@asrunjs/asrun 0.0.0-stage → 0.5.2

package/dist/ui/server/app.js

@@ -0,0 +1,395 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { Hono } from 'hono';
+import { streamSSE } from 'hono/streaming';
+import { z } from 'zod';
+import { listBaselines, snapshotsDir } from '../../lib/baselines.js';
+import { listEnvs } from '../../lib/profiles.js';
+import { listSuites } from '../../lib/cases.js';
+import { FRAMEWORK_ROOT, ROOT } from '../../lib/paths.js';
+import { ActionError, buildJobSpec, planRunCases, previewRun, previewSchema, startJobSchema } from './actions.js';
+import { addProfile, deleteProfile, editProfile, forgetSession, listProfileRows, ProfileError, verifyProfiles } from './profiles.js';
+import { CaseError, caseImpact, createCase, deleteCase, isValidCaseId, listCaseIds, listCases, openSpec, readCase, readSpec, renameCase, writeCase, writeSpec, } from './cases.js';
+import { resolveInside, sendFile } from './files.js';
+import { JobConflictError, jobs } from './jobs.js';
+import { listAiModels } from './ai-models.js';
+import { fileEvents } from './watch-files.js';
+const REPORTS_DIR = path.join(ROOT, 'reports');
+// Built by `prepack` and shipped with the package; the framework repository builds it with `pnpm ui`.
+const WEB_DIST = path.join(FRAMEWORK_ROOT, 'ui', 'dist');
+// `2026-10-27T16-47-54` (before environments existed, always production) or `2026-10-27T16-47-54-staging`.
+const REPORT_ID = /^(latest|\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}(-[a-z0-9]+(-[a-z0-9]+)*)?)$/;
+const BASELINE_FILE = /^[\w.@-]+\.png$/i;
+const CSRF_HEADER = 'x-asrun-ui';
+function readSummary(id) {
+    const file = resolveInside(REPORTS_DIR, path.join(id, 'summary.json'));
+    if (!file)
+        return null;
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function createApp({ port }) {
+    const app = new Hono();
+    const allowedHosts = new Set([`127.0.0.1:${port}`, `localhost:${port}`]);
+    const allowedOrigins = new Set([...allowedHosts].map((host) => `http://${host}`));
+    // Vite dev server proxies /api to us and keeps its own origin.
+    const devOrigin = process.env.ASRUN_UI_DEV_ORIGIN;
+    if (devOrigin)
+        allowedOrigins.add(devOrigin);
+    // This server can start local processes, so only accept requests that really come from our own pages.
+    app.use('*', async (c, next) => {
+        const host = c.req.header('host') ?? '';
+        if (!allowedHosts.has(host) && !(devOrigin && new URL(devOrigin).host === host)) {
+            return c.text('Forbidden host', 403);
+        }
+        const origin = c.req.header('origin');
+        if (origin && !allowedOrigins.has(origin))
+            return c.text('Forbidden origin', 403);
+        if (!['GET', 'HEAD'].includes(c.req.method)) {
+            if (c.req.header(CSRF_HEADER) !== '1')
+                return c.text('Missing CSRF header', 403);
+        }
+        await next();
+    });
+    app.onError((error, c) => {
+        if (error instanceof ActionError)
+            return c.json({ error: error.message }, 400);
+        if (error instanceof JobConflictError)
+            return c.json({ error: error.message }, 409);
+        if (error instanceof ProfileError)
+            return c.json({ error: error.message }, error.status);
+        if (error instanceof CaseError)
+            return c.json({ error: error.message }, error.status);
+        if (error instanceof z.ZodError)
+            return c.json({ error: 'Invalid request body.' }, 400);
+        console.error(error);
+        return c.json({ error: error instanceof Error ? error.message : 'Internal error' }, 500);
+    });
+    const api = new Hono();
+    api.get('/info', (c) => {
+        let suites = [];
+        try {
+            suites = listSuites();
+        }
+        catch {
+            // A case with broken front matter; the cases page shows it.
+        }
+        return c.json({ root: ROOT, envs: listEnvs(), suites, caseIds: listCaseIds() });
+    });
+    api.get('/profiles', (c) => c.json(listProfileRows()));
+    const profileFields = {
+        name: z.string().max(100),
+        env: z.string().max(40),
+        baseURL: z.string().max(200),
+        account: z.string().max(200).optional(),
+        tags: z.array(z.string().max(40)).max(20).optional(),
+        startPath: z.string().max(300).optional(),
+        sessionCheckPath: z.string().max(200).optional(),
+        // Optional keys: an omitted one keeps its default. The ranges are checked by lib/profiles.ts, so the
+        // form and a hand-edited profiles.yaml fail with the same message.
