@cloudagentfleet/hub 0.1.1

package/dist/cloudagentfleet-hub.mjs

@@ -0,0 +1,2675 @@
+#!/usr/bin/env node
+
+
+// apps/control-plane/src/server.ts
+import { createServer } from "node:http";
+import { existsSync as existsSync2 } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { resolve, dirname as dirname2, join as join2, sep } from "node:path";
+
+// packages/protocol/src/index.ts
+var DEFAULT_HEARTBEAT_TIMEOUT_MS = 45e3;
+var DEFAULT_PREVIEW_LEASE_MS = 15 * 6e4;
+function isCodemanSession(value) {
+  return isRecord(value) && isNonEmptyString(value.id) && isNonEmptyString(value.instanceId) && isNonEmptyString(value.workspaceId) && isCodemanAgentProfile(value.agent) && isNonEmptyString(value.title) && (value.status === "starting" || value.status === "working" || value.status === "waiting" || value.status === "idle" || value.status === "completed" || value.status === "failed" || value.status === "stopped") && typeof value.terminalBuffer === "string" && typeof value.needsInput === "boolean" && typeof value.previewAvailable === "boolean" && typeof value.browserAvailable === "boolean" && typeof value.createdAt === "string" && typeof value.lastEventAt === "string";
+}
+function validateCodemanSession(value) {
+  if (!isCodemanSession(value)) {
+    throw new TypeError("Invalid namespaced Codeman session");
+  }
+  return value;
+}
+function isCodemanSessionEvent(value) {
+  return isRecord(value) && isNonEmptyString(value.instanceId) && isNonEmptyString(value.sessionId) && (value.event === "created" || value.event === "started" || value.event === "output" || value.event === "waiting" || value.event === "idle" || value.event === "completed" || value.event === "failed" || value.event === "stopped") && (value.data === void 0 || typeof value.data === "string") && isNonEmptyString(value.createdAt);
+}
+function isCodemanInstance(value) {
+  return isRecord(value) && isNonEmptyString(value.id) && isNonEmptyString(value.label) && (value.connectionMode === "connector" || value.connectionMode === "tailscale-url") && (value.nodeId === void 0 || isNonEmptyString(value.nodeId)) && (value.endpoint === null || typeof value.endpoint === "string" && isSafeCodemanEndpoint(value.endpoint)) && (value.connectionMode !== "tailscale-url" || typeof value.endpoint === "string") && (value.workspacePolicy === void 0 || isWorkspacePolicy(value.workspacePolicy)) && (value.status === "online" || value.status === "offline" || value.status === "unhealthy" || value.status === "revoked") && Array.isArray(value.capabilities) && value.capabilities.every((capability) => typeof capability === "string") && Array.isArray(value.agents) && value.agents.every(isCodemanAgentProfile) && Array.isArray(value.workspaces) && value.workspaces.every(isWorkspaceDescriptor) && (value.lastSeenAt === null || typeof value.lastSeenAt === "string") && typeof value.createdAt === "string";
+}
+function validateCodemanInstance(value) {
+  if (!isCodemanInstance(value)) {
+    throw new TypeError("Invalid Codeman instance");
+  }
+  return value;
+}
+function validateCodemanInstanceRegistration(value) {
+  if (!isRecord(value) || !isNonEmptyString(value.id) || !isNonEmptyString(value.label) || value.connectionMode !== "connector" && value.connectionMode !== "tailscale-url" || value.connectionMode === "connector" && !isNonEmptyString(value.nodeId) || value.endpoint !== void 0 && (typeof value.endpoint !== "string" || !isSafeCodemanEndpoint(value.endpoint)) || value.workspacePolicy !== void 0 && !isWorkspacePolicy(value.workspacePolicy) || value.connectionMode === "tailscale-url" && typeof value.endpoint !== "string") {
+    throw new TypeError("Invalid Codeman instance registration");
+  }
+  if (value.capabilities !== void 0 && (!Array.isArray(value.capabilities) || !value.capabilities.every((capability) => typeof capability === "string")) || value.agents !== void 0 && (!Array.isArray(value.agents) || !value.agents.every(isCodemanAgentProfile)) || value.workspaces !== void 0 && (!Array.isArray(value.workspaces) || !value.workspaces.every(isWorkspaceDescriptor))) {
+    throw new TypeError("Invalid Codeman instance registration");
+  }
+  return value;
+}
+function isCodemanConnectorResponse(value) {
+  return isRecord(value) && value.type === "codeman.response" && isNonEmptyString(value.requestId) && isNonEmptyString(value.instanceId) && typeof value.success === "boolean" && (value.success || isNonEmptyString(value.error)) && (value.error === void 0 || isNonEmptyString(value.error)) && (value.errorCode === void 0 || isNonEmptyString(value.errorCode));
+}
+function isCodemanConnectorSessionEvent(value) {
+  return isRecord(value) && value.type === "codeman.session.event" && isNonEmptyString(value.instanceId) && isCodemanSessionEvent(value.event) && value.event.instanceId === value.instanceId;
+}
+function validateCodemanConnectorResponse(value) {
+  if (!isCodemanConnectorResponse(value)) {
+    throw new TypeError("Invalid Codeman connector response");
+  }
+  return value;
+}
+function validateCodemanConnectorSessionEvent(value) {
+  if (!isCodemanConnectorSessionEvent(value)) {
+    throw new TypeError("Invalid Codeman connector session event");
+  }
+  return value;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function isSafeCodemanEndpoint(value) {
+  try {
+    const endpoint = new URL(value);
+    const hasNoEmbeddedCredentials = endpoint.username === "" && endpoint.password === "";
+    return hasNoEmbeddedCredentials && (endpoint.protocol === "https:" || endpoint.protocol === "http:" && (endpoint.hostname === "localhost" || endpoint.hostname === "127.0.0.1" || endpoint.hostname === "::1" || endpoint.hostname === "[::1]"));
+  } catch {
+    return false;
+  }
+}
+function isCodemanAgentProfile(value) {
+  return isRecord(value) && isNonEmptyString(value.id) && isNonEmptyString(value.name) && isCodemanAgentMode(value.mode) && typeof value.ready === "boolean";
+}
+function isCodemanAgentMode(value) {
+  return value === "claude" || value === "shell" || value === "opencode" || value === "codex" || value === "gemini" || value === "antigravity" || value === "pi" || value === "grok" || value === "deepseek";
+}
+function isWorkspaceDescriptor(value) {
+  return isRecord(value) && isNonEmptyString(value.id) && isNonEmptyString(value.name) && isNonEmptyString(value.canonicalPath) && (value.health === "ready" || value.health === "missing" || value.health === "unreadable") && isRecord(value.providers) && Object.values(value.providers).every(
+    (provider) => provider === "ready" || provider === "missing" || provider === "unauthenticated" || provider === "unavailable"
+  );
+}
+function isWorkspacePolicy(value) {
+  return isRecord(value) && (value.mode === "folders" || value.mode === "system") && Array.isArray(value.roots) && value.roots.every((root) => isNonEmptyString(root));
+}
+
+// packages/protocol/src/lifecycle.ts
+var defaultClock = () => /* @__PURE__ */ new Date();
+function id(prefix) {
+  return `${prefix}_${crypto.randomUUID()}`;
+}
+function providerCapability(provider) {
+  if (provider === "codeman") return "codeman";
+  if (provider === "cursor") return "cursor-worker";
+  return "claude-runner";
+}
+var NodeRegistry = class {
+  nodes = /* @__PURE__ */ new Map();
+  clock;
+  heartbeatTimeoutMs;
+  constructor(clock = defaultClock, heartbeatTimeoutMs = DEFAULT_HEARTBEAT_TIMEOUT_MS) {
+    this.clock = clock;
+    this.heartbeatTimeoutMs = heartbeatTimeoutMs;
+  }
+  enroll(registration) {
+    const now = this.clock().toISOString();
+    const existing = this.nodes.get(registration.nodeId);
+    if (existing?.status === "revoked") {
+      throw new Error(`Node is revoked: ${registration.nodeId}`);
+    }
+    const node = {
+      id: registration.nodeId,
+      name: registration.name,
+      platform: registration.platform,
+      status: "online",
+      capabilities: [...new Set(registration.capabilities)],
+      labels: { ...registration.labels },
+      workspacePolicy: registration.workspacePolicy ?? { mode: "folders", roots: [] },
+      workspaces: [...registration.workspaces ?? []],
+      lastSeenAt: now
+    };
+    this.nodes.set(node.id, node);
+    return node;
+  }
+  heartbeat(heartbeat) {
+    const node = this.nodes.get(heartbeat.nodeId);
+    if (!node) throw new Error(`Unknown node: ${heartbeat.nodeId}`);
+    if (node.status === "revoked") throw new Error(`Node is revoked: ${node.id}`);
+    const updated = {
+      ...node,
+      status: "online",
+      capabilities: [...new Set(heartbeat.capabilities)],
+      lastSeenAt: heartbeat.sentAt
+    };
+    this.nodes.set(updated.id, updated);
+    return updated;
+  }
+  markOffline(now = this.clock()) {
+    for (const node of this.nodes.values()) {
+      if (node.status !== "online" || !node.lastSeenAt) continue;
+      const age = now.getTime() - Date.parse(node.lastSeenAt);
+      if (age > this.heartbeatTimeoutMs) {
+        this.nodes.set(node.id, { ...node, status: "offline" });
+      }
+    }
+  }
+  revoke(nodeId) {
+    const node = this.require(nodeId);
+    const revoked = { ...node, status: "revoked" };
+    this.nodes.set(nodeId, revoked);
+    return revoked;
+  }
+  select(provider, requestedNodeId) {
+    if (requestedNodeId) {
+      const node2 = this.require(requestedNodeId);
+      this.assertSchedulable(node2, provider);
+      return node2;
+    }
+    const capability = providerCapability(provider);
+    const node = [...this.nodes.values()].find(
+      (candidate) => candidate.status === "online" && candidate.capabilities.includes(capability)
+    );
+    if (!node) throw new Error(`No online node supports provider: ${provider}`);
+    return node;
+  }
+  selectWorkspace(nodeId, workspaceId, provider) {
+    const node = this.require(nodeId);
+    this.assertSchedulable(node, provider);
+    const workspace = node.workspaces.find((candidate) => candidate.id === workspaceId);
+    if (!workspace) throw new Error(`Unknown workspace: ${workspaceId}`);
+    if (workspace.health !== "ready") {
+      throw new Error(`Workspace is not ready: ${workspaceId}`);
+    }
+    if (workspace.providers[provider] !== "ready") {
+      throw new Error(`Provider is not ready for workspace: ${provider}`);
+    }
+    return workspace;
+  }
+  list() {
+    return [...this.nodes.values()].map((node) => ({
+      ...node,
+      capabilities: [...node.capabilities],
+      labels: { ...node.labels },
+      workspacePolicy: { ...node.workspacePolicy, roots: [...node.workspacePolicy.roots] },
+      workspaces: node.workspaces.map((workspace) => ({
+        ...workspace,
+        providers: { ...workspace.providers }
+      }))
+    }));
+  }
+  require(nodeId) {
+    const node = this.nodes.get(nodeId);
+    if (!node) throw new Error(`Unknown node: ${nodeId}`);
+    return node;
+  }
+  assertSchedulable(node, provider) {
+    if (node.status !== "online") throw new Error(`Node is not online: ${node.id}`);
+    if (!node.capabilities.includes(providerCapability(provider))) {
+      throw new Error(`Node does not support provider: ${provider}`);
+    }
+  }
+};
+var JobStore = class {
+  jobs = /* @__PURE__ */ new Map();
+  byIdempotencyKey = /* @__PURE__ */ new Map();
+  clock;
+  constructor(clock = defaultClock) {
+    this.clock = clock;
+  }
+  create(request, nodeId) {
+    const existingId = this.byIdempotencyKey.get(request.idempotencyKey);
+    if (existingId) return this.require(existingId);
+    const job = {
+      id: id("job"),
+      provider: request.provider,
+      nodeId,
+      workspaceId: request.workspaceId,
+      prompt: request.prompt,
+      status: "queued",
+      idempotencyKey: request.idempotencyKey,
+      createdAt: this.clock().toISOString()
+    };
+    this.jobs.set(job.id, job);
+    this.byIdempotencyKey.set(job.idempotencyKey, job.id);
+    return job;
+  }
+  start(jobId) {
+    return this.update(jobId, { status: "running" });
+  }
+  complete(jobId) {
+    return this.update(jobId, { status: "completed" });
+  }
+  fail(jobId) {
+    return this.update(jobId, { status: "failed" });
+  }
+  cancel(jobId) {
+    const job = this.require(jobId);
+    if (job.status === "completed" || job.status === "failed") {
+      throw new Error(`Cannot cancel terminal job: ${job.id}`);
+    }
+    return this.update(jobId, { status: "cancelled" });
+  }
+  get(jobId) {
+    return this.jobs.get(jobId);
+  }
+  getByIdempotencyKey(idempotencyKey) {
+    const jobId = this.byIdempotencyKey.get(idempotencyKey);
+    return jobId ? this.jobs.get(jobId) : void 0;
+  }
+  update(jobId, patch) {
+    const job = this.require(jobId);
+    const updated = { ...job, ...patch };
+    this.jobs.set(jobId, updated);
+    return updated;
+  }
+  require(jobId) {
+    const job = this.jobs.get(jobId);
+    if (!job) throw new Error(`Unknown job: ${jobId}`);
+    return job;
+  }
+};
+var AuditLog = class {
+  events = [];
+  clock;
+  constructor(clock = defaultClock) {
+    this.clock = clock;
+  }
+  append(type, actor, resourceId, metadata = {}) {
+    const event = {
+      id: id("audit"),
+      type,
+      actor,
+      resourceId,
+      createdAt: this.clock().toISOString(),
+      metadata: { ...metadata }
+    };
