@agent-link/server 0.1.187 → 0.1.189

package/dist/auth-manager.d.ts

@@ -0,0 +1,36 @@
+export interface AuthAttemptState {
+    failures: number;
+    lockedUntil: Date | null;
+}
+export declare class AuthManager {
+    readonly authAttempts: Map<string, AuthAttemptState>;
+    readonly pendingAuth: Map<string, string>;
+    readonly sessionAuth: Map<string, {
+        passwordHash: string;
+        passwordSalt: string;
+    }>;
+    private readonly serverSecret;
+    hashPassword(password: string): {
+        hash: string;
+        salt: string;
+    };
+    verifyPassword(submitted: string, storedHash: string, storedSalt: string): boolean;
+    setSessionPassword(sessionId: string, hash: string, salt: string): void;
+    getSessionAuth(sessionId: string): {
+        passwordHash: string;
+        passwordSalt: string;
+    } | undefined;
+    requiresAuth(sessionId: string): boolean;
+    generateAuthToken(sessionId: string): string;
+    verifyAuthToken(token: string, expectedSessionId: string): boolean;
+    isLocked(sessionId: string): boolean;
+    recordFailure(sessionId: string): {
+        locked: boolean;
+        remaining: number;
+    };
+    clearFailures(sessionId: string): void;
+    setPending(clientId: string, sessionId: string): void;
+    getPending(clientId: string): string | undefined;
+    removePending(clientId: string): void;
+}
+export declare const auth: AuthManager;

package/dist/auth-manager.js

@@ -0,0 +1,96 @@
+import { scryptSync, randomBytes, timingSafeEqual, createHmac } from 'crypto';
+const MAX_FAILURES = 5;
+const LOCKOUT_MS = 15 * 60 * 1000; // 15 minutes
+const TOKEN_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+export class AuthManager {
+    authAttempts = new Map();
+    pendingAuth = new Map();
+    sessionAuth = new Map();
+    serverSecret = randomBytes(32);
+    // --- Password ---
+    hashPassword(password) {
+        const salt = randomBytes(16).toString('base64');
+        const hash = scryptSync(password, salt, 32).toString('base64');
+        return { hash, salt };
+    }
+    verifyPassword(submitted, storedHash, storedSalt) {
+        const computed = scryptSync(submitted, storedSalt, 32);
+        const expected = Buffer.from(storedHash, 'base64');
+        if (computed.length !== expected.length)
+            return false;
+        return timingSafeEqual(computed, expected);
+    }
+    // --- Session password ---
+    setSessionPassword(sessionId, hash, salt) {
+        this.sessionAuth.set(sessionId, { passwordHash: hash, passwordSalt: salt });
+    }
+    getSessionAuth(sessionId) {
+        return this.sessionAuth.get(sessionId);
+    }
+    requiresAuth(sessionId) {
+        const a = this.sessionAuth.get(sessionId);
+        return !!(a?.passwordHash && a?.passwordSalt);
+    }
+    // --- Token ---
+    generateAuthToken(sessionId) {
+        const ts = Date.now().toString();
+        const hmac = createHmac('sha256', this.serverSecret).update(`${sessionId}:${ts}`).digest('base64url');
+        return `${sessionId}:${ts}:${hmac}`;
+    }
+    verifyAuthToken(token, expectedSessionId) {
+        const idx1 = token.indexOf(':');
+        const idx2 = token.indexOf(':', idx1 + 1);
+        if (idx1 === -1 || idx2 === -1)
+            return false;
+        const sessionId = token.slice(0, idx1);
+        const ts = token.slice(idx1 + 1, idx2);
+        const hmac = token.slice(idx2 + 1);
+        if (sessionId !== expectedSessionId)
+            return false;
+        const age = Date.now() - parseInt(ts, 10);
+        if (isNaN(age) || age < 0 || age > TOKEN_TTL_MS)
+            return false;
+        const expected = createHmac('sha256', this.serverSecret).update(`${sessionId}:${ts}`).digest('base64url');
+        return hmac === expected;
+    }
+    // --- Brute-force protection ---
+    isLocked(sessionId) {
+        const state = this.authAttempts.get(sessionId);
+        if (!state?.lockedUntil)
+            return false;
+        if (Date.now() > state.lockedUntil.getTime()) {
+            this.authAttempts.delete(sessionId);
+            return false;
+        }
+        return true;
+    }
+    recordFailure(sessionId) {
+        let state = this.authAttempts.get(sessionId);
+        if (!state) {
+            state = { failures: 0, lockedUntil: null };
+            this.authAttempts.set(sessionId, state);
+        }
+        state.failures++;
+        if (state.failures >= MAX_FAILURES) {
+            state.lockedUntil = new Date(Date.now() + LOCKOUT_MS);
+            return { locked: true, remaining: 0 };
+        }
+        return { locked: false, remaining: MAX_FAILURES - state.failures };
+    }
+    clearFailures(sessionId) {
+        this.authAttempts.delete(sessionId);
+    }
+    // --- Pending auth ---
+    setPending(clientId, sessionId) {
+        this.pendingAuth.set(clientId, sessionId);
+    }
+    getPending(clientId) {
+        return this.pendingAuth.get(clientId);
+    }
+    removePending(clientId) {
+        this.pendingAuth.delete(clientId);
+    }
+}
+// Singleton instance
+export const auth = new AuthManager();
+//# sourceMappingURL=auth-manager.js.map

