@cluesmith/codev 2.0.0-rc.9 → 2.0.1

package/dist/agent-farm/lib/nonce-store.js

@@ -0,0 +1,60 @@
+/**
+ * In-memory nonce store for OAuth registration state management.
+ *
+ * Bridges the gap between OAuth initiation (POST /api/tunnel/connect)
+ * and completion (GET /api/tunnel/connect/callback) by storing
+ * pending registration data keyed by a single-use nonce.
+ */
+import { randomUUID } from 'node:crypto';
+const NONCE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+const pendingRegistrations = new Map();
+/**
+ * Create a pending registration with a unique nonce.
+ * Runs cleanup of expired entries on each call.
+ */
+export function createPendingRegistration(name, serverUrl) {
+    cleanupExpired();
+    const nonce = randomUUID();
+    pendingRegistrations.set(nonce, {
+        nonce,
+        name,
+        serverUrl,
+        createdAt: Date.now(),
+    });
+    return nonce;
+}
+/**
+ * Consume a pending registration by nonce (single-use).
+ * Returns the registration data and deletes it, or null if not found/expired.
+ */
+export function consumePendingRegistration(nonce) {
+    const entry = pendingRegistrations.get(nonce);
+    if (!entry)
+        return null;
+    // Check expiry
+    if (Date.now() - entry.createdAt > NONCE_TTL_MS) {
+        pendingRegistrations.delete(nonce);
+        return null;
+    }
+    // Single-use: delete after consumption
+    pendingRegistrations.delete(nonce);
+    return entry;
+}
+/**
+ * Remove all expired entries from the store.
+ */
+function cleanupExpired() {
+    const now = Date.now();
+    for (const [nonce, entry] of pendingRegistrations) {
+        if (now - entry.createdAt > NONCE_TTL_MS) {
+            pendingRegistrations.delete(nonce);
+        }
+    }
+}
+/**
+ * Clear all pending registrations. Used for testing.
+ */
+export function clearPendingRegistrations() {
+    pendingRegistrations.clear();
+}
+//# sourceMappingURL=nonce-store.js.map

package/dist/agent-farm/lib/nonce-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce-store.js","sourceRoot":"","sources":["../../../src/agent-farm/lib/nonce-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAShD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAA+B,CAAC;AAEpE;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,SAAiB;IACvE,cAAc,EAAE,CAAC;IAEjB,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE;QAC9B,KAAK;QACL,IAAI;QACJ,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,eAAe;IACf,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;QAChD,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uCAAuC;IACvC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAClD,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;YACzC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB;IACvC,oBAAoB,CAAC,KAAK,EAAE,CAAC;AAC/B,CAAC"}

package/dist/agent-farm/lib/token-exchange.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Token exchange for Tower cloud registration.
+ *
+ * Shared between CLI (tower-cloud.ts) and Tower server (tower-tunnel.ts)
+ * for exchanging an OAuth registration token for API credentials.
+ */
+/**
+ * Exchange a registration token for API key and tower ID.
+ *
+ * POSTs to {serverUrl}/api/towers/register/redeem with the token,
+ * tower name, and machine ID. Handles 301/302 redirects manually
+ * to preserve the POST method (fetch follows redirects as GET).
+ */
+export declare function redeemToken(serverUrl: string, token: string, towerName: string, machineId: string): Promise<{
+    towerId: string;
+    apiKey: string;
+}>;
+//# sourceMappingURL=token-exchange.d.ts.map

package/dist/agent-farm/lib/token-exchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.d.ts","sourceRoot":"","sources":["../../../src/agent-farm/lib/token-exchange.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAsC9C"}

