@ash-ai/server 0.0.4 → 0.0.5

package/dist/index.js

@@ -1,27 +1,9 @@
-import Fastify from 'fastify';
-import swagger from '@fastify/swagger';
-import swaggerUi from '@fastify/swagger-ui';
-import { join, resolve, dirname } from 'node:path';
+import { resolve, join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { DEFAULT_PORT, DEFAULT_HOST, DEFAULT_DATA_DIR, DEFAULT_MAX_SANDBOXES, DEFAULT_IDLE_TIMEOUT_MS } from '@ash-ai/shared';
-import { initDb, closeDb, updateSessionStatus } from './db/index.js';
-import { SandboxManager, SandboxPool, persistSessionState, syncStateToCloud } from '@ash-ai/sandbox';
-import { LocalRunnerBackend } from './runner/local-backend.js';
-import { RunnerCoordinator } from './runner/coordinator.js';
-import { registerSchemas } from './schemas.js';
-import { registerAuth } from './auth.js';
-import { agentRoutes } from './routes/agents.js';
-import { sessionRoutes } from './routes/sessions.js';
-import { healthRoutes } from './routes/health.js';
-import { runnerRoutes } from './routes/runners.js';
-import { fileRoutes } from './routes/files.js';
-import { credentialRoutes } from './routes/credentials.js';
-import { queueRoutes } from './routes/queue.js';
-import { attachmentRoutes } from './routes/attachments.js';
-import { usageRoutes } from './routes/usage.js';
-import { workspaceRoutes } from './routes/workspace.js';
-import { createTelemetryExporter } from './telemetry/exporter.js';
-// Config from env
+import { createAshServer } from './server.js';
+export { createAshServer } from './server.js';
+// When run directly (not imported), start the server from env config
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const monorepoRoot = resolve(__dirname, '..', '..', '..');
 const port = parseInt(process.env.ASH_PORT || String(DEFAULT_PORT), 10);
@@ -30,99 +12,21 @@ const dataDir = resolve(process.env.ASH_DATA_DIR || DEFAULT_DATA_DIR);
 const bridgeEntry = process.env.ASH_BRIDGE_ENTRY
     ? resolve(process.env.ASH_BRIDGE_ENTRY)
     : join(monorepoRoot, 'packages', 'bridge', 'dist', 'index.js');
-// Mode: 'standalone' (default) or 'coordinator'
 const mode = (process.env.ASH_MODE || 'standalone');
-// Initialize DB
-const databaseUrl = process.env.ASH_DATABASE_URL;
-const db = await initDb({ dataDir, databaseUrl });
-// Build the backend and coordinator based on mode
-let pool = null;
-let coordinator;
-if (mode === 'standalone') {
-    // Standalone: server creates local SandboxPool + LocalRunnerBackend
-    const sandboxManager = new SandboxManager({
-        sandboxesDir: join(dataDir, 'sandboxes'),
-        bridgeEntry,
-    });
-    const maxCapacity = parseInt(process.env.ASH_MAX_SANDBOXES || String(DEFAULT_MAX_SANDBOXES), 10);
-    const idleTimeoutMs = parseInt(process.env.ASH_IDLE_TIMEOUT_MS || String(DEFAULT_IDLE_TIMEOUT_MS), 10);
-    pool = new SandboxPool({
-        manager: sandboxManager,
-        db,
-        dataDir,
-        maxCapacity,
-        idleTimeoutMs,
-        onBeforeEvict: async (entry) => {
-            if (entry.sessionId) {
-                persistSessionState(dataDir, entry.sessionId, entry.sandbox.workspaceDir, entry.agentName);
-                syncStateToCloud(dataDir, entry.sessionId).catch((err) => console.error(`[server] Cloud sync failed for ${entry.sessionId}:`, err));
-                await updateSessionStatus(entry.sessionId, 'paused');
-            }
-        },
-    });
-    await pool.init();
-    pool.startIdleSweep();
-    const localBackend = new LocalRunnerBackend(pool, dataDir);
-    coordinator = new RunnerCoordinator({ localBackend });
-}
-else {
-    // Coordinator mode: pure control plane, no local sandbox pool
-    // Runners must register and provide sandbox capacity
-    coordinator = new RunnerCoordinator({});
-}
-const telemetry = createTelemetryExporter();
-const app = Fastify({ logger: true });
-// OpenAPI / Swagger
-await app.register(swagger, {
-    openapi: {
-        info: {
-            title: 'Ash API',
-            description: 'REST API for deploying and orchestrating hosted AI agents',
-            version: '0.1.0',
-        },
-        servers: [{ url: `http://localhost:${port}` }],
-        tags: [
-            { name: 'health', description: 'Server health' },
-            { name: 'agents', description: 'Agent deployment and management' },
-            { name: 'sessions', description: 'Session lifecycle and messaging' },
-            { name: 'credentials', description: 'Credential storage and management' },
-            { name: 'attachments', description: 'File attachments for sessions' },
-            { name: 'queue', description: 'Async message queue' },
-            { name: 'usage', description: 'Usage tracking and analytics' },
-        ],
-    },