+    this.events.push(event);
+    return event;
+  }
+  list() {
+    return this.events.map((event) => ({
+      ...event,
+      metadata: { ...event.metadata }
+    }));
+  }
+};
+
+// apps/control-plane/src/index.ts
+var ControlPlane = class {
+  nodes;
+  jobs;
+  audit;
+  connections = /* @__PURE__ */ new Map();
+  connectorRequests = /* @__PURE__ */ new Map();
+  connectorEventListeners = /* @__PURE__ */ new Map();
+  constructor() {
+    this.nodes = new NodeRegistry();
+    this.jobs = new JobStore();
+    this.audit = new AuditLog();
+  }
+  enrollNode(registration) {
+    const node = this.nodes.enroll(registration);
+    this.audit.append("node.enrolled", "node", node.id, { name: node.name });
+    return node;
+  }
+  heartbeatNode(heartbeat) {
+    const node = this.nodes.heartbeat(heartbeat);
+    this.audit.append("node.heartbeat", "node", node.id);
+    return node;
+  }
+  registerConnection(connection) {
+    if (connection.node.status === "revoked") {
+      throw new Error(`Cannot register revoked node: ${connection.node.id}`);
+    }
+    const existing = this.connections.get(connection.node.id);
+    void existing?.close();
+    if (existing) this.rejectConnectorRequests(connection.node.id, "Worker connection replaced");
+    this.connections.set(connection.node.id, connection);
+  }
+  removeConnection(nodeId, connection) {
+    if (connection && this.connections.get(nodeId) !== connection) return;
+    this.connections.delete(nodeId);
+    this.rejectConnectorRequests(nodeId, `Worker connection closed: ${nodeId}`);
+  }
+  receiveNodeMessage(nodeId, message) {
+    if (message.type === "codeman.response") {
+      this.receiveConnectorResponse(nodeId, message);
+      return;
+    }
+    if (message.type === "codeman.session.event") {
+      this.receiveConnectorEvent(nodeId, message);
+      return;
+    }
+    if (message.type === "heartbeat") {
+      this.heartbeatNode({ ...message, nodeId });
+      return;
+    }
+    if (message.type !== "job.accept" && message.type !== "job.event") return;
+    const jobId = message.jobId;
+    const job = this.jobs.get(jobId);
+    if (!job) throw new Error(`Unknown job: ${jobId}`);
+    if (job.nodeId !== nodeId) {
+      throw new Error(`Job ${jobId} is assigned to a different node`);
+    }
+    if (message.type === "job.accept") {
+      this.jobs.start(jobId);
+      return;
+    }
+    if (message.event === "started") {
+      this.jobs.start(jobId);
+      this.audit.append("job.started", "node", jobId, { nodeId });
+    } else if (message.event === "completed") {
+      this.jobs.complete(jobId);
+      this.audit.append("job.completed", "node", jobId, { nodeId });
+    } else if (message.event === "failed") {
+      this.jobs.fail(jobId);
+      this.audit.append("job.failed", "node", jobId, { nodeId });
+    } else if (message.event === "cancelled") {
+      if (job.status !== "cancelled") this.jobs.cancel(jobId);
+      this.audit.append("job.cancelled", "node", jobId, { nodeId });
+    }
+  }
+  async requestConnector(nodeId, instanceId, operation, payload, timeoutMs = 15e3) {
+    const connection = this.connections.get(nodeId);
+    if (!connection) throw new Error(`Node has no active connection: ${nodeId}`);
+    if (connection.node.status === "revoked") {
+      throw new Error(`Node is revoked: ${nodeId}`);
+    }
+    const requestId = crypto.randomUUID();
+    const request = {
+      type: "codeman.request",
+      requestId,
+      instanceId,
+      operation,
+      ...payload === void 0 ? {} : { payload }
+    };
+    const result = new Promise((resolve2, reject) => {
+      const timer = setTimeout(() => {
+        this.connectorRequests.delete(requestId);
+        reject(new Error(`Connector request timed out: ${operation}`));
+      }, timeoutMs);
+      this.connectorRequests.set(requestId, {
+        nodeId,
+        instanceId,
+        timer,
+        resolve: resolve2,
+        reject
+      });
+    });
+    try {
+      await connection.send(request);
+    } catch (error) {
+      const pending = this.connectorRequests.get(requestId);
+      if (pending) {
+        clearTimeout(pending.timer);
+        this.connectorRequests.delete(requestId);
+        pending.reject(error instanceof Error ? error : new Error("Connector request failed"));
+      }
+    }
+    return result;
+  }
+  subscribeConnectorEvents(nodeId, instanceId, listener) {
+    const key = connectorKey(nodeId, instanceId);
+    const listeners = this.connectorEventListeners.get(key) ?? /* @__PURE__ */ new Set();
+    listeners.add(listener);
+    this.connectorEventListeners.set(key, listeners);
+    return () => {
+      listeners.delete(listener);
+      if (listeners.size === 0) this.connectorEventListeners.delete(key);
+    };
+  }
+  receiveConnectorResponse(nodeId, message) {
+    validateCodemanConnectorResponse(message);
+    const pending = this.connectorRequests.get(message.requestId);
+    if (!pending) throw new Error(`Unknown connector request: ${message.requestId}`);
+    if (pending.nodeId !== nodeId || pending.instanceId !== message.instanceId) {
+      throw new Error("Connector response authorization failed");
+    }
+    clearTimeout(pending.timer);
+    this.connectorRequests.delete(message.requestId);
+    if (message.success) {
+      pending.resolve(message.data);
+    } else {
+      pending.reject(new Error(message.error ?? "Connector request failed"));
+    }
+  }
+  receiveConnectorEvent(nodeId, message) {
+    validateCodemanConnectorSessionEvent(message);
+    const listeners = this.connectorEventListeners.get(connectorKey(nodeId, message.instanceId));
+    if (!listeners) return;
+    for (const listener of listeners) listener(message.event);
+  }
+  rejectConnectorRequests(nodeId, reason) {
+    for (const [requestId, pending] of this.connectorRequests) {
+      if (pending.nodeId !== nodeId) continue;
+      clearTimeout(pending.timer);
+      pending.reject(new Error(reason));
+      this.connectorRequests.delete(requestId);
+    }
+  }
+  async createJob(request) {
+    const existing = this.jobs.getByIdempotencyKey(request.idempotencyKey);
+    if (existing) return existing;
+    const node = this.nodes.select(request.provider, request.nodeId);
+    this.nodes.selectWorkspace(node.id, request.workspaceId, request.provider);
+    const connection = this.connections.get(node.id);
+    if (!connection) throw new Error(`Node has no active connection: ${node.id}`);
+    const job = this.jobs.create(request, node.id);
+    this.audit.append("job.created", "operator", job.id, {
+      nodeId: node.id,
+      provider: job.provider
+    });
+    await connection.send({ type: "job.assign", job });
+    return job;
+  }
+  async cancelJob(jobId) {
+    const job = this.jobs.cancel(jobId);
+    const connection = job.nodeId ? this.connections.get(job.nodeId) : void 0;
+    if (connection) await connection.send({ type: "job.cancel", jobId });
+    this.audit.append("job.cancelled", "operator", jobId);
+  }
+  revokeNode(nodeId) {
+    const node = this.nodes.revoke(nodeId);
+    this.audit.append("node.revoked", "operator", nodeId);
+    void this.connections.get(nodeId)?.close();
+    this.connections.delete(nodeId);
+    return node;
+  }
+};
+function connectorKey(nodeId, instanceId) {
+  return `${nodeId}\0${instanceId}`;
+}
+
+// packages/codeman-bridge/src/index.ts
+import { createHash, randomBytes } from "node:crypto";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+var CodemanHttpAdapter = class {
+  instance;
+  fetchImpl;
+  headers;
+  listeners = /* @__PURE__ */ new Set();
+  eventAbort;
+  inputSequence = Date.now();
+  constructor(options) {
+    this.instance = validateCodemanInstance(options.instance);
+    if (!this.instance.endpoint) throw new Error("Codeman HTTP adapter requires an endpoint");
+    const endpoint = new URL(this.instance.endpoint);
+    if (endpoint.protocol !== "https:" && endpoint.hostname !== "localhost" && endpoint.hostname !== "127.0.0.1" && endpoint.hostname !== "::1" && endpoint.hostname !== "[::1]") {
+      throw new Error("Codeman endpoint must use HTTPS or loopback HTTP");
+    }
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.headers = { accept: "application/json" };
+    if (options.username !== void 0 || options.password !== void 0) {
+      if (!options.username || options.password === void 0) {
+        throw new Error("Codeman username and password must be provided together");
+      }
+      this.headers.authorization = `Basic ${Buffer.from(`${options.username}:${options.password}`).toString("base64")}`;
+    }
+  }
+  async listWorkspaces() {
+    return this.instance.workspaces;
+  }
+  async listWorkspacePathSuggestions(prefix) {
+    const trimmed = prefix.trim();
+    const normalizedPrefix = trimmed.toLowerCase();
+    const suggestions = /* @__PURE__ */ new Map();
+    const add = (path, name) => {
+      const key = path.replaceAll("\\", "/").toLowerCase();
+      if (!suggestions.has(key)) suggestions.set(key, { path, name });
+    };
+    for (const workspace of this.instance.workspaces) {
+      if (workspace.health !== "ready") continue;
+      add(workspace.canonicalPath, workspace.name);
+    }
+    const roots = this.instance.workspacePolicy?.roots ?? [];
+    for (const root of roots) {
+      const segments = root.replaceAll("\\", "/").split("/").filter(Boolean);
+      add(root, segments.at(-1) ?? root);
+    }
+    return [...suggestions.values()].filter((suggestion) => {
+      if (!normalizedPrefix) return true;
+      const path = suggestion.path.toLowerCase();
+      return path.startsWith(normalizedPrefix) || suggestion.name.toLowerCase().startsWith(normalizedPrefix) || normalizedPrefix.startsWith(path);
+    }).slice(0, 50);
+  }
+  async getStatus() {
+    const data = await this.requestData("/api/v1/status");
+    const status = {};
+    if (typeof data.version === "string") status.version = data.version;
+    if (typeof data.sessions === "number") status.sessions = data.sessions;
+    if (Array.isArray(data.capabilities)) {
+      status.capabilities = data.capabilities.filter(
+        (capability) => typeof capability === "string"
+      );
+    }
+    if (Array.isArray(data.agents)) {
+      status.agents = data.agents.map((agent) => this.toAgent(agent));
+    }
+    return status;
+  }
+  async listCapabilities() {
+    const status = await this.getStatus();
+    if (status.agents && status.agents.length > 0) return status.agents;
+    if (status.capabilities && status.capabilities.length > 0) {
+      return status.capabilities.map((capability) => this.toAgent(capability));
+    }
+    return this.instance.agents.map((agent) => ({ ...agent }));
+  }
+  async listSessions() {
+    const data = await this.requestData(
+      "/api/v1/sessions"
+    );
+    const sessions = Array.isArray(data) ? data : data.sessions ?? [];
+    return Promise.all(sessions.map(async (session) => {
+      const normalized = this.toSession(session);
+      const terminal = await this.readTerminal(normalized.id);
+      return terminal ? {
+        ...normalized,
+        status: this.statusFromCodeman(terminal.status ?? String(session.status ?? "")),
+        terminalBuffer: terminal.terminalBuffer === void 0 ? normalized.terminalBuffer : terminal.terminalBuffer
+      } : normalized;
+    }));
+  }
+  async createSession(workspace, agent, title = `${agent.name} \xB7 ${workspace.name}`) {
+    const data = await this.requestData("/api/v1/sessions", {
+      method: "POST",
+      body: {
+        workingDir: workspace.canonicalPath,
+        mode: agent.mode,
+        name: title
+      }
+    });
+    const session = this.toSession(
+      data.session ?? data,
+      workspace.id,
+      agent
+    );
+    await this.request(`/api/v1/sessions/${encodeURIComponent(session.id)}/interactive`, {
+      method: "POST"
+    });
+    this.emit(this.event(session.id, "started", void 0, session.lastEventAt));
+    return { ...session, status: "working" };
+  }
+  async sendInput(sessionId, input, raw = false) {
+    await this.request(`/api/v1/sessions/${encodeURIComponent(sessionId)}/input`, {
+      method: "POST",
+      body: {
+        input: raw ? input : `${input.replaceAll(/\r?\n/g, " ")}${input.endsWith("\r") ? "" : "\r"}`,
+        useMux: !raw,
+        clientId: `hosted-agents-${this.instance.id}`,
+        seq: ++this.inputSequence
+      }
+    });
+  }
+  async resize(sessionId, cols, rows) {
+    await this.request(`/api/v1/sessions/${encodeURIComponent(sessionId)}/resize`, {
+      method: "POST",
+      body: { cols, rows, viewportType: "desktop" }
+    });
+  }
+  async stopSession(sessionId) {
+    await this.request(`/api/v1/sessions/${encodeURIComponent(sessionId)}`, {
+      method: "DELETE"
+    });
+    this.emit(this.event(sessionId, "stopped", void 0, (/* @__PURE__ */ new Date()).toISOString()));
+  }
+  async proxyTerminal(sessionId, request, clientSocket, head) {
+    const endpoint = new URL(this.instance.endpoint);
+    const websocketPath = `/ws/sessions/${encodeURIComponent(sessionId)}/terminal`;
+    const query = typeof request.url === "string" ? new URL(request.url, "http://controller.local").search : "";