+        sessionCheck: z
+            .object({
+            loggedOutUrl: z.string().max(300).optional(),
+            loggedInSelector: z.string().max(300).optional(),
+            loggedOutSelector: z.string().max(300).optional(),
+            timeoutMs: z.number().int().optional(),
+        })
+            .optional(),
+        email: z.boolean().optional(),
+    };
+    api.post('/profiles', async (c) => {
+        const body = z.object({ id: z.string().max(60), ...profileFields }).parse(await c.req.json());
+        return c.json(addProfile(body), 201);
+    });
+    // A running job read profiles.yaml at its start and uses the session files while it runs, so a profile
+    // cannot change underneath it.
+    const assertProfileIdle = (id) => {
+        const busy = jobs
+            .list()
+            .find((job) => job.status === 'running' &&
+            (job.kind === 'run' ||
+                job.kind === 'ai' ||
+                (job.profile === id && (job.kind === 'signin' || job.kind === 'visit'))));
+        if (busy)
+            throw new ProfileError(`Wait for "${busy.command}" to finish first.`, 409);
+    };
+    // The id is fixed: commands, session files and baseline names use it. Changing the site address logs the profile out.
+    api.put('/profiles/:id', async (c) => {
+        const id = c.req.param('id');
+        assertProfileIdle(id);
+        const body = z.object(profileFields).parse(await c.req.json());
+        return c.json(editProfile({ ...body, id }));
+    });
+    // Removes the entry from profiles.yaml and deletes the saved login. Never reads the session file.
+    api.delete('/profiles/:id', (c) => {
+        const id = c.req.param('id');
+        assertProfileIdle(id);
+        deleteProfile(id);
+        return c.json(listProfileRows());
+    });
+    api.post('/profiles/verify', async (c) => {
+        const body = z
+            .object({ profile: z.string().optional(), env: z.string().optional() })
+            .parse(await c.req.json().catch(() => ({})));
+        void verifyProfiles({ ids: body.profile ? [body.profile] : undefined, env: body.env });
+        // Give verifyProfiles a tick to mark the profiles as "verifying".
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        return c.json(listProfileRows());
+    });
+    // Forgets the saved login of one profile. Never reads it: the file is only deleted.
+    api.post('/profiles/logout', async (c) => {
+        const { profile: id } = z.object({ profile: z.string().min(1).max(60) }).parse(await c.req.json());
+        assertProfileIdle(id);
+        forgetSession(id);
+        return c.json(listProfileRows());
+    });
+    api.get('/cases', (c) => c.json(listCases()));
+    api.post('/cases', async (c) => {
+        const { id } = z.object({ id: z.string() }).parse(await c.req.json());
+        return c.json(await createCase(id), 201);
+    });
+    // A case id may contain one `/` (`documents/landing-page`), so the id is the whole rest of the path.
+    api.get('/case-impact/:id{.+}', (c) => c.json(caseImpact(c.req.param('id'))));
+    // Moving or deleting files under a running agent or test run would break it.
+    const assertNoRunningWork = () => {
+        const busy = jobs.list().find((job) => job.status === 'running' && (job.kind === 'ai' || job.kind === 'run'));
+        if (busy)
+            throw new CaseError(`Wait for "${busy.command}" to finish first.`, 409);
+    };
+    api.post('/case-rename', async (c) => {
+        const body = z.object({ id: z.string().max(200), to: z.string().max(200) }).parse(await c.req.json());
+        assertNoRunningWork();
+        return c.json(renameCase(body.id, body.to));
+    });
+    api.get('/specs/:id{.+}', (c) => c.json(readSpec(c.req.param('id'))));
+    api.put('/specs/:id{.+}', async (c) => {
+        const body = z.object({ content: z.string(), mtimeMs: z.number() }).parse(await c.req.json());
+        return c.json(writeSpec(c.req.param('id'), body.content, body.mtimeMs));
+    });
+    // Only the spec of a known case, never a path from the browser.
