@agentrific/server 0.1.5 → 0.1.6

package/index.js

@@ -45,7 +45,14 @@ var PushGrantSchema = PushEnrollmentSchema.extend({
   grant: z.string().regex(/^[a-f0-9]{64}$/),
   expiresAt: z.number()
 }).strict();
-var PushEventSchema = z.object({ eventId: z.string().uuid(), sessionId: z.string().uuid(), kind: PushKindSchema }).strict();
+var PushPullRequestUrlSchema = z.string().max(512).regex(/^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/[1-9][0-9]*$/);
+var PushEventSchema = z.object({
+  eventId: z.string().uuid(),
+  sessionId: z.string().uuid(),
+  kind: PushKindSchema,
+  taskTitle: z.string().trim().min(1).max(160).optional(),
+  prUrl: PushPullRequestUrlSchema.optional()
+}).strict();
 var PushSignedRequestSchema = z.object({
   bindingId: z.string().uuid(),
   timestamp: z.number().int(),
@@ -105,10 +112,11 @@ function pushKind(session, previous) {
   }
 }
 var ServerPush = class {
-  constructor(store2, serverId, directory, transport = fetch) {
+  constructor(store2, serverId, directory, transport = fetch, apiUrl = PUSH_API_URL) {
     this.store = store2;
     this.serverId = serverId;
     this.transport = transport;
+    this.apiUrl = apiUrl;
     mkdirSync(directory, { recursive: true, mode: 448 });
     const filename = path.join(directory, "push-signing-key.pem");
     if (!existsSync(filename))
@@ -123,6 +131,7 @@ var ServerPush = class {
   store;
   serverId;
   transport;
+  apiUrl;
   key;
   publicKey;
   draining;
@@ -136,6 +145,8 @@ var ServerPush = class {
       eventId: randomUUID(),
       sessionId: session.id,
       kind,
+      taskTitle: session.title.replace(/[\r\n\t]+/g, " ").trim().slice(0, 160) || void 0,
+      prUrl: kind === "pr_created" ? PushPullRequestUrlSchema.safeParse(session.gitDelivery?.url).data : void 0,
       remaining: state.bindings,
       createdAt: Date.now(),
       attempts: 0,
@@ -158,7 +169,7 @@ var ServerPush = class {
       Buffer.from(pushSigningText(installationId, operation, request)),
       this.key
     ).toString("hex");
-    return this.transport(`${PUSH_API_URL}/v1/installations/${installationId}/${operation}`, {
+    return this.transport(`${this.apiUrl}/v1/installations/${installationId}/${operation}`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ ...request, signature }),
@@ -232,7 +243,13 @@ var ServerPush = class {
             binding.installationId,
             binding.bindingId,
             "events",
-            JSON.stringify({ eventId: job.eventId, sessionId: job.sessionId, kind: job.kind })
+            JSON.stringify({
+              eventId: job.eventId,
+              sessionId: job.sessionId,
+              kind: job.kind,
+              taskTitle: job.taskTitle,
+              prUrl: job.prUrl
+            })
           );
           if (response.ok) continue;
           if ([401, 403, 404].includes(response.status)) {
@@ -613,6 +630,11 @@ var PairingPayloadSchema = z2.object({
   serverId: z2.string().uuid(),
   pairingId: z2.string().regex(/^[a-f0-9]{64}$/)
 });
+var PairingInvitationSchema = z2.object({
+  payload: PairingPayloadSchema,
+  pin: z2.string().regex(/^\d{6}$/),
+  expiresAt: z2.number()
+});
 var PairingRequestSchema = z2.object({
   pairingId: z2.string().regex(/^[a-f0-9]{64}$/),
   pin: z2.string().regex(/^\d{6}$/),
@@ -905,190 +927,55 @@ function attachEventServer(app2, security2, origins, snapshot) {
 
 // src/security.ts
 import { createHash, randomBytes, randomInt, randomUUID as randomUUID3, timingSafeEqual } from "node:crypto";
-import { Effect as Effect3 } from "effect";
-import { z as z4 } from "zod";
-var secret = () => randomBytes(32).toString("hex");
-var digest = (value) => createHash("sha256").update(value).digest("hex");
-var ServerSecurity = class {
-  constructor(store2, serverId) {
-    this.store = store2;
-    this.serverId = serverId;
-  }
-  store;
-  serverId;
-  grants = /* @__PURE__ */ new Map();
-  tickets = /* @__PURE__ */ new Map();
-  attempts = /* @__PURE__ */ new Map();
-  sockets = /* @__PURE__ */ new Map();
-  prune() {
-    const now = Date.now();
-    for (const [key, grant] of this.grants) if (grant.expiresAt <= now) this.grants.delete(key);
-    for (const [key, ticket] of this.tickets) if (ticket.expiresAt <= now) this.tickets.delete(key);
-    for (const [key, attempts] of this.attempts)
-      if (attempts.until <= now) this.attempts.delete(key);
-  }
-  createPairing() {
-    this.prune();
-    if (this.grants.size >= 10)
-      throw new Error("Too many pending enrollments. Wait for them to expire.");
-    const pairingId = secret();
-    const grant = {
-      pin: String(randomInt(1e6)).padStart(6, "0"),
-      expiresAt: Date.now() + 3e5,
-      attempts: 0
-    };
-    this.grants.set(pairingId, grant);
