@agent-native/core 0.79.16 → 0.79.18

package/dist/styles/agent-native.css

@@ -55,6 +55,8 @@
   --agent-native-lower-surface: hsl(
     var(--sidebar-background, var(--background))
   );
+  --agent-native-raised-surface: hsl(var(--background));
+  --agent-native-card-surface: hsl(var(--card));
   --agent-native-raised-border: hsl(var(--border));
   --agent-native-raised-radius: 8px;
   --agent-native-raised-shadow-left: -1px 0 3px rgb(0 0 0 / 0.018);
@@ -86,6 +88,16 @@
       hsl(var(--sidebar-background, var(--background))) 94%,
       black
     );
+    --agent-native-raised-surface: color-mix(
+      in srgb,
+      hsl(var(--background)) 78%,
+      hsl(var(--muted)) 22%
+    );
+    --agent-native-card-surface: color-mix(
+      in srgb,
+      var(--agent-native-raised-surface) 88%,
+      hsl(var(--muted)) 12%
+    );
   }
 }
 
@@ -107,6 +119,13 @@
   border-inline-end-color: transparent !important;
 }
 
+.agent-layout-shell
+  .agent-layout-left-drawer
+  > :where(.border-e, .border-r):first-child {
+  border-inline-end-color: transparent !important;
+  border-right-color: transparent !important;
+}
+
 .agent-sidebar-panel > .agent-sidebar-panel-inner {
   background: inherit;
 }
@@ -119,26 +138,59 @@
 .agent-sidebar-main-surface {
   position: relative;
   z-index: 1;
-  background: hsl(var(--background));
+  background: var(--agent-native-raised-surface);
   transition:
     border-radius 260ms cubic-bezier(0.32, 0.72, 0, 1),
+    border-color 260ms cubic-bezier(0.32, 0.72, 0, 1),
     box-shadow 260ms cubic-bezier(0.32, 0.72, 0, 1);
 }
 
 .agent-layout-shell
   :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
   > :first-child
-  > :where(header, div).border-b:first-child,
+  > :where(header, div).border-b,
 .agent-layout-shell
   :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
-  > :where(header, div).border-b:first-child,
+  > :where(header, div).border-b,
 .agent-layout-shell
   .agent-layout-left-drawer
   > :where(header, div).border-b:first-child,
+.agent-layout-shell
+  .agent-layout-left-drawer
+  > :first-child
+  > :where(header, div).border-b,
 .agent-layout-shell .agent-native-shell-topbar {
   border-bottom-color: transparent !important;
 }
 
+.agent-layout-shell
+  :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
+  > :first-child
+  > :where(header, div).border-b,
+.agent-layout-shell
+  :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
+  > :where(header, div).border-b {
+  background-color: var(--agent-native-raised-surface) !important;
+}
+
+.agent-layout-shell
+  :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
+  > :first-child
+  > :where(header, div).border-b.h-12,
+.agent-layout-shell
+  :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
+  > :where(header, div).border-b.h-12 {
+  min-height: 4rem;
+  height: 4rem;
+}
+
+.dark
+  .agent-layout-shell
+  :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
+  :where(.bg-card) {
+  background-color: var(--agent-native-card-surface) !important;
+}
+
 @media (min-width: 768px) {
   .agent-layout-main-surface,
   .agent-layout-shell > .agent-sidebar-shell > .agent-sidebar-main-surface {

package/dist/templates/workspace-root/AGENTS.md

@@ -170,7 +170,8 @@ Use the workspace root `.env` for shared identity and cross-app trust settings:
 - `WORKSPACE_OWNER_EMAIL` — initial owner/admin email for repairs and
   integration defaults.
 - `A2A_SECRET` — shared secret for cross-app A2A signing. Generate with
-  `openssl rand -hex 32` or `pnpm repair:workspace-org -- --name ...`.
+  `openssl rand -hex 32` and configure through your deployment/scoped secret
+  manager.
 
 `DISPATCH_DEFAULT_OWNER_EMAIL` is optional. Set it only for trusted,
 single-workspace deployments where unlinked integration requests should run as
@@ -183,7 +184,7 @@ When asked to repair workspace org or A2A configuration:
 1. Read `.env` first. Do not infer the organization, domain, owner email, or
    secret from old examples.
 2. Run `pnpm repair:workspace-org -- --name "<org>" --domain example.com --owner-email owner@example.com`
-   to create or update generic workspace identity values.
+   to validate generic workspace identity values without writing `.env`.
 3. Prefer the app's organization settings UI or authenticated org routes for
    changing `allowed_domain` and `a2a_secret`.
 4. If direct SQL is unavoidable, inspect the live schema first and use only

package/dist/templates/workspace-root/README.md

@@ -97,7 +97,7 @@ cross-app trust:
 - `A2A_SECRET` — shared signing secret for cross-app A2A calls.
 
 Run `pnpm repair:workspace-org -- --name "<org>" --domain example.com --owner-email owner@example.com`
-to fill or validate those values without committing secrets. Existing
+to validate those values without writing env files. Existing
 organization rows should still be repaired through the app's org settings UI or
 authenticated org routes whenever possible.
 

package/dist/templates/workspace-root/scripts/repair-workspace-org.ts

@@ -1,6 +1,5 @@
 #!/usr/bin/env tsx
 
-import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 
@@ -10,8 +9,6 @@ interface Options {
   ownerEmail?: string;
   a2aSecret?: string;
   envPath: string;
-  force: boolean;
-  dryRun: boolean;
   setDispatchDefaultOwner: boolean;
 }
 
@@ -22,10 +19,10 @@ Options:
   --name <value>                 Sets WORKSPACE_ORG_NAME
   --domain <value>               Sets WORKSPACE_ORG_DOMAIN
   --owner-email <value>          Sets WORKSPACE_OWNER_EMAIL
-  --a2a-secret <value>           Sets A2A_SECRET (generated when omitted)
-  --env <path>                   Env file to update (default: .env)
-  --force                        Overwrite existing non-empty values
-  --dry-run                      Print the changes without writing
+  --a2a-secret <value>           Reads A2A_SECRET for validation
+  --env <path>                   Env file to read for fallback values (default: .env)
+  --force                        Accepted for compatibility; no file is written
+  --dry-run                      Accepted for compatibility; no file is written
   --set-dispatch-default-owner   Also set DISPATCH_DEFAULT_OWNER_EMAIL
 `;
 
@@ -41,8 +38,6 @@ type RequiredKey = (typeof REQUIRED_KEYS)[number];
 function parseArgs(argv: string[]): Options {
   const opts: Options = {
     envPath: ".env",
-    force: false,
-    dryRun: false,
     setDispatchDefaultOwner: false,
   };
 
@@ -78,10 +73,8 @@ function parseArgs(argv: string[]): Options {
         opts.envPath = value();
         break;
       case "--force":
-        opts.force = true;
         break;
       case "--dry-run":
-        opts.dryRun = true;
         break;
       case "--set-dispatch-default-owner":
         opts.setDispatchDefaultOwner = true;
@@ -147,47 +140,6 @@ function validateEmail(email: string): void {
   }
 }
 
