@edwardlee5423/magi 0.1.0-alpha.0

package/dist/control/server.js

@@ -0,0 +1,887 @@
+import http from "node:http";
+import { randomUUID } from "node:crypto";
+import { runHeadlessPrompt } from "../headless.js";
+import { createPairingToken, validateDeviceToken } from "./auth.js";
+import { advertiseMdns, getLocalHostname } from "./mdns.js";
+import { ActiveInteractionCancelledError, ActiveInteractionNotFoundError, ActiveInteractionRegistry, ActiveInteractionStateError } from "../interactions.js";
+import { cancelAgentTask, completeAgentTask, spawnAgentTask, startAgentTask, waitAgentTask } from "../agents/task-queue.js";
+import { listLocalPlugins } from "../plugins/manifest.js";
+import { discoverLocalMarketplaceSources, loadMarketplace } from "../plugins/marketplace.js";
+import { listSkills } from "../skills/loader.js";
+import { openApiDocument, renderPanelClient, renderWebPanel } from "../web/panel.js";
+import { triggerHooks } from "../hooks/events.js";
+import { cronStorePathFromRoot, takeDueCronJobs } from "../tools/cron.js";
+import { toEventView } from "../events.js";
+import { normalizeAskUserQuestionAnswer } from "../tools/user-question.js";
+export async function startControlServer(input) {
+    const interactions = new ActiveInteractionRegistry({
+        timeoutMs: parseInteractionTimeoutMs(input.env?.MAGI_INTERACTION_TIMEOUT_MS)
+    });
+    const runningJobs = new Map();
+    const server = http.createServer((request, response) => {
+        void handleRequest({ ...input, interactions, runningJobs, request, response });
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", (err) => {
+            if (err.code === "EADDRINUSE") {
+                reject(new Error([
+                    `Cannot start control server: port ${input.runtime.controlPort} is already in use on ${input.runtime.controlBind}.`,
+                    ``,
+                    `Common fixes:`,
+                    `  - 'magi daemon status' — see if Magi is already running`,
+                    `  - 'lsof -i :${input.runtime.controlPort}' — find what's using the port`,
+                    `  - 'MAGI_CONTROL_PORT=8780 magi serve' — pick a different port`
+                ].join("\n")));
+                return;
+            }
+            if (err.code === "EACCES") {
+                reject(new Error(`Cannot bind to ${input.runtime.controlBind}:${input.runtime.controlPort} — permission denied. Pick a port above 1024 or run with elevated privileges.`));
+                return;
+            }
+            reject(err);
+        });
+        server.listen(input.runtime.controlPort, input.runtime.controlBind, () => resolve());
+    });
+    const address = server.address();
+    const cronRunner = startCronRunner(input);
+    // Advertise this daemon via mDNS so phones and other Magi instances can discover it.
+    let mdnsHandle;
+    if (input.env?.MAGI_DISABLE_MDNS !== "1") {
+        try {
+            const hostname = getLocalHostname();
+            const instanceName = `magi-${address.port}-${process.pid}`;
+            mdnsHandle = advertiseMdns({
+                hostname,
+                instanceName,
+                port: address.port,
+                txt: {
+                    version: "0.1.0-alpha.0",
+                    cwd: input.cwd,
+                    bind: input.runtime.controlBind
+                }
+            });
+            if (input.env?.MAGI_DEBUG_MDNS === "1") {
+                process.stdout.write(`[mdns] Advertising ${instanceName} on _magi._tcp.local. (port ${address.port})\n`);
+            }
+        }
+        catch (error) {
+            if (input.env?.MAGI_DEBUG_MDNS === "1") {
+                process.stdout.write(`[mdns] Failed to advertise: ${error instanceof Error ? error.message : String(error)}\n`);
+            }
+        }
+    }
+    return {
+        server,
+        url: `http://${input.runtime.controlBind}:${address.port}`,
+        interactions,
+        close: async () => {
+            mdnsHandle?.stop();
+            cronRunner.close();
+            for (const running of runningJobs.values()) {
+                running.controller.abort("control server closing");
+            }
+            await Promise.allSettled([...runningJobs.values()].map((running) => running.promise));
+            interactions.close();
+            await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
+        }
+    };
+}
+export function runDueCronJobs(input) {
+    const due = takeDueCronJobs(cronStorePathFromRoot(input.paths.stateRoot), input.now ?? new Date());
+    return Promise.all(due.map(async ({ job, prompt }) => {
+        const result = await runHeadlessPrompt({
+            prompt,
+            cwd: input.cwd,
+            store: input.store,
+            config: input.config,
+            env: input.env,
+            paths: input.paths,
+            stateRoot: input.paths.stateRoot,
+            modelAlias: "main",
+            sessionName: `cron ${job.id}`
+        });
+        input.store.recordAudit({
+            sessionId: result.sessionId,
+            jobId: result.jobId,
+            action: "cron.job.executed",
+            target: job.id,
+            metadata: {
+                cron: job.cron,
+                prompt,
+                recurring: job.recurring,
+                nextRunAt: job.nextRunAt
+            }
+        });
+        return { cronJob: job, result };
+    }));
+}
+function startCronRunner(input) {
+    const intervalMs = parseCronIntervalMs(input.env?.MAGI_CRON_POLL_MS);
+    let running = false;
+    const tick = async () => {
+        if (running) {
+            return;
+        }
+        running = true;
+        try {
+            await runDueCronJobs(input);
+        }
+        catch (error) {
+            const sessionId = input.store.createSession({
+                title: "cron runner error",
+                cwd: input.cwd,
+                metadata: { source: "cron-runner" }
+            });
+            input.store.recordAudit({
