@dadado/agent-kit-cli 4.7.2 → 4.8.2

package/dashboard/logo-cursor.svg

@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 22.38 22.45" fill="none" aria-hidden="true">
+  <!-- Cursor Interface Skin: stroke helmet mark (readable at 16px chrome icon size). -->
+  <path d="M9.61,22.1c-4.45-1.22-7.48-4.71-8.17-9.63v-2.47c0-5.39,4.37-9.75,9.75-9.75h0c5.39,0,9.75,4.37,9.75,9.75,0,.62.04,1.85,0,2.47-.34,4.86-3.54,8.41-8.2,9.63-.49.13-2.63.13-3.13,0Z" stroke="#e4e4e4" stroke-width=".5" stroke-miterlimit="10" fill="none"/>
+  <path d="M18.42,9.54c-.38,3.74-1.81,8.07-7.22,8.07s-6.66-4.49-7.22-8.07v-.19c0-3.47,3.23-6.28,7.22-6.28s7.22,2.81,7.22,6.28v.19Z" stroke="#e4e4e4" stroke-width=".5" stroke-miterlimit="10" fill="none"/>
+  <path d="M13.59,6.08c1.18.76,1.99,1.85,2.2,3.16.07.43.07.86,0,1.28s-.19.84-.37,1.25" stroke="#e4e4e4" stroke-width=".5" stroke-linecap="round" fill="none"/>
+  <g>
+    <line x1=".25" y1="7.9" x2=".25" y2="13.68" stroke="#e4e4e4" stroke-width=".5" stroke-linecap="round"/>
+    <line x1="22.13" y1="7.9" x2="22.13" y2="13.68" stroke="#e4e4e4" stroke-width=".5" stroke-linecap="round"/>
+  </g>
+</svg>

package/dashboard/logo.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="425" height="431" viewBox="0 0 425 431" fill="none"><path d="M336.63 276.677C332.594 322.739 284.509 369.238 212.312 369.238C140.116 369.238 96.6777 324.675 88.6322 281.275C87.4704 275.028 87.158 264.135 87.3829 256.289C87.4195 261.58 87.837 266.862 88.6322 272.093C96.6777 315.493 140.116 360.055 212.312 360.055C284.509 360.055 332.594 313.557 336.63 267.495C336.967 263.597 337.317 258.825 337.467 254.228C337.655 261.721 337.375 269.219 336.63 276.677V276.677Z" fill="#e2e8f0"></path><path d="M344.35 166.265H338.229C324.699 105.337 273.428 60 212.225 60C151.022 60 99.7884 105.337 86.1836 166.265H79.5998C77.5165 166.337 75.5467 167.232 74.1226 168.754C72.6986 170.277 71.9367 172.302 72.0041 174.385V231.778C71.9367 233.861 72.6986 235.887 74.1226 237.409C75.5467 238.931 77.5165 239.827 79.5998 239.898H87.7702C87.3062 245.328 87.1643 250.78 87.3455 256.227V256.314C87.382 261.605 87.7995 266.887 88.5947 272.118C96.6402 315.518 140.078 360.08 212.275 360.08C284.472 360.08 332.557 313.582 336.592 267.52C336.929 263.622 337.279 258.85 337.429 254.253C337.641 248.543 337.554 243.097 336.817 239.898H344.313C346.396 239.827 348.366 238.931 349.79 237.409C351.214 235.887 351.976 233.861 351.908 231.778V174.398C351.976 172.319 351.22 170.298 349.804 168.775C348.388 167.252 346.428 166.35 344.35 166.265V166.265Z" fill="#DADADA"></path><path d="M351.996 174.398V231.778C352.029 232.814 351.858 233.846 351.491 234.815C351.124 235.784 350.57 236.672 349.86 237.426C349.149 238.181 348.297 238.787 347.351 239.212C346.406 239.636 345.386 239.869 344.35 239.898H335.83C319.327 296.117 270.205 336.844 212.15 336.844C154.095 336.844 105.085 296.117 88.5823 239.898H79.5998C77.5165 239.827 75.5467 238.931 74.1226 237.409C72.6986 235.887 71.9367 233.861 72.0041 231.778V174.385C71.9367 172.302 72.6986 170.277 74.1226 168.754C75.5467 167.232 77.5165 166.337 79.5998 166.265H86.1836C99.7509 105.337 151.034 60 212.225 60C273.415 60 324.661 105.337 338.279 166.265H344.35C345.387 166.296 346.407 166.53 347.352 166.956C348.298 167.382 349.15 167.99 349.86 168.745C350.571 169.501 351.125 170.389 351.491 171.359C351.858 172.329 352.029 173.361 351.996 174.398V174.398Z" fill="#F6F6F6"></path><path d="M351.996 174.398V231.778C352.029 232.814 351.858 233.846 351.491 234.815C351.124 235.784 350.57 236.672 349.86 237.426C349.149 238.181 348.297 238.787 347.351 239.212C346.406 239.636 345.386 239.869 344.35 239.898H335.843C342.835 215.951 343.694 190.631 