+    const transport = endpoint.protocol === "https:" ? httpsRequest : httpRequest;
+    const upstreamKey = randomBytes(16).toString("base64");
+    const browserKey = request.headers["sec-websocket-key"];
+    if (typeof browserKey !== "string") {
+      rejectSocket(clientSocket, 400, "Missing WebSocket key");
+      return;
+    }
+    const headers = {
+      connection: "Upgrade",
+      upgrade: "websocket",
+      "sec-websocket-version": "13",
+      "sec-websocket-key": upstreamKey
+    };
+    if (this.basicAuthorization) headers.authorization = this.basicAuthorization;
+    const upstreamRequest = transport({
+      hostname: endpoint.hostname,
+      port: endpoint.port || void 0,
+      path: `${websocketPath}${query}`,
+      method: "GET",
+      headers,
+      rejectUnauthorized: endpoint.protocol !== "https:" || endpoint.hostname === "localhost"
+    });
+    upstreamRequest.once("upgrade", (response, upstreamSocket, upstreamHead) => {
+      if (response.statusCode !== 101) {
+        upstreamSocket.destroy();
+        rejectSocket(clientSocket, response.statusCode ?? 502, "Codeman WebSocket rejected");
+        return;
+      }
+      const accept = createHash("sha1").update(`${browserKey}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`).digest("base64");
+      clientSocket.write(
+        `HTTP/1.1 101 Switching Protocols\r
+Upgrade: websocket\r
+Connection: Upgrade\r
+Sec-WebSocket-Accept: ${accept}\r
+\r
+`
+      );
+      if (head.length > 0) upstreamSocket.write(head);
+      if (upstreamHead.length > 0) clientSocket.write(upstreamHead);
+      relaySockets(clientSocket, upstreamSocket);
+    });
+    upstreamRequest.once("response", (response) => {
+      response.resume();
+      rejectSocket(clientSocket, response.statusCode ?? 502, "Codeman WebSocket unavailable");
+    });
+    upstreamRequest.once("error", () => rejectSocket(clientSocket, 502, "Codeman WebSocket unavailable"));
+    upstreamRequest.end();
+  }
+  async ensureNativeCases() {
+    const workspaces = this.instance.workspaces.filter(
+      (workspace) => typeof workspace.canonicalPath === "string" && workspace.canonicalPath.length > 0
+    );
+    if (workspaces.length === 0) return;
+    let existingNames = /* @__PURE__ */ new Set();
+    try {
+      const data = await this.requestData("/api/cases");
+      const cases = Array.isArray(data) ? data : isRecord2(data) && Array.isArray(data.cases) ? data.cases : [];
+      existingNames = new Set(
+        cases.map((entry) => isRecord2(entry) ? String(entry.name ?? "") : "").filter(Boolean)
+      );
+    } catch {
+      return;
+    }
+    for (const workspace of workspaces) {
+      const candidates = uniqueCaseNames(workspace.name, workspace.id);
+      if (candidates.some((name2) => existingNames.has(name2))) continue;
+      const name = candidates[0];
+      try {
+        await this.request("/api/cases/link", {
+          method: "POST",
+          body: { name, path: workspace.canonicalPath }
+        });
+        existingNames.add(name);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "";
+        if (/already exists/i.test(message)) {
+          existingNames.add(name);
+          continue;
+        }
+      }
+    }
+  }
+  async proxyHttp(request, response) {
+    const endpoint = new URL(this.instance.endpoint);
+    const requestUrl = new URL(request.url ?? "/", "http://controller.local");
+    const transport = endpoint.protocol === "https:" ? httpsRequest : httpRequest;
+    const headers = {};
+    for (const [name, value] of Object.entries(request.headers)) {
+      if (name === "host" || name === "authorization" || name === "cookie" || name === "connection" || name === "upgrade" || name === "origin" || name === "referer" || name.startsWith("x-forwarded-")) continue;
+      if (typeof value === "string") headers[name] = value;
+      else if (Array.isArray(value)) headers[name] = value.join(", ");
+    }
+    headers["accept-encoding"] = "identity";
+    if (this.basicAuthorization) headers.authorization = this.basicAuthorization;
+    const upstreamRequest = transport({
+      hostname: endpoint.hostname,
+      port: endpoint.port || void 0,
+      path: `${requestUrl.pathname}${requestUrl.search}`,
+      method: request.method ?? "GET",
+      headers,
+      rejectUnauthorized: endpoint.protocol !== "https:" || endpoint.hostname === "localhost"
+    }, (upstreamResponse) => {
+      const isHtml = String(upstreamResponse.headers["content-type"] ?? "").includes("text/html");
+      const responseHeaders = {};
+      for (const [name, value] of Object.entries(upstreamResponse.headers)) {
+        if (value === void 0 || name === "set-cookie" || name === "connection" || isHtml && (name === "content-length" || name === "content-encoding")) continue;
+        responseHeaders[name] = value;
+      }
+      const location = responseHeaders.location;
+      if (typeof location === "string") {
+        try {
+          const redirected = new URL(location, endpoint);
+          responseHeaders.location = `${redirected.pathname}${redirected.search}${redirected.hash}`;
+        } catch {
+        }
+      }
+      if (isHtml) {
+        const chunks = [];
+        upstreamResponse.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+        upstreamResponse.on("end", () => {
+          const html = Buffer.concat(chunks).toString("utf8");
+          const injected = html.includes("</body>") ? html.replace("</body>", '<script src="/fleet-host-switcher.js"></script></body>') : `${html}<script src="/fleet-host-switcher.js"></script>`;
+          responseHeaders["content-type"] = "text/html; charset=utf-8";
+          response.writeHead(upstreamResponse.statusCode ?? 502, responseHeaders);
+          response.end(injected);
+        });
+        return;
+      }
+      response.writeHead(upstreamResponse.statusCode ?? 502, responseHeaders);
+      upstreamResponse.pipe(response);
+    });
+    upstreamRequest.once("error", () => {
+      if (!response.headersSent) {
+        response.writeHead(502, { "content-type": "application/json; charset=utf-8" });
+        response.end(JSON.stringify({ error: "Codeman request unavailable" }));
+      } else {
+        response.destroy();
+      }
+    });
+    request.pipe(upstreamRequest);
+  }
+  subscribeEvents(onEvent) {
+    this.listeners.add(onEvent);
+    if (!this.eventAbort) void this.startEventStream();
+    return () => {
+      this.listeners.delete(onEvent);
+      if (this.listeners.size === 0) {
+        this.eventAbort?.abort();
+        this.eventAbort = void 0;
+      }
+    };
+  }
+  async startEventStream() {
+    const abort = new AbortController();
+    this.eventAbort = abort;
+    const response = await this.fetchImpl(`${this.baseUrl()}/api/v1/events`, {
+      headers: { ...this.headers, accept: "text/event-stream" },
+      signal: abort.signal
+    }).catch(() => void 0);
+    if (!response?.ok || !response.body) {
+      if (this.eventAbort === abort) this.eventAbort = void 0;
+      return;
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    try {
+      while (!abort.signal.aborted) {
+        const result = await reader.read();
+        if (result.done) break;
+        buffer += decoder.decode(result.value, { stream: true });
+        let boundary = sseBoundary(buffer);
+        while (boundary) {
+          const raw = buffer.slice(0, boundary.index);
+          buffer = buffer.slice(boundary.index + boundary.length);
+          boundary = sseBoundary(buffer);
+          const data = raw.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n");
+          if (!data) continue;
+          const eventName = raw.split(/\r?\n/).find((line) => line.startsWith("event:"))?.slice("event:".length).trim();
+          let event;
+          try {
+            const parsed = JSON.parse(data);
+            const payload = isRecord2(parsed) ? parsed : { data: parsed };
+            if (eventName && payload.type === void 0 && payload.event === void 0) {
+              payload.type = eventName;
+            }
+            event = this.toEvent(payload);
+          } catch {
+            event = void 0;
+          }
+          if (event) this.emit(event);
+        }
+      }
+    } catch {
+      if (!abort.signal.aborted) {
+      }
+    } finally {
+      reader.releaseLock();
+      if (this.eventAbort === abort) this.eventAbort = void 0;
+    }
+  }
+  async readTerminal(sessionId) {
+    try {
+      return await this.requestData(
+        `/api/v1/sessions/${encodeURIComponent(sessionId)}/terminal?tail=20000`
+      );
+    } catch {
+      return void 0;
+    }
+  }
+  toSession(raw, workspaceId, agent) {
+    const id2 = String(raw.id ?? "");
+    if (!id2) throw new Error("Codeman returned a session without an ID");
+    const resolvedWorkspaceId = workspaceId ?? this.workspaceIdForPath(String(raw.workspaceId ?? raw.workingDir ?? ""));
+    const resolvedAgent = agent ?? this.agentFromMode(String(raw.mode ?? "shell"));
+    const createdAt = this.timestamp(raw.createdAt ?? raw.created_at);
+    return {
+      id: id2,
+      instanceId: this.instance.id,
+      workspaceId: resolvedWorkspaceId,
+      agent: resolvedAgent,
+      title: String(raw.name ?? id2),
+      status: this.statusFromCodeman(String(raw.status ?? "idle")),
+      terminalBuffer: String(raw.terminalBuffer ?? ""),
+      needsInput: false,
+      previewAvailable: false,
+      browserAvailable: false,
+      createdAt,
+      lastEventAt: this.timestamp(raw.lastEventAt ?? raw.last_event_at ?? createdAt)
+    };
+  }
+  toEvent(raw) {
+    const type = String(raw.type ?? raw.event ?? "").toLowerCase();
+    const nestedSession = isRecord2(raw.session) ? raw.session : void 0;
+    const nestedData = isRecord2(raw.data) ? raw.data : void 0;
+    const sessionId = String(
+      raw.sessionId ?? raw.session_id ?? nestedSession?.id ?? nestedData?.sessionId ?? nestedData?.session_id ?? ""
+    );
+    if (!sessionId) return void 0;
+    const createdAt = this.timestamp(raw.createdAt ?? raw.created_at);
+    const data = raw.data ?? raw.output ?? raw.text;
+    if (type === "session:terminal" || type.includes("terminal") || type.includes("output")) {
+      return this.event(sessionId, "output", data, createdAt);
+    }
+    if (type === "hook:idle_prompt" || type.includes("permission") || type.includes("wait")) {
+      return this.event(sessionId, "waiting", data, createdAt);
+    }
+    if (type === "session:idle") return this.event(sessionId, "idle", data, createdAt);
+    if (type.includes("fail") || type.includes("error")) {
+      return this.event(sessionId, "failed", data, createdAt);
+    }
+    if (type.includes("complete") || type.includes("completion")) {
+      return this.event(sessionId, "completed", data, createdAt);
+    }
+    if (type.includes("exit") || type.includes("delet")) {
+      return this.event(sessionId, "stopped", data, createdAt);
+    }
+    if (type.includes("start") || type.includes("run")) {
+      return this.event(sessionId, "started", data, createdAt);
+    }
+    if (type.includes("stop")) {
+      return this.event(sessionId, "stopped", data, createdAt);
+    }
+    if (type.includes("create")) {
+      return this.event(sessionId, "created", data, createdAt);
+    }
+    return void 0;
+  }
+  agentFromMode(mode) {
+    const known = ["claude", "shell", "opencode", "codex", "gemini", "antigravity", "pi", "grok", "deepseek"];
+    const selected = known.includes(mode) ? mode : "shell";
+    return {
+      id: selected,
+      name: selected === "claude" ? "Claude Code" : selected,
+      mode: selected,
+      ready: true
+    };
+  }
+  toAgent(raw) {
+    if (typeof raw === "string") return this.agentFromMode(raw);
+    const value = isRecord2(raw) ? raw : {};
+    const mode = String(value.mode ?? value.id ?? "shell");
+    const agent = this.agentFromMode(mode);
+    return {
+      ...agent,
+      id: String(value.id ?? agent.id),
+      name: String(value.name ?? agent.name),
+      ready: value.ready !== false && value.available !== false
+    };
+  }
+  workspaceIdForPath(path) {
+    const workspace = this.instance.workspaces.find(
+      (candidate) => candidate.id === path || candidate.canonicalPath === path
+    );
+    return workspace?.id ?? (path || "unknown");
+  }
+  timestamp(value) {
+    if (typeof value === "string" && !Number.isNaN(Date.parse(value))) return value;
+    if (typeof value === "number" && Number.isFinite(value)) return new Date(value).toISOString();
+    return (/* @__PURE__ */ new Date()).toISOString();
+  }
+  event(sessionId, event, data, createdAt) {
+    return {
+      instanceId: this.instance.id,
+      sessionId,
+      event,
+      ...data === void 0 ? {} : { data: typeof data === "string" ? data : JSON.stringify(data) },
+      createdAt
+    };
+  }
+  statusFromCodeman(status) {
+    if (status === "running" || status === "working" || status === "busy") return "working";
+    if (status === "starting" || status === "created") return "starting";
+    if (status === "completed") return "completed";
+    if (status === "failed") return "failed";
+    if (status === "stopped" || status === "deleted" || status === "exited") return "stopped";
