@davvidbaker/flambe-cli 0.1.0 → 0.1.2

package/src/local/commands.mjs

@@ -0,0 +1,291 @@
+// Local start/end/suspend/resume rules. HTTP is the adapter; SQLite is the source of truth.
+export const COMMANDS = ['start', 'end', 'suspend', 'resume', 'status', 'message', 'plan'];
+const RUNNING = new Set(['B', 'R', 'X']);
+const ENDED = new Set(['E', 'J', 'V']);
+const LIFECYCLE = new Set([...RUNNING, ...ENDED, 'S']);
+const STOPWORDS = new Set('the and for with from into that this work task item stuff'.split(' '));
+const tokens = name => name.toLowerCase().split(/[^a-z0-9]+/).filter(t => t.length >= 4 && !STOPWORDS.has(t));
+
+export class CommandError extends Error {
+  constructor(status, code, message, extra = {}) {
+    super(message);
+    this.status = status;
+    this.body = { error: { code, message, ...extra } };
+  }
+}
+function invalid(message) { throw new CommandError(422, 'INVALID_INPUT', message); }
+function notFound() { throw new CommandError(404, 'NOT_FOUND', 'The requested resource was not found'); }
+function positiveId(value, field) {
+  if (!['number', 'string'].includes(typeof value) || !/^\d+$/.test(String(value))
+    || !Number.isSafeInteger(Number(value)) || Number(value) <= 0) invalid(`${field} must be a positive integer`);
+  return Number(value);
+}
+function optionalId(value, field) { return value == null ? null : positiveId(value, field); }
+function bool(value, field) {
+  if (value !== undefined && typeof value !== 'boolean') invalid(`${field} must be boolean`);
+  return value ?? false;
+}
+function requiredText(value, field) {
+  if (typeof value !== 'string' || !value.trim()) invalid(`${field} is required`);
+  return value.trim();
+}
+function compare(a, b) { return Date.parse(a.timestamp) - Date.parse(b.timestamp) || a.id - b.id; }
+
+/** Derive state only from lifecycle history; annotations never reopen work. */
+export function commandState(trace, filters = {}) {
+  const latest = new Map();
+  const begins = new Map();
+  for (const event of trace.events) {
+    if (!event.activity || !LIFECYCLE.has(event.phase)) continue;
+    const id = event.activity.id;
+    if (!latest.has(id) || compare(event, latest.get(id)) > 0) latest.set(id, event);
+    if (event.phase === 'B' && (!begins.has(id) || compare(event, begins.get(id)) < 0)) begins.set(id, event);
+  }
+  const chain = id => {
+    const result = [];
+    const seen = new Set();
+    while (latest.has(id) && !seen.has(id)) {
+      seen.add(id);
+      const event = latest.get(id);
+      result.unshift(event);
+      id = event.activity.parent_id;
+    }
+    return result;
+  };
+  const threads = trace.threads.map(thread => ({ ...thread, availableActions: [{
+    operation: 'start', arguments: { trace_id: trace.id, thread_id: thread.id, parent_id: null },
+  }] }));
+  const activities = [...latest.values()].sort(compare).map(event => {
+    const activity = event.activity;
+    const ancestors = chain(activity.id);
+    const status = RUNNING.has(event.phase)
+      ? ancestors.slice(0, -1).some(a => a.phase === 'S') ? 'parent_suspended' : 'running'
+      : event.phase === 'S' ? 'suspended' : 'ended';
+    const descendants = [...latest.values()].filter(e => e.activity.id !== activity.id
+      && RUNNING.has(e.phase) && chain(e.activity.id).some(a => a.activity.id === activity.id));
+    const args = { trace_id: trace.id, activity_id: activity.id };
+    const end = { operation: 'end', arguments: args, ...(descendants.length ? {
+      requires: { force: true }, reason: 'open_descendants',
+    } : {}) };
+    const actions = status === 'running' ? [
+      { operation: 'start', arguments: { trace_id: trace.id, thread_id: activity.thread.id, parent_id: activity.id } },
+      { operation: 'suspend', arguments: args }, end,
+    ] : status === 'suspended' ? [{ operation: 'resume', arguments: args }, end] : [];
+    return {
+      id: activity.id, name: activity.name, threadId: activity.thread.id,
+      threadName: threads.find(t => t.id === activity.thread.id)?.name ?? null,
