@agimon-ai/doompi-web 0.0.1-alpha.0 → 0.0.1-alpha.10

package/README.md

@@ -1,22 +1,18 @@
 # @agimon-ai/doompi-web
 
-Web cockpit for DoomPi: a multi-session hub that serves the browser console, discovers every
-running [doompi-server](https://www.npmjs.com/package/@agimon-ai/doompi-server) through the session
-registry, and multiplexes their authenticated sockets behind one page connection
+Web cockpit for DoomPi. It discovers running [doompi-server](https://www.npmjs.com/package/@agimon-ai/doompi-server) sessions, multiplexes their authenticated sockets, and serves them through one browser connection.
 
 This package is a composable [DoomPi](https://www.npmjs.com/package/@agimon-ai/doompi) subsystem.
 It registers no Pi extension and adds nothing to an interactive session.
 
-## Enabling it
+## How it runs
 
-This package is still in development, so `doompi init` does not reference it and there is nothing
-to add to `.doom/modes.yaml`. It is a standalone executable you run yourself, as shown under Run
-below, or the process `doompi-server --web` starts for you.
+`doompi-web` is a standalone process, not a Pi extension. Do not add it to `.doom/modes.yaml`. Run it directly, or start it through `doompi-server --web`.
 
 ## Requirements
 
 - Node.js 22.19.0 or newer
-- Running `doompi-server` processes registering their session sockets
+- `doompi-server` sessions to attach to. The cockpit can start them itself.
 
 ## Install
 
@@ -30,37 +26,33 @@ npm install -g @agimon-ai/doompi-web
 doompi-web
 ```
 
-Then open `http://127.0.0.1:7433`. That is the whole command: no flag is required, and every one
-below is an override. `doompi-web` is the hub. It watches the session registry (`~/.doompi/run` by
-default), attaches to every registered session, shows them all in the rail, and can start new ones
-from the page. Sessions it starts run the `doompi-server` and the agent from this installation, so
-the cockpit and the sessions it creates are always the same build.
+Open `http://127.0.0.1:7433`. With no flags, the hub watches `~/.doompi/run`, attaches to registered sessions, and resolves the union of their synchronized cockpit compositions from `~/.pi/.doom/sync/registrations`. The directory that launches `doompi-web` does not select the bundle. Sessions started by the cockpit use the server and agent from the same installation.
 
-Running it twice is not an error. The second one finds the first over the port, prints its URL, and
-exits, because one hub already serves every session.
+If `~/.pi/.doom` does not exist, the command runs its bundled `doompi init` before starting. If a hub already answers on the port, a second `doompi-web` process prints its URL and exits.
 
-Working on this repository, one command builds what it needs and starts it:
+To run this repository's build with its composition pinned and watched:
 
 ```bash
-pnpm cockpit
+pnpm cockpit:build
+pnpm doompi-web --dir=<PWD>
 ```
 
-Nx caches the build, so a warm run is effectively just the hub. Sessions created from the page run
-this checkout's builds, which matters: a session on some other `doompi` is a different composition,
-and its extensions, commands, and minor modes are not the ones being edited here, so a change looks
-like it did nothing.
+`--dir` accepts `--dir <path>` too. It synchronizes that repository before launch and watches it for development rebuilds.
 
-| Flag              | Default         | Meaning                                          |
-| ----------------- | --------------- | ------------------------------------------------ |
-| `--registry-dir`  | `~/.doompi/run` | Registry to watch (also `DOOMPI_RUNTIME_DIR`)    |
-| `--spawn-command` | this install    | Command launching sessions created from the page |
-| `--port`          | `7433`          | HTTP port                                        |
-| `--host`          | `127.0.0.1`     | Bind address                                     |
-| `--assets`        | bundled         | Override the built SPA directory                 |
+| Flag              | Default                  | Meaning                                          |
+| ----------------- | ------------------------ | ------------------------------------------------ |
+| `--dir`           | live-session union       | Pin, sync, and watch one repository composition  |
+| `--registry-dir`  | `~/.doompi/run`          | Registry to watch (also `DOOMPI_RUNTIME_DIR`)    |
+| `--spawn-command` | this install             | Command launching sessions created from the page |
+| `--port`          | `7433`                   | HTTP port                                        |
+| `--host`          | `127.0.0.1`              | Bind address                                     |
+| `--assets`        | synchronized or packaged | Override the built SPA directory                 |
+| `--state-dir`     | `~/.doompi/web`          | Remote-access settings and cockpit cache         |
+| `--cloudflared`   | from `PATH`              | Tunnel binary (also `DOOMPI_CLOUDFLARED`)        |
+| `-h`, `--help`    |                          | Print command help                               |
+| `-v`, `--version` |                          | Print the installed package version              |
 
-Installing this package gives you `doompi-web` and nothing else. For a session server you run
-yourself, install [doompi-server](https://www.npmjs.com/package/@agimon-ai/doompi-server); the hub
-does not need it on PATH to create sessions.
+Install [doompi-server](https://www.npmjs.com/package/@agimon-ai/doompi-server) when you also want to run a session server directly. The hub does not require `doompi-server` on `PATH` to create sessions.
 
 ## Security
 
@@ -69,6 +61,24 @@ browser. The server binds loopback by default, so reaching the cockpit already m
 account on the machine. Remote access means tunnelling the port, for example over SSH; do not bind
 a public address and call it done.
 
+Loopback binding is not on its own an authorization boundary, because two request shapes escape it
+and both reach code execution:
+
+- **WebSockets are exempt from CORS.** Any page in any browser on this machine can open a socket to
+  the cockpit's port, and `session_command` frames carry prompts straight to an agent holding a
+  `bash` tool.
+- **A cross-origin POST need not be preflighted.** Sent as `text/plain`, it still parses as JSON
+  server-side, so a page could spawn a session in any directory without ever reading a response.
+
+Both are refused. Every request and every socket upgrade is checked against an origin and host
+allowlist derived from the port actually bound, plus the vite dev server. A request carrying no
+`Origin` is allowed, because curl, the health probe, and the test harness send none and a browser
+always sends one where it matters; this defends against a hostile web page, not against a hostile
+local program, which can send whatever headers it likes. `DOOMPI_WEB_ALLOW_ORIGIN` takes a
+comma-separated list for setups this package cannot guess. The host check is also the DNS rebinding
+defence, and it is the only check a socket upgrade gets, since the upgrade path never reaches the
+server's own host parsing.
+
 ## What the cockpit shows
 
 Everything comes from Pi's RPC protocol, so a bare Pi session and a DoomPi session both work and
@@ -85,13 +95,17 @@ neither is shown facts it did not report:
   usage, cost, and session identity.
 - **Dialogs:** the extension UI sub-protocol (`select`, `confirm`, `input`, `editor`), which is how
   a permission prompt reaches the browser. Cancelling answers the agent rather than stranding it.
+- **Notifications:** live `doom-notification` entries from every attached session, including sessions
+  that are not focused. Browser permission is requested only after the user clicks **allow notifications**
+  in Settings. Replayed backlog and historical pages update the timeline but never notify.
 - **Leader Space:** `ctrl+k`, `ctrl+space`, or space in an empty composer. Keys walk the tree the
   installed web plugins declared (`SPC w r` opens the workflows tab, `SPC g e` toggles goal mode),
   backspace climbs, and `/` searches whatever `get_commands` reported to run it as a slash prompt.
-- **Settings:** the gear at the foot of the rail opens the settings pages. The providers page lists
-  every model provider Pi knows with whether it is authenticated, signs in with an API key or OAuth
-  through the hub, and signs out. The hub uses the same `auth.json` as the sessions, so a login
-  here is a login for every session on the machine.
+- **Settings:** the gear at the foot of the rail opens the settings pages. Notifications shows this
+  browser's permission and provides the user-click permission action. Providers lists every model
+  provider Pi knows with whether it is authenticated, signs in with an API key or OAuth through the
+  hub, and signs out. The hub uses the same `auth.json` as the sessions, so a login here is a login for
+  every session on the machine.
 
 ## Attach and reattach
 
@@ -110,6 +124,205 @@ perform the handshake itself: `attach` frames sent from the browser are refused.
   them.
 - Subagent, workflow, and runner surfaces report summaries only; per-run detail has no RPC source
   to render from yet.
+- Open pages show full live browser notifications. An installed paired PWA can also receive a generic
+  zero-TTL Web Push alert while closed. There is no durable subscription database, outbox, replay, or
+  historical delivery.
+
+## iPhone Home Screen app
+
+Use a stable named HTTPS tunnel such as `doompi.agimon.win`. Quick-tunnel hostnames rotate, so they cannot
+provide durable PWA identity, passkeys, or reliable Push subscriptions. Open `/pair` in Safari, add it to the
+Home Screen, then launch the installed app and scan the QR shown by the host.
+
+The install shell, scanner, manifest, and verifier worker are package-owned. The QR pins the host signing key
+and minimum bundle revision. The worker verifies every host and plugin asset before committing it to the
+active cache, and the host never serves its SPA directly. A failed update keeps the last-known-good bundle.
+Signer loss, signer rotation, or a host/container transition requires explicit fingerprint confirmation and
+re-pairing. Session file previews remain sealed `no-store` HTTP Blob URLs and never enter the application
+cache, IndexedDB, a signed manifest, or a Push payload.
+
+Closed-app alerts are opt-in under settings. The server keeps subscriptions only in memory and sends fixed
+generic copy with `TTL: 0` only when the device has no connected cockpit socket. Opening the app after a host
+restart re-registers the browser subscription. Disabling alerts, revoking or expiring the device, switching
+off remote access, or rotating process credentials removes it.
+
+## Remote access
+
+Working from a phone means putting the cockpit on the internet, and the cockpit's socket carries
+prompts to an agent holding a `bash` tool. Reaching it is therefore equivalent to a shell on this
+machine, and the whole design follows from that.
+
+Switching it on binds a **second loopback listener** on an ephemeral port and points `cloudflared`
+at it. Port 7433 is untouched, so working at the keyboard is exactly as before, while everything
+arriving on the tunnel listener has to prove it holds a paired session. The two listeners are the
+mechanism, not an implementation detail: a tunnel connects from `127.0.0.1` like every local client,
+so the socket a connection arrived on is the only thing about it that cannot be forged.