-function formatEnvValue(value: string): string {
-  if (/^[A-Za-z0-9_@./:+-]+$/.test(value)) return value;
-  return JSON.stringify(value);
-}
-
-function upsertEnvValue(
-  content: string,
-  key: string,
-  value: string,
-  force: boolean,
-): { content: string; changed: boolean; skipped: boolean } {
-  const lines = content.length > 0 ? content.split(/\r?\n/) : [];
-  let found = false;
-  let changed = false;
-  let skipped = false;
-
-  const next = lines.map((line) => {
-    const match = line.match(/^(\s*)([A-Z0-9_]+)(\s*=\s*)(.*)$/);
-    if (!match || match[2] !== key) return line;
-
-    found = true;
-    const existing = unquote(match[4]);
-    if (existing && !force) {
-      skipped = true;
-      return line;
-    }
-
-    const replacement = `${match[1]}${key}${match[3]}${formatEnvValue(value)}`;
-    if (replacement !== line) changed = true;
-    return replacement;
-  });
-
-  if (!found) {
-    if (next.length > 0 && next[next.length - 1] !== "") next.push("");
-    next.push(`${key}=${formatEnvValue(value)}`);
-    changed = true;
-  }
-
-  return { content: next.join("\n"), changed, skipped };
-}
-
 function firstValue(...values: Array<string | undefined>): string | undefined {
   return values.map((v) => v?.trim()).find(Boolean);
 }
@@ -213,13 +165,21 @@ function main(): void {
     process.env.WORKSPACE_OWNER_EMAIL,
     current.WORKSPACE_OWNER_EMAIL,
   )?.toLowerCase();
-  const a2aSecret =
-    firstValue(opts.a2aSecret, process.env.A2A_SECRET, current.A2A_SECRET) ??
-    crypto.randomBytes(32).toString("hex");
+  const a2aSecret = firstValue(
+    opts.a2aSecret,
+    process.env.A2A_SECRET,
+    current.A2A_SECRET,
+  );
 
   if (!name) fail("--name or WORKSPACE_ORG_NAME is required.");
   if (!rawDomain) fail("--domain or WORKSPACE_ORG_DOMAIN is required.");
   if (!ownerEmail) fail("--owner-email or WORKSPACE_OWNER_EMAIL is required.");
+  if (!a2aSecret) {
+    fail(
+      "--a2a-secret or A2A_SECRET is required. This script reads existing " +
+        "configuration but does not write env files.",
+    );
+  }
 
   const domain = normalizeDomain(rawDomain);
   validateDomain(domain);
@@ -232,52 +192,31 @@ function main(): void {
     A2A_SECRET: a2aSecret,
   };
 
-  let next = original.trimEnd();
-  const changed: string[] = [];
-  const skipped: string[] = [];
-
-  for (const key of REQUIRED_KEYS) {
-    const result = upsertEnvValue(next, key, desired[key], opts.force);
-    next = result.content;
-    if (result.changed) changed.push(key);
-    if (result.skipped) skipped.push(key);
-  }
-
+  const displayEntries: Array<[string, string]> = REQUIRED_KEYS.map((key) => [
+    key,
+    key === "A2A_SECRET" ? "[configured]" : desired[key],
+  ]);
   if (opts.setDispatchDefaultOwner) {
-    const result = upsertEnvValue(
-      next,
-      "DISPATCH_DEFAULT_OWNER_EMAIL",
-      ownerEmail,
-      opts.force,
-    );
-    next = result.content;
-    if (result.changed) changed.push("DISPATCH_DEFAULT_OWNER_EMAIL");
-    if (result.skipped) skipped.push("DISPATCH_DEFAULT_OWNER_EMAIL");
-  }
-
-  next = next.trimEnd() + "\n";
-
-  if (opts.dryRun) {
-    console.log(next);
-  } else {
-    fs.writeFileSync(envPath, next);
+    displayEntries.push(["DISPATCH_DEFAULT_OWNER_EMAIL", ownerEmail]);
   }
 
   console.log(
-    `${opts.dryRun ? "Validated" : "Updated"} ${path.relative(process.cwd(), envPath) || envPath}.`,
+    `Validated workspace org settings from ${path.relative(process.cwd(), envPath) || envPath}.`,
   );
-  if (changed.length > 0) console.log(`Changed: ${changed.join(", ")}`);
-  if (skipped.length > 0) {
-    console.log(
-      `Kept existing values: ${skipped.join(", ")} (use --force to overwrite)`,
-    );
+  console.log("No env files were written.");
+  console.log("");
+  console.log("Resolved configuration:");
+  for (const [key, value] of displayEntries) {
+    console.log(`- ${key}: ${value}`);
   }
   console.log("");
   console.log("Next steps:");
   console.log("1. Sign in as WORKSPACE_OWNER_EMAIL.");
   console.log("2. Create or select the org named by WORKSPACE_ORG_NAME.");
   console.log("3. Set the org allowed domain to WORKSPACE_ORG_DOMAIN.");
-  console.log("4. Set or sync the org A2A secret from A2A_SECRET across apps.");
+  console.log(
+    "4. Configure A2A_SECRET through the scoped secret/deployment secret manager for apps that need cross-app A2A.",
+  );
 }
 
 main();

package/dist/terminal/pty-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pty-server.d.ts","sourceRoot":"","sources":["../../src/terminal/pty-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,MAAM,IAAI,UAAU,EAC1B,MAAM,MAAM,CAAC;AA2Fd,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,MAAM,EAAE,UAAU,CAAC;IACnB,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CAuS1B"}
+{"version":3,"file":"pty-server.d.ts","sourceRoot":"","sources":["../../src/terminal/pty-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,MAAM,IAAI,UAAU,EAC1B,MAAM,MAAM,CAAC;AAmFd,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,MAAM,EAAE,UAAU,CAAC;IACnB,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CA4Q1B"}

package/dist/terminal/pty-server.js

@@ -18,13 +18,6 @@ async function getChildProcess() {
     }
     return _cp;
 }
-let _fs;
-async function getFs() {
-    if (!_fs) {
-        _fs = await import("node:fs");
-    }
-    return _fs;
-}
 /**
  * Kill a process and all its descendants.
  * node-pty's kill() only sends a signal to the shell, but child processes
@@ -241,9 +234,9 @@ export async function createPtyWebSocketServer(options = {}) {
                 const msg = JSON.parse(str);
                 if (msg.type === "agentNative.setEnvVars" &&
                     Array.isArray(msg.data?.vars)) {
-                    const envPath = path.join(resolvedAppDir, ".env");
                     const vars = msg.data.vars;
-                    // Validate env var names and sanitize values
+                    // Legacy bridge message. Keep validating the keys, but do not persist
+                    // them to .env or process.env; key storage is DB-scoped.
                     const validKeyPattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
                     const sanitizedVars = vars.filter(({ key }) => {
                         if (!validKeyPattern.test(key)) {
@@ -252,37 +245,11 @@ export async function createPtyWebSocketServer(options = {}) {
                         }
                         return true;
                     });
-                    const fs = await getFs();
-                    let lines = [];
-                    try {
-                        lines = fs.readFileSync(envPath, "utf-8").split("\n");
-                    }
-                    catch { }
-                    for (const { key, value } of sanitizedVars) {
-                        // Strip newlines/null bytes to prevent line injection
-                        const safeValue = value.replace(/[\r\n\0]/g, "");
-                        // Quote values containing #, spaces, or quotes so dotenv parses correctly
-                        const needsQuoting = /[# "']/.test(safeValue);
-                        const quotedValue = needsQuoting
-                            ? `"${safeValue.replace(/"/g, '\\"')}"`
-                            : safeValue;
-                        const idx = lines.findIndex((l) => l.startsWith(`${key}=`));
-                        const entry = `${key}=${quotedValue}`;
-                        if (idx !== -1) {
-                            lines[idx] = entry;
-                        }
-                        else {
-                            lines.push(entry);
-                        }
-                    }
-                    while (lines.length > 0 && lines[lines.length - 1] === "") {
-                        lines.pop();
-                    }
-                    fs.writeFileSync(envPath, lines.join("\n") + "\n", "utf-8");
                     if (ws.readyState === WebSocket.OPEN) {
                         ws.send(JSON.stringify({
                             type: "env-vars-saved",
                             keys: sanitizedVars.map((v) => v.key),
+                            storage: "scoped-secrets",
                         }));
                     }
                     return;