+      parentId: activity.parent_id ?? null, agentId: activity.agent_id ?? null,
+      path: ancestors.map(e => e.activity.name), categoryIds: activity.categories ?? [],
+      startedAt: begins.get(activity.id)?.timestamp ?? null,
+      latestEvent: { id: event.id, phase: event.phase, timestamp: event.timestamp,
+        ...(event.message ? { message: event.message } : {}) },
+      status, availableActions: actions,
+    };
+  });
+  return {
+    trace: { id: trace.id, name: trace.name },
+    threads: threads.filter(t => !filters.thread_id || t.id === filters.thread_id),
+    activities: activities.filter(a => (!filters.thread_id || a.threadId === filters.thread_id)
+      && (!filters.active_only || a.status === 'running')
+      && (!filters.suspended_only || ['suspended', 'parent_suspended'].includes(a.status))),
+  };
+}
+
+/** A command and all of its corrections commit together, or not at all. */
+export function executeCommand(store, userId, command, attrs, headerAgent = null) {
+  if (!COMMANDS.includes(command) || !attrs || typeof attrs !== 'object' || Array.isArray(attrs)) {
+    invalid('command and arguments are required');
+  }
+  const traceId = positiveId(attrs.trace_id, 'trace_id');
+  const trace = store.getTrace(userId, traceId);
+  if (!trace) notFound();
+  const before = commandState(trace);
+  const byId = new Map(before.activities.map(a => [a.id, a]));
+  const timestamp = attrs.timestamp ?? Date.now();
+  if (!Number.isSafeInteger(timestamp) || !Number.isFinite(new Date(timestamp).getTime())) invalid('timestamp must be milliseconds since epoch');
+  const threadId = optionalId(attrs.thread_id, 'thread_id');
+  // Starts resolve the parent's lane even if a different lane was requested.
+  if (command === 'status' && threadId && !trace.threads.some(t => t.id === threadId)) notFound();
+  const filters = { thread_id: threadId,
+    active_only: bool(attrs.active_only, 'active_only'),
+    suspended_only: bool(attrs.suspended_only, 'suspended_only'),
+    include_unstarted: bool(attrs.include_unstarted, 'include_unstarted') };
+  if (filters.active_only && filters.suspended_only) invalid('active_only and suspended_only cannot both be true');
+  const result = { direction: null, reply: null, actions_applied: [], rules_fired: [], closed_descendants: [] };
+  if (command === 'status') {
+    const state = commandState(trace, filters);
+    if (filters.include_unstarted && !filters.active_only && !filters.suspended_only) {
+      for (const row of store.listUnstarted(traceId)) {
+        if (filters.thread_id && row.thread_id !== filters.thread_id) continue;
+        state.activities.push({
+          id: row.id, name: row.name, threadId: row.thread_id,
+          threadName: trace.threads.find(t => t.id === row.thread_id)?.name ?? null,
+          parentId: row.parent_id, agentId: row.agent_id, path: [row.name],
+          categoryIds: [], startedAt: null, latestEvent: null, status: 'unstarted',
+          scheduledStart: row.scheduled_start_ms, scheduledEnd: row.scheduled_end_ms,
+          availableActions: [{ operation: 'start', arguments: { trace_id: trace.id, activity_id: row.id, name: row.name } }],
+        });
+      }
+    }
+    return { ...result, state };
+  }
+  if (command === 'plan') {
+    const name = requiredText(attrs.name, 'name');
+    if (name.length > 255) invalid('name must be at most 255 characters');
+    const startAt = attrs.scheduled_start ?? null;
+    const endAt = attrs.scheduled_end ?? null;
+    if (startAt != null && (!Number.isSafeInteger(startAt))) invalid('scheduled_start must be milliseconds');
+    if (endAt != null && (!Number.isSafeInteger(endAt))) invalid('scheduled_end must be milliseconds');
+    if (startAt != null && endAt != null && endAt < startAt) invalid('scheduled_end must be at or after scheduled_start');
+    const created = store.createUnstarted(userId, {
+      traceId, name, description: attrs.description, weight: attrs.weight,
+      scheduledStart: startAt, scheduledEnd: endAt,
+      agent: headerAgent ?? (attrs.agent_id ? { agent_id: attrs.agent_id, name: attrs.agent_name } : null),