package/dist/auth-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-manager.js","sourceRoot":"","sources":["../src/auth-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAO9E,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAG,aAAa;AAClD,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAErD,MAAM,OAAO,WAAW;IACb,YAAY,GAAG,IAAI,GAAG,EAA4B,CAAC;IACnD,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,WAAW,GAAG,IAAI,GAAG,EAA0D,CAAC;IACxE,YAAY,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAEhD,mBAAmB;IAEnB,YAAY,CAAC,QAAgB;QAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,UAAkB,EAAE,UAAkB;QACtE,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACtD,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,2BAA2B;IAE3B,kBAAkB,CAAC,SAAiB,EAAE,IAAY,EAAE,IAAY;QAC9D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,cAAc,CAAC,SAAiB;QAC9B,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IAChD,CAAC;IAED,gBAAgB;IAEhB,iBAAiB,CAAC,SAAiB;QACjC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtG,OAAO,GAAG,SAAS,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,eAAe,CAAC,KAAa,EAAE,iBAAyB;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAE7C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAEnC,IAAI,SAAS,KAAK,iBAAiB;YAAE,OAAO,KAAK,CAAC;QAElD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,YAAY;YAAE,OAAO,KAAK,CAAC;QAE9D,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1G,OAAO,IAAI,KAAK,QAAQ,CAAC;IAC3B,CAAC;IAED,iCAAiC;IAEjC,QAAQ,CAAC,SAAiB;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,WAAW;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,SAAiB;QAC7B,IAAI,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjB,IAAI,KAAK,CAAC,QAAQ,IAAI,YAAY,EAAE,CAAC;YACnC,KAAK,CAAC,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC;YACtD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IACrE,CAAC;IAED,aAAa,CAAC,SAAiB;QAC7B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,uBAAuB;IAEvB,UAAU,CAAC,QAAgB,EAAE,SAAiB;QAC5C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,UAAU,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;CACF;AAED,qBAAqB;AACrB,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/dist/http.d.ts

@@ -0,0 +1,4 @@
+import express from 'express';
+export declare function createApp(webDir: string, pkg: {
+    version: string;
+}, startedAt: Date): express.Express;