338.341 166.265H344.35C345.387 166.296 346.407 166.53 347.352 166.956C348.298 167.382 349.15 167.99 349.86 168.745C350.571 169.501 351.125 170.389 351.491 171.359C351.858 172.329 352.029 173.361 351.996 174.398V174.398Z" fill="#DADADA"></path><path d="M88.5823 239.898H79.5998C77.5165 239.827 75.5467 238.931 74.1226 237.409C72.6986 235.887 71.9367 233.861 72.0041 231.778V174.385C71.9367 172.302 72.6986 170.277 74.1226 168.754C75.5467 167.232 77.5165 166.337 79.5998 166.265H86.0712C80.718 190.631 81.5772 215.951 88.5698 239.898H88.5823Z" fill="#DADADA"></path><path d="M324.811 198.159C324.811 211.539 324.461 222.583 320.189 232.877C313.258 249.263 302.263 263.612 288.244 274.566C284.905 277.199 281.427 279.651 277.825 281.912L277.313 282.224L277.163 282.324C275.189 283.574 273.19 284.823 270.917 286.459C269.068 287.709 267.256 289.058 265.495 290.32C261.947 292.818 258.599 295.317 254.963 297.578C245.831 303.3 233.55 309.147 211.738 309.147C183.991 309.147 171.373 300.027 158.018 290.407C154.27 287.721 150.522 284.948 146.275 282.362C142.429 279.994 138.725 277.403 135.181 274.604C121.16 263.635 110.166 249.274 103.236 232.877C100.013 225.094 99.3137 216.786 99.2512 206.717V205.218C99.2512 203.656 99.2512 202.07 99.2512 200.483C99.2512 199.983 99.2512 199.471 99.2512 198.984V198.809C99.2512 198.134 99.2512 197.447 99.2512 196.773C99.2512 195.111 99.2512 193.475 99.2512 191.775C99.2512 190.689 99.2512 189.614 99.2512 188.577C99.3137 181.082 99.7884 173.036 102.774 165.54C110.467 146.665 123.49 130.438 140.253 118.842C161.199 104.214 186.178 96.4684 211.725 96.6792C235.15 96.6106 258.123 103.125 278.025 115.481C297.077 127.424 312.143 144.465 320.501 164.866C324.474 174.935 324.799 185.429 324.811 198.159Z" fill="url(#paint0_linear_108_70)"></path><g style="mix-blend-mode:color-dodge"><g style="mix-blend-mode:color-dodge"><path d="M290.631 150.924C301.025 158.882 307.821 182.156 308.121 197.26C308.296 207.329 299.75 207.179 299.525 197.922C299.238 186.066 294.678 168.589 285.408 159.993C269.143 144.952 282.323 144.54 290.631 150.924Z" fill="#e2e8f0"></path></g><g style="mix-blend-mode:color-dodge"><path d="M301.624 213.251C304.51 213.701 306.222 218.073 305.447 222.995C304.673 227.918 301.699 231.565 298.813 231.103C295.927 230.641 294.216 226.281 294.99 221.359C295.765 216.437 298.738 212.789 301.624 213.251Z" fill="#e2e8f0"></path></g></g><path d="M324.749 163.167C316.341 142.453 301.324 124.801 281.311 112.008C260.496 98.8265 236.338 91.8895 211.7 92.0194C185.184 91.8211 159.263 99.8765 137.53 115.069C120.008 127.19 106.395 144.15 98.3517 163.879C95.0786 172.087 94.6038 180.607 94.5039 188.627C94.5039 189.702 94.5039 190.789 94.5039 191.875C94.5039 193.5 94.5039 195.124 94.5039 196.773V200.521C94.5039 202.107 94.5039 203.669 94.5039 205.23V206.767C94.5039 217.399 95.3284 226.219 98.8514 234.714C106.094 251.829 117.578 266.818 132.22 278.264C135.901 281.183 139.752 283.882 143.751 286.347C147.799 288.846 151.572 291.569 155.22 294.205C168.587 303.862 182.417 313.869 211.675 313.869C234.675 313.869 247.68 307.623 257.374 301.576C261.122 299.215 264.72 296.579 268.168 294.155C269.905 292.906 271.716 291.657 273.528 290.345C275.764 288.783 277.688 287.521 279.587 286.347L279.749 286.247L280.311 285.885C284.057 283.548 287.669 281.004 291.13 278.264C305.769 266.817 317.249 251.829 324.486 234.714C329.084 223.62 329.484 212.102 329.484 198.197C329.484 184.929 329.134 173.911 324.749 163.167ZM320.189 232.877C313.258 249.263 302.263 263.612 288.244 274.566C284.905 277.199 281.427 279.651 277.825 281.912L277.313 282.224L277.163 282.324C275.189 283.574 273.19 284.823 270.917 286.459C269.068 287.709 267.256 289.058 