+    });
+    if (created.error) notFound();
+    result.activity_id = created.activity.id;
+    return { ...result, state: commandState(store.getTrace(userId, traceId), filters) };
+  }
+  if (command === 'message') {
+    requiredText(attrs.message, 'message');
+    if (attrs.activity_id != null && !byId.has(positiveId(attrs.activity_id, 'activity_id'))) notFound();
+    throw new CommandError(503, 'REDUCER_NOT_CONFIGURED',
+      'Model review is unavailable in the self-contained runtime. Lifecycle commands remain available; no content was sent to a provider.');
+  }
+  if (attrs.message != null && typeof attrs.message !== 'string') invalid('message must be a string');
+  if (attrs.description != null && typeof attrs.description !== 'string') invalid('description must be a string');
+  const force = bool(attrs.force, 'force');
+  const agentId = headerAgent?.agent_id ?? attrs.agent_id;
+  if (agentId != null && (typeof agentId !== 'string' || !agentId.trim() || agentId.length > 200)) invalid('agent_id is invalid');
+
+  const ancestors = activity => {
+    const chain = [];
+    const seen = new Set();
+    while (activity && !seen.has(activity.id)) {
+      seen.add(activity.id);
+      chain.unshift(activity);
+      activity = byId.get(activity.parentId);
+    }
+    return chain;
+  };
+  const record = (id, phase, message) => {
+    const event = store.createEvent(userId, { traceId, activityId: id,
+      event: { phase, message, timestamp_integer: timestamp } });
+    if (event.error) notFound();
+    return event;
+  };
+  const annotate = (id, rule, applied) => {
+    result.rules_fired.push({ rule, applied });
+    record(id, 'reducer_decision', `rule=${rule} | applied=${JSON.stringify(applied)}`);
+  };
+
+  store.db.exec('BEGIN IMMEDIATE');
+  try {
+    const agent = headerAgent ?? (agentId ? store.identifyAgent(userId, agentId, attrs.agent_name, attrs.agent_platform) : null);
+    if (command === 'start') {
+      const name = requiredText(attrs.name, 'name');
+      if (name.length > 255) invalid('name must be at most 255 characters');
+      const categories = attrs.category_ids ?? [];
+      if (!Array.isArray(categories)) invalid('category_ids must be an array');
+      const categoryIds = [...new Set(categories.map(id => positiveId(id, 'category_id')))];
+      const explicitParent = Object.hasOwn(attrs, 'parent_id');
+      const requestedParent = optionalId(attrs.parent_id, 'parent_id');
+      if (requestedParent && !byId.has(requestedParent)) notFound();
+      const unstartedRows = store.listUnstarted(traceId);
+      const beginId = optionalId(attrs.activity_id, 'activity_id');
+      const namedLimbo = agentId && unstartedRows.find(row => row.proposed_by_agent_id === agentId
+        && row.name === name && row.scheduled_start_ms == null && row.scheduled_end_ms == null);
+      const explicit = beginId && unstartedRows.find(row => row.id === beginId);
+      if (beginId && !explicit) notFound();
+      const toBegin = explicit || namedLimbo;
+      if (toBegin) {
+        if (toBegin.parent_id) {
+          const parent = unstartedRows.find(row => row.id === toBegin.parent_id);
+          if (parent) invalid('parent is unstarted');
+        }
+        if (agentId) {
+          store.db.prepare('UPDATE activities SET agent_id = ?, agent_name = ? WHERE id = ?')
+            .run(agentId, headerAgent?.name ?? attrs.agent_name ?? agentId, toBegin.id);
+        }
+        const event = record(toBegin.id, 'B', 'Begun by reducer: a start matched this activity in limbo');
+        result.activity_id = toBegin.id;
+        result.event_id = event.id;
+        const action = { type: 'begin_existing', activity_id: toBegin.id };
+        result.actions_applied.push(action);
+        annotate(toBegin.id, 'begin_limbo', action);
+      } else {
+      const duplicate = agentId && [...before.activities].reverse().find(a => a.agentId === agentId
+        && a.name === name && !ENDED.has(a.latestEvent.phase));
+      if (duplicate) {
+        result.activity_id = duplicate.id;
