feat: wire new providers, auth, mention-gating, and browser into daemon

Update config schema with server auth fields (token, tailscale_identity,
auth_http), channel mention settings, browser config, and openrouter/bedrock
provider enum values. Wire GeminiClient, BedrockClient, OpenRouter into
createClientFromConfig. Initialize BrowserManager and register browser tools
in daemon startup. Pass auth config and channel mention settings through to
gateway and adapters. Add puppeteer-core, @google/generative-ai, and
@aws-sdk/client-bedrock-runtime dependencies.

src/daemon/index.ts

@@ -1,11 +1,11 @@
 import { Lifecycle } from './lifecycle.js';
 import type { Config, ModelConfig } from '../config/index.js';
-import { AnthropicClient, OpenAIClient, OllamaClient, LlamaCppClient, ModelRouter, DEFAULT_RETRY_CONFIG } from '../models/index.js';
+import { AnthropicClient, OpenAIClient, OllamaClient, LlamaCppClient, GeminiClient, BedrockClient, ModelRouter, DEFAULT_RETRY_CONFIG } from '../models/index.js';
 import type { ModelClient, RetryConfig } from '../models/index.js';
 import { AgentOrchestrator, type DelegationConfig } from '../backends/index.js';
 import { SessionStore, SessionManager } from '../session/index.js';
 import { HookEngine } from '../hooks/index.js';
-import { ToolRegistry, ToolExecutor, ToolPolicy, allBuiltinTools, createWebSearchTools, createProcessTools, ProcessManager } from '../tools/index.js';
+import { ToolRegistry, ToolExecutor, ToolPolicy, allBuiltinTools, createWebSearchTools, createProcessTools, ProcessManager, BrowserManager, createBrowserTools } from '../tools/index.js';
 import type { Tool } from '../tools/types.js';
 import { MemoryStore } from '../memory/index.js';
 import { createMemoryTools } from '../tools/builtin/index.js';
@@ -39,6 +39,7 @@ export interface DaemonContext {
   agentConfigRegistry: AgentConfigRegistry;
   agentRouter: AgentRouter;
   sandboxManager?: SandboxManager;
+  browserManager?: BrowserManager;
 }
 
 function loadSystemPrompt(config: Config): string {
@@ -91,12 +92,23 @@ export function createClientFromConfig(cfg: ModelConfig): ModelClient {
         authToken: cfg.auth_token,
       });
     case 'gemini':
-      // Gemini support not yet implemented — fall back to OpenAI-compatible client
-      console.warn(`Gemini provider not yet implemented for model "${cfg.model}", using OpenAI-compatible client`);
-      return new OpenAIClient({
+      return new GeminiClient({
         model: cfg.model,
         apiKey: cfg.api_key,
       });
+    case 'openrouter':
+      return new OpenAIClient({
+        model: cfg.model,
+        apiKey: cfg.api_key ?? process.env.OPENROUTER_API_KEY,
+        baseURL: cfg.endpoint ?? 'https://openrouter.ai/api/v1',
+      });
+    case 'bedrock':
+      return new BedrockClient({
+        model: cfg.model,
+        region: cfg.endpoint,
+        accessKeyId: cfg.api_key,
+        secretAccessKey: cfg.auth_token,
+      });
     default:
       throw new Error(`Unknown model provider: ${(cfg as Record<string, unknown>).provider}`);
   }
@@ -415,6 +427,28 @@ export async function startDaemon(config: Config): Promise<DaemonContext> {
     console.log('Process manager stopped');
   });
 
+  // Initialize browser manager and register browser tools (if enabled)
+  let browserManager: BrowserManager | undefined;
+  if (config.browser?.enabled) {
+    browserManager = new BrowserManager({
+      executablePath: config.browser.executable_path,
+      wsEndpoint: config.browser.ws_endpoint,
+      headless: config.browser.headless,
+      maxPages: config.browser.max_pages,
+      defaultTimeout: config.browser.default_timeout,
+    });
+
+    for (const tool of createBrowserTools(browserManager)) {
+      toolRegistry.register(tool);
+    }
+    console.log(`Browser tools enabled (headless=${config.browser.headless})`);
+
+    lifecycle.onShutdown(async () => {
+      await browserManager!.shutdown();
+      console.log('Browser manager stopped');
+    });
+  }
+
   const toolExecutor = new ToolExecutor(toolRegistry, hookEngine);
 
   // Initialize tool policy from config
@@ -505,6 +539,11 @@ export async function startDaemon(config: Config): Promise<DaemonContext> {
     systemPrompt,
     toolRegistry,
     toolExecutor,
+    auth: {
+      token: config.server.token,
+      tailscaleIdentity: config.server.tailscale_identity,
+    },
+    authHttp: config.server.auth_http,
     uiDir: resolve(import.meta.dirname, '../gateway/ui'),
     config,
     restart: async () => {
@@ -515,6 +554,10 @@ export async function startDaemon(config: Config): Promise<DaemonContext> {
     },
   });
 
+  if (config.server.token) {
+    console.log(`Gateway auth: token required${config.server.tailscale_identity ? ' + Tailscale identity' : ''}`);
+  }
+
   // ── Channel Registry ──────────────────────────────────────────
 
   const channelRegistry = new ChannelRegistry();
@@ -537,6 +580,7 @@ export async function startDaemon(config: Config): Promise<DaemonContext> {
   const telegramAdapter = new TelegramAdapter({
     botToken: config.telegram.bot_token,
     allowedChatIds: config.telegram.allowed_chat_ids,
+    requireMention: config.telegram.require_mention,
     hookEngine,
   });
   channelRegistry.register(telegramAdapter);
@@ -559,6 +603,7 @@ export async function startDaemon(config: Config): Promise<DaemonContext> {
       appToken: config.slack.app_token,
       signingSecret: config.slack.signing_secret,
       allowedChannelIds: config.slack.allowed_channel_ids.length > 0 ? config.slack.allowed_channel_ids : undefined,
+      requireMention: config.slack.require_mention,
     });
     channelRegistry.register(slackAdapter);
   }
@@ -567,6 +612,8 @@ export async function startDaemon(config: Config): Promise<DaemonContext> {
   if (config.whatsapp) {
     const whatsappAdapter = new WhatsAppAdapter({
       allowedNumbers: config.whatsapp.allowed_numbers.length > 0 ? config.whatsapp.allowed_numbers : undefined,
+      allowedGroupIds: config.whatsapp.allowed_group_ids.length > 0 ? config.whatsapp.allowed_group_ids : undefined,
+      requireMention: config.whatsapp.require_mention,
       dataDir: config.whatsapp.data_dir,
     });
     channelRegistry.register(whatsappAdapter);
@@ -635,6 +682,7 @@ export async function startDaemon(config: Config): Promise<DaemonContext> {
     agentConfigRegistry,
     agentRouter,
     sandboxManager,
+    browserManager,
   };
 }