@company-os/terminal-server 1.0.0 → 1.1.0

package/dist/index.js

@@ -1,935 +1,457 @@
 #!/usr/bin/env node
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  DEFAULT_PORT: () => DEFAULT_PORT,
-  SERVER_CONFIG: () => SERVER_CONFIG
-});
-module.exports = __toCommonJS(index_exports);
-var import_ws = require("ws");
-var http = __toESM(require("http"));
-var pty2 = __toESM(require("node-pty"));
-
-// src/config.ts
-var os = __toESM(require("os"));
-var SERVER_CONFIG = {
-  /** Default WebSocket server port */
-  defaultPort: parseInt(process.env.TERMINAL_SERVER_PORT || "3002", 10),
-  /** Allowed origins for WebSocket connections */
-  allowedOrigins: (process.env.ALLOWED_ORIGINS || "http://localhost:3000,http://localhost:3002,https://app.company-os.ai").split(",")
-};
-var PTY_CONFIG = {
-  /** Terminal type */
-  termName: "xterm-256color",
-  /** Default columns */
-  cols: 80,
-  /** Default rows */
-  rows: 24
-};
-function getDefaultShell() {
-  if (os.platform() === "win32") {
-    return process.env.COMSPEC || "cmd.exe";
-  }
-  return process.env.SHELL || "/bin/zsh";
-}
-function getWorkingDirectory() {
-  return process.env.COMPANYOS_WORKSPACE_ROOT || process.cwd().replace(/\/packages\/terminal-server$/, "") || os.homedir();
-}
-function generateSessionId() {
-  return `session-${Date.now()}-${Math.random().toString(36).substring(2, 9)}`;
-}
-
-// src/validation.ts
-var VALIDATION_LIMITS = {
-  /** Maximum input size in bytes (64KB) */
-  maxInputLength: 65536,
-  /** Maximum terminal columns */
-  maxCols: 500,
-  /** Maximum terminal rows */
-  maxRows: 200,
-  /** Minimum terminal columns */
-  minCols: 1,
-  /** Minimum terminal rows */
-  minRows: 1
-};
-function validateClientMessage(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw.toString());
-  } catch {
-    return { valid: false, error: "Invalid JSON" };
-  }
-  if (typeof parsed !== "object" || parsed === null) {
-    return { valid: false, error: "Message must be an object" };
-  }
-  const msg = parsed;
-  if (typeof msg.type !== "string") {
-    return { valid: false, error: "Missing or invalid message type" };
-  }
-  switch (msg.type) {
-    case "input":
-      return validateInputMessage(msg);
-    case "resize":
-      return validateResizeMessage(msg);
-    case "ping":
-      return { valid: true, message: { type: "ping" } };
-    default:
-      return { valid: false, error: `Unknown message type: ${msg.type}` };
-  }
-}
-function validateInputMessage(msg) {
-  if (typeof msg.data !== "string") {
-    return { valid: false, error: "Input data must be a string" };
-  }
-  if (msg.data.length > VALIDATION_LIMITS.maxInputLength) {
-    return {
-      valid: false,
-      error: `Input exceeds maximum length of ${VALIDATION_LIMITS.maxInputLength} bytes`
-    };
-  }
-  return { valid: true, message: { type: "input", data: msg.data } };
+import { WebSocketServer, WebSocket } from 'ws';
+import * as http from 'http';
+import * as pty from 'node-pty';
+import * as fsp from 'fs/promises';
+import * as path from 'path';
+import * as os from 'os';
+import { execFileSync } from 'child_process';
+import { SERVER_CONFIG, PTY_CONFIG, generateSessionId, detectClis } from './config.js';
+import { validateClientMessage } from './validation.js';
+import { getAuthConfig, verifyToken, extractTokenFromRequest } from './auth.js';
+import { buildSpawnConfig } from './spawn-config.js';
+import { startTranscriptSync } from './transcript-sync.js';
+const sessions = new Map();
+const authConfig = getAuthConfig();
+function sendMessage(ws, message) {
+    if (ws.readyState === WebSocket.OPEN) {
+        ws.send(JSON.stringify(message));
+    }
 }
-function validateResizeMessage(msg) {
-  if (typeof msg.cols !== "number" || typeof msg.rows !== "number") {
-    return { valid: false, error: "Resize requires numeric cols and rows" };
-  }
-  if (!Number.isInteger(msg.cols) || !Number.isInteger(msg.rows)) {
-    return { valid: false, error: "cols and rows must be integers" };
-  }
-  if (msg.cols < VALIDATION_LIMITS.minCols || msg.cols > VALIDATION_LIMITS.maxCols || msg.rows < VALIDATION_LIMITS.minRows || msg.rows > VALIDATION_LIMITS.maxRows) {
-    return {
-      valid: false,
-      error: `Dimensions out of range: cols ${VALIDATION_LIMITS.minCols}-${VALIDATION_LIMITS.maxCols}, rows ${VALIDATION_LIMITS.minRows}-${VALIDATION_LIMITS.maxRows}`
-    };
-  }
-  return { valid: true, message: { type: "resize", cols: msg.cols, rows: msg.rows } };
+function resetIdleTimer(sessionId) {
+    const session = sessions.get(sessionId);
+    if (!session)
+        return;
+    if (session.idleTimer)
+        clearTimeout(session.idleTimer);
+    if (SERVER_CONFIG.idleTimeoutMs <= 0)
+        return;
+    session.idleTimer = setTimeout(() => {
+        console.log(`Session idle timeout: ${sessionId}`);
+        sendMessage(session.ws, { type: 'exit', exitCode: -1 });
+        session.pty.kill();
+        session.ws.close(1000, 'Idle timeout');
+        sessions.delete(sessionId);
+    }, SERVER_CONFIG.idleTimeoutMs);
 }
-
-// src/terminalPage.ts
-function renderTerminalPage() {
-  return `<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="UTF-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-  <title>CompanyOS Terminal</title>
-  <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@xterm/xterm@5.5.0/css/xterm.min.css" />
-  <style>
-    * { margin: 0; padding: 0; box-sizing: border-box; }
-    html, body { height: 100%; overflow: hidden; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; }
-    body { display: flex; flex-direction: column; }
-    #header {
-      height: 56px;
-      display: flex;
-      align-items: center;
-      justify-content: space-between;
-      padding: 0 16px;
-      background: #1e1e1e;
-      border-bottom: 1px solid #333;
-      flex-shrink: 0;
-      position: sticky;
-      top: 0;
-      z-index: 10;
-    }
-    #header-left {
-      display: flex;
-      align-items: center;
-      gap: 8px;
-      overflow: hidden;
+function clearIdleTimer(session) {
+    if (session.idleTimer) {
+        clearTimeout(session.idleTimer);
+        session.idleTimer = null;
     }
-    #header-title {
-      font-size: 14px;
