@alisio/server 0.1.0-alpha.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gustavo Gutiérrez
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,47 @@
+# @alisio/server
+
+**The local HTTP + SSE server behind `alisio serve`.** It gives a browser multi-workspace,
+multi-session access to the [Alisio](https://github.com/GustavoGutierrez/alisio) agent core.
+
+## What it is
+
+- `node:http` only (no web framework, no WebSocket): JSON routes under `/api` and one multiplexed
+  Server-Sent Events stream per browser tab (`GET /api/events`).
+- One `@alisio/core` `Application` per open workspace, created lazily and evicted when idle.
+- Local security model: binds `127.0.0.1` by default, a per-process launch token exchanged for an
+  `HttpOnly; SameSite=Strict` cookie, strict `Host`/`Origin` checks, a strict CSP and fail-closed
+  approvals (no answer means deny).
+- Runs on Node.js >= 22.16 and on Bun, with portable Node APIs only.
+
+The CLI loads it with a dynamic `import("@alisio/server")` inside `alisio serve`, so `alisio`,
+`alisio run` and the TUI never load it.
+
+## Usage
+
+Most people run it through the CLI:
+
+```sh
+alisio serve              # prints http://127.0.0.1:4317/?token=… and opens the browser
+alisio serve --no-open --port 0 --allow-write
+```
+
+Embedding it directly:
+
+```ts
+import { startServer } from "@alisio/server";
+
+const server = await startServer({ port: 0, app: { allowWrite: true } });
+console.log(server.launchUrl);
+// …
+await server.close();
+```
+
+Plugins are not sandboxed: a trusted project's plugins run inside the server process with its
+operating-system permissions. Remote access (`--host` other than loopback) requires
+`--allow-remote` and has no TLS; prefer an SSH tunnel.
+
+Documentation: <https://gustavogutierrez.github.io/alisio/web>.
+
+## License
+
+MIT

package/dist/auth/guard.d.ts

@@ -0,0 +1,37 @@
+import type { IncomingMessage } from "node:http";
+/** Whether a bind address only accepts local connections. */
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * Launch-token authentication plus the Host/Origin checks of §11.1. The launch token is only
+ * accepted once per browser (exchanged for a cookie holding a separate secret); cookies are
+ * named per port because browsers do not isolate cookies by port.
+ */
+export declare class AuthGuard {
+    readonly token: string;
+    readonly cookieName: string;
+    private readonly secret;
+    private readonly hosts;
+    private readonly wildcard;
+    constructor(options: {
+        token?: string;
+        host: string;
+        port: number;
+    });
+    /**
+     * DNS-rebinding defense: the `Host` header must name this server. When bound to a wildcard
+     * address (`--allow-remote`), any IP-literal host on the right port is accepted too, since a
+     * rebinding attack needs a DNS name.
+     */
+    checkHost(req: IncomingMessage): void;
+    /**
+     * CSRF defense: requests with side effects need an `Origin` equal to this server's origin; any
+     * request that carries a foreign `Origin` is refused.
+     */
+    checkOrigin(req: IncomingMessage): void;
+    /** Whether the request carries this process's session cookie. */
+    authenticated(req: IncomingMessage): boolean;
+    /** Whether `candidate` is the launch token (constant time). */
+    validToken(candidate: string | null): boolean;
+    /** The `Set-Cookie` value issued after a successful token exchange. */
+    sessionCookie(): string;
+}