package/dist/http.js

@@ -0,0 +1,85 @@
+import express from 'express';
+import { join } from 'path';
+import { sessions } from './session-manager.js';
+export function createApp(webDir, pkg, startedAt) {
+    const app = express();
+    // Landing page at root
+    app.get('/', (_req, res) => {
+        res.sendFile(join(webDir, 'landing.html'));
+    });
+    // Chinese landing page
+    app.get('/zh', (_req, res) => {
+        res.sendFile(join(webDir, 'landing.zh.html'));
+    });
+    // Serve index.html with no-store (Vite hashed filenames handle cache-busting)
+    const sendIndexHtml = (_req, res) => {
+        res.setHeader('Cache-Control', 'no-store');
+        res.sendFile(join(webDir, 'index.html'));
+    };
+    // Intercept /index.html before express.static to ensure no-store is applied
+    app.get('/index.html', sendIndexHtml);
+    // Serve static assets from web/ — hashed assets are immutable, others use no-cache
+    app.use(express.static(webDir, {
+        setHeaders(res, filePath) {
+            if (filePath.includes('assets')) {
+                // Vite-hashed files (e.g. index-CqWVRN_z.js) — immutable
+                res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+            }
+            else if (filePath.endsWith('.html')) {
+                res.setHeader('Cache-Control', 'no-store');
+            }
+            else {
+                res.setHeader('Cache-Control', 'no-cache');
+            }
+        },
+    }));
+    // SPA fallback: /s/:sessionId → serve versioned index.html
+    app.get('/s/:sessionId', sendIndexHtml);
+    // Health check
+    app.get('/api/health', (_req, res) => {
+        res.json({
+            status: 'ok',
+            agents: sessions.agents.size,
+            webClients: sessions.webClients.size,
+            timestamp: new Date().toISOString(),
+        });
+    });
+    // Server status (aggregate stats, no agent details exposed)
+    app.get('/api/status', (_req, res) => {
+        const mem = process.memoryUsage();
+        res.json({
+            server: {
+                version: pkg.version,
+                startedAt: startedAt.toISOString(),
+                uptimeSeconds: Math.floor((Date.now() - startedAt.getTime()) / 1000),
+                memoryMB: Math.round(mem.rss / 1024 / 1024),
+            },
+            agents: {
+                connected: sessions.agents.size,
+            },
+            webClients: {
+                connected: sessions.webClients.size,
+            },
+        });
+    });
+    // Session info API (web client fetches this to know agent details)
+    app.get('/api/session/:sessionId', (req, res) => {
+        const { sessionId } = req.params;
+        const agent = sessions.getAgentBySession(sessionId);
+        if (agent) {
+            res.json({
+                sessionId,
+                agent: {
+                    name: agent.name,
+                    workDir: agent.workDir,
+                    connectedAt: agent.connectedAt,
+                },
+            });
+        }
+        else {
+            res.status(404).json({ error: 'Session not found' });
+        }
+    });
+    return app;
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,GAAwB,EAAE,SAAe;IACjF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,uBAAuB;IACvB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,uBAAuB;IACvB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,MAAM,aAAa,GAAG,CAAC,IAAqB,EAAE,GAAqB,EAAE,EAAE;QACrE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,4EAA4E;IAC5E,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IAEtC,mFAAmF;IACnF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;QAC7B,UAAU,CAAC,GAAG,EAAE,QAAQ;YACtB,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,yDAAyD;gBACzD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;YACxE,CAAC;iBAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;KACF,CAAC,CAAC,CAAC;IAEJ,2DAA2D;IAC3D,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IAExC,eAAe;IACf,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnC,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI;YAC5B,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;YACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,4DAA4D;IAC5D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE;gBACN,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;gBAClC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC;gBACpE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;aAC5C;YACD,MAAM,EAAE;gBACN,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI;aAChC;YACD,UAAU,EAAE;gBACV,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI;aACpC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC;gBACP,SAAS;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B;aACF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.js

