@chatroomcp/chatroom 0.1.3

package/dist/plugins/process/mcp.js

@@ -0,0 +1,69 @@
+import { z } from "zod";
+import { closedRead, destructiveLocalMutation, mcpTool, openWorldMutation, processSnapshotSchema, } from "../../mcp/server/tool-support.js";
+export function registerProcessTools(server, processes, operations) {
+    server.registerTool("process_start", {
+        title: "Start process",
+        description: "Start a supervised pipe or PTY process. Returns a ProcessId immediately.",
+        inputSchema: z.object({
+            command: z.string().min(1),
+            args: z.array(z.string()).default([]),
+            cwd: z.string().default("."),
+            env: z.record(z.string(), z.string()).optional(),
+            pty: z.boolean().default(false),
+            timeoutMs: z.number().int().positive().optional(),
+        }),
+        outputSchema: processSnapshotSchema,
+        annotations: openWorldMutation,
+    }, mcpTool((input) => processes.start({
+        cwd: input.cwd,
+        command: input.command,
+        args: input.args,
+        ...(input.env ? { env: input.env } : {}),
+        pty: input.pty,
+        ...(input.timeoutMs === undefined
+            ? {}
+            : { timeoutMs: input.timeoutMs }),
+    }, { source: "mcp" })));
+    server.registerTool("process_read", {
+        title: "Read process",
+        description: "Read bounded stdout/stderr and current process state.",
+        inputSchema: z.object({ processId: z.string() }),
+        outputSchema: processSnapshotSchema,
+        annotations: closedRead,
+    }, mcpTool((input) => operations.run({
+        pluginId: "process",
+        source: "mcp",
+        action: "read",
+        processId: input.processId,
+        input,
+    }, () => Promise.resolve(processes.read(input.processId)))));
+    server.registerTool("process_write", {
+        title: "Write process stdin",
+        description: "Write to stdin of a running process.",
+        inputSchema: z.object({ processId: z.string(), data: z.string() }),
+        outputSchema: processSnapshotSchema,
+        annotations: openWorldMutation,
+    }, mcpTool((input) => operations.run({
+        pluginId: "process",
+        source: "mcp",
+        action: "write",
+        processId: input.processId,
+        input,
+    }, () => Promise.resolve(processes.write(input.processId, input.data)))));
+    server.registerTool("process_kill", {
+        title: "Stop process",
+        description: "Terminate or force-kill a supervised process.",
+        inputSchema: z.object({
+            processId: z.string(),
+            force: z.boolean().default(false),
+        }),
+        outputSchema: processSnapshotSchema,
+        annotations: destructiveLocalMutation,
+    }, mcpTool((input) => operations.run({
+        pluginId: "process",
+        source: "mcp",
+        action: input.force ? "kill" : "terminate",
+        processId: input.processId,
+        input,
+    }, () => Promise.resolve(processes.kill(input.processId, input.force)))));
+}

package/dist/plugins/process/plugin.d.ts

@@ -0,0 +1,4 @@
+import type { InternalPlugin } from "../types.js";
+import { ProcessSupervisor } from "./process-supervisor.js";
+export declare const ProcessService: import("../types.js").ServiceToken<ProcessSupervisor>;
+export declare function createProcessPlugin(): InternalPlugin;

package/dist/plugins/process/plugin.js

@@ -0,0 +1,28 @@
+import { createServiceToken } from "../types.js";
+import { PipeProcessBackend } from "./infrastructure/pipe-process-backend.js";
+import { PtyProcessBackend } from "./infrastructure/pty-process-backend.js";
+import { registerProcessTools } from "./mcp.js";
+import { ProcessSupervisor } from "./process-supervisor.js";
+export const ProcessService = createServiceToken("process");
+export function createProcessPlugin() {
+    let service = null;
+    let operations = null;
+    return {
+        id: "process",
+        activate(context) {
+            service = new ProcessSupervisor({ pipe: new PipeProcessBackend(), pty: new PtyProcessBackend() }, context.operations, context.events, context.config.process.maxOutputBytes, context.config.process.defaultTimeoutMs, context.config.process.maxCompletedProcesses);
+            operations = context.operations;
+            context.services.provide(ProcessService, service);
+        },
+        registerMcp(server) {
+            if (!service || !operations)
+                throw new Error("Process plugin is not active");
+            registerProcessTools(server, service, operations);
+        },
+        async deactivate() {
+            await service?.shutdown();
+            service = null;
+            operations = null;
+        },
+    };
+}