+    api.post('/spec-open', async (c) => {
+        const { id } = z.object({ id: z.string().max(200) }).parse(await c.req.json());
+        await openSpec(id);
+        return c.json({ ok: true });
+    });
+    api.get('/cases/:id{.+}', (c) => c.json(readCase(c.req.param('id'))));
+    api.put('/cases/:id{.+}', async (c) => {
+        const body = z.object({ content: z.string(), mtimeMs: z.number() }).parse(await c.req.json());
+        return c.json(writeCase(c.req.param('id'), body.content, body.mtimeMs));
+    });
+    api.delete('/cases/:id{.+}', (c) => {
+        assertNoRunningWork();
+        return c.json(deleteCase(c.req.param('id')));
+    });
+    // The screenshot baselines of one case, with what each must show. Read-only.
+    api.get('/baselines', (c) => {
+        const caseId = c.req.query('case') ?? '';
+        if (!isValidCaseId(caseId) || !listCaseIds().includes(caseId))
+            return c.json({ error: 'Unknown case.' }, 404);
+        const items = listBaselines([caseId]).map(({ caseId, file, profile, env, changed, mtimeMs, targetId, card, problem }) => ({
+            caseId,
+            file,
+            profile,
+            env,
+            changed,
+            mtimeMs,
+            targetId,
+            card,
+            problem,
+        }));
+        return c.json(items);
+    });
+    // One baseline image. Only a .png that sits directly in the snapshot folder of a known case.
+    app.get('/baseline-files', (c) => {
+        const caseId = c.req.query('case') ?? '';
+        const file = c.req.query('file') ?? '';
+        if (!isValidCaseId(caseId) || !listCaseIds().includes(caseId) || !BASELINE_FILE.test(file))
+            return c.notFound();
+        const dir = snapshotsDir(caseId);
+        if (!fs.existsSync(dir))
+            return c.notFound();
+        const image = resolveInside(dir, file);
+        return image ? sendFile(c, image) : c.notFound();
+    });
+    // A reference screenshot of a target card: the case names it as a project-relative path under `.explore/`, which is
+    // local state and git-ignored, so the file may be missing on this machine. Only images, only inside `.explore/`.
+    const REFERENCE_IMAGE = /\.(png|jpe?g|webp)$/i;
+    app.get('/explore-files', (c) => {
+        const file = (c.req.query('file') ?? '').replace(/\\/g, '/');
+        if (!file.startsWith('.explore/') || file.includes('..') || !REFERENCE_IMAGE.test(file))
+            return c.notFound();
+        const base = path.join(ROOT, '.explore');
+        if (!fs.existsSync(base))
+            return c.notFound();
+        const image = resolveInside(base, file.slice('.explore/'.length));
+        return image ? sendFile(c, image) : c.notFound();
+    });
+    api.get('/reports', (c) => {
+        if (!fs.existsSync(REPORTS_DIR))
+            return c.json([]);
+        const latestTarget = resolveInside(REPORTS_DIR, 'latest');
+        const reports = fs
+            .readdirSync(REPORTS_DIR)
+            .filter((name) => REPORT_ID.test(name) && name !== 'latest')
+            .filter((name) => fs.existsSync(path.join(REPORTS_DIR, name, 'html', 'index.html')))
+            .sort()
+            .reverse()
+            .map((id) => {
+            const summary = readSummary(id);
+            return {
+                id,
+                // Runs from before environments existed have no env in the id or the summary; they all ran against production.
+                env: summary?.env ?? /^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-(.+)$/.exec(id)?.[1] ?? null,
+                createdAt: new Date(id.slice(0, 10) + 'T' + id.slice(11, 19).replace(/-/g, ':') + 'Z').toISOString(),
+                isLatest: latestTarget === path.join(fs.realpathSync(REPORTS_DIR), id),
+                counts: summary?.counts ?? null,
+            };
+        });
+        return c.json(reports);
+    });
+    // Per-test results with the error already split into a headline and technical details.
+    api.get('/reports/:id/summary', (c) => {
+        const id = c.req.param('id');
+        if (!REPORT_ID.test(id))
+            return c.json({ error: 'Unknown report.' }, 404);
+        const summary = readSummary(id);
+        return summary ? c.json(summary) : c.json({ error: 'This run has no summary.' }, 404);
+    });
+    api.post('/runs/preview', async (c) => c.json(previewRun(previewSchema.parse(await c.req.json()))));
+    api.post('/runs/plan', async (c) => c.json(await planRunCases(previewSchema.parse(await c.req.json()))));
+    // The models the chosen AI CLI can be run with here (read from the CLI or its configuration, never from a list
+    // this app ships). `?refresh=1` reads them again instead of using the short cache.
