim(), replyToMessageId: message?.messageId });
-        }
-    }
-    if (adapterByPlatform.size > 0) {
-        for (const [platform, adapter] of adapterByPlatform.entries()) {
-            if (!isChannelAllowedByPolicy(platform))
-                continue;
-            try {
-                const unsub = adapter.on(async (event) => {
-                    if (!event || event.type !== 'message')
-                        return;
-                    const data = event.data;
-                    if (!data)
-                        return;
-                    const key = `${platform}:${String(data.conversationId || '').trim()}`;
-                    enqueueChannelTurn(key, async () => {
-                        await handleInboundChannelMessage(data);
-                    });
-                }, ['message']);
-                channelUnsubs.push(unsub);
-            }
-            catch (err) {
-                logger.warn?.('[wunderland/api][channels] subscribe failed', {
-                    platform,
-                    error: err instanceof Error ? err.message : String(err),
-                });
-            }
-        }
-    }
-    /* ── Assemble shared deps for extracted route handlers ─────────────────── */
-    const routeDeps = {
-        seedId,
-        displayName,
-        activePersonaId,
-        selectedPersona,
-        availablePersonas: availablePersonas ?? [],
-        providerId,
-        model,
-        llmApiKey,
-        llmBaseUrl,
-        canUseLLM,
-        openrouterFallback,
-        seed,
-        cfg,
-        rawAgentConfig,
-        policy,
-        toolMap,
-        sessions,
-        systemPrompt,
-        adaptiveRuntime,
-        discoveryManager: discoveryManager,
-        strictToolNames,
-        autoApproveToolCalls,
-        turnApprovalMode,
-        defaultTenantId,
-        workspaceAgentId,
-        workspaceBaseDir,
-        lazyTools,
-        skillsPrompt,
-        workingDirectory,
-        hitlSecret,
-        hitlManager,
-        sseClients,
-        broadcastHitlUpdate,
-        pairingEnabled,
-        pairing,
-        adapterByPlatform,
-        loadedChannelAdapters,
-        loadedHttpHandlers,
-        sessionTextLogger,
-        logger,
-        configDirOverride: opts?.configDirOverride,
-        toolApiSecret,
-        dangerouslySkipPermissions,
-    };
-    const server = createServer(async (req, res) => {
-        try {
-            /* ── CORS ───────────────────────────────────────────────────────────── */
-            res.setHeader('Access-Control-Allow-Origin', '*');
-            res.setHeader('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
-            res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Api-Key, X-Wunderland-HITL-Secret, X-Wunderland-Chat-Secret, X-Wunderland-Feed-Secret');
-            if (req.method === 'OPTIONS') {
-                res.writeHead(204);
-                res.end();
-                return;
-            }
-            const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
-            /* ── RAG proxy pass-through ─────────────────────────────────────────── */
-            if (await maybeProxyAgentosRagRequest({ req, res, url, agentConfig: cfg, logger })) {
-                return;
-            }
-            /* ── Dispatch to extracted route handlers ───────────────────────────── */
-            if (await dispatchRoute(req, res, url, routeDeps)) {
-                return;
-            }
-            /* ── Extension HTTP handlers (webhooks, etc.) ───────────────────────── */
-            for (const handler of loadedHttpHandlers) {
-                try {
-                    const handled = await handler(req, res);
-                    if (handled)
-                        return;
-                }
-                catch (err) {
-                    sendJson(res, 500, { error: err instanceof Error ? err.message : 'HTTP handler error' });
-                    return;
-                }
-            }
-            sendJson(res, 404, { error: 'Not Found' });
-        }
-        catch (err) {
-            sendJson(res, 500, { error: err instanceof Error ? err.message : 'Server error' });
-        }
-    });
-    await new Promise((resolve) => {
-        server.listen(port, host, () => resolve());
-    });
-    const address = server.address();
-    const actualPort = typeof address === 'object' && address && 'port' in address ? Number(address.port) : port;
-    const url = `http://${host === '0.0.0.0' ? 'localhost' : host}:${actualPort}`;
-    const close = async () => {
-        for (const unsub of channelUnsubs) {
-            try {
-                unsub();
-            }
-            catch {
-                // ignore
-            }
-        }
-        await Promise.allSettled((activePacks || [])
-            .map((p2) => (typeof p2?.onDeactivate === 'function' ? p2.onDeactivate({ logger: console }) : null))
-            .filter(Boolean));
-        await new Promise((resolve, reject) => {
-            server.close((err) => (err ? reject(err) : resolve()));
-        });
-        await adaptiveRuntime.close();
-        await discoveryManager.close().catch(() => undefined);
-        await shutdownWunderlandOtel();
-    };
-    logger.info?.('[wunderland/api] server started', {
-        url,
-        seedId,
-        toolCount: toolMap.size,
-        channelCount: adapterByPlatform.size,
-        pairingEnabled,
-    });
-    const usage = async (usageOpts) => {
-        if (usageOpts?.sessionId) {
-            return getRecordedWunderlandSessionUsage(usageOpts.sessionId, opts?.configDirOverride);
-        }
-        return getRecordedWunderlandTokenUsage(opts?.configDirOverride);
-    };
-    return {
-        server,
-        url,
-        host,
-        port: actualPort,
-        hitlSecret,
-        seedId,
-        displayName,
-        providerId: providerId,
-        model,
-        canUseLLM,
-        toolCount: toolMap.size,
-        channelCount: adapterByPlatform.size,
-        selectedPersonaId: activePersonaId !== seedId ? activePersonaId : undefined,
-        personaCount: availablePersonas?.length ?? 0,
-        pairingEnabled,
-        policy,
-        autoApproveToolCalls,
-        turnApprovalMode,
-        openaiFallbackEnabled,
-        usage,
-        close,
-    };
-}
-//# sourceMappingURL=server.js.map