@cryptiklemur/lattice 2.0.0 → 4.0.0

package/src/server/daemon.ts

@@ -18,7 +18,7 @@ import { startMeshConnections, onPeerConnected, onPeerDisconnected, onPeerMessag
 import { handleProxyRequest, handleProxyResponse } from "./mesh/proxy";
 import { verifyPassphrase, generateSessionToken, addSession, isValidSession } from "./auth/passphrase";
 import { ensureCerts } from "./tls";
-import type { ClientMessage, MeshMessage } from "@lattice/shared";
+import type { ClientMessage, MeshMessage } from "#shared";
 import { log } from "./logger";
 import { detectIdeProjectName } from "./handlers/settings";
 import "./handlers/session";
@@ -336,9 +336,26 @@ export async function startDaemon(portOverride?: number | null): Promise<void> {
   var app = express();
   app.use(express.json());
 
-  app.post("/auth", function (req, res) {
+  var authAttempts = new Map<string, number[]>();
+  var AUTH_RATE_LIMIT = 5;
+  var AUTH_RATE_WINDOW = 60000;
+
+  app.post("/auth", async function (req, res) {
+    var ip = req.ip || req.socket.remoteAddress || "unknown";
+    var now = Date.now();
+    var attempts = authAttempts.get(ip) || [];
+    attempts = attempts.filter(function (t) { return now - t < AUTH_RATE_WINDOW; });
+
+    if (attempts.length >= AUTH_RATE_LIMIT) {
+      res.status(429).json({ ok: false, error: "Too many attempts. Try again later." });
+      return;
+    }
+
+    attempts.push(now);
+    authAttempts.set(ip, attempts);
+
     var passphrase = (req.body as { passphrase?: string }).passphrase || "";
-    if (!config.passphraseHash || verifyPassphrase(passphrase, config.passphraseHash)) {
+    if (!config.passphraseHash || await verifyPassphrase(passphrase, config.passphraseHash)) {
       var token = generateSessionToken();
       addSession(token);
       res.setHeader("Set-Cookie", "lattice_auth=" + token + "; HttpOnly; Path=/; SameSite=Strict");
@@ -381,20 +398,23 @@ export async function startDaemon(portOverride?: number | null): Promise<void> {
       res.status(400).send("Missing path parameter");
       return;
     }
-    var resolved = resolve(reqFilePath);
-    if (!existsSync(resolved)) {
-      for (var pi = 0; pi < config.projects.length; pi++) {
-        var projectResolved = join(config.projects[pi].path, reqFilePath);
-        if (existsSync(projectResolved)) {
-          resolved = projectResolved;
-          break;
-        }
+
+    var resolved: string | null = null;
+
+    for (var pi = 0; pi < config.projects.length; pi++) {
+      var projectPath = resolve(config.projects[pi].path);
+      var candidate = resolve(projectPath, reqFilePath);
+      if (candidate.startsWith(projectPath + "/") && existsSync(candidate)) {
+        resolved = candidate;
+        break;
       }
     }
-    if (!existsSync(resolved)) {
+
+    if (!resolved) {
       res.status(404).send("File not found");
       return;
     }
+
     var stat = statSync(resolved);
     res.setHeader("Content-Type", getMimeType(resolved));
     res.setHeader("Content-Length", stat.size);

package/src/server/features/ralph-loop.ts

@@ -5,7 +5,7 @@ import { query } from "@anthropic-ai/claude-agent-sdk";
 import type { SDKMessage, SDKPartialAssistantMessage, SDKResultMessage } from "@anthropic-ai/claude-agent-sdk";
 import { broadcast } from "../ws/broadcast";
 import { getProjectBySlug } from "../project/registry";
-import type { LoopStatus } from "@lattice/shared";
+import type { LoopStatus } from "#shared";
 
 var activeLoops = new Map<string, LoopStatus>();
 

package/src/server/features/scheduler.ts

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { randomBytes } from "node:crypto";
 import { getLatticeHome } from "../config";
 import { broadcast } from "../ws/broadcast";
-import type { ScheduledTask } from "@lattice/shared";
+import type { ScheduledTask } from "#shared";
 
 var schedulesFile = "";
 var tasks: ScheduledTask[] = [];