-    return { pairingId, pin: grant.pin, expiresAt: grant.expiresAt, serverId: this.serverId };
-  }
-  async pair(input, address) {
-    this.prune();
-    const attempts = this.attempts.get(address) ?? { count: 0, until: Date.now() + 6e4 };
-    if (attempts.count >= 20 || !this.attempts.has(address) && this.attempts.size >= 5e3)
-      return void 0;
-    attempts.count++;
-    this.attempts.set(address, attempts);
-    const grant = this.grants.get(input.pairingId);
-    if (!grant) return void 0;
-    grant.attempts++;
-    const match = timingSafeEqual(Buffer.from(grant.pin), Buffer.from(input.pin));
-    if (grant.attempts >= 3 || match) this.grants.delete(input.pairingId);
-    if (!match) return void 0;
-    const token = secret();
-    const now = Date.now();
-    const device = {
-      id: randomUUID3(),
-      name: input.deviceName,
-      platform: input.platform,
-      createdAt: now,
-      lastSeenAt: now,
-      revokedAt: null
-    };
-    await Effect3.runPromise(this.store.saveDevice(device, digest(token)));
-    return { deviceId: device.id, deviceToken: token, serverId: this.serverId };
-  }
-  authenticate(token) {
-    if (!/^[a-f0-9]{64}$/.test(token)) return void 0;
-    return Effect3.runSync(this.store.deviceForToken(digest(token)));
-  }
-  ticket(token, path10) {
-    this.prune();
-    if (!this.authenticate(token) || this.tickets.size >= 1e4) return void 0;
-    const value = secret();
-    this.tickets.set(value, { tokenHash: digest(token), expiresAt: Date.now() + 6e4, path: path10 });
-    return value;
-  }
-  redeemTicket(value, path10, consume = true) {
-    this.prune();
-    const ticket = this.tickets.get(value);
-    if (!ticket || ticket.path !== path10) return void 0;
-    if (consume) this.tickets.delete(value);
-    return Effect3.runSync(this.store.deviceForToken(ticket.tokenHash));
-  }
-  async revoke(id) {
-    const revoked = await Effect3.runPromise(this.store.revokeDevice(id));
-    for (const [socket, owner] of this.sockets)
-      if (owner === id) socket.close(4401, "Device revoked");
-    return revoked;
-  }
-};
-async function registerSecurity(app2, security2, version, allowedOrigins2) {
-  app2.addHook("onRequest", async (request, reply) => {
-    const path10 = new URL(request.url, "http://localhost");
-    reply.header("Cache-Control", "no-store");
-    if (request.method === "OPTIONS") return;
-    if (request.headers.origin && !allowedOrigins2.includes(request.headers.origin))
-      return reply.code(403).send({ error: "Browser origin is not allowed." });
-    if (path10.pathname === "/health" || path10.pathname === "/api/auth/pair" && request.method === "POST")
-      return;
-    const authorization = request.headers.authorization ?? "";
-    const token = authorization.startsWith("Bearer ") ? authorization.slice(7) : "";
-    const asset = request.method === "GET" && /^\/api\/projects\/[^/]+\/attachments\/[^/]+\/content$/.test(path10.pathname);
-    const ticket = path10.searchParams.get("ticket");
-    path10.searchParams.delete("ticket");
-    if (!security2.authenticate(token) && !(asset && ticket && security2.redeemTicket(ticket, path10.pathname + path10.search, false)))
-      return reply.code(401).send({ error: "Pair this device with your server.", code: "UNAUTHORIZED" });
-    if (!asset && request.headers["x-agentrific-protocol"] !== String(PROTOCOL_VERSION))
-      return reply.code(409).send({
-        error: "Update your Agentrific client or server.",
-        code: "VERSION_MISMATCH",
-        protocolVersion: PROTOCOL_VERSION
-      });
-  });
-  app2.get("/health", () => ({
-    status: "ok",
-    service: "agentrific-server",
-    serverId: security2.serverId,
-    serverVersion: version,
-    protocolVersion: PROTOCOL_VERSION,
-    authentication: "pairing"
-  }));
-  app2.post("/api/auth/pair", async (request, reply) => {
-    const input = PairingRequestSchema.safeParse(request.body);
-    if (!input.success)
-      return reply.code(400).send({ error: "Enter a valid pairing payload and six-digit PIN." });
-    const result = await security2.pair(input.data, request.ip);
-    return result ?? reply.code(401).send({ error: "Pairing expired, locked, or invalid. Run agentrific pair again." });
-  });
-  app2.get("/api/auth/session", (request) => ({
-    serverId: security2.serverId,
-    device: security2.authenticate((request.headers.authorization ?? "").slice(7))
-  }));
-  app2.post("/api/auth/event-ticket", (request) => ({
-    ticket: security2.ticket((request.headers.authorization ?? "").slice(7), "/api/events")
-  }));
-  app2.post("/api/auth/asset-ticket", (request, reply) => {
-    const input = z4.object({
-      path: z4.string().regex(/^\/api\/projects\/[^/?]+\/attachments\/[^/?]+\/content(?:\?preview=1)?$/)