+
+Pairing takes **two** things, not one:
+
+1. The host shows a QR encoding `https://<tunnel-host>/pair#c=<code>&k=<channel-key>&s=<signer>&r=<revision>`.
+   Every value rides in the URL fragment, which no browser sends to a server, so the relay cannot replace the
+   channel or bundle key without changing what was shown on the host. Manual pairing requires comparing the
+   signing-key fingerprint shown on both devices.
+2. Scanning raises an approve or deny prompt **on the host**. Nothing is paired until someone at the machine
+   answers. A screen is visible over a shoulder and in a screenshare, so the code alone is one factor for a
+   credential that ends in shell access.
+
+A paired device then has the same powers as the person at the keyboard, with one exception: it
+cannot mint pairing codes, approve devices, or change these settings. A device able to approve
+devices could make its own access permanent, which is precisely what host confirmation prevents.
+Turning remote access off and revoking a device are allowed remotely, because a panic button is
+worth more from the couch than from the desk.
+
+Two optional time limits, both **off by default** and both in the dialog:
+
+- Close the tunnel automatically, after 60 minutes.
+- Expire paired sessions, after 30 minutes idle or 12 hours total.
+
+Either switch takes effect retroactively in both directions, because expiry is evaluated against the
+setting in force at the moment of the check rather than stamped onto a session when it was made.
+Turning expiry on therefore drops sessions that are already idle, and turning it off brings them
+back.
+
+With both off, a paired device keeps its session until it is revoked, remote access is switched off, or
+the hub restarts. Switching remote access off always revokes every paired session, and that is not a
+toggle.
+
+Before reporting success, the tunnel is **self-tested through its own public URL**: the pairing page
+must answer 200 and `/api/health` must answer 401. Anything else means the agent is on the public
+internet unguarded, so the tunnel is killed immediately rather than warned about.
+
+Requires `cloudflared` on `PATH` (`brew install cloudflared`). A quick tunnel needs no account but gets a new
+hostname on every start. It does not provide a durable PWA, passkey, or Push identity, and Cloudflare does not
+support SSE on quick tunnels, which breaks workflow and runner-log plugin surfaces. Use a stable named tunnel
+for the Home Screen app.
+
+If a named tunnel's connector exits unexpectedly, the hub makes three backoff restart attempts and
+self-tests every replacement. The existing listener and paired sessions stay valid while recovery is
+in progress. A quick tunnel cannot recover transparently because its origin changes, so it still fails
+closed immediately. Exhausting named-tunnel recovery also switches remote access off and revokes the
+paired sessions.
+
+### Passkeys and step-up
+
+On a named tunnel, a device can enrol a passkey once and then sign in with a gesture instead of
+another QR. Two actions need a fresh gesture even from a live session: writing or clearing a model
+provider's credential, and spawning a session in a directory of the caller's choosing. Both are
+escalation paths out of "drive the agent" and into "own the machine". Ordinary prompting and tool
+approval are deliberately ungated, because a biometric check in that loop gets trained away in a day.
+
+A quick tunnel cannot carry a passkey: `rpID` is bound to the hostname and a quick tunnel's rotates
+on every start, so a credential enrolled today would silently stop working tomorrow. The cockpit says
+so rather than letting the ceremony fail in the browser.
+
+### Tunnel-provider trust and payload privacy
+
+Cloudflare terminates TLS and delivers the package-owned pairing and verifier bootstrap. A browser cannot
+independently authenticate that first executable shell against the same edge that served it: a malicious
+replacement could omit the worker and steal a QR fragment. DoomPi does not claim protection from a malicious
+code-delivery edge.
+
+After that bootstrap, **bundle signing is mandatory**. The QR pins the host ECDSA key and revision floor. The
+worker verifies the signed manifest plus every raw asset before any host JavaScript executes, serves only the
+atomically committed verified cache, and retains the last-known-good revision on failure. Cloudflare may
+alter the raw bytes, but altered bytes do not execute.
+
+**The payload is also sealed.** A QR carries an ephemeral P-256 public key in the fragment. A returning
+passkey device restores its channel only after the pinned bundle worker accepts the same signer. Both paths
+complete ECDH and derive separate AES-256-GCM keys per direction. Socket frames and API bodies travel as
+ciphertext.
+
+The channel implementation lives in `@agimon-ai/doompi-web-security`, which ships the envelope contract,
+a `node:crypto` half, and a WebCrypto half. **A web plugin that calls `fetch` directly sends plaintext to
+the relay**, so plugins use `sealedTransport.fetch` from that package's `./browser` subpath. The host
+cannot enforce this, which is why the import allowlist admits the helper and why it is said here.
+
+Cloudflare can still observe the served page and assets, timing, message sizes, connection patterns, and
+tunnel metadata. Do not enable this transport if Cloudflare is outside your trust boundary. Protect a
+named-tunnel account with a passkey or hardware MFA.
+
+### What a paired device may browse
+
+While a tunnel is up, the new-session picker answers a request arriving on it from one subtree only:
+the directory `doompi-web` was started in. Unpinned, that route hands a paired device a map of the
+machine, every project and client name and checkout, which is worth more to an attacker than most of
+what the cockpit shows.
+
+Only that request is pinned. The person at the keyboard already has a shell, so pinning them would
+cost the picker its usefulness and buy nothing, and a contained cockpit needs none of it because its
+mounts are already the boundary.
+
+Session creation itself is not narrowed by this. `POST /api/sessions` still accepts any absolute path
+a caller already knows, which is why the container below exists: it is the boundary, this is only the
+end of casual enumeration.
+
+### Running the cockpit in a container
+
+Off by default. A second switch in the same dialog moves the whole cockpit into a container when
+remote access is turned on: the hub, every session server it spawns, every agent, and `cloudflared`
+itself. This is the answer to the blunt fact that a paired device drives an agent holding a shell,
+which every layer above narrows access to but none of them contains.
+
+The list of workspaces is the boundary, and it is the only thing on the host the container can see.
+A hub inside the container cannot create a session in a path that is not mounted, so spawning in an
+arbitrary directory is closed by construction rather than by a check. Not mounted, and deliberately
+so: your home directory, `~/.ssh`, `~/.gitconfig`, the container socket, and every repository you
+did not list.
+
+What happens when you turn it on:
+
+1. The image is built if this DoomPi version has not built it before, which takes minutes the first
+   time. Progress is printed in the terminal that started the cockpit.
+2. The host cockpit answers the request, then stops serving and releases its port.
+3. The container starts, publishing the same port on loopback, and becomes the cockpit. Your browser
+   reconnects on its own; there is no new address to remember.
+4. Sessions working inside a mounted workspace are stopped on the host and recreated inside. Sessions
+   working anywhere else are named in the terminal and stay on the host, where the contained cockpit
+   cannot see them.
+
+If the container fails to start, the host cockpit comes back and its sessions are recreated there, so
+a failed move never leaves you with nothing listening. `Ctrl-C` stops the container. A cockpit killed
+outright leaves the container running; the next start finds it through `~/.doompi/web/cockpit-container.json`
+and stops it.
+
+Two things carry across the boundary and nothing else does. Provider credentials go through the
+existing broker, which hands the container a per-session token rather than your keys. Git identity is
+passed as `GIT_AUTHOR_*` and `GIT_COMMITTER_*`, so an agent can commit but cannot push, because no
+key crosses.
+
+What this does not defend against, stated plainly: anyone who can talk to the container daemon can
+escape any container it runs, so the engine is part of the trusted base. Sessions share one container
+and can read each other's mounted workspaces. A mounted workspace is fully writable, so the agent can
+still destroy the repository you gave it. Network access is unrestricted, exactly as it already is for
+`doompi --sandbox`. And plugin tabs fall back to the built-in set until a bundle is synced inside.
+
+Requires `@agimon-ai/doompi-sandbox` in the composition and a container engine on the host.
+
+## Planned: WebRTC transport
+
+Today the page reaches the hub over two WebSockets, and any remote access means putting a tunnel in
+front of them, which puts the tunnel provider in the path of everything. A WebRTC data channel would
+replace that, with the tunnel demoted to carrying signaling only. Two independent reasons want it,
+and the first is the stronger.
+
+**Realtime voice.** `@agimon-ai/doompi-voice` now captures on the selected browser client, sends
+mono PCM16 through its authenticated session media transport, keeps VAD and Whisper on the agent
+host, and plays narration with browser speech synthesis. Voice activation is when the page asks for
+microphone permission, never on load. A future WebRTC implementation can replace the HTTP media
+adapter with Opus tracks while preserving the same client device and transport contracts.
+
+**Confidentiality.** A QR shown on the host can carry the DTLS fingerprint, which authenticates the
+peer connection out-of-band. The data path is then peer-to-peer DTLS: the tunnel provider usually
+never carries the traffic and can never read it. That is close to VPN-grade confidentiality without
+asking anyone to install a VPN.
+
+The cost is real and worth stating: a WebRTC stack on the Node side (`node-datachannel` or
+`werift`), a second client transport alongside `wsClient.ts` and `piTransport.ts`, ICE and NAT
+traversal debugging, and a TURN relay fallback for the connections that cannot go direct. TURN
+reintroduces a relay, though still one that cannot decrypt. The WebSocket transport stays as the
+fallback for when a data channel cannot be established.
+
+No date. This is a design note, not a commitment.
 
 ## Public API
 
@@ -159,14 +372,17 @@ package declares a `doompiWeb` block in its package.json naming a client entry (
 definition: tab, panel, badge, session data channels, tool renderers for the timeline cards of
 the tools the package registers, slots it opens for other plugins, fills into slots others open,
 and the host's own slot contributions) and an optional hub entry (`webHubChannels` plus its built
-dist). This package's own bundle carries no plugins; the full set is assembled on your machine:
-`doompi sync` discovers the installed composition's manifests, generates the import entries, and
-rebuilds the SPA through the `./bundler` subpath into `~/.doompi/web/current`, which the server
-prefers over the packaged bundle (`--assets` and `DOOMPI_WEB_DIST` override it). The synced bundle
-carries `webPlugins.server.json` naming each plugin's built hub entry, imported lazily: a missing
-plugin package logs a notice and its tab shows an empty state. The subagents tab in
-`@agimon-ai/doompi-team` is the reference plugin; the workflows tab ships with
-`@agimon-ai/doompi-workflow`. Contracts come from `@agimon-ai/doompi-web-contracts`.