package/dist/plugins/process/process-supervisor.d.ts

@@ -0,0 +1,36 @@
+import type { ProcessId, ProcessSnapshot, ProcessStartRequest } from "./types.js";
+import type { RuntimeEventBus } from "../../app/event-bus.js";
+import type { OperationLog } from "../../operations/operation-log.js";
+import type { OperationSource } from "../../core/operations/types.js";
+import type { ProcessBackend } from "./backend.js";
+interface ProcessOperationContext {
+    source: OperationSource;
+    action?: string;
+}
+export declare class ProcessSupervisor {
+    private readonly backends;
+    private readonly operations;
+    private readonly eventBus;
+    private readonly maxOutputBytes;
+    private readonly defaultTimeoutMs;
+    private readonly maxCompletedProcesses;
+    private readonly processes;
+    private shuttingDown;
+    constructor(backends: {
+        pipe: ProcessBackend;
+        pty: ProcessBackend;
+    }, operations: OperationLog, eventBus: RuntimeEventBus, maxOutputBytes: number, defaultTimeoutMs: number, maxCompletedProcesses: number);
+    start(request: ProcessStartRequest, operationContext: ProcessOperationContext): Promise<ProcessSnapshot>;
+    read(processId: ProcessId): ProcessSnapshot;
+    list(): ProcessSnapshot[];
+    write(processId: ProcessId, data: string): ProcessSnapshot;
+    kill(processId: ProcessId, force?: boolean): ProcessSnapshot;
+    shutdown(): Promise<void>;
+    private onOutput;
+    private onExit;
+    private trimCompletedProcesses;
+    private require;
+    private requireRunning;
+    private snapshotOf;
+}
+export {};