+        const type = duplicate.latestEvent.phase === 'S' ? 'resume_existing' : 'no_op';
+        result.event_id = type === 'resume_existing'
+          ? record(duplicate.id, 'R', 'Resumed by reducer: duplicate start').id : duplicate.latestEvent.id;
+        const action = { type, activity_id: duplicate.id };
+        result.actions_applied.push(action);
+        annotate(duplicate.id, 'duplicate_open', action);
+      } else {
+        const parent = explicitParent ? byId.get(requestedParent) : [...before.activities].reverse()
+          .find(a => a.status === 'running' && (agentId ? a.agentId === agentId : a.threadId === (threadId ?? trace.threads[0]?.id)));
+        for (const ancestor of ancestors(parent)) {
+          if (ancestor.latestEvent.phase !== 'S') continue;
+          record(ancestor.id, 'R', 'Resumed by reducer: child started under suspended work');
+          result.actions_applied.push({ type: 'resume_ancestor', activity_id: ancestor.id });
+        }
+        const created = store.createActivity(userId, {
+          traceId, threadId, agent, reduce: true,
+          activity: { name, description: attrs.description, categories: categoryIds,
+            parent_id: parent?.id ?? null },
+          event: { phase: 'B', timestamp_integer: timestamp },
+        });
+        if (created.error) notFound();
+        result.activity_id = created.activity.id;
+        result.event_id = created.event.id;
+        result.reducer = { ...created.reducer,
+          parent_source: parent ? explicitParent ? 'explicit' : 'inferred' : 'root' };
+        if (result.actions_applied.length) annotate(result.activity_id, 'resume_ancestor',
+          result.actions_applied.map(a => a.activity_id));
+        if (!parent && agentId && before.activities.some(a => a.agentId === agentId && a.status === 'running')) {
+          annotate(result.activity_id, 'new_root_while_open', { type: 'skipped', reason: 'model_unavailable' });
+        } else if (parent) {
+          const ancestorTokens = new Set(ancestors(parent).flatMap(a => tokens(a.name)));
+          const childTokens = tokens(name);
+          if (childTokens.length && childTokens.every(t => !ancestorTokens.has(t))) {
+            annotate(result.activity_id, 'name_unfit', { type: 'skipped', reason: 'model_unavailable' });
+          }
+        }
+      }
+      }
+    } else {
+      const id = positiveId(attrs.activity_id, 'activity_id');
+      const activity = byId.get(id);
+      if (!activity) notFound();
+      const phase = command === 'end' ? attrs.phase ?? (attrs.message ? 'V' : 'E') : command === 'resume' ? 'R' : 'S';
+      if (command === 'end' && !ENDED.has(phase)) invalid('end phase must be E, J, or V');
+      const descendants = before.activities.filter(a => a.id !== id && RUNNING.has(a.latestEvent.phase)
+        && ancestors(a).some(p => p.id === id)).sort((a, b) => b.path.length - a.path.length || b.id - a.id);
+      if (command === 'end' && descendants.length && !force) {
+        throw new CommandError(409, 'OPEN_CHILDREN', 'End descendants first or use force: true', {
+          open_children: descendants.map(a => ({ activity_id: a.id, activity_name: a.name })),
+        });
+      }
+      if (command === 'end') {
+        for (const child of descendants) {
+          const event = record(child.id, 'E', `Ended by reducer: parent activity ${id} (${activity.name}) ended`);
+          result.closed_descendants.push({ activity_id: child.id, activity_name: child.name, event_id: event.id });
+        }
+        if (!descendants.length && activity.parentId != null) result.rules_fired.push({
+          rule: 'pop_to_parent', applied: { activity_id: activity.parentId, name: byId.get(activity.parentId)?.name },
+        });
+      }
+      result.activity_id = id;
+      result.event_id = record(id, phase, attrs.message).id;
+    }
+    result.state = commandState(store.getTrace(userId, traceId));
+    store.db.exec('COMMIT');
+    return result;
+  } catch (error) {
+    store.db.exec('ROLLBACK');
+    throw error;
+  }
+}