@@ -1,11 +1,10 @@
-import express from 'express';
 import { createServer } from 'http';
 import { createRequire } from 'module';
-import { readFileSync } from 'fs';
 import { WebSocket, WebSocketServer } from 'ws';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
-import { agents, webClients, cleanupDeadConnections } from './context.js';
+import { sessions } from './session-manager.js';
+import { createApp } from './http.js';
 import { handleAgentConnection } from './ws-agent.js';
 import { handleWebConnection } from './ws-client.js';
 import { saveServerRuntimeState, clearServerRuntimeState } from './config.js';
@@ -14,89 +13,11 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const require = createRequire(import.meta.url);
 const pkg = require('../package.json');
 const startedAt = new Date();
-// Build versioned index.html at startup (cache-busting for browsers like iPhone Safari)
-const versionTag = `v=${pkg.version}`;
-const indexHtml = readFileSync(join(__dirname, '../web/index.html'), 'utf-8')
-    // Version-stamp local asset URLs in src="..." and href="..." attributes
-    .replace(/((?:src|href)\s*=\s*")(\/(?!\/)[^"?]+\.(?:js|css))(")/g, `$1$2?${versionTag}$3`)
-    // Version-stamp JS string literals referencing local .css/.js paths (e.g. theme switching)
-    .replace(/(')(\/(?!\/)[^'?]+\.(?:js|css))(')/g, `$1$2?${versionTag}$3`);
 const PORT = parseInt(process.env.PORT || '3456', 10);
-const app = express();
+const webDir = join(__dirname, '../web/dist');
+const app = createApp(webDir, pkg, startedAt);
 const server = createServer(app);
 const wss = new WebSocketServer({ server });
-const webDir = join(__dirname, '../web');
-// Landing page at root
-app.get('/', (_req, res) => {
-    res.sendFile(join(webDir, 'landing.html'));
-});
-// Chinese landing page
-app.get('/zh', (_req, res) => {
-    res.sendFile(join(webDir, 'landing.zh.html'));
-});
-// Serve versioned index.html with no-store (cache-busting for browsers like iPhone Safari)
-const sendIndexHtml = (_req, res) => {
-    res.setHeader('Content-Type', 'text/html; charset=utf-8');
-    res.setHeader('Cache-Control', 'no-store');
-    res.send(indexHtml);
-};
-// Intercept /index.html before express.static to ensure versioned HTML is served
-app.get('/index.html', sendIndexHtml);
-// Serve static assets from web/ with no-cache for JS/CSS (ensures updates are picked up)
-app.use(express.static(webDir, {
-    setHeaders(res, filePath) {
-        if (filePath.endsWith('.js') || filePath.endsWith('.css') || filePath.endsWith('.html')) {
-            res.setHeader('Cache-Control', 'no-cache');
-        }
-    },
-}));
-// SPA fallback: /s/:sessionId → serve versioned index.html
-app.get('/s/:sessionId', sendIndexHtml);
-// Health check
-app.get('/api/health', (_req, res) => {
-    res.json({
-        status: 'ok',
-        agents: agents.size,
-        webClients: webClients.size,
-        timestamp: new Date().toISOString(),
-    });
-});
-// Server status (aggregate stats, no agent details exposed)
-app.get('/api/status', (_req, res) => {
-    const mem = process.memoryUsage();
-    res.json({
-        server: {
-            version: pkg.version,
-            startedAt: startedAt.toISOString(),
-            uptimeSeconds: Math.floor((Date.now() - startedAt.getTime()) / 1000),
-            memoryMB: Math.round(mem.rss / 1024 / 1024),
-        },
-        agents: {
-            connected: agents.size,
-        },
-        webClients: {
-            connected: webClients.size,
-        },
-    });
-});
-// Session info API (web client fetches this to know agent details)
-app.get('/api/session/:sessionId', (req, res) => {
-    const { sessionId } = req.params;
-    for (const [, agent] of agents) {
-        if (agent.sessionId === sessionId) {
-            res.json({
-                sessionId,
-                agent: {
-                    name: agent.name,
-                    workDir: agent.workDir,
-                    connectedAt: agent.connectedAt,
-                },
-            });
-            return;
-        }
-    }
-    res.status(404).json({ error: 'Session not found' });
-});
 // WebSocket routing: agent or web client
 wss.on('connection', (ws, req) => {
     const url = new URL(req.url || '/', `http://${req.headers.host}`);
@@ -114,7 +35,7 @@ wss.on('connection', (ws, req) => {
 });
 // Heartbeat every 30s to detect dead connections
 setInterval(() => {
-    cleanupDeadConnections((client, msg) => {
+    sessions.cleanupDeadConnections((client, msg) => {
         if (client.ws.readyState === WebSocket.OPEN) {
             encryptAndSend(client.ws, msg, client.sessionKey);
         }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AACvC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;AAE7B,wFAAwF;AACxF,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;AACtC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC3E,wEAAwE;KACvE,OAAO,CAAC,wDAAwD,EAAE,QAAQ,UAAU,IAAI,CAAC;IAC1F,2FAA2F;KAC1F,OAAO,CAAC,qCAAqC,EAAE,QAAQ,UAAU,IAAI,CAAC,CAAC;AAE1E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AAEtD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;AACtB,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;AACjC,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAE5C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAEzC,uBAAuB;AACvB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,uBAAuB;AACvB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC3B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,2FAA2F;AAC3F,MAAM,aAAa,GAAG,CAAC,IAAqB,EAAE,GAAqB,EAAE,EAAE;IACrE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAC1D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAC3C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACtB,CAAC,CAAC;AAEF,iFAAiF;AACjF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AAEtC,yFAAyF;AACzF,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE;IAC7B,UAAU,CAAC,GAAG,EAAE,QAAQ;QACtB,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;CACF,CAAC,CAAC,CAAC;AAEJ,2DAA2D;AAC3D,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;AAExC,eAAe;AACf,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACnC,GAAG,CAAC,IAAI,CAAC;QACP,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,UAAU,EAAE,UAAU,CAAC,IAAI;QAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,4DAA4D;AAC5D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAClC,GAAG,CAAC,IAAI,CAAC;QACP,MAAM,EAAE;YACN,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC;YACpE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;SAC5C;QACD,MAAM,EAAE;YACN,SAAS,EAAE,MAAM,CAAC,IAAI;SACvB;QACD,UAAU,EAAE;YACV,SAAS,EAAE,UAAU,CAAC,IAAI;SAC3B;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,mEAAmE;AACnE,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC9C,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IACjC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC;gBACP,SAAS;gBACT,KAAK,EAAE;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;IACH,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEH,yCAAyC;AACzC,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE;IAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE1C,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,qBAAqB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;SAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC,CAAC;QAClG,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iDAAiD;AACjD,WAAW,CAAC,GAAG,EAAE;IACf,sBAAsB,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QACrC,IAAI,MAAM,CAAC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YAC5C,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,EAAE,MAAM,CAAC,CAAC;AAEX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;IACvB,OAAO,CAAC,GAAG,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC;IAE7C,kDAAkD;IAClD,sBAAsB,CAAC;QACrB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,iCAAiC;AACjC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;AAC5C,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AACvC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;AAE7B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;AAEtD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAC9C,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;AAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;AACjC,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAE5C,yCAAyC;AACzC,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE;IAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE1C,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,qBAAqB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;SAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC,CAAC;QAClG,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,iDAAiD;AACjD,WAAW,CAAC,GAAG,EAAE;IACf,QAAQ,CAAC,sBAAsB,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QAC9C,IAAI,MAAM,CAAC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YAC5C,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,EAAE,MAAM,CAAC,CAAC;AAEX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;IACvB,OAAO,CAAC,GAAG,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC;IAE7C,kDAAkD;IAClD,sBAAsB,CAAC;QACrB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,iCAAiC;AACjC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;AAC5C,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/message-relay.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Per-ID ordered message relay queue.
+ * Guarantees messages for the same ID are processed sequentially,
+ * preventing out-of-order delivery caused by async encryption/compression.
+ */
+export declare class MessageRelay {
+    private queues;
+    /**
+     * Enqueue a message handler for the given ID.
+     * Handlers for the same ID execute in order; different IDs run concurrently.
+     */
+    enqueue(id: string, handler: () => Promise<void>): void;
+    /**
+     * Remove the queue for the given ID (call on disconnect).
+     */
+    cleanup(id: string): void;
+}