+    api.get('/ai/models', async (c) => {
+        const tool = c.req.query('tool') === 'claude' ? 'claude' : 'opencode';
+        return c.json(await listAiModels(tool, c.req.query('refresh') === '1'));
+    });
+    api.get('/jobs', (c) => c.json(jobs.list()));
+    api.post('/jobs', async (c) => {
+        const request = startJobSchema.parse(await c.req.json());
+        return c.json(jobs.start(buildJobSpec(request)), 201);
+    });
+    api.post('/jobs/:id/input', async (c) => {
+        const { text } = z.object({ text: z.string().max(100) }).parse(await c.req.json());
+        return c.json({ ok: jobs.write(c.req.param('id'), text) });
+    });
+    api.post('/jobs/:id/cancel', (c) => c.json({ ok: jobs.cancel(c.req.param('id')) }));
+    // Status changes of any job, so every open page can refresh what depends on them.
+    api.get('/events', (c) => streamSSE(c, async (stream) => {
+        let open = true;
+        const listener = (info) => {
+            if (open)
+                void stream.writeSSE({ event: 'job', data: JSON.stringify(info) }).catch(() => { });
+        };
+        const filesListener = (change) => {
+            if (open)
+                void stream.writeSSE({ event: 'files', data: JSON.stringify(change) }).catch(() => { });
+        };
+        jobs.events.on('job', listener);
+        fileEvents.on('files', filesListener);
+        stream.onAbort(() => {
+            open = false;
+            jobs.events.off('job', listener);
+            fileEvents.off('files', filesListener);
+        });
+        while (open) {
+            await stream.writeSSE({ event: 'ping', data: '' });
+            await stream.sleep(15_000);
+        }
+    }));
+    // Output of one job. Reconnecting with Last-Event-ID replays only what was missed.
+    api.get('/jobs/:id/events', (c) => {
+        const record = jobs.get(c.req.param('id'));
+        if (!record)
+            return c.json({ error: 'Unknown job.' }, 404);
+        const lastId = Number(c.req.header('last-event-id') ?? c.req.query('after') ?? -1);
+        return streamSSE(c, async (stream) => {
+            const queue = [];
+            let wake = null;
+            let aborted = false;
+            const notify = () => wake?.();
+            const onChunk = (chunk) => {
+                queue.push({ event: 'chunk', id: String(chunk.seq), data: JSON.stringify(chunk) });
+                notify();
+            };
+            const onStatus = (info) => {
+                queue.push({ event: 'status', data: JSON.stringify(info) });
+                notify();
+            };
+            // Replay and subscribe in one synchronous step so no chunk can fall in between.
+            for (const chunk of record.chunks)
+                if (chunk.seq > lastId)
+                    onChunk(chunk);
+            record.emitter.on('chunk', onChunk);
+            record.emitter.on('status', onStatus);
+            if (record.info.status !== 'running')
+                onStatus(record.info);
+            stream.onAbort(() => {
+                aborted = true;
+                notify();
+            });
+            try {
+                let done = false;
+                while (!aborted && !done) {
+                    while (queue.length > 0) {
+                        const message = queue.shift();
+                        await stream.writeSSE(message);
+                        if (message.event === 'status' && JSON.parse(message.data).status !== 'running')
+                            done = true;
+                    }
+                    if (done || aborted)
+                        break;
+                    await new Promise((resolve) => {
+                        wake = resolve;
+                        setTimeout(resolve, 15_000);
+                    });
+                    wake = null;
+                }
+            }
+            finally {
+                record.emitter.off('chunk', onChunk);
+                record.emitter.off('status', onStatus);
+            }
+        });
+    });
+    api.all('*', (c) => c.json({ error: 'Not found' }, 404));
+    app.route('/api', api);
+    // The Playwright HTML report, same origin so it can be embedded in an iframe.
