wunderland 0.85.10 → 0.86.0

package/README.md

@@ -371,9 +371,15 @@ wunderland extensions info image-generation
 wunderland --theme cyberpunk
 wunderland --ascii
 
-# Start the agent server
+# Start the agent server (127.0.0.1:3777, this machine only)
 wunderland start
 
+# Let other machines connect. start refuses this until POST /chat has a secret
+# (chat.secret in agent.config.json, or WUNDERLAND_CHAT_SECRET); clients send it
+# in the x-wunderland-chat-secret header
+export WUNDERLAND_CHAT_SECRET=<a long random value>
+wunderland start --host 0.0.0.0
+
 # Chat with your agent
 wunderland chat
 
@@ -513,7 +519,7 @@ See `presets/workflows/` and `presets/missions/` for all templates.
 | `wunderland` | Open the interactive TUI dashboard (TTY only) |
 | `wunderland setup` | Interactive setup wizard (LLM provider, channels, personality) |
 | `wunderland help [topic]` | Onboarding guides + keybindings (`wunderland help tui`) |
-| `wunderland start` | Start the agent server (default port 3777) |
+| `wunderland start` | Start the agent server on 127.0.0.1:3777 (`--host` and `--port` change them) |
 | `wunderland chat` | Chat with your agent in the terminal |
 | `wunderland doctor` | Health check and diagnostics |
 | `wunderland status` | Agent & connection status |

package/dist/channels/api/listen-host.d.ts

@@ -0,0 +1,54 @@
+/**
+ * @fileoverview The address the agent HTTP servers listen on.
+ * @module wunderland/channels/api/listen-host
+ *
+ * POST /chat answers without a secret unless `chat.secret` or
+ * `WUNDERLAND_CHAT_SECRET` is set, so `wunderland start`, `wunderland serve`
+ * and {@link createWunderlandServer} listen on the loopback address unless a
+ * host is named, and refuse a host other machines can reach until a chat
+ * secret is set. `0.0.0.0` accepts connections from every machine that can
+ * reach the port.
+ */
+/** The address the agent servers listen on when no host is named. */
+export declare const DEFAULT_LISTEN_HOST = "127.0.0.1";
+/**
+ * Resolves a `--host` flag.
+ *
+ * @param value - The parsed flag: undefined when absent, `true` when it was given with no address.
+ * @returns The address to listen on: {@link DEFAULT_LISTEN_HOST} when no flag was given, and a
+ *   bracketed IPv6 address (`[::1]`, URL notation) bare, the form server.listen takes.
+ * @throws Error when the flag was given without an address, so a typo never widens the server.
+ */
+export declare function resolveListenHost(value: string | boolean | undefined): string;
+/**
+ * Whether only this machine can reach an address.
+ *
+ * @param host - A listen address, with or without IPv6 brackets.
+ * @returns True for `localhost`, `::1` and the 127.0.0.0/8 range.
+ */
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * Refuses to listen where other machines can connect while POST /chat has no secret.
+ *
+ * @param host - The address the server is about to listen on.
+ * @param chatSecret - The secret /chat requires; empty when none is set.
+ * @throws Error naming the host and how to set a secret, unless the host is loopback or a secret is set.
+ */
+export declare function assertChatSecretForHost(host: string, chatSecret: string): void;
+/**
+ * The host to print in a URL for a listen address.
+ *
+ * @param host - A listen address.
+ * @returns `localhost` for a wildcard address (`0.0.0.0`, `::`), IPv6 in brackets, anything else as given.
+ */
+export declare function displayHost(host: string): string;
+/**
+ * The /health URL of an agent server.
+ *
+ * @param port - The server's port.
+ * @param host - The address it listens on. Daemons recorded before `--host`
+ *   existed have none; they listened on every interface and answer on localhost.
+ * @returns The URL to poll.
+ */
+export declare function healthUrl(port: number, host?: string): string;
+//# sourceMappingURL=listen-host.d.ts.map

package/dist/channels/api/listen-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listen-host.d.ts","sourceRoot":"","sources":["../../../src/channels/api/listen-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAQ7E;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQpD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAO9E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhD;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/dist/channels/api/listen-host.js

@@ -0,0 +1,82 @@
+/**
+ * @fileoverview The address the agent HTTP servers listen on.
+ * @module wunderland/channels/api/listen-host
+ *
+ * POST /chat answers without a secret unless `chat.secret` or
+ * `WUNDERLAND_CHAT_SECRET` is set, so `wunderland start`, `wunderland serve`
+ * and {@link createWunderlandServer} listen on the loopback address unless a
+ * host is named, and refuse a host other machines can reach until a chat
+ * secret is set. `0.0.0.0` accepts connections from every machine that can
+ * reach the port.
+ */
+import { isIPv6 } from 'node:net';
+/** The address the agent servers listen on when no host is named. */
+export const DEFAULT_LISTEN_HOST = '127.0.0.1';
+/**
+ * Resolves a `--host` flag.
+ *
+ * @param value - The parsed flag: undefined when absent, `true` when it was given with no address.
+ * @returns The address to listen on: {@link DEFAULT_LISTEN_HOST} when no flag was given, and a
+ *   bracketed IPv6 address (`[::1]`, URL notation) bare, the form server.listen takes.
+ * @throws Error when the flag was given without an address, so a typo never widens the server.
+ */
+export function resolveListenHost(value) {
+    if (value === undefined || value === false)
+        return DEFAULT_LISTEN_HOST;
+    const host = typeof value === 'string' ? value.trim() : '';
+    if (!host) {
+        throw new Error('--host needs an address, for example --host 127.0.0.1 or --host 0.0.0.0');
+    }
+    const bracketed = /^\[(.*)\]$/.exec(host);
+    return bracketed && isIPv6(bracketed[1]) ? bracketed[1] : host;
+}
+/**
+ * Whether only this machine can reach an address.
+ *
+ * @param host - A listen address, with or without IPv6 brackets.
+ * @returns True for `localhost`, `::1` and the 127.0.0.0/8 range.
+ */
+export function isLoopbackHost(host) {
+    const bare = host.trim().toLowerCase().replace(/^\[(.*)\]$/, '$1');
+    return (bare === 'localhost' ||
+        bare === '::1' ||
+        /^127(\.\d{1,3}){3}$/.test(bare) ||
+        /^::ffff:127(\.\d{1,3}){3}$/.test(bare));
+}
+/**
+ * Refuses to listen where other machines can connect while POST /chat has no secret.
+ *
+ * @param host - The address the server is about to listen on.
+ * @param chatSecret - The secret /chat requires; empty when none is set.
+ * @throws Error naming the host and how to set a secret, unless the host is loopback or a secret is set.
+ */
+export function assertChatSecretForHost(host, chatSecret) {
+    if (chatSecret || isLoopbackHost(host))
+        return;
+    throw new Error(`Refusing to listen on ${host}: other machines could reach POST /chat, which has no secret. `
+        + 'Set chat.secret in agent.config.json or WUNDERLAND_CHAT_SECRET (createWunderlandServer() also takes '
+        + 'a chatSecret option), or listen on 127.0.0.1.');
+}
+/**
+ * The host to print in a URL for a listen address.
+ *
+ * @param host - A listen address.
+ * @returns `localhost` for a wildcard address (`0.0.0.0`, `::`), IPv6 in brackets, anything else as given.
+ */
+export function displayHost(host) {
+    if (host === '0.0.0.0' || host === '::')
+        return 'localhost';
+    return host.includes(':') && !host.startsWith('[') ? `[${host}]` : host;
+}
+/**
+ * The /health URL of an agent server.
+ *
+ * @param port - The server's port.
+ * @param host - The address it listens on. Daemons recorded before `--host`
+ *   existed have none; they listened on every interface and answer on localhost.
+ * @returns The URL to poll.
+ */
+export function healthUrl(port, host) {
+    return `http://${host ? displayHost(host) : 'localhost'}:${port}/health`;
+}
+//# sourceMappingURL=listen-host.js.map

package/dist/channels/api/listen-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listen-host.js","sourceRoot":"","sources":["../../../src/channels/api/listen-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAElC,qEAAqE;AACrE,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAmC;IACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,mBAAmB,CAAC;IACvE,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACnE,OAAO,CACL,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,KAAK;QACd,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CACxC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,UAAkB;IACtE,IAAI,UAAU,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO;IAC/C,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,gEAAgE;UACzF,sGAAsG;UACtG,+CAA+C,CACpD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,WAAW,CAAC;IAC5D,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAa;IACnD,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,SAAS,CAAC;AAC3E,CAAC"}

package/dist/channels/api/routes/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../../../src/channels/api/routes/agents.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEjE;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,kBAAkB,CAAC,CA8D7B"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../../../src/channels/api/routes/agents.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEjE;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,kBAAkB,CAAC,CA2E7B"}

package/dist/channels/api/routes/agents.js

@@ -7,7 +7,7 @@
  *  - `GET  /api/tools`          — List all registered tools with schemas
  *  - `POST /api/tools/:name`    — Execute a specific tool by name with JSON arguments
  */
-import { readBody, sendJson } from '../server-helpers.js';
+import { isLoopbackRequest, readBody, sendJson } from '../server-helpers.js';
 /**
  * Attempt to handle tool/agent management routes.
  *
@@ -19,10 +19,21 @@ import { readBody, sendJson } from '../server-helpers.js';
  */
 export async function handleAgentRoutes(req, res, url, deps) {
     const { toolMap, toolApiSecret, policy, activePersonaId } = deps;
+    /**
+     * The tool API runs tools in autonomous mode. With WUNDERLAND_TOOL_API_KEY it
+     * needs that key in x-api-key; without one it answers this machine only, so a
+     * server listening on a wider host never runs tools for other machines.
+     */
+    const toolApiAllowed = () => toolApiSecret ? req.headers['x-api-key'] === toolApiSecret : isLoopbackRequest(req);
+    const refuseToolApi = () => {
+        sendJson(res, 401, {
+            error: toolApiSecret ? 'Unauthorized' : 'Set WUNDERLAND_TOOL_API_KEY to use the tool API from another machine.',
+        });
+    };
     /* GET /api/tools — list all available tools */
     if (url.pathname === '/api/tools' && req.method === 'GET') {
-        if (toolApiSecret && req.headers['x-api-key'] !== toolApiSecret) {
-            sendJson(res, 401, { error: 'Unauthorized' });
+        if (!toolApiAllowed()) {
+            refuseToolApi();
             return true;
         }
         const tools = Array.from(toolMap.values()).map((t) => ({
@@ -37,8 +48,8 @@ export async function handleAgentRoutes(req, res, url, deps) {
     }
     /* POST /api/tools/:name — execute a tool */
     if (url.pathname.startsWith('/api/tools/') && req.method === 'POST') {
-        if (toolApiSecret && req.headers['x-api-key'] !== toolApiSecret) {
-            sendJson(res, 401, { error: 'Unauthorized' });
+        if (!toolApiAllowed()) {
+            refuseToolApi();
             return true;
         }
         const toolName = decodeURIComponent(url.pathname.slice('/api/tools/'.length));