package/dist/message-relay.js

@@ -0,0 +1,23 @@
+/**
+ * Per-ID ordered message relay queue.
+ * Guarantees messages for the same ID are processed sequentially,
+ * preventing out-of-order delivery caused by async encryption/compression.
+ */
+export class MessageRelay {
+    queues = new Map();
+    /**
+     * Enqueue a message handler for the given ID.
+     * Handlers for the same ID execute in order; different IDs run concurrently.
+     */
+    enqueue(id, handler) {
+        const prev = this.queues.get(id) || Promise.resolve();
+        this.queues.set(id, prev.then(handler).catch(() => { }));
+    }
+    /**
+     * Remove the queue for the given ID (call on disconnect).
+     */
+    cleanup(id) {
+        this.queues.delete(id);
+    }
+}
+//# sourceMappingURL=message-relay.js.map

package/dist/message-relay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-relay.js","sourceRoot":"","sources":["../src/message-relay.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACf,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAElD;;;OAGG;IACH,OAAO,CAAC,EAAU,EAAE,OAA4B;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,EAAU;QAChB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzB,CAAC;CACF"}

package/dist/session-manager.d.ts

@@ -0,0 +1,44 @@
+import { WebSocket } from 'ws';
+export interface AgentSession {
+    ws: WebSocket;
+    agentId: string;
+    name: string;
+    hostname: string;
+    workDir: string;
+    version: string;
+    sessionId: string;
+    sessionKey: Uint8Array | null;
+    connectedAt: Date;
+    isAlive: boolean;
+    passwordHash: string | null;
+    passwordSalt: string | null;
+}
+export interface WebClient {
+    ws: WebSocket;
+    clientId: string;
+    sessionId: string;
+    sessionKey: Uint8Array | null;
+    connectedAt: Date;
+    isAlive: boolean;
+}
+export declare class SessionManager {
+    readonly agents: Map<string, AgentSession>;
+    readonly sessionToAgent: Map<string, string>;
+    readonly webClients: Map<string, WebClient>;
+    generateSessionId(): string;
+    registerAgent(agentId: string, agent: AgentSession): void;
+    removeAgent(agentId: string): void;
+    getAgent(agentId: string): AgentSession | undefined;
+    getAgentBySession(sessionId: string): AgentSession | undefined;
+    registerClient(clientId: string, client: WebClient): void;
+    removeClient(clientId: string): void;
+    getClient(clientId: string): WebClient | undefined;
+    getClientsForSession(sessionId: string): WebClient[];
+    cleanupDeadConnections(notifyFn: (client: WebClient, msg: {
+        type: string;
+    }) => void): {
+        removedAgents: string[];
+        removedClients: string[];
+    };
+}
+export declare const sessions: SessionManager;