+dist). This package's own bundle carries no plugins; the full set is assembled on your machine.
+`doompi sync` discovers the installed composition's manifests, generates the import entries, and builds
+the SPA through the `./bundler` subpath inside the repository/worktree's immutable sync generation.
+The shared server uses the validated registration for its startup repository. `--assets` and
+`DOOMPI_WEB_DIST` override registered assets, then packaged assets provide the fallback. Server-only
+`webPlugins.server.json` sits beside the public `web/` directory, never inside the signed or served
+bundle. It names each plugin's built hub entry, imported lazily. A missing plugin package logs a notice
+and its tab is omitted. Session package API routes use the session `cwd` registration, while
+`DOOMPI_API_DIR` remains the explicit API override. `@agimon-ai/doompi-team` is the reference plugin;
+the workflows tab ships with `@agimon-ai/doompi-workflow`. Contracts come from
+`@agimon-ai/doompi-web-contracts`.
 
 A tool call's timeline item belongs to the plugin that registers the tool: its `toolRenderers`
 entry names the tool (or claims it with `matches` when the name is only known at runtime) and
@@ -180,7 +396,8 @@ Plugins are independent. A manifest names no other plugin and `registrationOrder
 optional tiebreak (default 1000, then plugin id): every relation between two plugins resolves by
 name once all of them are installed. A plugin opens slots named `<pluginId>.<name>` and renders
 them with the `renderSlot` and `slotData` props its components receive; any plugin fills them, and
-the host's `overlay`, `rail`, `selection-bar`, `activity`, and `activity.<group>` slots, without
+the host's `overlay`, `rail`, `selection-bar`, `composer-actions`, `activity`, and
+`activity.<group>` slots, without
 knowing whether the owner is installed. A fill into a slot nobody declares, or two plugins wanting
 one tab id, tool name, group name, or Leader Space leaf, never fails the page: the install resolves
 it (the first plugin keeps a shared name, a later binding takes a leaf over as the TUI documents)

package/dist/bin/serve.cjs

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-const e=require("../_virtual/_rolldown/runtime.cjs"),t=require("../src/services/registryStore.cjs"),n=require("../src/adapters/httpServer.cjs"),r=require("../src/services/serveOptions.cjs"),i=require("../src/adapters/hubProbe.cjs");let a=require("node:os");a=e.__toESM(a,1);function o(e){process.stderr.write(`[doompi-web] ${e}\n`)}async function s(){let e=r.parseServeOptions(process.argv.slice(2)),s=`http://${e.host}:${String(e.port)}`;if(await i.hubAnswers(e.host,e.port)){o(`cockpit already running at ${s}`);return}let c;try{c=await n.serveWeb({port:e.port,host:e.host,assetsDir:e.assetsDir,registryDir:t.resolveRegistryDir({flagValue:e.registryDir,envValue:process.env[t.REGISTRY_DIR_ENV],homeDir:a.default.homedir()}),spawnCommand:e.spawnCommand,onNotice:o})}catch(t){if(t.code!==`EADDRINUSE`)throw t;if(await i.hubAnswers(e.host,e.port)){o(`cockpit already running at ${s}`);return}throw Error(`Port ${String(e.port)} is taken by something that is not a DoomPi cockpit; pass --port.`)}let l=()=>{c.close().then(()=>{process.exit(0)})};process.on(`SIGINT`,l),process.on(`SIGTERM`,l)}s().catch(e=>{o(e instanceof Error?e.message:String(e)),process.exitCode=1});
+const e=require("../_virtual/_rolldown/runtime.cjs"),t=require("../src/services/registryStore.cjs"),n=require("../src/adapters/remoteAccessStore.cjs"),r=require("../src/adapters/httpServer.cjs"),i=require("../src/services/serveOptions.cjs"),a=require("../src/adapters/cockpitContainer.cjs"),o=require("../src/adapters/cockpitHandoff.cjs"),s=require("../src/adapters/doomInitialization.cjs"),c=require("../src/adapters/hubProbe.cjs"),l=require("../src/adapters/sessionRelaunch.cjs");let u=require("node:os");u=e.__toESM(u,1);function d(e){process.stderr.write(`[doompi-web] ${e}\n`)}async function f(e,t,n){try{process.kill(e,`SIGTERM`)}catch{}let r=Date.now()+1e4;for(;Date.now()<r;)if(await new Promise(e=>setTimeout(e,100)),!await c.hubAnswers(t,n))return!0;return!1}async function p(){let e=i.parseServeOptions(process.argv.slice(2));if(e.help){process.stdout.write(i.serveHelp());return}if(e.version){process.stdout.write(`${r.packagedVersion()}\n`);return}await s.ensureDoomInitialized({homeDirectory:u.default.homedir(),onNotice:d});let o=`http://${e.host}:${String(e.port)}`,l=e.stateDir??n.defaultRemoteStateDir(),p=a.createCockpitContainer({stateDir:l,onNotice:d});await p.reapStale(),i.isLoopbackHost(e.host)||(d(`WARNING: --host ${e.host} is not loopback, so the cockpit is reachable without pairing.`),d(`WARNING: turn on remote access in settings instead, which requires a paired device.`));let h=await c.probeHub(e.host,e.port);if(h!==void 0){let t=r.packagedVersion(),n=h.version??`an older build`;if(h.version===t){d(`cockpit already running at ${o}`);return}if(h.sessions>0){d(`WARNING: ${n} is already running at ${o} with ${String(h.sessions)} live session(s).`),d(`WARNING: stop it and run again to serve ${t}; refusing to interrupt running work.`);return}if(h.pid===void 0||!i.isLoopbackHost(e.host)){d(`WARNING: ${n} is already running at ${o} and cannot be replaced automatically.`),d(`WARNING: stop it and run again to serve ${t}.`);return}if(d(`replacing ${n} at ${o} with ${t}`),!await f(h.pid,e.host,e.port)){d(`WARNING: the hub at ${o} did not stop; serve ${t} on another port with --port.`);return}}let g=async()=>{},_=async()=>{let n=await r.serveWeb({port:e.port,host:e.host,assetsDir:e.assetsDir,compositionDir:e.directory,registryDir:t.resolveRegistryDir({flagValue:e.registryDir,envValue:process.env[t.REGISTRY_DIR_ENV],homeDir:u.default.homedir()}),spawnCommand:e.spawnCommand,remoteStateDir:l,cloudflaredPath:e.cloudflaredPath,onNotice:d,onHandover:t=>{m({serving:n,restart:_,container:p,handover:t,port:e.port,host:e.host,adopt:e=>{g=e}})}});return g=async()=>{await n.close()},n};try{await _()}catch(t){if(t.code!==`EADDRINUSE`)throw t;if(await c.hubAnswers(e.host,e.port)){d(`cockpit already running at ${o}`);return}throw Error(`Port ${String(e.port)} is taken by something that is not a DoomPi cockpit; pass --port.`)}let v=()=>{g().then(()=>{process.exit(0)})};process.on(`SIGINT`,v),process.on(`SIGTERM`,v)}async function m(e){await e.serving.close();let t=await e.container.start({workspaces:e.handover.settings.sandbox.workspaces.map(e=>({path:e})),port:e.port,onProgress:d});if(!t.ok){d(`the cockpit could not move into a container: ${t.error}`),d(`serving from the host again`),await e.restart(),await l.relaunchSessions({port:e.port,host:e.host,sessions:e.handover.sessions,onNotice:d});return}e.adopt(async()=>{await t.container.stop()}),await o.handOffRemoteAccess({port:e.port,settings:e.handover.settings,onNotice:d}),await l.relaunchSessions({port:e.port,sessions:e.handover.sessions,onNotice:d}),d(`supervising the cockpit container; Ctrl-C stops it`),await t.container.supervise()}p().catch(e=>{d(e instanceof Error?e.message:String(e)),process.exitCode=1});
 //# sourceMappingURL=serve.cjs.map