package/src/server/features/sticky-notes.ts

@@ -2,7 +2,7 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeF
 import { join } from "node:path";
 import { randomBytes } from "node:crypto";
 import { getLatticeHome } from "../config";
-import type { StickyNote } from "@lattice/shared";
+import type { StickyNote } from "#shared";
 
 var notesFile = "";
 var notes: StickyNote[] = [];

package/src/server/handlers/analytics.ts

@@ -1,4 +1,4 @@
-import type { ClientMessage } from "@lattice/shared";
+import type { ClientMessage } from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo } from "../ws/broadcast";
 import { streamAnalyticsSections } from "../analytics/engine";

package/src/server/handlers/attachment.ts

@@ -1,5 +1,5 @@
-import type { Attachment } from "@lattice/shared";
-import type { AttachmentChunkMessage, AttachmentCompleteMessage, ClientMessage } from "@lattice/shared";
+import type { Attachment } from "#shared";
+import type { AttachmentChunkMessage, AttachmentCompleteMessage, ClientMessage } from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo } from "../ws/broadcast";
 
@@ -176,7 +176,7 @@ export function cleanupClient(clientId: string): void {
   completed.delete(clientId);
 }
 
-setInterval(function () {
+var ttlCleanupInterval = setInterval(function () {
   var now = Date.now();
   stores.forEach(function (store) {
     store.forEach(function (pending, id) {
@@ -186,3 +186,4 @@ setInterval(function () {
     });
   });
 }, CLEANUP_INTERVAL_MS);
+ttlCleanupInterval.unref();

package/src/server/handlers/bookmarks.ts

@@ -3,7 +3,7 @@ import type {
   BookmarkListMessage,
   BookmarkAddMessage,
   BookmarkRemoveMessage,
-} from "@lattice/shared";
+} from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo } from "../ws/broadcast";
 import { listBookmarks, addBookmark, removeBookmark } from "../project/bookmarks";

package/src/server/handlers/chat.ts

@@ -1,4 +1,4 @@
-import type { ChatSendMessage, ChatPermissionResponseMessage, ChatSetPermissionModeMessage, ChatPromptResponseMessage, ClientMessage } from "@lattice/shared";
+import type { ChatSendMessage, ChatPermissionResponseMessage, ChatSetPermissionModeMessage, ChatPromptResponseMessage, ClientMessage } from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo } from "../ws/broadcast";
 import { getProjectBySlug } from "../project/registry";

package/src/server/handlers/editor.ts

@@ -1,7 +1,7 @@
 import { execSync } from "node:child_process";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import type { ClientMessage, EditorDetectMessage, EditorEnsureProjectMessage } from "@lattice/shared";
+import type { ClientMessage, EditorDetectMessage, EditorEnsureProjectMessage } from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo } from "../ws/broadcast";
 import { loadConfig } from "../config";

package/src/server/handlers/fs.ts

@@ -1,4 +1,4 @@
-import type { ClientMessage, FsListMessage, FsReadMessage, FsWriteMessage } from "@lattice/shared";
+import type { ClientMessage, FsListMessage, FsReadMessage, FsWriteMessage } from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo, broadcast } from "../ws/broadcast";
 import { getProjectBySlug } from "../project/registry";

package/src/server/handlers/loop.ts

@@ -1,4 +1,4 @@
-import type { ClientMessage, LoopStartMessage, LoopStopMessage, LoopStatusRequestMessage } from "@lattice/shared";
+import type { ClientMessage, LoopStartMessage, LoopStopMessage, LoopStatusRequestMessage } from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo } from "../ws/broadcast";
 import { startLoop, stopLoop, getLoopStatus } from "../features/ralph-loop";

package/src/server/handlers/memory.ts

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, writeFileSync, readdirSync, unlinkSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
-import type { ClientMessage } from "@lattice/shared";
+import type { ClientMessage } from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo } from "../ws/broadcast";
 import { loadConfig } from "../config";