-    }).safeParse(request.body);
-    if (!input.success) return reply.code(400).send({ error: "Choose a valid attachment." });
-    return {
-      ticket: security2.ticket((request.headers.authorization ?? "").slice(7), input.data.path)
-    };
-  });
-}
+import { Effect as Effect4 } from "effect";
+import { z as z6 } from "zod";
+
+// src/pairing.ts
+import { z as z5 } from "zod";
+import qrcode from "qrcode-terminal";
 
 // src/control.ts
 import { createServer, createConnection } from "node:net";
 import { chmod, mkdir as mkdir2, readFile as readFile2, unlink, writeFile } from "node:fs/promises";
 import path3 from "node:path";
-import { Effect as Effect4 } from "effect";
-import { z as z5 } from "zod";
-var MaintenanceSchema = z5.object({
-  active: z5.boolean(),
-  drained: z5.boolean(),
-  blockers: z5.array(z5.string())
+import { Effect as Effect3 } from "effect";
+import { z as z4 } from "zod";
+var MaintenanceSchema = z4.object({
+  active: z4.boolean(),
+  drained: z4.boolean(),
+  blockers: z4.array(z4.string())
 });
-var ControlStatusSchema = z5.object({
-  serverId: z5.string().uuid(),
-  publicUrl: z5.string().optional(),
-  serverVersion: z5.string().optional(),
-  connectedDevices: z5.number().optional(),
-  connectedSockets: z5.number().optional(),
-  memory: z5.number().optional(),
-  activeRuns: z5.number().optional(),
+var ControlStatusSchema = z4.object({
+  serverId: z4.string().uuid(),
+  publicUrl: z4.string().optional(),
+  serverVersion: z4.string().optional(),
+  connectedDevices: z4.number().optional(),
+  connectedSockets: z4.number().optional(),
+  memory: z4.number().optional(),
+  activeRuns: z4.number().optional(),
   maintenance: MaintenanceSchema.optional()
 });
-var ControlResultSchema = z5.union([
-  z5.object({
-    pairingId: z5.string(),
-    pin: z5.string(),
-    expiresAt: z5.number(),
-    serverId: z5.string().uuid()
+var ControlResultSchema = z4.union([
+  z4.object({
+    pairingId: z4.string(),
+    pin: z4.string(),
+    expiresAt: z4.number(),
+    serverId: z4.string().uuid()
   }),
   DeviceSchema.array(),
   ControlStatusSchema,
-  z5.object({ revoked: z5.boolean() }),
+  z4.object({ revoked: z4.boolean() }),
   MaintenanceSchema
 ]);
-var ControlRequest = z5.discriminatedUnion("command", [
-  z5.object({ command: z5.literal("pair") }),
-  z5.object({ command: z5.literal("devices") }),
-  z5.object({ command: z5.literal("status") }),
-  z5.object({ command: z5.literal("revoke"), id: z5.string().uuid() }),
-  z5.object({
-    command: z5.literal("maintenance"),
-    action: z5.enum(["enter", "resume", "drain"]),
-    timeoutMs: z5.number().int().min(0).max(6e4).default(3e4)
+var ControlRequest = z4.discriminatedUnion("command", [
+  z4.object({ command: z4.literal("pair") }),
+  z4.object({ command: z4.literal("devices") }),
+  z4.object({ command: z4.literal("status") }),
+  z4.object({ command: z4.literal("revoke"), id: z4.string().uuid() }),
+  z4.object({
+    command: z4.literal("maintenance"),
+    action: z4.enum(["enter", "resume", "drain"]),
+    timeoutMs: z4.number().int().min(0).max(6e4).default(3e4)
   })
 ]);
 async function acquireServerLock(directory) {
@@ -1098,14 +985,14 @@ async function acquireServerLock(directory) {
   try {
     await writeFile(filename, String(process.pid), { flag: "wx", mode: 384 });
   } catch (cause) {
-    if (!z5.object({ code: z5.literal("EEXIST") }).safeParse(cause).success) throw cause;
+    if (!z4.object({ code: z4.literal("EEXIST") }).safeParse(cause).success) throw cause;
     const owner = Number(await readFile2(filename, "utf8"));
     if (!Number.isInteger(owner) || owner <= 0)
       throw new Error("Invalid server lock. Check the owner before removing it.");
     try {
       process.kill(owner, 0);
     } catch (error) {
-      if (!z5.object({ code: z5.literal("ESRCH") }).safeParse(error).success) throw error;
+      if (!z4.object({ code: z4.literal("ESRCH") }).safeParse(error).success) throw error;
       const recovery = `${filename}.recovery`;
       await writeFile(recovery, String(process.pid), { flag: "wx", mode: 384 }).catch(() => {
         throw new Error(
@@ -1135,7 +1022,7 @@ async function acquireServerLock(directory) {
 async function startControl(directory, security2, status, maintenance2) {
   const filename = path3.join(directory, "control.sock");
   await unlink(filename).catch((error) => {
-    if (!z5.object({ code: z5.literal("ENOENT") }).safeParse(error).success) throw error;
+    if (!z4.object({ code: z4.literal("ENOENT") }).safeParse(error).success) throw error;
   });
   const server = createServer((socket) => {
     socket.setTimeout(5e3, () => socket.destroy());