+const { app, shutdown } = await createAshServer({
+    dataDir,
+    databaseUrl: process.env.ASH_DATABASE_URL,
+    mode,
+    bridgeEntry,
+    port,
+    host,
+    maxSandboxes: parseInt(process.env.ASH_MAX_SANDBOXES || String(DEFAULT_MAX_SANDBOXES), 10),
+    idleTimeoutMs: parseInt(process.env.ASH_IDLE_TIMEOUT_MS || String(DEFAULT_IDLE_TIMEOUT_MS), 10),
+    apiKey: process.env.ASH_API_KEY,
 });
-await app.register(swaggerUi, { routePrefix: '/docs' });
-registerSchemas(app);
-// Auth: multi-tenant API key resolution with ASH_API_KEY fallback
-registerAuth(app, process.env.ASH_API_KEY, db);
-// Routes
-agentRoutes(app, dataDir);
-sessionRoutes(app, coordinator, dataDir, telemetry);
-fileRoutes(app, coordinator, dataDir);
-credentialRoutes(app);
-queueRoutes(app);
-attachmentRoutes(app, dataDir);
-usageRoutes(app);
-workspaceRoutes(app, coordinator, dataDir);
-healthRoutes(app, coordinator, pool);
-runnerRoutes(app, coordinator);
-coordinator.startLivenessSweep();
 // Graceful shutdown
-async function shutdown() {
-    app.log.info('Shutting down...');
-    await telemetry.shutdown();
-    coordinator.stopLivenessSweep();
-    if (pool) {
-        pool.stopIdleSweep();
-        await pool.destroyAll();
-    }
-    await closeDb();
-    await app.close();
-    process.exit(0);
-}
-process.on('SIGTERM', shutdown);
-process.on('SIGINT', shutdown);
+process.on('SIGTERM', async () => { await shutdown(); process.exit(0); });
+process.on('SIGINT', async () => { await shutdown(); process.exit(0); });
 // Start
 try {
     await app.listen({ port, host });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,OAAO,MAAM,kBAAkB,CAAC;AACvC,OAAO,SAAS,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9H,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,kBAAkB;AAClB,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC1D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;AACxE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC;AAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,gBAAgB,CAAC,CAAC;AACtE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC9C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACvC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAEjE,gDAAgD;AAChD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAiC,CAAC;AAEpF,gBAAgB;AAChB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AACjD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;AAElD,kDAAkD;AAClD,IAAI,IAAI,GAAuB,IAAI,CAAC;AACpC,IAAI,WAA8B,CAAC;AAEnC,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;IAC1B,oEAAoE;IACpE,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC;QACxC,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;QACxC,WAAW;KACZ,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE,CAAC,CAAC;IACjG,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,CAAC,uBAAuB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEvG,IAAI,GAAG,IAAI,WAAW,CAAC;QACrB,OAAO,EAAE,cAAc;QACvB,EAAE;QACF,OAAO;QACP,WAAW;QACX,aAAa;QACb,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC3F,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACvD,OAAO,CAAC,KAAK,CAAC,kCAAkC,KAAK,CAAC,SAAS,GAAG,EAAE,GAAG,CAAC,CACzE,CAAC;gBACF,MAAM,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAClB,IAAI,CAAC,cAAc,EAAE,CAAC;IAEtB,MAAM,YAAY,GAAG,IAAI,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,WAAW,GAAG,IAAI,iBAAiB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;AACxD,CAAC;KAAM,CAAC;IACN,8DAA8D;IAC9D,qDAAqD;IACrD,WAAW,GAAG,IAAI,iBAAiB,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;AAE5C,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAEtC,oBAAoB;AACpB,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE;IAC1B,OAAO,EAAE;QACP,IAAI,EAAE;YACJ,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,2DAA2D;YACxE,OAAO,EAAE,OAAO;SACjB;QACD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,oBAAoB,IAAI,EAAE,EAAE,CAAC;QAC9C,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE;YAChD,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;YAClE,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,iCAAiC,EAAE;YACpE,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,mCAAmC,EAAE;YACzE,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,+BAA+B,EAAE;YACrE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE;YACrD,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,8BAA8B,EAAE;SAC/D;KACF;CACF,CAAC,CAAC;AACH,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AACxD,eAAe,CAAC,GAAG,CAAC,CAAC;AAErB,kEAAkE;AAClE,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAE/C,SAAS;AACT,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC1B,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AACpD,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AACtC,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACtB,WAAW,CAAC,