265.495 290.32C261.947 292.818 258.599 295.317 254.963 297.578C245.831 303.3 233.55 309.147 211.738 309.147C183.991 309.147 171.373 300.027 158.018 290.407C154.27 287.721 150.522 284.948 146.275 282.362C142.429 279.994 138.725 277.403 135.181 274.604C121.16 263.635 110.166 249.274 103.236 232.877C100.013 225.094 99.3137 216.786 99.2512 206.717V205.218C99.2512 203.656 99.2512 202.07 99.2512 200.483C99.2512 199.983 99.2512 199.471 99.2512 198.984V198.809C99.2512 198.134 99.2512 197.447 99.2512 196.773C99.2512 195.111 99.2512 193.475 99.2512 191.776C99.2512 190.689 99.2512 189.614 99.2512 188.577C99.3137 181.082 99.7884 173.036 102.774 165.54C110.467 146.665 123.49 130.438 140.253 118.842C161.199 104.214 186.178 96.4684 211.725 96.6792C235.15 96.6106 258.123 103.125 278.025 115.481C297.077 127.424 312.143 144.465 320.501 164.866C324.561 174.86 324.886 185.367 324.899 198.097C324.799 211.539 324.461 222.583 320.189 232.877Z" fill="#e2e8f0"></path><defs><linearGradient id="paint0_linear_108_70" x1="288.457" y1="275.403" x2="134.906" y2="121.865" gradientUnits="userSpaceOnUse"><stop stop-color="#2739BD"></stop><stop offset="0.32" stop-color="#0C8DEB"></stop><stop offset="0.47" stop-color="#00B2FF"></stop><stop offset="0.67" stop-color="#00D0E7"></stop><stop offset="1" stop-color="#00FFC2"></stop></linearGradient></defs></svg>

package/dashboard/serve.mjs

@@ -0,0 +1,550 @@
+#!/usr/bin/env node
+// dashboard/serve.mjs
+// Server for the Startup Kit Dashboard
+// - Serves dashboard HTML
+// - Generates dashboard-data.json on each request
+// - SSE endpoint for live push updates
+
+import { execFile } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, realpathSync, watch, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { dirname, extname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  DEFAULT_HOST,
+  REPO_ROOT_ENV,
+  allowlistConfig,
+  applyCorsHeaders,
+  authorizeMissionControlRequest,
+  broadcastAuthCookieHeader,
+  isAllowedOrigin,
+  isLoopbackAddress,
+  listLanIPv4Addresses,
+  mergeConfigAllowlist,
+  resolveBroadcastAuth,
+  resolveContextConfigPath,
+  resolveDashboardStatic,
+  resolveSnapshotRepoRoot,
+  validateConfigWriteBody,
+} from "./lib/guards.mjs";
+import {
+  PERIODIC_REFRESH_MS,
+  WATCH_DEBOUNCE_MS,
+  createTrailingDebounce,
+  resolveAgentTranscriptsWatchPath,
+  resolveWatchPaths,
+} from "./lib/live-refresh.mjs";
+import { buildInventoryBaseline } from "./lib/semantic-model.mjs";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+/** Kit tree that owns `dashboard/` static assets and serve.mjs. */
+const KIT_ROOT = join(__dirname, "..");
+/** Workspace Mission Control snapshots (plans, HANDOFF, git). Defaults to KIT_ROOT. */
+const ROOT = resolveSnapshotRepoRoot(process.env, KIT_ROOT);
+const DASHBOARD_DIR = __dirname;
+const authResolved = resolveBroadcastAuth(process.env);
+if (!authResolved.ok) {
+  console.error(`[ERROR] ${authResolved.error}`);
+  process.exit(1);
+}
+const HOST = authResolved.host;
+const PORT = Number.parseInt(process.env.PORT || "3333", 10);
+const TOKEN_REQUIRED = authResolved.tokenRequired;
+const AUTH_TOKEN = authResolved.token;
+const DASHBOARD_REAL = realpathSync(DASHBOARD_DIR);
+
+const MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".js": "application/javascript; charset=utf-8",
+  ".mjs": "application/javascript; charset=utf-8",
+  ".css": "text/css",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+};
+
+const dataScript = join(__dirname, "dashboard-data.mjs");
+
+/** Compact inventory baseline fed back into the next data-script run via env. */
+let previousInventoryJson = null;
+
+/**
+ * @param {string} payload