package/dist/bin/serve.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"serve.cjs","names":["parseServeOptions","hubAnswers","serveWeb","resolveRegistryDir","REGISTRY_DIR_ENV","os"],"sources":["../../src/bin/serve.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport os from 'node:os';\nimport { hubAnswers } from '../adapters/hubProbe.ts';\nimport { serveWeb } from '../adapters/httpServer.ts';\nimport { REGISTRY_DIR_ENV, resolveRegistryDir } from '../services/registryStore.ts';\nimport { parseServeOptions } from '../services/serveOptions.ts';\nimport type { WebServer } from '../types/bridge.ts';\n\nconst ADDRESS_IN_USE = 'EADDRINUSE';\n\nfunction notice(message: string): void {\n  process.stderr.write(`[doompi-web] ${message}\\n`);\n}\n\nasync function main(): Promise<void> {\n  const options = parseServeOptions(process.argv.slice(2));\n  const url = `http://${options.host}:${String(options.port)}`;\n\n  // One hub serves every session, so a second start is a request to use the\n  // running one, not an error worth a stack trace.\n  if (await hubAnswers(options.host, options.port)) {\n    notice(`cockpit already running at ${url}`);\n    return;\n  }\n\n  let server: WebServer;\n  try {\n    server = await serveWeb({\n      port: options.port,\n      host: options.host,\n      assetsDir: options.assetsDir,\n      registryDir: resolveRegistryDir({\n        flagValue: options.registryDir,\n        envValue: process.env[REGISTRY_DIR_ENV],\n        homeDir: os.homedir(),\n      }),\n      spawnCommand: options.spawnCommand,\n      onNotice: notice,\n    });\n  } catch (error) {\n    // Two cockpits starting together can both find the port free; the loser\n    // settles for the winner rather than reporting a clash nobody caused.\n    if ((error as NodeJS.ErrnoException).code !== ADDRESS_IN_USE) throw error;\n    if (await hubAnswers(options.host, options.port)) {\n      notice(`cockpit already running at ${url}`);\n      return;\n    }\n    throw new Error(`Port ${String(options.port)} is taken by something that is not a DoomPi cockpit; pass --port.`);\n  }\n\n  const stop = (): void => {\n    void server.close().then(() => {\n      process.exit(0);\n    });\n  };\n  process.on('SIGINT', stop);\n  process.on('SIGTERM', stop);\n}\n\nmain().catch((error: unknown) => {\n  notice(error instanceof Error ? error.message : String(error));\n  process.exitCode = 1;\n});\n"],"mappings":";kRAWA,SAAS,EAAO,EAAuB,CACrC,QAAQ,OAAO,MAAM,gBAAgB,EAAQ,GAAG,CAClD,CAEA,eAAe,GAAsB,CACnC,IAAM,EAAUA,EAAAA,kBAAkB,QAAQ,KAAK,MAAM,CAAC,CAAC,EACjD,EAAM,UAAU,EAAQ,KAAK,GAAG,OAAO,EAAQ,IAAI,IAIzD,GAAI,MAAMC,EAAAA,WAAW,EAAQ,KAAM,EAAQ,IAAI,EAAG,CAChD,EAAO,8BAA8B,GAAK,EAC1C,MACF,CAEA,IAAI,EACJ,GAAI,CACF,EAAS,MAAMC,EAAAA,SAAS,CACtB,KAAM,EAAQ,KACd,KAAM,EAAQ,KACd,UAAW,EAAQ,UACnB,YAAaC,EAAAA,mBAAmB,CAC9B,UAAW,EAAQ,YACnB,SAAU,QAAQ,IAAIC,EAAAA,kBACtB,QAASC,EAAAA,QAAG,QAAQ,CACtB,CAAC,EACD,aAAc,EAAQ,aACtB,SAAU,CACZ,CAAC,CACH,OAAS,EAAO,CAGd,GAAK,EAAgC,OAAS,aAAgB,MAAM,EACpE,GAAI,MAAMJ,EAAAA,WAAW,EAAQ,KAAM,EAAQ,IAAI,EAAG,CAChD,EAAO,8BAA8B,GAAK,EAC1C,MACF,CACA,MAAU,MAAM,QAAQ,OAAO,EAAQ,IAAI,EAAE,kEAAkE,CACjH,CAEA,IAAM,MAAmB,CACvB,EAAY,MAAM,CAAC,CAAC,SAAW,CAC7B,QAAQ,KAAK,CAAC,CAChB,CAAC,CACH,EACA,QAAQ,GAAG,SAAU,CAAI,EACzB,QAAQ,GAAG,UAAW,CAAI,CAC5B,CAEA,EAAK,CAAC,CAAC,MAAO,GAAmB,CAC/B,EAAO,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,CAAC,EAC7D,QAAQ,SAAW,CACrB,CAAC"}
+{"version":3,"file":"serve.cjs","names":["hubAnswers","parseServeOptions","serveHelp","packagedVersion","ensureDoomInitialized","os","defaultRemoteStateDir","createCockpitContainer","isLoopbackHost","probeHub","serveWeb","resolveRegistryDir","REGISTRY_DIR_ENV","relaunchSessions","handOffRemoteAccess"],"sources":["../../src/bin/serve.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport os from 'node:os';\nimport { createCockpitContainer } from '../adapters/cockpitContainer.ts';\nimport { handOffRemoteAccess } from '../adapters/cockpitHandoff.ts';\nimport { ensureDoomInitialized } from '../adapters/doomInitialization.ts';\nimport { hubAnswers, probeHub } from '../adapters/hubProbe.ts';\nimport { packagedVersion, serveWeb } from '../adapters/httpServer.ts';\nimport { defaultRemoteStateDir } from '../adapters/remoteAccessStore.ts';\nimport { relaunchSessions } from '../adapters/sessionRelaunch.ts';\nimport { REGISTRY_DIR_ENV, resolveRegistryDir } from '../services/registryStore.ts';\nimport { isLoopbackHost, parseServeOptions, serveHelp } from '../services/serveOptions.ts';\nimport type { WebServer } from '../types/bridge.ts';\nimport type { MigratingSession, RemoteAccessSettings } from '../types/remoteAccess.ts';\n\nconst ADDRESS_IN_USE = 'EADDRINUSE';\nconst STOP_POLL_MS = 100;\nconst STOP_TIMEOUT_MS = 10_000;\n\nfunction notice(message: string): void {\n  process.stderr.write(`[doompi-web] ${message}\\n`);\n}\n\n/**\n * Signals the running hub and waits for the address to go quiet.\n *\n * Only ever called for a loopback address, because the pid on the other end of\n * the probe is only this machine's pid when the hub is on this machine.\n */\nasync function stopRunningHub(pid: number, host: string, port: number): Promise<boolean> {\n  try {\n    process.kill(pid, 'SIGTERM');\n  } catch {\n    // Already gone, or not ours to signal. The probe below settles it either way.\n  }\n  const deadline = Date.now() + STOP_TIMEOUT_MS;\n  while (Date.now() < deadline) {\n    await new Promise((resolve) => setTimeout(resolve, STOP_POLL_MS));\n    if (!(await hubAnswers(host, port))) return true;\n  }\n  return false;\n}\n\nasync function main(): Promise<void> {\n  const options = parseServeOptions(process.argv.slice(2));\n  if (options.help) {\n    process.stdout.write(serveHelp());\n    return;\n  }\n  if (options.version) {\n    process.stdout.write(`${packagedVersion()}\\n`);\n    return;\n  }\n  await ensureDoomInitialized({ homeDirectory: os.homedir(), onNotice: notice });\n  const url = `http://${options.host}:${String(options.port)}`;\n  const stateDir = options.stateDir ?? defaultRemoteStateDir();\n  const container = createCockpitContainer({ stateDir, onNotice: notice });\n  // A cockpit that was killed rather than closed leaves its container holding\n  // the published port, so the next start would fail to bind for a reason\n  // nothing explains.\n  await container.reapStale();\n\n  // Binding off loopback publishes an unauthenticated cockpit to whoever can\n  // reach the address. Remote access exists so nobody has to do this; a warning\n  // rather than a refusal, because an existing setup should not break today.\n  if (!isLoopbackHost(options.host)) {\n    notice(`WARNING: --host ${options.host} is not loopback, so the cockpit is reachable without pairing.`);\n    notice('WARNING: turn on remote access in settings instead, which requires a paired device.');\n  }\n\n  // One hub serves every session, so a second start is normally a request to\n  // use the running one. A second start from a *different* version is not: a\n  // long-lived hub signs its asset directory once, so handing back to it would\n  // serve the older cockpit for as long as it lives, and a browser that already\n  // verified that bundle would never be offered a newer one.\n  const running = await probeHub(options.host, options.port);\n  if (running !== undefined) {\n    const mine = packagedVersion();\n    const theirs = running.version ?? 'an older build';\n    if (running.version === mine) {\n      notice(`cockpit already running at ${url}`);\n      return;\n    }\n    if (running.sessions > 0) {\n      notice(`WARNING: ${theirs} is already running at ${url} with ${String(running.sessions)} live session(s).`);\n      notice(`WARNING: stop it and run again to serve ${mine}; refusing to interrupt running work.`);\n      return;\n    }\n    if (running.pid === undefined || !isLoopbackHost(options.host)) {\n      notice(`WARNING: ${theirs} is already running at ${url} and cannot be replaced automatically.`);\n      notice(`WARNING: stop it and run again to serve ${mine}.`);\n      return;\n    }\n    notice(`replacing ${theirs} at ${url} with ${mine}`);\n    if (!(await stopRunningHub(running.pid, options.host, options.port))) {\n      notice(`WARNING: the hub at ${url} did not stop; serve ${mine} on another port with --port.`);\n      return;\n    }\n  }\n\n  /**\n   * What Ctrl-C stops, which is not the same thing throughout the run.\n   *\n   * A single indirection rather than swapping signal handlers, so the handover\n   * never has to reach for `removeAllListeners` and take out whatever else this\n   * process has registered.