package/dist/agent-farm/lib/token-exchange.js

@@ -0,0 +1,48 @@
+/**
+ * Token exchange for Tower cloud registration.
+ *
+ * Shared between CLI (tower-cloud.ts) and Tower server (tower-tunnel.ts)
+ * for exchanging an OAuth registration token for API credentials.
+ */
+/**
+ * Exchange a registration token for API key and tower ID.
+ *
+ * POSTs to {serverUrl}/api/towers/register/redeem with the token,
+ * tower name, and machine ID. Handles 301/302 redirects manually
+ * to preserve the POST method (fetch follows redirects as GET).
+ */
+export async function redeemToken(serverUrl, token, towerName, machineId) {
+    const url = `${serverUrl}/api/towers/register/redeem`;
+    const body = JSON.stringify({ token, name: towerName, machineId });
+    // Use manual redirect to preserve POST method across 301/302 redirects
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body,
+        redirect: 'manual',
+        signal: AbortSignal.timeout(30_000),
+    }).then((res) => {
+        if (res.status >= 300 && res.status < 400) {
+            const location = res.headers.get('location');
+            if (location) {
+                return fetch(location, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body,
+                    signal: AbortSignal.timeout(30_000),
+                });
+            }
+        }
+        return res;
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => '');
+        throw new Error(`Registration failed (${response.status}): ${text || response.statusText}`);
+    }
+    const data = (await response.json());
+    if (!data.towerId || !data.apiKey) {
+        throw new Error('Invalid response from registration server: missing towerId or apiKey');
+    }
+    return { towerId: data.towerId, apiKey: data.apiKey };
+}
+//# sourceMappingURL=token-exchange.js.map

package/dist/agent-farm/lib/token-exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.js","sourceRoot":"","sources":["../../../src/agent-farm/lib/token-exchange.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,KAAa,EACb,SAAiB,EACjB,SAAiB;IAEjB,MAAM,GAAG,GAAG,GAAG,SAAS,6BAA6B,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAEnE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI;QACJ,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACd,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7C,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC,QAAQ,EAAE;oBACrB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI;oBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0C,CAAC;IAE9E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC"}