-      font-weight: 600;
-      color: #e0e0e0;
-      overflow: hidden;
-      text-overflow: ellipsis;
-      white-space: nowrap;
-      max-width: 60vw;
-    }
-    #header-error {
-      font-size: 12px;
-      color: #f44336;
-      display: none;
-    }
-    #copy-btn {
-      background: none;
-      border: 1px solid #555;
-      color: #ccc;
-      padding: 6px 12px;
-      border-radius: 4px;
-      cursor: pointer;
-      font-size: 13px;
-      display: flex;
-      align-items: center;
-      gap: 4px;
-    }
-    #copy-btn:hover { background: #333; }
-    #terminal-container {
-      flex: 1;
-      overflow: hidden;
-    }
-    #terminal-container .xterm { height: 100%; width: 100%; }
-    #terminal-container .xterm-viewport { overflow-y: auto !important; }
-    #toast {
-      position: fixed;
-      top: 16px;
-      left: 50%;
-      transform: translateX(-50%) translateY(-80px);
-      background: #4caf50;
-      color: #fff;
-      padding: 8px 24px;
-      border-radius: 6px;
-      font-size: 14px;
-      font-weight: 500;
-      opacity: 0;
-      transition: transform 0.3s ease, opacity 0.3s ease;
-      z-index: 100;
-      pointer-events: none;
+}
+const RESUME_CAPABLE_COMMANDS = new Set(['claude', 'codex']);
+/** Snapshot all .jsonl session files under ~/.claude/projects/ */
+async function snapshotClaudeSessions() {
+    const ids = new Set();
+    const claudeDir = path.join(os.homedir(), '.claude', 'projects');
+    try {
+        const projectDirs = await fsp.readdir(claudeDir);
+        for (const dir of projectDirs) {
+            const dirPath = path.join(claudeDir, dir);
+            try {
+                const files = await fsp.readdir(dirPath);
+                for (const f of files) {
+                    if (f.endsWith('.jsonl'))
+                        ids.add(f.replace('.jsonl', ''));
+                }
+            }
+            catch { /* skip unreadable dirs */ }
+        }
     }
-    #toast.show {
-      opacity: 1;
-      transform: translateX(-50%) translateY(0);
+    catch { /* directory doesn't exist */ }
+    return ids;
+}
+/** After spawning a CLI, detect its session ID by diffing the sessions directory */
+async function detectCliSessionId(beforeSnapshot) {
+    const claudeDir = path.join(os.homedir(), '.claude', 'projects');
+    for (let attempt = 0; attempt < 12; attempt++) {
+        await new Promise(resolve => setTimeout(resolve, 500));
+        try {
+            const projectDirs = await fsp.readdir(claudeDir);
+            for (const dir of projectDirs) {
+                const dirPath = path.join(claudeDir, dir);
+                try {
+                    const files = await fsp.readdir(dirPath);
+                    for (const f of files) {
+                        if (f.endsWith('.jsonl')) {
+                            const id = f.replace('.jsonl', '');
+                            if (!beforeSnapshot.has(id))
+                                return id;
+                        }
+                    }
+                }
+                catch { /* skip */ }
+            }
+        }
+        catch { /* retry */ }
     }
-  </style>
-</head>
-<body>
-  <div id="header">
-    <div id="header-left">
-      <span id="header-title">Terminal</span>
-      <span id="header-error">(Failed to load task)</span>
-    </div>
-    <button id="copy-btn" title="Copy terminal contents">
-      <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-        <rect x="9" y="9" width="13" height="13" rx="2" ry="2"></rect>
-        <path d="M5 15H4a2 2 0 01-2-2V4a2 2 0 012-2h9a2 2 0 012 2v1"></path>
-      </svg>
-      Copy
-    </button>
-  </div>
-  <div id="terminal-container"></div>
-  <div id="toast">Copied to clipboard</div>
-
-  <script src="https://cdn.jsdelivr.net/npm/@xterm/xterm@5.5.0/lib/xterm.min.js"></script>
-  <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-fit@0.10.0/lib/addon-fit.min.js"></script>
-  <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-web-links@0.11.0/lib/addon-web-links.min.js"></script>
-  <script>
-  (function() {
-    // --- Theme definitions (mirrored from terminalConfig.ts) ---
-    var THEMES = {
-      homebrew: {
-        background: '#000000', foreground: '#00ff00', cursor: '#00ff00', cursorAccent: '#000000',
-        selectionBackground: '#005500', selectionForeground: '#00ff00',
-        black: '#000000', red: '#990000', green: '#00a600', yellow: '#999900',
-        blue: '#0000b2', magenta: '#b200b2', cyan: '#00a6b2', white: '#bfbfbf',
-        brightBlack: '#666666', brightRed: '#e50000', brightGreen: '#00d900', brightYellow: '#e5e500',
-        brightBlue: '#0000ff', brightMagenta: '#e500e5', brightCyan: '#00e5e5', brightWhite: '#e5e5e5'
-      },
-      vscode: {
-        background: '#1e1e1e', foreground: '#d4d4d4', cursor: '#d4d4d4', cursorAccent: '#1e1e1e',
-        selectionBackground: '#264f78',
-        black: '#000000', red: '#cd3131', green: '#0dbc79', yellow: '#e5e510',
-        blue: '#2472c8', magenta: '#bc3fbc', cyan: '#11a8cd', white: '#e5e5e5',
-        brightBlack: '#666666', brightRed: '#f14c4c', brightGreen: '#23d18b', brightYellow: '#f5f543',
-        brightBlue: '#3b8eea', brightMagenta: '#d670d6', brightCyan: '#29b8db', brightWhite: '#ffffff'
-      },
-      dracula: {
-        background: '#282a36', foreground: '#f8f8f2', cursor: '#f8f8f2', cursorAccent: '#282a36',
-        selectionBackground: '#44475a',
-        black: '#21222c', red: '#ff5555', green: '#50fa7b', yellow: '#f1fa8c',
-        blue: '#bd93f9', magenta: '#ff79c6', cyan: '#8be9fd', white: '#f8f8f2',
-        brightBlack: '#6272a4', brightRed: '#ff6e6e', brightGreen: '#69ff94', brightYellow: '#ffffa5',
-        brightBlue: '#d6acff', brightMagenta: '#ff92df', brightCyan: '#a4ffff', brightWhite: '#ffffff'
-      },
-      monokai: {
-        background: '#272822', foreground: '#f8f8f2', cursor: '#f8f8f2', cursorAccent: '#272822',
-        selectionBackground: '#49483e',
-        black: '#272822', red: '#f92672', green: '#a6e22e', yellow: '#f4bf75',
-        blue: '#66d9ef', magenta: '#ae81ff', cyan: '#a1efe4', white: '#f8f8f2',
-        brightBlack: '#75715e', brightRed: '#f92672', brightGreen: '#a6e22e', brightYellow: '#f4bf75',