package/dist/terminal/pty-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"pty-server.js","sourceRoot":"","sources":["../../src/terminal/pty-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,YAAY,IAAI,gBAAgB,GAGjC,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAE3B,oEAAoE;AACpE,IAAI,GAA+C,CAAC;AACpD,KAAK,UAAU,eAAe;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,IAAI,GAAoC,CAAC;AACzC,KAAK,UAAU,KAAK;IAClB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,UAAkB;IAC5D,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAEnC,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,EAAE,CAAC,QAAQ,CAAC,iBAAiB,GAAG,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,OAAO;IACT,CAAC;IAED,2DAA2D;IAC3D,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,SAAS,eAAe,CAAC,SAAiB;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE;iBACd,QAAQ,CAAC,YAAY,SAAS,EAAE,EAAE;gBACjC,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;aAClC,CAAC;iBACD,IAAI,EAAE,CAAC;YACV,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACpC,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACjC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;wBAC3B,eAAe,CAAC,QAAQ,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;IACD,eAAe,CAAC,GAAG,CAAC,CAAC;IAErB,0DAA0D;IAC1D,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,+CAA+C;IAC/C,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC,EAAE,GAAG,CAAC,CAAC;AACV,CAAC;AAwBD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAO,GAAqB,EAAE;IAE9B,MAAM,EACJ,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,EACtB,OAAO,EAAE,cAAc,GAAG,QAAQ,EAClC,IAAI,GAAG,CAAC,EACR,SAAS,EACT,SAAS,GAAG,YAAY,GACzB,GAAG,OAAO,CAAC;IAEZ,mDAAmD;IACnD,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAErC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GACT,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,UAAU,CAAC;IAE1E,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,eAAe;QACf,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;QACpE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpD,+CAA+C;IAC/C,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;oBAClD,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC3D,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;QACH,CAAC;QAED,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,yCAAyC;IACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAgC,CAAC;IAE3D,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,EAAkC,EAAE,GAAG,EAAE,EAAE;QACrE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC;QAClE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,qCAAqC,OAAO,EAAE,CAAC,CAAC;QAExE,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,EAAE;YACrD,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACrC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC,CAAC;QAEF,0DAA0D;QAC1D,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,UAAU,CACR,WAAW,EACX,IAAI,OAAO,uCAAuC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzF,CAAC;YACF,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,EAAE,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QAED,+CAA+C;QAC/C,IAAI,UAAU,IAAI,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,QAAQ,EAAE,iDAAiD,CAAC,CAAC;YACxE,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,EAAE,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,QAAQ,EAAE,cAAc,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,IAAI,OAAO,8BAA8B,CAAC,CAAC;gBACnE,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,UAAU,CACR,WAAW,EACX,IAAI,OAAO,kDAAkD,CAC9D,CAAC;gBACF,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;oBAAE,EAAE,CAAC,KAAK,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,MAAM,WAAW,GAAG,MAAM;YACxB,CAAC,CAAC,aAAa,YAAY,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE;YACrD,CAAC,CAAC,OAAO,CAAC;QACZ,MAAM,WAAW,GAAG,UAAU;YAC5B,CAAC,CAAC,GAAG,WAAW,IAAI,UAAU,EAAE;YAChC,CAAC,CAAC,WAAW,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,kBAAkB,WAAW,EAAE,CAAC,CAAC;QAEzD,iDAAiD;QACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,GAAG,GAAuC;YAC9C,GAAG,OAAO,CAAC,GAAG;YACd,IAAI,EAAE,gBAAgB;SACvB,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,UAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE;gBACvD,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,EAAE;gBACR,GAAG,EAAE,cAAc;gBACnB,GAAG,EAAE,GAA6B;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,uBAAuB,EAAE,GAAG,CAAC,CAAC;YACxD,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACrC,EAAE,CAAC,IAAI,CACL,eAAe,SAAS,yBAAyB,GAAG,aAAa,CAClE,CAAC;gBACF,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;YACD,OAAO;QACT,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,sBAAsB,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;QAEjE,UAAU,CAAC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;YACjC,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACrC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;YACjC,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,yBAAyB,QAAQ,EAAE,CAAC,CAAC;YAC7D,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC9B,IAAI,QAAQ,KAAK,GAAG,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACzD,EAAE,CAAC,IAAI,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,cAAc;oBACpB,MAAM,EAAE,WAAW;oBACnB,OAAO,EAAE,YAAY,OAAO,uCAAuC;iBACpE,CAAC,CACH,CAAC;YACJ,CAAC;YACD,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACrC,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,IAAqB,EAAE,EAAE;YAC/C,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAE9D,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAE5B,IACE,GAAG,CAAC,IAAI,KAAK,wBAAwB;oBACrC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAC7B,CAAC;oBACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;oBAClD,MAAM,IAAI,GAA0C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBAElE,6CAA6C;oBAC7C,MAAM,eAAe,GAAG,0BAA0B,CAAC;oBACnD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;wBAC5C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC/B,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,kCAAkC,GAAG,EAAE,CAAC,CAAC;4BAClE,OAAO,KAAK,CAAC;wBACf,CAAC;wBACD,OAAO,IAAI,CAAC;oBACd,CAAC,CAAC,CAAC;oBAEH,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;oBACzB,IAAI,KAAK,GAAa,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACxD,CAAC;oBAAC,MAAM,CAAC,CAAA,CAAC;oBAEV,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,aAAa,EAAE,CAAC;wBAC3C,sDAAsD;wBACtD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;wBACjD,0EAA0E;wBAC1E,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;wBAC9C,MAAM,WAAW,GAAG,YAAY;4BAC9B,CAAC,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG;4BACvC,CAAC,CAAC,SAAS,CAAC;wBACd,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;wBAC5D,MAAM,KAAK,GAAG,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;wBACtC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;4BACf,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;wBACrB,CAAC;6BAAM,CAAC;4BACN,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACpB,CAAC;oBACH,CAAC;oBAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