package/dist/agent-farm/lib/tower-client.d.ts

@@ -0,0 +1,163 @@
+/**
+ * Tower API Client (Spec 0090 Phase 3)
+ *
+ * Provides a client for CLI commands to interact with the tower daemon.
+ * Handles local-key authentication and common API operations.
+ */
+/**
+ * Project info returned by tower API
+ */
+export interface TowerProject {
+    path: string;
+    name: string;
+    active: boolean;
+    proxyUrl: string;
+    terminals: number;
+}
+/**
+ * Project status with detailed info
+ */
+export interface TowerProjectStatus {
+    path: string;
+    name: string;
+    active: boolean;
+    terminals: Array<{
+        type: 'architect' | 'builder' | 'shell';
+        id: string;
+        label: string;
+        url: string;
+        active: boolean;
+    }>;
+    gateStatus?: {
+        hasGate: boolean;
+        gateName?: string;
+        builderId?: string;
+        requestedAt?: string;
+    };
+}
+/**
+ * Health status from tower
+ */
+export interface TowerHealth {
+    status: 'healthy' | 'degraded';
+    uptime: number;
+    activeProjects: number;
+    totalProjects: number;
+    memoryUsage: number;
+    timestamp: string;
+}
+/**
+ * Terminal info from tower
+ */
+export interface TowerTerminal {
+    id: string;
+    pid: number;
+    cols: number;
+    rows: number;
+    label: string;
+    status: 'running' | 'exited';
+    createdAt: string;
+    wsPath: string;
+}
+/**
+ * Encode a project path for use in tower API URLs
+ */
+export declare function encodeProjectPath(projectPath: string): string;
+/**
+ * Decode a project path from tower API URL
+ */
+export declare function decodeProjectPath(encoded: string): string;
+/**
+ * Tower API client class
+ */
+export declare class TowerClient {
+    private readonly baseUrl;
+    private readonly localKey;
+    constructor(port?: number);
+    /**
+     * Make a request to the tower API
+     */
+    request<T>(path: string, options?: RequestInit): Promise<{
+        ok: boolean;
+        status: number;
+        data?: T;
+        error?: string;
+    }>;
+    /**
+     * Check if tower is running and healthy
+     */
+    isRunning(): Promise<boolean>;
+    /**
+     * Get tower health status
+     */
+    getHealth(): Promise<TowerHealth | null>;
+    /**
+     * List all projects known to tower
+     */
+    listProjects(): Promise<TowerProject[]>;
+    /**
+     * Activate a project (start its dashboard)
+     */
+    activateProject(projectPath: string): Promise<{
+        ok: boolean;
+        adopted?: boolean;
+        error?: string;
+    }>;
+    /**
+     * Deactivate a project (stop its dashboard)
+     */
+    deactivateProject(projectPath: string): Promise<{
+        ok: boolean;
+        stopped?: number[];
+        error?: string;
+    }>;
+    /**
+     * Get status of a specific project
+     */
+    getProjectStatus(projectPath: string): Promise<TowerProjectStatus | null>;
+    /**
+     * Create a terminal session
+     */
+    createTerminal(options: {
+        command?: string;
+        args?: string[];
+        cols?: number;
+        rows?: number;
+        cwd?: string;
+        label?: string;
+        env?: Record<string, string>;
+    }): Promise<TowerTerminal | null>;
+    /**
+     * List all terminal sessions
+     */
+    listTerminals(): Promise<TowerTerminal[]>;
+    /**
+     * Get terminal info
+     */
+    getTerminal(terminalId: string): Promise<TowerTerminal | null>;
+    /**
+     * Write data to a terminal session
+     */
+    writeTerminal(terminalId: string, data: string): Promise<boolean>;
+    /**
+     * Kill a terminal session
+     */
+    killTerminal(terminalId: string): Promise<boolean>;
+    /**
+     * Resize a terminal
+     */
+    resizeTerminal(terminalId: string, cols: number, rows: number): Promise<TowerTerminal | null>;
+    /**
+     * Get the tower dashboard URL for a project
+     */
+    getProjectUrl(projectPath: string): string;
+    /**
+     * Get the WebSocket URL for a terminal
+     */
+    getTerminalWsUrl(terminalId: string): string;
+}
+/**
+ * Get the default tower client
+ */
+export declare function getTowerClient(port?: number): TowerClient;
+//# sourceMappingURL=tower-client.d.ts.map

package/dist/agent-farm/lib/tower-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tower-client.d.ts","sourceRoot":"","sources":["../../../src/agent-farm/lib/tower-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAeH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,KAAK,CAAC;QACf,IAAI,EAAE,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;QACxC,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC,CAAC;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,IAAI,GAAE,MAA2B;IAK7C;;OAEG;IACG,OAAO,CAAC,CAAC,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA0CrE;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAKnC;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAK9C;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAK7C;;OAEG;IACG,eAAe,CACnB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAkB9D;;OAEG;IACG,iBAAiB,CACrB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAkB/D;;OAEG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAM/E;;OAEG;IACG,cAAc,CAAC,OAAO,EAAE;QAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAQjC;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAK/C;;OAEG;IACG,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKpE;;OAEG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQvE;;OAEG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKxD;;OAEG;IACG,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAQhC;;OAEG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;IAK1C;;OAEG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;CAG7C;AAOD;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAKzD"}