+ * @returns {string|null}
+ */
+function inventoryBaselineJsonFromPayload(payload) {
+  try {
+    const data = JSON.parse(payload);
+    if (!data || data.error) return null;
+    return JSON.stringify(
+      buildInventoryBaseline({
+        agents: data.agents,
+        skills: data.skills,
+        commands: data.commands,
+        memory: data.memory,
+      }),
+    );
+  } catch {
+    return null;
+  }
+}
+
+function setCorsHeaders(req, res) {
+  applyCorsHeaders(req, res, PORT);
+}
+
+/**
+ * @param {import("node:http").IncomingMessage} req
+ * @returns {Promise<string>}
+ */
+function readRequestBody(req) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    const MAX = 64 * 1024;
+    req.on("data", (chunk) => {
+      size += chunk.length;
+      if (size > MAX) {
+        reject(new Error("body too large"));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
+}
+
+/**
+ * @param {import("node:http").IncomingMessage} req
+ * @param {import("node:http").ServerResponse} res
+ * @param {number} status
+ * @param {object} payload
+ */
+function sendJson(res, status, payload) {
+  res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
+  res.end(JSON.stringify(payload));
+}
+
+/**
+ * Narrow allowlisted merge-write for `.cursor/context/config.json`.
+ * @param {import("node:http").IncomingMessage} req
+ * @param {import("node:http").ServerResponse} res
+ */
+async function handleConfigWrite(req, res) {
+  const remote = req.socket?.remoteAddress;
+  if (!isLoopbackAddress(remote)) {
+    sendJson(res, 403, { error: "loopback only" });
+    return;
+  }
+  const origin = req.headers?.origin;
+  if (origin && !isAllowedOrigin(origin, PORT)) {
+    sendJson(res, 403, { error: "origin not allowed" });
+    return;
+  }
+
+  let rawBody;
+  try {
+    rawBody = await readRequestBody(req);
+  } catch (err) {
+    sendJson(res, 413, { error: err?.message || "body read failed" });
+    return;
+  }
+
+  let body;
+  try {
+    body = rawBody ? JSON.parse(rawBody) : null;
+  } catch {
+    sendJson(res, 400, { error: "invalid JSON" });
+    return;
+  }
+
+  const validated = validateConfigWriteBody(body);
+  if (!validated.ok) {
+    sendJson(res, 400, { error: validated.error });
+    return;
+  }
+
+  const locked = resolveContextConfigPath(ROOT, { existsSync, realpathSync, mkdirSync });
+  if (!locked.ok) {
+    sendJson(res, 500, { error: locked.error });
+    return;
+  }
+
+  let existing = {};
+  if (existsSync(locked.path)) {
+    try {
+      existing = JSON.parse(readFileSync(locked.path, "utf8"));
+      if (!existing || typeof existing !== "object" || Array.isArray(existing)) {
+        sendJson(res, 500, { error: "existing config is not an object" });
+        return;
+      }
+    } catch {
+      sendJson(res, 500, { error: "existing config parse error" });
+      return;
+    }
+  }
+
+  const merged = mergeConfigAllowlist(existing, validated.patch);
+  try {
+    writeFileSync(locked.path, `${JSON.stringify(merged, null, 2)}\n`, "utf8");
+  } catch (err) {
+    sendJson(res, 500, { error: err?.message || "write failed" });
+    return;
+  }
+
+  cachedPayload = null;
+  cachedAt = 0;
+  scheduleBroadcast();
+
+  sendJson(res, 200, { ok: true, config: allowlistConfig(merged) });
+}
+
+function resolveStaticPath(pathname) {
+  return resolveDashboardStatic(pathname, {
+    dashboardDir: DASHBOARD_DIR,
+    dashboardReal: DASHBOARD_REAL,
+    existsSync,
+    realpathSync,
+  });
+}
+
+// SSE clients
+const sseClients = new Set();
+
+// Short TTL cache + single-flight so concurrent HTTP/SSE requests do not
+// stack child processes. Generation is async so heartbeats and accepts stay live.