package/dist/channels/api/routes/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../../../src/channels/api/routes/agents.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;;;;GAOG;AAGH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAG1D;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,IAAgB;IAEhB,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAEjE,+CAA+C;IAC/C,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1D,IAAI,aAAa,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,aAAa,EAAE,CAAC;YAChE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrD,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,cAAc,EAAE,CAAC,CAAC,cAAc;SACjC,CAAC,CAAC,CAAC;QACJ,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACpE,IAAI,aAAa,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,aAAa,EAAE,CAAC;YAChE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,QAAQ,aAAa,EAAE,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,GAA4B,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,IAAI;gBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAA4B;gBACnC,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,eAAe;gBAC1B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,aAAa,EAAE,YAAY;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,kBAAkB,EAAE,KAAK;aAC1B,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB;aACpE,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../../../src/channels/api/routes/agents.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;;;;GAOG;AAGH,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAG7E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,IAAgB;IAEhB,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IAEjE;;;;OAIG;IACH,MAAM,cAAc,GAAG,GAAY,EAAE,CACnC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtF,MAAM,aAAa,GAAG,GAAS,EAAE;QAC/B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,uEAAuE;SAChH,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,+CAA+C;IAC/C,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC1D,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,aAAa,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACrD,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,cAAc,EAAE,CAAC,CAAC,cAAc;SACjC,CAAC,CAAC,CAAC;QACJ,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACpE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACtB,aAAa,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,QAAQ,aAAa,EAAE,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,GAA4B,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,IAAI;gBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAA4B;gBACnC,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,eAAe;gBAC1B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,aAAa,EAAE,YAAY;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,kBAAkB,EAAE,KAAK;aAC1B,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB;aACpE,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/channels/api/routes/chat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../../../src/channels/api/routes/chat.ts"],"names":[],"mappings":"AACA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAiBjE,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA8BjE;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,kBAAkB,CAAC,CA2R7B"}
+{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../../../src/channels/api/routes/chat.ts"],"names":[],"mappings":"AACA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAiBjE,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA8BjE;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,kBAAkB,CAAC,CAgS7B"}

package/dist/channels/api/routes/chat.js

@@ -13,7 +13,7 @@ import { randomUUID } from 'node:crypto';
 import { runToolCallingTurn, safeJsonStringify, } from '../../../runtime/tools/tool-calling.js';
 import { buildPersonaSessionKey, createRequestScopedToolMap, extractRequestedPersonaId, resolveRequestScopedPersonaRuntime, } from '../../../runtime/execution/request-persona.js';
 import { buildOllamaRuntimeOptions } from '../../../runtime/tools/ollama-options.js';
-import { readBody, sendJson } from '../server-helpers.js';
+import { isChatAuthorized, readBody, sendJson } from '../server-helpers.js';
 function toAgentosApprovalCategory(tool) {
     const name = String(tool?.name || '').toLowerCase();
     if (name.startsWith('file_') ||
@@ -49,6 +49,10 @@ function toAgentosApprovalCategory(tool) {
 export async function handleChatRoutes(req, res, url, deps) {
     if (url.pathname !== '/chat' || req.method !== 'POST')
         return false;
+    if (!isChatAuthorized(req, url, deps.chatSecret)) {
+        sendJson(res, 401, { error: 'Unauthorized' });
+        return true;
+    }
     const { seedId, displayName, activePersonaId, availablePersonas, providerId, model, llmApiKey, llmBaseUrl, canUseLLM, openrouterFallback, seed, cfg, rawAgentConfig, policy, toolMap, sessions, systemPrompt, adaptiveRuntime, strictToolNames, autoApproveToolCalls, turnApprovalMode, defaultTenantId, workspaceAgentId, workspaceBaseDir, hitlManager, sessionTextLogger, logger, lazyTools, skillsPrompt, workingDirectory, loadedChannelAdapters, configDirOverride, } = deps;
     const body = await readBody(req);
     const parsed = JSON.parse(body || '{}');