+    if (status === "waiting" || status === "blocked") return "waiting";
+    return "idle";
+  }
+  emit(event) {
+    for (const listener of this.listeners) listener(event);
+  }
+  baseUrl() {
+    return this.instance.endpoint.replace(/\/+$/, "");
+  }
+  get basicAuthorization() {
+    return this.headers.authorization;
+  }
+  async requestData(path, options = {}) {
+    const envelope = await this.request(path, options);
+    if (envelope.data === void 0) throw new Error("Codeman response did not include data");
+    return envelope.data;
+  }
+  async request(path, options = {}) {
+    const response = await this.fetchImpl(`${this.baseUrl()}${path}`, {
+      method: options.method ?? "GET",
+      headers: {
+        ...this.headers,
+        ...options.body === void 0 ? {} : { "content-type": "application/json" }
+      },
+      body: options.body === void 0 ? void 0 : JSON.stringify(options.body),
+      signal: options.signal
+    });
+    const text = await response.text();
+    if (response.status === 401) throw new Error("Codeman request unauthorized");
+    if (!text) {
+      if (response.ok) return { success: true };
+      throw new Error(`Codeman request failed with HTTP ${response.status}`);
+    }
+    let envelope;
+    try {
+      envelope = JSON.parse(text);
+    } catch {
+      throw new Error(`Codeman returned invalid JSON with HTTP ${response.status}`);
+    }
+    if (!response.ok || envelope.success === false) {
+      throw new Error(envelope.error ?? `Codeman request failed with HTTP ${response.status}`);
+    }
+    return envelope;
+  }
+};
+var CodemanConnectorAdapter = class {
+  instance;
+  request;
+  subscribe;
+  constructor(options) {
+    this.instance = validateCodemanInstance(options.instance);
+    if (this.instance.connectionMode !== "connector") {
+      throw new Error("Codeman connector adapter requires connector mode");
+    }
+    this.request = options.request;
+    this.subscribe = options.subscribeEvents;
+  }
+  async getStatus() {
+    return this.request("status");
+  }
+  async listCapabilities() {
+    const data = await this.request("capabilities");
+    const agents = isRecord2(data) && Array.isArray(data.agents) ? data.agents : data;
+    if (!Array.isArray(agents)) return this.instance.agents.map((agent) => ({ ...agent }));
+    return agents.map((agent) => toConnectorAgent(agent));
+  }
+  async listWorkspaces() {
+    const data = await this.request("workspaces");
+    return Array.isArray(data) ? data.map((workspace) => workspace) : [];
+  }
+  async listWorkspacePathSuggestions(prefix) {
+    const data = await this.request("workspaces.suggest", { prefix });
+    return Array.isArray(data) ? data.map((suggestion) => suggestion) : [];
+  }
+  async listSessions() {
+    const data = await this.request("sessions.list");
+    const sessions = isRecord2(data) && Array.isArray(data.sessions) ? data.sessions : data;
+    if (!Array.isArray(sessions)) return [];
+    return sessions.map((session) => this.toSession(session));
+  }
+  async createSession(workspace, agent, title = `${agent.name} \xB7 ${workspace.name}`) {
+    const knownWorkspace = this.instance.workspaces.some(
+      (candidate) => candidate.id === workspace.id || candidate.canonicalPath === workspace.canonicalPath
+    );
+    const data = await this.request("sessions.create", {
+      ...knownWorkspace ? { workspaceId: workspace.id } : { workspacePath: workspace.canonicalPath },
+      agent,
+      title
+    });
+    const raw = isRecord2(data) && isRecord2(data.session) ? data.session : data;
+    return this.toSession(raw, workspace.id, agent);
+  }
+  async sendInput(sessionId, input, raw = false) {
+    await this.request("sessions.input", {
+      sessionId,
+      input,
+      raw
+    });
+  }
+  async resize(sessionId, cols, rows) {
+    await this.request("sessions.resize", { sessionId, cols, rows });
+  }
+  async stopSession(sessionId) {
+    await this.request("sessions.stop", { sessionId });
+  }
+  subscribeEvents(onEvent) {
+    return this.subscribe(onEvent);
+  }
+  toSession(raw, workspaceId, agent) {
+    if (!isRecord2(raw)) throw new Error("Connector returned an invalid session");
+    const id2 = String(raw.id ?? "");
+    if (!id2) throw new Error("Connector returned a session without an ID");
+    const resolvedWorkspaceId = workspaceId ?? String(raw.workspaceId ?? raw.workingDir ?? "unknown");
+    const resolvedAgent = agent ?? toConnectorAgent(raw.mode);
+    const createdAt = connectorTimestamp(raw.createdAt ?? raw.created_at);
+    return {
+      id: id2,
+      instanceId: this.instance.id,
+      workspaceId: resolvedWorkspaceId,
+      agent: resolvedAgent,
+      title: String(raw.name ?? id2),
+      status: connectorStatus(String(raw.status ?? "idle")),
+      terminalBuffer: String(raw.terminalBuffer ?? ""),
+      needsInput: false,
+      previewAvailable: false,
+      browserAvailable: false,
+      createdAt,
+      lastEventAt: connectorTimestamp(raw.lastEventAt ?? raw.last_event_at ?? createdAt)
+    };
+  }
+};
+function toConnectorAgent(raw) {
+  const value = isRecord2(raw) ? raw : {};
+  const mode = String(value.mode ?? value.id ?? (typeof raw === "string" ? raw : "shell"));
+  const known = ["claude", "shell", "opencode", "codex", "gemini", "antigravity", "pi", "grok", "deepseek"];
+  const selected = known.includes(mode) ? mode : "shell";
+  return {
+    id: String(value.id ?? selected),
+    name: String(value.name ?? (selected === "claude" ? "Claude Code" : selected)),
+    mode: selected,
+    ready: value.ready !== false && value.available !== false
+  };
+}
+function connectorTimestamp(value) {
+  if (typeof value === "string" && !Number.isNaN(Date.parse(value))) return value;
+  if (typeof value === "number" && Number.isFinite(value)) return new Date(value).toISOString();
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function connectorStatus(status) {
+  if (status === "running" || status === "working") return "working";
+  if (status === "completed") return "completed";
+  if (status === "failed") return "failed";
+  if (status === "stopped" || status === "deleted" || status === "exited") return "stopped";
+  if (status === "waiting" || status === "blocked") return "waiting";
+  return "idle";
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function uniqueCaseNames(...values) {
+  const names = [];
+  for (const value of values) {
+    const name = String(value ?? "").trim().replace(/[^\w.-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
+    if (name && !names.includes(name)) names.push(name);
+  }
+  return names;
+}
+function sseBoundary(value) {
+  const lineFeed = value.indexOf("\n\n");
+  const carriageReturn = value.indexOf("\r\n\r\n");
+  if (lineFeed < 0 && carriageReturn < 0) return void 0;
+  if (lineFeed < 0) return { index: carriageReturn, length: 4 };
+  if (carriageReturn < 0 || lineFeed < carriageReturn) {
+    return { index: lineFeed, length: 2 };
+  }
+  return { index: carriageReturn, length: 4 };
+}
+function relaySockets(clientSocket, upstreamSocket) {
+  let closed = false;
+  const close = () => {
+    if (closed) return;
+    closed = true;
+    clientSocket.destroy();
+    upstreamSocket.destroy();
+  };
+  clientSocket.on("data", (chunk) => {
+    if (!upstreamSocket.destroyed) upstreamSocket.write(chunk);
+  });
+  upstreamSocket.on("data", (chunk) => {
+    if (!clientSocket.destroyed) clientSocket.write(chunk);
+  });
+  clientSocket.on("error", close);
+  clientSocket.on("close", close);
+  upstreamSocket.on("error", close);
+  upstreamSocket.on("close", close);
+}
+function rejectSocket(socket, status, message) {
+  if (socket.destroyed) return;
+  socket.write(
+    `HTTP/1.1 ${status} ${message}\r
+Connection: close\r
+Content-Type: text/plain; charset=utf-8\r
+Content-Length: ${Buffer.byteLength(message)}\r
+\r
+` + message
+  );
+  socket.destroy();
+}
+
+// packages/protocol/src/persistence.ts
+import {
+  chmodSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "node:fs";
+import { dirname } from "node:path";
+var emptyState = () => ({ instances: [], sessions: [], audit: [] });
+var HubStateStore = class {
+  state;
+  path;
+  constructor(path) {
+    this.path = path;
+    this.state = path ? load(path) : emptyState();
+  }
+  snapshot() {
+    return structuredClone(this.state);
+  }
+  upsertInstance(instance) {
+    validateCodemanInstance(instance);
+    const index = this.state.instances.findIndex((candidate) => candidate.id === instance.id);
+    if (index < 0) this.state.instances.push(structuredClone(instance));
+    else this.state.instances[index] = structuredClone(instance);
+    this.persist();
+  }
+  removeInstance(instanceId) {
+    this.state.instances = this.state.instances.filter((instance) => instance.id !== instanceId);
+    this.state.sessions = this.state.sessions.filter((session) => session.instanceId !== instanceId);
+    this.persist();
+  }
+  upsertSession(session) {
+    validateCodemanSession(session);
+    const index = this.state.sessions.findIndex(
+      (candidate) => candidate.instanceId === session.instanceId && candidate.id === session.id
+    );
+    if (index < 0) this.state.sessions.push(structuredClone(session));
+    else this.state.sessions[index] = structuredClone(session);
+    this.persist();
+  }
+  removeSession(instanceId, sessionId) {
+    this.state.sessions = this.state.sessions.filter(
+      (session) => session.instanceId !== instanceId || session.id !== sessionId
+    );
+    this.persist();
+  }
+  appendAudit(event) {
+    this.state.audit.push(structuredClone(event));
+    this.persist();
+  }
+  persist() {
+    if (!this.path) return;
+    mkdirSync(dirname(this.path), { recursive: true });
+    const temp = `${this.path}.tmp`;
+    const serialized = `${JSON.stringify(this.state, null, 2)}
+`;
+    writeFileSync(temp, serialized, { mode: 384 });
+    try {
+      renameSync(temp, this.path);
+      chmodSync(this.path, 384);
+    } catch {
+      writeFileSync(this.path, serialized, { mode: 384 });
+      chmodSync(this.path, 384);
+      try {
+        unlinkSync(temp);
+      } catch {
+      }
+    }
+  }
+};
+function load(path) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return {
+      instances: Array.isArray(parsed.instances) ? parsed.instances.filter(isCodemanInstance) : [],
+      sessions: Array.isArray(parsed.sessions) ? parsed.sessions.filter(isCodemanSession) : [],
+      audit: Array.isArray(parsed.audit) ? parsed.audit.filter(isAuditEvent) : []
+    };
+  } catch {
+    return emptyState();
+  }
+}
+function isAuditEvent(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const event = value;
+  return typeof event.id === "string" && isAuditType(event.type) && (event.actor === "system" || event.actor === "operator" || event.actor === "node") && typeof event.resourceId === "string" && typeof event.createdAt === "string" && typeof event.metadata === "object" && event.metadata !== null && !Array.isArray(event.metadata) && Object.values(event.metadata).every((entry) => typeof entry === "string");
+}
+function isAuditType(value) {
+  return value === "node.enrolled" || value === "node.heartbeat" || value === "node.revoked" || value === "job.created" || value === "job.started" || value === "job.completed" || value === "job.failed" || value === "job.cancelled" || value === "instance.registered" || value === "instance.removed" || value === "instance.health" || value === "session.created" || value === "session.stopped" || value === "session.removed" || value === "preview.created" || value === "preview.revoked" || value === "browser.started" || value === "browser.stopped";
+}
+
+// apps/control-plane/src/hub.ts
+var CodemanHub = class {
+  state;
+  credentials;
+  adapterFactory;
+  hasCustomAdapterFactory;
+  connectorRequest;
+  connectorSubscribeEvents;
+  runtimeCredentials = /* @__PURE__ */ new Map();
+  adapters = /* @__PURE__ */ new Map();
+  adapterUnsubscribers = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Set();
+  constructor(options = {}) {
+    this.state = new HubStateStore(options.statePath);
+    this.hasCustomAdapterFactory = options.adapterFactory !== void 0;
+    this.credentials = options.credentials;
+    this.connectorRequest = options.connectorRequest;
+    this.connectorSubscribeEvents = options.connectorSubscribeEvents;
+    this.adapterFactory = options.adapterFactory ?? ((instance, credentials) => {
+      if (instance.connectionMode === "connector") {
+        if (!this.connectorRequest || !this.connectorSubscribeEvents || !instance.nodeId) {
+          throw new Error(`Connector is not configured: ${instance.id}`);
+        }
+        return new CodemanConnectorAdapter({
+          instance,
+          request: (operation, payload) => this.connectorRequest(
+            instance.nodeId,
+            instance.id,
+            operation,
+            payload
+          ),
+          subscribeEvents: (listener) => this.connectorSubscribeEvents(
+            instance.nodeId,
+            instance.id,
+            listener
+          )
+        });
+      }