package/dist/agent-farm/lib/tower-client.js

@@ -0,0 +1,233 @@
+/**
+ * Tower API Client (Spec 0090 Phase 3)
+ *
+ * Provides a client for CLI commands to interact with the tower daemon.
+ * Handles local-key authentication and common API operations.
+ */
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { randomBytes } from 'node:crypto';
+// Tower configuration
+const DEFAULT_TOWER_PORT = 4100;
+const AGENT_FARM_DIR = resolve(homedir(), '.agent-farm');
+const LOCAL_KEY_PATH = resolve(AGENT_FARM_DIR, 'local-key');
+// Request timeout
+const REQUEST_TIMEOUT_MS = 10000;
+/**
+ * Get or create the local key for CLI authentication
+ */
+function getLocalKey() {
+    if (!existsSync(AGENT_FARM_DIR)) {
+        mkdirSync(AGENT_FARM_DIR, { recursive: true, mode: 0o700 });
+    }
+    if (!existsSync(LOCAL_KEY_PATH)) {
+        const key = randomBytes(32).toString('hex');
+        writeFileSync(LOCAL_KEY_PATH, key, { mode: 0o600 });
+        return key;
+    }
+    return readFileSync(LOCAL_KEY_PATH, 'utf-8').trim();
+}
+/**
+ * Encode a project path for use in tower API URLs
+ */
+export function encodeProjectPath(projectPath) {
+    return Buffer.from(projectPath).toString('base64url');
+}
+/**
+ * Decode a project path from tower API URL
+ */
+export function decodeProjectPath(encoded) {
+    return Buffer.from(encoded, 'base64url').toString('utf-8');
+}
+/**
+ * Tower API client class
+ */
+export class TowerClient {
+    baseUrl;
+    localKey;
+    constructor(port = DEFAULT_TOWER_PORT) {
+        this.baseUrl = `http://localhost:${port}`;
+        this.localKey = getLocalKey();
+    }
+    /**
+     * Make a request to the tower API
+     */
+    async request(path, options = {}) {
+        try {
+            const response = await fetch(`${this.baseUrl}${path}`, {
+                ...options,
+                headers: {
+                    ...options.headers,
+                    'codev-web-key': this.localKey,
+                    'Content-Type': 'application/json',
+                },
+                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            });
+            if (!response.ok) {
+                const text = await response.text();
+                let error;
+                try {
+                    const json = JSON.parse(text);
+                    error = json.error || json.message || text;
+                }
+                catch {
+                    error = text;
+                }
+                return { ok: false, status: response.status, error };
+            }
+            if (response.status === 204) {
+                return { ok: true, status: 204 };
+            }
+            const data = (await response.json());
+            return { ok: true, status: response.status, data };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            if (message.includes('ECONNREFUSED')) {
+                return { ok: false, status: 0, error: 'Tower not running' };
+            }
+            if (message.includes('timeout')) {
+                return { ok: false, status: 0, error: 'Request timeout' };
+            }
+            return { ok: false, status: 0, error: message };
+        }
+    }
+    /**
+     * Check if tower is running and healthy
+     */
+    async isRunning() {
+        const result = await this.request('/health');
+        return result.ok && result.data?.status === 'healthy';
+    }
+    /**
+     * Get tower health status
+     */
+    async getHealth() {
+        const result = await this.request('/health');
+        return result.ok ? result.data : null;
+    }
+    /**
+     * List all projects known to tower
+     */
+    async listProjects() {
+        const result = await this.request('/api/projects');
+        return result.ok ? result.data.projects : [];
+    }
+    /**
+     * Activate a project (start its dashboard)
+     */
+    async activateProject(projectPath) {
+        const encoded = encodeProjectPath(projectPath);
+        const result = await this.request(`/api/projects/${encoded}/activate`, { method: 'POST' });
+        if (!result.ok) {
+            return { ok: false, error: result.error };
+        }
+        return {
+            ok: result.data?.success ?? true,
+            adopted: result.data?.adopted,
+            error: result.data?.error,
+        };
+    }
+    /**
+     * Deactivate a project (stop its dashboard)
+     */
+    async deactivateProject(projectPath) {
+        const encoded = encodeProjectPath(projectPath);
+        const result = await this.request(`/api/projects/${encoded}/deactivate`, { method: 'POST' });
+        if (!result.ok) {
+            return { ok: false, error: result.error };
+        }
+        return {
+            ok: result.data?.success ?? true,
+            stopped: result.data?.stopped,
+            error: result.data?.error,
+        };
+    }
+    /**
+     * Get status of a specific project
+     */
+    async getProjectStatus(projectPath) {
+        const encoded = encodeProjectPath(projectPath);
+        const result = await this.request(`/api/projects/${encoded}/status`);
+        return result.ok ? result.data : null;
+    }
+    /**
+     * Create a terminal session
+     */
+    async createTerminal(options) {
+        const result = await this.request('/api/terminals', {
+            method: 'POST',
+            body: JSON.stringify(options),
+        });
+        return result.ok ? result.data : null;
+    }
+    /**
+     * List all terminal sessions
+     */
+    async listTerminals() {
+        const result = await this.request('/api/terminals');
+        return result.ok ? result.data.terminals : [];
+    }
+    /**
+     * Get terminal info
+     */
+    async getTerminal(terminalId) {
+        const result = await this.request(`/api/terminals/${terminalId}`);
+        return result.ok ? result.data : null;
+    }
+    /**
+     * Write data to a terminal session
+     */
+    async writeTerminal(terminalId, data) {
+        const result = await this.request(`/api/terminals/${terminalId}/write`, {
+            method: 'POST',
+            body: JSON.stringify({ data }),
+        });
+        return result.ok;
+    }
+    /**
+     * Kill a terminal session
+     */
+    async killTerminal(terminalId) {
+        const result = await this.request(`/api/terminals/${terminalId}`, { method: 'DELETE' });
+        return result.ok;
+    }
+    /**
+     * Resize a terminal
+     */
+    async resizeTerminal(terminalId, cols, rows) {
+        const result = await this.request(`/api/terminals/${terminalId}/resize`, {
+            method: 'POST',
+            body: JSON.stringify({ cols, rows }),
+        });
+        return result.ok ? result.data : null;
+    }
+    /**
+     * Get the tower dashboard URL for a project
+     */
+    getProjectUrl(projectPath) {
+        const encoded = encodeProjectPath(projectPath);
+        return `${this.baseUrl}/project/${encoded}/`;
+    }
+    /**
+     * Get the WebSocket URL for a terminal
+     */
+    getTerminalWsUrl(terminalId) {
+        return `ws://localhost:${new URL(this.baseUrl).port}/ws/terminal/${terminalId}`;
+    }
+}
+/**
+ * Default tower client instance
+ */
+let defaultClient = null;
+/**
+ * Get the default tower client
+ */
+export function getTowerClient(port) {
+    if (!defaultClient || (port && port !== DEFAULT_TOWER_PORT)) {
+        defaultClient = new TowerClient(port);
+    }
+    return defaultClient;
+}
+//# sourceMappingURL=tower-client.js.map