@@ -1157,7 +1044,7 @@ async function startControl(directory, security2, status, maintenance2) {
               result = security2.createPairing();
               break;
             case "devices":
-              result = await Effect4.runPromise(security2.store.devices());
+              result = await Effect3.runPromise(security2.store.devices());
               break;
             case "status":
               result = status();
@@ -1194,7 +1081,7 @@ async function startControl(directory, security2, status, maintenance2) {
 // package.json
 var package_default = {
   name: "@agentrific/server",
-  version: "0.1.5",
+  version: "0.1.6",
   description: "Self-hosted control plane for long-running coding agents",
   keywords: [
     "agentrific",
@@ -1257,6 +1144,180 @@ var package_default = {
 // src/version.ts
 var serverVersion = package_default.version;
 
+// src/pairing.ts
+function pairingOrigin(url) {
+  const endpoint = new URL(url);
+  if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.pathname !== "/")
+    throw new Error("Use the HTTPS server origin without a path or credentials.");
+  if (endpoint.protocol !== "https:" && !(process.env.NODE_ENV !== "production" && endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname)))
+    throw new Error("Use HTTPS. Localhost HTTP is for development builds only.");
+  return endpoint.origin;
+}
+
+// src/security.ts
+var secret = () => randomBytes(32).toString("hex");
+var digest = (value) => createHash("sha256").update(value).digest("hex");
+var ServerSecurity = class {
+  constructor(store2, serverId) {
+    this.store = store2;
+    this.serverId = serverId;
+  }
+  store;
+  serverId;
+  grants = /* @__PURE__ */ new Map();
+  tickets = /* @__PURE__ */ new Map();
+  attempts = /* @__PURE__ */ new Map();
+  sockets = /* @__PURE__ */ new Map();
+  prune() {
+    const now = Date.now();
+    for (const [key, grant] of this.grants) if (grant.expiresAt <= now) this.grants.delete(key);
+    for (const [key, ticket] of this.tickets) if (ticket.expiresAt <= now) this.tickets.delete(key);
+    for (const [key, attempts] of this.attempts)
+      if (attempts.until <= now) this.attempts.delete(key);
+  }
+  createPairing() {
+    this.prune();
+    if (this.grants.size >= 10)
+      throw new Error("Too many pending enrollments. Wait for them to expire.");
+    const pairingId = secret();
+    const grant = {
+      pin: String(randomInt(1e6)).padStart(6, "0"),
+      expiresAt: Date.now() + 3e5,
+      attempts: 0
+    };
+    this.grants.set(pairingId, grant);
+    return { pairingId, pin: grant.pin, expiresAt: grant.expiresAt, serverId: this.serverId };
+  }
+  async pair(input, address) {
+    this.prune();
+    const attempts = this.attempts.get(address) ?? { count: 0, until: Date.now() + 6e4 };
+    if (attempts.count >= 20 || !this.attempts.has(address) && this.attempts.size >= 5e3)
+      return void 0;
+    attempts.count++;
+    this.attempts.set(address, attempts);
+    const grant = this.grants.get(input.pairingId);
+    if (!grant) return void 0;
+    grant.attempts++;
+    const match = timingSafeEqual(Buffer.from(grant.pin), Buffer.from(input.pin));
+    if (grant.attempts >= 3 || match) this.grants.delete(input.pairingId);
+    if (!match) return void 0;
+    const token = secret();
+    const now = Date.now();
+    const device = {
+      id: randomUUID3(),
+      name: input.deviceName,
+      platform: input.platform,
+      createdAt: now,
+      lastSeenAt: now,
+      revokedAt: null
+    };
+    await Effect4.runPromise(this.store.saveDevice(device, digest(token)));
+    return { deviceId: device.id, deviceToken: token, serverId: this.serverId };
+  }
+  authenticate(token) {
+    if (!/^[a-f0-9]{64}$/.test(token)) return void 0;
+    return Effect4.runSync(this.store.deviceForToken(digest(token)));
+  }
+  ticket(token, path10) {
+    this.prune();
+    if (!this.authenticate(token) || this.tickets.size >= 1e4) return void 0;
+    const value = secret();
+    this.tickets.set(value, { tokenHash: digest(token), expiresAt: Date.now() + 6e4, path: path10 });
+    return value;
+  }
+  redeemTicket(value, path10, consume = true) {
+    this.prune();
+    const ticket = this.tickets.get(value);
+    if (!ticket || ticket.path !== path10) return void 0;
+    if (consume) this.tickets.delete(value);
+    return Effect4.runSync(this.store.deviceForToken(ticket.tokenHash));
+  }
+  async revoke(id) {
+    const revoked = await Effect4.runPromise(this.store.revokeDevice(id));
+    for (const [socket, owner] of this.sockets)
+      if (owner === id) socket.close(4401, "Device revoked");
+    return revoked;
+  }
+};
+async function registerSecurity(app2, security2, version, allowedOrigins2) {
+  app2.addHook("onRequest", async (request, reply) => {