package/src/server/handlers/mesh.ts

@@ -1,7 +1,7 @@
-import type { ClientMessage, MeshPairMessage, MeshUnpairMessage, NodeInfo } from "@lattice/shared";
+import type { ClientMessage, MeshPairMessage, MeshUnpairMessage, NodeInfo } from "#shared";
 import { log } from "../logger";
 import { handleProxyRequest, handleProxyResponse } from "../mesh/proxy";
-import type { MeshProxyRequestMessage, MeshProxyResponseMessage } from "@lattice/shared";
+import type { MeshProxyRequestMessage, MeshProxyResponseMessage } from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo, broadcast } from "../ws/broadcast";
 import { loadConfig } from "../config";
@@ -10,7 +10,7 @@ import { generateInviteCode, parseInviteCode, validatePairingToken, consumePairi
 import { addPeer, removePeer, loadPeers, getPeer } from "../mesh/peers";
 import { getConnectedPeerIds, connectToPeer, reconnectPeer, getPeerConnection, disconnectPeer, getConnectedPeerProjects, registerInboundPeer } from "../mesh/connector";
 import { getClientWebSocket, registerVirtualClient, removeVirtualClient } from "../ws/broadcast";
-import type { PeerInfo } from "@lattice/shared";
+import type { PeerInfo } from "#shared";
 import { networkInterfaces } from "node:os";
 import { existsSync, readFileSync } from "node:fs";
 import { execSync } from "node:child_process";

package/src/server/handlers/notes.ts

@@ -4,7 +4,7 @@ import type {
   NotesCreateMessage,
   NotesUpdateMessage,
   NotesDeleteMessage,
-} from "@lattice/shared";
+} from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo, broadcast } from "../ws/broadcast";
 import { listNotes, createNote, updateNote, deleteNote } from "../features/sticky-notes";

package/src/server/handlers/plugins.ts

@@ -9,7 +9,7 @@ import type {
   PluginDetails,
   PluginError,
   MarketplacePluginEntry,
-} from "@lattice/shared";
+} from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo } from "../ws/broadcast";
 

package/src/server/handlers/project-settings.ts

@@ -1,4 +1,4 @@
-import type { ClientMessage, ProjectSettingsGetMessage, ProjectSettingsUpdateMessage, ProjectSettings, McpServerConfig } from "@lattice/shared";
+import type { ClientMessage, ProjectSettingsGetMessage, ProjectSettingsUpdateMessage, ProjectSettings, McpServerConfig } from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo } from "../ws/broadcast";
 import { loadConfig, saveConfig, invalidateConfigCache } from "../config";

package/src/server/handlers/scheduler.ts

@@ -4,7 +4,7 @@ import type {
   SchedulerDeleteMessage,
   SchedulerToggleMessage,
   SchedulerUpdateMessage,
-} from "@lattice/shared";
+} from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo } from "../ws/broadcast";
 import { listTasks, createTask, deleteTask, toggleTask, updateTask } from "../features/scheduler";

package/src/server/handlers/session.ts

@@ -7,7 +7,7 @@ import type {
   SessionListRequestMessage,
   SessionPreviewRequestMessage,
   SessionRenameMessage,
-} from "@lattice/shared";
+} from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo } from "../ws/broadcast";
 import { loadConfig } from "../config";
@@ -91,6 +91,7 @@ registerHandler("session", function (clientId: string, message: ClientMessage) {
         sessionId: pageMsg.sessionId,
         messages: page.messages,
         hasMore: page.hasMore,
+        totalMessages: page.totalMessages,
       });
     });
     return;

package/src/server/handlers/settings.ts

@@ -1,9 +1,9 @@
-import type { ClientMessage, SettingsGetMessage, SettingsUpdateMessage } from "@lattice/shared";
+import type { ClientMessage, SettingsGetMessage, SettingsUpdateMessage } from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo, broadcast } from "../ws/broadcast";
 import { loadConfig, saveConfig } from "../config";
 import { addProject, removeProject } from "../project/registry";
-import type { LatticeConfig } from "@lattice/shared";
+import type { LatticeConfig } from "#shared";
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -67,7 +67,7 @@ registerHandler("settings", function (clientId: string, message: ClientMessage)
     sendTo(clientId, {
       type: "settings:data",
       config: configWithClaudeMd,
-      mcpServers: readGlobalMcpServers() as Record<string, import("@lattice/shared").McpServerConfig>,
+      mcpServers: readGlobalMcpServers() as Record<string, import("#shared").McpServerConfig>,
       globalSkills: readGlobalSkills(),
       globalRules: readGlobalRules(),
       spinnerVerbs: loadSpinnerVerbs(),
@@ -130,7 +130,7 @@ registerHandler("settings", function (clientId: string, message: ClientMessage)
     sendTo(clientId, {
       type: "settings:data",
       config: updatedWithClaudeMd,
-      mcpServers: readGlobalMcpServers() as Record<string, import("@lattice/shared").McpServerConfig>,
+      mcpServers: readGlobalMcpServers() as Record<string, import("#shared").McpServerConfig>,
       globalSkills: readGlobalSkills(),
       globalRules: readGlobalRules(),
       spinnerVerbs: loadSpinnerVerbs(),