GAAG,CAAC,CAAC;AACjB,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC/B,WAAW,CAAC,GAAG,CAAC,CAAC;AACjB,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAC3C,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;AACrC,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAE/B,WAAW,CAAC,kBAAkB,EAAE,CAAC;AAEjC,oBAAoB;AACpB,KAAK,UAAU,QAAQ;IACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjC,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC3B,WAAW,CAAC,iBAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,OAAO,EAAE,CAAC;IAChB,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE/B,QAAQ;AACR,IAAI,CAAC;IACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,2BAA2B,IAAI,IAAI,IAAI,WAAW,IAAI,GAAG,CAAC,CAAC;IACxE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9H,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,qEAAqE;AACrE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAE1D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;AACxE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC;AAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,gBAAgB,CAAC,CAAC;AACtE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC9C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACvC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AACjE,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAiC,CAAC;AAEpF,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC;IAC9C,OAAO;IACP,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;IACzC,IAAI;IACJ,WAAW;IACX,IAAI;IACJ,IAAI;IACJ,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE,CAAC;IAC1F,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,MAAM,CAAC,uBAAuB,CAAC,EAAE,EAAE,CAAC;IAC/F,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;CAChC,CAAC,CAAC;AAEH,oBAAoB;AACpB,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzE,QAAQ;AACR,IAAI,CAAC;IACH,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,2BAA2B,IAAI,IAAI,IAAI,WAAW,IAAI,GAAG,CAAC,CAAC;IACxE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAAC,OAAO,GAAG,EAAE,CAAC;IACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/routes/credentials.js

@@ -42,8 +42,8 @@ export function credentialRoutes(app) {
         }
         const { type, key, label } = req.body;
         const id = randomUUID();
-        const { encrypted, iv, authTag } = encrypt(key, MASTER_KEY);
-        const credential = await insertCredential(id, req.tenantId, type, encrypted, iv, authTag, label ?? '');
+        const { encrypted, iv, authTag, salt } = encrypt(key, MASTER_KEY);
+        const credential = await insertCredential(id, req.tenantId, type, encrypted, iv, authTag, label ?? '', salt);
         return reply.status(201).send({ credential });
     });
     // List credentials (no plaintext returned)
@@ -110,7 +110,7 @@ export async function decryptCredential(credentialId, tenantId) {
     if (!cred || cred.tenantId !== tenantId || !cred.active)
         return null;
     try {
-        const key = decrypt(cred.encryptedKey, cred.iv, cred.authTag, MASTER_KEY);
+        const key = decrypt(cred.encryptedKey, cred.iv, cred.authTag, MASTER_KEY, cred.salt);
         return { type: cred.type, key };
     }
     catch {

package/dist/routes/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/routes/credentials.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACxG,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;AAElD,MAAM,UAAU,gBAAgB,CAAC,GAAoB;IACnD,yBAAyB;IACzB,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;QAC3B,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;oBACjE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACrC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC1B;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aAC1B;YACD,QAAQ,EAAE;gBACR,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,UAAU,EAAE;4BACV,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gCACtB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gCACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gCACzB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;6BAC9B;yBACF;qBACF;iBACF;gBACD,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gBAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAC3B;SACF;KACF,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACtB,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gEAAgE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9H,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAAqD,CAAC;QACvF,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAE5D,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACvG,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,2CAA2C;IAC3C,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE;QAC1B,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,QAAQ,EAAE;gBACR,