+    const path10 = new URL(request.url, "http://localhost");
+    reply.header("Cache-Control", "no-store");
+    if (request.method === "OPTIONS") return;
+    if (request.headers.origin && !allowedOrigins2.includes(request.headers.origin))
+      return reply.code(403).send({ error: "Browser origin is not allowed." });
+    if (path10.pathname === "/health" || path10.pathname === "/api/auth/pair" && request.method === "POST")
+      return;
+    const authorization = request.headers.authorization ?? "";
+    const token = authorization.startsWith("Bearer ") ? authorization.slice(7) : "";
+    const asset = request.method === "GET" && /^\/api\/projects\/[^/]+\/attachments\/[^/]+\/content$/.test(path10.pathname);
+    const ticket = path10.searchParams.get("ticket");
+    path10.searchParams.delete("ticket");
+    if (!security2.authenticate(token) && !(asset && ticket && security2.redeemTicket(ticket, path10.pathname + path10.search, false)))
+      return reply.code(401).send({ error: "Pair this device with your server.", code: "UNAUTHORIZED" });
+    if (!asset && request.headers["x-agentrific-protocol"] !== String(PROTOCOL_VERSION))
+      return reply.code(409).send({
+        error: "Update your Agentrific client or server.",
+        code: "VERSION_MISMATCH",
+        protocolVersion: PROTOCOL_VERSION
+      });
+  });
+  app2.get("/health", () => ({
+    status: "ok",
+    service: "agentrific-server",
+    serverId: security2.serverId,
+    serverVersion: version,
+    protocolVersion: PROTOCOL_VERSION,
+    authentication: "pairing"
+  }));
+  app2.post("/api/auth/pair", async (request, reply) => {
+    const input = PairingRequestSchema.safeParse(request.body);
+    if (!input.success)
+      return reply.code(400).send({ error: "Enter a valid pairing payload and six-digit PIN." });
+    const result = await security2.pair(input.data, request.ip);
+    return result ?? reply.code(401).send({ error: "Pairing expired, locked, or invalid. Run agentrific pair again." });
+  });
+  app2.post("/api/auth/pairing-invitation", (_request, reply) => {
+    const publicUrl = process.env.AGENTRIFIC_PUBLIC_URL;
+    if (!publicUrl)
+      return reply.code(503).send({
+        error: "Configure the server\u2019s public HTTPS URL and restart the server before pairing a device."
+      });
+    let url;
+    try {
+      url = pairingOrigin(publicUrl);
+    } catch {
+      return reply.code(503).send({ error: "The server\u2019s public URL is invalid. Configure a public HTTPS origin." });
+    }
+    try {
+      const grant = security2.createPairing();
+      return {
+        payload: { v: 1, url, serverId: grant.serverId, pairingId: grant.pairingId },
+        pin: grant.pin,
+        expiresAt: grant.expiresAt
+      };
+    } catch {
+      return reply.code(429).send({ error: "Too many pending pairing codes. Wait five minutes and try again." });
+    }
+  });
+  app2.get("/api/auth/session", (request) => ({
+    serverId: security2.serverId,
+    device: security2.authenticate((request.headers.authorization ?? "").slice(7))
+  }));
+  app2.post("/api/auth/event-ticket", (request) => ({
+    ticket: security2.ticket((request.headers.authorization ?? "").slice(7), "/api/events")
+  }));
+  app2.post("/api/auth/asset-ticket", (request, reply) => {
+    const input = z6.object({
+      path: z6.string().regex(/^\/api\/projects\/[^/?]+\/attachments\/[^/?]+\/content(?:\?preview=1)?$/)
+    }).safeParse(request.body);
+    if (!input.success) return reply.code(400).send({ error: "Choose a valid attachment." });
+    return {
+      ticket: security2.ticket((request.headers.authorization ?? "").slice(7), input.data.path)
+    };
+  });
+}
+
 // src/maintenance.ts
 var MaintenanceError = class extends Error {
   statusCode = 503;
@@ -1313,10 +1374,10 @@ var Maintenance = class {
 
 // src/updates.ts
 import semver from "semver";
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 import { Effect as Effect5 } from "effect";
-var RegistryRelease = z6.object({
-  version: z6.string().refine((value) => semver.valid(value) !== null)
+var RegistryRelease = z7.object({
+  version: z7.string().refine((value) => semver.valid(value) !== null)
 });
 async function checkForUpdates() {
   const response = await fetch("https://registry.npmjs.org/@agentrific%2Fserver/latest", {
@@ -1406,7 +1467,7 @@ var UpdateDiscovery = class {
 
 // src/index.ts
 import { Effect as Effect16, ManagedRuntime } from "effect";
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 
 // src/automation.ts
 import { Effect as Effect7 } from "effect";
@@ -1911,7 +1972,7 @@ var AgentSessions = class extends Context2.Service()(
 
 // src/delivery.ts
 import { Effect as Effect9 } from "effect";