package/dist/plugins/process/process-supervisor.js

@@ -0,0 +1,232 @@
+/**
+ * Owns all ChatRoom-managed process lifecycle, timeout handling, output buffering, stdin, and process operation events.
+ * Platform-specific creation details are delegated to pipe/PTY backends.
+ */
+import { randomUUID } from "node:crypto";
+import { ChatRoomError } from "../../core/errors/chatroom-error.js";
+import { childEnvironment } from "../../core/runtime/child-environment.js";
+import { HeadTailBuffer } from "./head-tail-buffer.js";
+export class ProcessSupervisor {
+    backends;
+    operations;
+    eventBus;
+    maxOutputBytes;
+    defaultTimeoutMs;
+    maxCompletedProcesses;
+    processes = new Map();
+    shuttingDown = false;
+    constructor(backends, operations, eventBus, maxOutputBytes, defaultTimeoutMs, maxCompletedProcesses) {
+        this.backends = backends;
+        this.operations = operations;
+        this.eventBus = eventBus;
+        this.maxOutputBytes = maxOutputBytes;
+        this.defaultTimeoutMs = defaultTimeoutMs;
+        this.maxCompletedProcesses = maxCompletedProcesses;
+    }
+    async start(request, operationContext) {
+        if (this.shuttingDown)
+            throw new ChatRoomError("CONFLICT", "Process supervisor is shutting down");
+        const processId = `proc_${randomUUID()}`;
+        const args = request.args ?? [];
+        const operation = this.operations.start({
+            pluginId: "process",
+            source: operationContext.source,
+            action: operationContext.action ?? "start",
+            processId,
+            input: {
+                command: request.command,
+                args,
+                cwd: request.cwd,
+                pty: request.pty ?? false,
+                timeoutMs: request.timeoutMs ?? this.defaultTimeoutMs,
+                env: request.env ?? {},
+            },
+        });
+        let backend;
+        try {
+            // Child environments inherit only the runtime allowlist, then apply explicit request overrides.
+            backend = await (request.pty ? this.backends.pty : this.backends.pipe).start(request.command, args, {
+                cwd: request.cwd,
+                env: childEnvironment(request.env),
+            });
+        }
+        catch (error) {
+            this.operations.finish(operation.operationId, "error", null, error);
+            throw new ChatRoomError("PROCESS_FAILED", `Failed to start process: ${request.command}`, undefined, { cause: error });
+        }
+        let resolveSettled;
+        const settled = new Promise((resolve) => {
+            resolveSettled = resolve;
+        });
+        const managed = {
+            request,
+            backend,
+            stdout: new HeadTailBuffer(this.maxOutputBytes),
+            stderr: new HeadTailBuffer(this.maxOutputBytes),
+            state: "running",
+            startedAt: new Date(),
+            finishedAt: null,
+            exitCode: null,
+            signal: null,
+            timeout: null,
+            forceTimeout: null,
+            timedOut: false,
+            operationId: operation.operationId,
+            settled,
+            resolveSettled,
+        };
+        this.processes.set(processId, managed);
+        backend.onStdout((chunk) => this.onOutput(processId, "stdout", chunk));
+        backend.onStderr((chunk) => this.onOutput(processId, "stderr", chunk));
+        backend.onExit((exit) => this.onExit(processId, exit.exitCode, exit.signal));
+        const timeoutMs = request.timeoutMs ?? this.defaultTimeoutMs;
+        if (timeoutMs > 0)
+            managed.timeout = setTimeout(() => {
+                if (managed.state !== "running")
+                    return;
+                managed.timedOut = true;
+                // Timeouts first request graceful termination and escalate to SIGKILL only if the backend remains alive.
+                managed.backend.kill("SIGTERM");
+                managed.forceTimeout = setTimeout(() => {
+                    if (managed.state === "running")
+                        managed.backend.kill("SIGKILL");
+                }, 2000).unref();
+            }, timeoutMs).unref();
+        const snapshot = this.snapshotOf(processId, managed);
+        this.eventBus.emit({ type: "process", process: snapshot });
+        return snapshot;
+    }
+    read(processId) {
+        const item = this.require(processId);
+        return this.snapshotOf(processId, item);
+    }
+    list() {
+        return [...this.processes.entries()]
+            .map(([id, item]) => this.snapshotOf(id, item))
+            .sort((a, b) => b.startedAt.localeCompare(a.startedAt));
+    }
+    write(processId, data) {
+        const item = this.requireRunning(processId);
+        item.backend.write(data);
+        return this.snapshotOf(processId, item);
+    }
+    kill(processId, force = false) {
+        const item = this.requireRunning(processId);
+        item.backend.kill(force ? "SIGKILL" : "SIGTERM");
+        return this.snapshotOf(processId, item);