package/dist/channels/api/routes/chat.js.map

@@ -1 +1 @@
-{"version":3,"file":"chat.js","sourceRoot":"","sources":["../../../../src/channels/api/routes/chat.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;;;;;;GASG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAErF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAS1D,SAAS,yBAAyB,CAChC,IAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,IACE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EACrB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC;IAChF,MAAM,GAAG,GAAG,MAAM,CAAE,IAAY,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAClD,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,eAAe,CAAC;IAC1D,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC;IACrH,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,IAAgB;IAEhB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAEpE,MAAM,EACJ,MAAM,EACN,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,KAAK,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,kBAAkB,EAClB,IAAI,EACJ,GAAG,EACH,cAAc,EACd,MAAM,EACN,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,MAAM,EACN,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,GAClB,GAAG,IAAI,CAAC;IAET,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,SAAkB,CAAC;IACvB,MAAM,SAAS,GACb,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtH,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,sBAAsB,GAAG,eAAe,CAAC;IAC7C,IAAI,mBAAmB,GAAG,YAAY,CAAC;IACvC,IAAI,cAAc,GAAG,OAAO,CAAC;IAE7B,IAAI,kBAAkB,IAAI,kBAAkB,KAAK,eAAe,EAAE,CAAC;QACjE,MAAM,cAAc,GAAG,MAAM,kCAAkC,CAAC;YAC9D,cAAc;YACd,kBAAkB;YAClB,gBAAgB;YAChB,MAAM;YACN,MAAM;YACN,IAAI,EAAE,QAAQ;YACd,SAAS;YACT,oBAAoB;YACpB,gBAAgB;YAChB,YAAY,EAAE,YAAY,IAAI,SAAS;YACvC,YAAY,EACV,qBAAqB,CAAC,MAAM,GAAG,CAAC;gBAC9B,CAAC,CAAC,qBAAqB;qBACpB,GAAG,CAAC,CAAC,OAAY,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC;qBAC9D,MAAM,CAAC,CAAC,IAAa,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;gBAChG,CAAC,CAAC,SAAS;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,KAAK,EAAE,YAAY,kBAAkB,cAAc;gBACnD,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;aAC5G,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sBAAsB,GAAG,cAAc,CAAC,eAAe,CAAC;QACxD,mBAAmB,GAAG,cAAc,CAAC,YAAY,CAAC;QAClD,cAAc,GAAG,0BAA0B,CAAC,OAAO,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACpF,MAAM,wBAAwB,GAC5B,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,QAAQ,GACZ,CAAC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;WAC5D,eAAe,CAAC;IACrB,MAAM,gBAAgB,GAAG,eAAe,CAAC,mBAAmB,CAAC;QAC3D,KAAK,EAAE;YACL,SAAS;YACT,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,sBAAsB;YACjC,QAAQ,EAAE,QAAQ,IAAI,SAAS;SAChC;QACD,wBAAwB;KACzB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC9D,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,wEAAwE;IACxE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1B,QAAQ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAA4B;gBAC3C,KAAK,EAAE,qBAAqB,iBAAiB,EAAE;gBAC/C,SAAS;gBACT,SAAS,EAAE,sBAAsB;gBACjC,WAAW,EAAE;oBACX,MAAM,EAAE,SAAS;oBACjB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBACpD;gBACD,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC1E,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE;gBACxE,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,kBAAkB,EAAE,KAAK;gBACzB,gBAAgB;gBAChB,eAAe,EAAE,gBAAgB,CAAC,eAAe;gBACjD,iBAAiB,EAAE;oBACjB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;oBACnC,MAAM,EAAE,gBAAgB,CAAC,MAAM;oBAC/B,OAAO,EAAE,gBAAgB,CAAC,OAAO;oBACjC,GAAG,EAAE,gBAAgB,CAAC,GAAG,IAAI,SAAS;iBACvC;gBACD,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACtF,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe;aAChB,CAAC;YAEF,KAAK,GAAG,MAAM,kBAAkB,CAAC;gBAC/B,UAAU;gBACV,MAAM,EAAE,SAAS;gBACjB,KAAK;gBACL,QAAQ;gBACR,OAAO,EAAE,cAAc;gBACvB,WAAW;gBACX,SAAS,EAAE,CAAC;gBACZ,0BAA0B,EAAE,oBAAoB;gBAChD,eAAe;gBACf,eAAe,EAAE,gBAAgB,CAAC,eAAe;gBACjD,aAAa,EAAE,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC;gBACrD,UAAU,EAAE,GAAG,EAAE;oBACf,aAAa,IAAI,CAAC,CAAC;gBACrB,CAAC;gBACD,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;oBAClC,IAAI,oBAAoB;wBAAE,OAAO,IAAI,CAAC;oBACtC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;oBAChF,MAAM,QAAQ,GAAG,QAAQ,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC;oBAClD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC;wBACjD,QAAQ;wBACR,WAAW,EAAE,SAAS,IAAI,CAAC,IAAI,KAAK,WAAW,SAAS,OAAO,EAAE;wBACjE,QAAQ,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;wBACvD,QAAQ,EAAE,yBAAyB,CAAC,IAAI,CAAC;wBACzC,OAAO,EAAE,IAAI,CAAC,MAAM;wBACpB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,sBAAsB,EAAE;wBACpF,UAAU,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;wBACxC,WAAW,EAAE,IAAI,IAAI,EAAE;wBACvB,SAAS,EAAE,CAAC,GAAG,MAAM;qBACtB,CAAC,CAAC;oBACH,OAAO,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC;gBACpC,CAAC;gBACD,aAAa,EACX,gBAAgB,KAAK,KAAK;oBACxB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE;wBAC7B,IAAI,oBAAoB;4BAAE,OAAO,IAAI,CAAC;wBACtC,MAAM,YAAY,GAAG,cAAc,MAAM,IAAI,iBAAiB,IAAI,KAAK,IAAI,UAAU,EAAE,EAAE,CAAC;wBAC1F,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;4BACxC,MAAM,MAAM,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;4BAC/D,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;4BAC/C,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,MAAM,MAAM,OAAO,EAAE,CAAC;wBACjD,CAAC,CAAC,CAAC;wBACH,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC;wBAC7B,MAAM,iBAAiB,GAAG,WAAW;6BAClC,UAAU,CAAC;4BACV,YAAY;4BACZ,UAAU,EAAE,QAAQ,iBAAiB,EAAE;4BACvC,YAAY,EAAE,cAAc,KAAK,EAAE;4BACnC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;4BACtC,aAAa;4BACb,YAAY,EAAE,CAAC,4BAA4B,CAAC;4BAC5C,MAAM,EAAE,EAAE;4BACV,KAAK,EAAE,WAAW;4BAClB,YAAY,EAAE,IAAI,IAAI,EAAE;yBACzB,CAAC;6BACD,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC;wBACjD,MAAM,cAAc,GAAG,IAAI,OAAO,CAAwB,CAAC,OAAO,EAAE,EAAE,CACpE,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAC5D,CAAC;wBACF,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAQ,CAAC;wBAClF,IAAI,QAAQ,EAAE,QAAQ,KAAK,UAAU,EAAE,CAAC;4BACtC,IAAI,CAAC;gCACH,MAAM,WAAW,CAAC,aAAa,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;4BAC/E,CAAC;4BAAC,MAAM,CAAC;gCACP,SAAS;4BACX,CAAC;wBACH,CAAC;wBACD,OAAO,QAAQ,EAAE,QAAQ,KAAK,UAAU,CAAC;oBAC3C,CAAC;gBACP,OAAO,EAAE,UAAU;gBACnB,QAAQ,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;gBAClE,UAAU,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;oBAC5B,iBAAiB,GAAG,IAAI,CAAC;oBACzB,MAAM,CAAC,IAAI,EAAE,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACzF,CAAC;aACF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK;gBACH,uFAAuF;oBACvF,iHAAiH;oBACjH,aAAa,OAAO,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,GAAG,IAAI,CAAC;QAClB,SAAS,GAAG,KAAK,CAAC;QAClB,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,iBAAiB,CAAC;gBACtC,KAAK,EAAE;oBACL,SAAS;oBACT,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,sBAAsB;oBACjC,QAAQ,EAAE,QAAQ,IAAI,SAAS;iBAChC;gBACD,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,IAAI,iBAAiB;gBACxD,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,UAAU;gBACnB,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,EAAE,CAAC,0DAA0D,EAAE;gBACxE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,iBAAiB,CAAC,OAAO,CAAC;YAC9B,IAAI,EAAE;gBACJ,OAAO,EAAE,gBAAgB;gBACzB,MAAM;gBACN,WAAW;gBACX,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;gBAC9B,KAAK;gBACL,SAAS,EAAE,sBAAsB;aAClC;YACD,SAAS;YACT,QAAQ,EAAE,OAAO;YACjB,KAAK;YACL,KAAK,EAAE,SAAS;YAChB,aAAa;YACb,UAAU,EAAE,CAAC;YACb,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"chat.js","sourceRoot":"","sources":["../../../../src/channels/api/routes/chat.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;;;;;;GASG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AAErF,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAS5E,SAAS,yBAAyB,CAChC,IAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,IACE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EACrB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC;IAChF,MAAM,GAAG,GAAG,MAAM,CAAE,IAAY,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAClD,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,eAAe,CAAC;IAC1D,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC;IACrH,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAoB,EACpB,GAAmB,EACnB,GAAQ,EACR,IAAgB;IAEhB,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAEpE,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EACJ,MAAM,EACN,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,KAAK,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,kBAAkB,EAClB,IAAI,EACJ,GAAG,EACH,cAAc,EACd,MAAM,EACN,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,MAAM,EACN,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,GAClB,GAAG,IAAI,CAAC;IAET,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,SAAkB,CAAC;IACvB,MAAM,SAAS,GACb,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtH,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC7D,IAAI,sBAAsB,GAAG,eAAe,CAAC;IAC7C,IAAI,mBAAmB,GAAG,YAAY,CAAC;IACvC,IAAI,cAAc,GAAG,OAAO,CAAC;IAE7B,IAAI,kBAAkB,IAAI,kBAAkB,KAAK,eAAe,EAAE,CAAC;QACjE,MAAM,cAAc,GAAG,MAAM,kCAAkC,CAAC;YAC9D,cAAc;YACd,kBAAkB;YAClB,gBAAgB;YAChB,MAAM;YACN,MAAM;YACN,IAAI,EAAE,QAAQ;YACd,SAAS;YACT,oBAAoB;YACpB,gBAAgB;YAChB,YAAY,EAAE,YAAY,IAAI,SAAS;YACvC,YAAY,EACV,qBAAqB,CAAC,MAAM,GAAG,CAAC;gBAC9B,CAAC,CAAC,qBAAqB;qBACpB,GAAG,CAAC,CAAC,OAAY,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC;qBAC9D,MAAM,CAAC,CAAC,IAAa,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;gBAChG,CAAC,CAAC,SAAS;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBACjB,KAAK,EAAE,YAAY,kBAAkB,cAAc;gBACnD,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;aAC5G,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sBAAsB,GAAG,cAAc,CAAC,eAAe,CAAC;QACxD,mBAAmB,GAAG,cAAc,CAAC,YAAY,CAAC;QAClD,cAAc,GAAG,0BAA0B,CAAC,OAAO,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACpF,MAAM,wBAAwB,GAC5B,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,QAAQ,GACZ,CAAC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;WAC5D,eAAe,CAAC;IACrB,MAAM,gBAAgB,GAAG,eAAe,CAAC,mBAAmB,CAAC;QAC3D,KAAK,EAAE;YACL,SAAS;YACT,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,sBAAsB;YACjC,QAAQ,EAAE,QAAQ,IAAI,SAAS;SAChC;QACD,wBAAwB;KACzB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC9D,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,wEAAwE;IACxE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1B,QAAQ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAElD,IAAI,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAA4B;gBAC3C,KAAK,EAAE,qBAAqB,iBAAiB,EAAE;gBAC/C,SAAS;gBACT,SAAS,EAAE,sBAAsB;gBACjC,WAAW,EAAE;oBACX,MAAM,EAAE,SAAS;oBACjB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBACpD;gBACD,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC1E,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE;gBACxE,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,kBAAkB,EAAE,KAAK;gBACzB,gBAAgB;gBAChB,eAAe,EAAE,gBAAgB,CAAC,eAAe;gBACjD,iBAAiB,EAAE;oBACjB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;oBACnC,MAAM,EAAE,gBAAgB,CAAC,MAAM;oBAC/B,OAAO,EAAE,gBAAgB,CAAC,OAAO;oBACjC,GAAG,EAAE,gBAAgB,CAAC,GAAG,IAAI,SAAS;iBACvC;gBACD,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACtF,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe;aAChB,CAAC;YAEF,KAAK,GAAG,MAAM,kBAAkB,CAAC;gBAC/B,UAAU;gBACV,MAAM,EAAE,SAAS;gBACjB,KAAK;gBACL,QAAQ;gBACR,OAAO,EAAE,cAAc;gBACvB,WAAW;gBACX,SAAS,EAAE,CAAC;gBACZ,0BAA0B,EAAE,oBAAoB;gBAChD,eAAe;gBACf,eAAe,EAAE,gBAAgB,CAAC,eAAe;gBACjD,aAAa,EAAE,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC;gBACrD,UAAU,EAAE,GAAG,EAAE;oBACf,aAAa,IAAI,CAAC,CAAC;gBACrB,CAAC;gBACD,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;oBAClC,IAAI,oBAAoB;wBAAE,OAAO,IAAI,CAAC;oBACtC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;oBAChF,MAAM,QAAQ,GAAG,QAAQ,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC;oBAClD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC;wBACjD,QAAQ;wBACR,WAAW,EAAE,SAAS,IAAI,CAAC,IAAI,KAAK,WAAW,SAAS,OAAO,EAAE;wBACjE,QAAQ,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;wBACvD,QAAQ,EAAE,yBAAyB,CAAC,IAAI,CAAC;wBACzC,OAAO,EAAE,IAAI,CAAC,MAAM;wBACpB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,sBAAsB,EAAE;wBACpF,UAAU,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;wBACxC,WAAW,EAAE,IAAI,IAAI,EAAE;wBACvB,SAAS,EAAE,CAAC,GAAG,MAAM;qBACtB,CAAC,CAAC;oBACH,OAAO,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC;gBACpC,CAAC;gBACD,aAAa,EACX,gBAAgB,KAAK,KAAK;oBACxB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE;wBAC7B,IAAI,oBAAoB;4BAAE,OAAO,IAAI,CAAC;wBACtC,MAAM,YAAY,GAAG,cAAc,MAAM,IAAI,iBAAiB,IAAI,KAAK,IAAI,UAAU,EAAE,EAAE,CAAC;wBAC1F,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;4BACxC,MAAM,MAAM,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;4BAC/D,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;4BAC/C,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,MAAM,MAAM,OAAO,EAAE,CAAC;wBACjD,CAAC,CAAC,CAAC;wBACH,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC;wBAC7B,MAAM,iBAAiB,GAAG,WAAW;6BAClC,UAAU,CAAC;4BACV,YAAY;4BACZ,UAAU,EAAE,QAAQ,iBAAiB,EAAE;4BACvC,YAAY,EAAE,cAAc,KAAK,EAAE;4BACnC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;4BACtC,aAAa;4BACb,YAAY,EAAE,CAAC,4BAA4B,CAAC;4BAC5C,MAAM,EAAE,EAAE;4BACV,KAAK,EAAE,WAAW;4BAClB,YAAY,EAAE,IAAI,IAAI,EAAE;yBACzB,CAAC;6BACD,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAgB,EAAE,CAAC,CAAC,CAAC;wBACjD,MAAM,cAAc,GAAG,IAAI,OAAO,CAAwB,CAAC,OAAO,EAAE,EAAE,CACpE,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAC5D,CAAC;wBACF,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAQ,CAAC;wBAClF,IAAI,QAAQ,EAAE,QAAQ,KAAK,UAAU,EAAE,CAAC;4BACtC,IAAI,CAAC;gCACH,MAAM,WAAW,CAAC,aAAa,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;4BAC/E,CAAC;4BAAC,MAAM,CAAC;gCACP,SAAS;4BACX,CAAC;wBACH,CAAC;wBACD,OAAO,QAAQ,EAAE,QAAQ,KAAK,UAAU,CAAC;oBAC3C,CAAC;gBACP,OAAO,EAAE,UAAU;gBACnB,QAAQ,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;gBAClE,UAAU,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;oBAC5B,iBAAiB,GAAG,IAAI,CAAC;oBACzB,MAAM,CAAC,IAAI,EAAE,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACzF,CAAC;aACF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK;gBACH,uFAAuF;oBACvF,iHAAiH;oBACjH,aAAa,OAAO,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,UAAU,GAAG,IAAI,CAAC;QAClB,SAAS,GAAG,KAAK,CAAC;QAClB,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,iBAAiB,CAAC;gBACtC,KAAK,EAAE;oBACL,SAAS;oBACT,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,sBAAsB;oBACjC,QAAQ,EAAE,QAAQ,IAAI,SAAS;iBAChC;gBACD,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,IAAI,iBAAiB;gBACxD,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,UAAU;gBACnB,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,EAAE,CAAC,0DAA0D,EAAE;gBACxE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,iBAAiB,CAAC,OAAO,CAAC;YAC9B,IAAI,EAAE;gBACJ,OAAO,EAAE,gBAAgB;gBACzB,MAAM;gBACN,WAAW;gBACX,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;gBAC9B,KAAK;gBACL,SAAS,EAAE,sBAAsB;aAClC;YACD,SAAS;YACT,QAAQ,EAAE,OAAO;YACjB,KAAK;YACL,KAAK,EAAE,SAAS;YAChB,aAAa;YACb,UAAU,EAAE,CAAC;YACb,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/channels/api/routes/types.d.ts