package/src/local/http.mjs

@@ -1,5 +1,6 @@
 import { createReadStream, existsSync, statSync } from 'node:fs';
 import { extname, join, normalize, resolve } from 'node:path';
+import { COMMANDS, CommandError, executeCommand } from './commands.mjs';
 
 function sendJson(res, status, body) {
   const payload = JSON.stringify(body);
@@ -10,8 +11,8 @@ function sendJson(res, status, body) {
   res.end(payload);
 }
 
-function sendEmpty(res, status) {
-  res.writeHead(status);
+function sendEmpty(res, status, headers = {}) {
+  res.writeHead(status, headers);
   res.end();
 }
 
@@ -88,12 +89,32 @@ function headerBag() {
   };
 }
 
-async function dispatch(store, req, url, body) {
-  const method = req.method ?? 'GET';
-  const path = url.pathname;
-  const auth = authenticate(store, req);
+// Same contract as FlambeNextWeb.Plugs.AgentIdentity (ADR-012).
+function identifyAgent(store, req, auth) {
+  if (!auth) return null;
   const agentId = req.headers['x-flambe-agent-id'];
   const agentName = req.headers['x-flambe-agent-name'];
+  const agentPlatform = req.headers['x-flambe-agent-platform'];
+  if (typeof agentId !== 'string') return null;
+  return store.identifyAgent(
+    auth.user.id,
+    agentId,
+    typeof agentName === 'string' ? agentName : undefined,
+    typeof agentPlatform === 'string' ? agentPlatform : undefined,
+  );
+}
+
+function agentHeaders(agent) {
+  if (!agent) return {};
+  return {
+    'x-flambe-agent-name': agent.name,
+    ...(agent.assigned ? { 'x-flambe-agent-name-assigned': 'true' } : {}),
+  };
+}
+
+async function dispatch(store, req, url, body, { auth, agent }) {
+  const method = req.method ?? 'GET';
+  const path = url.pathname;
 
   if (method === 'GET' && path === '/api/health') {
     return { status: 200, json: { status: 'ok' } };
@@ -123,6 +144,22 @@ async function dispatch(store, req, url, body) {
 
   const userId = auth?.user?.id;
 
+  if (path === '/api/agent-commands') {
+    if (method === 'GET') return { status: 200, json: { data: {
+      version: 1, commands: COMMANDS, runtime_mode: 'local_self_contained', model_review: false,
+    } } };
+    if (method === 'POST') return { status: 200, json: {
+      data: executeCommand(store, userId, body.command, body.arguments, agent),
+    } };
+  }
+
+  if (method === 'GET' && path === '/api/agents/me') {
+    if (!agent) {
+      return { status: 400, json: { error: 'AGENT_ID_REQUIRED', detail: 'Send x-flambe-agent-id with a bearer token' } };
+    }
+    return { status: 200, json: { data: { agent_id: agent.agent_id, name: agent.name, platform: agent.platform ?? null, name_assigned: agent.assigned } } };
+  }
+
   if (method === 'GET' && path === '/api/export') {
     return { status: 200, json: store.exportBundle() };
   }
@@ -220,14 +257,29 @@ async function dispatch(store, req, url, body) {
   }
 