;wBAC1D,KAAK,CAAC,GAAG,EAAE,CAAC;oBACd,CAAC;oBACD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;oBAE5D,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;wBACrC,EAAE,CAAC,IAAI,CACL,IAAI,CAAC,SAAS,CAAC;4BACb,IAAI,EAAE,gBAAgB;4BACtB,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;yBACtC,CAAC,CACH,CAAC;oBACJ,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;oBAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CACnB,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAC9C,CAAC;oBACF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CACnB,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAC9C,CAAC;oBACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,OAAO;oBAC7D,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBAC9B,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;YAED,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,OAAO,CAAC,GAAG,CACT,GAAG,SAAS,6CAA6C,UAAU,CAAC,GAAG,GAAG,CAC3E,CAAC;YACF,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC9B,eAAe,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACpC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACvE,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;gBACnB,OAAO,CAAC,GAAG,CACT,GAAG,SAAS,2CAA2C,UAAU,KAAK,CACvE,CAAC;YAEJ,OAAO,CAAC;gBACN,MAAM;gBACN,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,GAAG,EAAE;oBACV,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;wBAC3B,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACpC,CAAC;oBACD,UAAU,CAAC,KAAK,EAAE,CAAC;oBACnB,GAAG,CAAC,KAAK,EAAE,CAAC;oBACZ,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * PTY WebSocket Server\n *\n * Creates an HTTP server with WebSocket support that spawns PTY processes\n * for AI CLI tools. Each WebSocket connection gets its own PTY.\n *\n * Used by both the embedded AgentTerminal component and the CLI frame.\n */\n\nimport {\n  createServer as createHttpServer,\n  type IncomingMessage,\n  type Server as HttpServer,\n} from \"http\";\nimport os from \"os\";\nimport path from \"path\";\n\nimport {\n  CLI_REGISTRY,\n  commandExists,\n  isAllowedCommand,\n} from \"./cli-registry.js\";\n\n// Lazy singletons for Node-only modules (only available in Node.js)\nlet _cp: typeof import(\"child_process\") | undefined;\nasync function getChildProcess(): Promise<typeof import(\"child_process\")> {\n  if (!_cp) {\n    _cp = await import(\"node:child_process\");\n  }\n  return _cp;\n}\n\nlet _fs: typeof import(\"fs\") | undefined;\nasync function getFs(): Promise<typeof import(\"fs\")> {\n  if (!_fs) {\n    _fs = await import(\"node:fs\");\n  }\n  return _fs;\n}\n\n/**\n * Kill a process and all its descendants.\n * node-pty's kill() only sends a signal to the shell, but child processes\n * (like `builder`) may be in their own process group and survive as orphans.\n */\nasync function killProcessTree(pid: number, _logPrefix: string): Promise<void> {\n  const cp = await getChildProcess();\n\n  if (os.platform() === \"win32\") {\n    try {\n      cp.execSync(`taskkill /pid ${pid} /T /F`, { stdio: \"ignore\" });\n    } catch {}\n    return;\n  }\n\n  // Find all descendant PIDs (children, grandchildren, etc.)\n  const descendants: number[] = [];\n  function findDescendants(parentPid: number) {\n    try {\n      const output = cp\n        .execSync(`pgrep -P ${parentPid}`, {\n          encoding: \"utf-8\",\n          stdio: [\"pipe\", \"pipe\", \"ignore\"],\n        })\n        .trim();\n      if (output) {\n        for (const line of output.split(\"\\n\")) {\n          const childPid = parseInt(line, 10);\n          if (childPid && !isNaN(childPid)) {\n            descendants.push(childPid);\n            findDescendants(childPid);\n          }\n        }\n      }\n    } catch {\n      // pgrep returns non-zero when no children found\n    }\n  }\n  findDescendants(pid);\n\n  // Kill descendants first (deepest first), then the parent\n  for (const childPid of descendants.reverse()) {\n    try {\n      process.kill(childPid, \"SIGTERM\");\n    } catch {}\n  }\n\n  try {\n    process.kill(pid, \"SIGTERM\");\n  } catch {}\n\n  // Force-kill any survivors after a short delay\n  setTimeout(() => {\n    for (const childPid of descendants) {\n      try {\n        process.kill(childPid, \"SIGKILL\");\n      } catch {}\n    }\n    try {\n      process.kill(pid, \"SIGKILL\");\n    } catch {}\n  }, 500);\n}\n\nexport interface PtyServerOptions {\n  /** Working directory for PTY processes. Defaults to process.cwd() */\n  appDir?: string;\n  /** Default CLI command. Defaults to 'claude' */\n  command?: string;\n  /** Port to listen on. Defaults to 0 (random available port) */\n  port?: number;\n  /** Auth check for WebSocket upgrade requests. Return false to reject. */\n  authCheck?: (req: IncomingMessage) => boolean | Promise<boolean>;\n  /** Log prefix for console output. Defaults to '[terminal]' */\n  logPrefix?: string;\n}\n\nexport interface PtyServerResult {\n  /** The underlying HTTP server */\n  server: HttpServer;\n  /** The actual port the server is listening on */\n  port: number;\n  /** Shut down the server and kill all PTY processes */\n  close: () => void;\n}\n\nexport async function createPtyWebSocketServer(\n  options: PtyServerOptions = {},\n): Promise<PtyServerResult> {\n  const {\n    appDir = process.cwd(),\n    command: defaultCommand = \"claude\",\n    port = 0,\n    authCheck,\n    logPrefix = \"[terminal]\",\n  } = options;\n\n  // Dynamic imports for optional native dependencies\n  const { WebSocketServer, WebSocket } = await import(\"ws\");\n  const pty = await import(\"node-pty\");\n\n  const resolvedAppDir = path.resolve(appDir);\n  const shell =\n    os.platform() === \"win32\" ? \"cmd.exe\" : process.env.SHELL || \"/bin/zsh\";\n\n  const server = createHttpServer((req, res) => {\n    // CORS headers\n    res.setHeader(\"Access-Control-Allow-Origin\", \"*\");\n    res.setHeader(\"Access-Control-Allow-Methods\", \"GET, POST, OPTIONS\");\n    res.setHeader(\"Access-Control-Allow-Headers\", \"Content-Type\");\n\n    if (req.method === \"OPTIONS\") {\n      res.writeHead(204);\n      res.end();\n      return;\n    }\n\n    res.writeHead(404);\n    res.end();\n  });\n\n  const wss = new WebSocketServer({ noServer: true });\n\n  // Handle WebSocket upgrades with optional auth\n  server.on(\"upgrade\", async (req, socket, head) => {\n    const url = new URL(req.url || \"/\", `http://${req.headers.host}`);\n    if (url.pathname !