@@ -61,6 +61,8 @@ export interface ServerDeps {
     skillsPrompt: string;
     workingDirectory: string;
     hitlSecret: string;
+    /** Secret POST /chat requires; empty when none is set (loopback hosts only). */
+    chatSecret: string;
     hitlManager: HumanInteractionManager;
     sseClients: Set<ServerResponse>;
     broadcastHitlUpdate: (payload: Record<string, unknown>) => Promise<void>;

package/dist/channels/api/routes/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/channels/api/routes/types.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAC;AACvG,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE/E,0DAA0D;AAC1D,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CAC/C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IAEzB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,EAAE,GAAG,EAAE,CAAC;IAGzB,UAAU,EAAE,oBAAoB,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,kBAAkB,EAAE,GAAG,CAAC;IAGxB,IAAI,EAAE,GAAG,CAAC;IACV,GAAG,EAAE,qBAAqB,CAAC;IAC3B,cAAc,EAAE,qBAAqB,CAAC;IACtC,MAAM,EAAE,uBAAuB,CAAC;IAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACtD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,kCAAkC,CAAC;IACpD,gBAAgB,EAAE,0BAA0B,CAAC;IAC7C,eAAe,EAAE,OAAO,CAAC;IACzB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,gBAAgB,EAAE,KAAK,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;IACjE,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IAGzB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,uBAAuB,CAAC;IACrC,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IAChC,mBAAmB,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,cAAc,CAAC;IAGxB,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,qBAAqB,EAAE,GAAG,EAAE,CAAC;IAC7B,kBAAkB,EAAE,KAAK,CACvB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAC1E,CAAC;IAGF,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,MAAM,EAAE,UAAU,CAAC;IAGnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,0BAA0B,EAAE,OAAO,CAAC;IACpC,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CAC3D;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/channels/api/routes/types.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qDAAqD,CAAC;AACvG,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE/E,0DAA0D;AAC1D,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CAC/C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IAEzB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,EAAE,GAAG,EAAE,CAAC;IAGzB,UAAU,EAAE,oBAAoB,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,kBAAkB,EAAE,GAAG,CAAC;IAGxB,IAAI,EAAE,GAAG,CAAC;IACV,GAAG,EAAE,qBAAqB,CAAC;IAC3B,cAAc,EAAE,qBAAqB,CAAC;IACtC,MAAM,EAAE,uBAAuB,CAAC;IAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACtD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,kCAAkC,CAAC;IACpD,gBAAgB,EAAE,0BAA0B,CAAC;IAC7C,eAAe,EAAE,OAAO,CAAC;IACzB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,gBAAgB,EAAE,KAAK,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;IACjE,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IAGzB,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,uBAAuB,CAAC;IACrC,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IAChC,mBAAmB,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,EAAE,cAAc,CAAC;IAGxB,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,qBAAqB,EAAE,GAAG,EAAE,CAAC;IAC7B,kBAAkB,EAAE,KAAK,CACvB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAC1E,CAAC;IAGF,iBAAiB,EAAE,2BAA2B,CAAC;IAC/C,MAAM,EAAE,UAAU,CAAC;IAGnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,0BAA0B,EAAE,OAAO,CAAC;IACpC,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CAC3D;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC"}