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 
 // src/workflow-command.ts
 import { execFile } from "node:child_process";
@@ -1955,12 +2016,12 @@ function workflowError(error) {
 }
 
 // src/workflow-schema.ts
-import { z as z7 } from "zod";
-var DeliveryJobSchema = z7.object({
-  kind: z7.literal("delivery"),
-  sessionId: z7.string(),
+import { z as z8 } from "zod";
+var DeliveryJobSchema = z8.object({
+  kind: z8.literal("delivery"),
+  sessionId: z8.string(),
   request: DeliveryRequestSchema,
-  phase: z7.enum([
+  phase: z8.enum([
     "validating",
     "drafting",
     "committing",
@@ -1970,25 +2031,25 @@ var DeliveryJobSchema = z7.object({
     "opening_pr",
     "delivered"
   ]),
-  attempt: z7.number().int().positive(),
-  commitSha: z7.string().optional(),
-  title: z7.string(),
-  body: z7.string(),
-  logs: z7.string().default(""),
-  failed: z7.boolean().default(false),
-  result: z7.enum(["merged", "pr_opened", "no_changes"]).optional(),
-  url: z7.string().optional(),
-  message: z7.string().optional()
+  attempt: z8.number().int().positive(),
+  commitSha: z8.string().optional(),
+  title: z8.string(),
+  body: z8.string(),
+  logs: z8.string().default(""),
+  failed: z8.boolean().default(false),
+  result: z8.enum(["merged", "pr_opened", "no_changes"]).optional(),
+  url: z8.string().optional(),
+  message: z8.string().optional()
 });
-var PreparationJobSchema = z7.object({
-  kind: z7.literal("preparation"),
-  sessionId: z7.string(),
-  projectPath: z7.string(),
+var PreparationJobSchema = z8.object({
+  kind: z8.literal("preparation"),
+  sessionId: z8.string(),
+  projectPath: z8.string(),
   input: CreateSessionSchema,
-  stage: z7.enum(["creating", "installing", "ready", "failed"]),
-  logs: z7.string().default("")
+  stage: z8.enum(["creating", "installing", "ready", "failed"]),
+  logs: z8.string().default("")
 });
-var WorkflowJobSchema = z7.discriminatedUnion("kind", [
+var WorkflowJobSchema = z8.discriminatedUnion("kind", [
   DeliveryJobSchema,
   PreparationJobSchema
 ]);
@@ -2284,11 +2345,11 @@ ${workflowError(error instanceof Error ? error : String(error))}`
             "--json",
             "url,state,headRefOid"
           ]);
-          const prs = z8.array(
-            z8.object({
-              url: z8.string().url(),
-              state: z8.string(),
-              headRefOid: z8.string().optional()
+          const prs = z9.array(
+            z9.object({
+              url: z9.string().url(),
+              state: z9.string(),
+              headRefOid: z9.string().optional()
             })
           ).parse(JSON.parse(existing));
           const open = prs.find(
@@ -2332,7 +2393,7 @@ ${workflowError(error instanceof Error ? error : String(error))}`
 import { mkdir as mkdir3, readFile as readFile3 } from "node:fs/promises";
 import path5 from "node:path";
 import { Effect as Effect10 } from "effect";
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var PreparationCoordinator = class {
   constructor(store2, options) {
     this.store = store2;
@@ -2450,7 +2511,7 @@ ${logs}` : ""}`);
       () => void 0
     );
     if (!packageFile) return;
-    const metadata = z9.object({ packageManager: z9.string().optional() }).parse(JSON.parse(packageFile));
+    const metadata = z10.object({ packageManager: z10.string().optional() }).parse(JSON.parse(packageFile));
     const has = async (name) => readFile3(path5.join(workspace, name)).then(
       () => true,
       () => false
@@ -2532,8 +2593,8 @@ ${logs}` : ""}`);
 
 // src/delivery-writer.ts
 import { createAgentSession, SessionManager } from "@earendil-works/pi-coding-agent";
-import { z as z10 } from "zod";
-var DraftSchema = z10.object({ title: z10.string().trim().min(1).max(120), body: z10.string().trim().min(1).max(1e4) }).strict();
+import { z as z11 } from "zod";
+var DraftSchema = z11.object({ title: z11.string().trim().min(1).max(120), body: z11.string().trim().min(1).max(1e4) }).strict();
 function deliveryWriter(models2, createSession = createAgentSession) {
   return async (run, input, diff, signal) => {
     signal?.throwIfAborted();
@@ -2688,7 +2749,7 @@ import {
   createAgentSession as createAgentSession2,
   SessionManager as SessionManager2
 } from "@earendil-works/pi-coding-agent";
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 
 // src/delivery-tool.ts
 import { defineTool } from "@earendil-works/pi-coding-agent";
@@ -2723,8 +2784,8 @@ function deliveryTool(sessionId, delivery2) {
 }
 
 // src/pi.ts
-var ToolResultSchema = z11.object({
-  content: z11.array(z11.object({ type: z11.string(), text: z11.string().optional() })).optional()
+var ToolResultSchema = z12.object({
+  content: z12.array(z12.object({ type: z12.string(), text: z12.string().optional() })).optional()