package/dist/auth/guard.js

@@ -0,0 +1,83 @@
+import { isIP } from "node:net";
+import { HttpError } from "../http/errors.js";
+import { newSecret, parseCookies, safeEqual } from "./token.js";
+const LOOPBACK = new Set(["127.0.0.1", "localhost", "::1"]);
+/** Whether a bind address only accepts local connections. */
+export function isLoopbackHost(host) {
+    const bare = host.replace(/^\[|\]$/g, "");
+    return LOOPBACK.has(bare) || /^127\.\d+\.\d+\.\d+$/.test(bare);
+}
+const WILDCARD = new Set(["0.0.0.0", "::", "[::]"]);
+/**
+ * Launch-token authentication plus the Host/Origin checks of §11.1. The launch token is only
+ * accepted once per browser (exchanged for a cookie holding a separate secret); cookies are
+ * named per port because browsers do not isolate cookies by port.
+ */
+export class AuthGuard {
+    token;
+    cookieName;
+    secret = newSecret();
+    hosts;
+    wildcard;
+    constructor(options) {
+        this.token = options.token ?? newSecret();
+        this.cookieName = `alisio_session_${options.port}`;
+        const port = options.port;
+        const explicit = options.host.includes(":") && !options.host.startsWith("[")
+            ? `[${options.host}]`
+            : options.host;
+        this.hosts = new Set([
+            `127.0.0.1:${port}`,
+            `localhost:${port}`,
+            `[::1]:${port}`,
+            `${explicit}:${port}`,
+        ]);
+        this.wildcard = WILDCARD.has(options.host);
+    }
+    /**
+     * DNS-rebinding defense: the `Host` header must name this server. When bound to a wildcard
+     * address (`--allow-remote`), any IP-literal host on the right port is accepted too, since a
+     * rebinding attack needs a DNS name.
+     */
+    checkHost(req) {
+        const host = (req.headers.host ?? "").toLowerCase();
+        if (this.hosts.has(host))
+            return;
+        if (this.wildcard) {
+            const match = /^(\[[^\]]+\]|[^:]+):(\d+)$/.exec(host);
+            const name = match?.[1]?.replace(/^\[|\]$/g, "");
+            if (match && name && isIP(name) && [...this.hosts].some((h) => h.endsWith(`:${match[2]}`)))
+                return;
+        }
+        throw new HttpError("forbidden_host", "Host not allowed");
+    }
+    /**
+     * CSRF defense: requests with side effects need an `Origin` equal to this server's origin; any
+     * request that carries a foreign `Origin` is refused.
+     */
+    checkOrigin(req) {
+        const origin = req.headers.origin;
+        const expected = `http://${req.headers.host ?? ""}`;
+        const effectful = !["GET", "HEAD", "OPTIONS"].includes(req.method ?? "GET");
+        if (origin === undefined) {
+            if (effectful)
+                throw new HttpError("forbidden_origin", "Origin header required");
+            return;
+        }
+        if (origin.toLowerCase() !== expected.toLowerCase())
+            throw new HttpError("forbidden_origin", "Origin not allowed");
+    }
+    /** Whether the request carries this process's session cookie. */
+    authenticated(req) {
+        const value = parseCookies(req.headers.cookie)[this.cookieName];
+        return value !== undefined && safeEqual(value, this.secret);
+    }
+    /** Whether `candidate` is the launch token (constant time). */
+    validToken(candidate) {
+        return candidate !== null && safeEqual(candidate, this.token);
+    }
+    /** The `Set-Cookie` value issued after a successful token exchange. */
+    sessionCookie() {
+        return `${this.cookieName}=${this.secret}; HttpOnly; SameSite=Strict; Path=/`;
+    }
+}

package/dist/auth/token.d.ts

@@ -0,0 +1,6 @@
+/** A fresh 256-bit secret, base64url encoded. Never written to disk. */
+export declare const newSecret: () => string;
+/** Constant-time string comparison (unequal lengths compare as different). */
+export declare function safeEqual(a: string, b: string): boolean;
+/** Parses a `Cookie` header into name → value (first occurrence wins). */
+export declare function parseCookies(header: string | undefined): Record<string, string>;