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,WAAW,EAAE;4BACX,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE;gCACL,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE;oCACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oCACtB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oCACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oCACzB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oCAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oCAC7B,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;iCACzC;6BACF;yBACF;qBACF;iBACF;aACF;SACF;KACF,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,oBAAoB;IACpB,GAAG,CAAC,MAAM,CAA6B,sBAAsB,EAAE;QAC7D,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACtC,QAAQ,EAAE,CAAC,IAAI,CAAC;aACjB;YACD,QAAQ,EAAE;gBACR,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;gBACrB,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAC3B;SACF;KACF,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,YAAoB,EAAE,QAAgB;IAC5E,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAErE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC1E,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/routes/credentials.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACxG,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;AAElD,MAAM,UAAU,gBAAgB,CAAC,GAAoB;IACnD,yBAAyB;IACzB,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;QAC3B,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;oBACjE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACrC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC1B;gBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;aAC1B;YACD,QAAQ,EAAE;gBACR,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,UAAU,EAAE;4BACV,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE;gCACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gCACtB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gCACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gCACzB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gCAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;6BAC9B;yBACF;qBACF;iBACF;gBACD,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gBAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAC3B;SACF;KACF,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACtB,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gEAAgE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9H,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAAqD,CAAC;QACvF,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAElE,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7G,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,2CAA2C;IAC3C,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE;QAC1B,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,QAAQ,EAAE;gBACR,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,WAAW,EAAE;4BACX,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE;gCACL,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE;oCACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oCACtB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oCACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oCACzB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oCAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oCAC7B,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;iCACzC;6BACF;yBACF;qBACF;iBACF;aACF;SACF;KACF,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,oBAAoB;IACpB,GAAG,CAAC,MAAM,CAA6B,sBAAsB,EAAE;QAC7D,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACtC,QAAQ,EAAE,CAAC,IAAI,CAAC;aACjB;YACD,QAAQ,EAAE;gBACR,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;gBACrB,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAC3B;SACF;KACF,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,YAAoB,EAAE,QAAgB;IAC5E,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAErE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/routes/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/routes/files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAuFlE,wBAAgB,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CA0HtG"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/routes/files.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAmJlE,wBAAgB,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAwItG"}

package/dist/routes/files.js

@@ -1,5 +1,5 @@
-import { readdirSync, statSync, readFileSync, existsSync } from 'node:fs';
-import { join, relative } from 'node:path';
+import { readdirSync, statSync, readFileSync, existsSync, createReadStream } from 'node:fs';
+import { join, relative, basename, extname } from 'node:path';
 import { getSession } from '../db/index.js';
 // Same skip list as state-persistence.ts — no value showing these to clients
 const SKIP_NAMES = new Set([