 }).passthrough();
 var boundedJson = (value, limit) => {
   let text;
@@ -2890,7 +2951,7 @@ function createPiFactory(files, models2, delivery2, createSession = createAgentS
 // src/projects.ts
 import { access, readdir as readdir2, realpath, stat as stat2, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 import { constants } from "node:fs";
 import { homedir } from "node:os";
 import path6 from "node:path";
@@ -2922,7 +2983,7 @@ function projectLock(store2) {
   }
   return lock;
 }
-var ProjectId = z12.string().trim().min(1).max(255);
+var ProjectId = z13.string().trim().min(1).max(255);
 async function gitDirectory(directory) {
   const location = path6.join(directory, ".git");
   const info = await stat2(location);
@@ -2939,10 +3000,10 @@ async function identity(directory, preferred) {
   try {
     return ProjectId.parse(await readFile4(filename, "utf8"));
   } catch (error) {
-    if (!z12.object({ code: z12.literal("ENOENT") }).safeParse(error).success) throw error;
+    if (!z13.object({ code: z13.literal("ENOENT") }).safeParse(error).success) throw error;
     const legacyFilename = path6.join(await gitDirectory(directory), "chatplans-project-id");
     const legacy = await readFile4(legacyFilename, "utf8").catch((cause) => {
-      if (!z12.object({ code: z12.literal("ENOENT") }).safeParse(cause).success) throw cause;
+      if (!z13.object({ code: z13.literal("ENOENT") }).safeParse(cause).success) throw cause;
       return null;
     });
     const id = legacy === null ? preferred ?? randomUUID6() : ProjectId.parse(legacy);
@@ -2950,7 +3011,7 @@ async function identity(directory, preferred) {
       await writeFile2(filename, id + "\n", { flag: "wx" });
       return id;
     } catch (writeError) {
-      if (!z12.object({ code: z12.literal("EEXIST") }).safeParse(writeError).success) throw writeError;
+      if (!z13.object({ code: z13.literal("EEXIST") }).safeParse(writeError).success) throw writeError;
       return ProjectId.parse(await readFile4(filename, "utf8"));
     }
   }
@@ -3028,32 +3089,32 @@ import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "n
 import path7 from "node:path";
 
 // src/push-schema.ts
-import { z as z13 } from "zod";
-var PushBindingSchema = z13.object({
-  bindingId: z13.string().uuid(),
-  installationId: z13.string().uuid(),
-  deviceId: z13.string().uuid()
+import { z as z14 } from "zod";
+var PushBindingSchema = z14.object({
+  bindingId: z14.string().uuid(),
+  installationId: z14.string().uuid(),
+  deviceId: z14.string().uuid()
 });
-var PushStateSchema = z13.object({
-  bindings: z13.array(PushBindingSchema).max(10),
-  error: z13.string().nullable()
+var PushStateSchema = z14.object({
+  bindings: z14.array(PushBindingSchema).max(10),
+  error: z14.string().nullable()
 });
 var PendingPushSchema = PushEventSchema.extend({
-  remaining: z13.array(PushBindingSchema),
-  createdAt: z13.number(),
-  attempts: z13.number().int().nonnegative(),
-  nextAt: z13.number()
+  remaining: z14.array(PushBindingSchema),
+  createdAt: z14.number(),
+  attempts: z14.number().int().nonnegative(),
+  nextAt: z14.number()
 });
 
 // src/store.ts
 import { DatabaseSync } from "node:sqlite";
 import { Context as Context3, Data as Data3, Effect as Effect14, Layer as Layer3 } from "effect";
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 import { randomUUID as randomUUID7 } from "node:crypto";
 var StorageError = class extends Data3.TaggedError("StorageError") {
 };
-var PayloadRow = z14.object({ payload: z14.string() });
-var EventRow = z14.object({ sequence: z14.number(), recorded_at: z14.string(), payload: z14.string() });
+var PayloadRow = z15.object({ payload: z15.string() });
+var EventRow = z15.object({ sequence: z15.number(), recorded_at: z15.string(), payload: z15.string() });
 var SqliteSessionStore = class {
   constructor(db) {
     this.db = db;
@@ -3104,7 +3165,7 @@ var SqliteSessionStore = class {
       const row = PayloadRow.parse(
         this.db.prepare("SELECT payload FROM settings WHERE id = 'server-id'").get()
       );
-      return z14.string().uuid().parse(JSON.parse(row.payload));
+      return z15.string().uuid().parse(JSON.parse(row.payload));
     });
   }
   saveDevice(device, tokenHash) {
@@ -3192,7 +3253,7 @@ var SqliteSessionStore = class {
       `).all();
       const insert = this.db.prepare("INSERT OR IGNORE INTO projects(id, payload) VALUES (?, ?)");
       for (const row of legacy) {
-        const id = z14.object({ id: z14.string() }).parse(row).id;
+        const id = z15.object({ id: z15.string() }).parse(row).id;
         insert.run(
           id,
           JSON.stringify({ id, name: id, path: path7.join(root, id), available: false })