+      return new CodemanHttpAdapter({ instance, ...credentials ?? {} });
+    });
+    for (const instance of this.state.snapshot().instances) this.attachAdapter(instance);
+  }
+  listInstances() {
+    return this.state.snapshot().instances;
+  }
+  listSessions() {
+    return this.state.snapshot().sessions;
+  }
+  async suggestWorkspacePaths(instanceId, prefix) {
+    this.getInstance(instanceId);
+    return this.getAdapter(instanceId).listWorkspacePathSuggestions(prefix);
+  }
+  listAudit() {
+    return this.state.snapshot().audit;
+  }
+  getInstance(instanceId) {
+    const instance = this.listInstances().find((candidate) => candidate.id === instanceId);
+    if (!instance) throw new Error(`Unknown Codeman instance: ${instanceId}`);
+    return instance;
+  }
+  getAdapter(instanceId) {
+    const adapter = this.adapters.get(instanceId);
+    if (!adapter) throw new Error(`Codeman instance is not connected: ${instanceId}`);
+    return adapter;
+  }
+  getSession(instanceId, sessionId) {
+    const session = this.listSessions().find(
+      (candidate) => candidate.instanceId === instanceId && candidate.id === sessionId
+    );
+    if (!session) throw new Error(`Unknown session: ${instanceId}/${sessionId}`);
+    return session;
+  }
+  registerInstance(registration, credentials) {
+    validateCodemanInstanceRegistration(registration);
+    const existing = this.listInstances().find((instance2) => instance2.id === registration.id);
+    const instance = {
+      id: registration.id,
+      label: registration.label,
+      connectionMode: registration.connectionMode,
+      ...registration.nodeId ? { nodeId: registration.nodeId } : {},
+      endpoint: registration.endpoint ?? null,
+      status: existing?.status ?? "offline",
+      capabilities: [...new Set(registration.capabilities ?? ["codeman"])],
+      ...registration.workspacePolicy ? {
+        workspacePolicy: {
+          mode: registration.workspacePolicy.mode,
+          roots: [...registration.workspacePolicy.roots]
+        }
+      } : existing?.workspacePolicy ? {
+        workspacePolicy: {
+          mode: existing.workspacePolicy.mode,
+          roots: [...existing.workspacePolicy.roots]
+        }
+      } : {},
+      agents: (registration.agents ?? defaultAgents()).map((agent) => ({ ...agent })),
+      workspaces: (registration.workspaces ?? []).map((workspace) => ({
+        ...workspace,
+        providers: { ...workspace.providers }
+      })),
+      lastSeenAt: existing?.lastSeenAt ?? null,
+      createdAt: existing?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+    };
+    validateCodemanInstance(instance);
+    if (credentials) this.runtimeCredentials.set(instance.id, credentials);
+    this.attachAdapter(instance, credentials ?? this.runtimeCredentials.get(instance.id));
+    this.state.upsertInstance(instance);
+    this.appendAudit("instance.registered", instance.id, { connectionMode: instance.connectionMode });
+    return instance;
+  }
+  removeInstance(instanceId) {
+    this.getInstance(instanceId);
+    this.adapterUnsubscribers.get(instanceId)?.();
+    this.adapterUnsubscribers.delete(instanceId);
+    this.adapters.delete(instanceId);
+    this.runtimeCredentials.delete(instanceId);
+    this.appendAudit("instance.removed", instanceId);
+    this.state.removeInstance(instanceId);
+  }
+  async checkInstance(instanceId) {
+    const instance = this.getInstance(instanceId);
+    const adapter = this.getAdapter(instanceId);
+    try {
+      const [workspaces, agents] = await Promise.all([
+        adapter.listWorkspaces(),
+        adapter.listCapabilities()
+      ]);
+      const updated = {
+        ...instance,
+        status: "online",
+        workspaces,
+        agents,
+        lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      this.state.upsertInstance(updated);
+      this.appendAudit("instance.health", instanceId, { status: updated.status });
+      return updated;
+    } catch {
+      const updated = { ...instance, status: "unhealthy" };
+      this.state.upsertInstance(updated);
+      this.appendAudit("instance.health", instanceId, { status: updated.status });
+      return updated;
+    }
+  }
+  async listCapabilities(instanceId) {
+    const instance = this.getInstance(instanceId);
+    const agents = await this.getAdapter(instanceId).listCapabilities();
+    this.state.upsertInstance({
+      ...instance,
+      agents,
+      status: "online",
+      lastSeenAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return agents;
+  }
+  async syncSessions(instanceId) {
+    const adapter = this.getAdapter(instanceId);
+    const sessions = await adapter.listSessions();
+    for (const session of sessions) this.state.upsertSession(session);
+    return sessions;
+  }
+  async createSession(instanceId, workspaceId, agentId, title, workspacePath) {
+    const instance = this.getInstance(instanceId);
+    const workspace = workspaceId ? requireWorkspace(instance.workspaces, workspaceId) : this.resolveWorkspacePath(instance, workspacePath);
+    const agent = instance.agents.find((candidate) => candidate.id === agentId);
+    if (!agent || !agent.ready) throw new Error(`Agent is not ready: ${agentId}`);
+    let session;
+    try {
+      session = await this.getAdapter(instanceId).createSession(workspace, agent, title);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unable to create session";
+      if (/workingDir does not exist|does not exist|ENOENT/i.test(message)) {
+        throw new Error(
+          `Workspace path does not exist on that host: ${workspace.canonicalPath}. Use a path that exists on the Codeman machine (for WSL, prefer /home/... or /mnt/...).`
+        );
+      }
+      throw error;
+    }
+    this.state.upsertSession(session);
+    this.appendAudit("session.created", `${instanceId}/${session.id}`, {
+      workspaceId: workspace.id,
+      agentId
+    });
+    return session;
+  }
+  async sendInput(instanceId, sessionId, input, raw = false) {
+    this.assertSession(instanceId, sessionId);
+    await this.getAdapter(instanceId).sendInput(sessionId, input, raw);
+  }
+  async resizeSession(instanceId, sessionId, cols, rows) {
+    this.assertSession(instanceId, sessionId);
+    await this.getAdapter(instanceId).resize(sessionId, cols, rows);
+  }
+  async proxyTerminal(instanceId, sessionId, request, clientSocket, head) {
+    const adapter = this.getAdapter(instanceId);
+    if (!this.listSessions().some(
+      (session) => session.instanceId === instanceId && session.id === sessionId
+    )) {
+      const remoteSession = (await adapter.listSessions()).find((session) => session.id === sessionId);
+      if (!remoteSession) throw new Error(`Unknown session: ${instanceId}/${sessionId}`);
+      this.state.upsertSession(remoteSession);
+    }
+    const proxyTerminal = adapter.proxyTerminal;
+    if (!proxyTerminal) {
+      throw new Error(`Codeman WebSocket proxy is unavailable: ${instanceId}`);
+    }
+    await proxyTerminal.call(
+      adapter,
+      sessionId,
+      request,
+      clientSocket,
+      head
+    );
+  }
+  async proxyCodemanRequest(instanceId, request, response) {
+    const adapter = this.getAdapter(instanceId);
+    const proxyHttp = adapter.proxyHttp;
+    if (!proxyHttp) {
+      throw new Error(`Codeman HTTP proxy is unavailable: ${instanceId}`);
+    }
+    await proxyHttp.call(adapter, request, response);
+  }
+  /**
+   * Prepare a Tailscale Codeman host for the native UI: seed Cases from Hub
+   * workspaces so Codeman Quick Start can create sessions.
+   */
+  async prepareNativeUi(instanceId) {
+    const instance = this.getInstance(instanceId);
+    if (instance.connectionMode !== "tailscale-url") {
+      throw new Error(`Native Codeman UI requires a Tailscale host: ${instanceId}`);
+    }
+    const adapter = this.getAdapter(instanceId);
+    await adapter.ensureNativeCases?.();
+  }
+  async stopSession(instanceId, sessionId) {
+    this.assertSession(instanceId, sessionId);
+    await this.getAdapter(instanceId).stopSession(sessionId);
+    const existing = this.state.snapshot().sessions.find(
+      (session) => session.instanceId === instanceId && session.id === sessionId
+    );
+    if (existing) this.state.upsertSession({ ...existing, status: "stopped", lastEventAt: (/* @__PURE__ */ new Date()).toISOString() });
+    this.appendAudit("session.stopped", `${instanceId}/${sessionId}`);
+  }
+  removeSession(instanceId, sessionId) {
+    const session = this.getSession(instanceId, sessionId);
+    if (!["completed", "failed", "stopped"].includes(session.status)) {
+      throw new Error("Only stopped sessions can be removed");
+    }
+    this.state.removeSession(instanceId, sessionId);
+    this.appendAudit("session.removed", `${instanceId}/${sessionId}`);
+  }
+  subscribeEvents(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  attachAdapter(instance, credentials) {
+    this.adapterUnsubscribers.get(instance.id)?.();
+    this.adapterUnsubscribers.delete(instance.id);
+    this.adapters.delete(instance.id);
+    if (instance.connectionMode === "connector") {
+      if (!instance.nodeId || !this.hasCustomAdapterFactory && (!this.connectorRequest || !this.connectorSubscribeEvents)) return;
+    } else if (!instance.endpoint) {
+      return;
+    }
+    const adapter = this.adapterFactory(
+      instance,
+      credentials ?? this.credentials?.[instance.id]
+    );
+    this.adapters.set(instance.id, adapter);
+    const unsubscribe = adapter.subscribeEvents((event) => {
+      this.updateSessionFromEvent(instance.id, event);
+      for (const listener of this.listeners) listener(event);
+    });
+    this.adapterUnsubscribers.set(instance.id, unsubscribe);
+  }
+  updateSessionFromEvent(instanceId, event) {
+    const existing = this.state.snapshot().sessions.find(
+      (session) => session.instanceId === instanceId && session.id === event.sessionId
+    );
+    if (!existing) return;
+    const status = sessionStatusForEvent(event.event, existing.status);
+    this.state.upsertSession({
+      ...existing,
+      status,
+      needsInput: event.event === "waiting" ? true : event.event === "output" || event.event === "started" ? false : existing.needsInput,
+      terminalBuffer: event.data ? `${existing.terminalBuffer}${event.data}` : existing.terminalBuffer,
+      lastEventAt: event.createdAt
+    });
+  }
+  assertSession(instanceId, sessionId) {
+    const exists = this.state.snapshot().sessions.some(
+      (session) => session.instanceId === instanceId && session.id === sessionId
+    );
+    if (!exists) throw new Error(`Unknown session: ${instanceId}/${sessionId}`);
+  }
+  resolveWorkspacePath(instance, workspacePath) {
+    if (!workspacePath?.trim()) throw new Error("workspaceId or workspacePath is required");
+    const path = workspacePath.trim();
+    const known = instance.workspaces.find((workspace) => workspace.canonicalPath === path);
+    if (known) return requireWorkspace(instance.workspaces, known.id);
+    const policy = instance.workspacePolicy;
+    if (!policy) throw new Error("This instance does not allow arbitrary workspace paths");
+    if (policy.mode !== "system" && !policy.roots.some((root) => isWithinPath(path, root))) {
+      throw new Error("Workspace path is outside the instance policy");
+    }
+    return {
+      id: path,
+      name: path.split(/[\\/]/).filter(Boolean).at(-1) ?? path,
+      canonicalPath: path,
+      health: "ready",
+      providers: { codeman: "ready" }
+    };
+  }
+  appendAudit(type, resourceId, metadata = {}) {
+    this.state.appendAudit({
+      id: `audit_${crypto.randomUUID()}`,
+      type,
+      actor: "operator",
+      resourceId,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      metadata
+    });
+  }
+};
+function sessionStatusForEvent(event, current) {
+  switch (event) {
+    case "output":
+      return current;
+    case "created":
+      return "starting";
+    case "started":
+      return "working";
+    case "waiting":
+      return "waiting";
+    case "idle":
+      return "idle";
+    case "completed":
+      return "completed";
+    case "failed":
+      return "failed";
+    case "stopped":
+      return "stopped";
+  }
+}
+function requireWorkspace(workspaces, workspaceId) {
+  const workspace = workspaces.find((candidate) => candidate.id === workspaceId);
+  if (!workspace) throw new Error(`Unknown workspace: ${workspaceId}`);
+  if (workspace.health !== "ready") throw new Error(`Workspace is not ready: ${workspaceId}`);
+  return workspace;
+}
+function isWithinPath(path, root) {
+  const normalizedPath = normalizePath(path);
+  const normalizedRoot = normalizePath(root);
+  return !normalizedRoot || normalizedPath === normalizedRoot || normalizedPath.startsWith(`${normalizedRoot}/`);
+}
+function normalizePath(value) {
+  const segments = [];
+  for (const segment of value.replaceAll("\\", "/").split("/")) {
+    if (!segment || segment === ".") continue;
+    if (segment === "..") {
+      segments.pop();
+    } else {
+      segments.push(segment);
+    }
+  }
+  return segments.join("/").toLowerCase();
+}
+function defaultAgents() {
+  const modes = [
+    "claude",
+    "shell",
+    "opencode",