package/dist/auth/token.js

@@ -0,0 +1,22 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+/** A fresh 256-bit secret, base64url encoded. Never written to disk. */
+export const newSecret = () => randomBytes(32).toString("base64url");
+/** Constant-time string comparison (unequal lengths compare as different). */
+export function safeEqual(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+/** Parses a `Cookie` header into name → value (first occurrence wins). */
+export function parseCookies(header) {
+    const cookies = {};
+    for (const part of (header ?? "").split(";")) {
+        const index = part.indexOf("=");
+        if (index < 0)
+            continue;
+        const name = part.slice(0, index).trim();
+        if (name && !(name in cookies))
+            cookies[name] = part.slice(index + 1).trim();
+    }
+    return cookies;
+}

package/dist/bridges/approval-bridge.d.ts

@@ -0,0 +1,53 @@
+import type { ApprovalDecision, ApprovalHandler, ExternalDirectoryHandler } from "@alisio/core";
+import type { PendingApproval, ServerFrame } from "@alisio/sdk";
+/** What the bridges need from the SSE hub. */
+export interface BridgeHub {
+    toSession(sessionId: string, frame: ServerFrame): void;
+    subscribers(sessionId: string): number;
+}
+export interface ApprovalBridgeOptions {
+    hub: BridgeHub;
+    /** Root of a session (children's approvals show in their root session view). */
+    rootOf: (sessionId: string) => string;
+    /** Current run of a session, when known. */
+    runOf?: (sessionId: string) => string | undefined;
+    /** Deny when the root session has no subscriber for this long (default 30 s). */
+    graceMs?: number;
+    /** Deny after this long even with subscribers (default 10 min; 0 = no limit). */
+    timeoutMs?: number;
+    /** Called when a root session starts or stops waiting for a decision. */
+    onChange?: (rootSessionId: string) => void;
+}
+/**
+ * Web approvals for the runner's `ApprovalHandler` and the external-directory handler (§8.7).
+ * Fail-closed: the answer is `deny` when the run aborts, when nobody watches the root session
+ * for `graceMs`, or after `timeoutMs`. The first answer wins; later ones are refused.
+ */
+export declare class ApprovalBridge {
+    private options;
+    private entries;
+    private recent;
+    private readonly graceMs;
+    private readonly timeoutMs;
+    constructor(options: ApprovalBridgeOptions);
+    /** Passed as `AppOptions.approve` for every workspace app. */
+    readonly handler: ApprovalHandler;
+    /** Passed as `AppOptions.approveExternalDirectory` for every workspace app. */
+    readonly directoryHandler: ExternalDirectoryHandler;
+    private ask;
+    private send;
+    private watched;
+    /** Starts the grace timer when nobody watches; clears it when someone does. */
+    private watch;
+    /** Re-evaluates grace timers after streams connect or disconnect. */
+    subscribersChanged(): void;
+    private remember;
+    /** Answers an approval; the first answer wins. */
+    resolve(approvalId: string, decision: ApprovalDecision): "resolved" | "already_resolved" | "not_found";
+    /** Pending approvals, optionally of one root session (or of the session itself). */
+    pending(sessionId?: string): PendingApproval[];
+    awaiting(rootSessionId: string): boolean;
+    get size(): number;
+    /** Denies everything (shutdown). */
+    denyAll(): void;
+}