@@ -3402,7 +3463,7 @@ var SqliteSessionStore = class {
         if (event.type === "message.user") this.claimAttachments(event.attachments ?? []);
         const result = this.db.prepare("INSERT INTO events(session_id, recorded_at, payload) VALUES (?, ?, ?)").run(sessionId, recordedAt, JSON.stringify(event));
         if (notification) {
-          const count = z14.object({ total: z14.number() }).parse(this.db.prepare("SELECT COUNT(*) AS total FROM push_outbox").get());
+          const count = z15.object({ total: z15.number() }).parse(this.db.prepare("SELECT COUNT(*) AS total FROM push_outbox").get());
           if (count.total >= 1e3)
             this.db.prepare(
               "DELETE FROM push_outbox WHERE rowid IN (SELECT rowid FROM push_outbox ORDER BY rowid LIMIT 1)"
@@ -3454,7 +3515,7 @@ var SessionStore = class extends Context3.Service()(
             for (const suffix of ["-wal", "-shm"])
               if (existsSync2(filename + suffix)) chmodSync(filename + suffix, 384);
             try {
-              const schema = z14.object({ user_version: z14.number() }).parse(db.prepare("PRAGMA user_version").get());
+              const schema = z15.object({ user_version: z15.number() }).parse(db.prepare("PRAGMA user_version").get());
               if (schema.user_version > 1)
                 throw new Error("This database requires a newer Agentrific server.");
               db.exec(`
@@ -3583,9 +3644,13 @@ var releaseLock = await acquireServerLock(dataRoot);
 var effects = ManagedRuntime.make(SessionStore.layer(path9.join(dataRoot, "sessions.sqlite")));
 var store = await effects.runPromise(SessionStore);
 var security = new ServerSecurity(store, await Effect16.runPromise(store.serverIdentity()));
-var push = new ServerPush(store, security.serverId, dataRoot);
+var testPushUrl = process.env.AGENTRIFIC_PUSH_TEST_URL;
+if (testPushUrl && (process.env.AGENTRIFIC_TEST_MODE !== "1" || !new URL(testPushUrl).hostname.endsWith(".ts.net") || new URL(testPushUrl).protocol !== "https:"))
+  throw new Error("Test relay requires explicit test mode and Tailscale HTTPS.");
+var push = new ServerPush(store, security.serverId, dataRoot, fetch, testPushUrl);
 var allowedOrigins = [
   .../* @__PURE__ */ new Set([
+    "agentrific-desktop://app",
     ...(process.env.AGENTRIFIC_ALLOWED_ORIGINS ?? "http://localhost:8081,http://127.0.0.1:8081").split(","),
     `http://${host === "::1" ? "[::1]" : host}:${port}`,
     ...process.env.AGENTRIFIC_PUBLIC_URL ? [new URL(process.env.AGENTRIFIC_PUBLIC_URL).origin] : []
@@ -3840,7 +3905,7 @@ app.get("/api/projects/:id", async (request, reply) => {
   return project ?? reply.code(404).send({ error: "Project not found on this server." });
 });
 app.post("/api/projects/:id/reconnect", async (request, reply) => {
-  const parsed = z15.object({ path: z15.string().trim().min(1).max(4096) }).safeParse(request.body);
+  const parsed = z16.object({ path: z16.string().trim().min(1).max(4096) }).safeParse(request.body);
   if (!parsed.success)
     return reply.code(400).send({ error: "Enter the project's new folder path." });
   const root = await Effect16.runPromise(store.projectsRoot(defaultProjectsRoot));
@@ -3972,9 +4037,9 @@ app.post(
     }
   })
 );
-var HistoryQuery = z15.object({
-  after: z15.coerce.number().int().nonnegative().default(0),
-  limit: z15.coerce.number().int().min(1).max(1e3).default(500)
+var HistoryQuery = z16.object({
+  after: z16.coerce.number().int().nonnegative().default(0),
+  limit: z16.coerce.number().int().min(1).max(1e3).default(500)
 });
 app.get("/api/sessions/:id/events", async (request, reply) => {
   const query = HistoryQuery.safeParse(request.query);
@@ -4116,7 +4181,7 @@ app.post("/api/sessions", async (request, reply) => {
   if (!result.session) return reply.code(result.status).send({ error: result.error });
   return reply.code(201).send(result.session);
 });
-var StartTaskBody = z15.object({ prompt: z15.string().trim().max(2e4).optional() }).default({});
+var StartTaskBody = z16.object({ prompt: z16.string().trim().max(2e4).optional() }).default({});
 function startTask(id, instructionsOverride, automated = false) {
   return withTaskLock(
     "agent-dispatch",
@@ -4194,7 +4259,7 @@ app.patch("/api/automation", async (request, reply) => {
   return automation.configure(parsed.data);
 });
 app.patch("/api/automation/queue", async (request, reply) => {
-  const parsed = z15.object({ taskId: z15.string().min(1), beforeId: z15.string().min(1).nullable() }).safeParse(request.body);
+  const parsed = z16.object({ taskId: z16.string().min(1), beforeId: z16.string().min(1).nullable() }).safeParse(request.body);
   if (!parsed.success)
     return reply.code(400).send({ error: "Choose a task and a queue position." });
   try {