   if (method === 'POST' && path === '/api/activities') {
+    if (auth.tokenName !== null) {
+      const activity = body.activity ?? {};
+      const folded = executeCommand(store, userId, 'start', {
+        trace_id: body.trace_id, thread_id: body.thread_id, name: activity.name,
+        description: activity.description, category_ids: activity.categories,
+        ...(Object.hasOwn(activity, 'parent_id') ? { parent_id: activity.parent_id } : {}),
+        timestamp: body.event?.timestamp_integer,
+      }, agent);
+      return { status: 201, json: { data: {
+        activity: store.getActivity(userId, folded.activity_id),
+        event: { id: folded.event_id,
+          phase: folded.state.activities.find(a => a.id === folded.activity_id)?.latestEvent.phase },
+        reducer: folded.reducer ?? { actions_applied: folded.actions_applied },
+        direction: folded.direction, reply: folded.reply, rules_fired: folded.rules_fired,
+        actions_applied: folded.actions_applied,
+      } } };
+    }
     const result = store.createActivity(userId, {
       traceId: body.trace_id,
       threadId: body.thread_id,
       activity: body.activity ?? {},
       event: body.event ?? {},
-      agentId: typeof agentId === 'string' ? agentId : undefined,
-      agentName: typeof agentName === 'string' ? agentName : undefined,
-      tokenName: auth.tokenName,
+      agent,
     });
     if (result.error) return { status: 404, json: { error: 'NOT_FOUND' } };
     return { status: 201, json: { data: result } };
@@ -242,7 +294,14 @@ async function dispatch(store, req, url, body) {
       return { status: 200, json: { data: activity } };
     }
     if (method === 'PUT') {
-      const activity = store.updateActivity(userId, id, body.activity ?? {});
+      let attrs = body.activity ?? {};
+      // Same rule as Phoenix: bearer tokens cannot reassign identity; a session can.
+      if (auth.tokenName !== null) {
+        attrs = Object.fromEntries(
+          Object.entries(attrs).filter(([key]) => key !== 'agent_id' && key !== 'agent_name'),
+        );
+      }
+      const activity = store.updateActivity(userId, id, attrs);
       if (activity?.error === 'not_found' || !activity) return { status: 404, json: { error: 'NOT_FOUND' } };
       return { status: 200, json: { data: activity } };
     }
@@ -253,6 +312,21 @@ async function dispatch(store, req, url, body) {
   }
 
   if (method === 'POST' && path === '/api/events') {
+    const phase = body.event?.phase;
+    const command = { E: 'end', J: 'end', V: 'end', S: 'suspend', R: 'resume' }[phase];
+    if (auth.tokenName !== null && command) {
+      const folded = executeCommand(store, userId, command, {
+        trace_id: body.trace_id, activity_id: body.activity_id,
+        timestamp: body.event?.timestamp_integer, message: body.event?.message,
+        phase, force: body.force ?? true,
+      }, agent);
+      return { status: 201, json: { data: {
+        id: folded.event_id, phase,
+        reducer: { closed_descendants: folded.closed_descendants,
+          rules_fired: folded.rules_fired, actions_applied: folded.actions_applied,
+          direction: folded.direction, reply: folded.reply },
+      } } };
+    }
     const result = store.createEvent(userId, {
       traceId: body.trace_id,
       activityId: body.activity_id,
@@ -282,10 +356,6 @@ async function dispatch(store, req, url, body) {
     return { status: 200, json: { data: store.userDashboard(userId) } };
   }
 
-  if (method === 'POST' && path === '/api/todos') {
-    return { status: 201, json: { data: store.createTodo(userId, body.todo ?? {}) } };
-  }
-
   if (method === 'POST' && path === '/api/mantras') {
     return { status: 201, json: { data: store.createMantra(userId, body.mantra ?? {}) } };
   }
@@ -327,7 +397,8 @@ function isoNow() {
 function tryStatic(staticDir, urlPath, res) {
   if (!staticDir) return false;
   const root = resolve(staticDir);
-  const indexPath = join(root, 'assets', 'index.html');
+  const rootIndex = join(root, 'index.html');
+  const indexPath = existsSync(rootIndex) ? rootIndex : join(root, 'assets', 'index.html');
   const requested = urlPath === '/' || !urlPath.includes('.')
     ? indexPath
     : join(root, urlPath.replace(/^\//, ''));
@@ -349,6 +420,21 @@ function tryStatic(staticDir, urlPath, res) {
 export async function handleLocalRequest(store, req, res, { staticDir } = {}) {
   const host = req.headers.host ?? '127.0.0.1';
   const url = new URL(req.url ?? '/', `http://${host}`);
+  // A locally served UI must not send trace content to a compiled-in remote API.
+  res.setHeader('content-security-policy', "connect-src 'self'; form-action 'self'; frame-ancestors 'none'");
+  if (!['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname)) {
+    sendJson(res, 403, { error: 'LOCAL_HOST_REQUIRED' });
+    return;
+  }
+  if (req.headers.origin) {
+    let origin;
+    try { origin = new URL(req.headers.origin); } catch { /* rejected below */ }
+    if (!origin || !['http:', 'https:'].includes(origin.protocol)
+      || !['127.0.0.1', 'localhost', '[::1]'].includes(origin.hostname)) {
+      sendJson(res, 403, { error: 'LOCAL_ORIGIN_REQUIRED' });
+      return;
+    }
+  }
 