\n   */\n  let shutDown: () => Promise<void> = async () => {};\n\n  const start = async (): Promise<WebServer> => {\n    const server = await serveWeb({\n      port: options.port,\n      host: options.host,\n      assetsDir: options.assetsDir,\n      compositionDir: options.directory,\n      registryDir: resolveRegistryDir({\n        flagValue: options.registryDir,\n        envValue: process.env[REGISTRY_DIR_ENV],\n        homeDir: os.homedir(),\n      }),\n      spawnCommand: options.spawnCommand,\n      remoteStateDir: stateDir,\n      cloudflaredPath: options.cloudflaredPath,\n      onNotice: notice,\n      // Already deferred past its own response by the route that asked, so by\n      // the time this runs the caller has its answer and the server can go.\n      onHandover: (handover) => {\n        void handOver({\n          serving: server,\n          restart: start,\n          container,\n          handover,\n          port: options.port,\n          host: options.host,\n          adopt: (next) => {\n            shutDown = next;\n          },\n        });\n      },\n    });\n    shutDown = async () => {\n      await server.close();\n    };\n    return server;\n  };\n\n  try {\n    await start();\n  } catch (error) {\n    // Two cockpits starting together can both find the port free; the loser\n    // settles for the winner rather than reporting a clash nobody caused.\n    if ((error as NodeJS.ErrnoException).code !== ADDRESS_IN_USE) throw error;\n    if (await hubAnswers(options.host, options.port)) {\n      notice(`cockpit already running at ${url}`);\n      return;\n    }\n    throw new Error(`Port ${String(options.port)} is taken by something that is not a DoomPi cockpit; pass --port.`);\n  }\n\n  const stop = (): void => {\n    void shutDown().then(() => {\n      process.exit(0);\n    });\n  };\n  process.on('SIGINT', stop);\n  process.on('SIGTERM', stop);\n}\n\n/**\n * Hands this cockpit over to one running in a container.\n *\n * The port has to be free before the container can publish onto it, so the\n * order is: stop serving, start the container, and put the host cockpit back if\n * the container does not come up. Leaving the user with nothing listening would\n * be the worst outcome of the three, which is why the rollback also recreates\n * the sessions that were stopped in preparation for a move that did not happen.\n */\nasync function handOver(input: {\n  serving: WebServer;\n  restart: () => Promise<WebServer>;\n  container: ReturnType<typeof createCockpitContainer>;\n  handover: { settings: RemoteAccessSettings; sessions: readonly MigratingSession[] };\n  port: number;\n  host: string;\n  adopt: (shutDown: () => Promise<void>) => void;\n}): Promise<void> {\n  await input.serving.close();\n  const started = await input.container.start({\n    workspaces: input.handover.settings.sandbox.workspaces.map((workspace) => ({ path: workspace })),\n    port: input.port,\n    onProgress: notice,\n  });\n  if (!started.ok) {\n    notice(`the cockpit could not move into a container: ${started.error}`);\n    notice('serving from the host again');\n    await input.restart();\n    await relaunchSessions({\n      port: input.port,\n      host: input.host,\n      sessions: input.handover.sessions,\n      onNotice: notice,\n    });\n    return;\n  }\n  input.adopt(async () => {\n    await started.container.stop();\n  });\n  // The container answers its own health probe before `start` resolves, so its\n  // hub is already there to take the settings and the sessions.\n  await handOffRemoteAccess({ port: input.port, settings: input.handover.settings, onNotice: notice });\n  await relaunchSessions({ port: input.port, sessions: input.handover.sessions, onNotice: notice });\n  // Nothing else holds this process open now that its server is closed, and a\n  // supervisor that exits leaves a container nobody will ever stop.\n  notice('supervising the cockpit container; Ctrl-C stops it');\n  await started.container.supervise();\n}\n\nmain().catch((error: unknown) => {\n  notice(error instanceof Error ? error.message : String(error));\n  process.exitCode = 1;\n});\n"],"mappings":";4gBAmBA,SAAS,EAAO,EAAuB,CACrC,QAAQ,OAAO,MAAM,gBAAgB,EAAQ,GAAG,CAClD,CAQA,eAAe,EAAe,EAAa,EAAc,EAAgC,CACvF,GAAI,CACF,QAAQ,KAAK,EAAK,SAAS,CAC7B,MAAQ,CAER,CACA,IAAM,EAAW,KAAK,IAAI,EAAI,IAC9B,KAAO,KAAK,IAAI,EAAI,GAElB,GADA,MAAM,IAAI,QAAS,GAAY,WAAW,EAAS,GAAY,CAAC,EAC5D,CAAE,MAAMA,EAAAA,WAAW,EAAM,CAAI,EAAI,MAAO,GAE9C,MAAO,EACT,CAEA,eAAe,GAAsB,CACnC,IAAM,EAAUC,EAAAA,kBAAkB,QAAQ,KAAK,MAAM,CAAC,CAAC,EACvD,GAAI,EAAQ,KAAM,CAChB,QAAQ,OAAO,MAAMC,EAAAA,UAAU,CAAC,EAChC,MACF,CACA,GAAI,EAAQ,QAAS,CACnB,QAAQ,OAAO,MAAM,GAAGC,EAAAA,gBAAgB,EAAE,GAAG,EAC7C,MACF,CACA,MAAMC,EAAAA,sBAAsB,CAAE,cAAeC,EAAAA,QAAG,QAAQ,EAAG,SAAU,CAAO,CAAC,EAC7E,IAAM,EAAM,UAAU,EAAQ,KAAK,GAAG,OAAO,EAAQ,IAAI,IACnD,EAAW,EAAQ,UAAYC,EAAAA,sBAAsB,EACrD,EAAYC,EAAAA,uBAAuB,CAAE,WAAU,SAAU,CAAO,CAAC,EAIvE,MAAM,EAAU,UAAU,EAKrBC,EAAAA,eAAe,EAAQ,IAAI,IAC9B,EAAO,mBAAmB,EAAQ,KAAK,+DAA+D,EACtG,EAAO,qFAAqF,GAQ9F,IAAM,EAAU,MAAMC,EAAAA,SAAS,EAAQ,KAAM,EAAQ,IAAI,EACzD,GAAI,IAAY,IAAA,GAAW,CACzB,IAAM,EAAON,EAAAA,gBAAgB,EACvB,EAAS,EAAQ,SAAW,iBAClC,GAAI,EAAQ,UAAY,EAAM,CAC5B,EAAO,8BAA8B,GAAK,EAC1C,MACF,CACA,GAAI,EAAQ,SAAW,EAAG,CACxB,EAAO,YAAY,EAAO,yBAAyB,EAAI,QAAQ,OAAO,EAAQ,QAAQ,EAAE,kBAAkB,EAC1G,EAAO,2CAA2C,EAAK,sCAAsC,EAC7F,MACF,CACA,GAAI,EAAQ,MAAQ,IAAA,IAAa,CAACK,EAAAA,eAAe,EAAQ,IAAI,EAAG,CAC9D,EAAO,YAAY,EAAO,yBAAyB,EAAI,uCAAuC,EAC9F,EAAO,2CAA2C,EAAK,EAAE,EACzD,MACF,CAEA,GADA,EAAO,aAAa,EAAO,MAAM,EAAI,QAAQ,GAAM,EAC/C,CAAE,MAAM,EAAe,EAAQ,IAAK,EAAQ,KAAM,EAAQ,IAAI,EAAI,CACpE,EAAO,uBAAuB,EAAI,uBAAuB,EAAK,8BAA8B,EAC5F,MACF,CACF,CASA,IAAI,EAAgC,SAAY,CAAC,EAE3C,EAAQ,SAAgC,CAC5C,IAAM,EAAS,MAAME,EAAAA,SAAS,CAC5B,KAAM,EAAQ,KACd,KAAM,EAAQ,KACd,UAAW,EAAQ,UACnB,eAAgB,EAAQ,UACxB,YAAaC,EAAAA,mBAAmB,CAC9B,UAAW,EAAQ,YACnB,SAAU,QAAQ,IAAIC,EAAAA,kBACtB,QAASP,EAAAA,QAAG,QAAQ,CACtB,CAAC,EACD,aAAc,EAAQ,aACtB,eAAgB,EAChB,gBAAiB,EAAQ,gBACzB,SAAU,EAGV,WAAa,GAAa,CACxB,EAAc,CACZ,QAAS,EACT,QAAS,EACT,YACA,WACA,KAAM,EAAQ,KACd,KAAM,EAAQ,KACd,MAAQ,GAAS,CACf,EAAW,CACb,CACF,CAAC,CACH,CACF,CAAC,EAID,MAHA,GAAW,SAAY,CACrB,MAAM,EAAO,MAAM,CACrB,EACO,CACT,EAEA,GAAI,CACF,MAAM,EAAM,CACd,OAAS,EAAO,CAGd,GAAK,EAAgC,OAAS,aAAgB,MAAM,EACpE,GAAI,MAAML,EAAAA,WAAW,EAAQ,KAAM,EAAQ,IAAI,EAAG,CAChD,EAAO,8BAA8B,GAAK,EAC1C,MACF,CACA,MAAU,MAAM,QAAQ,OAAO,EAAQ,IAAI,EAAE,kEAAkE,CACjH,CAEA,IAAM,MAAmB,CACvB,EAAc,CAAC,CAAC,SAAW,CACzB,QAAQ,KAAK,CAAC,CAChB,CAAC,CACH,EACA,QAAQ,GAAG,SAAU,CAAI,EACzB,QAAQ,GAAG,UAAW,CAAI,CAC5B,CAWA,eAAe,EAAS,EAQN,CAChB,MAAM,EAAM,QAAQ,MAAM,EAC1B,IAAM,EAAU,MAAM,EAAM,UAAU,MAAM,CAC1C,WAAY,EAAM,SAAS,SAAS,QAAQ,WAAW,IAAK,IAAe,CAAE,KAAM,CAAU,EAAE,EAC/F,KAAM,EAAM,KACZ,WAAY,CACd,CAAC,EACD,GAAI,CAAC,EAAQ,GAAI,CACf,EAAO,gDAAgD,EAAQ,OAAO,EACtE,EAAO,6BAA6B,EACpC,MAAM,EAAM,QAAQ,EACpB,MAAMa,EAAAA,iBAAiB,CACrB,KAAM,EAAM,KACZ,KAAM,EAAM,KACZ,SAAU,EAAM,SAAS,SACzB,SAAU,CACZ,CAAC,EACD,MACF,CACA,EAAM,MAAM,SAAY,CACtB,MAAM,EAAQ,UAAU,KAAK,CAC/B,CAAC,EAGD,MAAMC,EAAAA,oBAAoB,CAAE,KAAM,EAAM,KAAM,SAAU,EAAM,SAAS,SAAU,SAAU,CAAO,CAAC,EACnG,MAAMD,EAAAA,iBAAiB,CAAE,KAAM,EAAM,KAAM,SAAU,EAAM,SAAS,SAAU,SAAU,CAAO,CAAC,EAGhG,EAAO,oDAAoD,EAC3D,MAAM,EAAQ,UAAU,UAAU,CACpC,CAEA,EAAK,CAAC,CAAC,MAAO,GAAmB,CAC/B,EAAO,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,CAAC,EAC7D,QAAQ,SAAW,CACrB,CAAC"}

package/dist/bin/serve.mjs

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import{REGISTRY_DIR_ENV as e,resolveRegistryDir as t}from"../src/services/registryStore.mjs";import{serveWeb as n}from"../src/adapters/httpServer.mjs";import{parseServeOptions as r}from"../src/services/serveOptions.mjs";import{hubAnswers as i}from"../src/adapters/hubProbe.mjs";import a from"node:os";function o(e){process.stderr.write(`[doompi-web] ${e}\n`)}async function s(){let s=r(process.argv.slice(2)),c=`http://${s.host}:${String(s.port)}`;if(await i(s.host,s.port)){o(`cockpit already running at ${c}`);return}let l;try{l=await n({port:s.port,host:s.host,assetsDir:s.assetsDir,registryDir:t({flagValue:s.registryDir,envValue:process.env[e],homeDir:a.homedir()}),spawnCommand:s.spawnCommand,onNotice:o})}catch(e){if(e.code!==`EADDRINUSE`)throw e;if(await i(s.host,s.port)){o(`cockpit already running at ${c}`);return}throw Error(`Port ${String(s.port)} is taken by something that is not a DoomPi cockpit; pass --port.`)}let u=()=>{l.close().then(()=>{process.exit(0)})};process.on(`SIGINT`,u),process.on(`SIGTERM`,u)}s().catch(e=>{o(e instanceof Error?e.message:String(e)),process.exitCode=1});export{};