-        brightBlue: '#66d9ef', brightMagenta: '#ae81ff', brightCyan: '#a1efe4', brightWhite: '#f9f8f5'
-      }
+    return null;
+}
+function spawnSession(ws, createMsg) {
+    const sessionId = generateSessionId();
+    console.log(`New terminal session: ${sessionId} (projectId: ${createMsg.projectId ?? "none"}, threadId: ${createMsg.threadId ?? "none"})`);
+    const spawn = buildSpawnConfig(createMsg);
+    const isResumable = RESUME_CAPABLE_COMMANDS.has(spawn.command);
+    // Snapshot sessions before spawn so we can detect the new one
+    const snapshotPromise = isResumable ? snapshotClaudeSessions() : Promise.resolve(new Set());
+    // Build clean env — strip ANTHROPIC_API_KEY for CLI tools that use claude.ai auth
+    // to avoid the "Auth conflict: Both a token and an API key are set" warning.
+    const spawnEnv = {
+        ...process.env,
+        TERM: PTY_CONFIG.termName,
+        COLORTERM: 'truecolor',
     };
-
-    // --- Parse query params ---
-    var params = new URLSearchParams(window.location.search);
-    var taskId = params.get('taskId');
-    var workflowName = params.get('workflow');
-    var dryRun = params.get('dryRun') === 'true';
-    var themeName = params.get('theme') || 'homebrew';
-    var autoExecute = params.get('autoExecute') !== 'false';
-    var skipPermissions = params.get('skipPermissions') === 'true';
-
-    var theme = THEMES[themeName] || THEMES.homebrew;
-
-    // Apply background to body and terminal container
-    document.body.style.background = theme.background;
-    document.getElementById('terminal-container').style.background = theme.background;
-
-    // --- Create xterm Terminal ---
-    var term = new window.Terminal({
-      theme: theme,
-      fontSize: 14,
-      fontFamily: '"Fira Code", "Menlo", "Monaco", "Courier New", monospace',
-      lineHeight: 1.2,
-      scrollback: 10000,
-      cursorBlink: true,
-      allowProposedApi: true,
+    if (isResumable) {
+        delete spawnEnv.ANTHROPIC_API_KEY;
+    }
+    // Pass project scope to MCP server so commands/queries are project-scoped.
+    // Server-configured projectId takes precedence over client-provided one
+    // to prevent clients from overriding the security boundary.
+    const serverProjectId = process.env.MCP_PROJECT_ID;
+    if (serverProjectId) {
+        spawnEnv.MCP_PROJECT_ID = serverProjectId;
+    }
+    else if (createMsg.projectId) {
+        spawnEnv.MCP_PROJECT_ID = createMsg.projectId;
+    }
+    const ptyProcess = pty.spawn(spawn.command, spawn.args, {
+        name: PTY_CONFIG.termName,
+        cols: PTY_CONFIG.cols,
+        rows: PTY_CONFIG.rows,
+        cwd: spawn.cwd,
+        env: spawnEnv,
     });
-
-    var fitAddon = new window.FitAddon.FitAddon();
-    var webLinksAddon = new window.WebLinksAddon.WebLinksAddon();
-
-    term.loadAddon(fitAddon);
-    term.loadAddon(webLinksAddon);
-
-    var container = document.getElementById('terminal-container');
-    term.open(container);
-    fitAddon.fit();
-
-    // Auto-fit on resize
-    var resizeObserver = new ResizeObserver(function() {
-      try { fitAddon.fit(); } catch(e) { /* ignore */ }
+    sessions.set(sessionId, { pty: ptyProcess, ws, idleTimer: null });
+    sendMessage(ws, { type: 'session', sessionId });
+    resetIdleTimer(sessionId);
+    // Detect CLI session ID in the background (non-blocking)
+    if (isResumable) {
+        snapshotPromise.then(async (before) => {
+            const cliSessionId = await detectCliSessionId(before);
+            if (cliSessionId) {
+                console.log(`Detected CLI session ID: ${cliSessionId} for terminal session ${sessionId}`);
+                sendMessage(ws, { type: 'cliSessionId', cliSessionId });
+                // Start transcript sync if we have a threadId
+                if (createMsg.threadId) {
+                    const session = sessions.get(sessionId);
+                    if (session) {
+                        session.transcriptWatcher = startTranscriptSync({
+                            threadId: createMsg.threadId,
+                            cliSessionId,
+                            projectId: createMsg.projectId,
+                            actorId: 'ai:claude-code',
+                        });
+                    }
+                }
+            }
+        }).catch(() => { });
+    }
+    ptyProcess.onData((data) => {
+        sendMessage(ws, { type: 'output', data });
     });
-    resizeObserver.observe(container);
-
-    // --- Toast helper ---
-    function showToast(msg) {
-      var toast = document.getElementById('toast');
-      toast.textContent = msg;
-      toast.classList.add('show');
-      setTimeout(function() { toast.classList.remove('show'); }, 3000);
-    }
-
-    // --- Copy button ---
-    document.getElementById('copy-btn').addEventListener('click', function() {
-      var content = '';
-      var buf = term.buffer.active;
-      for (var i = 0; i < buf.length; i++) {
-        var line = buf.getLine(i);
-        if (line) content += line.translateToString(true) + '\\n';
-      }
-      content = content.trimEnd();
-      if (content) {
-        navigator.clipboard.writeText(content).then(function() {
-          showToast('Copied to clipboard');
-        });
-      }
+    ptyProcess.onExit(({ exitCode, signal }) => {
+        console.log(`PTY exited: sessionId=${sessionId}, exitCode=${exitCode}, signal=${signal}`);
+        const session = sessions.get(sessionId);
+        if (session) {
+            clearIdleTimer(session);
+            session.transcriptWatcher?.stop();
+        }
+        sendMessage(ws, { type: 'exit', exitCode, signal });
+        ws.close();
+        sessions.delete(sessionId);
     });
-
-    // --- WebSocket connection ---
-    var wsProtocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
-    var wsUrl = wsProtocol + '//' + window.location.host;
-    var ws = null;
-    var commandInjected = false;
-
-    function connectWs() {
-      ws = new WebSocket(wsUrl);
-
-      ws.onopen = function() {
-        updateConnectionStatus(true);
-      };
-
-      ws.onmessage = function(event) {
-        try {