@@ -7,8 +7,65 @@ const SKIP_NAMES = new Set([
     '.pnpm-store', '.yarn', '.venv', 'venv', '.tmp', 'tmp',
 ]);
 const SKIP_EXTENSIONS = new Set(['.sock', '.lock', '.pid']);
-// Max file size we'll return inline (1 MB)
-const MAX_FILE_SIZE = 1_048_576;
+// Max file size for JSON mode (1 MB) — encoding huge files as JSON strings is wasteful
+const MAX_JSON_FILE_SIZE = 1_048_576;
+// Max file size for raw streaming (100 MB) — prevent abuse
+const MAX_RAW_FILE_SIZE = 104_857_600;
+/** Simple extension → MIME type map. No external dependency needed. */
+const MIME_TYPES = {
+    '.html': 'text/html',
+    '.htm': 'text/html',
+    '.css': 'text/css',
+    '.js': 'application/javascript',
+    '.mjs': 'application/javascript',
+    '.json': 'application/json',
+    '.xml': 'application/xml',
+    '.csv': 'text/csv',
+    '.txt': 'text/plain',
+    '.md': 'text/markdown',
+    '.yaml': 'text/yaml',
+    '.yml': 'text/yaml',
+    '.toml': 'text/plain',
+    '.ts': 'text/typescript',
+    '.tsx': 'text/typescript',
+    '.jsx': 'text/javascript',
+    '.py': 'text/x-python',
+    '.rb': 'text/x-ruby',
+    '.rs': 'text/x-rust',
+    '.go': 'text/x-go',
+    '.java': 'text/x-java',
+    '.c': 'text/x-c',
+    '.cpp': 'text/x-c++',
+    '.h': 'text/x-c',
+    '.sh': 'text/x-shellscript',
+    '.bash': 'text/x-shellscript',
+    '.zsh': 'text/x-shellscript',
+    '.sql': 'text/x-sql',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.webp': 'image/webp',
+    '.ico': 'image/x-icon',
+    '.pdf': 'application/pdf',
+    '.zip': 'application/zip',
+    '.gz': 'application/gzip',
+    '.tar': 'application/x-tar',
+    '.wasm': 'application/wasm',
+    '.mp4': 'video/mp4',
+    '.webm': 'video/webm',
+    '.mp3': 'audio/mpeg',
+    '.wav': 'audio/wav',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+    '.ttf': 'font/ttf',
+    '.otf': 'font/otf',
+};
+function getMimeType(filePath) {
+    const ext = extname(filePath).toLowerCase();
+    return MIME_TYPES[ext] || 'application/octet-stream';
+}
 /**
  * Recursively list files in a directory, returning flat paths relative to root.
  */
@@ -115,7 +172,7 @@ export function fileRoutes(app, coordinator, dataDir) {
         const files = listFiles(workspace.dir, workspace.dir);
         return reply.send({ files, source: workspace.source });
     });
-    // Get single file content
+    // Get single file content (raw by default, JSON with ?format=json)
     app.get('/api/sessions/:id/files/*', {
         schema: {
             tags: ['sessions'],
@@ -127,19 +184,11 @@ export function fileRoutes(app, coordinator, dataDir) {
                 },
                 required: ['id', '*'],
             },
-            response: {
-                200: {
-                    type: 'object',
-                    properties: {
-                        path: { type: 'string' },
-                        content: { type: 'string' },
-                        size: { type: 'integer' },
-                        source: { type: 'string', enum: ['sandbox', 'snapshot'] },
-                    },
-                    required: ['path', 'content', 'size', 'source'],
+            querystring: {
+                type: 'object',
+                properties: {
+                    format: { type: 'string', enum: ['json', 'raw'] },
                 },
-                400: { $ref: 'ApiError#' },
-                404: { $ref: 'ApiError#' },
             },
         },
     }, async (req, reply) => {
@@ -174,16 +223,33 @@ export function fileRoutes(app, coordinator, dataDir) {
         if (!st.isFile()) {
             return reply.status(400).send({ error: 'Path is not a file', statusCode: 400 });
         }
-        if (st.size > MAX_FILE_SIZE) {
-            return reply.status(400).send({ error: `File too large (${st.size} bytes, max ${MAX_FILE_SIZE})`, statusCode: 400 });
+        const format = req.query.format;
+        // JSON mode: backwards-compatible JSON-wrapped response
+        if (format === 'json') {
+            if (st.size > MAX_JSON_FILE_SIZE) {
+                return reply.status(400).send({ error: `File too large (${st.size} bytes, max ${MAX_JSON_FILE_SIZE})`, statusCode: 400 });
+            }
+            const content = readFileSync(fullPath, 'utf-8');
+            return reply.send({
+                path: filePath,
+                content,
+                size: st.size,
+                source: workspace.source,
+            });
         }
-        const content = readFileSync(fullPath, 'utf-8');
-        return reply.send({
-            path: filePath,
-            content,
-            size: st.size,
-            source: workspace.source,
-        });
+        // Raw mode (default): stream file bytes with proper headers
+        if (st.size > MAX_RAW_FILE_SIZE) {