   if (!url.pathname.startsWith('/api') && !url.pathname.startsWith('/auth')) {
     if (tryStatic(staticDir, url.pathname, res)) return;
@@ -356,8 +442,9 @@ export async function handleLocalRequest(store, req, res, { staticDir } = {}) {
     const html = `<!doctype html><meta charset="utf-8"><title>Flambe local</title>
 <body style="font-family:sans-serif;max-width:40rem;margin:3rem auto;line-height:1.4">
 <h1>Flambe local</h1>
-<p>CLI API is running. Build the frontend (<code>cd frontend &amp;&amp; npm run build</code>) and restart with <code>--static</code> pointing at <code>backend/priv/static</code> to open the chart here. Vite can also proxy to this port.</p>
+<p>CLI API is running. From the repository root, run <code>npm --prefix frontend run build:local</code>, then restart <code>flambe serve</code> to open the local chart here.</p>
 <pre>FLAMBE_URL=http://${host}
+FLAMBE_RUNTIME_MODE=local_self_contained
 FLAMBE_API_TOKEN=${rawToken}
 FLAMBE_TRACE_ID=${traceId}</pre>
 </body>`;
@@ -374,15 +461,24 @@ FLAMBE_TRACE_ID=${traceId}</pre>
     return;
   }
 
-  const result = await dispatch(store, req, url, body);
+  const auth = authenticate(store, req);
+  const agent = identifyAgent(store, req, auth);
+  let result;
+  try {
+    result = await dispatch(store, req, url, body, { auth, agent });
+  } catch (error) {
+    if (!(error instanceof CommandError)) throw error;
+    result = { status: error.status, json: error.body };
+  }
+  const identity = agentHeaders(agent);
   if (result.status === 204) {
-    if (result.headers) result.headers.apply(res, 204);
-    else sendEmpty(res, 204);
+    if (result.headers) result.headers.apply(res, 204, identity);
+    else sendEmpty(res, 204, identity);
     return;
   }
 
   const payload = JSON.stringify(result.json);
-  const extra = { 'content-type': 'application/json; charset=utf-8', 'content-length': Buffer.byteLength(payload) };
+  const extra = { 'content-type': 'application/json; charset=utf-8', 'content-length': Buffer.byteLength(payload), ...identity };
   if (result.headers) result.headers.apply(res, result.status, extra);
   else res.writeHead(result.status, extra);
   res.end(payload);

package/src/local/serve.mjs

@@ -12,7 +12,7 @@ export function defaultDbPath() {
 }
 
 export function defaultStaticDir() {
-  return resolve(fileURLToPath(new URL('../../../../backend/priv/static', import.meta.url)));
+  return resolve(fileURLToPath(new URL('../../../backend/priv/static', import.meta.url)));
 }
 
 export function createLocalServer({ dbPath = defaultDbPath(), staticDir } = {}) {
@@ -56,6 +56,7 @@ export function printServeBanner({ host, port, store }, stdout = process.stdout)
   const origin = `http://${host}:${port}`;
   stdout.write(`Flambe local on ${origin} (SQLite, loopback only)\n`);
   stdout.write(`FLAMBE_URL=${origin}\n`);
+  stdout.write('FLAMBE_RUNTIME_MODE=local_self_contained\n');
   stdout.write(`FLAMBE_API_TOKEN=${rawToken}\n`);
   stdout.write(`FLAMBE_TRACE_ID=${traceId}\n`);
 }