package/dist/channels/api/server-helpers.d.ts

@@ -25,8 +25,14 @@ export declare function sendJson(res: import('node:http').ServerResponse, status
 export declare function getHeaderString(req: import('node:http').IncomingMessage, header: string): string;
 export declare function extractHitlSecret(req: import('node:http').IncomingMessage, url: URL): string;
 export declare function isHitlAuthorized(req: import('node:http').IncomingMessage, url: URL, hitlSecret: string): boolean;
+/** Whether a request comes from this machine's loopback interface. */
+export declare function isLoopbackRequest(req: import('node:http').IncomingMessage): boolean;
+/** The chat secret a request carries: the `x-wunderland-chat-secret` header, else `?chat_secret=` or `?secret=`. */
+export declare function extractChatSecret(req: import('node:http').IncomingMessage, url: URL): string;
+/** Whether a request may use POST /chat: always when no chat secret is set, otherwise only with it. */
+export declare function isChatAuthorized(req: import('node:http').IncomingMessage, url: URL, chatSecret: string): boolean;
 export declare function inferTurnApprovalMode(cfg: WunderlandAgentConfig | undefined): 'off' | 'after-each-turn' | 'after-each-round';
 export declare function finiteNumber(value: unknown, fallback: number): number;
-export declare const PAIRING_PAGE_HTML = "<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <title>Wunderland Pairing</title>\n    <style>\n      :root { --bg: #0b1020; --panel: #111833; --text: #e8ecff; --muted: #9aa6d8; --accent: #53d6c7; --danger: #ff6b6b; --ok: #63e6be; }\n      body { margin: 0; font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, Helvetica, Arial, sans-serif; background: radial-gradient(1200px 800px at 20% 20%, #18244a, var(--bg)); color: var(--text); }\n      header { padding: 16px 20px; border-bottom: 1px solid rgba(255,255,255,0.08); position: sticky; top: 0; background: rgba(11,16,32,0.75); backdrop-filter: blur(6px); }\n      h1 { margin: 0; font-size: 16px; letter-spacing: 0.2px; }\n      main { padding: 18px 20px; display: grid; gap: 16px; max-width: 1100px; margin: 0 auto; }\n      .row { display: grid; grid-template-columns: 1fr; gap: 16px; }\n      @media (min-width: 900px) { .row { grid-template-columns: 1fr 1fr; } }\n      .card { background: rgba(17,24,51,0.78); border: 1px solid rgba(255,255,255,0.10); border-radius: 12px; padding: 14px; box-shadow: 0 20px 40px rgba(0,0,0,0.22); }\n      .card h2 { margin: 0 0 10px; font-size: 13px; color: var(--muted); font-weight: 600; text-transform: uppercase; letter-spacing: 0.08em; }\n      .meta { display: flex; gap: 10px; align-items: center; color: var(--muted); font-size: 12px; flex-wrap: wrap; }\n      input { width: 360px; max-width: 100%; border-radius: 10px; border: 1px solid rgba(255,255,255,0.14); background: rgba(0,0,0,0.22); color: var(--text); padding: 8px 10px; }\n      button { appearance: none; border: 1px solid rgba(255,255,255,0.18); background: rgba(255,255,255,0.06); color: var(--text); padding: 8px 10px; border-radius: 10px; cursor: pointer; font-weight: 600; font-size: 12px; }\n      button:hover { border-color: rgba(83,214,199,0.55); }\n      button.ok { background: rgba(99,230,190,0.12); border-color: rgba(99,230,190,0.28); }\n      button.bad { background: rgba(255,107,107,0.10); border-color: rgba(255,107,107,0.30); }\n      .item { border: 1px solid rgba(255,255,255,0.10); border-radius: 10px; padding: 12px; margin: 10px 0; background: rgba(0,0,0,0.14); }\n      .title { display: flex; align-items: baseline; justify-content: space-between; gap: 12px; }\n      .id { font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", monospace; font-size: 12px; color: rgba(232,236,255,0.85); }\n      .desc { margin-top: 8px; font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", monospace; font-size: 11px; color: rgba(232,236,255,0.78); line-height: 1.5; white-space: pre-wrap; }\n      .btns { display: flex; gap: 8px; flex-wrap: wrap; margin-top: 10px; }\n      .status { font-size: 12px; color: var(--muted); }\n      .note { font-size: 12px; color: rgba(232,236,255,0.86); line-height: 1.5; }\n      ul { margin: 8px 0 0; padding-left: 18px; }\n      li { margin: 6px 0; }\n      code { font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", \"Courier New\", monospace; font-size: 11px; color: rgba(232,236,255,0.92); }\n    </style>\n  </head>\n  <body>\n    <header>\n      <h1>Wunderland Pairing</h1>\n      <div class=\"meta\">\n        <span>Paste the admin secret to approve pairing codes.</span>\n      </div>\n    </header>\n    <main>\n      <div class=\"card\">\n        <h2>Admin Secret</h2>\n        <div class=\"meta\">\n          <input id=\"secret\" placeholder=\"x-wunderland-hitl-secret\" />\n          <button id=\"connect\" class=\"ok\">Connect</button>\n          <button id=\"refresh\">Refresh</button>\n          <span class=\"status\" id=\"hint\"></span>\n        </div>\n        <div class=\"status\" style=\"margin-top:10px\">\n          Unknown senders receive a pairing code automatically in DMs. In group chats, send the pairing trigger (default <code>!pair</code>) to request one.\n        </div>\n      </div>\n\n      <div class=\"card\">\n        <h2>Security</h2>\n        <div class=\"note\">\n          <div><strong>Treat the secret like a password.</strong> This server binds to <code>0.0.0.0</code> by default.</div>\n          <ul>\n            <li>Don\u2019t share URLs containing <code>?secret=...</code> (they can end up in browser history/logs).</li>\n            <li>This UI stores the secret in localStorage (<code>wunderland_hitl_secret</code>). Clear site data to forget it.</li>\n            <li>Set a stable secret via <code>agent.config.json</code> \u2192 <code>hitl.secret</code> or <code>WUNDERLAND_HITL_SECRET</code> (restart to rotate).</li>\n            <li>Remote ops: use SSH port-forwarding (example: <code>ssh -L 3777:localhost:3777 you@host</code>).</li>\n            <li>Approve pairing only for people you trust (it grants the sender access to the agent).</li>\n          </ul>\n          <div style=\"margin-top:10px\">Tip: run <code>wunderland help security</code> for the full model.</div>\n        </div>\n      </div>\n\n      <div class=\"row\">\n        <div class=\"card\">\n          <h2>Pending Requests</h2>\n          <div id=\"requests\" class=\"status\">Loading\u2026</div>\n        </div>\n        <div class=\"card\">\n          <h2>Allowlist</h2>\n          <div id=\"allowlist\" class=\"status\">Loading\u2026</div>\n        </div>\n      </div>\n    </main>\n    <script>\n      const server = window.location.origin;\n      const secretInput = document.getElementById('secret');\n      const hint = document.getElementById('hint');\n      const requestsEl = document.getElementById('requests');\n      const allowEl = document.getElementById('allowlist');\n\n      const stored = localStorage.getItem('wunderland_hitl_secret');\n      if (stored) secretInput.value = stored;\n\n      async function api(path, method, body) {\n        const secret = secretInput.value.trim();\n        const url = new URL(server + path);\n        url.searchParams.set('secret', secret);\n        const res = await fetch(url.toString(), {\n          method,\n          headers: { 'Content-Type': 'application/json' },\n          body: body ? JSON.stringify(body) : undefined,\n        });\n        if (!res.ok) throw new Error('HTTP ' + res.status);\n        return res.json();\n      }\n\n      function esc(s) {\n        return String(s || '').replace(/[&<>\"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','\"':'&quot;',\"'\":'&#39;'}[c]));\n      }\n\n      function renderRequests(payload) {\n        const by = (payload && payload.requestsByChannel) || {};\n        const channels = Object.keys(by).sort();\n        if (channels.length === 0) { requestsEl.innerHTML = '<div class=\"status\">No pending requests.</div>'; return; }\n        requestsEl.innerHTML = '';\n        for (const ch of channels) {\n          const list = by[ch] || [];\n          if (!list.length) continue;\n          const header = document.createElement('div');\n          header.className = 'status';\n          header.textContent = ch;\n          header.style.marginTop = '8px';\n          requestsEl.appendChild(header);\n          for (const r of list) {\n            const div = document.createElement('div');\n            div.className = 'item';\n            div.innerHTML =\n              '<div class=\"title\"><div><strong>' + esc(r.code || '') + '</strong></div><div class=\"id\">' + esc(r.id || '') + '</div></div>' +\n              '<div class=\"desc\">' + esc(JSON.stringify(r.meta || {}, null, 2)) + '</div>' +\n              '<div class=\"btns\"><button class=\"ok\">Approve</button><button class=\"bad\">Reject</button></div>';\n            const btns = div.querySelectorAll('button');\n            btns[0].onclick = async () => { await api('/pairing/approve', 'POST', { channel: ch, code: r.code }); await refresh(); };\n            btns[1].onclick = async () => { await api('/pairing/reject', 'POST', { channel: ch, code: r.code }); await refresh(); };\n            requestsEl.appendChild(div);\n          }\n        }\n      }\n\n      function renderAllowlist(payload) {\n        const by = (payload && payload.allowlistByChannel) || {};\n        const channels = Object.keys(by).sort();\n        if (channels.length === 0) { allowEl.innerHTML = '<div class=\"status\">No allowlist entries.</div>'; return; }\n        allowEl.innerHTML = '';\n        for (const ch of channels) {\n          const list = by[ch] || [];\n          const header = document.createElement('div');\n          header.className = 'status';\n          header.textContent = ch;\n          header.style.marginTop = '8px';\n          allowEl.appendChild(header);\n          const div = document.createElement('div');\n          div.className = 'item';\n          div.innerHTML = '<div class=\"desc\">' + esc(list.join('\\n')) + '</div>';\n          allowEl.appendChild(div);\n        }\n      }\n\n      async function refresh() {\n        try {\n          const pending = await api('/pairing/requests', 'GET');\n          renderRequests(pending);\n          const allow = await api('/pairing/allowlist', 'GET');\n          renderAllowlist(allow);\n          hint.textContent = '';\n        } catch (e) {\n          requestsEl.innerHTML = '<div class=\"status\">Paste the admin secret to view pairing requests.</div>';\n          allowEl.innerHTML = '';\n          hint.textContent = 'Unauthorized or server error.';\n        }\n      }\n\n      function connect() {\n        const secret = secretInput.value.trim();\n        if (!secret) { hint.textContent = 'Paste secret from server logs.'; return; }\n        localStorage.setItem('wunderland_hitl_secret', secret);\n        refresh();\n      }\n\n      document.getElementById('connect').onclick = connect;\n      document.getElementById('refresh').onclick = refresh;\n      refresh();\n      setInterval(refresh, 5000);\n    </script>\n  </body>\n</html>";
+export declare const PAIRING_PAGE_HTML = "<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <title>Wunderland Pairing</title>\n    <style>\n      :root { --bg: #0b1020; --panel: #111833; --text: #e8ecff; --muted: #9aa6d8; --accent: #53d6c7; --danger: #ff6b6b; --ok: #63e6be; }\n      body { margin: 0; font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, Helvetica, Arial, sans-serif; background: radial-gradient(1200px 800px at 20% 20%, #18244a, var(--bg)); color: var(--text); }\n      header { padding: 16px 20px; border-bottom: 1px solid rgba(255,255,255,0.08); position: sticky; top: 0; background: rgba(11,16,32,0.75); backdrop-filter: blur(6px); }\n      h1 { margin: 0; font-size: 16px; letter-spacing: 0.2px; }\n      main { padding: 18px 20px; display: grid; gap: 16px; max-width: 1100px; margin: 0 auto; }\n      .row { display: grid; grid-template-columns: 1fr; gap: 16px; }\n      @media (min-width: 900px) { .row { grid-template-columns: 1fr 1fr; } }\n      .card { background: rgba(17,24,51,0.78); border: 1px solid rgba(255,255,255,0.10); border-radius: 12px; padding: 14px; box-shadow: 0 20px 40px rgba(0,0,0,0.22); }\n      .card h2 { margin: 0 0 10px; font-size: 13px; color: var(--muted); font-weight: 600; text-transform: uppercase; letter-spacing: 0.08em; }\n      .meta { display: flex; gap: 10px; align-items: center; color: var(--muted); font-size: 12px; flex-wrap: wrap; }\n      input { width: 360px; max-width: 100%; border-radius: 10px; border: 1px solid rgba(255,255,255,0.14); background: rgba(0,0,0,0.22); color: var(--text); padding: 8px 10px; }\n      button { appearance: none; border: 1px solid rgba(255,255,255,0.18); background: rgba(255,255,255,0.06); color: var(--text); padding: 8px 10px; border-radius: 10px; cursor: pointer; font-weight: 600; font-size: 12px; }\n      button:hover { border-color: rgba(83,214,199,0.55); }\n      button.ok { background: rgba(99,230,190,0.12); border-color: rgba(99,230,190,0.28); }\n      button.bad { background: rgba(255,107,107,0.10); border-color: rgba(255,107,107,0.30); }\n      .item { border: 1px solid rgba(255,255,255,0.10); border-radius: 10px; padding: 12px; margin: 10px 0; background: rgba(0,0,0,0.14); }\n      .title { display: flex; align-items: baseline; justify-content: space-between; gap: 12px; }\n      .id { font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", monospace; font-size: 12px; color: rgba(232,236,255,0.85); }\n      .desc { margin-top: 8px; font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", monospace; font-size: 11px; color: rgba(232,236,255,0.78); line-height: 1.5; white-space: pre-wrap; }\n      .btns { display: flex; gap: 8px; flex-wrap: wrap; margin-top: 10px; }\n      .status { font-size: 12px; color: var(--muted); }\n      .note { font-size: 12px; color: rgba(232,236,255,0.86); line-height: 1.5; }\n      ul { margin: 8px 0 0; padding-left: 18px; }\n      li { margin: 6px 0; }\n      code { font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", \"Courier New\", monospace; font-size: 11px; color: rgba(232,236,255,0.92); }\n    </style>\n  </head>\n  <body>\n    <header>\n      <h1>Wunderland Pairing</h1>\n      <div class=\"meta\">\n        <span>Paste the admin secret to approve pairing codes.</span>\n      </div>\n    </header>\n    <main>\n      <div class=\"card\">\n        <h2>Admin Secret</h2>\n        <div class=\"meta\">\n          <input id=\"secret\" placeholder=\"x-wunderland-hitl-secret\" />\n          <button id=\"connect\" class=\"ok\">Connect</button>\n          <button id=\"refresh\">Refresh</button>\n          <span class=\"status\" id=\"hint\"></span>\n        </div>\n        <div class=\"status\" style=\"margin-top:10px\">\n          Unknown senders receive a pairing code automatically in DMs. In group chats, send the pairing trigger (default <code>!pair</code>) to request one.\n        </div>\n      </div>\n\n      <div class=\"card\">\n        <h2>Security</h2>\n        <div class=\"note\">\n          <div><strong>Treat the secret like a password.</strong> This server listens on <code>127.0.0.1</code>, this machine only, unless it was started with another host (<code>--host</code> or the <code>host</code> option), which it does only once a chat secret is set.</div>\n          <ul>\n            <li>Don\u2019t share URLs containing <code>?secret=...</code> (they can end up in browser history/logs).</li>\n            <li>This UI stores the secret in localStorage (<code>wunderland_hitl_secret</code>). Clear site data to forget it.</li>\n            <li>Set a stable secret via <code>agent.config.json</code> \u2192 <code>hitl.secret</code> or <code>WUNDERLAND_HITL_SECRET</code> (restart to rotate).</li>\n            <li>Remote ops: use SSH port-forwarding (example: <code>ssh -L 3777:localhost:3777 you@host</code>).