== \"/ws\") {\n      socket.write(\"HTTP/1.1 404 Not Found\\r\\n\\r\\n\");\n      socket.destroy();\n      return;\n    }\n\n    if (authCheck) {\n      try {\n        const allowed = await authCheck(req);\n        if (!allowed) {\n          socket.write(\"HTTP/1.1 401 Unauthorized\\r\\n\\r\\n\");\n          socket.destroy();\n          return;\n        }\n      } catch {\n        socket.write(\"HTTP/1.1 500 Internal Server Error\\r\\n\\r\\n\");\n        socket.destroy();\n        return;\n      }\n    }\n\n    wss.handleUpgrade(req, socket, head, (ws) => {\n      wss.emit(\"connection\", ws, req);\n    });\n  });\n\n  // Track active PTY processes for cleanup\n  const activePtys = new Set<ReturnType<typeof pty.spawn>>();\n\n  wss.on(\"connection\", async (ws: InstanceType<typeof WebSocket>, req) => {\n    const url = new URL(req.url || \"\", `http://${req.headers.host}`);\n    const command = url.searchParams.get(\"command\") || defaultCommand;\n    const extraFlags = url.searchParams.get(\"flags\") || \"\";\n    console.log(`${logPrefix} WebSocket connected for command: ${command}`);\n\n    const sendStatus = (status: string, message: string) => {\n      if (ws.readyState === WebSocket.OPEN) {\n        ws.send(JSON.stringify({ type: \"setup-status\", status, message }));\n      }\n    };\n\n    // Validate command against allowlist to prevent injection\n    if (!isAllowedCommand(command)) {\n      sendStatus(\n        \"not-found\",\n        `\"${command}\" is not a recognized CLI. Allowed: ${Object.keys(CLI_REGISTRY).join(\", \")}`,\n      );\n      if (ws.readyState === WebSocket.OPEN) ws.close();\n      return;\n    }\n\n    // Reject flags containing shell metacharacters\n    if (extraFlags && /[;&|`$(){}\\n\\r<>]/.test(extraFlags)) {\n      sendStatus(\"failed\", \"Invalid flags: shell metacharacters not allowed\");\n      if (ws.readyState === WebSocket.OPEN) ws.close();\n      return;\n    }\n\n    // Check if CLI is installed; if not, use npx to run it\n    let useNpx = false;\n    if (!(await commandExists(command))) {\n      const registry = CLI_REGISTRY[command];\n      if (registry?.installPackage) {\n        console.log(`${logPrefix} ${command} CLI not found, will use npx`);\n        useNpx = true;\n      } else {\n        sendStatus(\n          \"not-found\",\n          `\"${command}\" not found on PATH. Please install it manually.`,\n        );\n        if (ws.readyState === WebSocket.OPEN) ws.close();\n        return;\n      }\n    }\n\n    // Build the command — use npx if CLI not found locally\n    const baseCommand = useNpx\n      ? `npx --yes ${CLI_REGISTRY[command].installPackage}`\n      : command;\n    const fullCommand = extraFlags\n      ? `${baseCommand} ${extraFlags}`\n      : baseCommand;\n    console.log(`${logPrefix} Spawning PTY: ${fullCommand}`);\n\n    // Build env, stripping CLI-specific nesting vars\n    const registry = CLI_REGISTRY[command];\n    const env: Record<string, string | undefined> = {\n      ...process.env,\n      TERM: \"xterm-256color\",\n    };\n    if (registry) {\n      for (const v of registry.stripEnv) delete env[v];\n    }\n\n    let ptyProcess: ReturnType<typeof pty.spawn>;\n    try {\n      ptyProcess = pty.spawn(shell, [\"-l\", \"-c\", fullCommand], {\n        name: \"xterm-256color\",\n        cols: 120,\n        rows: 40,\n        cwd: resolvedAppDir,\n        env: env as Record<string, string>,\n      });\n    } catch (err) {\n      console.error(`${logPrefix} Failed to spawn PTY:`, err);\n      if (ws.readyState === WebSocket.OPEN) {\n        ws.send(\n          `\\r\\n\\x1b[31m${logPrefix} Failed to spawn PTY: ${err}\\x1b[0m\\r\\n`,\n        );\n        ws.close();\n      }\n      return;\n    }\n\n    activePtys.add(ptyProcess);\n    console.log(`${logPrefix} PTY spawned (pid: ${ptyProcess.pid})`);\n\n    ptyProcess.onData((data: string) => {\n      if (ws.readyState === WebSocket.OPEN) {\n        ws.send(data);\n      }\n    });\n\n    ptyProcess.onExit(({ exitCode }) => {\n      console.log(`${logPrefix} PTY exited with code ${exitCode}`);\n      activePtys.delete(ptyProcess);\n      if (exitCode === 127 && ws.readyState === WebSocket.OPEN) {\n        ws.send(\n          JSON.stringify({\n            type: \"setup-status\",\n            status: \"not-found\",\n            message: `Command \"${command}\" not found. Please install it first.`,\n          }),\n        );\n      }\n      if (ws.readyState === WebSocket.OPEN) {\n        ws.close();\n      }\n    });\n\n    ws.on(\"message\", async (data: Buffer | string) => {\n      const str = typeof data === \"string\" ? data : data.toString();\n\n      try {\n        const msg = JSON.parse(str);\n\n        if (\n          msg.type === \"agentNative.setEnvVars\" &&\n          Array.isArray(msg.data?.vars)\n        ) {\n          const envPath = path.join(resolvedAppDir, \".env\");\n          const vars: Array<{ key: string; value: string }> = msg.data.vars;\n\n          // Validate env var names and sanitize values\n          const validKeyPattern = /^[A-Za-z_][A-Za-z0-9_]*$/;\n          const sanitizedVars = vars.filter(({ key }) => {\n            if (!validKeyPattern.test(key)) {\n              console.warn(`${logPrefix} Rejected invalid env var key: ${key}`);\n              return false;\n            }\n            return true;\n          });\n\n          const fs = await getFs();\n          let lines: string[] = [];\n          try {\n            lines = fs.readFileSync(envPath, \"utf-8\").split(\"\\n\");\n          } catch {}\n\n          for (const { key, value } of sanitizedVars) {\n            // Strip newlines/null bytes to prevent line injection\n            const safeValue = value.replace(/[\\r\\n\\0]/g, \"\");\n            // Quote values containing #, spaces, or quotes so dotenv parses correctly\n            const needsQuoting = /[# \"']/.test(safeValue);\n            const quotedValue = needsQuoting\n              ? `\"${safeValue.replace(/\"/g, '\\\\\"')}\"`\n              : safeValue;\n            const idx = lines.findIndex((l) => l.startsWith(`${key}=`));\n            const entry = `${key}=${quotedValue}`;\n            if (idx !== -1) {\n              lines[idx] = entry;\n            } else {\n              lines.push(entry);\n            }\n          }\n\n          while (lines.length > 0 && lines[lines.length - 1] === \"\") {\n            lines.pop();\n          }\n          fs.writeFileSync(envPath, lines.join(\"\\n\") + \"\\n\", \"utf-8\");\n\n          if (ws.readyState === WebSocket.OPEN) {\n            ws.send(\n              JSON.stringify({\n                type: \"env-vars-saved\",\n                keys: sanitizedVars.map((v) => v.key),\n              }),\n            );\n          }\n          return;\n        }\n\n        if (msg.type === \"resize\" && msg.cols != null && msg.rows != null) {\n          const cols = Math.max(\n            1,\n            Math.min(65535, Math.trunc(Number(msg.cols))),\n          );\n          const rows = Math.max(\n            1,\n            Math.min(65535, Math.trunc(Number(msg.rows))),\n          );\n          if (!Number.isFinite(cols) || !Number.isFinite(rows)) return;\n          ptyProcess.resize(cols, rows);\n          return;\n        }\n      } catch {\n        // Not JSON — regular terminal input\n      }\n\n      ptyProcess.write(str);\n    });\n\n    ws.on(\"close\", () => {\n      console.log(\n        `${logPrefix} WebSocket closed, killing PTY tree (pid: ${ptyProcess.pid})`,\n      );\n      activePtys.delete(ptyProcess);\n      killProcessTree(ptyProcess.pid, logPrefix);\n    });\n  });\n\n  return new Promise((resolve, reject) => {\n    server.once(\"error\", (err) => {\n      reject(err);\n    });\n    server.listen(port, \"127.0.0.1\", () => {\n      const addr = server.address();\n      const actualPort = typeof addr === \"object\" && addr ? addr.port : port;\n      if (process.env.DEBUG)\n        console.log(\n          `${logPrefix} PTY WebSocket server on ws://localhost:${actualPort}/ws`,\n        );\n\n      resolve({\n        server,\n        port: actualPort,\n        close: () => {\n          for (const p of activePtys) {\n            killProcessTree(p.pid, logPrefix);\n          }\n          activePtys.clear();\n          wss.close();\n          server.close();\n        },\n      });\n    });\n  });\n}\n"]}