package/dist/bridges/approval-bridge.js

@@ -0,0 +1,162 @@
+import { randomUUID } from "node:crypto";
+const MAX_INPUT = 4_096;
+const RECENT = 500;
+const pretty = (value) => {
+    let text;
+    try {
+        text = JSON.stringify(value, null, 2) ?? "";
+    }
+    catch {
+        text = String(value);
+    }
+    return text.length > MAX_INPUT ? `${text.slice(0, MAX_INPUT)}\n…` : text;
+};
+/**
+ * Web approvals for the runner's `ApprovalHandler` and the external-directory handler (§8.7).
+ * Fail-closed: the answer is `deny` when the run aborts, when nobody watches the root session
+ * for `graceMs`, or after `timeoutMs`. The first answer wins; later ones are refused.
+ */
+export class ApprovalBridge {
+    options;
+    entries = new Map();
+    recent = new Set();
+    graceMs;
+    timeoutMs;
+    constructor(options) {
+        this.options = options;
+        this.graceMs = options.graceMs ?? 30_000;
+        this.timeoutMs = options.timeoutMs ?? 10 * 60_000;
+    }
+    /** Passed as `AppOptions.approve` for every workspace app. */
+    handler = (request) => {
+        const session = request.session ?? "";
+        return this.ask({
+            approvalId: `${session}:${request.call.id}`,
+            sessionId: session,
+            rootSessionId: this.options.rootOf(session),
+            kind: "effect",
+            callId: request.call.id,
+            name: request.call.name,
+            effect: request.effect,
+            ...(request.label ? { label: request.label } : {}),
+            input: pretty(request.input),
+        }, request.signal);
+    };
+    /** Passed as `AppOptions.approveExternalDirectory` for every workspace app. */
+    directoryHandler = (request) => {
+        const session = request.session ?? "";
+        return this.ask({
+            approvalId: `${session}:dir:${randomUUID()}`,
+            sessionId: session,
+            rootSessionId: this.options.rootOf(session),
+            kind: "directory",
+            directory: request.directory,
+            ...(request.label ? { label: request.label } : {}),
+            input: pretty({ directory: request.directory, path: request.path }),
+        }, request.signal);
+    };
+    ask(base, signal) {
+        if (signal.aborted)
+            return Promise.resolve("deny");
+        const runId = this.options.runOf?.(base.rootSessionId);
+        const approval = {
+            ...base,
+            ...(runId ? { runId } : {}),
+            ...(this.timeoutMs > 0 ? { expiresAt: Date.now() + this.timeoutMs } : {}),
+        };
+        return new Promise((resolve) => {
+            let timeout;
+            const onAbort = () => entry.settle("deny", "cancelled");
+            const entry = {
+                approval,
+                settle: (decision, reason) => {
+                    if (this.entries.get(approval.approvalId) !== entry)
+                        return;
+                    this.entries.delete(approval.approvalId);
+                    this.remember(approval.approvalId);
+                    if (timeout)
+                        clearTimeout(timeout);
+                    if (entry.grace)
+                        clearTimeout(entry.grace);
+                    signal.removeEventListener("abort", onAbort);
+                    this.send(approval, {
+                        t: "approval_withdrawn",
+                        approvalId: approval.approvalId,
+                        reason: reason ?? "resolved_elsewhere",
+                    });
+                    this.options.onChange?.(approval.rootSessionId);
+                    resolve(decision);
+                },
+            };
+            this.entries.set(approval.approvalId, entry);
+            signal.addEventListener("abort", onAbort, { once: true });
+            if (this.timeoutMs > 0)
+                timeout = setTimeout(() => entry.settle("deny", "timeout"), this.timeoutMs);
+            this.send(approval, { t: "approval", approval });
+            this.watch(entry);
+            this.options.onChange?.(approval.rootSessionId);
+        });
+    }
+    send(approval, frame) {
+        this.options.hub.toSession(approval.rootSessionId, frame);
+        if (approval.sessionId !== approval.rootSessionId)
+            this.options.hub.toSession(approval.sessionId, frame);
+    }
+    watched(approval) {
+        return (this.options.hub.subscribers(approval.rootSessionId) > 0 ||
+            this.options.hub.subscribers(approval.sessionId) > 0);
+    }
+    /** Starts the grace timer when nobody watches; clears it when someone does. */
+    watch(entry) {
+        if (this.watched(entry.approval)) {
+            if (entry.grace)
+                clearTimeout(entry.grace);
+            entry.grace = undefined;
+        }
+        else
+            entry.grace ??= setTimeout(() => {
+                if (!this.watched(entry.approval))
+                    entry.settle("deny", "timeout");
+                else
+                    entry.grace = undefined;
+            }, this.graceMs);
+    }
+    /** Re-evaluates grace timers after streams connect or disconnect. */
+    subscribersChanged() {
+        for (const entry of this.entries.values())
+            this.watch(entry);
+    }
+    remember(id) {
+        this.recent.add(id);
+        if (this.recent.size > RECENT)
+            this.recent.delete(this.recent.values().next().value);
+    }
+    /** Answers an approval; the first answer wins. */
+    resolve(approvalId, decision) {
+        const entry = this.entries.get(approvalId);
+        if (!entry)
+            return this.recent.has(approvalId) ? "already_resolved" : "not_found";
+        entry.settle(decision);
+        return "resolved";
+    }
+    /** Pending approvals, optionally of one root session (or of the session itself). */
+    pending(sessionId) {
+        return [...this.entries.values()]
+            .map((entry) => entry.approval)
+            .filter((approval) => !sessionId || approval.rootSessionId === sessionId || approval.sessionId === sessionId);
+    }
+    awaiting(rootSessionId) {
+        for (const entry of this.entries.values())
+            if (entry.approval.rootSessionId === rootSessionId)
+                return true;
+        return false;
+    }
+    get size() {
+        return this.entries.size;
+    }
+    /** Denies everything (shutdown). */
+    denyAll() {
+        for (const entry of [...this.entries.values()])
+            entry.settle("deny", "cancelled");
+    }
+}