package/dist/session-manager.js

@@ -0,0 +1,83 @@
+import { randomBytes } from 'crypto';
+export class SessionManager {
+    agents = new Map();
+    sessionToAgent = new Map();
+    webClients = new Map();
+    generateSessionId() {
+        return randomBytes(12).toString('base64url');
+    }
+    // --- Agent operations ---
+    registerAgent(agentId, agent) {
+        this.agents.set(agentId, agent);
+        this.sessionToAgent.set(agent.sessionId, agentId);
+    }
+    removeAgent(agentId) {
+        const agent = this.agents.get(agentId);
+        if (agent) {
+            this.sessionToAgent.delete(agent.sessionId);
+            this.agents.delete(agentId);
+        }
+    }
+    getAgent(agentId) {
+        return this.agents.get(agentId);
+    }
+    getAgentBySession(sessionId) {
+        const agentId = this.sessionToAgent.get(sessionId);
+        return agentId ? this.agents.get(agentId) : undefined;
+    }
+    // --- Client operations ---
+    registerClient(clientId, client) {
+        this.webClients.set(clientId, client);
+    }
+    removeClient(clientId) {
+        this.webClients.delete(clientId);
+    }
+    getClient(clientId) {
+        return this.webClients.get(clientId);
+    }
+    getClientsForSession(sessionId) {
+        const result = [];
+        for (const [, client] of this.webClients) {
+            if (client.sessionId === sessionId) {
+                result.push(client);
+            }
+        }
+        return result;
+    }
+    // --- Heartbeat ---
+    cleanupDeadConnections(notifyFn) {
+        const removedAgents = [];
+        const removedClients = [];
+        for (const [agentId, agent] of this.agents) {
+            if (!agent.isAlive) {
+                console.log(`[Heartbeat] Agent ${agent.name} timed out`);
+                agent.ws.terminate();
+                this.sessionToAgent.delete(agent.sessionId);
+                this.agents.delete(agentId);
+                removedAgents.push(agentId);
+                for (const [, client] of this.webClients) {
+                    if (client.sessionId === agent.sessionId) {
+                        notifyFn(client, { type: 'agent_disconnected' });
+                    }
+                }
+                continue;
+            }
+            agent.isAlive = false;
+            agent.ws.ping();
+        }
+        for (const [clientId, client] of this.webClients) {
+            if (!client.isAlive) {
+                client.ws.terminate();
+                this.webClients.delete(clientId);
+                removedClients.push(clientId);
+                continue;
+            }
+            client.isAlive = false;
+            client.ws.ping();
+        }
+        return { removedAgents, removedClients };
+    }
+}
+// Singleton instance for backward compatibility
+export const sessions = new SessionManager();
+//# sourceMappingURL=session-manager.js.map

package/dist/session-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manager.js","sourceRoot":"","sources":["../src/session-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AA0BrC,MAAM,OAAO,cAAc;IAChB,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IACzC,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAEnD,iBAAiB;QACf,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,2BAA2B;IAE3B,aAAa,CAAC,OAAe,EAAE,KAAmB;QAChD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,WAAW,CAAC,OAAe;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,OAAe;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,iBAAiB,CAAC,SAAiB;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAED,4BAA4B;IAE5B,cAAc,CAAC,QAAgB,EAAE,MAAiB;QAChD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,oBAAoB,CAAC,SAAiB;QACpC,MAAM,MAAM,GAAgB,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oBAAoB;IAEpB,sBAAsB,CACpB,QAA4D;QAE5D,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,MAAM,cAAc,GAAa,EAAE,CAAC;QAEpC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC;gBACzD,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;gBACrB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC5C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC5B,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAE5B,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACzC,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;wBACzC,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBACnD,CAAC;gBACH,CAAC;gBACD,SAAS;YACX,CAAC;YACD,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;YACtB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAClB,CAAC;QAED,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;gBACtB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACjC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;YACvB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;IAC3C,CAAC;CACF;AAED,gDAAgD;AAChD,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC"}