+    }
+    async shutdown() {
+        this.shuttingDown = true;
+        const running = [...this.processes.entries()].filter(([, item]) => item.state === "running");
+        for (const [, item] of running)
+            item.backend.kill("SIGTERM");
+        await Promise.race([
+            Promise.allSettled(running.map(([, item]) => item.settled)),
+            new Promise((resolve) => setTimeout(resolve, 1500)),
+        ]);
+        const survivors = running.filter(([, item]) => item.state === "running");
+        for (const [, item] of survivors)
+            item.backend.kill("SIGKILL");
+        if (survivors.length) {
+            await Promise.race([
+                Promise.allSettled(survivors.map(([, item]) => item.settled)),
+                new Promise((resolve) => setTimeout(resolve, 1500)),
+            ]);
+            // A backend that does not report close after SIGKILL must still be settled before SQLite closes.
+            for (const [processId, item] of survivors)
+                if (item.state === "running")
+                    this.onExit(processId, null, "SIGKILL");
+        }
+    }
+    onOutput(processId, stream, chunk) {
+        const item = this.processes.get(processId);
+        if (!item || item.state !== "running")
+            return;
+        // Store only bounded head/tail output while forwarding live chunks to SSE.
+        (stream === "stdout" ? item.stdout : item.stderr).append(chunk);
+        const text = chunk.toString("utf8");
+        this.eventBus.emit({
+            type: "process-output",
+            processId,
+            stream,
+            chunk: text,
+        });
+        const snapshot = this.snapshotOf(processId, item);
+        this.operations.updateRunning(item.operationId, {
+            stdout: snapshot.stdout,
+            stderr: snapshot.stderr,
+            outputTruncated: snapshot.outputTruncated,
+            pid: snapshot.pid,
+        });
+    }
+    onExit(processId, exitCode, signal) {
+        const item = this.processes.get(processId);
+        if (!item || item.state !== "running")
+            return;
+        if (item.timeout)
+            clearTimeout(item.timeout);
+        if (item.forceTimeout)
+            clearTimeout(item.forceTimeout);
+        // A signal is represented as killed/cancelled; otherwise zero means exited and non-zero means failed.
+        item.finishedAt = new Date();
+        item.exitCode = exitCode;
+        item.signal = signal;
+        item.state = signal ? "killed" : exitCode === 0 ? "exited" : "failed";
+        const snapshot = this.snapshotOf(processId, item);
+        this.operations.finish(item.operationId, exitCode === 0 && !signal ? "success" : signal ? "cancelled" : "error", {
+            stdout: snapshot.stdout,
+            stderr: snapshot.stderr,
+            exitCode,
+            signal,
+            durationMs: snapshot.durationMs,
+            outputTruncated: snapshot.outputTruncated,
+            timedOut: snapshot.timedOut,
+        }, exitCode === 0 && !signal
+            ? undefined
+            : { exitCode, signal, timedOut: snapshot.timedOut });
+        this.eventBus.emit({ type: "process", process: snapshot });
+        item.resolveSettled(snapshot);
+        this.trimCompletedProcesses();
+    }
+    trimCompletedProcesses() {
+        const completed = [...this.processes.entries()]
+            .filter(([, item]) => item.state !== "running")
+            .sort(([, a], [, b]) => b.startedAt.getTime() - a.startedAt.getTime());
+        for (const [processId] of completed.slice(this.maxCompletedProcesses)) {
+            this.processes.delete(processId);
+        }
+    }
+    require(processId) {
+        const item = this.processes.get(processId);
+        if (!item)
+            throw new ChatRoomError("NOT_FOUND", `Unknown ProcessId: ${processId}`);
+        return item;
+    }
+    requireRunning(processId) {
+        const item = this.require(processId);
+        if (item.state !== "running")
+            throw new ChatRoomError("CONFLICT", `Process is not running: ${processId}`);
+        return item;
+    }
+    snapshotOf(id, item) {
+        const stdout = item.stdout.snapshot(), stderr = item.stderr.snapshot(), finish = item.finishedAt?.getTime() ?? Date.now();
+        return {
+            processId: id,
+            command: item.request.command,
+            args: item.request.args ?? [],
+            cwd: item.request.cwd,
+            pid: item.backend.pid,
+            state: item.state,
+            startedAt: item.startedAt.toISOString(),
+            finishedAt: item.finishedAt?.toISOString() ?? null,
+            durationMs: Math.max(0, finish - item.startedAt.getTime()),
+            exitCode: item.exitCode,
+            signal: item.signal,
+            stdout: stdout.text,
+            stderr: stderr.text,
+            outputTruncated: stdout.outputTruncated || stderr.outputTruncated,
+            timedOut: item.timedOut,
+            operationId: item.operationId,
+        };
+    }
+}