+    app.get('/report-files/:id', (c) => c.redirect(`/report-files/${c.req.param('id')}/`));
+    app.get('/report-files/:id/*', (c) => {
+        const id = c.req.param('id');
+        if (!REPORT_ID.test(id))
+            return c.notFound();
+        const prefix = `/report-files/${id}/`;
+        const relative = decodeURIComponent(c.req.path.slice(prefix.length)) || 'index.html';
+        const htmlDir = path.join(REPORTS_DIR, id, 'html');
+        if (!fs.existsSync(htmlDir))
+            return c.notFound();
+        // Joined videos live next to the HTML report (it owns its folder), but are served under the same prefix.
+        const videosDir = path.join(REPORTS_DIR, id, 'videos');
+        if (relative.startsWith('videos/') && fs.existsSync(videosDir)) {
+            const video = resolveInside(videosDir, relative.slice('videos/'.length));
+            return video ? sendFile(c, video) : c.notFound();
+        }
+        let file = resolveInside(htmlDir, relative);
+        if (file && fs.statSync(file).isDirectory())
+            file = resolveInside(htmlDir, path.join(relative, 'index.html'));
+        return file ? sendFile(c, file) : c.notFound();
+    });
+    // The static Inkstone theme guide, linked from the top bar of the UI.
+    app.get('/docs/theme-guide.html', (c) => sendFile(c, path.join(FRAMEWORK_ROOT, 'docs', 'theme-guide.html')));
+    // Built web app (production mode). In dev, Vite serves it and proxies /api here.
+    if (fs.existsSync(WEB_DIST)) {
+        app.get('*', (c) => {
+            const relative = decodeURIComponent(c.req.path).replace(/^\/+/, '') || 'index.html';
+            const file = resolveInside(WEB_DIST, relative);
+            if (file && fs.statSync(file).isFile())
+                return sendFile(c, file);
+            return sendFile(c, path.join(WEB_DIST, 'index.html'));
+        });
+    }
+    return app;
+}

package/dist/ui/server/cases.d.ts

@@ -0,0 +1,23 @@
+import { isValidCaseId } from '../../lib/case-id.js';
+import { CaseError } from '../../lib/case-ops.js';
+import { listCaseFileIds } from '../../lib/cases.js';
+import type { CaseDetail, CaseImpact, CaseSummary, SpecDetail } from '../shared/types.js';
+export { CaseError, isValidCaseId };
+export declare const listCaseIds: typeof listCaseFileIds;
+export declare function listCases(): CaseSummary[];
+export declare function readCase(id: string): CaseDetail;
+export declare function readSpec(id: string): SpecDetail;
+/** Writes only if the file is unchanged since the editor loaded it (an agent or an external editor may change it too). */
+export declare function writeSpec(id: string, content: string, expectedMtimeMs: number): SpecDetail;
+/**
+ * Opens the spec of a case in the default application of the system. Resolves once the opener has handed the file over
+ * (or is still running after a moment, as `xdg-open` can be); rejects when there is no opener or it fails.
+ */
+export declare function openSpec(id: string): Promise<void>;
+/** Writes only if the file is unchanged since the editor loaded it (an agent may be editing it too). */
+export declare function writeCase(id: string, content: string, expectedMtimeMs: number): CaseDetail;
+/** Reuses `pnpm case:new` so the template stays in one place. */
+export declare function createCase(id: string): Promise<CaseDetail>;
+export declare const caseImpact: (id: string) => CaseImpact;
+export declare const renameCase: (id: string, to: string) => CaseDetail;
+export declare const deleteCase: (id: string) => CaseImpact;

package/dist/ui/server/cases.js

@@ -0,0 +1,170 @@
+import { execFile, spawn } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { parse } from 'yaml';
+import { isValidCaseId } from '../../lib/case-id.js';
+import { assertValidNewId, CaseError, caseFilePath, deleteCase as deleteCaseFiles, getCaseImpact, renameCase as renameCaseFiles, specFilePath, } from '../../lib/case-ops.js';
+import { listCaseFileIds, parseCaseMeta } from '../../lib/cases.js';