package/src/server/handlers/skills.ts

@@ -2,8 +2,8 @@ import { readdirSync, readFileSync, existsSync, lstatSync, realpathSync, statSyn
 import { join, sep, dirname } from "node:path";
 import { homedir } from "node:os";
 import { execSync, spawn } from "node:child_process";
-import type { ClientMessage } from "@lattice/shared";
-import type { SkillInfo } from "@lattice/shared";
+import type { ClientMessage } from "#shared";
+import type { SkillInfo } from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo } from "../ws/broadcast";
 import { loadConfig } from "../config";
@@ -292,7 +292,7 @@ registerHandler("skills", function (clientId: string, message: ClientMessage) {
           sendTo(clientId, {
             type: "settings:data",
             config: globalConfig,
-            mcpServers: readGlobalMcpServers() as Record<string, import("@lattice/shared").McpServerConfig>,
+            mcpServers: readGlobalMcpServers() as Record<string, import("#shared").McpServerConfig>,
             globalSkills: readGlobalSkills(),
           });
         }
@@ -333,7 +333,7 @@ registerHandler("skills", function (clientId: string, message: ClientMessage) {
       sendTo(clientId, {
         type: "settings:data",
         config: delConfig,
-        mcpServers: readGlobalMcpServers() as Record<string, import("@lattice/shared").McpServerConfig>,
+        mcpServers: readGlobalMcpServers() as Record<string, import("#shared").McpServerConfig>,
         globalSkills: readGlobalSkills(),
       });
     } catch (err) {
@@ -366,7 +366,7 @@ registerHandler("skills", function (clientId: string, message: ClientMessage) {
         sendTo(clientId, {
           type: "settings:data",
           config: updConfig,
-          mcpServers: readGlobalMcpServers() as Record<string, import("@lattice/shared").McpServerConfig>,
+          mcpServers: readGlobalMcpServers() as Record<string, import("#shared").McpServerConfig>,
           globalSkills: readGlobalSkills(),
         });
       });

package/src/server/handlers/terminal.ts

@@ -1,4 +1,4 @@
-import type { ClientMessage, TerminalCreateMessage, TerminalInputMessage, TerminalResizeMessage } from "@lattice/shared";
+import type { ClientMessage, TerminalCreateMessage, TerminalInputMessage, TerminalResizeMessage } from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo } from "../ws/broadcast";
 import { createTerminal, destroyTerminal, writeToTerminal, resizeTerminal } from "../project/terminal";
@@ -65,12 +65,23 @@ registerHandler("terminal", function(clientId: string, message: ClientMessage) {
 
   if (message.type === "terminal:input") {
     var inputMsg = message as TerminalInputMessage;
+    var clientSet = clientTerminals.get(clientId);
+    if (!clientSet || !clientSet.has(inputMsg.termId)) {
+      return;
+    }
+    if (typeof inputMsg.data === "string" && inputMsg.data.length > 65536) {
+      return;
+    }
     writeToTerminal(inputMsg.termId, inputMsg.data);
     return;
   }
 
   if (message.type === "terminal:resize") {
     var resizeMsg = message as TerminalResizeMessage;
+    var resizeClientSet = clientTerminals.get(clientId);
+    if (!resizeClientSet || !resizeClientSet.has(resizeMsg.termId)) {
+      return;
+    }
     resizeTerminal(resizeMsg.termId, resizeMsg.cols, resizeMsg.rows);
     return;
   }