+{"version":3,"file":"pty-server.js","sourceRoot":"","sources":["../../src/terminal/pty-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,YAAY,IAAI,gBAAgB,GAGjC,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAE3B,oEAAoE;AACpE,IAAI,GAA+C,CAAC;AACpD,KAAK,UAAU,eAAe;IAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,UAAkB;IAC5D,MAAM,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;IAEnC,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,EAAE,CAAC,QAAQ,CAAC,iBAAiB,GAAG,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACV,OAAO;IACT,CAAC;IAED,2DAA2D;IAC3D,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,SAAS,eAAe,CAAC,SAAiB;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE;iBACd,QAAQ,CAAC,YAAY,SAAS,EAAE,EAAE;gBACjC,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;aAClC,CAAC;iBACD,IAAI,EAAE,CAAC;YACV,IAAI,MAAM,EAAE,CAAC;gBACX,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACpC,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;wBACjC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;wBAC3B,eAAe,CAAC,QAAQ,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;IACD,eAAe,CAAC,GAAG,CAAC,CAAC;IAErB,0DAA0D;IAC1D,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,+CAA+C;IAC/C,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC,EAAE,GAAG,CAAC,CAAC;AACV,CAAC;AAwBD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAO,GAAqB,EAAE;IAE9B,MAAM,EACJ,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,EACtB,OAAO,EAAE,cAAc,GAAG,QAAQ,EAClC,IAAI,GAAG,CAAC,EACR,SAAS,EACT,SAAS,GAAG,YAAY,GACzB,GAAG,OAAO,CAAC;IAEZ,mDAAmD;IACnD,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAErC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GACT,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,UAAU,CAAC;IAE1E,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,eAAe;QACf,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;QACpE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpD,+CAA+C;IAC/C,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;oBAClD,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC3D,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;QACH,CAAC;QAED,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;YAC1C,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,yCAAyC;IACzC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAgC,CAAC;IAE3D,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,EAAkC,EAAE,GAAG,EAAE,EAAE;QACrE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC;QAClE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,qCAAqC,OAAO,EAAE,CAAC,CAAC;QAExE,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,EAAE;YACrD,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACrC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC,CAAC;QAEF,0DAA0D;QAC1D,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,UAAU,CACR,WAAW,EACX,IAAI,OAAO,uCAAuC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzF,CAAC;YACF,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,EAAE,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QAED,+CAA+C;QAC/C,IAAI,UAAU,IAAI,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,QAAQ,EAAE,iDAAiD,CAAC,CAAC;YACxE,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;gBAAE,EAAE,CAAC,KAAK,EAAE,CAAC;YACjD,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACvC,IAAI,QAAQ,EAAE,cAAc,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,IAAI,OAAO,8BAA8B,CAAC,CAAC;gBACnE,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,UAAU,CACR,WAAW,EACX,IAAI,OAAO,kDAAkD,CAC9D,CAAC;gBACF,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI;oBAAE,EAAE,CAAC,KAAK,EAAE,CAAC;gBACjD,OAAO;YACT,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,MAAM,WAAW,GAAG,MAAM;YACxB,CAAC,CAAC,aAAa,YAAY,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE;YACrD,CAAC,CAAC,OAAO,CAAC;QACZ,MAAM,WAAW,GAAG,UAAU;YAC5B,CAAC,CAAC,GAAG,WAAW,IAAI,UAAU,EAAE;YAChC,CAAC,CAAC,WAAW,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,kBAAkB,WAAW,EAAE,CAAC,CAAC;QAEzD,iDAAiD;QACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,GAAG,GAAuC;YAC9C,GAAG,OAAO,CAAC,GAAG;YACd,IAAI,EAAE,gBAAgB;SACvB,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,UAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE;gBACvD,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,EAAE;gBACR,GAAG,EAAE,cAAc;gBACnB,GAAG,EAAE,GAA6B;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,SAAS,uBAAuB,EAAE,GAAG,CAAC,CAAC;YACxD,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACrC,EAAE,CAAC,IAAI,CACL,eAAe,SAAS,yBAAyB,GAAG,aAAa,CAClE,CAAC;gBACF,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;YACD,OAAO;QACT,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,sBAAsB,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;QAEjE,UAAU,CAAC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;YACjC,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACrC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;YACjC,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,yBAAyB,QAAQ,EAAE,CAAC,CAAC;YAC7D,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC9B,IAAI,QAAQ,KAAK,GAAG,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACzD,EAAE,CAAC,IAAI,CACL,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,cAAc;oBACpB,MAAM,EAAE,WAAW;oBACnB,OAAO,EAAE,YAAY,OAAO,uCAAuC;iBACpE,CAAC,CACH,CAAC;YACJ,CAAC;YACD,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACrC,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,IAAqB,EAAE,EAAE;YAC/C,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAE9D,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAE5B,IACE,GAAG,CAAC,IAAI,KAAK,wBAAwB;oBACrC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAC7B,CAAC;oBACD,MAAM,IAAI,GAA0C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBAElE,sEAAsE;oBACtE,yDAAyD;oBACzD,MAAM,eAAe,GAAG,0BAA0B,CAAC;oBACnD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;wBAC5C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC/B,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,kCAAkC,GAAG,EAAE,CAAC,CAAC;4BAClE,OAAO,KAAK,CAAC;wBACf,CAAC;wBACD,OAAO,IAAI,CAAC;oBACd,CAAC,CAAC,CAAC;oBAEH,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;wBACrC,EAAE,CAAC,IAAI,CACL,IAAI,CAAC,SAAS,CAAC;4BACb,IAAI,EAAE