+    "codex",
+    "gemini",
+    "antigravity",
+    "pi",
+    "grok",
+    "deepseek"
+  ];
+  return modes.map((mode) => ({
+    id: mode,
+    name: mode === "claude" ? "Claude Code" : mode,
+    mode,
+    ready: true
+  }));
+}
+
+// apps/control-plane/src/auth.ts
+import {
+  createHash as createHash2,
+  randomBytes as randomBytes2,
+  scryptSync,
+  timingSafeEqual
+} from "node:crypto";
+import {
+  chmodSync as chmodSync2,
+  existsSync,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { join } from "node:path";
+var DEFAULT_SESSION_TTL_MS = 8 * 60 * 60 * 1e3;
+var DEFAULT_COOKIE_NAME = "hosted_agents_session";
+var DEFAULT_CSRF_COOKIE_NAME = "hosted_agents_csrf";
+var SCRYPT_COST = 16384;
+var SCRYPT_BLOCK_SIZE = 8;
+var SCRYPT_PARALLELIZATION = 1;
+var SCRYPT_KEY_LENGTH = 32;
+var UiAuth = class {
+  enabled;
+  cookieName;
+  csrfCookieName;
+  secureCookies;
+  verifier;
+  sessionTtlMs;
+  sessions = /* @__PURE__ */ new Map();
+  loginAttempts = /* @__PURE__ */ new Map();
+  constructor(options = {}) {
+    const passwordHash = options.passwordHash ?? process.env.HOSTED_AGENTS_UI_PASSWORD_HASH;
+    const password = options.password ?? process.env.HOSTED_AGENTS_UI_PASSWORD;
+    this.verifier = passwordHash ? parsePasswordVerifier(passwordHash) : password ? createPasswordVerifier(password) : void 0;
+    this.enabled = this.verifier !== void 0;
+    this.sessionTtlMs = options.sessionTtlMs ?? Number(process.env.HOSTED_AGENTS_UI_SESSION_TTL_MS ?? DEFAULT_SESSION_TTL_MS);
+    this.cookieName = options.cookieName ?? DEFAULT_COOKIE_NAME;
+    this.csrfCookieName = options.csrfCookieName ?? DEFAULT_CSRF_COOKIE_NAME;
+    this.secureCookies = options.secureCookies ?? process.env.HOSTED_AGENTS_COOKIE_SECURE === "true";
+  }
+  authenticate(request, bearerToken) {
+    if (bearerToken && request.headers.authorization === `Bearer ${bearerToken}`) {
+      return { authenticated: true, method: "bearer" };
+    }
+    if (!this.enabled) return { authenticated: true, method: "none" };
+    const cookies = parseCookies(request.headers.cookie);
+    const sessionToken = cookies[this.cookieName];
+    if (!sessionToken) return { authenticated: false, method: "none" };
+    const session = this.sessions.get(sessionToken);
+    if (!session || session.expiresAt <= Date.now()) {
+      if (session) this.sessions.delete(sessionToken);
+      return { authenticated: false, method: "none" };
+    }
+    return {
+      authenticated: true,
+      method: "ui",
+      sessionToken,
+      csrfToken: session.csrfToken
+    };
+  }
+  canAttemptLogin(clientKey) {
+    const attempt = this.loginAttempts.get(clientKey);
+    return !attempt || attempt.blockedUntil <= Date.now();
+  }
+  verifyPassword(clientKey, password) {
+    if (!this.enabled || !this.verifier || !this.canAttemptLogin(clientKey)) return false;
+    if (verifyPassword(password, this.verifier)) {
+      this.loginAttempts.delete(clientKey);
+      return true;
+    }
+    const now = Date.now();
+    const current = this.loginAttempts.get(clientKey);
+    const attempt = current && now - current.firstFailureAt < 15 * 6e4 ? current : { failures: 0, firstFailureAt: now, blockedUntil: 0 };
+    attempt.failures += 1;
+    attempt.blockedUntil = attempt.failures >= 10 ? now + 15 * 6e4 : 0;
+    this.loginAttempts.set(clientKey, attempt);
+    return false;
+  }
+  createSession() {
+    if (!this.enabled) throw new Error("UI password authentication is disabled");
+    const token = randomToken();
+    const csrfToken = randomToken();
+    const expiresAt = Date.now() + this.sessionTtlMs;
+    this.sessions.set(token, { csrfToken, expiresAt });
+    this.pruneSessions();
+    return { token, csrfToken, expiresAt };
+  }
+  revoke(request) {
+    const token = parseCookies(request.headers.cookie)[this.cookieName];
+    if (token) this.sessions.delete(token);
+  }
+  isCsrfValid(request, auth) {
+    if (!this.enabled || auth.method !== "ui") return true;
+    const origin = request.headers.origin;
+    if (origin) return sameOrigin(origin, request);
+    const referer = request.headers.referer;
+    if (typeof referer === "string") {
+      try {
+        if (sameOrigin(new URL(referer).origin, request)) return true;
+      } catch {
+      }
+    }
+    const header = request.headers["x-csrf-token"];
+    return typeof header === "string" && typeof auth.csrfToken === "string" && safeEqual(header, auth.csrfToken);
+  }
+  isOriginValid(request) {
+    const origin = request.headers.origin;
+    return !origin || sameOrigin(origin, request);
+  }
+  sessionCookie(token, request) {
+    return serializeCookie(
+      this.cookieName,
+      token,
+      this.cookieOptions(request, true)
+    );
+  }
+  csrfCookie(token, request) {
+    return serializeCookie(
+      this.csrfCookieName,
+      token,
+      this.cookieOptions(request, false)
+    );
+  }
+  clearCookies(request) {
+    return [
+      serializeCookie(this.cookieName, "", {
+        ...this.cookieOptions(request, true),
+        maxAge: 0
+      }),
+      serializeCookie(this.csrfCookieName, "", {
+        ...this.cookieOptions(request, false),
+        maxAge: 0
+      })
+    ];
+  }
+  getCsrfToken(request, auth) {
+    if (!this.enabled || auth.method !== "ui") return void 0;
+    return auth.csrfToken;
+  }
+  cookieOptions(request, httpOnly) {
+    const forwardedProto = request.headers["x-forwarded-proto"];
+    const isHttps = this.secureCookies || forwardedProto === "https" || request.socket.encrypted === true;
+    return {
+      httpOnly,
+      secure: isHttps,
+      sameSite: "Lax",
+      path: "/",
+      maxAge: Math.floor(this.sessionTtlMs / 1e3)
+    };
+  }
+  pruneSessions() {
+    const now = Date.now();
+    for (const [token, session] of this.sessions) {
+      if (session.expiresAt <= now) this.sessions.delete(token);
+    }
+    if (this.sessions.size <= 1e3) return;
+    const oldest = [...this.sessions.entries()].sort((left, right) => left[1].expiresAt - right[1].expiresAt).slice(0, this.sessions.size - 1e3);
+    for (const [token] of oldest) this.sessions.delete(token);
+  }
+};
+function createPasswordVerifier(password) {
+  const salt = randomBytes2(16);
+  return {
+    salt,
+    hash: scryptSync(password, salt, SCRYPT_KEY_LENGTH, {
+      N: SCRYPT_COST,
+      r: SCRYPT_BLOCK_SIZE,
+      p: SCRYPT_PARALLELIZATION
+    }),
+    cost: SCRYPT_COST,
+    blockSize: SCRYPT_BLOCK_SIZE,
+    parallelization: SCRYPT_PARALLELIZATION
+  };
+}
+function parsePasswordVerifier(encoded) {
+  const [algorithm, cost, blockSize, parallelization, saltText, hashText] = encoded.split("$");
+  if (algorithm !== "scrypt" || !Number.isInteger(Number(cost)) || !Number.isInteger(Number(blockSize)) || !Number.isInteger(Number(parallelization)) || !saltText || !hashText) {
+    throw new Error("HOSTED_AGENTS_UI_PASSWORD_HASH must use scrypt$N$r$p$salt$hash format");
+  }
+  const salt = Buffer.from(saltText, "base64url");
+  const hash = Buffer.from(hashText, "base64url");
+  if (salt.length < 16 || hash.length !== SCRYPT_KEY_LENGTH) {
+    throw new Error("HOSTED_AGENTS_UI_PASSWORD_HASH has invalid salt or hash");
+  }
+  return {
+    salt,
+    hash,
+    cost: Number(cost),
+    blockSize: Number(blockSize),
+    parallelization: Number(parallelization)
+  };
+}
+function verifyPassword(password, verifier) {
+  const actual = scryptSync(password, verifier.salt, verifier.hash.length, {
+    N: verifier.cost,
+    r: verifier.blockSize,
+    p: verifier.parallelization
+  });
+  return safeEqual(actual, verifier.hash);
+}
+function encodePasswordVerifier(verifier) {
+  return [
+    "scrypt",
+    verifier.cost,
+    verifier.blockSize,
+    verifier.parallelization,
+    verifier.salt.toString("base64url"),
+    verifier.hash.toString("base64url")
+  ].join("$");
+}
+function createUiPasswordHash(password) {
+  return encodePasswordVerifier(createPasswordVerifier(password));
+}
+var BOOTSTRAP_AUTH_FILE = "hub-ui-auth.json";
+function resolveUiAuth(options = {}) {
+  const passwordHash = options.passwordHash ?? process.env.HOSTED_AGENTS_UI_PASSWORD_HASH;
+  const password = options.password ?? process.env.HOSTED_AGENTS_UI_PASSWORD;
+  const common = {
+    sessionTtlMs: options.sessionTtlMs,
+    secureCookies: options.secureCookies
+  };
+  if (passwordHash || password) {
+    if (options.dataDir) clearBootstrapPlaintext(options.dataDir);
+    return {
+      auth: new UiAuth({
+        ...common,
+        passwordHash,
+        password
+      })
+    };
+  }
+  if (!options.dataDir) {
+    return { auth: new UiAuth(common) };
+  }
+  const bootstrap = loadOrCreateBootstrapAuth(options.dataDir);
+  return {
+    auth: new UiAuth({
+      ...common,
+      passwordHash: bootstrap.hash
+    }),
+    revealPassword: bootstrap.password
+  };
+}
+function bootstrapAuthPath(dataDir) {
+  return join(dataDir, BOOTSTRAP_AUTH_FILE);
+}
+function loadOrCreateBootstrapAuth(dataDir) {
+  mkdirSync2(dataDir, { recursive: true });
+  const path = bootstrapAuthPath(dataDir);
+  if (existsSync(path)) {
+    const raw = JSON.parse(readFileSync2(path, "utf8"));
+    if (typeof raw.hash !== "string" || raw.hash.length === 0) {
+      throw new Error(`${BOOTSTRAP_AUTH_FILE} is missing a password hash`);
+    }
+    parsePasswordVerifier(raw.hash);
+    if (typeof raw.password === "string" && raw.password.length > 0) {
+      return { hash: raw.hash, password: raw.password };
+    }
+    return { hash: raw.hash };
+  }
+  const password = randomBytes2(18).toString("base64url");
+  const hash = createUiPasswordHash(password);
+  writeBootstrapAuth(dataDir, { hash, password });
+  return { hash, password };
+}
+function writeBootstrapAuth(dataDir, value) {
+  mkdirSync2(dataDir, { recursive: true });
+  const path = bootstrapAuthPath(dataDir);
+  writeFileSync2(path, `${JSON.stringify(value, null, 2)}
+`, { encoding: "utf8", mode: 384 });
+  try {
+    chmodSync2(path, 384);
+  } catch {
+  }
+}
+function clearBootstrapPlaintext(dataDir) {
+  const path = bootstrapAuthPath(dataDir);
+  if (!existsSync(path)) return;
+  try {
+    const raw = JSON.parse(readFileSync2(path, "utf8"));
+    if (typeof raw.hash === "string" && raw.hash.length > 0 && raw.password) {
+      writeBootstrapAuth(dataDir, { hash: raw.hash });
+      return;
+    }
+    if (raw.password) unlinkSync2(path);
+  } catch {
+  }
+}
+function randomToken() {
+  return randomBytes2(32).toString("base64url");
+}
+function serializeCookie(name, value, options) {
+  return [
+    `${name}=${encodeURIComponent(value)}`,
+    `Path=${options.path}`,
+    `Max-Age=${options.maxAge}`,
+    `SameSite=${options.sameSite}`,
+    options.httpOnly ? "HttpOnly" : "",
+    options.secure ? "Secure" : ""
+  ].filter(Boolean).join("; ");
+}
+function parseCookies(header) {
+  const cookies = {};
+  for (const item of header?.split(";") ?? []) {
+    const separator = item.indexOf("=");
+    if (separator < 1) continue;
+    const name = item.slice(0, separator).trim();
+    const value = item.slice(separator + 1).trim();
+    try {
+      cookies[name] = decodeURIComponent(value);
+    } catch {
+      cookies[name] = value;
+    }
+  }
+  return cookies;
+}
+function safeEqual(left, right) {
+  const leftBuffer = typeof left === "string" ? createHash2("sha256").update(left).digest() : left;
+  const rightBuffer = typeof right === "string" ? createHash2("sha256").update(right).digest() : right;
+  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
+}
+function sameOrigin(origin, request) {
+  try {
+    const parsed = new URL(origin);
+    const forwardedHost = request.headers["x-forwarded-host"];
+    const host = typeof forwardedHost === "string" ? forwardedHost.split(",")[0].trim() : request.headers.host;
+    return parsed.host === host;
+  } catch {
+    return false;
+  }
+}
+
+// apps/control-plane/src/server.ts
+var MAX_BODY_BYTES = 1048576;
+var CODEMAN_INSTANCE_COOKIE = "hosted_agents_codeman_instance";
+function resolveDashboardRoot() {
+  const here = dirname2(fileURLToPath(import.meta.url));
+  const candidates = [];
+  try {
+    const require2 = createRequire(import.meta.url);
+    const packageRoot = dirname2(require2.resolve("@cloudagentfleet/ui/package.json"));
+    candidates.push(join2(packageRoot, "dist", "public"), join2(packageRoot, "public"));
+  } catch {
+  }
+  candidates.push(
+    resolve(here, "../../dashboard/dist/public"),
+    resolve(here, "../../dashboard/public")
+  );
+  for (const candidate of candidates) {
+    if (existsSync2(candidate)) return candidate;
+  }
+  throw new Error("Unable to resolve @cloudagentfleet/ui public assets");
+}
+var DASHBOARD_ROOT = resolveDashboardRoot();
+function startControllerServer(options = {}) {
+  const controller = createControllerServer(options);
+  controller.server.listen(controller.port, controller.host, () => {
+    console.log(`Hosted Agents Controller listening on ${controller.host}:${controller.port}`);
+    if (controller.revealPassword) {
+      console.log(`Hub UI password: ${controller.revealPassword}`);
+      console.log(
+        "Shown on every start until you set HOSTED_AGENTS_UI_PASSWORD or HOSTED_AGENTS_UI_PASSWORD_HASH."