+import{REGISTRY_DIR_ENV as e,resolveRegistryDir as t}from"../src/services/registryStore.mjs";import{defaultRemoteStateDir as n}from"../src/adapters/remoteAccessStore.mjs";import{packagedVersion as r,serveWeb as i}from"../src/adapters/httpServer.mjs";import{isLoopbackHost as a,parseServeOptions as o,serveHelp as s}from"../src/services/serveOptions.mjs";import{createCockpitContainer as c}from"../src/adapters/cockpitContainer.mjs";import{handOffRemoteAccess as l}from"../src/adapters/cockpitHandoff.mjs";import{ensureDoomInitialized as u}from"../src/adapters/doomInitialization.mjs";import{hubAnswers as d,probeHub as f}from"../src/adapters/hubProbe.mjs";import{relaunchSessions as p}from"../src/adapters/sessionRelaunch.mjs";import m from"node:os";function h(e){process.stderr.write(`[doompi-web] ${e}\n`)}async function g(e,t,n){try{process.kill(e,`SIGTERM`)}catch{}let r=Date.now()+1e4;for(;Date.now()<r;)if(await new Promise(e=>setTimeout(e,100)),!await d(t,n))return!0;return!1}async function _(){let l=o(process.argv.slice(2));if(l.help){process.stdout.write(s());return}if(l.version){process.stdout.write(`${r()}\n`);return}await u({homeDirectory:m.homedir(),onNotice:h});let p=`http://${l.host}:${String(l.port)}`,_=l.stateDir??n(),y=c({stateDir:_,onNotice:h});await y.reapStale(),a(l.host)||(h(`WARNING: --host ${l.host} is not loopback, so the cockpit is reachable without pairing.`),h(`WARNING: turn on remote access in settings instead, which requires a paired device.`));let b=await f(l.host,l.port);if(b!==void 0){let e=r(),t=b.version??`an older build`;if(b.version===e){h(`cockpit already running at ${p}`);return}if(b.sessions>0){h(`WARNING: ${t} is already running at ${p} with ${String(b.sessions)} live session(s).`),h(`WARNING: stop it and run again to serve ${e}; refusing to interrupt running work.`);return}if(b.pid===void 0||!a(l.host)){h(`WARNING: ${t} is already running at ${p} and cannot be replaced automatically.`),h(`WARNING: stop it and run again to serve ${e}.`);return}if(h(`replacing ${t} at ${p} with ${e}`),!await g(b.pid,l.host,l.port)){h(`WARNING: the hub at ${p} did not stop; serve ${e} on another port with --port.`);return}}let x=async()=>{},S=async()=>{let n=await i({port:l.port,host:l.host,assetsDir:l.assetsDir,compositionDir:l.directory,registryDir:t({flagValue:l.registryDir,envValue:process.env[e],homeDir:m.homedir()}),spawnCommand:l.spawnCommand,remoteStateDir:_,cloudflaredPath:l.cloudflaredPath,onNotice:h,onHandover:e=>{v({serving:n,restart:S,container:y,handover:e,port:l.port,host:l.host,adopt:e=>{x=e}})}});return x=async()=>{await n.close()},n};try{await S()}catch(e){if(e.code!==`EADDRINUSE`)throw e;if(await d(l.host,l.port)){h(`cockpit already running at ${p}`);return}throw Error(`Port ${String(l.port)} is taken by something that is not a DoomPi cockpit; pass --port.`)}let C=()=>{x().then(()=>{process.exit(0)})};process.on(`SIGINT`,C),process.on(`SIGTERM`,C)}async function v(e){await e.serving.close();let t=await e.container.start({workspaces:e.handover.settings.sandbox.workspaces.map(e=>({path:e})),port:e.port,onProgress:h});if(!t.ok){h(`the cockpit could not move into a container: ${t.error}`),h(`serving from the host again`),await e.restart(),await p({port:e.port,host:e.host,sessions:e.handover.sessions,onNotice:h});return}e.adopt(async()=>{await t.container.stop()}),await l({port:e.port,settings:e.handover.settings,onNotice:h}),await p({port:e.port,sessions:e.handover.sessions,onNotice:h}),h(`supervising the cockpit container; Ctrl-C stops it`),await t.container.supervise()}_().catch(e=>{h(e instanceof Error?e.message:String(e)),process.exitCode=1});export{};
 //# sourceMappingURL=serve.mjs.map

package/dist/bin/serve.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"serve.mjs","names":[],"sources":["../../src/bin/serve.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport os from 'node:os';\nimport { hubAnswers } from '../adapters/hubProbe.ts';\nimport { serveWeb } from '../adapters/httpServer.ts';\nimport { REGISTRY_DIR_ENV, resolveRegistryDir } from '../services/registryStore.ts';\nimport { parseServeOptions } from '../services/serveOptions.ts';\nimport type { WebServer } from '../types/bridge.ts';\n\nconst ADDRESS_IN_USE = 'EADDRINUSE';\n\nfunction notice(message: string): void {\n  process.stderr.write(`[doompi-web] ${message}\\n`);\n}\n\nasync function main(): Promise<void> {\n  const options = parseServeOptions(process.argv.slice(2));\n  const url = `http://${options.host}:${String(options.port)}`;\n\n  // One hub serves every session, so a second start is a request to use the\n  // running one, not an error worth a stack trace.\n  if (await hubAnswers(options.host, options.port)) {\n    notice(`cockpit already running at ${url}`);\n    return;\n  }\n\n  let server: WebServer;\n  try {\n    server = await serveWeb({\n      port: options.port,\n      host: options.host,\n      assetsDir: options.assetsDir,\n      registryDir: resolveRegistryDir({\n        flagValue: options.registryDir,\n        envValue: process.env[REGISTRY_DIR_ENV],\n        homeDir: os.homedir(),\n      }),\n      spawnCommand: options.spawnCommand,\n      onNotice: notice,\n    });\n  } catch (error) {\n    // Two cockpits starting together can both find the port free; the loser\n    // settles for the winner rather than reporting a clash nobody caused.\n    if ((error as NodeJS.ErrnoException).code !== ADDRESS_IN_USE) throw error;\n    if (await hubAnswers(options.host, options.port)) {\n      notice(`cockpit already running at ${url}`);\n      return;\n    }\n    throw new Error(`Port ${String(options.port)} is taken by something that is not a DoomPi cockpit; pass --port.`);\n  }\n\n  const stop = (): void => {\n    void server.close().then(() => {\n      process.exit(0);\n    });\n  };\n  process.on('SIGINT', stop);\n  process.on('SIGTERM', stop);\n}\n\nmain().catch((error: unknown) => {\n  notice(error instanceof Error ? error.message : String(error));\n  process.exitCode = 1;\n});\n"],"mappings":";6SAWA,SAAS,EAAO,EAAuB,CACrC,QAAQ,OAAO,MAAM,gBAAgB,EAAQ,GAAG,CAClD,CAEA,eAAe,GAAsB,CACnC,IAAM,EAAU,EAAkB,QAAQ,KAAK,MAAM,CAAC,CAAC,EACjD,EAAM,UAAU,EAAQ,KAAK,GAAG,OAAO,EAAQ,IAAI,IAIzD,GAAI,MAAM,EAAW,EAAQ,KAAM,EAAQ,IAAI,EAAG,CAChD,EAAO,8BAA8B,GAAK,EAC1C,MACF,CAEA,IAAI,EACJ,GAAI,CACF,EAAS,MAAM,EAAS,CACtB,KAAM,EAAQ,KACd,KAAM,EAAQ,KACd,UAAW,EAAQ,UACnB,YAAa,EAAmB,CAC9B,UAAW,EAAQ,YACnB,SAAU,QAAQ,IAAI,GACtB,QAAS,EAAG,QAAQ,CACtB,CAAC,EACD,aAAc,EAAQ,aACtB,SAAU,CACZ,CAAC,CACH,OAAS,EAAO,CAGd,GAAK,EAAgC,OAAS,aAAgB,MAAM,EACpE,GAAI,MAAM,EAAW,EAAQ,KAAM,EAAQ,IAAI,EAAG,CAChD,EAAO,8BAA8B,GAAK,EAC1C,MACF,CACA,MAAU,MAAM,QAAQ,OAAO,EAAQ,IAAI,EAAE,kEAAkE,CACjH,CAEA,IAAM,MAAmB,CACvB,EAAY,MAAM,CAAC,CAAC,SAAW,CAC7B,QAAQ,KAAK,CAAC,CAChB,CAAC,CACH,EACA,QAAQ,GAAG,SAAU,CAAI,EACzB,QAAQ,GAAG,UAAW,CAAI,CAC5B,CAEA,EAAK,CAAC,CAAC,MAAO,GAAmB,CAC/B,EAAO,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,CAAC,EAC7D,QAAQ,SAAW,CACrB,CAAC"}