package/dist/bridges/interaction-bridge.d.ts

@@ -0,0 +1,52 @@
+import type { AskQuestionsRequest, AskQuestionsResult, PendingInteraction, SelectRequest, ServerFrame } from "@alisio/sdk";
+export interface InteractionHub {
+    toSession(sessionId: string, frame: ServerFrame): void;
+    toWorkspace(workspaceId: string, frame: ServerFrame): void;
+    subscribers(sessionId: string): number;
+    workspaceSubscribers(workspaceId: string): number;
+}
+export interface InteractionBridgeOptions {
+    hub: InteractionHub;
+    rootOf: (sessionId: string) => string;
+    /** Workspace id of a session (to match workspace-wide requests in snapshots). */
+    workspaceOf: (sessionId: string) => string | undefined;
+    /** Give up (cancel) when nobody can answer for this long (default 30 s). */
+    graceMs?: number;
+    /** Give up after this long even with subscribers (default 10 min; 0 = no limit). */
+    timeoutMs?: number;
+    /** A plugin asked to show a session (`ui.open`). */
+    onOpen?: (sessionId: string) => void;
+    onChange?: (rootSessionId: string | undefined) => void;
+}
+/**
+ * Plugin UI requests (`ui.select`, `ui.askQuestions`, `ui.open`) for web clients (RF-18). A
+ * request that names a session goes to its root session's streams; otherwise (every `select`)
+ * to every stream watching the workspace. No answer means cancelled (`undefined`), like the
+ * TUI without an interactive UI: fail-closed.
+ */
+export declare class InteractionBridge {
+    private options;
+    private entries;
+    private recent;
+    private readonly graceMs;
+    private readonly timeoutMs;
+    constructor(options: InteractionBridgeOptions);
+    /** The `PluginHost.setInteractiveUI` implementation for one workspace app. */
+    uiFor(workspaceId: string): {
+        select(request: SelectRequest): Promise<string | undefined>;
+        askQuestions(request: AskQuestionsRequest): Promise<AskQuestionsResult>;
+        open(sessionId: string): boolean;
+    };
+    private ask;
+    private send;
+    private watched;
+    private watch;
+    subscribersChanged(): void;
+    private remember;
+    /** Answers an interaction (`null` cancels it); the first valid answer wins. */
+    resolve(interactionId: string, answer: unknown): "resolved" | "already_resolved" | "not_found" | "invalid";
+    /** Interactions a stream subscribed to `sessionId` should see. */
+    pending(sessionId?: string): PendingInteraction[];
+    awaiting(rootSessionId: string): boolean;
+    cancelAll(): void;
+}