+const CACHE_TTL_MS = 2000;
+let cachedPayload = null;
+let cachedAt = 0;
+/** @type {Promise<string> | null} */
+let inFlight = null;
+
+function errorPayload(message) {
+  // Every collection the panel reads must be present, or the render throws
+  // and a snapshot failure surfaces as "Render Failed" instead of an
+  // empty panel.
+  return JSON.stringify({
+    generatedAt: new Date().toISOString(),
+    version: "error",
+    error: message,
+    plans: [],
+    system: {},
+    agents: [],
+    commands: [],
+    skills: [],
+    memory: {},
+    git: {},
+    terminals: [],
+    processes: [],
+    health: { status: "error", checks: [] },
+    missionControl: null,
+  });
+}
+
+// Cold snapshot on a busy dogfood repo can exceed 15s; killing the child
+// yields health:error and a Degraded badge with empty cockpit panels.
+// Override with AGENT_KIT_DASHBOARD_DATA_TIMEOUT_MS (ms) when needed.
+const DATA_SCRIPT_TIMEOUT_MS = (() => {
+  const raw = process.env.AGENT_KIT_DASHBOARD_DATA_TIMEOUT_MS;
+  const n = raw != null && raw !== "" ? Number(raw) : 60_000;
+  return Number.isFinite(n) && n > 0 ? n : 60_000;
+})();
+
+function runDataScript() {
+  return new Promise((resolve) => {
+    const env = {
+      ...process.env,
+      // Pin snapshot root for the child even if the parent cwd differs.
+      [REPO_ROOT_ENV]: ROOT,
+      // Empty string = cold start (dashboard-data treats falsy as no previous).
+      AGENT_KIT_PREV_INVENTORY: previousInventoryJson || "",
+    };
+    execFile(
+      process.execPath,
+      [dataScript],
+      {
+        cwd: ROOT,
+        encoding: "utf-8",
+        maxBuffer: 10 * 1024 * 1024,
+        timeout: DATA_SCRIPT_TIMEOUT_MS,
+        env,
+      },
+      (err, stdout) => {
+        if (err) {
+          const timedOut = err.killed || err.signal === "SIGTERM";
+          const message = timedOut
+            ? `dashboard-data.mjs timed out after ${DATA_SCRIPT_TIMEOUT_MS}ms (set AGENT_KIT_DASHBOARD_DATA_TIMEOUT_MS to raise)`
+            : err.message;
+          resolve(errorPayload(message));
+          return;
+        }
+        const baseline = inventoryBaselineJsonFromPayload(stdout);
+        if (baseline) previousInventoryJson = baseline;
+        resolve(stdout);
+      },
+    );
+  });
+}
+
+/**
+ * @param {{ force?: boolean }} [opts]
+ * @returns {Promise<string>}
+ */
+async function generateData({ force = false } = {}) {
+  const now = Date.now();
+  if (!force && cachedPayload && now - cachedAt < CACHE_TTL_MS) {
+    return cachedPayload;
+  }
+  if (inFlight) {
+    const payload = await inFlight;
+    if (!force) return payload;
+    if (cachedPayload && Date.now() - cachedAt < CACHE_TTL_MS) {
+      return cachedPayload;
+    }
+  }
+  inFlight = runDataScript()
+    .then((payload) => {
+      cachedPayload = payload;
+      cachedAt = Date.now();
+      return payload;
+    })
+    .finally(() => {
+      inFlight = null;
+    });
+  return inFlight;
+}
+
+/**
+ * SSE data fields are line-oriented: only lines prefixed with `data:` become
+ * event.data. Pretty-printed JSON (newlines) would deliver a broken `{` fragment
+ * and the browser client would silently drop every push. Always emit one line.