+            return reply.status(400).send({ error: `File too large (${st.size} bytes, max ${MAX_RAW_FILE_SIZE})`, statusCode: 400 });
+        }
+        const fileName = basename(filePath);
+        const mimeType = getMimeType(filePath);
+        void reply
+            .header('Content-Type', mimeType)
+            .header('Content-Disposition', `attachment; filename*=UTF-8''${encodeURIComponent(fileName)}`)
+            .header('Content-Length', st.size)
+            .header('X-Ash-Source', workspace.source);
+        const stream = createReadStream(fullPath);
+        return reply.send(stream);
     });
 }
 //# sourceMappingURL=files.js.map

package/dist/routes/files.js.map

@@ -1 +1 @@
-{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/routes/files.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAY,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAI5C,6EAA6E;AAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM;IACvD,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;CACvD,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5D,2CAA2C;AAC3C,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC;;GAEG;AACH,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY;IAC1C,MAAM,OAAO,GAAgB,EAAE,CAAC;IAEhC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAErE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC;QACP,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAC9B,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,WAA8B,EAC9B,OAAe,EACf,OAAoE;IAEpE,yBAAyB;IACzB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,wBAAwB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE7B,kCAAkC;IAClC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACvE,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,GAAG;IACd,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACtD,QAAQ,EAAE,CAAC,IAAI,CAAC;CACR,CAAC;AAEX,MAAM,UAAU,UAAU,CAAC,GAAoB,EAAE,WAA8B,EAAE,OAAe;IAC9F,kCAAkC;IAClC,GAAG,CAAC,GAAG,CAA6B,yBAAyB,EAAE;QAC7D,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE;gBACR,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,KAAK,EAAE;4BACL,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE;gCACL,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE;oCACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oCACxB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oCACzB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;iCACpD;gCACD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC;6BACzC;yBACF;wBACD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE;qBAC1D;oBACD,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;iBAC9B;gBACD,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAC3B;SACF;KACF,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,0BAA0B;IAC1B,GAAG,CAAC,GAAG,CAA0C,2BAA2B,EAAE;QAC5E,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;oBACtC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBACxB;gBACD,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;aACtB;YACD,QAAQ,EAAE;gBACR,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACxB,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;wBACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE;qBAC1D;oBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC;iBAChD;gBACD,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gBAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAC3B;SACF;KACF,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,4BAA4B;QAC5B,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAE/C,uEAAuE;QACvE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,EAAE,CAAC;QACP,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,EAAE,CAAC,IAAI,GAAG,aAAa,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,IAAI,eAAe,aAAa,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvH,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,QAAQ;YACd,OAAO;YACP,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/routes/files.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC5F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAI5C,6EAA6E;AAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM;IACvD,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;CACvD,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5D,uFAAuF;AACvF,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAErC,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAEtC,uEAAuE;AACvE,MAAM,UAAU,GAA2B;IACzC,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,wBAAwB;IAC/B,MAAM,EAAE,wBAAwB;IAChC,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,eAAe;IACtB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,eAAe;IACtB,KAAK,EAAE,aAAa;IACpB,KAAK,EAAE,aAAa;IACpB,KAAK,EAAE,WAAW;IAClB,OAAO,EAAE,aAAa;IACtB,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,UAAU;IAChB,KAAK,EAAE,oBAAoB;IAC3B,OAAO,EAAE,oBAAoB;IAC7B,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,kBAAkB;IACzB,MAAM,EAAE,mBAAmB;IAC3B,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;CACnB,CAAC;AAEF,SAAS,WAAW,CAAC,QAAgB;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY;IAC1C,MAAM,OAAO,GAAgB,EAAE,CAAC;IAEhC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAErE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC;QACP,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAC9B,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,WAA8B,EAC9B,OAAe,EACf,OAAoE;IAEpE,yBAAyB;IACzB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,wBAAwB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE7B,kCAAkC;IAClC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACvE,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,GAAG;IACd,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IACtD,QAAQ,EAAE,CAAC,IAAI,CAAC;CACR,CAAC;AAEX,MAAM,UAAU,UAAU,CAAC,GAAoB,EAAE,WAA8B,EAAE,OAAe;IAC9F,kCAAkC;IAClC,GAAG,CAAC,GAAG,CAA6B,yBAAyB,EAAE;QAC7D,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE;gBACR,GAAG,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,KAAK,EAAE;4BACL,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE;gCACL,IAAI,EAAE,QAAQ;gCACd,UAAU,EAAE;oCACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oCACxB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oCACzB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;iCACpD;gCACD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC;6BACzC;yBACF;wBACD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE;qBAC1D;oBACD,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;iBAC9B;gBACD,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAC3B;SACF;KACF,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,GAAG,CAAC,GAAG,CAA4E,2BAA2B,EAAE;QAC9G,MAAM,EAAE;YACN,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;oBACtC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBACxB;gBACD,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;aACtB;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;iBAClD;aACF;SACF;KACF,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,4BAA4B;QAC5B,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAE/C,uEAAuE;QACvE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,EAAE,CAAC;QACP,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAEhC,wDAAwD;QACxD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,IAAI,EAAE,CAAC,IAAI,GAAG,kBAAkB,EAAE,CAAC;gBACjC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,IAAI,eAAe,kBAAkB,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5H,CAAC;YAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC,IAAI,CAAC;gBAChB,IAAI,EAAE,QAAQ;gBACd,OAAO;gBACP,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,MAAM,EAAE,SAAS,CAAC,MAAM;aACzB,CAAC,CAAC;QACL,CAAC;QAED,4DAA4D;QAC5D,IAAI,EAAE,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,IAAI,eAAe,iBAAiB,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3H,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAEvC,KAAK,KAAK;aACP,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC;aAChC,MAAM,CAAC,qBAAqB,EAAE,gCAAgC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;aAC7F,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC,IAAI,CAAC;aACjC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAE5C,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAOhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AA6BlE;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAwmBvI"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAOhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AA6BlE;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAyrBvI"}

package/dist/routes/sessions.js

@@ -65,6 +65,8 @@ export function sessionRoutes(app, coordinator, dataDir, telemetry) {
                 properties: {
                     agent: { type: 'string' },
                     credentialId: { type: 'string' },
+                    extraEnv: { type: 'object', additionalProperties: { type: 'string' } },
+                    startupScript: { type: 'string' },
                 },
                 required: ['agent'],
             },
@@ -77,7 +79,7 @@ export function sessionRoutes(app, coordinator, dataDir, telemetry) {
             },
         },
     }, async (req, reply) => {
-        const { agent, credentialId } = req.body;
+        const { agent, credentialId, extraEnv: bodyExtraEnv, startupScript } = req.body;
         const agentRecord = await getAgent(agent, req.tenantId);
         if (!agentRecord) {
             return reply.status(404).send({ error: `Agent "${agent}" not found`, statusCode: 404 });
@@ -93,6 +95,10 @@ export function sessionRoutes(app, coordinator, dataDir, telemetry) {
             extraEnv = { [envKey]: cred.key };