-          var msg = JSON.parse(event.data);
-          switch (msg.type) {
-            case 'session':
-              onSessionReady(msg.sessionId);
-              break;
-            case 'output':
-              term.write(msg.data);
-              break;
-            case 'exit':
-              term.write('\\r\\n\\x1b[90mProcess exited with code ' + msg.exitCode + '\\x1b[0m');
-              break;
-            case 'error':
-              term.write('\\r\\n\\x1b[31mError: ' + msg.message + '\\x1b[0m');
-              break;
-          }
-        } catch(e) {
-          console.error('Failed to parse message:', e);
+    ws.on('message', (rawMessage) => {
+        const result = validateClientMessage(rawMessage.toString());
+        if (!result.valid) {
+            console.warn(`Invalid message from ${sessionId}: ${result.error}`);
+            sendMessage(ws, { type: 'error', message: result.error || 'Invalid message' });
+            return;
+        }
+        const msg = result.message;
+        switch (msg.type) {
+            case 'create':
+                sendMessage(ws, { type: 'error', message: 'Session already created' });
+                break;
+            case 'input':
+                ptyProcess.write(msg.data);
+                resetIdleTimer(sessionId);
+                break;
+            case 'resize':
+                ptyProcess.resize(msg.cols, msg.rows);
+                resetIdleTimer(sessionId);
+                break;
+            case 'ping':
+                sendMessage(ws, { type: 'pong' });
+                break;
         }
-      };
-
-      ws.onclose = function() {
-        updateConnectionStatus(false);
-      };
-
-      ws.onerror = function() {
-        updateConnectionStatus(false);
-      };
-    }
-
-    function updateConnectionStatus(connected) {
-      var titleEl = document.getElementById('header-title');
-      var baseTitle = titleEl.getAttribute('data-base-title') || titleEl.textContent;
-      titleEl.setAttribute('data-base-title', baseTitle);
-      titleEl.textContent = connected ? baseTitle : baseTitle + ' (Disconnected)';
-    }
-
-    // --- Send input to terminal ---
-    term.onData(function(data) {
-      if (ws && ws.readyState === WebSocket.OPEN) {
-        ws.send(JSON.stringify({ type: 'input', data: data }));
-      }
     });
-
-    term.onResize(function(size) {
-      if (ws && ws.readyState === WebSocket.OPEN) {
-        ws.send(JSON.stringify({ type: 'resize', cols: size.cols, rows: size.rows }));
-      }
+    ws.on('close', () => {
+        console.log(`Session closed: ${sessionId}`);
+        const session = sessions.get(sessionId);
+        if (session) {
+            clearIdleTimer(session);
+            session.transcriptWatcher?.stop();
+            session.pty.kill();
+            sessions.delete(sessionId);
+        }
     });
-
-    // --- Fetch brief and inject command ---
-    function onSessionReady(sessionId) {
-      // Send initial resize
-      var dims = fitAddon.proposeDimensions();
-      if (dims && ws && ws.readyState === WebSocket.OPEN) {
-        ws.send(JSON.stringify({ type: 'resize', cols: dims.cols, rows: dims.rows }));
-      }
-
-      if (commandInjected) return;
-
-      if (taskId) {
-        fetchBrief('/api/brief?taskId=' + encodeURIComponent(taskId));
-      } else if (workflowName) {
-        var url = '/api/workflow?name=' + encodeURIComponent(workflowName);
-        if (dryRun) url += '&dryRun=true';
-        fetchBrief(url);
-      }
-    }
-
-    function fetchBrief(url) {
-      fetch(url)
-        .then(function(res) {
-          if (!res.ok) throw new Error('Failed to fetch brief');
-          return res.json();
-        })
-        .then(function(brief) {
-          updateHeader(brief);
-          injectCommand(brief);
-        })
-        .catch(function(err) {
-          console.error('Failed to fetch brief:', err);
-          document.getElementById('header-error').style.display = 'inline';
-        });
-    }
-
-    function updateHeader(brief) {
-      var title;
-      if (brief.taskId !== undefined) {
-        title = 'Task #' + brief.taskId + ': ' + brief.name;
-        document.title = title + ' - Terminal';
-      } else if (brief.displayName) {
-        title = 'Workflow: ' + brief.displayName;
-        document.title = title + ' - Terminal';
-      }
-      if (title) {
-        var el = document.getElementById('header-title');
-        el.textContent = title;
-        el.setAttribute('data-base-title', title);
-      }
-    }
-
-    function injectCommand(brief) {
-      if (commandInjected) return;
-      commandInjected = true;
-
-      setTimeout(function() {
-        var command = brief.command;
-        if (skipPermissions && command.indexOf('claude ') === 0) {
-          command = command.replace('claude ', 'claude --dangerously-skip-permissions ');
+    ws.on('error', (err) => {
+        console.error(`WebSocket error for session ${sessionId}:`, err);
+    });
+}
+function handleConnection(ws) {
+    ws.on('message', function onCreate(rawMessage) {
+        const result = validateClientMessage(rawMessage.toString());
+        if (!result.valid) {
+            sendMessage(ws, { type: 'error', message: result.error || 'Invalid message' });
+            return;
         }
-        var isTask = brief.taskId !== undefined;
-        var shouldAutoExecute = isTask ? autoExecute : true;
-        var input = shouldAutoExecute ? command + '\\n' : command;
-
-        if (ws && ws.readyState === WebSocket.OPEN) {
-          ws.send(JSON.stringify({ type: 'input', data: input }));
+        const msg = result.message;
+        if (msg.type === 'ping') {
+            sendMessage(ws, { type: 'pong' });
+            return;
         }
-      }, 500);
-    }
-
-    // --- Start connection ---
-    connectWs();
-  })();
-  </script>
-</body>
-</html>`;
-}
-
-// src/headlessPtyManager.ts
-var pty = __toESM(require("node-pty"));
-var MAX_OUTPUT_LINES = 500;
-var MAX_CONCURRENT_SESSIONS = 5;
-var headlessSessions = /* @__PURE__ */ new Map();
-function getRunningSessionCount() {
-  let count = 0;
-  for (const session of headlessSessions.values()) {
-    if (session.status === "running") count++;
-  }