+ * @param {string} data
+ */
+function toSseDataLine(data) {
+  try {
+    return JSON.stringify(JSON.parse(data));
+  } catch {
+    return String(data).replace(/\r?\n/g, " ");
+  }
+}
+
+function writeSseData(res, data) {
+  res.write(`data: ${toSseDataLine(data)}\n\n`);
+}
+
+function broadcast(data) {
+  const msg = `data: ${toSseDataLine(data)}\n\n`;
+  for (const client of sseClients) {
+    try {
+      client.write(msg);
+    } catch {
+      sseClients.delete(client);
+    }
+  }
+}
+
+let lastBroadcastAt = 0;
+
+/** Fresh snapshot + push. Skips work when nobody is listening. */
+async function flushBroadcast() {
+  if (sseClients.size === 0) return;
+  const data = await generateData({ force: true });
+  lastBroadcastAt = Date.now();
+  broadcast(data);
+}
+
+// Watch bursts coalesce; maxWait guarantees a flush during continuous writes.
+const scheduleBroadcast = createTrailingDebounce(
+  () => {
+    void flushBroadcast();
+  },
+  WATCH_DEBOUNCE_MS,
+  { maxWait: PERIODIC_REFRESH_MS },
+);
+
+// Watch every in-repo snapshot source (full `.cursor` tree + package + data script).
+const watchPaths = resolveWatchPaths(ROOT, __dirname);
+// External: agent transcripts (Field Report prompts). Outside SNAPSHOT_REPO_SOURCE_RELS;
+// without this watch, prompt rows wait on PERIODIC_REFRESH_MS alone.
+const agentTranscriptsWatch = resolveAgentTranscriptsWatchPath(ROOT);
+const allWatchPaths = [...watchPaths, agentTranscriptsWatch];
+
+for (const p of allWatchPaths) {
+  if (!existsSync(p)) {
+    console.warn(`[watch] skip missing path: ${p}`);
+    continue;
+  }
+  try {
+    watch(p, { recursive: true }, () => {
+      scheduleBroadcast();
+    });
+  } catch (err) {
+    console.warn(`[watch] failed for ${p}: ${err?.message ? err.message : err}`);
+  }
+}
+
+// Git / terminals / processes do not touch watched files; keep SSE clients fresh.
+// Call flushBroadcast directly (not via trailing debounce) so watch-event storms
+// cannot starve the periodic cadence.
+setInterval(() => {
+  if (sseClients.size === 0) return;
+  if (Date.now() - lastBroadcastAt < PERIODIC_REFRESH_MS) return;
+  void flushBroadcast();
+}, PERIODIC_REFRESH_MS);
+
+const server = createServer((req, res) => {
+  const url = new URL(req.url, `http://127.0.0.1:${PORT}`);
+  const path = url.pathname;
+
+  setCorsHeaders(req, res);
+
+  if (path === "/api/config" && req.method === "OPTIONS") {
+    const origin = req.headers?.origin;
+    if (origin && isAllowedOrigin(origin, PORT)) {
+      res.writeHead(204, {
+        "Access-Control-Allow-Origin": origin,
+        "Access-Control-Allow-Methods": "PUT, PATCH, OPTIONS",
+        "Access-Control-Allow-Headers": "Content-Type",
+        Vary: "Origin",
+      });
+    } else {
+      res.writeHead(204);
+    }
+    res.end();
+    return;
+  }
+
+  if (path === "/api/config" && (req.method === "PUT" || req.method === "PATCH")) {
+    // Config mutations stay loopback-only (token does not unlock writes from LAN).