,gBAAgB;4BACtB,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;4BACrC,OAAO,EAAE,gBAAgB;yBAC1B,CAAC,CACH,CAAC;oBACJ,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;oBAClE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CACnB,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAC9C,CAAC;oBACF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CACnB,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAC9C,CAAC;oBACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,OAAO;oBAC7D,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBAC9B,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;YAED,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,OAAO,CAAC,GAAG,CACT,GAAG,SAAS,6CAA6C,UAAU,CAAC,GAAG,GAAG,CAC3E,CAAC;YACF,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC9B,eAAe,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YACpC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACvE,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;gBACnB,OAAO,CAAC,GAAG,CACT,GAAG,SAAS,2CAA2C,UAAU,KAAK,CACvE,CAAC;YAEJ,OAAO,CAAC;gBACN,MAAM;gBACN,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,GAAG,EAAE;oBACV,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;wBAC3B,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACpC,CAAC;oBACD,UAAU,CAAC,KAAK,EAAE,CAAC;oBACnB,GAAG,CAAC,KAAK,EAAE,CAAC;oBACZ,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,CAAC;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * PTY WebSocket Server\n *\n * Creates an HTTP server with WebSocket support that spawns PTY processes\n * for AI CLI tools. Each WebSocket connection gets its own PTY.\n *\n * Used by both the embedded AgentTerminal component and the CLI frame.\n */\n\nimport {\n  createServer as createHttpServer,\n  type IncomingMessage,\n  type Server as HttpServer,\n} from \"http\";\nimport os from \"os\";\nimport path from \"path\";\n\nimport {\n  CLI_REGISTRY,\n  commandExists,\n  isAllowedCommand,\n} from \"./cli-registry.js\";\n\n// Lazy singletons for Node-only modules (only available in Node.js)\nlet _cp: typeof import(\"child_process\") | undefined;\nasync function getChildProcess(): Promise<typeof import(\"child_process\")> {\n  if (!_cp) {\n    _cp = await import(\"node:child_process\");\n  }\n  return _cp;\n}\n\n/**\n * Kill a process and all its descendants.\n * node-pty's kill() only sends a signal to the shell, but child processes\n * (like `builder`) may be in their own process group and survive as orphans.\n */\nasync function killProcessTree(pid: number, _logPrefix: string): Promise<void> {\n  const cp = await getChildProcess();\n\n  if (os.platform() === \"win32\") {\n    try {\n      cp.execSync(`taskkill /pid ${pid} /T /F`, { stdio: \"ignore\" });\n    } catch {}\n    return;\n  }\n\n  // Find all descendant PIDs (children, grandchildren, etc.)\n  const descendants: number[] = [];\n  function findDescendants(parentPid: number) {\n    try {\n      const output = cp\n        .execSync(`pgrep -P ${parentPid}`, {\n          encoding: \"utf-8\",\n          stdio: [\"pipe\", \"pipe\", \"ignore\"],\n        })\n        .trim();\n      if (output) {\n        for (const line of output.split(\"\\n\")) {\n          const childPid = parseInt(line, 10);\n          if (childPid && !isNaN(childPid)) {\n            descendants.push(childPid);\n            findDescendants(childPid);\n          }\n        }\n      }\n    } catch {\n      // pgrep returns non-zero when no children found\n    }\n  }\n  findDescendants(pid);\n\n  // Kill descendants first (deepest first), then the parent\n  for (const childPid of descendants.reverse()) {\n    try {\n      process.kill(childPid, \"SIGTERM\");\n    } catch {}\n  }\n\n  try {\n    process.kill(pid, \"SIGTERM\");\n  } catch {}\n\n  // Force-kill any survivors after a short delay\n  setTimeout(() => {\n    for (const childPid of descendants) {\n      try {\n        process.kill(childPid, \"SIGKILL\");\n      } catch {}\n    }\n    try {\n      process.kill(pid, \"SIGKILL\");\n    } catch {}\n  }, 500);\n}\n\nexport interface PtyServerOptions {\n  /** Working directory for PTY processes. Defaults to process.cwd() */\n  appDir?: string;\n  /** Default CLI command. Defaults to 'claude' */\n  command?: string;\n  /** Port to listen on. Defaults to 0 (random available port) */\n  port?: number;\n  /** Auth check for WebSocket upgrade requests. Return false to reject. */\n  authCheck?: (req: IncomingMessage) => boolean | Promise<boolean>;\n  /** Log prefix for console output. Defaults to '[terminal]' */\n  logPrefix?: string;\n}\n\nexport interface PtyServerResult {\n  /** The underlying HTTP server */\n  server: HttpServer;\n  /** The actual port the server is listening on */\n  port: number;\n  /** Shut down the server and kill all PTY processes */\n  close: () => void;\n}\n\nexport async function createPtyWebSocketServer(\n  options: PtyServerOptions = {},\n): Promise<PtyServerResult> {\n  const {\n    appDir = process.cwd(),\n    command: defaultCommand = \"claude\",\n    port = 0,\n    authCheck,\n    logPrefix = \"[terminal]\",\n  } = options;\n\n  // Dynamic imports for optional native dependencies\n  const { WebSocketServer, WebSocket } = await import(\"ws\");\n  const pty = await import(\"node-pty\");\n\n  const resolvedAppDir = path.resolve(appDir);\n  const shell =\n    os.platform() === \"win32\" ? \"cmd.exe\" : process.env.SHELL || \"/bin/zsh\";\n\n  const server = createHttpServer((req, res) => {\n    // CORS headers\n    res.setHeader(\"Access-Control-Allow-Origin\", \"*\");\n    res.setHeader(\"Access-Control-Allow-Methods\", \"GET, POST, OPTIONS\");\n    res.setHeader(\"Access-Control-Allow-Headers\", \"Content-Type\");\n\n    if (req.method === \"OPTIONS\") {\n      res.writeHead(204);\n      res.end();\n      return;\n    }\n\n    res.writeHead(404);\n    res.end();\n  });\n\n  const wss = new WebSocketServer({ noServer: true });\n\n  // Handle WebSocket upgrades with optional auth\n  server.on(\"upgrade\", async (req, socket, head) => {\n    const url = new URL(req.url || \"/\", `http://${req.headers.host}`);\n    if (url.pathname !