</li>\n            <li>Approve pairing only for people you trust (it grants the sender access to the agent).</li>\n          </ul>\n          <div style=\"margin-top:10px\">Tip: run <code>wunderland help security</code> for the full model.</div>\n        </div>\n      </div>\n\n      <div class=\"row\">\n        <div class=\"card\">\n          <h2>Pending Requests</h2>\n          <div id=\"requests\" class=\"status\">Loading\u2026</div>\n        </div>\n        <div class=\"card\">\n          <h2>Allowlist</h2>\n          <div id=\"allowlist\" class=\"status\">Loading\u2026</div>\n        </div>\n      </div>\n    </main>\n    <script>\n      const server = window.location.origin;\n      const secretInput = document.getElementById('secret');\n      const hint = document.getElementById('hint');\n      const requestsEl = document.getElementById('requests');\n      const allowEl = document.getElementById('allowlist');\n\n      const stored = localStorage.getItem('wunderland_hitl_secret');\n      if (stored) secretInput.value = stored;\n\n      async function api(path, method, body) {\n        const secret = secretInput.value.trim();\n        const url = new URL(server + path);\n        url.searchParams.set('secret', secret);\n        const res = await fetch(url.toString(), {\n          method,\n          headers: { 'Content-Type': 'application/json' },\n          body: body ? JSON.stringify(body) : undefined,\n        });\n        if (!res.ok) throw new Error('HTTP ' + res.status);\n        return res.json();\n      }\n\n      function esc(s) {\n        return String(s || '').replace(/[&<>\"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','\"':'&quot;',\"'\":'&#39;'}[c]));\n      }\n\n      function renderRequests(payload) {\n        const by = (payload && payload.requestsByChannel) || {};\n        const channels = Object.keys(by).sort();\n        if (channels.length === 0) { requestsEl.innerHTML = '<div class=\"status\">No pending requests.</div>'; return; }\n        requestsEl.innerHTML = '';\n        for (const ch of channels) {\n          const list = by[ch] || [];\n          if (!list.length) continue;\n          const header = document.createElement('div');\n          header.className = 'status';\n          header.textContent = ch;\n          header.style.marginTop = '8px';\n          requestsEl.appendChild(header);\n          for (const r of list) {\n            const div = document.createElement('div');\n            div.className = 'item';\n            div.innerHTML =\n              '<div class=\"title\"><div><strong>' + esc(r.code || '') + '</strong></div><div class=\"id\">' + esc(r.id || '') + '</div></div>' +\n              '<div class=\"desc\">' + esc(JSON.stringify(r.meta || {}, null, 2)) + '</div>' +\n              '<div class=\"btns\"><button class=\"ok\">Approve</button><button class=\"bad\">Reject</button></div>';\n            const btns = div.querySelectorAll('button');\n            btns[0].onclick = async () => { await api('/pairing/approve', 'POST', { channel: ch, code: r.code }); await refresh(); };\n            btns[1].onclick = async () => { await api('/pairing/reject', 'POST', { channel: ch, code: r.code }); await refresh(); };\n            requestsEl.appendChild(div);\n          }\n        }\n      }\n\n      function renderAllowlist(payload) {\n        const by = (payload && payload.allowlistByChannel) || {};\n        const channels = Object.keys(by).sort();\n        if (channels.length === 0) { allowEl.innerHTML = '<div class=\"status\">No allowlist entries.</div>'; return; }\n        allowEl.innerHTML = '';\n        for (const ch of channels) {\n          const list = by[ch] || [];\n          const header = document.createElement('div');\n          header.className = 'status';\n          header.textContent = ch;\n          header.style.marginTop = '8px';\n          allowEl.appendChild(header);\n          const div = document.createElement('div');\n          div.className = 'item';\n          div.innerHTML = '<div class=\"desc\">' + esc(list.join('\\n')) + '</div>';\n          allowEl.appendChild(div);\n        }\n      }\n\n      async function refresh() {\n        try {\n          const pending = await api('/pairing/requests', 'GET');\n          renderRequests(pending);\n          const allow = await api('/pairing/allowlist', 'GET');\n          renderAllowlist(allow);\n          hint.textContent = '';\n        } catch (e) {\n          requestsEl.innerHTML = '<div class=\"status\">Paste the admin secret to view pairing requests.</div>';\n          allowEl.innerHTML = '';\n          hint.textContent = 'Unauthorized or server error.';\n        }\n      }\n\n      function connect() {\n        const secret = secretInput.value.trim();\n        if (!secret) { hint.textContent = 'Paste secret from server logs.'; return; }\n        localStorage.setItem('wunderland_hitl_secret', secret);\n        refresh();\n      }\n\n      document.getElementById('connect').onclick = connect;\n      document.getElementById('refresh').onclick = refresh;\n      refresh();\n      setInterval(refresh, 5000);\n    </script>\n  </body>\n</html>";
 export declare const HITL_PAGE_HTML = "<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <title>Wunderland HITL</title>\n    <style>\n      :root { --bg: #0b1020; --panel: #111833; --text: #e8ecff; --muted: #9aa6d8; --accent: #53d6c7; --danger: #ff6b6b; --ok: #63e6be; }\n      body { margin: 0; font-family: ui-sans-serif, system-ui, -apple-system, Segoe UI, Roboto, Helvetica, Arial, sans-serif; background: radial-gradient(1200px 800px at 20% 20%, #18244a, var(--bg)); color: var(--text); }\n      header { padding: 16px 20px; border-bottom: 1px solid rgba(255,255,255,0.08); position: sticky; top: 0; background: rgba(11,16,32,0.75); backdrop-filter: blur(6px); }\n      h1 { margin: 0; font-size: 16px; letter-spacing: 0.2px; }\n      main { padding: 18px 20px; display: grid; gap: 16px; max-width: 1100px; margin: 0 auto; }\n      .row { display: grid; grid-template-columns: 1fr; gap: 16px; }\n      @media (min-width: 900px) { .row { grid-template-columns: 1fr 1fr; } }\n      .card { background: rgba(17,24,51,0.78); border: 1px solid rgba(255,255,255,0.10); border-radius: 12px; padding: 14px; box-shadow: 0 20px 40px rgba(0,0,0,0.22); }\n      .card h2 { margin: 0 0 10px; font-size: 13px; color: var(--muted); font-weight: 600; text-transform: uppercase; letter-spacing: 0.08em; }\n      .meta { display: flex; gap: 10px; align-items: center; color: var(--muted); font-size: 12px; flex-wrap: wrap; }\n      input { width: 360px; max-width: 100%; border-radius: 10px; border: 1px solid rgba(255,255,255,0.14); background: rgba(0,0,0,0.22); color: var(--text); padding: 8px 10px; }\n      button { appearance: none; border: 1px solid rgba(255,255,255,0.18); background: rgba(255,255,255,0.06); color: var(--text); padding: 8px 10px; border-radius: 10px; cursor: pointer; font-weight: 600; font-size: 12px; }\n      button:hover { border-color: rgba(83,214,199,0.55); }\n      button.ok { background: rgba(99,230,190,0.12); border-color: rgba(99,230,190,0.28); }\n      button.bad { background: rgba(255,107,107,0.10); border-color: rgba(255,107,107,0.30); }\n      .item { border: 1px solid rgba(255,255,255,0.10); border-radius: 10px; padding: 12px; margin: 10px 0; background: rgba(0,0,0,0.14); }\n      .title { display: flex; align-items: baseline; justify-content: space-between; gap: 12px; }\n      .id { font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", monospace; font-size: 12px; color: rgba(232,236,255,0.85); }\n      .desc { margin-top: 8px; font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", monospace; font-size: 11px; color: rgba(232,236,255,0.78); line-height: 1.5; white-space: pre-wrap; }\n      .btns { display: flex; gap: 8px; flex-wrap: wrap; margin-top: 10px; }\n      .status { font-size: 12px; color: var(--muted); }\n      .note { font-size: 12px; color: rgba(232,236,255,0.86); line-height: 1.5; }\n      ul { margin: 8px 0 0; padding-left: 18px; }\n      li { margin: 6px 0; }\n      code { font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, \"Liberation Mono\", \"Courier New\", monospace; font-size: 11px; color: rgba(232,236,255,0.92); }\n    </style>\n  </head>\n  <body>\n    <header>\n      <h1>Wunderland HITL</h1>\n      <div class=\"meta\">\n        <span>Approve tool calls and checkpoints.</span>\n      </div>\n    </header>\n    <main>\n      <div class=\"card\">\n        <h2>Admin Secret</h2>\n        <div class=\"meta\">\n          <input id=\"secret\" placeholder=\"x-wunderland-hitl-secret\" />\n          <button id=\"connect\" class=\"ok\">Connect</button>\n          <button id=\"refresh\">Refresh</button>\n          <span class=\"status\" id=\"hint\"></span>\n          <span class=\"status\">Pending: <span id=\"pendingCount\">0</span></span>\n          <span class=\"status\">Stream: <span id=\"streamStatus\">disconnected</span></span>\n        </div>\n      </div>\n\n      <div class=\"card\">\n        <h2>Security</h2>\n        <div class=\"note\">\n          <div><strong>Approvals can trigger real side effects.</strong> Only approve actions you understand.</div>\n          <ul>\n            <li>This UI uses <code>?secret=...</code> for API calls/streaming; don\u2019t share or screenshot URLs with the secret.</li>\n            <li>This UI stores the secret in localStorage (<code>wunderland_hitl_secret</code>). Clear site data to forget it.</li>\n            <li>For scripts, prefer the header <code>x-wunderland-hitl-secret</code>.</li>\n            <li>Set/rotate via <code>agent.config.json</code> \u2192 <code>hitl.secret</code> or <code>WUNDERLAND_HITL_SECRET</code> (restart to rotate).</li>\n            <li>Protect chat with <code>chat.secret</code> / <code>WUNDERLAND_CHAT_SECRET</code> if exposing <code>/chat</code>.</li>\n            <li>Remote ops: <code>ssh -L 3777:localhost:3777 you@host</code> instead of opening the port publicly.</li>\n          </ul>\n        </div>\n      </div>\n\n      <div class=\"row\">\n        <div class=\"card\">\n          <h2>Approvals</h2>\n          <div id=\"approvals\" class=\"status\">Loading\u2026</div>\n        </div>\n        <div class=\"card\">\n          <h2>Checkpoints</h2>\n          <div id=\"checkpoints\" class=\"status\">Loading\u2026</div>\n        </div>\n      </div>\n    </main>\n    <script>\n      const server = window.location.origin;\n      const secretInput = document.getElementById('secret');\n      const hint = document.getElementById('hint');\n      const approvalsEl = document.getElementById('approvals');\n      const checkpointsEl = document.getElementById('checkpoints');\n      const pendingCount = document.getElementById('pendingCount');\n      const streamStatus = document.getElementById('streamStatus');\n\n      const stored = localStorage.getItem('wunderland_hitl_secret');\n      if (stored) secretInput.value = stored;\n\n      async function api(path, method, body) {\n        const secret = secretInput.value.trim();\n        const url = new URL(server + path);\n        url.searchParams.set('secret', secret);\n        const res = await fetch(url.toString(), {\n          method,\n          headers: { 'Content-Type': 'application/json' },\n          body: body ? JSON.stringify(body) : undefined,\n        });\n        if (!res.ok) throw new Error('HTTP ' + res.status);\n        return res.json();\n      }\n\n      function esc(s) {\n        return String(s || '').replace(/[&<>\"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','\"':'&quot;',\"'\":'&#39;'}[c]));\n      }\n\n      function renderApprovals(approvals) {\n        if (!approvals || approvals.length === 0) { approvalsEl.innerHTML = '<div class=\"status\">No pending approvals.</div>'; return; }\n        approvalsEl.innerHTML = '';\n        for (const a of approvals) {\n          const div = document.createElement('div');\n          div.className = 'item';\n          div.innerHTML =\n            '<div class=\"title\"><div><strong>' + esc(a.severity || 'low') + '</strong></div><div class=\"id\">' + esc(a.actionId || '') + '</div></div>' +\n            '<div class=\"desc\">' + esc(a.description || '') + '</div>' +\n            '<div class=\"btns\"><button class=\"ok\">Approve</button><button class=\"bad\">Reject</button></div>';\n          const btns = div.querySelectorAll('button');\n          btns[0].onclick = async () => { await api('/hitl/approvals/' + encodeURIComponent(a.actionId) + '/approve', 'POST', { decidedBy: 'operator' }); await refresh(); };\n          btns[1].onclick = async () => { const reason = prompt('Rejection reason (optional):') || ''; await api('/hitl/approvals/' + encodeURIComponent(a.actionId) + '/reject', 'POST', { decidedBy: 'operator', reason }); await refresh(); };\n          approvalsEl.appendChild(div);\n        }\n      }\n\n      function renderCheckpoints(checkpoints) {\n        if (!checkpoints || checkpoints.length === 0) { checkpointsEl.innerHTML = '<div class=\"status\">No pending checkpoints.</div>'; return; }\n        checkpointsEl.innerHTML = '';\n        for (const c of checkpoints) {\n          const div = document.createElement('div');\n          div.className = 'item';\n          div.innerHTML =\n            '<div class=\"title\"><div><strong>' + esc(c.workflowId || 'workflow') + '</strong></div><div class=\"id\">' + esc(c.checkpointId || '') + '</div></div>' +\n            '<div class=\"desc\">' + esc(JSON.stringify({ phase: c.currentPhase, progress: c.progress, notes: c.notes, issues: c.issues, completedWork: c.completedWork }, null, 2)) + '</div>' +\n            '<div class=\"btns\"><button class=\"ok\">Continue</button><button class=\"bad\">Abort</button></div>';\n          const btns = div.querySelectorAll('button');\n          btns[0].onclick = async () => { await api('/hitl/checkpoints/' + encodeURIComponent(c.checkpointId) + '/continue', 'POST', { decidedBy: 'operator' }); await refresh(); };\n          btns[1].onclick = async () => { await api('/hitl/checkpoints/' + encodeURIComponent(c.checkpointId) + '/abort', 'POST', { decidedBy: 'operator' }); await refresh(); };\n          checkpointsEl.appendChild(div);\n        }\n      }\n\n      async function refresh() {\n        try {\n          const pending = await api('/hitl/pending', 'GET');\n          const approvals = pending && pending.approvals ? pending.approvals : [];\n          const checkpoints = pending && pending.checkpoints ? pending.checkpoints : [];\n          pendingCount.textContent = String((approvals.length || 0) + (checkpoints.length || 0));\n          renderApprovals(approvals);\n          renderCheckpoints(checkpoints);\n          hint.textContent = '';\n        } catch (e) {\n          approvalsEl.innerHTML = '<div class=\"status\">Paste the admin secret to view pending actions.</div>';\n          checkpointsEl.innerHTML = '';\n          hint.textContent = 'Unauthorized or server error.';\n        }\n      }\n\n      let es;\n      function connectStream() {\n        const secret = secretInput.value.trim();\n        if (!secret) return;\n        if (es) es.close();\n        const u = new URL(server + '/hitl/stream');\n        u.searchParams.set('secret', secret);\n        es = new EventSource(u.toString());\n        es.onopen = () => { streamStatus.textContent = 'connected'; };\n        es.onerror = () => { streamStatus.textContent = 'error'; };\n        es.addEventListener('hitl', () => refresh());\n      }\n\n      function connect() {\n        const secret = secretInput.value.trim();\n        if (!secret) { hint.textContent = 'Paste secret from server logs.'; return; }\n        localStorage.setItem('wunderland_hitl_secret', secret);\n        refresh();\n        connectStream();\n      }\n\n      document.getElementById('connect').onclick = connect;\n      document.getElementById('refresh').onclick = refresh;\n      refresh();\n    </script>\n  </body>\n</html>";
 //# sourceMappingURL=server-helpers.d.ts.map