package/dist/agent-farm/lib/tower-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tower-client.js","sourceRoot":"","sources":["../../../src/agent-farm/lib/tower-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,sBAAsB;AACtB,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACzD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;AAE5D,kBAAkB;AAClB,MAAM,kBAAkB,GAAG,KAAK,CAAC;AA6DjC;;GAEG;AACH,SAAS,WAAW;IAClB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5C,aAAa,CAAC,cAAc,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IACL,OAAO,CAAS;IAChB,QAAQ,CAAS;IAElC,YAAY,OAAe,kBAAkB;QAC3C,IAAI,CAAC,OAAO,GAAG,oBAAoB,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,WAAW,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,IAAY,EACZ,UAAuB,EAAE;QAEzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;gBACrD,GAAG,OAAO;gBACV,OAAO,EAAE;oBACP,GAAG,OAAO,CAAC,OAAO;oBAClB,eAAe,EAAE,IAAI,CAAC,QAAQ;oBAC9B,cAAc,EAAE,kBAAkB;iBACnC;gBACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;aAChD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,KAAa,CAAC;gBAClB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC9B,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;gBAC7C,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,GAAG,IAAI,CAAC;gBACf,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;YACvD,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACnC,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;YAC5D,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAc,SAAS,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAc,SAAS,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAA+B,eAAe,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,WAAmB;QAEnB,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAC/B,iBAAiB,OAAO,WAAW,EACnC,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5C,CAAC;QAED,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI;YAChC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO;YAC7B,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK;SAC1B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CACrB,WAAmB;QAEnB,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAC/B,iBAAiB,OAAO,aAAa,EACrC,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5C,CAAC;QAED,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI;YAChC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO;YAC7B,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK;SAC1B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAqB,iBAAiB,OAAO,SAAS,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,OAQpB;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAgB,gBAAgB,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAiC,gBAAgB,CAAC,CAAC;QACpF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,UAAkB;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAgB,kBAAkB,UAAU,EAAE,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,IAAY;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,UAAU,QAAQ,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,UAAkB;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC,EAAE,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,UAAkB,EAClB,IAAY,EACZ,IAAY;QAEZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAgB,kBAAkB,UAAU,SAAS,EAAE;YACtF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;SACrC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,WAAmB;QAC/B,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC/C,OAAO,GAAG,IAAI,CAAC,OAAO,YAAY,OAAO,GAAG,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,UAAkB;QACjC,OAAO,kBAAkB,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,gBAAgB,UAAU,EAAE,CAAC;IAClF,CAAC;CACF;AAED;;GAEG;AACH,IAAI,aAAa,GAAuB,IAAI,CAAC;AAE7C;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,kBAAkB,CAAC,EAAE,CAAC;QAC5D,aAAa,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/agent-farm/lib/tunnel-client.d.ts