             touchCredentialUsed(credentialId).catch(() => { });
         }
+        // Merge body-level extraEnv (overrides credential env on conflict)
+        if (bodyExtraEnv) {
+            extraEnv = { ...extraEnv, ...bodyExtraEnv };
+        }
         const sessionId = randomUUID();
         try {
             const { backend, runnerId } = await coordinator.selectBackend();
@@ -102,6 +108,7 @@ export function sessionRoutes(app, coordinator, dataDir, telemetry) {
                 agentName: agentRecord.name,
                 sandboxId: sessionId,
                 extraEnv,
+                startupScript,
                 onOomKill: () => {
                     updateSessionStatus(sessionId, 'paused').catch((err) => console.error(`Failed to update session status on OOM: ${err}`));
                 },
@@ -293,6 +300,8 @@ export function sessionRoutes(app, coordinator, dataDir, telemetry) {
             'Cache-Control': 'no-cache',
             'Connection': 'keep-alive',
         });
+        // Emit session_start as first SSE event — clients know which session they're streaming
+        await writeSSE(reply.raw, `event: session_start\ndata: ${JSON.stringify({ sessionId: session.id })}\n\n`);
         let eventCount = 0;
         let firstEventMs = 0;
         try {
@@ -356,6 +365,8 @@ export function sessionRoutes(app, coordinator, dataDir, telemetry) {
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
             reply.raw.write(`event: error\ndata: ${JSON.stringify({ error: msg })}\n\n`);
+            // Emit session_end when an error terminates the stream
+            reply.raw.write(`event: session_end\ndata: ${JSON.stringify({ sessionId: session.id })}\n\n`);
         }
         finally {
             // Mark waiting after message processing completes
@@ -376,6 +387,71 @@ export function sessionRoutes(app, coordinator, dataDir, telemetry) {
         }
         reply.raw.end();
     });
+    // Execute a command in the session's sandbox (synchronous — waits for result)
+    app.post('/api/sessions/:id/exec', {
+        schema: {
+            tags: ['sessions'],
+            params: idParam,
+            body: {
+                type: 'object',
+                properties: {
+                    command: { type: 'string' },
+                    timeout: { type: 'integer', minimum: 1, maximum: 300000 },
+                },
+                required: ['command'],
+            },
+            response: {
+                200: {
+                    type: 'object',
+                    properties: {
+                        exitCode: { type: 'integer' },
+                        stdout: { type: 'string' },
+                        stderr: { type: 'string' },
+                    },
+                    required: ['exitCode', 'stdout', 'stderr'],
+                },
+                400: { $ref: 'ApiError#' },
+                404: { $ref: 'ApiError#' },
+                500: { $ref: 'ApiError#' },
+            },
+        },
+    }, async (req, reply) => {
+        const session = await getSession(req.params.id);
+        if (!session || session.tenantId !== req.tenantId) {
+            return reply.status(404).send({ error: 'Session not found', statusCode: 404 });
+        }
+        if (session.status !== 'active') {
+            return reply.status(400).send({ error: `Session is ${session.status}`, statusCode: 400 });
+        }
+        const { command, timeout } = req.body;
+        let backend;
+        try {
+            backend = await coordinator.getBackendForRunnerAsync(session.runnerId);
+        }
+        catch {
+            return reply.status(500).send({ error: 'Runner not available', statusCode: 500 });
+        }
+        const sandbox = backend.getSandbox(session.sandboxId);
+        if (!sandbox) {
+            return reply.status(500).send({ error: 'Sandbox not found', statusCode: 500 });
+        }
+        try {
+            const events = backend.sendCommand(session.sandboxId, { cmd: 'exec', command, timeout });
+            for await (const event of events) {
+                if (event.ev === 'exec_result') {
+                    return reply.send({ exitCode: event.exitCode, stdout: event.stdout, stderr: event.stderr });
+                }
+                if (event.ev === 'error') {
+                    return reply.status(500).send({ error: event.error, statusCode: 500 });
+                }
+            }
+            return reply.status(500).send({ error: 'No exec result received', statusCode: 500 });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return reply.status(500).send({ error: `Exec failed: ${msg}`, statusCode: 500 });
+        }
+    });
     // Pause session
     app.post('/api/sessions/:id/pause', {
         schema: {