package/src/server/handlers/themes.ts

@@ -4,7 +4,7 @@ import type {
   ClientMessage,
   ThemeSaveMessage,
   ThemeDeleteMessage,
-} from "@lattice/shared";
+} from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo, broadcast } from "../ws/broadcast";
 import { getLatticeHome } from "../config";

package/src/server/handlers/update.ts

@@ -2,7 +2,7 @@ import { chmodSync, writeFileSync, accessSync, copyFileSync, unlinkSync, constan
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { execSync, spawn } from "node:child_process";
-import type { ClientMessage } from "@lattice/shared";
+import type { ClientMessage } from "#shared";
 import { registerHandler } from "../ws/router";
 import { sendTo, broadcast } from "../ws/broadcast";
 import { checkForUpdate, getPackageName, getGitHubRepo, getInstallMode } from "../update-checker";

package/src/server/identity.ts

@@ -1,4 +1,4 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
 import { join } from "node:path";
 import { randomUUID, generateKeyPairSync } from "node:crypto";
 import { getLatticeHome } from "./config";
@@ -25,6 +25,7 @@ export function loadOrCreateIdentity(): NodeIdentity {
     stored.publicKey = keys.publicKey;
     stored.privateKey = keys.privateKey;
     writeFileSync(path, JSON.stringify(stored, null, 2), "utf-8");
+    chmodSync(path, 0o600);
     return stored;
   }
   var keys = generateEd25519Keypair();
@@ -35,6 +36,7 @@ export function loadOrCreateIdentity(): NodeIdentity {
     createdAt: Date.now(),
   };
   writeFileSync(path, JSON.stringify(identity, null, 2), "utf-8");
+  chmodSync(path, 0o600);
   return identity;
 }
 

package/src/server/index.ts

@@ -6,7 +6,7 @@ import { existsSync, readFileSync, writeFileSync, unlinkSync, openSync } from "n
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn, execSync } from "node:child_process";
-import { DAEMON_PID_FILE } from "@lattice/shared";
+import { DAEMON_PID_FILE } from "#shared";
 import { getLatticeHome, loadConfig } from "./config";
 
 var __filename_local = fileURLToPath(import.meta.url);
@@ -143,7 +143,7 @@ async function runDaemon(): Promise<void> {
   if (onboarding.passphrase) {
     var { hashPassphrase } = await import("./auth/passphrase");
     var config = loadConfig();
-    config.passphraseHash = hashPassphrase(onboarding.passphrase);
+    config.passphraseHash = await hashPassphrase(onboarding.passphrase);
     var { saveConfig: saveCfg } = await import("./config");
     saveCfg(config);
   }

package/src/server/mesh/connector.ts

@@ -1,4 +1,4 @@
-import type { MeshMessage, MeshHelloMessage, MeshSessionSyncMessage, MeshSessionRequestMessage } from "@lattice/shared";
+import type { MeshMessage, MeshHelloMessage, MeshSessionSyncMessage, MeshSessionRequestMessage } from "#shared";
 import * as peersModule from "./peers";
 import { loadPeers } from "./peers";
 import { loadOrCreateIdentity } from "../identity";

package/src/server/mesh/peers.ts

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import type { PeerInfo } from "@lattice/shared";
+import type { PeerInfo } from "#shared";
 import { getLatticeHome } from "../config";
 
 function getPeersPath(): string {

package/src/server/mesh/proxy.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import type { ClientMessage, MeshProxyRequestMessage, MeshProxyResponseMessage, ServerMessage } from "@lattice/shared";
+import type { ClientMessage, MeshProxyRequestMessage, MeshProxyResponseMessage, ServerMessage } from "#shared";
 import { getPeerConnection } from "./connector";
 import { sendTo, broadcast, registerVirtualClient, removeVirtualClient } from "../ws/broadcast";
 import { routeMessage } from "../ws/router";

package/src/server/mesh/session-sync.ts

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, appendFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
-import type { MeshSessionSyncMessage, MeshSessionRequestMessage } from "@lattice/shared";
+import type { MeshSessionSyncMessage, MeshSessionRequestMessage } from "#shared";
 import { getConnectedPeerIds, getPeerConnection } from "./connector";
 import { getLatticeHome } from "../config";
 

package/src/server/project/bookmarks.ts

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "
 import { join } from "node:path";
 import { randomBytes } from "node:crypto";
 import { getLatticeHome } from "../config";
-import type { MessageBookmark } from "@lattice/shared";
+import type { MessageBookmark } from "#shared";
 