package/dist/bridges/interaction-bridge.js

@@ -0,0 +1,163 @@
+import { randomUUID } from "node:crypto";
+const RECENT = 500;
+/**
+ * Plugin UI requests (`ui.select`, `ui.askQuestions`, `ui.open`) for web clients (RF-18). A
+ * request that names a session goes to its root session's streams; otherwise (every `select`)
+ * to every stream watching the workspace. No answer means cancelled (`undefined`), like the
+ * TUI without an interactive UI: fail-closed.
+ */
+export class InteractionBridge {
+    options;
+    entries = new Map();
+    recent = new Set();
+    graceMs;
+    timeoutMs;
+    constructor(options) {
+        this.options = options;
+        this.graceMs = options.graceMs ?? 30_000;
+        this.timeoutMs = options.timeoutMs ?? 10 * 60_000;
+    }
+    /** The `PluginHost.setInteractiveUI` implementation for one workspace app. */
+    uiFor(workspaceId) {
+        return {
+            select: (request) => this.ask({
+                interactionId: randomUUID(),
+                workspaceId,
+                request: { kind: "select", select: { title: request.title, options: request.options } },
+            }, undefined, undefined, (answer) => answer === null ||
+                (typeof answer === "string" && request.options.some((o) => o.value === answer)), (answer) => (typeof answer === "string" ? answer : undefined)),
+            askQuestions: (request) => {
+                const empty = () => Object.fromEntries(request.questions.map((q) => [q.id, undefined]));
+                const ids = new Set(request.questions.map((q) => q.id));
+                return this.ask({
+                    interactionId: randomUUID(),
+                    ...(request.session ? { sessionId: request.session } : {}),
+                    workspaceId,
+                    request: {
+                        kind: "questions",
+                        questions: request.questions,
+                        ...(request.label ? { label: request.label } : {}),
+                    },
+                }, request.signal, empty(), (answer) => answer === null ||
+                    (!!answer &&
+                        typeof answer === "object" &&
+                        !Array.isArray(answer) &&
+                        Object.entries(answer).every(([id, value]) => ids.has(id) &&
+                            (value === null ||
+                                typeof value === "string" ||
+                                (Array.isArray(value) && value.every((v) => typeof v === "string"))))), (answer) => ({
+                    ...empty(),
+                    ...Object.fromEntries(Object.entries((answer ?? {})).map(([id, value]) => [
+                        id,
+                        value === null ? undefined : value,
+                    ])),
+                }));
+            },
+            open: (sessionId) => {
+                this.options.onOpen?.(sessionId);
+                return this.options.hub.workspaceSubscribers(workspaceId) > 0;
+            },
+        };
+    }
+    ask(interaction, signal, cancelled, validate, convert) {
+        if (signal?.aborted)
+            return Promise.resolve(cancelled);
+        const root = interaction.sessionId ? this.options.rootOf(interaction.sessionId) : undefined;
+        return new Promise((resolve) => {
+            let timeout;
+            const onAbort = () => entry.settle(undefined);
+            const entry = {
+                interaction,
+                ...(root ? { root } : {}),
+                validate,
+                settle: (answer) => {
+                    if (this.entries.get(interaction.interactionId) !== entry)
+                        return;
+                    this.entries.delete(interaction.interactionId);
+                    this.remember(interaction.interactionId);
+                    if (timeout)
+                        clearTimeout(timeout);
+                    if (entry.grace)
+                        clearTimeout(entry.grace);
+                    signal?.removeEventListener("abort", onAbort);
+                    this.send(entry, {
+                        t: "interaction_withdrawn",