package/dist/plugins/process/types.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Process lifecycle and request types shared above the platform-specific backend layer.
+ * ProcessId is independent from the OS PID and transport/session identity.
+ */
+type ProcessState = "running" | "exited" | "killed" | "failed";
+export type ProcessId = string;
+export interface ProcessStartRequest {
+    cwd: string;
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+    pty?: boolean;
+    timeoutMs?: number;
+}
+export interface ProcessSnapshot {
+    processId: ProcessId;
+    command: string;
+    args: string[];
+    cwd: string;
+    pid: number | null;
+    state: ProcessState;
+    startedAt: string;
+    finishedAt: string | null;
+    durationMs: number;
+    exitCode: number | null;
+    signal: string | null;
+    /** Bounded retained output rather than an unbounded transcript. */
+    stdout: string;
+    stderr: string;
+    outputTruncated: boolean;
+    timedOut: boolean;
+    operationId: string;
+}
+export {};

package/dist/plugins/process/types.js

@@ -0,0 +1 @@
+export {};

package/dist/plugins/types.d.ts

@@ -0,0 +1,32 @@
+import type { McpServer } from "@modelcontextprotocol/server";
+import type { ChatRoomConfig } from "../config/types.js";
+import type { AppDatabase } from "../infrastructure/database/app-database.js";
+import type { OperationLog } from "../operations/operation-log.js";
+import type { RuntimeEventBus } from "../app/event-bus.js";
+import type { ExternalAccessRegistry } from "../app/external-access-registry.js";
+export interface ServiceToken<T> {
+    readonly key: symbol;
+    readonly name: string;
+    /** Compile-time marker only; it is never set at runtime. */
+    readonly __type?: T;
+}
+export declare function createServiceToken<T>(name: string): ServiceToken<T>;
+export declare class ServiceRegistry {
+    private readonly values;
+    provide<T>(token: ServiceToken<T>, value: T): void;
+    require<T>(token: ServiceToken<T>): T;
+}
+export interface PluginContext {
+    config: ChatRoomConfig;
+    database: AppDatabase;
+    operations: OperationLog;
+    events: RuntimeEventBus;
+    externalAccess: ExternalAccessRegistry;
+    services: ServiceRegistry;
+}
+export interface InternalPlugin {
+    id: string;
+    activate(context: PluginContext): Promise<void> | void;
+    registerMcp?(server: McpServer): void;
+    deactivate?(): Promise<void> | void;
+}

package/dist/plugins/types.js

@@ -0,0 +1,17 @@
+export function createServiceToken(name) {
+    return { key: Symbol(name), name };
+}
+export class ServiceRegistry {
+    values = new Map();
+    provide(token, value) {
+        if (this.values.has(token.key))
+            throw new Error(`Service already provided: ${token.name}`);
+        this.values.set(token.key, value);
+    }
+    require(token) {
+        const value = this.values.get(token.key);
+        if (value === undefined)
+            throw new Error(`Required service unavailable: ${token.name}`);
+        return value;
+    }
+}

package/dist/plugins/web/api-types.d.ts

@@ -0,0 +1,10 @@
+import type { Operation as DomainOperation } from "../../core/operations/types.js";
+import type { GitInfo } from "../workspace/domain/git.js";
+import type { ProcessSnapshot } from "../process/types.js";
+import type { Workspace } from "../workspace/domain/workspace.js";
+import type { WorktreeApplyPreview, WorktreeFileDiff } from "../workspace/domain/review.js";
+export type { ProcessSnapshot, WorktreeApplyPreview, WorktreeFileDiff };
+export type Operation = DomainOperation;
+export interface WorkspaceView extends Workspace {
+    git?: GitInfo | null;
+}

package/dist/plugins/web/api-types.js

@@ -0,0 +1 @@
+export {};