+import { scriptArgs } from '../../lib/node-cli.js';
+import { ROOT } from '../../lib/paths.js';
+const MAX_BYTES = 1_000_000;
+export { CaseError, isValidCaseId };
+function fileFor(id) {
+    if (!isValidCaseId(id))
+        throw new CaseError(`Invalid case id "${id}".`, 400);
+    return caseFilePath(id);
+}
+function frontMatter(text) {
+    const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text);
+    if (!match)
+        return {};
+    try {
+        const value = parse(match[1]);
+        return value && typeof value === 'object' ? value : {};
+    }
+    catch {
+        return {};
+    }
+}
+const asString = (value) => (typeof value === 'string' ? value : null);
+export const listCaseIds = listCaseFileIds;
+export function listCases() {
+    return listCaseIds().map((id) => {
+        const file = fileFor(id);
+        const text = fs.readFileSync(file, 'utf8');
+        const meta = frontMatter(text);
+        let parsed = null;
+        let problem = null;
+        try {
+            parsed = parseCaseMeta(id, text);
+        }
+        catch (error) {
+            problem = error.message;
+        }
+        return {
+            id,
+            title: asString(meta.title),
+            login: asString(meta.login),
+            suites: parsed?.suites ?? [],
+            writes: parsed?.writes ?? [],
+            writesNote: parsed?.writesNote ?? null,
+            envs: parsed?.envs ?? null,
+            problem,
+            group: id.includes('/') ? id.slice(0, id.indexOf('/')) : null,
+            hasSpec: fs.existsSync(specFilePath(id)),
+            updatedAt: fs.statSync(file).mtime.toISOString(),
+        };
+    });
+}
+export function readCase(id) {
+    const file = fileFor(id);
+    if (!fs.existsSync(file))
+        throw new CaseError(`Case "${id}" does not exist.`, 404);
+    return { id, content: fs.readFileSync(file, 'utf8'), mtimeMs: fs.statSync(file).mtimeMs };
+}
+/** The path comes from the case id only, never from the browser. */
+function existingSpecFile(id) {
+    if (!isValidCaseId(id))
+        throw new CaseError(`Invalid case id "${id}".`, 400);
+    const file = specFilePath(id);
+    if (!fs.existsSync(file))
+        throw new CaseError(`Case "${id}" has no spec yet.`, 404);
+    return file;
+}
+export function readSpec(id) {
+    const file = existingSpecFile(id);
+    const stat = fs.statSync(file);
+    if (stat.size > MAX_BYTES)
+        throw new CaseError('Spec file is too large to show.', 400);
+    return {
+        id,
+        file: path.relative(ROOT, file),
+        path: file,
+        content: fs.readFileSync(file, 'utf8'),
+        mtimeMs: stat.mtimeMs,
+    };
+}
+/** Writes only if the file is unchanged since the editor loaded it (an agent or an external editor may change it too). */
+export function writeSpec(id, content, expectedMtimeMs) {
+    const file = existingSpecFile(id);
+    if (Buffer.byteLength(content) > MAX_BYTES)
+        throw new CaseError('Spec file is too large.', 400);
+    if (fs.statSync(file).mtimeMs !== expectedMtimeMs) {
+        throw new CaseError('The file changed on disk since you opened it. Reload it (copy your edits first) to continue.', 409);
+    }
+    const temp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(temp, content);
+    fs.renameSync(temp, file);
+    return readSpec(id);
+}
+/** The command that opens a file with the application the operating system has registered for it. */
+function openCommand(file) {
+    if (process.platform === 'darwin')
+        return { command: 'open', args: [file] };
+    if (process.platform === 'win32')
+        return { command: 'cmd', args: ['/c', 'start', '""', file] };
+    return { command: 'xdg-open', args: [file] };
+}
+/**
+ * Opens the spec of a case in the default application of the system. Resolves once the opener has handed the file over
+ * (or is still running after a moment, as `xdg-open` can be); rejects when there is no opener or it fails.