@@ -0,0 +1,117 @@
+/**
+ * HTTP/2 Role-Reversal Tunnel Client (Spec 0097 Phase 3, TICK-001)
+ *
+ * Opens a WebSocket connection to codevos.ai/tunnel, authenticates
+ * with JSON messages, then runs an HTTP/2 *server* over the WebSocket
+ * stream. codevos.ai acts as the HTTP/2 *client*, sending requests
+ * through the tunnel. The tower proxies those requests to localhost.
+ *
+ * TICK-001: Transport changed from raw TCP/TLS to WebSocket.
+ * The H2 role-reversal is transport-agnostic — it works over any duplex stream.
+ */
+export interface TunnelClientOptions {
+    serverUrl: string;
+    apiKey: string;
+    towerId: string;
+    localPort: number;
+    /** @deprecated Use serverUrl protocol (ws:// vs wss://) instead */
+    tunnelPort?: number;
+    /** @deprecated No longer needed — WebSocket handles TLS via wss:// */
+    usePlainTcp?: boolean;
+}
+export type TunnelState = 'disconnected' | 'connecting' | 'connected' | 'auth_failed';
+export interface TowerMetadata {
+    projects: Array<{
+        path: string;
+        name: string;
+    }>;
+    terminals: Array<{
+        id: string;
+        projectPath: string;
+    }>;
+}
+type StateChangeCallback = (state: TunnelState, previousState: TunnelState) => void;
+/**
+ * Calculate reconnection backoff with exponential increase and jitter.
+ * Exported for unit testing.
+ *
+ * Formula: min(1000 * 2^attempt + random(0, 1000), 60000)
+ * After 10 consecutive failures: 300000ms (5 min)
+ */
+export declare function calculateBackoff(attempt: number, randomFn?: () => number): number;
+/**
+ * Check if a request path should be blocked from tunnel proxying.
+ * Normalizes percent-encoding and collapses dot segments before checking,
+ * preventing bypass via encoded slashes (%2F), double dots, etc.
+ * Exported for unit testing.
+ */
+export declare function isBlockedPath(path: string): boolean;
+/**
+ * Filter hop-by-hop headers from a headers object.
+ * Returns a new object with only end-to-end headers.
+ * Exported for unit testing.
+ */
+export declare function filterHopByHopHeaders(headers: Record<string, string | string[] | undefined>): Record<string, string | string[]>;
+export declare class TunnelClient {
+    private options;
+    private state;
+    private connectedAt;
+    private stateListeners;
+    private ws;
+    private wsStream;
+    private h2Server;
+    private h2Session;
+    private reconnectTimer;
+    private consecutiveFailures;
+    private rateLimitCount;
+    private destroyed;
+    constructor(options: TunnelClientOptions);
+    getState(): TunnelState;
+    getUptime(): number | null;
+    onStateChange(callback: StateChangeCallback): void;
+    private setState;
+    /**
+     * Initiate tunnel connection. Non-blocking — connection happens asynchronously.
+     */
+    connect(): void;
+    /**
+     * Gracefully disconnect the tunnel.
+     */
+    disconnect(): void;
+    /**
+     * Reset the circuit breaker (e.g. after config change).
+     * Allows reconnection after auth_failed state.
+     */
+    resetCircuitBreaker(): void;
+    /**
+     * Send tower metadata to codevos.ai.
+     *
+     * Uses a dual mechanism:
+     * 1. Caches metadata for `GET /__tower/metadata` (served when codevos.ai H2 client polls)
+     * 2. When connected, proactively POSTs to `serverUrl/api/tower/metadata` via HTTPS
+     *
+     * Call before `connect()` to set initial metadata, or after to update it.
+     */
+    sendMetadata(metadata: TowerMetadata): void;
+    /** Stored metadata for serving via GET /__tower/metadata */
+    private _pendingMetadata;
+    /**
+     * Push metadata to codevos.ai via outbound HTTPS POST.
+     * Best-effort — failures are silently ignored since codevos.ai
+     * can also poll via the H2 tunnel's GET /__tower/metadata handler.
+     */
+    private pushMetadataViaHttp;
+    private clearReconnectTimer;
+    private scheduleReconnect;
+    private cleanup;
+    private doConnect;
+    private onWsOpen;
+    private handleAuthError;
+    private handleConnectionError;
+    private startH2Server;
+    private handleH2Stream;
+    private handleWebSocketConnect;
+    private proxyHttpRequest;
+}
+export {};
+//# sourceMappingURL=tunnel-client.d.ts.map