 var bookmarksFile = "";
 var bookmarks: MessageBookmark[] = [];

package/src/server/project/context-breakdown.ts

@@ -2,7 +2,7 @@ import { encodingForModel } from "js-tiktoken";
 import { existsSync, readFileSync, readdirSync, openSync, readSync, fstatSync, closeSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
-import type { ContextBreakdownSegment } from "@lattice/shared";
+import type { ContextBreakdownSegment } from "#shared";
 import { guessContextWindow } from "./session";
 import { loadConfig } from "../config";
 import { getInstalledPluginCount, getPluginSkillRuleTokenEstimate } from "../handlers/plugins";

package/src/server/project/file-browser.ts

@@ -1,6 +1,6 @@
 import { readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join, resolve, relative } from "node:path";
-import type { FileEntry } from "@lattice/shared";
+import type { FileEntry } from "#shared";
 
 var MAX_FILE_SIZE = 512 * 1024;
 

package/src/server/project/registry.ts

@@ -1,7 +1,7 @@
 import { existsSync } from "node:fs";
 import { basename } from "node:path";
 import { loadConfig, saveConfig } from "../config";
-import type { ProjectSummary } from "@lattice/shared";
+import type { ProjectSummary } from "#shared";
 
 export function listProjects(nodeId: string): ProjectSummary[] {
   var config = loadConfig();

package/src/server/project/sdk-bridge.ts

@@ -3,7 +3,7 @@ import { query } from "@anthropic-ai/claude-agent-sdk";
 import type { SDKMessage, SDKPartialAssistantMessage, SDKResultMessage, SDKUserMessage } from "@anthropic-ai/claude-agent-sdk";
 import type { CanUseTool, PermissionMode, PermissionResult, PermissionUpdate } from "@anthropic-ai/claude-agent-sdk";
 type MessageParam = SDKUserMessage["message"];
-import type { Attachment } from "@lattice/shared";
+import type { Attachment } from "#shared";
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { homedir } from "node:os";
@@ -777,7 +777,6 @@ export function startChatStream(options: ChatStreamOptions): void {
 
   var mq = createMessageQueue();
   var firstMsg = buildSDKUserMessage(prompt, attachments, sessionId);
-  mq.push(firstMsg);
 
   var stream = query({ prompt: mq as any, options: queryOptions });
   pendingStreams.delete(sessionId);
@@ -804,6 +803,13 @@ export function startChatStream(options: ChatStreamOptions): void {
   broadcast({ type: "session:busy", sessionId, busy: true }, clientId);
 
   void (async function () {
+    var retried = false;
+    try {
+      await stream.initializationResult();
+    } catch (initErr) {
+      log.chat("Session %s SDK initialization warning: %O", sessionId, initErr);
+    }
+    mq.push(firstMsg);
     try {
       for await (var msg of stream) {
         processMessage(sessionStream, msg);
@@ -812,6 +818,26 @@ export function startChatStream(options: ChatStreamOptions): void {
       var errMsg = err instanceof Error ? err.message : String(err);
       if (errMsg.includes("aborted") || errMsg.includes("AbortError")) {
         log.chat("Session %s stream aborted", sessionId);
+      } else if (errMsg.includes("Sent before connected") && !retried) {
+        retried = true;
+        log.chat("Session %s SDK WebSocket race condition, retrying after delay...", sessionId);
+        await new Promise(function (r) { setTimeout(r, 500); });
+        try {
+          var retryMq = createMessageQueue();
+          var retryStream = query({ prompt: retryMq as any, options: queryOptions });
+          retryMq.push(firstMsg);
+          sessionStream.queryInstance = retryStream;
+          sessionStream.messageQueue = retryMq;
+          for await (var retryMsg of retryStream) {
+            processMessage(sessionStream, retryMsg);
+          }
+        } catch (retryErr: unknown) {
+          var retryErrMsg = retryErr instanceof Error ? retryErr.message : String(retryErr);
+          if (!retryErrMsg.includes("aborted") && !retryErrMsg.includes("AbortError")) {
+            console.error("[lattice] SDK stream retry error: " + retryErrMsg);
+            sendTo(sessionStream.clientId, { type: "chat:error", message: retryErrMsg });
+          }
+        }
       } else {
         console.error("[lattice] SDK stream error: " + errMsg);
         sendTo(sessionStream.clientId, { type: "chat:error", message: errMsg });