+{"version":3,"file":"serve.mjs","names":[],"sources":["../../src/bin/serve.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport os from 'node:os';\nimport { createCockpitContainer } from '../adapters/cockpitContainer.ts';\nimport { handOffRemoteAccess } from '../adapters/cockpitHandoff.ts';\nimport { ensureDoomInitialized } from '../adapters/doomInitialization.ts';\nimport { hubAnswers, probeHub } from '../adapters/hubProbe.ts';\nimport { packagedVersion, serveWeb } from '../adapters/httpServer.ts';\nimport { defaultRemoteStateDir } from '../adapters/remoteAccessStore.ts';\nimport { relaunchSessions } from '../adapters/sessionRelaunch.ts';\nimport { REGISTRY_DIR_ENV, resolveRegistryDir } from '../services/registryStore.ts';\nimport { isLoopbackHost, parseServeOptions, serveHelp } from '../services/serveOptions.ts';\nimport type { WebServer } from '../types/bridge.ts';\nimport type { MigratingSession, RemoteAccessSettings } from '../types/remoteAccess.ts';\n\nconst ADDRESS_IN_USE = 'EADDRINUSE';\nconst STOP_POLL_MS = 100;\nconst STOP_TIMEOUT_MS = 10_000;\n\nfunction notice(message: string): void {\n  process.stderr.write(`[doompi-web] ${message}\\n`);\n}\n\n/**\n * Signals the running hub and waits for the address to go quiet.\n *\n * Only ever called for a loopback address, because the pid on the other end of\n * the probe is only this machine's pid when the hub is on this machine.\n */\nasync function stopRunningHub(pid: number, host: string, port: number): Promise<boolean> {\n  try {\n    process.kill(pid, 'SIGTERM');\n  } catch {\n    // Already gone, or not ours to signal. The probe below settles it either way.\n  }\n  const deadline = Date.now() + STOP_TIMEOUT_MS;\n  while (Date.now() < deadline) {\n    await new Promise((resolve) => setTimeout(resolve, STOP_POLL_MS));\n    if (!(await hubAnswers(host, port))) return true;\n  }\n  return false;\n}\n\nasync function main(): Promise<void> {\n  const options = parseServeOptions(process.argv.slice(2));\n  if (options.help) {\n    process.stdout.write(serveHelp());\n    return;\n  }\n  if (options.version) {\n    process.stdout.write(`${packagedVersion()}\\n`);\n    return;\n  }\n  await ensureDoomInitialized({ homeDirectory: os.homedir(), onNotice: notice });\n  const url = `http://${options.host}:${String(options.port)}`;\n  const stateDir = options.stateDir ?? defaultRemoteStateDir();\n  const container = createCockpitContainer({ stateDir, onNotice: notice });\n  // A cockpit that was killed rather than closed leaves its container holding\n  // the published port, so the next start would fail to bind for a reason\n  // nothing explains.\n  await container.reapStale();\n\n  // Binding off loopback publishes an unauthenticated cockpit to whoever can\n  // reach the address. Remote access exists so nobody has to do this; a warning\n  // rather than a refusal, because an existing setup should not break today.\n  if (!isLoopbackHost(options.host)) {\n    notice(`WARNING: --host ${options.host} is not loopback, so the cockpit is reachable without pairing.`);\n    notice('WARNING: turn on remote access in settings instead, which requires a paired device.');\n  }\n\n  // One hub serves every session, so a second start is normally a request to\n  // use the running one. A second start from a *different* version is not: a\n  // long-lived hub signs its asset directory once, so handing back to it would\n  // serve the older cockpit for as long as it lives, and a browser that already\n  // verified that bundle would never be offered a newer one.\n  const running = await probeHub(options.host, options.port);\n  if (running !== undefined) {\n    const mine = packagedVersion();\n    const theirs = running.version ?? 'an older build';\n    if (running.version === mine) {\n      notice(`cockpit already running at ${url}`);\n      return;\n    }\n    if (running.sessions > 0) {\n      notice(`WARNING: ${theirs} is already running at ${url} with ${String(running.sessions)} live session(s).`);\n      notice(`WARNING: stop it and run again to serve ${mine}; refusing to interrupt running work.`);\n      return;\n    }\n    if (running.pid === undefined || !isLoopbackHost(options.host)) {\n      notice(`WARNING: ${theirs} is already running at ${url} and cannot be replaced automatically.`);\n      notice(`WARNING: stop it and run again to serve ${mine}.`);\n      return;\n    }\n    notice(`replacing ${theirs} at ${url} with ${mine}`);\n    if (!(await stopRunningHub(running.pid, options.host, options.port))) {\n      notice(`WARNING: the hub at ${url} did not stop; serve ${mine} on another port with --port.`);\n      return;\n    }\n  }\n\n  /**\n   * What Ctrl-C stops, which is not the same thing throughout the run.\n   *\n   * A single indirection rather than swapping signal handlers, so the handover\n   * never has to reach for `removeAllListeners` and take out whatever else this\n   * process has registered.\n   */\n  let shutDown: () => Promise<void> = async () => {};\n\n  const start = async (): Promise<WebServer> => {\n    const server = await serveWeb({\n      port: options.port,\n      host: options.host,\n      assetsDir: options.assetsDir,\n      compositionDir: options.directory,\n      registryDir: resolveRegistryDir({\n        flagValue: options.registryDir,\n        envValue: process.env[REGISTRY_DIR_ENV],\n        homeDir: os.homedir(),\n      }),\n      spawnCommand: options.spawnCommand,\n      remoteStateDir: stateDir,\n      cloudflaredPath: options.cloudflaredPath,\n      onNotice: notice,\n      // Already deferred past its own response by the route that asked, so by\n      // the time this runs the caller has its answer and the server can go.\n      onHandover: (handover) => {\n        void handOver({\n          serving: server,\n          restart: start,\n          container,\n          handover,\n          port: options.port,\n          host: options.host,\n          adopt: (next) => {\n            shutDown = next;\n          },\n        });\n      },\n    });\n    shutDown = async () => {\n      await server.close();\n    };\n    return server;\n  };\n\n  try {\n    await start();\n  } catch (error) {\n    // Two cockpits starting together can both find the port free; the loser\n    // settles for the winner rather than reporting a clash nobody caused.\n    if ((error as NodeJS.ErrnoException).code !== ADDRESS_IN_USE) throw error;\n    if (await hubAnswers(options.host, options.port)) {\n      notice(`cockpit already running at ${url}`);\n      return;\n    }\n    throw new Error(`Port ${String(options.port)} is taken by something that is not a DoomPi cockpit; pass --port.`);\n  }\n\n  const stop = (): void => {\n    void shutDown().then(() => {\n      process.exit(0);\n    });\n  };\n  process.on('SIGINT', stop);\n  process.on('SIGTERM', stop);\n}\n\n/**\n * Hands this cockpit over to one running in a container.\n *\n * The port has to be free before the container can publish onto it, so the\n * order is: stop serving, start the container, and put the host cockpit back if\n * the container does not come up. Leaving the user with nothing listening would\n * be the worst outcome of the three, which is why the rollback also recreates\n * the sessions that were stopped in preparation for a move that did not happen.\n */\nasync function handOver(input: {\n  serving: WebServer;\n  restart: () => Promise<WebServer>;\n  container: ReturnType<typeof createCockpitContainer>;\n  handover: { settings: RemoteAccessSettings; sessions: readonly MigratingSession[] };\n  port: number;\n  host: string;\n  adopt: (shutDown: () => Promise<void>) => void;\n}): Promise<void> {\n  await input.serving.close();\n  const started = await input.container.start({\n    workspaces: input.handover.settings.sandbox.workspaces.map((workspace) => ({ path: workspace })),\n    port: input.port,\n    onProgress: notice,\n  });\n  if (!started.ok) {\n    notice(`the cockpit could not move into a container: ${started.error}`);\n    notice('serving from the host again');\n    await input.restart();\n    await relaunchSessions({\n      port: input.port,\n      host: input.host,\n      sessions: input.handover.sessions,\n      onNotice: notice,\n    });\n    return;\n  }\n  input.adopt(async () => {\n    await started.container.stop();\n  });\n  // The container answers its own health probe before `start` resolves, so its\n  // hub is already there to take the settings and the sessions.\n  await handOffRemoteAccess({ port: input.port, settings: input.handover.settings, onNotice: notice });\n  await relaunchSessions({ port: input.port, sessions: input.handover.sessions, onNotice: notice });\n  // Nothing else holds this process open now that its server is closed, and a\n  // supervisor that exits leaves a container nobody will ever stop.