package/dist/agent-farm/lib/tunnel-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel-client.d.ts","sourceRoot":"","sources":["../../../src/agent-farm/lib/tunnel-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG,YAAY,GAAG,WAAW,GAAG,aAAa,CAAC;AAEtF,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvD;AAED,KAAK,mBAAmB,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,KAAK,IAAI,CAAC;AAiBpF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,MAAoB,GAAG,MAAM,CAK9F;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAWnD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAQnC;AAYD,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,EAAE,CAA0B;IACpC,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,QAAQ,CAAkC;IAClD,OAAO,CAAC,SAAS,CAAyC;IAC1D,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,SAAS,CAAS;gBAEd,OAAO,EAAE,mBAAmB;IAIxC,QAAQ,IAAI,WAAW;IAIvB,SAAS,IAAI,MAAM,GAAG,IAAI;IAK1B,aAAa,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI;IAIlD,OAAO,CAAC,QAAQ;IAwBhB;;OAEG;IACH,OAAO,IAAI,IAAI;IAOf;;OAEG;IACH,UAAU,IAAI,IAAI;IAOlB;;;OAGG;IACH,mBAAmB,IAAI,IAAI;IAS3B;;;;;;;;OAQG;IACH,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAQ3C,4DAA4D;IAC5D,OAAO,CAAC,gBAAgB,CAA8B;IAEtD;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IA4B3B,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,OAAO;IAsBf,OAAO,CAAC,SAAS;IA8BjB,OAAO,CAAC,QAAQ;IA2BhB,OAAO,CAAC,eAAe;IA6BvB,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,aAAa;IA8BrB,OAAO,CAAC,cAAc;IAmCtB,OAAO,CAAC,sBAAsB;IAqE9B,OAAO,CAAC,gBAAgB;CA0DzB"}