+      );
+    }
+  });
+  return controller;
+}
+function createControllerServer(options = {}) {
+  const host = options.host ?? process.env.HOSTED_AGENTS_HOST ?? "127.0.0.1";
+  const port = options.port ?? Number(process.env.HOSTED_AGENTS_PORT ?? 8787);
+  const authToken = options.authToken ?? process.env.HOSTED_AGENTS_AUTH_TOKEN;
+  const statePath = options.statePath ?? process.env.HOSTED_AGENTS_DATA_PATH ?? "data/hub.json";
+  const dataDir = statePath ? dirname2(resolve(statePath)) : void 0;
+  const resolvedAuth = resolveUiAuth({
+    dataDir,
+    password: options.uiPassword,
+    passwordHash: options.uiPasswordHash,
+    sessionTtlMs: options.uiSessionTtlMs,
+    secureCookies: options.uiCookieSecure
+  });
+  const uiAuth = resolvedAuth.auth;
+  const controlPlane = options.controlPlane ?? new ControlPlane();
+  const hub = options.hub ?? new CodemanHub({
+    statePath,
+    credentials: options.codemanCredentials ?? readCodemanCredentials(),
+    connectorRequest: (nodeId, instanceId, operation, payload) => controlPlane.requestConnector(nodeId, instanceId, operation, payload),
+    connectorSubscribeEvents: (nodeId, instanceId, listener) => controlPlane.subscribeConnectorEvents(nodeId, instanceId, listener)
+  });
+  if (!isLoopback(host) && !authToken) {
+    throw new Error("A bearer token is required when the Controller binds beyond loopback");
+  }
+  const server = createServer(async (request, response) => {
+    try {
+      const url = new URL(request.url ?? "/", "http://controller.local");
+      const auth = uiAuth.authenticate(request, authToken);
+      const isHealthCheck = request.method === "GET" && url.pathname === "/healthz";
+      const isLoginRoute = url.pathname === "/api/auth/login";
+      const isSessionRoute = url.pathname === "/api/auth/session";
+      const isLogoutRoute = url.pathname === "/api/auth/logout";
+      if (!isHealthCheck && !isLoginRoute && !isSessionRoute && !auth.authenticated) {
+        if (request.method === "GET" && !url.pathname.startsWith("/api/")) {
+          sendLoginPage(response, uiAuth.enabled);
+        } else {
+          sendJson(response, 401, { error: "Authentication required" });
+        }
+        return;
+      }
+      if (isLogoutRoute && uiAuth.enabled && !auth.authenticated) {
+        sendJson(response, 401, { error: "Unauthorized" });
+        return;
+      }
+      const selectedForCsrf = selectedInstance(request);
+      const proxiedCodemanMutation = Boolean(
+        selectedForCsrf && request.method !== "GET" && request.method !== "HEAD" && isCodemanProxiedApiPath(url.pathname)
+      );
+      if (auth.authenticated && request.method !== "GET" && request.method !== "HEAD" && !proxiedCodemanMutation && !uiAuth.isCsrfValid(request, auth)) {
+        sendJson(response, 403, { error: "Cross-site request blocked" });
+        return;
+      }
+      if (auth.authenticated && uiAuth.enabled && isWorkerOrJobRoute(url.pathname) && auth.method === "ui" && authToken) {
+        sendJson(response, 403, { error: "Worker credentials are required" });
+        return;
+      }
+      await route(request, response, controlPlane, hub, uiAuth, auth);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Request failed";
+      const status = error instanceof HttpError ? error.status : message.startsWith("Unknown Codeman instance") || message.startsWith("Unknown session") ? 404 : message.startsWith("Codeman instance is not connected") ? 503 : 400;
+      sendJson(response, status, { error: message });
+    }
+  });
+  server.on("upgrade", (request, socket, head) => {
+    void handleTerminalUpgrade(request, socket, head, hub, uiAuth, authToken);
+  });
+  return { server, controlPlane, hub, host, port, revealPassword: resolvedAuth.revealPassword };
+}
+async function handleTerminalUpgrade(request, socket, head, hub, uiAuth, authToken) {
+  const url = new URL(request.url ?? "/", "http://controller.local");
+  const explicitMatch = url.pathname.match(
+    /^\/ws\/instances\/([^/]+)\/sessions\/([^/]+)\/terminal$/
+  );
+  const nativeMatch = url.pathname.match(/^\/ws\/sessions\/([^/]+)\/terminal$/);
+  if (!explicitMatch && !nativeMatch) {
+    socket.destroy();
+    return;
+  }
+  const auth = uiAuth.authenticate(request, authToken);
+  if (!auth.authenticated || !uiAuth.isOriginValid(request) || typeof request.headers.upgrade !== "string" || request.headers.upgrade.toLowerCase() !== "websocket") {
+    rejectUpgrade(socket, 401, "Unauthorized");
+    return;
+  }
+  const instanceId = explicitMatch ? decodeURIComponent(explicitMatch[1]) : selectedInstance(request);
+  const sessionId = explicitMatch ? decodeURIComponent(explicitMatch[2]) : decodeURIComponent(nativeMatch[1]);
+  if (!instanceId) {
+    rejectUpgrade(socket, 400, "A Codeman host must be selected");
+    return;
+  }
+  try {
+    await hub.proxyTerminal(instanceId, sessionId, request, socket, head);
+  } catch (error) {
+    rejectUpgrade(
+      socket,
+      502,
+      error instanceof Error ? error.message : "Terminal proxy unavailable"
+    );
+  }
+}
+async function route(request, response, controlPlane, hub, uiAuth, auth) {
+  const method = request.method ?? "GET";
+  const url = new URL(request.url ?? "/", "http://controller.local");
+  if (method === "GET" && url.pathname === "/healthz") {
+    sendJson(response, 200, {
+      ok: true,
+      role: "controller",
+      execution: "codeman-native-proxy-with-worker-fallback"
+    });
+    return;
+  }
+  if (method === "GET" && url.pathname === "/api/auth/session") {
+    sendJson(response, 200, {
+      enabled: uiAuth.enabled,
+      authenticated: auth.authenticated,
+      ...uiAuth.getCsrfToken(request, auth) ? { csrfToken: uiAuth.getCsrfToken(request, auth) } : {}
+    });
+    return;
+  }
+  if (method === "POST" && url.pathname === "/api/auth/login") {
+    const body = await readJson(request);
+    const clientKey = clientAddress(request);
+    if (!uiAuth.enabled) {
+      sendJson(response, 400, { error: "UI password authentication is disabled" });
+      return;
+    }
+    if (typeof body.password !== "string" || !uiAuth.verifyPassword(clientKey, body.password)) {
+      sendJson(response, 401, { error: "Invalid password" });
+      return;
+    }
+    const session = uiAuth.createSession();
+    response.setHeader("set-cookie", [
+      uiAuth.sessionCookie(session.token, request),
+      uiAuth.csrfCookie(session.csrfToken, request)
+    ]);
+    sendJson(response, 200, {
+      authenticated: true,
+      expiresAt: new Date(session.expiresAt).toISOString()
+    });
+    return;
+  }
+  if (method === "POST" && url.pathname === "/api/auth/logout") {
+    uiAuth.revoke(request);
+    response.setHeader("set-cookie", [
+      ...uiAuth.clearCookies(request),
+      `${CODEMAN_INSTANCE_COOKIE}=; Path=/; Max-Age=0; SameSite=Lax${isSecureRequest(request) ? "; Secure" : ""}`
+    ]);
+    sendJson(response, 204, {});
+    return;
+  }
+  const selectedInstanceId = selectedInstance(request);
+  const fleetSelectMatch = url.pathname.match(/^\/api\/fleet\/select\/([^/]+)$/);
+  if (method === "GET" && fleetSelectMatch) {
+    const instanceId = decodeURIComponent(fleetSelectMatch[1]);
+    const instance = hub.getInstance(instanceId);
+    if (instance.connectionMode !== "tailscale-url" || !instance.endpoint) {
+      throw new HttpError(400, "This instance is not available through the tailnet proxy");
+    }
+    try {
+      await hub.prepareNativeUi(instanceId);
+    } catch {
+    }
+    response.setHeader(
+      "set-cookie",
+      `${CODEMAN_INSTANCE_COOKIE}=${encodeURIComponent(instanceId)}; Path=/; Max-Age=86400; SameSite=Lax${isSecureRequest(request) ? "; Secure" : ""}`
+    );
+    response.writeHead(303, { location: "/" });
+    response.end();
+    return;
+  }
+  if (method === "GET" && url.pathname === "/api/fleet/clear") {
+    response.setHeader(
+      "set-cookie",
+      `${CODEMAN_INSTANCE_COOKIE}=; Path=/; Max-Age=0; SameSite=Lax${isSecureRequest(request) ? "; Secure" : ""}`
+    );
+    response.writeHead(303, { location: "/" });
+    response.end();
+    return;
+  }
+  if (method === "GET" && url.pathname === "/api/fleet/current") {
+    sendJson(response, 200, {
+      instanceId: selectedInstanceId,
+      instance: selectedInstanceId ? publicInstance(hub.getInstance(selectedInstanceId)) : null
+    });
+    return;
+  }
+  if (method === "GET" && url.pathname === "/fleet-host-switcher.js") {
+    await serveDashboardAsset("/fleet-host-switcher.js", response);
+    return;
+  }
+  if (method === "GET" && !url.pathname.startsWith("/api/")) {
+    if (selectedInstanceId) {
+      await hub.proxyCodemanRequest(selectedInstanceId, request, response);
+      return;
+    }
+    await serveDashboardAsset(url.pathname, response);
+    return;
+  }
+  if (method === "GET" && url.pathname === "/api/instances") {
+    sendJson(response, 200, { instances: hub.listInstances().map(publicInstance) });
+    return;
+  }
+  if (method === "POST" && url.pathname === "/api/instances") {
+    const body = await readJson(request);
+    const credentials = body.credentials;
+    const registration = { ...body };
+    delete registration.credentials;
+    if (credentials !== void 0 && (typeof credentials.username !== "string" || credentials.username.length === 0 || typeof credentials.password !== "string")) {
+      throw new HttpError(400, "Codeman credentials must include a username and password");
+    }
+    if (registration.connectionMode === "tailscale-url" && (!registration.endpoint || !isTailnetEndpoint(registration.endpoint) && !isLoopbackEndpoint(registration.endpoint))) {
+      throw new HttpError(400, "Codeman endpoint must be a Tailscale HTTPS hostname or loopback development URL");
+    }
+    if (registration.connectionMode === "connector") {
+      const node = controlPlane.nodes.list().find((candidate) => candidate.id === registration.nodeId);
+      if (!node) throw new HttpError(404, `Unknown node: ${registration.nodeId}`);
+      if (node.status === "revoked") throw new HttpError(403, `Node is revoked: ${node.id}`);
+      if (!node.capabilities.includes("codeman")) {
+        throw new HttpError(400, `Node does not support Codeman: ${node.id}`);
+      }
+    }
+    const instance = hub.registerInstance(
+      registration,
+      credentials ? { username: credentials.username, password: credentials.password } : void 0
+    );
+    sendJson(response, 201, { instance: publicInstance(instance) });
+    return;
+  }
+  const instanceMatch = url.pathname.match(/^\/api\/instances\/([^/]+)$/);
+  if (method === "GET" && instanceMatch) {
+    const instance = hub.getInstance(decodeURIComponent(instanceMatch[1]));
+    sendJson(response, 200, { instance: publicInstance(instance) });
+    return;
+  }
+  const instanceCapabilitiesMatch = url.pathname.match(
+    /^\/api\/instances\/([^/]+)\/capabilities$/
+  );
+  if (method === "GET" && instanceCapabilitiesMatch) {
+    const instanceId = decodeURIComponent(instanceCapabilitiesMatch[1]);
+    const agents = await hub.listCapabilities(instanceId);
+    sendJson(response, 200, { agents });
+    return;
+  }
+  const instanceHealthMatch = url.pathname.match(/^\/api\/instances\/([^/]+)\/health$/);
+  if (method === "POST" && instanceHealthMatch) {
+    const instanceId = decodeURIComponent(instanceHealthMatch[1]);
+    const instance = await hub.checkInstance(instanceId);
+    sendJson(response, 200, { instance: publicInstance(instance) });
+    return;
+  }
+  if (method === "DELETE" && instanceMatch) {
+    const instanceId = decodeURIComponent(instanceMatch[1]);
+    hub.removeInstance(instanceId);
+    sendJson(response, 204, {});
+    return;
+  }
+  if (method === "GET" && url.pathname === "/api/sessions" && !selectedInstanceId) {
+    const instanceId = url.searchParams.get("instanceId");
+    if (instanceId) hub.getInstance(instanceId);
+    sendJson(response, 200, {
+      sessions: instanceId ? hub.listSessions().filter((session) => session.instanceId === instanceId) : hub.listSessions()
+    });
+    return;
+  }
+  const instanceWorkspaceMatch = url.pathname.match(/^\/api\/instances\/([^/]+)\/workspaces$/);
+  const instanceWorkspaceSuggestionMatch = url.pathname.match(
+    /^\/api\/instances\/([^/]+)\/workspaces\/suggestions$/
+  );
+  if (method === "GET" && instanceWorkspaceSuggestionMatch) {
+    const instanceId = decodeURIComponent(instanceWorkspaceSuggestionMatch[1]);
+    const suggestions = await hub.suggestWorkspacePaths(
+      instanceId,
+      url.searchParams.get("path") ?? ""
+    );
+    sendJson(response, 200, { suggestions });
+    return;
+  }
+  if (method === "GET" && instanceWorkspaceMatch) {
+    const instance = hub.getInstance(decodeURIComponent(instanceWorkspaceMatch[1]));
+    sendJson(response, 200, { workspaces: instance.workspaces });
+    return;
+  }
+  const instanceSessionsMatch = url.pathname.match(/^\/api\/instances\/([^/]+)\/sessions$/);
+  if (method === "GET" && instanceSessionsMatch) {
+    const instanceId = decodeURIComponent(instanceSessionsMatch[1]);
+    await Promise.all([
+      hub.listCapabilities(instanceId),
+      hub.syncSessions(instanceId)
+    ]);
+    sendJson(response, 200, {
+      sessions: hub.listSessions().filter((session) => session.instanceId === instanceId)
+    });
+    return;
+  }
+  if (method === "POST" && instanceSessionsMatch) {
+    const instanceId = decodeURIComponent(instanceSessionsMatch[1]);
+    const body = await readJson(request);
+    const session = await hub.createSession(
+      instanceId,
+      body.workspaceId,
+      body.agentId,
+      body.title,
+      body.workspacePath
+    );
+    sendJson(response, 201, { session });
+    return;
+  }
+  const sessionRemoveMatch = url.pathname.match(
+    /^\/api\/instances\/([^/]+)\/sessions\/([^/]+)$/
+  );
+  if (method === "DELETE" && sessionRemoveMatch) {
+    hub.removeSession(
+      decodeURIComponent(sessionRemoveMatch[1]),
+      decodeURIComponent(sessionRemoveMatch[2])
+    );
+    sendJson(response, 204, {});
+    return;
+  }