package/dist/plugins/web/http/api-router.d.ts

@@ -0,0 +1,13 @@
+/** HTTP/JSON presentation adapter for runtime status, workspaces, operations, processes, and management actions. */
+import { Router } from "express";
+import type { WebRuntime } from "../runtime.js";
+import type { RuntimeEventBus } from "../../../app/event-bus.js";
+import type { AuthService } from "../../../auth/auth-service.js";
+import type { PasskeyService } from "../../../auth/passkey-service.js";
+import type { IngressPolicy } from "../../../auth/ingress-policy.js";
+import type { CloudController } from "../../cloud/controller.js";
+export declare function createApiRouter(application: WebRuntime, eventBus: RuntimeEventBus, auth: AuthService, passkeys: PasskeyService, ingress: IngressPolicy, cloud: CloudController, runtimeStatus: () => {
+    version: string;
+    mcpRequests: number;
+    uptimeMinutes: number;
+}): Router;

package/dist/plugins/web/http/api-router.js

@@ -0,0 +1,146 @@
+/** HTTP/JSON presentation adapter for runtime status, workspaces, operations, processes, and management actions. */
+import { Router } from "express";
+import { ChatRoomError } from "../../../core/errors/chatroom-error.js";
+import { asyncRoute, parseCookie, requireString, } from "../../../presentation/http/http-utils.js";
+import { createProcessApiRouter } from "./process-api-router.js";
+import { createWorkspaceApiRouter } from "./workspace-api-router.js";
+import { createCloudApiRouter } from "./cloud-api-router.js";
+const SESSION_COOKIE = "chatroom_session";
+export function createApiRouter(application, eventBus, auth, passkeys, ingress, cloud, runtimeStatus) {
+    const router = Router();
+    router.get("/auth/status", (req, res) => {
+        const token = parseCookie(req.headers.cookie, SESSION_COOKIE);
+        const enabled = ingress.requiresWebAuth(req);
+        const passkeyAvailable = Boolean(ingress.webAuthnOrigin(req));
+        res.json({
+            enabled,
+            authenticated: !enabled || Boolean(token && auth.verifyWebSession(token)),
+            passkeyAvailable,
+            passkeyRegistered: passkeyAvailable && passkeys.list().length > 0,
+        });
+    });
+    router.post("/auth/login", asyncRoute(async (req, res) => {
+        if (!ingress.requiresWebAuth(req)) {
+            res.json({ authenticated: true });
+            return;
+        }
+        const ownerToken = requireString(req.body?.ownerToken, "ownerToken");
+        const remember = req.body?.remember !== false;
+        const session = auth.createWebSession(ownerToken, remember);
+        setSessionCookie(res, session.token, session.maxAgeSeconds, ingress.secureWebCookie(req));
+        res.json({ authenticated: true, expiresAt: session.expiresAt });
+    }));
+    router.post("/auth/passkey/options", asyncRoute(async (req, res) => {
+        res.json(await passkeys.authenticationOptions(ingress.webAuthnOrigin(req)));
+    }));
+    router.post("/auth/passkey/verify", asyncRoute(async (req, res) => {
+        const body = req.body;
+        await passkeys.verifyAuthentication({
+            challengeId: requireString(body.challengeId, "challengeId"),
+            response: body.response,
+        });
+        const remember = body.remember !== false;
+        const session = auth.createPasskeyWebSession(remember);
+        setSessionCookie(res, session.token, session.maxAgeSeconds, ingress.secureWebCookie(req));
+        res.json({ authenticated: true, expiresAt: session.expiresAt });
+    }));
+    router.post("/auth/logout", (req, res) => {
+        const token = parseCookie(req.headers.cookie, SESSION_COOKIE);
+        if (token)
+            auth.revokeWebSession(token);
+        const secure = ingress.secureWebCookie(req) ? "; Secure" : "";
+        res.setHeader("Set-Cookie", `${SESSION_COOKIE}=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0${secure}`);
+        res.json({ authenticated: false });
+    });
+    router.use(apiAuthentication(auth, ingress));
+    router.get("/runtime", (_req, res) => res.json(runtimeStatus()));
+    router.get("/auth/passkeys", (_req, res) => res.json(passkeys.list()));