+                        interactionId: interaction.interactionId,
+                    });
+                    this.options.onChange?.(root);
+                    resolve(answer === undefined ? cancelled : convert(answer));
+                },
+            };
+            this.entries.set(interaction.interactionId, entry);
+            signal?.addEventListener("abort", onAbort, { once: true });
+            if (this.timeoutMs > 0)
+                timeout = setTimeout(() => entry.settle(undefined), this.timeoutMs);
+            this.send(entry, { t: "interaction", interaction });
+            this.watch(entry);
+            this.options.onChange?.(root);
+        });
+    }
+    send(entry, frame) {
+        if (entry.root)
+            this.options.hub.toSession(entry.root, frame);
+        else
+            this.options.hub.toWorkspace(entry.interaction.workspaceId, frame);
+    }
+    watched(entry) {
+        return entry.root
+            ? this.options.hub.subscribers(entry.root) > 0
+            : this.options.hub.workspaceSubscribers(entry.interaction.workspaceId) > 0;
+    }
+    watch(entry) {
+        if (this.watched(entry)) {
+            if (entry.grace)
+                clearTimeout(entry.grace);
+            entry.grace = undefined;
+        }
+        else
+            entry.grace ??= setTimeout(() => {
+                if (!this.watched(entry))
+                    entry.settle(undefined);
+                else
+                    entry.grace = undefined;
+            }, this.graceMs);
+    }
+    subscribersChanged() {
+        for (const entry of this.entries.values())
+            this.watch(entry);
+    }
+    remember(id) {
+        this.recent.add(id);
+        if (this.recent.size > RECENT)
+            this.recent.delete(this.recent.values().next().value);
+    }
+    /** Answers an interaction (`null` cancels it); the first valid answer wins. */
+    resolve(interactionId, answer) {
+        const entry = this.entries.get(interactionId);
+        if (!entry)
+            return this.recent.has(interactionId) ? "already_resolved" : "not_found";
+        if (!entry.validate(answer))
+            return "invalid";
+        entry.settle(answer === null ? undefined : answer);
+        return "resolved";
+    }
+    /** Interactions a stream subscribed to `sessionId` should see. */
+    pending(sessionId) {
+        const workspace = sessionId ? this.options.workspaceOf(sessionId) : undefined;
+        return [...this.entries.values()]
+            .filter((entry) => !sessionId ||
+            entry.root === sessionId ||
+            (!entry.root && entry.interaction.workspaceId === workspace))
+            .map((entry) => entry.interaction);
+    }
+    awaiting(rootSessionId) {
+        for (const entry of this.entries.values())
+            if (entry.root === rootSessionId)
+                return true;
+        return false;
+    }
+    cancelAll() {
+        for (const entry of [...this.entries.values()])
+            entry.settle(undefined);
+    }
+}

package/dist/host/git.d.ts

@@ -0,0 +1,22 @@
+export interface GitResult {
+    code: number;
+    stdout: string;
+}
+/** Runs git in `cwd`; resolves with code -1 when git is missing, times out or overflows. */
+export declare function runGit(cwd: string, args: string[], 
+/** `literal`: pathspecs are plain paths (no globs or magic); unsupported by check-ignore. */
+options?: {
+    input?: string;
+    timeoutMs?: number;
+    maxBytes?: number;
+    literal?: boolean;
+}): Promise<GitResult>;
+/** Top-level directory of the repository containing `cwd`, or undefined outside git. */
+export declare function gitRoot(cwd: string): Promise<string | undefined>;
+/**
+ * `git status --porcelain=v1 -z` of the repository as `workspace-relative path → code` (`M`,
+ * `A`, `D`, `R`, `??`…). Paths outside `workspace` (sibling directories of a monorepo) are left out.
+ */
+export declare function gitStatus(workspace: string, top: string): Promise<Map<string, string>>;
+/** The subset of workspace-relative `paths` (directories end in `/`) that git ignores. */
+export declare function gitIgnored(workspace: string, paths: string[]): Promise<Set<string>>;