-  return count;
-}
-function canSpawnSession() {
-  return getRunningSessionCount() < MAX_CONCURRENT_SESSIONS;
-}
-function spawnHeadlessSession(options) {
-  if (!canSpawnSession()) {
-    throw new Error(
-      `Cannot spawn session: at capacity (${MAX_CONCURRENT_SESSIONS} concurrent sessions)`
-    );
-  }
-  const sessionId = generateSessionId();
-  const cwd = options.cwd ?? getWorkingDirectory();
-  const escapedPrompt = options.prompt.replace(/'/g, "'\\''");
-  const command = `claude --dangerously-skip-permissions -p '${escapedPrompt}'`;
-  const ptyProcess = pty.spawn("/bin/bash", ["-c", command], {
-    name: PTY_CONFIG.termName,
-    cols: PTY_CONFIG.cols,
-    rows: PTY_CONFIG.rows,
-    cwd,
-    env: {
-      ...process.env,
-      TERM: PTY_CONFIG.termName,
-      COLORTERM: "truecolor"
-    }
-  });
-  const session = {
-    id: sessionId,
-    taskExecutionId: options.taskExecutionId,
-    branchName: options.branchName,
-    pty: ptyProcess,
-    status: "running",
-    exitCode: null,
-    output: [],
-    startedAt: /* @__PURE__ */ new Date(),
-    completedAt: null
-  };
-  headlessSessions.set(sessionId, session);
-  ptyProcess.onData((data) => {
-    session.output.push(data);
-    if (session.output.length > MAX_OUTPUT_LINES) {
-      session.output.splice(0, session.output.length - MAX_OUTPUT_LINES);
-    }
-  });
-  ptyProcess.onExit(({ exitCode }) => {
-    session.exitCode = exitCode;
-    session.status = exitCode === 0 ? "succeeded" : "failed";
-    session.completedAt = /* @__PURE__ */ new Date();
-    console.log(
-      `[HeadlessPTY] Session ${sessionId} exited: code=${exitCode}, task=${options.taskExecutionId}, branch=${options.branchName}`
-    );
-  });
-  console.log(
-    `[HeadlessPTY] Spawned session ${sessionId} for task ${options.taskExecutionId} on branch ${options.branchName}`
-  );
-  return toSessionInfo(session);
-}
-function getSession(sessionId) {
-  const session = headlessSessions.get(sessionId);
-  if (!session) return null;
-  return toSessionInfo(session);
-}
-function getSessionByTaskExecution(taskExecutionId) {
-  for (const session of headlessSessions.values()) {
-    if (session.taskExecutionId === taskExecutionId) {
-      return toSessionInfo(session);
-    }
-  }
-  return null;
-}
-function listSessions(status) {
-  const results = [];
-  for (const session of headlessSessions.values()) {
-    if (!status || session.status === status) {
-      results.push(toSessionInfo(session));
-    }
-  }
-  return results;
-}
-function killSession(sessionId) {
-  const session = headlessSessions.get(sessionId);
-  if (!session || session.status !== "running") return false;
-  session.pty.kill();
-  session.status = "failed";
-  session.exitCode = -1;
-  session.completedAt = /* @__PURE__ */ new Date();
-  console.log(`[HeadlessPTY] Killed session ${sessionId}`);
-  return true;
-}
-function killAllSessions() {
-  for (const [id, session] of headlessSessions) {
-    if (session.status === "running") {
-      session.pty.kill();
-      session.status = "failed";
-      session.exitCode = -1;
-      session.completedAt = /* @__PURE__ */ new Date();
-    }
-    headlessSessions.delete(id);
-  }
-}
-function toSessionInfo(session) {
-  const tailCount = 50;
-  return {
-    id: session.id,
-    taskExecutionId: session.taskExecutionId,
-    branchName: session.branchName,
-    status: session.status,
-    exitCode: session.exitCode,
-    startedAt: session.startedAt,
-    completedAt: session.completedAt,
-    outputTail: session.output.slice(-tailCount)
-  };
-}
-
-// src/index.ts
-var APP_API_URL = process.env.COMPANYOS_APP_URL || "http://localhost:3000";
-var sessions = /* @__PURE__ */ new Map();
-function sendMessage(ws, message) {
-  if (ws.readyState === import_ws.WebSocket.OPEN) {
-    ws.send(JSON.stringify(message));
-  }
+        if (msg.type !== 'create') {
+            sendMessage(ws, { type: 'error', message: 'First message must be a create message' });
+            return;
+        }
+        ws.removeListener('message', onCreate);
+        spawnSession(ws, msg);
+    });
+    ws.on('close', () => {
+        console.log('Connection closed before session created');
+    });
+    ws.on('error', (err) => {
+        console.error('WebSocket error before session created:', err);
+    });
 }
-function handleConnection(ws, origin) {
-  if (!origin || !SERVER_CONFIG.allowedOrigins.includes(origin)) {
-    console.warn(`Rejected connection from origin: ${origin ?? "(none)"}`);
-    ws.close(1008, "Origin not allowed");
-    return;
-  }
-  const sessionId = generateSessionId();
-  console.log(`New terminal session: ${sessionId}`);
-  const ptyProcess = pty2.spawn(getDefaultShell(), [], {
-    name: PTY_CONFIG.termName,
-    cols: PTY_CONFIG.cols,
-    rows: PTY_CONFIG.rows,
-    cwd: getWorkingDirectory(),
-    env: {
-      ...process.env,
-      TERM: PTY_CONFIG.termName,
-      COLORTERM: "truecolor"
-    }
-  });
-  sessions.set(sessionId, { pty: ptyProcess, ws });
-  sendMessage(ws, { type: "session", sessionId });
-  ptyProcess.onData((data) => {
-    sendMessage(ws, { type: "output", data });
-  });
-  ptyProcess.onExit(({ exitCode, signal }) => {
-    console.log(`PTY exited: sessionId=${sessionId}, exitCode=${exitCode}, signal=${signal}`);
-    sendMessage(ws, { type: "exit", exitCode, signal });
-    ws.close();
-    sessions.delete(sessionId);
-  });
-  ws.on("message", (rawMessage) => {
-    const result = validateClientMessage(rawMessage.toString());
-    if (!result.valid) {
-      console.warn(`Invalid message from ${sessionId}: ${result.error}`);
-      sendMessage(ws, { type: "error", message: result.error || "Invalid message" });
-      return;
-    }
-    const msg = result.message;
-    switch (msg.type) {
-      case "input":
-        ptyProcess.write(msg.data);
-        break;
-      case "resize":
-        ptyProcess.resize(msg.cols, msg.rows);
-        break;
-      case "ping":
-        sendMessage(ws, { type: "pong" });
-        break;
+async function handleSessionsRequest(limit, res) {
+    try {
+        const claudeDir = path.join(os.homedir(), '.claude', 'projects');
+        const sessionData = [];