+    router.post("/auth/passkeys/register/options", asyncRoute(async (req, res) => {
+        res.json(await passkeys.registrationOptions(ingress.webAuthnOrigin(req)));
+    }));
+    router.post("/auth/passkeys/register/verify", asyncRoute(async (req, res) => {
+        const body = req.body;
+        res.status(201).json(await passkeys.verifyRegistration({
+            challengeId: requireString(body.challengeId, "challengeId"),
+            response: body.response,
+            ...(typeof body.name === "string" ? { name: body.name } : {}),
+        }));
+    }));
+    router.delete("/auth/passkeys/:credentialId", (req, res) => {
+        passkeys.remove(requireString(req.params.credentialId, "credentialId"));
+        res.status(204).end();
+    });
+    router.get("/operations", (req, res) => {
+        res.json(application.operations.list({
+            limit: numberQuery(req.query.limit, 100, 500),
+            offset: numberQuery(req.query.offset, 0, 100000),
+            ...(typeof req.query.pluginId === "string"
+                ? { pluginId: req.query.pluginId }
+                : {}),
+            ...(typeof req.query.status === "string"
+                ? { status: req.query.status }
+                : {}),
+            ...(typeof req.query.workspaceId === "string"
+                ? { workspaceId: req.query.workspaceId }
+                : {}),
+        }));
+    });
+    router.delete("/operations", (_req, res) => {
+        res.json(application.operations.clearHistory());
+    });
+    router.get("/operations/:operationId", (req, res) => {
+        const operationId = requireString(req.params.operationId, "operationId");
+        const event = application.operations.get(operationId);
+        if (!event)
+            throw new ChatRoomError("NOT_FOUND", "Operation not found");
+        res.json(event);
+    });
+    router.use(createWorkspaceApiRouter(application));
+    router.use(createProcessApiRouter(application));
+    router.use(createCloudApiRouter(cloud, application.operations));
+    router.get("/events", (req, res) => {
+        res.status(200);
+        res.setHeader("Content-Type", "text/event-stream");
+        res.setHeader("Cache-Control", "no-cache, no-transform");
+        res.setHeader("Connection", "keep-alive");
+        res.flushHeaders();
+        res.write(`event: ready\ndata: ${JSON.stringify({ time: new Date().toISOString() })}\n\n`);
+        const unsubscribe = eventBus.subscribe((event) => {
+            res.write(`event: runtime\ndata: ${JSON.stringify(event)}\n\n`);
+        });
+        const keepalive = setInterval(() => res.write(": keepalive\n\n"), 15000);
+        keepalive.unref();
+        req.on("close", () => {
+            clearInterval(keepalive);
+            unsubscribe();
+        });
+    });
+    return router;
+}
+function setSessionCookie(res, token, maxAgeSeconds, secureCookie) {
+    const secure = secureCookie ? "; Secure" : "";
+    const maxAge = maxAgeSeconds === null ? "" : `; Max-Age=${maxAgeSeconds}`;
+    res.setHeader("Set-Cookie", `${SESSION_COOKIE}=${encodeURIComponent(token)}; HttpOnly; SameSite=Strict; Path=/${maxAge}${secure}`);
+}
+function apiAuthentication(auth, ingress) {
+    return (req, res, next) => {
+        if (!ingress.requiresWebAuth(req)) {
+            next();
+            return;
+        }
+        const token = parseCookie(req.headers.cookie, SESSION_COOKIE);
+        if (token && auth.verifyWebSession(token)) {
+            next();
+            return;
+        }
+        res.status(401).json({
+            error: { code: "FORBIDDEN", message: "Authentication required" },
+        });
+    };
+}
+function numberQuery(value, fallback, max) {
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed >= 0
+        ? Math.min(parsed, max)
+        : fallback;
+}

package/dist/plugins/web/http/cloud-api-router.d.ts

@@ -0,0 +1,4 @@
+import { Router } from "express";
+import type { OperationLog } from "../../../operations/operation-log.js";
+import type { CloudController } from "../../cloud/controller.js";
+export declare function createCloudApiRouter(controller: CloudController, operations: OperationLog): Router;