+  const sessionInputMatch = url.pathname.match(
+    /^\/api\/instances\/([^/]+)\/sessions\/([^/]+)\/input$/
+  );
+  if (method === "POST" && sessionInputMatch) {
+    const body = await readJson(request);
+    await hub.sendInput(
+      decodeURIComponent(sessionInputMatch[1]),
+      decodeURIComponent(sessionInputMatch[2]),
+      body.input,
+      body.raw === true
+    );
+    sendJson(response, 202, { accepted: true });
+    return;
+  }
+  const sessionResizeMatch = url.pathname.match(
+    /^\/api\/instances\/([^/]+)\/sessions\/([^/]+)\/resize$/
+  );
+  if (method === "POST" && sessionResizeMatch) {
+    const body = await readJson(request);
+    if (!Number.isInteger(body.cols) || !Number.isInteger(body.rows) || body.cols < 1 || body.cols > 500 || body.rows < 1 || body.rows > 500) {
+      throw new HttpError(400, "Terminal size must be between 1 and 500 columns and rows");
+    }
+    await hub.resizeSession(
+      decodeURIComponent(sessionResizeMatch[1]),
+      decodeURIComponent(sessionResizeMatch[2]),
+      body.cols,
+      body.rows
+    );
+    sendJson(response, 202, { accepted: true });
+    return;
+  }
+  const sessionStopMatch = url.pathname.match(
+    /^\/api\/instances\/([^/]+)\/sessions\/([^/]+)\/stop$/
+  );
+  if (method === "POST" && sessionStopMatch) {
+    const instanceId = decodeURIComponent(sessionStopMatch[1]);
+    const sessionId = decodeURIComponent(sessionStopMatch[2]);
+    await hub.stopSession(instanceId, sessionId);
+    sendJson(response, 202, { accepted: true });
+    return;
+  }
+  if (method === "GET" && url.pathname === "/api/events") {
+    if (selectedInstanceId) {
+      await hub.proxyCodemanRequest(selectedInstanceId, request, response);
+      return;
+    }
+    const instanceId = url.searchParams.get("instanceId");
+    if (instanceId) hub.getInstance(instanceId);
+    response.writeHead(200, {
+      "content-type": "text/event-stream; charset=utf-8",
+      "cache-control": "no-cache, no-store",
+      connection: "keep-alive"
+    });
+    response.write(`event: snapshot
+data: ${JSON.stringify({
+      instances: instanceId ? hub.listInstances().filter((instance) => instance.id === instanceId) : hub.listInstances(),
+      sessions: instanceId ? hub.listSessions().filter((session) => session.instanceId === instanceId) : hub.listSessions()
+    })}
+
+`);
+    const unsubscribe = hub.subscribeEvents((event) => {
+      if (!response.writableEnded && (!instanceId || event.instanceId === instanceId)) {
+        response.write(`event: session
+data: ${JSON.stringify(event)}
+
+`);
+      }
+    });
+    const keepAlive = setInterval(() => {
+      if (!response.writableEnded) response.write(": keep-alive\n\n");
+    }, 15e3);
+    response.on("close", () => {
+      clearInterval(keepAlive);
+      unsubscribe();
+    });
+    return;
+  }
+  if (method === "GET" && url.pathname === "/api/workers") {
+    sendJson(response, 200, { workers: controlPlane.nodes.list() });
+    return;
+  }
+  if (method === "POST" && url.pathname === "/api/workers") {
+    const registration = await readJson(request);
+    const worker = controlPlane.enrollNode(registration);
+    sendJson(response, 201, { worker });
+    return;
+  }
+  const connectMatch = url.pathname.match(/^\/api\/workers\/([^/]+)\/connect$/);
+  if (method === "GET" && connectMatch) {
+    const nodeId = decodeURIComponent(connectMatch[1]);
+    const node = controlPlane.nodes.list().find((candidate) => candidate.id === nodeId);
+    if (!node) {
+      sendJson(response, 404, { error: "Worker not found" });
+      return;
+    }
+    response.writeHead(200, {
+      "content-type": "text/event-stream; charset=utf-8",
+      "cache-control": "no-cache, no-store",
+      connection: "keep-alive"
+    });
+    response.write(`event: connected
+data: ${JSON.stringify({ nodeId })}
+
+`);
+    const connection = {
+      node,
+      send: async (message) => {
+        if (!response.writableEnded) {
+          response.write(`data: ${JSON.stringify(message)}
+
+`);
+        }
+      },
+      close: async () => {
+        if (!response.writableEnded) response.end();
+      }
+    };
+    controlPlane.registerConnection(connection);
+    response.on("close", () => controlPlane.removeConnection(nodeId, connection));
+    return;
+  }
+  const messageMatch = url.pathname.match(/^\/api\/workers\/([^/]+)\/messages$/);
+  if (method === "POST" && messageMatch) {
+    const message = await readJson(request);
+    controlPlane.receiveNodeMessage(decodeURIComponent(messageMatch[1]), message);
+    sendJson(response, 202, { accepted: true });
+    return;
+  }
+  const heartbeatMatch = url.pathname.match(/^\/api\/workers\/([^/]+)\/heartbeat$/);
+  if (method === "POST" && heartbeatMatch) {
+    const heartbeat = await readJson(request);
+    const worker = controlPlane.heartbeatNode({
+      ...heartbeat,
+      nodeId: heartbeatMatch[1]
+    });
+    sendJson(response, 200, { worker });
+    return;
+  }
+  if (method === "POST" && url.pathname === "/api/jobs") {
+    const jobRequest = await readJson(request);
+    const job = await controlPlane.createJob(jobRequest);
+    sendJson(response, 202, { job });
+    return;
+  }
+  const jobMatch = url.pathname.match(/^\/api\/jobs\/([^/]+)$/);
+  if (method === "GET" && jobMatch) {
+    const job = controlPlane.jobs.get(jobMatch[1]);
+    if (!job) {
+      sendJson(response, 404, { error: "Job not found" });
+      return;
+    }
+    sendJson(response, 200, { job });
+    return;
+  }
+  const cancelMatch = url.pathname.match(/^\/api\/jobs\/([^/]+)\/cancel$/);
+  if (method === "POST" && cancelMatch) {
+    await controlPlane.cancelJob(cancelMatch[1]);
+    sendJson(response, 202, { job: controlPlane.jobs.get(cancelMatch[1]) });
+    return;
+  }
+  if (method === "GET" && url.pathname === "/api/audit") {
+    sendJson(response, 200, {
+      events: [...controlPlane.audit.list(), ...hub.listAudit()]
+    });
+    return;
+  }
+  if (selectedInstanceId) {
+    await hub.proxyCodemanRequest(selectedInstanceId, request, response);
+    return;
+  }
+  sendJson(response, 404, { error: "Not found" });
+}
+async function serveDashboardAsset(pathname, response) {
+  let relativePath;
+  try {
+    relativePath = pathname === "/" ? "index.html" : decodeURIComponent(pathname.slice(1));
+  } catch {
+    sendJson(response, 400, { error: "Invalid asset path" });
+    return;
+  }
+  const filePath = resolve(DASHBOARD_ROOT, relativePath);
+  if (filePath !== DASHBOARD_ROOT && !filePath.startsWith(`${DASHBOARD_ROOT}${sep}`)) {
+    sendJson(response, 404, { error: "Not found" });
+    return;
+  }
+  try {
+    const body = await readFile(filePath);
+    response.writeHead(200, {
+      "content-type": contentType(filePath),
+      "cache-control": "no-cache"
+    });
+    response.end(body);
+  } catch {
+    sendJson(response, 404, { error: "Not found" });
+  }
+}
+function contentType(filePath) {
+  if (filePath.endsWith(".html")) return "text/html; charset=utf-8";
+  if (filePath.endsWith(".js")) return "application/javascript; charset=utf-8";
+  if (filePath.endsWith(".css")) return "text/css; charset=utf-8";
+  return "application/octet-stream";
+}
+function isWorkerOrJobRoute(pathname) {
+  return pathname === "/api/workers" || pathname.startsWith("/api/workers/") || pathname === "/api/jobs" || pathname.startsWith("/api/jobs/");
+}
+function isCodemanProxiedApiPath(pathname) {
+  if (!pathname.startsWith("/api/")) return false;
+  return !(pathname === "/api/auth" || pathname.startsWith("/api/auth/") || pathname === "/api/fleet" || pathname.startsWith("/api/fleet/") || pathname === "/api/instances" || pathname.startsWith("/api/instances/") || pathname === "/api/workers" || pathname.startsWith("/api/workers/") || pathname === "/api/jobs" || pathname.startsWith("/api/jobs/") || pathname === "/api/audit");
+}
+function readCodemanCredentials() {
+  const encoded = process.env.HOSTED_AGENTS_CODEMAN_CREDENTIALS;
+  if (!encoded) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(encoded);
+  } catch {
+    throw new Error("HOSTED_AGENTS_CODEMAN_CREDENTIALS must be valid JSON");
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error("HOSTED_AGENTS_CODEMAN_CREDENTIALS must be an object");
+  }
+  const credentials = {};
+  for (const [instanceId, value] of Object.entries(parsed)) {
+    if (typeof value !== "object" || value === null || Array.isArray(value) || typeof value.username !== "string" || typeof value.password !== "string") {
+      throw new Error(`Invalid Codeman credentials for instance ${instanceId}`);
+    }
+    credentials[instanceId] = {
+      username: value.username,
+      password: value.password
+    };
+  }
+  return credentials;
+}
+function clientAddress(request) {
+  const forwarded = request.headers["x-forwarded-for"];
+  if (typeof forwarded === "string" && forwarded.trim()) {
+    return forwarded.split(",")[0].trim();
+  }
+  return request.socket.remoteAddress ?? "unknown";
+}
+function selectedInstance(request) {
+  const cookie = request.headers.cookie;
+  for (const item of cookie?.split(";") ?? []) {
+    const separator = item.indexOf("=");
+    if (separator < 1 || item.slice(0, separator).trim() !== CODEMAN_INSTANCE_COOKIE) continue;
+    const value = item.slice(separator + 1).trim();
+    try {
+      return decodeURIComponent(value) || void 0;
+    } catch {
+      return value || void 0;
+    }
+  }
+  return void 0;
+}
+function isSecureRequest(request) {
+  return request.headers["x-forwarded-proto"] === "https" || request.socket.encrypted === true;
+}
+function isTailnetEndpoint(value) {
+  try {
+    const endpoint = new URL(value);
+    return endpoint.protocol === "https:" && (endpoint.hostname.endsWith(".ts.net") || endpoint.hostname.endsWith(".ts.net.") || isTailscaleIpv4(endpoint.hostname));
+  } catch {
+    return false;
+  }
+}
+function isLoopbackEndpoint(value) {
+  try {
+    const endpoint = new URL(value);
+    return endpoint.hostname === "localhost" || endpoint.hostname === "127.0.0.1" || endpoint.hostname === "::1" || endpoint.hostname === "[::1]";
+  } catch {
+    return false;
+  }
+}
+function isTailscaleIpv4(hostname) {
+  const parts = hostname.split(".");
+  if (parts.length !== 4 || parts.some((part) => !/^\d+$/.test(part))) return false;
+  const [first, second] = parts.map(Number);
+  return first === 100 && second >= 64 && second <= 127;
+}
+function publicInstance(instance) {
+  return { ...instance, endpoint: null };
+}
+function isLoopback(host) {
+  return host === "127.0.0.1" || host === "::1" || host === "localhost";
+}
+function sendJson(response, status, body) {
+  if (status === 204) {
+    response.writeHead(status);
+    response.end();
+    return;
+  }
+  response.writeHead(status, {
+    "content-type": "application/json; charset=utf-8",
+    "cache-control": "no-store"
+  });
+  response.end(JSON.stringify(body));
+}
+function sendLoginPage(response, authEnabled) {
+  if (!authEnabled) {
+    sendJson(response, 401, { error: "Unauthorized" });
+    return;
+  }
+  response.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+  response.end(`<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Hosted Agents \u2014 Sign in</title>
+<style>
+body{margin:0;min-height:100vh;display:grid;place-items:center;background:#090c10;color:#d7dee7;font:16px system-ui,sans-serif}
+main{width:min(360px,calc(100vw - 48px));padding:28px;border:1px solid #253044;border-radius:14px;background:#111722;box-shadow:0 20px 60px #0008}
+h1{margin:0 0 8px;font-size:22px}p{color:#98a6ba;margin:0 0 22px}
+label{display:grid;gap:8px;color:#b9c5d6}input{padding:12px;border:1px solid #3a465b;border-radius:8px;background:#090c10;color:inherit;font:inherit}
+button{width:100%;margin-top:16px;padding:12px;border:0;border-radius:8px;background:#77e0af;color:#07110d;font:600 15px system-ui;cursor:pointer}
+#error{min-height:20px;margin-top:12px;color:#ff8585}
+</style></head>
+<body><main><h1>Hosted Agents</h1><p>Sign in to the private fleet Hub.</p>
+<form id="login"><label>Password<input id="password" type="password" autocomplete="current-password" required autofocus></label>
+<button type="submit">Sign in</button><div id="error" role="alert"></div></form></main>
+<script>
+document.getElementById("login").addEventListener("submit",async function(event){
+event.preventDefault();const error=document.getElementById("error");error.textContent="";
+try{const response=await fetch("/api/auth/login",{method:"POST",credentials:"same-origin",headers:{"content-type":"application/json"},body:JSON.stringify({password:document.getElementById("password").value})});
+if(!response.ok)throw new Error((await response.json().catch(function(){return {}})).error||"Sign in failed");
+location.assign("/");}catch(cause){error.textContent=cause.message||"Sign in failed";}
+});
+</script></body></html>`);
+}
+function rejectUpgrade(socket, status, message) {
+  if (socket.destroyed) return;
+  socket.write(
+    `HTTP/1.1 ${status} ${message}\r
+Connection: close\r
+Content-Type: text/plain; charset=utf-8\r
+Content-Length: ${Buffer.byteLength(message)}\r
+\r
+` + message
+  );
+  socket.destroy();
+}
+var HttpError = class extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.name = "HttpError";
+    this.status = status;
+  }
+};
+async function readJson(request) {
+  const chunks = [];
+  const decoder = new TextDecoder();
+  let size = 0;
+  for await (const chunk of request) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    size += buffer.length;
+    if (size > MAX_BODY_BYTES) throw new Error("Request body is too large");
+    chunks.push(decoder.decode(buffer, { stream: true }));
+  }
+  if (chunks.length === 0) throw new Error("Request body is required");
+  chunks.push(decoder.decode());
+  return JSON.parse(chunks.join(""));
+}
+if (process.argv[1]?.endsWith("/server.ts") || process.argv[1]?.endsWith("\\server.ts") || process.argv[1]?.endsWith("/server.mjs") || process.argv[1]?.endsWith("\\server.mjs")) {
+  startControllerServer();
+}
+export {
+  createControllerServer,
+  startControllerServer
+};