+        let dirExists = false;
+        try {
+            const stat = await fsp.stat(claudeDir);
+            dirExists = stat.isDirectory();
+        }
+        catch { /* directory doesn't exist */ }
+        if (dirExists) {
+            const projectDirs = await fsp.readdir(claudeDir);
+            for (const projectDir of projectDirs) {
+                const projectPath = path.join(claudeDir, projectDir);
+                const stat = await fsp.stat(projectPath);
+                if (!stat.isDirectory())
+                    continue;
+                const files = (await fsp.readdir(projectPath)).filter(f => f.endsWith('.jsonl'));
+                for (const file of files) {
+                    const sessionId = file.replace('.jsonl', '');
+                    const filePath = path.join(projectPath, file);
+                    const fileStat = await fsp.stat(filePath);
+                    let summary = '';
+                    let firstPrompt = '';
+                    try {
+                        const content = await fsp.readFile(filePath, 'utf-8');
+                        const lines = content.trim().split('\n');
+                        if (lines.length > 0) {
+                            const firstLine = JSON.parse(lines[0]);
+                            if (firstLine.type === 'summary')
+                                summary = firstLine.summary ?? '';
+                            if (firstLine.message?.content)
+                                firstPrompt = String(firstLine.message.content).slice(0, 200);
+                        }
+                        if (lines.length > 1) {
+                            const lastLine = JSON.parse(lines[lines.length - 1]);
+                            if (lastLine.type === 'summary')
+                                summary = lastLine.summary ?? summary;
+                        }
+                    }
+                    catch { /* skip unreadable files */ }
+                    sessionData.push({
+                        sessionId,
+                        summary,
+                        lastModified: fileStat.mtimeMs,
+                        createdAt: fileStat.birthtimeMs,
+                        firstPrompt,
+                    });
+                }
+            }
+        }
+        sessionData.sort((a, b) => b.lastModified - a.lastModified);
+        const limited = sessionData.slice(0, limit);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ data: limited }));
     }
-  });
-  ws.on("close", () => {
-    console.log(`Session closed: ${sessionId}`);
-    const session = sessions.get(sessionId);
-    if (session) {
-      session.pty.kill();
-      sessions.delete(sessionId);
+    catch {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ data: [] }));
     }
-  });
-  ws.on("error", (err) => {
-    console.error(`WebSocket error for session ${sessionId}:`, err);
-  });
 }
 function handleHttpRequest(req, res) {
-  const url = new URL(req.url || "/", `http://${req.headers.host}`);
-  const reqOrigin = req.headers.origin;
-  if (reqOrigin && SERVER_CONFIG.allowedOrigins.includes(reqOrigin)) {
-    res.setHeader("Access-Control-Allow-Origin", reqOrigin);
-  }
-  res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-  res.setHeader("Access-Control-Allow-Headers", "Content-Type");
-  if (req.method === "OPTIONS") {
-    res.writeHead(204);
-    res.end();
-    return;
-  }
-  if (url.pathname === "/terminal" && req.method === "GET") {
-    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-    res.end(renderTerminalPage());
-    return;
-  }
-  if (url.pathname === "/api/brief" && req.method === "GET") {
-    const taskId = url.searchParams.get("taskId");
-    if (!taskId) {
-      res.writeHead(400, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: "taskId is required" }));
-      return;
-    }
-    const upstream = `${APP_API_URL}/api/tasks/${encodeURIComponent(taskId)}/brief`;
-    proxyGet(upstream, res, req.headers.cookie);
-    return;
-  }
-  if (url.pathname === "/api/workflow" && req.method === "GET") {
-    const name = url.searchParams.get("name");
-    if (!name) {
-      res.writeHead(400, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: "name is required" }));
-      return;
-    }
-    const upstream = `${APP_API_URL}/api/workflows/${encodeURIComponent(name)}/run`;
-    proxyPost(upstream, res, req.headers.cookie);
-    return;
-  }
-  const executionRouteMatch = url.pathname.match(/^\/api\/execution\/([^/]+)\/(start|pause|resume|cancel)$/);
-  if (executionRouteMatch && req.method === "POST") {
-    const executionId = executionRouteMatch[1];
-    const action = executionRouteMatch[2];
-    const upstream = `${APP_API_URL}/api/execution/${encodeURIComponent(executionId)}/${action}`;
-    proxyPost(upstream, res, req.headers.cookie);
-    return;
-  }
-  const executionHealthMatch = url.pathname.match(/^\/api\/execution\/([^/]+)\/(health|log)$/);
-  if (executionHealthMatch && req.method === "GET") {
-    const executionId = executionHealthMatch[1];
-    const endpoint = executionHealthMatch[2];
-    const query = url.search || "";
-    const upstream = `${APP_API_URL}/api/execution/${encodeURIComponent(executionId)}/${endpoint}${query}`;
-    proxyGet(upstream, res, req.headers.cookie);
-    return;
-  }
-  const executionStatusMatch = url.pathname.match(/^\/api\/execution\/([^/]+)$/);
-  if (executionStatusMatch && req.method === "GET") {
-    const executionId = executionStatusMatch[1];
-    const upstream = `${APP_API_URL}/api/execution/${encodeURIComponent(executionId)}`;
-    proxyGet(upstream, res, req.headers.cookie);
-    return;
-  }
-  if (url.pathname === "/api/headless/spawn" && req.method === "POST") {
-    readBody(req).then((body) => {
-      try {
-        const data = JSON.parse(body);
-        if (!data.taskExecutionId || !data.branchName || !data.prompt) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ error: "taskExecutionId, branchName, and prompt are required" }));
-          return;
+    const reqOrigin = req.headers.origin;
+    if (reqOrigin && SERVER_CONFIG.allowedOrigins.includes(reqOrigin)) {
+        res.setHeader('Access-Control-Allow-Origin', reqOrigin);
+    }