package/src/server/project/session.ts

@@ -10,7 +10,7 @@ import * as fsPromises from "node:fs/promises";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
-import type { HistoryMessage, SessionPreview, SessionSummary } from "@lattice/shared";
+import type { HistoryMessage, SessionPreview, SessionSummary } from "#shared";
 import { loadConfig } from "../config";
 import { log } from "../logger";
 
@@ -629,7 +629,7 @@ export async function loadSessionHistory(projectSlug: string, sessionId: string)
   }
 }
 
-export async function getSessionHistoryPage(sessionId: string, beforeIndex: number, limit: number, projectSlug?: string): Promise<{ messages: HistoryMessage[]; hasMore: boolean }> {
+export async function getSessionHistoryPage(sessionId: string, beforeIndex: number, limit: number, projectSlug?: string): Promise<{ messages: HistoryMessage[]; hasMore: boolean; totalMessages: number }> {
   var cached = historyCache.get(sessionId);
   if (!cached && projectSlug) {
     var projectPath = getProjectPath(projectSlug);
@@ -643,16 +643,17 @@ export async function getSessionHistoryPage(sessionId: string, beforeIndex: numb
       cached = historyCache.get(sessionId)!;
       log.session("getSessionHistoryPage: full load for %s, %d messages", sessionId.slice(0, 8), allMessages.length);
     } catch {
-      return { messages: [], hasMore: false };
+      return { messages: [], hasMore: false, totalMessages: 0 };
     }
   }
-  if (!cached) return { messages: [], hasMore: false };
+  if (!cached) return { messages: [], hasMore: false, totalMessages: 0 };
 
-  var endIdx = Math.max(0, beforeIndex);
+  var total = cached.messages.length;
+  var endIdx = Math.min(Math.max(0, beforeIndex), total);
   var startIdx = Math.max(0, endIdx - limit);
   var page = cached.messages.slice(startIdx, endIdx);
 
-  return { messages: page, hasMore: startIdx > 0 };
+  return { messages: page, hasMore: startIdx > 0, totalMessages: total };
 }
 
 export function createSession(projectSlug: string): SessionSummary {

package/src/server/tls.ts

@@ -16,12 +16,26 @@ export function getCertsDir(): string {
   return certsDir;
 }
 
+function isCertExpiringSoon(certPath: string): boolean {
+  try {
+    var result = spawnSync("openssl", ["x509", "-enddate", "-noout", "-in", certPath], { encoding: "utf-8" });
+    if (result.status !== 0) return true;
+    var match = result.stdout.match(/notAfter=(.+)/);
+    if (!match) return true;
+    var expiryDate = new Date(match[1]);
+    var daysLeft = (expiryDate.getTime() - Date.now()) / (1000 * 60 * 60 * 24);
+    return daysLeft < 30;
+  } catch {
+    return true;
+  }
+}
+
 export function ensureCerts(): CertPaths {
   var certsDir = getCertsDir();
   var certPath = join(certsDir, "cert.pem");
   var keyPath = join(certsDir, "key.pem");
 
-  if (existsSync(certPath) && existsSync(keyPath)) {
+  if (existsSync(certPath) && existsSync(keyPath) && !isCertExpiringSoon(certPath)) {
     return { cert: certPath, key: keyPath };
   }
 

package/src/server/tui.ts

@@ -2,8 +2,8 @@ import * as p from "@clack/prompts";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { getLatticeHome, loadConfig, saveConfig } from "./config";
-import type { LatticeConfig } from "@lattice/shared";
-import { DEFAULT_PORT } from "@lattice/shared";
+import type { LatticeConfig } from "#shared";
+import { DEFAULT_PORT } from "#shared";
 
 var BANNER = `
   \x1b[36m██╗\x1b[0m      \x1b[36m█████╗\x1b[0m \x1b[36m████████╗████████╗██╗\x1b[0m \x1b[36m██████╗\x1b[0m \x1b[36m███████╗\x1b[0m