+    void handleConfigWrite(req, res);
+    return;
+  }
+
+  const auth = authorizeMissionControlRequest(req, url, {
+    tokenRequired: TOKEN_REQUIRED,
+    expectedToken: AUTH_TOKEN,
+  });
+  if (!auth.ok) {
+    sendJson(res, auth.status || 401, { error: auth.error || "unauthorized" });
+    return;
+  }
+  if (auth.viaQuery && AUTH_TOKEN) {
+    res.setHeader("Set-Cookie", broadcastAuthCookieHeader(AUTH_TOKEN));
+  }
+
+  // SSE endpoint
+  if (path === "/api/events") {
+    res.writeHead(200, {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+    });
+
+    sseClients.add(res);
+    const clientAddr = req.socket.remoteAddress || "unknown";
+    console.log(`[SSE] Client connected: ${clientAddr} (${sseClients.size} clients)`);
+
+    // Prefer warm cache so connect does not block the event loop; refresh after.
+    if (cachedPayload) {
+      try {
+        writeSseData(res, cachedPayload);
+      } catch {
+        // client gone
+      }
+      if (Date.now() - cachedAt >= CACHE_TTL_MS) {
+        void flushBroadcast();
+      }
+    } else {
+      void generateData().then((data) => {
+        try {
+          writeSseData(res, data);
+        } catch {
+          // client gone
+        }
+      });
+    }
+
+    req.on("close", () => {
+      sseClients.delete(res);
+      console.log(
+        `[SSE] Client disconnected: ${clientAddr} (${sseClients.size} clients remaining)`,
+      );
+    });
+
+    // Heartbeat every 30s to keep connection alive
+    const heartbeat = setInterval(() => {
+      try {
+        res.write(":heartbeat\n\n");
+      } catch {
+        clearInterval(heartbeat);
+      }
+    }, 30000);
+
+    req.on("close", () => clearInterval(heartbeat));
+    return;
+  }
+
+  // Data endpoint
+  if (path === "/dashboard-data.json" || path === "/api/data") {
+    void generateData().then((data) => {
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(data);
+    });
+    return;
+  }
+
+  const staticPath = resolveStaticPath(path);
+  if (!staticPath) {
+    res.writeHead(404);
+    res.end("Not found");
+    return;
+  }
+
+  const ext = extname(staticPath);
+  const contentType = MIME[ext] || "application/octet-stream";
+  const content = readFileSync(staticPath);
+  res.writeHead(200, { "Content-Type": contentType });
+  res.end(content);
+});
+
+server.listen(PORT, HOST, () => {
+  const loopback = HOST === DEFAULT_HOST || HOST === "localhost" || HOST === "::1";
+  if (!loopback) {
+    console.warn(
+      `[WARN] Mission Control broadcast mode on ${HOST}:${PORT}. Token gate is required; config writes stay loopback-only.`,
+    );
+  }
+
+  console.log("\n  Mission Control\n");
+  if (loopback) {
+    const url = `http://127.0.0.1:${PORT}`;
+    console.log(`  Local:   ${url}`);
+    console.log(`  Data:    ${url}/dashboard-data.json`);
+    console.log(`  Events:  ${url}/api/events (SSE)`);
+    console.log(`  Config:  ${url}/api/config (PUT/PATCH, loopback)`);
+  } else {
+    const lan = listLanIPv4Addresses();
+    const tokenQ = AUTH_TOKEN ? `?token=${encodeURIComponent(AUTH_TOKEN)}` : "";
+    console.log(`  Bind:    ${HOST}:${PORT} (token-gated)`);
+    console.log(`  Local:   http://127.0.0.1:${PORT}/${tokenQ}`);
+    if (lan.length === 0) {
+      console.log("  LAN:     (no non-internal IPv4 found; check Wi-Fi / Ethernet)");
+    } else {
+      for (const ip of lan) {
+        console.log(`  LAN:     http://${ip}:${PORT}/${tokenQ}`);
+      }
+    }
+    console.log("  Token:   printed once above in each LAN URL (MISSION_CONTROL_TOKEN)");
+    console.log("  Config:  PUT/PATCH /api/config remains loopback-only");
+    console.log("  Firewall: allow inbound TCP on this port for your LAN profile if needed");
+  }
+  console.log(`  Snapshot: ${ROOT}`);
+  if (ROOT !== KIT_ROOT) {
+    console.log(`  Kit:     ${KIT_ROOT}`);
+  }
+  console.log("\n  Open in Cursor Simple Browser or your browser.\n");
+  console.log("  Press Ctrl+C to stop.\n");
+});