package/dist/channels/api/server-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-helpers.d.ts","sourceRoot":"","sources":["../../../src/channels/api/server-helpers.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAExE,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CAC/C,CAAC;AAEF,wBAAgB,aAAa,IAAI,QAAQ,CAAC,UAAU,CAAC,CAOpD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;CAClC,GAAG,YAAY,CAUf;AAID,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlF;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAOrG;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAKhG;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAK5F;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAGhH;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,qBAAqB,GAAG,SAAS,GAAG,KAAK,GAAG,iBAAiB,GAAG,kBAAkB,CAS5H;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,eAAO,MAAM,iBAAiB,wvTAsLtB,CAAC;AAET,eAAO,MAAM,cAAc,ouVAyLnB,CAAC"}
+{"version":3,"file":"server-helpers.d.ts","sourceRoot":"","sources":["../../../src/channels/api/server-helpers.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAExE,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CAC/C,CAAC;AAEF,wBAAgB,aAAa,IAAI,QAAQ,CAAC,UAAU,CAAC,CAOpD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;CAClC,GAAG,YAAY,CAUf;AAID,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlF;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAOrG;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAKhG;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAK5F;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAGhH;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,GAAG,OAAO,CAGnF;AAED,oHAAoH;AACpH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAI5F;AAED,uGAAuG;AACvG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAGhH;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,qBAAqB,GAAG,SAAS,GAAG,KAAK,GAAG,iBAAiB,GAAG,kBAAkB,CAS5H;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,eAAO,MAAM,iBAAiB,i5TAsLtB,CAAC;AAET,eAAO,MAAM,cAAc,ouVAyLnB,CAAC"}