+    else if (!reqOrigin || reqOrigin === 'null') {
+        // Electron file:// origin sends 'null' — allow since token auth is the security gate
+        res.setHeader('Access-Control-Allow-Origin', '*');
+    }
+    res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+    if (req.method === 'OPTIONS') {
+        res.writeHead(204);
+        res.end();
+        return;
+    }
+    if (req.url === '/health') {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            status: 'ok',
+            sessions: sessions.size,
+            maxSessions: SERVER_CONFIG.maxSessions,
+        }));
+        return;
+    }
+    // Check if claude CLI is available (mirrors API's /api/terminal/status)
+    if (req.url === '/status') {
+        try {
+            execFileSync('which', ['claude'], { encoding: 'utf-8' });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ available: true }));
         }
-        const session = spawnHeadlessSession({
-          taskExecutionId: data.taskExecutionId,
-          branchName: data.branchName,
-          prompt: data.prompt,
-          cwd: data.cwd
+        catch {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ available: false, message: 'claude CLI not found in PATH' }));
+        }
+        return;
+    }
+    // List Claude Code sessions from ~/.claude/projects/ (mirrors API's /api/terminal/sessions)
+    if (req.url?.startsWith('/sessions')) {
+        const reqUrl = new URL(req.url, `http://${req.headers.host ?? 'localhost'}`);
+        const limit = parseInt(reqUrl.searchParams.get('limit') ?? '50', 10);
+        handleSessionsRequest(limit, res);
+        return;
+    }
+    if (req.url === '/clis') {
+        const clis = detectClis();
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ data: clis }));
+        return;
+    }
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Not found' }));
+}
+const MAX_PORT_RETRIES = 10;
+async function tryListen(httpServer, port) {
+    return new Promise((resolve, reject) => {
+        const onError = (err) => {
+            httpServer.removeListener('error', onError);
+            reject(err);
+        };
+        httpServer.on('error', onError);
+        httpServer.listen(port, '127.0.0.1', () => {
+            httpServer.removeListener('error', onError);
+            resolve(port);
         });
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify(session));
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : "Spawn failed";
-        res.writeHead(500, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ error: msg }));
-      }
-    }).catch(() => {
-      res.writeHead(400, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: "Invalid request body" }));
     });
-    return;
-  }
-  if (url.pathname === "/api/headless/sessions" && req.method === "GET") {
-    const status = url.searchParams.get("status");
-    const sessions2 = listSessions(status ?? void 0);
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ sessions: sessions2, runningCount: getRunningSessionCount() }));
-    return;
-  }
-  const headlessSessionMatch = url.pathname.match(/^\/api\/headless\/session\/([^/]+)$/);
-  if (headlessSessionMatch && req.method === "GET") {
-    const sessionId = headlessSessionMatch[1];
-    const session = getSession(sessionId);
-    if (!session) {
-      res.writeHead(404, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: "Session not found" }));
-      return;
-    }
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify(session));
-    return;
-  }
-  const headlessTaskMatch = url.pathname.match(/^\/api\/headless\/task\/([^/]+)$/);
-  if (headlessTaskMatch && req.method === "GET") {
-    const taskExecId = headlessTaskMatch[1];
-    const session = getSessionByTaskExecution(taskExecId);
-    if (!session) {
-      res.writeHead(404, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: "No session found for task execution" }));
-      return;
-    }
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify(session));
-    return;
-  }
-  const headlessKillMatch = url.pathname.match(/^\/api\/headless\/session\/([^/]+)\/kill$/);
-  if (headlessKillMatch && req.method === "POST") {
-    const sessionId = headlessKillMatch[1];
-    const killed = killSession(sessionId);
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ killed }));
-    return;
-  }
-  if (url.pathname === "/api/headless/capacity" && req.method === "GET") {
-    res.writeHead(200, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({
-      canSpawn: canSpawnSession(),
-      runningCount: getRunningSessionCount()
-    }));
-    return;
-  }
-  res.writeHead(404, { "Content-Type": "application/json" });
-  res.end(JSON.stringify({ error: "Not found" }));
-}
-function readBody(req) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    req.on("data", (chunk) => chunks.push(chunk));
-    req.on("end", () => resolve(Buffer.concat(chunks).toString()));
-    req.on("error", reject);
-  });
-}
-function buildProxyHeaders(cookie) {
-  const headers = {};
-  if (cookie) headers["cookie"] = cookie;
-  return headers;
-}
-function forwardSetCookies(upstreamRes, res) {
-  const setCookies = upstreamRes.headers.getSetCookie?.();
-  if (setCookies) {
-    for (const c of setCookies) {
-      res.appendHeader("Set-Cookie", c);
-    }
-  }
-}
-function proxyGet(upstream, res, cookie) {
-  fetch(upstream, { headers: buildProxyHeaders(cookie) }).then(async (upstreamRes) => {
-    const body = await upstreamRes.text();
-    forwardSetCookies(upstreamRes, res);
-    res.writeHead(upstreamRes.status, { "Content-Type": "application/json" });
-    res.end(body);
-  }).catch((err) => {
-    console.error("Proxy GET error:", err);
-    res.writeHead(502, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "Upstream request failed" }));
-  });
-}
-function proxyPost(upstream, res, cookie) {
-  fetch(upstream, { method: "POST", headers: buildProxyHeaders(cookie) }).then(async (upstreamRes) => {
-    const body = await upstreamRes.text();
-    forwardSetCookies(upstreamRes, res);
-    res.writeHead(upstreamRes.status, { "Content-Type": "application/json" });
-    res.end(body);
-  }).catch((err) => {
-    console.error("Proxy POST error:", err);