+ */
+export function openSpec(id) {
+    const { command, args } = openCommand(existingSpecFile(id));
+    return new Promise((resolve, reject) => {
+        const fail = (reason) => reject(new CaseError(`Could not open the spec: ${reason}`, 400));
+        const child = spawn(command, args, { detached: true, stdio: 'ignore' });
+        const timer = setTimeout(() => {
+            child.unref();
+            resolve();
+        }, 3000);
+        child.on('error', (error) => {
+            clearTimeout(timer);
+            fail(error.message);
+        });
+        child.on('exit', (code) => {
+            clearTimeout(timer);
+            if (code === 0)
+                resolve();
+            else
+                fail(`"${command}" exited with code ${code}.`);
+        });
+    });
+}
+/** Writes only if the file is unchanged since the editor loaded it (an agent may be editing it too). */
+export function writeCase(id, content, expectedMtimeMs) {
+    const file = fileFor(id);
+    if (!fs.existsSync(file))
+        throw new CaseError(`Case "${id}" does not exist.`, 404);
+    if (Buffer.byteLength(content) > MAX_BYTES)
+        throw new CaseError('Case file is too large.', 400);
+    if (fs.statSync(file).mtimeMs !== expectedMtimeMs) {
+        throw new CaseError('The file changed on disk since you opened it. Reload it (copy your edits first) to continue.', 409);
+    }
+    const temp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(temp, content);
+    fs.renameSync(temp, file);
+    return readCase(id);
+}
+/** Reuses `pnpm case:new` so the template stays in one place. */
+export async function createCase(id) {
+    assertValidNewId(id);
+    if (fs.existsSync(fileFor(id)))
+        throw new CaseError(`Case "${id}" already exists.`, 409);
+    await promisify(execFile)(process.execPath, [...scriptArgs('new-case.ts'), id], {
+        cwd: ROOT,
+    });
+    return readCase(id);
+}
+export const caseImpact = (id) => {
+    fileFor(id);
+    if (!fs.existsSync(caseFilePath(id)))
+        throw new CaseError(`Case "${id}" does not exist.`, 404);
+    return getCaseImpact(id);
+};
+export const renameCase = (id, to) => {
+    renameCaseFiles(id, to);
+    return readCase(to);
+};
+export const deleteCase = (id) => deleteCaseFiles(id);

package/dist/ui/server/files.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from 'hono';
+/** Resolves `relative` under `base`; returns null if the result escapes `base` (also via symlinks). */
+export declare function resolveInside(base: string, relative: string): string | null;
+/** Serves a file with HTTP Range support, which videos need for seeking. */
+export declare function sendFile(c: Context, file: string): Response | Promise<Response>;

package/dist/ui/server/files.js

@@ -0,0 +1,67 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { Readable } from 'node:stream';
+const MIME = {
+    '.html': 'text/html; charset=utf-8',
+    '.js': 'text/javascript; charset=utf-8',
+    '.mjs': 'text/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.webmanifest': 'application/manifest+json',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.webm': 'video/webm',
+    '.mp4': 'video/mp4',
+    '.zip': 'application/zip',
+    '.ttf': 'font/ttf',
+    '.woff2': 'font/woff2',
+    '.txt': 'text/plain; charset=utf-8',
+    '.md': 'text/markdown; charset=utf-8',
+};
+/** Resolves `relative` under `base`; returns null if the result escapes `base` (also via symlinks). */
+export function resolveInside(base, relative) {
+    const realBase = fs.realpathSync(base);
+    const target = path.resolve(realBase, '.' + path.sep + relative);
+    let real;
+    try {
+        real = fs.realpathSync(target);
+    }
+    catch {
+        return null;
+    }
+    return real === realBase || real.startsWith(realBase + path.sep) ? real : null;
+}
+/** Serves a file with HTTP Range support, which videos need for seeking. */
+export function sendFile(c, file) {
+    const stat = fs.statSync(file, { throwIfNoEntry: false });
+    if (!stat?.isFile())
+        return c.notFound();
+    const headers = {
+        'Content-Type': MIME[path.extname(file).toLowerCase()] ?? 'application/octet-stream',
+        'Accept-Ranges': 'bytes',
+        'Cache-Control': 'no-cache',
+    };
+    const range = /^bytes=(\d*)-(\d*)$/.exec(c.req.header('range') ?? '');
+    if (range && (range[1] || range[2])) {
+        const size = stat.size;
+        const start = range[1] ? Number(range[1]) : Math.max(0, size - Number(range[2]));
+        const end = range[1] && range[2] ? Math.min(Number(range[2]), size - 1) : size - 1;
+        if (start > end || start >= size) {
+            return new Response(null, { status: 416, headers: { 'Content-Range': `bytes */${size}` } });
+        }
+        return new Response(Readable.toWeb(fs.createReadStream(file, { start, end })), {
+            status: 206,
+            headers: {
+                ...headers,
+                'Content-Range': `bytes ${start}-${end}/${size}`,
+                'Content-Length': String(end - start + 1),
+            },
+        });
+    }
+    return new Response(Readable.toWeb(fs.createReadStream(file)), {
+        status: 200,
+        headers: { ...headers, 'Content-Length': String(stat.size) },
+    });
+}

package/dist/ui/server/index.d.ts

@@ -0,0 +1 @@
+export {};