\n  notice('supervising the cockpit container; Ctrl-C stops it');\n  await started.container.supervise();\n}\n\nmain().catch((error: unknown) => {\n  notice(error instanceof Error ? error.message : String(error));\n  process.exitCode = 1;\n});\n"],"mappings":";8uBAmBA,SAAS,EAAO,EAAuB,CACrC,QAAQ,OAAO,MAAM,gBAAgB,EAAQ,GAAG,CAClD,CAQA,eAAe,EAAe,EAAa,EAAc,EAAgC,CACvF,GAAI,CACF,QAAQ,KAAK,EAAK,SAAS,CAC7B,MAAQ,CAER,CACA,IAAM,EAAW,KAAK,IAAI,EAAI,IAC9B,KAAO,KAAK,IAAI,EAAI,GAElB,GADA,MAAM,IAAI,QAAS,GAAY,WAAW,EAAS,GAAY,CAAC,EAC5D,CAAE,MAAM,EAAW,EAAM,CAAI,EAAI,MAAO,GAE9C,MAAO,EACT,CAEA,eAAe,GAAsB,CACnC,IAAM,EAAU,EAAkB,QAAQ,KAAK,MAAM,CAAC,CAAC,EACvD,GAAI,EAAQ,KAAM,CAChB,QAAQ,OAAO,MAAM,EAAU,CAAC,EAChC,MACF,CACA,GAAI,EAAQ,QAAS,CACnB,QAAQ,OAAO,MAAM,GAAG,EAAgB,EAAE,GAAG,EAC7C,MACF,CACA,MAAM,EAAsB,CAAE,cAAe,EAAG,QAAQ,EAAG,SAAU,CAAO,CAAC,EAC7E,IAAM,EAAM,UAAU,EAAQ,KAAK,GAAG,OAAO,EAAQ,IAAI,IACnD,EAAW,EAAQ,UAAY,EAAsB,EACrD,EAAY,EAAuB,CAAE,WAAU,SAAU,CAAO,CAAC,EAIvE,MAAM,EAAU,UAAU,EAKrB,EAAe,EAAQ,IAAI,IAC9B,EAAO,mBAAmB,EAAQ,KAAK,+DAA+D,EACtG,EAAO,qFAAqF,GAQ9F,IAAM,EAAU,MAAM,EAAS,EAAQ,KAAM,EAAQ,IAAI,EACzD,GAAI,IAAY,IAAA,GAAW,CACzB,IAAM,EAAO,EAAgB,EACvB,EAAS,EAAQ,SAAW,iBAClC,GAAI,EAAQ,UAAY,EAAM,CAC5B,EAAO,8BAA8B,GAAK,EAC1C,MACF,CACA,GAAI,EAAQ,SAAW,EAAG,CACxB,EAAO,YAAY,EAAO,yBAAyB,EAAI,QAAQ,OAAO,EAAQ,QAAQ,EAAE,kBAAkB,EAC1G,EAAO,2CAA2C,EAAK,sCAAsC,EAC7F,MACF,CACA,GAAI,EAAQ,MAAQ,IAAA,IAAa,CAAC,EAAe,EAAQ,IAAI,EAAG,CAC9D,EAAO,YAAY,EAAO,yBAAyB,EAAI,uCAAuC,EAC9F,EAAO,2CAA2C,EAAK,EAAE,EACzD,MACF,CAEA,GADA,EAAO,aAAa,EAAO,MAAM,EAAI,QAAQ,GAAM,EAC/C,CAAE,MAAM,EAAe,EAAQ,IAAK,EAAQ,KAAM,EAAQ,IAAI,EAAI,CACpE,EAAO,uBAAuB,EAAI,uBAAuB,EAAK,8BAA8B,EAC5F,MACF,CACF,CASA,IAAI,EAAgC,SAAY,CAAC,EAE3C,EAAQ,SAAgC,CAC5C,IAAM,EAAS,MAAM,EAAS,CAC5B,KAAM,EAAQ,KACd,KAAM,EAAQ,KACd,UAAW,EAAQ,UACnB,eAAgB,EAAQ,UACxB,YAAa,EAAmB,CAC9B,UAAW,EAAQ,YACnB,SAAU,QAAQ,IAAI,GACtB,QAAS,EAAG,QAAQ,CACtB,CAAC,EACD,aAAc,EAAQ,aACtB,eAAgB,EAChB,gBAAiB,EAAQ,gBACzB,SAAU,EAGV,WAAa,GAAa,CACxB,EAAc,CACZ,QAAS,EACT,QAAS,EACT,YACA,WACA,KAAM,EAAQ,KACd,KAAM,EAAQ,KACd,MAAQ,GAAS,CACf,EAAW,CACb,CACF,CAAC,CACH,CACF,CAAC,EAID,MAHA,GAAW,SAAY,CACrB,MAAM,EAAO,MAAM,CACrB,EACO,CACT,EAEA,GAAI,CACF,MAAM,EAAM,CACd,OAAS,EAAO,CAGd,GAAK,EAAgC,OAAS,aAAgB,MAAM,EACpE,GAAI,MAAM,EAAW,EAAQ,KAAM,EAAQ,IAAI,EAAG,CAChD,EAAO,8BAA8B,GAAK,EAC1C,MACF,CACA,MAAU,MAAM,QAAQ,OAAO,EAAQ,IAAI,EAAE,kEAAkE,CACjH,CAEA,IAAM,MAAmB,CACvB,EAAc,CAAC,CAAC,SAAW,CACzB,QAAQ,KAAK,CAAC,CAChB,CAAC,CACH,EACA,QAAQ,GAAG,SAAU,CAAI,EACzB,QAAQ,GAAG,UAAW,CAAI,CAC5B,CAWA,eAAe,EAAS,EAQN,CAChB,MAAM,EAAM,QAAQ,MAAM,EAC1B,IAAM,EAAU,MAAM,EAAM,UAAU,MAAM,CAC1C,WAAY,EAAM,SAAS,SAAS,QAAQ,WAAW,IAAK,IAAe,CAAE,KAAM,CAAU,EAAE,EAC/F,KAAM,EAAM,KACZ,WAAY,CACd,CAAC,EACD,GAAI,CAAC,EAAQ,GAAI,CACf,EAAO,gDAAgD,EAAQ,OAAO,EACtE,EAAO,6BAA6B,EACpC,MAAM,EAAM,QAAQ,EACpB,MAAM,EAAiB,CACrB,KAAM,EAAM,KACZ,KAAM,EAAM,KACZ,SAAU,EAAM,SAAS,SACzB,SAAU,CACZ,CAAC,EACD,MACF,CACA,EAAM,MAAM,SAAY,CACtB,MAAM,EAAQ,UAAU,KAAK,CAC/B,CAAC,EAGD,MAAM,EAAoB,CAAE,KAAM,EAAM,KAAM,SAAU,EAAM,SAAS,SAAU,SAAU,CAAO,CAAC,EACnG,MAAM,EAAiB,CAAE,KAAM,EAAM,KAAM,SAAU,EAAM,SAAS,SAAU,SAAU,CAAO,CAAC,EAGhG,EAAO,oDAAoD,EAC3D,MAAM,EAAQ,UAAU,UAAU,CACpC,CAEA,EAAK,CAAC,CAAC,MAAO,GAAmB,CAC/B,EAAO,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,CAAC,EAC7D,QAAQ,SAAW,CACrB,CAAC"}

package/dist/index.d.cts

@@ -1,7 +1,7 @@
 import { BridgeState, BridgeStatusFrame, SessionFrame } from "./src/types/session.cjs";
 import { SessionAttachment, WebServer, WebServerOptions } from "./src/types/bridge.cjs";
-import { serveWeb } from "./src/adapters/httpServer.cjs";
-import { ServeOptions, parseServeOptions } from "./src/services/serveOptions.cjs";
 import { HUB_PROTOCOL_VERSION, HUB_ROLE, SESSIONS_API_ROUTE, SessionPhase, SessionSummary } from "./src/types/hub.cjs";
 import { SESSION_RECORD_VERSION, SessionRecord } from "./src/types/registry.cjs";
+import { serveWeb } from "./src/adapters/httpServer.cjs";
+import { ServeOptions, parseServeOptions } from "./src/services/serveOptions.cjs";
 export { type BridgeState, type BridgeStatusFrame, HUB_PROTOCOL_VERSION, HUB_ROLE, SESSIONS_API_ROUTE, SESSION_RECORD_VERSION, type ServeOptions, type SessionAttachment, type SessionFrame, type SessionPhase, type SessionRecord, type SessionSummary, type WebServer, type WebServerOptions, parseServeOptions, serveWeb };

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import { BridgeState, BridgeStatusFrame, SessionFrame } from "./src/types/session.mjs";
 import { SessionAttachment, WebServer, WebServerOptions } from "./src/types/bridge.mjs";
-import { serveWeb } from "./src/adapters/httpServer.mjs";
-import { ServeOptions, parseServeOptions } from "./src/services/serveOptions.mjs";
 import { HUB_PROTOCOL_VERSION, HUB_ROLE, SESSIONS_API_ROUTE, SessionPhase, SessionSummary } from "./src/types/hub.mjs";
 import { SESSION_RECORD_VERSION, SessionRecord } from "./src/types/registry.mjs";
+import { serveWeb } from "./src/adapters/httpServer.mjs";
+import { ServeOptions, parseServeOptions } from "./src/services/serveOptions.mjs";
 export { type BridgeState, type BridgeStatusFrame, HUB_PROTOCOL_VERSION, HUB_ROLE, SESSIONS_API_ROUTE, SESSION_RECORD_VERSION, type ServeOptions, type SessionAttachment, type SessionFrame, type SessionPhase, type SessionRecord, type SessionSummary, type WebServer, type WebServerOptions, parseServeOptions, serveWeb };

package/dist/pwa/index.html

@@ -0,0 +1,104 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+    <meta name="theme-color" content="#14161a" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
+    <meta name="robots" content="noindex, nofollow" />
+    <link rel="manifest" href="/pwa/manifest.webmanifest" />
+    <link rel="apple-touch-icon" href="/pwa/icon-192.png" />
+    <title>Pair with DoomPi</title>
+    <style>
+      :root {
+        color-scheme: dark;
+      }
+      * {
+        box-sizing: border-box;
+      }
+      body {
+        margin: 0;
+        min-height: 100vh;
+        min-height: 100dvh;
+        display: grid;
+        place-items: center;
+        padding: max(1.25rem, env(safe-area-inset-top)) max(1.25rem, env(safe-area-inset-right))
+          max(1.25rem, env(safe-area-inset-bottom)) max(1.25rem, env(safe-area-inset-left));
+        background: #14161a;
+        color: #e6e8ec;
+        font:
+          16px/1.5 ui-sans-serif,
+          system-ui,
+          -apple-system,
+          sans-serif;
+      }
+      main {
+        width: min(32rem, 100%);
+        text-align: center;
+      }
+      h1 {
+        margin: 0 0 0.5rem;
+        font-size: 1.35rem;
+      }
+      p {
+        margin: 0 0 1rem;
+        color: #a2a8b4;
+      }
+      #pwa-status[data-tone='good'] {
+        color: #6bd68a;
+      }
+      #pwa-status[data-tone='bad'] {
+        color: #ff7b7b;
+      }
+      video {
+        width: 100%;
+        max-height: 24rem;
+        margin: 0.75rem 0;
+        border: 1px solid #2c313a;
+        border-radius: 0.75rem;
+        background: #090a0c;
+        object-fit: cover;
+      }
+      .actions {
+        display: flex;
+        gap: 0.75rem;
+        margin-top: 1.25rem;
+      }
+      button {
+        flex: 1;
+        min-height: 3rem;
+        border: 1px solid #2f6feb;
+        border-radius: 0.6rem;
+        background: #2f6feb;
+        color: #fff;
+        font: inherit;
+        font-weight: 650;
+      }
+      button.secondary {
+        border-color: #2c313a;
+        background: #1b1e24;
+      }
+      button:disabled {
+        opacity: 0.55;
+      }
+      [hidden] {
+        display: none !important;
+      }
+    </style>
+    <script type="module" crossorigin src="/pwa/pwa.js"></script>
+  </head>
+  <body data-marker="doompi-pwa-shell">
+    <main>
+      <h1>Pair this device</h1>
+      <p>This cockpit can run shell commands on the host. Pair only with your own DoomPi.</p>
+      <p id="pwa-status" role="status">Checking browser support.</p>
+      <video id="camera" playsinline muted hidden></video>
+      <div class="actions">
+        <button id="scan" type="button">Scan pairing QR</button>
+        <button id="cancel" class="secondary" type="button" hidden>Cancel</button>
+      </div>
+      <noscript><p>Pairing needs JavaScript.</p></noscript>
+    </main>
+  </body>
+</html>