-    res.writeHead(502, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: "Upstream request failed" }));
-  });
 }
 async function startServer() {
-  const PORT = SERVER_CONFIG.defaultPort;
-  const httpServer = http.createServer(handleHttpRequest);
-  const wss = new import_ws.WebSocketServer({ server: httpServer });
-  wss.on("connection", (ws, req) => {
-    handleConnection(ws, req.headers.origin);
-  });
-  httpServer.on("error", (err) => {
-    if (err.code === "EADDRINUSE") {
-      console.error("");
-      console.error(`  Error: Port ${PORT} is already in use.`);
-      console.error("");
-      console.error(`  Fix: stop the other process on port ${PORT}, or run with a custom port:`);
-      console.error(`    TERMINAL_SERVER_PORT=3003 npx @company-os/terminal-server`);
-      console.error("");
-      process.exit(1);
+    const basePort = SERVER_CONFIG.defaultPort;
+    const httpServer = http.createServer(handleHttpRequest);
+    // Try ports starting from basePort, auto-increment on EADDRINUSE
+    let actualPort = basePort;
+    for (let attempt = 0; attempt < MAX_PORT_RETRIES; attempt++) {
+        const port = basePort + attempt;
+        try {
+            actualPort = await tryListen(httpServer, port);
+            break;
+        }
+        catch (err) {
+            const nodeErr = err;
+            if (nodeErr.code === 'EADDRINUSE') {
+                if (attempt === 0) {
+                    console.warn(`  Port ${port} is in use, trying next...`);
+                }
+                if (attempt === MAX_PORT_RETRIES - 1) {
+                    console.error(`\n  Error: All ports ${basePort}-${basePort + MAX_PORT_RETRIES - 1} are in use.\n`);
+                    process.exit(1);
+                }
+                continue;
+            }
+            throw err;
+        }
     }
-    throw err;
-  });
-  httpServer.listen(PORT, "127.0.0.1", () => {
-    console.log("");
-    console.log(`  CompanyOS Terminal Server`);
-    console.log(`  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`);
-    console.log(`  Local:     http://localhost:${PORT}`);
-    console.log(`  WebSocket: ws://localhost:${PORT}`);
-    console.log(`  Terminal:  http://localhost:${PORT}/terminal`);
-    console.log("");
-    console.log(`  Allowed origins:`);
+    // Create WebSocket server AFTER port is bound (avoids WSS emitting EADDRINUSE)
+    const wss = new WebSocketServer({
+        server: httpServer,
+        verifyClient: (info, cb) => {
+            const origin = info.origin;
+            if (origin && !SERVER_CONFIG.allowedOrigins.includes(origin)) {
+                console.warn(`Rejected connection from origin: ${origin}`);
+                cb(false, 403, 'Origin not allowed');
+                return;
+            }
+            if (sessions.size >= SERVER_CONFIG.maxSessions) {
+                console.warn(`Rejected connection: max sessions (${SERVER_CONFIG.maxSessions}) reached`);
+                cb(false, 503, 'Max sessions reached');
+                return;
+            }
+            if (authConfig.token) {
+                const provided = extractTokenFromRequest(info.req);
+                if (!provided || !verifyToken(provided, authConfig.token)) {
+                    console.warn('Rejected connection: invalid or missing token');
+                    cb(false, 401, 'Unauthorized');
+                    return;
+                }
+            }
+            cb(true);
+        },
+    });
+    wss.on('connection', (ws) => {
+        handleConnection(ws);
+    });
+    console.log('');
+    console.log('  CompanyOS Terminal Server');
+    console.log('  ────────────────────────');
+    console.log(`  Local:        http://localhost:${actualPort}`);
+    console.log(`  WebSocket:    ws://localhost:${actualPort}`);
+    if (actualPort !== basePort) {
+        console.log(`  Note:         Default port ${basePort} was in use, using ${actualPort} instead`);
+    }
+    console.log(`  Auth:         ${authConfig.token ? 'enabled (token required)' : 'disabled (no token set)'}`);
+    console.log(`  Max sessions: ${SERVER_CONFIG.maxSessions}`);
+    console.log(`  Idle timeout: ${SERVER_CONFIG.idleTimeoutMs / 1000}s`);
+    console.log('');
+    if (!authConfig.token) {
+        console.warn('  ⚠ TERMINAL_SERVER_TOKEN not set — connections are unauthenticated');
+    }
+    console.log('  Allowed origins:');
     for (const origin of SERVER_CONFIG.allowedOrigins) {
-      console.log(`    \u2022 ${origin}`);
-    }
-    console.log("");
-    console.log(`  Open app.company-os.ai and toggle the terminal in chat.`);
-    console.log("");
-  });
-  process.on("SIGINT", () => {
-    console.log("\nShutting down terminal server...");
-    killAllSessions();
-    for (const [sessionId, session] of sessions) {
-      console.log(`Killing session: ${sessionId}`);
-      session.pty.kill();
-      session.ws.close();
-    }
-    wss.close();
-    httpServer.close(() => {
-      console.log("Terminal server stopped");
-      process.exit(0);
+        console.log(`    ${origin}`);
+    }
+    console.log('');
+    process.on('SIGINT', () => {
+        console.log('\nShutting down terminal server...');
+        for (const [sessionId, session] of sessions) {
+            console.log(`Killing session: ${sessionId}`);
+            clearIdleTimer(session);
+            session.pty.kill();
+            session.ws.close();
+        }
+        wss.close();
+        httpServer.close(() => {
+            console.log('Terminal server stopped');
+            process.exit(0);
+        });
+    });
+    process.on('SIGTERM', () => {
+        process.emit('SIGINT');
     });
-  });
-  process.on("SIGTERM", () => {
-    process.emit("SIGINT");
-  });
 }
 startServer().catch((err) => {
-  console.error("Failed to start terminal server:", err);
-  process.exit(1);
-});
-var DEFAULT_PORT = SERVER_CONFIG.defaultPort;
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  DEFAULT_PORT,
-  SERVER_CONFIG
+    console.error('Failed to start terminal server:', err);
+    process.exit(1);
 });
+export { SERVER_CONFIG };
+export { buildSpawnConfig } from './spawn-config.js';
+//# sourceMappingURL=index.js.map