== \"/ws\") {\n      socket.write(\"HTTP/1.1 404 Not Found\\r\\n\\r\\n\");\n      socket.destroy();\n      return;\n    }\n\n    if (authCheck) {\n      try {\n        const allowed = await authCheck(req);\n        if (!allowed) {\n          socket.write(\"HTTP/1.1 401 Unauthorized\\r\\n\\r\\n\");\n          socket.destroy();\n          return;\n        }\n      } catch {\n        socket.write(\"HTTP/1.1 500 Internal Server Error\\r\\n\\r\\n\");\n        socket.destroy();\n        return;\n      }\n    }\n\n    wss.handleUpgrade(req, socket, head, (ws) => {\n      wss.emit(\"connection\", ws, req);\n    });\n  });\n\n  // Track active PTY processes for cleanup\n  const activePtys = new Set<ReturnType<typeof pty.spawn>>();\n\n  wss.on(\"connection\", async (ws: InstanceType<typeof WebSocket>, req) => {\n    const url = new URL(req.url || \"\", `http://${req.headers.host}`);\n    const command = url.searchParams.get(\"command\") || defaultCommand;\n    const extraFlags = url.searchParams.get(\"flags\") || \"\";\n    console.log(`${logPrefix} WebSocket connected for command: ${command}`);\n\n    const sendStatus = (status: string, message: string) => {\n      if (ws.readyState === WebSocket.OPEN) {\n        ws.send(JSON.stringify({ type: \"setup-status\", status, message }));\n      }\n    };\n\n    // Validate command against allowlist to prevent injection\n    if (!isAllowedCommand(command)) {\n      sendStatus(\n        \"not-found\",\n        `\"${command}\" is not a recognized CLI. Allowed: ${Object.keys(CLI_REGISTRY).join(\", \")}`,\n      );\n      if (ws.readyState === WebSocket.OPEN) ws.close();\n      return;\n    }\n\n    // Reject flags containing shell metacharacters\n    if (extraFlags && /[;&|`$(){}\\n\\r<>]/.test(extraFlags)) {\n      sendStatus(\"failed\", \"Invalid flags: shell metacharacters not allowed\");\n      if (ws.readyState === WebSocket.OPEN) ws.close();\n      return;\n    }\n\n    // Check if CLI is installed; if not, use npx to run it\n    let useNpx = false;\n    if (!(await commandExists(command))) {\n      const registry = CLI_REGISTRY[command];\n      if (registry?.installPackage) {\n        console.log(`${logPrefix} ${command} CLI not found, will use npx`);\n        useNpx = true;\n      } else {\n        sendStatus(\n          \"not-found\",\n          `\"${command}\" not found on PATH. Please install it manually.`,\n        );\n        if (ws.readyState === WebSocket.OPEN) ws.close();\n        return;\n      }\n    }\n\n    // Build the command — use npx if CLI not found locally\n    const baseCommand = useNpx\n      ? `npx --yes ${CLI_REGISTRY[command].installPackage}`\n      : command;\n    const fullCommand = extraFlags\n      ? `${baseCommand} ${extraFlags}`\n      : baseCommand;\n    console.log(`${logPrefix} Spawning PTY: ${fullCommand}`);\n\n    // Build env, stripping CLI-specific nesting vars\n    const registry = CLI_REGISTRY[command];\n    const env: Record<string, string | undefined> = {\n      ...process.env,\n      TERM: \"xterm-256color\",\n    };\n    if (registry) {\n      for (const v of registry.stripEnv) delete env[v];\n    }\n\n    let ptyProcess: ReturnType<typeof pty.spawn>;\n    try {\n      ptyProcess = pty.spawn(shell, [\"-l\", \"-c\", fullCommand], {\n        name: \"xterm-256color\",\n        cols: 120,\n        rows: 40,\n        cwd: resolvedAppDir,\n        env: env as Record<string, string>,\n      });\n    } catch (err) {\n      console.error(`${logPrefix} Failed to spawn PTY:`, err);\n      if (ws.readyState === WebSocket.OPEN) {\n        ws.send(\n          `\\r\\n\\x1b[31m${logPrefix} Failed to spawn PTY: ${err}\\x1b[0m\\r\\n`,\n        );\n        ws.close();\n      }\n      return;\n    }\n\n    activePtys.add(ptyProcess);\n    console.log(`${logPrefix} PTY spawned (pid: ${ptyProcess.pid})`);\n\n    ptyProcess.onData((data: string) => {\n      if (ws.readyState === WebSocket.OPEN) {\n        ws.send(data);\n      }\n    });\n\n    ptyProcess.onExit(({ exitCode }) => {\n      console.log(`${logPrefix} PTY exited with code ${exitCode}`);\n      activePtys.delete(ptyProcess);\n      if (exitCode === 127 && ws.readyState === WebSocket.OPEN) {\n        ws.send(\n          JSON.stringify({\n            type: \"setup-status\",\n            status: \"not-found\",\n            message: `Command \"${command}\" not found. Please install it first.`,\n          }),\n        );\n      }\n      if (ws.readyState === WebSocket.OPEN) {\n        ws.close();\n      }\n    });\n\n    ws.on(\"message\", async (data: Buffer | string) => {\n      const str = typeof data === \"string\" ? data : data.toString();\n\n      try {\n        const msg = JSON.parse(str);\n\n        if (\n          msg.type === \"agentNative.setEnvVars\" &&\n          Array.isArray(msg.data?.vars)\n        ) {\n          const vars: Array<{ key: string; value: string }> = msg.data.vars;\n\n          // Legacy bridge message. Keep validating the keys, but do not persist\n          // them to .env or process.env; key storage is DB-scoped.\n          const validKeyPattern = /^[A-Za-z_][A-Za-z0-9_]*$/;\n          const sanitizedVars = vars.filter(({ key }) => {\n            if (!validKeyPattern.test(key)) {\n              console.warn(`${logPrefix} Rejected invalid env var key: ${key}`);\n              return false;\n            }\n            return true;\n          });\n\n          if (ws.readyState === WebSocket.OPEN) {\n            ws.send(\n              JSON.stringify({\n                type: \"env-vars-saved\",\n                keys: sanitizedVars.map((v) => v.key),\n                storage: \"scoped-secrets\",\n              }),\n            );\n          }\n          return;\n        }\n\n        if (msg.type === \"resize\" && msg.cols != null && msg.rows != null) {\n          const cols = Math.max(\n            1,\n            Math.min(65535, Math.trunc(Number(msg.cols))),\n          );\n          const rows = Math.max(\n            1,\n            Math.min(65535, Math.trunc(Number(msg.rows))),\n          );\n          if (!Number.isFinite(cols) || !Number.isFinite(rows)) return;\n          ptyProcess.resize(cols, rows);\n          return;\n        }\n      } catch {\n        // Not JSON — regular terminal input\n      }\n\n      ptyProcess.write(str);\n    });\n\n    ws.on(\"close\", () => {\n      console.log(\n        `${logPrefix} WebSocket closed, killing PTY tree (pid: ${ptyProcess.pid})`,\n      );\n      activePtys.delete(ptyProcess);\n      killProcessTree(ptyProcess.pid, logPrefix);\n    });\n  });\n\n  return new Promise((resolve, reject) => {\n    server.once(\"error\", (err) => {\n      reject(err);\n    });\n    server.listen(port, \"127.0.0.1\", () => {\n      const addr = server.address();\n      const actualPort = typeof addr === \"object\" && addr ? addr.port : port;\n      if (process.env.DEBUG)\n        console.log(\n          `${logPrefix} PTY WebSocket server on ws://localhost:${actualPort}/ws`,\n        );\n\n      resolve({\n        server,\n        port: actualPort,\n        close: () => {\n          for (const p of activePtys) {\n            killProcessTree(p.pid, logPrefix);\n          }\n          activePtys.clear();\n          wss.close();\n          server.close();\n        },\n      });\n    });\n  });\n}\n"]}

package/dist/triggers/dispatcher.js

@@ -209,7 +209,7 @@ async function handleEvent(eventName, payload, eventMeta) {
             // Resolve API key for condition evaluation
             const owner = meta.createdBy || resource.owner;
             const userApiKey = await getOwnerActiveApiKey(owner);
-            const apiKey = userApiKey || _deps.apiKey || process.env.ANTHROPIC_API_KEY;
+            const apiKey = userApiKey || _deps.apiKey;
             if (!apiKey) {
                 console.warn(`[triggers] No API key for trigger "${resource.path}" — skipping`);
                 continue;