package/dist/channels/api/server-helpers.js

@@ -69,6 +69,24 @@ export function isHitlAuthorized(req, url, hitlSecret) {
         return true;
     return extractHitlSecret(req, url) === hitlSecret;
 }
+/** Whether a request comes from this machine's loopback interface. */
+export function isLoopbackRequest(req) {
+    const remote = req.socket?.remoteAddress || '';
+    return remote === '::1' || /^(::ffff:)?127(\.\d{1,3}){3}$/.test(remote);
+}
+/** The chat secret a request carries: the `x-wunderland-chat-secret` header, else `?chat_secret=` or `?secret=`. */
+export function extractChatSecret(req, url) {
+    const fromHeader = getHeaderString(req, 'x-wunderland-chat-secret');
+    if (fromHeader)
+        return fromHeader;
+    return (url.searchParams.get('chat_secret') || url.searchParams.get('secret') || '').trim();
+}
+/** Whether a request may use POST /chat: always when no chat secret is set, otherwise only with it. */
+export function isChatAuthorized(req, url, chatSecret) {
+    if (!chatSecret)
+        return true;
+    return extractChatSecret(req, url) === chatSecret;
+}
 export function inferTurnApprovalMode(cfg) {
     const raw = cfg?.hitl && typeof cfg.hitl === 'object' && !Array.isArray(cfg.hitl)
         ? cfg.hitl.turnApprovalMode ?? cfg.hitl.turnApproval
@@ -141,7 +159,7 @@ export const PAIRING_PAGE_HTML = `<!doctype html>
       <div class="card">
         <h2>Security</h2>
         <div class="note">
-          <div><strong>Treat the secret like a password.</strong> This server binds to <code>0.0.0.0</code> by default.</div>
+          <div><strong>Treat the secret like a password.</strong> This server listens on <code>127.0.0.1</code>, this machine only, unless it was started with another host (<code>--host</code> or the <code>host</code> option), which it does only once a chat secret is set.</div>
           <ul>
             <li>Don’t share URLs containing <code>?secret=...</code> (they can end up in browser history/logs).</li>
             <li>This UI stores the secret in localStorage (<code>wunderland_hitl_secret</code>). Clear site data to forget it.</li>

package/dist/channels/api/server-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-helpers.js","sourceRoot":"","sources":["../../../src/channels/api/server-helpers.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;GAGG;AAYH,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;QACpD,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;QACjD,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;QAClD,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAQ9B;IACC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAkB;QACpC,cAAc,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;QAC5C,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc;QACpG,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,OAAO,EAAE,IAAI,CAAC,OAAc;KAC7B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,QAAQ,CAAC,GAAwC;IAC/D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,QAAQ,GAAG,SAAS,CAAC;QAE3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;YACzB,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;gBACxB,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAuC,EAAE,MAAc,EAAE,IAAa;IAC7F,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;KAC1C,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAwC,EAAE,MAAc;IACtF,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAwC,EAAE,GAAQ;IAClF,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACpE,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAwC,EAAE,GAAQ,EAAE,UAAkB;IACrG,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,UAAU,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAsC;IAC1E,MAAM,GAAG,GACP,GAAG,EAAE,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACnE,CAAC,CAAE,GAAG,CAAC,IAAY,CAAC,gBAAgB,IAAK,GAAG,CAAC,IAAY,CAAC,YAAY;QACtE,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,CAAC,KAAK,iBAAiB;QAAE,OAAO,iBAAiB,CAAC;IACtD,IAAI,CAAC,KAAK,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IACxD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,QAAgB;IAC3D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAsLzB,CAAC;AAET,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAyLtB,CAAC"}
+{"version":3,"file":"server-helpers.js","sourceRoot":"","sources":["../../../src/channels/api/server-helpers.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;GAGG;AAYH,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;QACpD,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;QACjD,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;QAClD,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAQ9B;IACC,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAkB;QACpC,cAAc,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;QAC5C,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc;QACpG,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,OAAO,EAAE,IAAI,CAAC,OAAc;KAC7B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,QAAQ,CAAC,GAAwC;IAC/D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,QAAQ,GAAG,SAAS,CAAC;QAE3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;YACzB,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;gBACxB,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAuC,EAAE,MAAc,EAAE,IAAa;IAC7F,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;KAC1C,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAwC,EAAE,MAAc;IACtF,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAwC,EAAE,GAAQ;IAClF,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACpE,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAwC,EAAE,GAAQ,EAAE,UAAkB;IACrG,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,UAAU,CAAC;AACpD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,GAAwC;IACxE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;IAC/C,OAAO,MAAM,KAAK,KAAK,IAAI,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,iBAAiB,CAAC,GAAwC,EAAE,GAAQ;IAClF,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACpE,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9F,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,gBAAgB,CAAC,GAAwC,EAAE,GAAQ,EAAE,UAAkB;IACrG,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,UAAU,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAsC;IAC1E,MAAM,GAAG,GACP,GAAG,EAAE,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACnE,CAAC,CAAE,GAAG,CAAC,IAAY,CAAC,gBAAgB,IAAK,GAAG,CAAC,IAAY,CAAC,YAAY;QACtE,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,CAAC,KAAK,iBAAiB;QAAE,OAAO,iBAAiB,CAAC;IACtD,IAAI,CAAC,KAAK,kBAAkB;QAAE,OAAO,kBAAkB,CAAC;IACxD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,QAAgB;IAC3D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAsLzB,CAAC;AAET,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAyLtB,CAAC"}

package/dist/channels/api/server.d.ts

@@ -59,7 +59,12 @@ export declare function createWunderlandServer(opts?: {
     loadEnv?: boolean;
     /** Override global config dir for ~/.wunderland/.env */
     configDirOverride?: string;
-    /** Defaults to `0.0.0.0` (same as CLI). */
+    /**
+     * Address to listen on. Defaults to `127.0.0.1`, this machine only, as
+     * `wunderland start` does. A host other machines can reach (`'0.0.0.0'`)
+     * needs a chat secret (`chatSecret`, `chat.secret` or `WUNDERLAND_CHAT_SECRET`);
+     * without one the server refuses to start.
+     */
     host?: string;
     /** Defaults to `process.env.PORT || 3777`. Use 0 for ephemeral port. */
     port?: number;
@@ -90,6 +95,13 @@ export declare function createWunderlandServer(opts?: {
     adaptiveExecution?: WunderlandAdaptiveExecutionConfig;
     /** Override HITL secret (otherwise config/env/random). */
     hitlSecret?: string;
+    /**
+     * Secret POST /chat requires, sent as the `x-wunderland-chat-secret` header
+     * (or `?chat_secret=`). Otherwise the agent config's `chat.secret`, then
+     * `WUNDERLAND_CHAT_SECRET`; with none, /chat answers without one and the
+     * server listens only on a loopback host.
+     */
+    chatSecret?: string;
     /** Optional OpenAI-compatible fallback provider config. */
     openaiFallback?: LLMProviderConfig;
     logger?: LoggerLike;

package/dist/channels/api/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/channels/api/server.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;GAYG;AAKH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAsBtD,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,+BAA+B,CAAC;AAevC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAC;AAE3F,OAAO,KAAK,EACV,iCAAiC,EACjC,qBAAqB,EACrB,oBAAoB,EACpB,oCAAoC,EACpC,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAKpB,KAAK,UAAU,GAAG;IAChB,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CAC/C,CAAC;AAIF,OAAO,EACL,aAAa,EACb,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,cAAc,EAAE,iBAAiB,GAClC,MAAM,qBAAqB,CAAC;AAS7B,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,oBAAoB,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,uBAAuB,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,gBAAgB,EAAE,KAAK,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;IACjE,qBAAqB,EAAE,OAAO,CAAC;IAC/B,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAAC,IAAI,CAAC,EAAE;IAClD,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,kCAAkC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzC,sDAAsD;IACtD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,oEAAoE;IACpE,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,oGAAoG;IACpG,GAAG,CAAC,EAAE,OAAO,CAAC;QACZ,UAAU,EAAE,oBAAoB,GAAG,MAAM,CAAC;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH,oEAAoE;IACpE,eAAe,CAAC,EAAE,yBAAyB,CAAC;IAC5C,+CAA+C;IAC/C,oBAAoB,CAAC,EAAE,oCAAoC,CAAC;IAC5D,2CAA2C;IAC3C,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,iBAAiB,CAAC;IACnC,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA6lClC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/channels/api/server.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;GAYG;AAKH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAsBtD,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,qCAAqC,CAAC;AAK7C,OAAO,EAIL,KAAK,uBAAuB,EAC7B,MAAM,+BAA+B,CAAC;AAevC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mDAAmD,CAAC;AAE3F,OAAO,KAAK,EACV,iCAAiC,EACjC,qBAAqB,EACrB,oBAAoB,EACpB,oCAAoC,EACpC,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAKpB,KAAK,UAAU,GAAG;IAChB,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7C,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CAC/C,CAAC;AAIF,OAAO,EACL,aAAa,EACb,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,cAAc,EAAE,iBAAiB,GAClC,MAAM,qBAAqB,CAAC;AAU7B,MAAM,MAAM,sBAAsB,GAAG;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,oBAAoB,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,uBAAuB,CAAC;IAChC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,gBAAgB,EAAE,KAAK,GAAG,iBAAiB,GAAG,kBAAkB,CAAC;IACjE,qBAAqB,EAAE,OAAO,CAAC;IAC/B,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,wBAAsB,sBAAsB,CAAC,IAAI,CAAC,EAAE;IAClD,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,kCAAkC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzC,sDAAsD;IACtD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,0EAA0E;IAC1E,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,oEAAoE;IACpE,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,oGAAoG;IACpG,GAAG,CAAC,EAAE,OAAO,CAAC;QACZ,UAAU,EAAE,oBAAoB,GAAG,MAAM,CAAC;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;IACH,oEAAoE;IACpE,eAAe,CAAC,EAAE,yBAAyB,CAAC;IAC5C,+CAA+C;IAC/C,oBAAoB,CAAC,EAAE,oCAAoC,CAAC;IAC5D,2CAA2C;IAC3C,iBAAiB,CAAC,EAAE,iCAAiC,CAAC;IACtD,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,iBAAiB,CAAC;IACnC,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA8mClC"}