+                sessionId,
+                action: "cron.runner.failed",
+                metadata: { error: error instanceof Error ? error.message : String(error) }
+            });
+        }
+        finally {
+            running = false;
+        }
+    };
+    const timer = setInterval(() => {
+        void tick();
+    }, intervalMs);
+    timer.unref?.();
+    void tick();
+    return {
+        close: () => clearInterval(timer)
+    };
+}
+function parseCronIntervalMs(raw) {
+    if (!raw) {
+        return 60_000;
+    }
+    if (!/^\d+$/.test(raw)) {
+        throw new Error(`MAGI_CRON_POLL_MS must be an integer >= 1000, got ${JSON.stringify(raw)}`);
+    }
+    const interval = Number(raw);
+    if (!Number.isInteger(interval) || interval < 1000) {
+        throw new Error(`MAGI_CRON_POLL_MS must be an integer >= 1000, got ${JSON.stringify(raw)}`);
+    }
+    return interval;
+}
+function parseInteractionTimeoutMs(raw) {
+    if (!raw) {
+        return undefined;
+    }
+    if (!/^\d+$/.test(raw)) {
+        throw new Error(`MAGI_INTERACTION_TIMEOUT_MS must be an integer >= 1, got ${JSON.stringify(raw)}`);
+    }
+    const timeout = Number(raw);
+    if (!Number.isInteger(timeout) || timeout < 1) {
+        throw new Error(`MAGI_INTERACTION_TIMEOUT_MS must be an integer >= 1, got ${JSON.stringify(raw)}`);
+    }
+    return timeout;
+}
+async function handleRequest(input) {
+    try {
+        const url = new URL(input.request.url ?? "/", `http://${input.request.headers.host ?? "127.0.0.1"}`);
+        if (input.request.method === "GET" && url.pathname === "/health") {
+            return sendJson(input.response, 200, {
+                ok: true,
+                root: input.paths.root,
+                control: { bind: input.runtime.controlBind, port: input.runtime.controlPort }
+            });
+        }
+        if (input.request.method === "GET" && url.pathname === "/panel") {
+            return sendText(input.response, 200, "text/html; charset=utf-8", renderWebPanel());
+        }
+        if (input.request.method === "GET" && url.pathname === "/panel-client.js") {
+            return sendText(input.response, 200, "text/javascript; charset=utf-8", renderPanelClient());
+        }
+        if (input.request.method === "GET" && url.pathname === "/openapi.json") {
+            return sendJson(input.response, 200, openApiDocument());
+        }
+        if (input.request.method === "POST" && url.pathname === "/pairing") {
+            // Pairing endpoint: only allow from loopback OR with an existing valid device token.
+            // This prevents an attacker on the network from minting tokens for themselves.
+            if (!isLoopbackRequest(input.request) && !isAuthorized(input.request, input.store)) {
+                return sendJson(input.response, 403, {
+                    error: "forbidden",
+                    message: "Pairing must be initiated from the local machine. Run 'magi pair' on the daemon host."
+                });
+            }
+            const body = await readJson(input.request);
+            const token = createPairingToken({
+                store: input.store,
+                deviceName: typeof body.name === "string" ? body.name : "unnamed device"
+            });
+            input.store.recordAudit({
+                sessionId: input.store.createSession({ title: "control pairing", cwd: input.cwd, metadata: { command: "pairing" } }),
+                action: "control.pairing.created",
+                target: token.deviceId,
+                metadata: { expiresAt: token.expiresAt }
+            });
+            return sendJson(input.response, 200, token);
+        }
+        if (!isAuthorized(input.request, input.store)) {
+            return sendJson(input.response, 401, { error: "unauthorized" });
+        }
+        if (input.request.method === "GET" && url.pathname === "/sessions") {
+            return sendJson(input.response, 200, { sessions: input.store.listSessions(50) });
+        }
+        if (input.request.method === "POST" && url.pathname === "/sessions") {
+            const body = await readJson(input.request);
+            const sessionId = input.store.createSession({
+                id: readOptionalString(body.id),
+                title: readOptionalString(body.title),
+                cwd: readOptionalString(body.cwd) ?? input.cwd,
+                metadata: readOptionalRecord(body.metadata)
+            });
+            return sendJson(input.response, 200, { session: input.store.getSession(sessionId) });
+        }
+        const sessionEventsRoute = /^\/sessions\/([^/]+)\/events$/.exec(url.pathname);
+        if (sessionEventsRoute && input.request.method === "GET") {
+            const sessionId = decodeURIComponent(sessionEventsRoute[1]);
+            const session = input.store.getSession(sessionId);
+            if (!session) {
+                return sendJson(input.response, 404, { error: "session not found" });
+            }
+            const limit = readLimit(url.searchParams.get("limit"), 100);
+            return sendJson(input.response, 200, {
+                events: input.store.listSessionAuditEvents(sessionId, limit).map(toEventView)
+            });
+        }
+        const sessionRoute = /^\/sessions\/([^/]+)(?:\/messages)?$/.exec(url.pathname);
+        if (sessionRoute) {
+            const sessionId = decodeURIComponent(sessionRoute[1]);
+            const isMessagesRoute = url.pathname.endsWith("/messages");
+            const session = input.store.getSession(sessionId);
+            if (!session) {
+                return sendJson(input.response, 404, { error: "session not found" });
+            }
+            if (input.request.method === "GET" && !isMessagesRoute) {
+                return sendJson(input.response, 200, { session });
+            }
+            if (input.request.method === "POST" && isMessagesRoute) {
+                const body = await readJson(input.request);
+                if (typeof body.prompt !== "string" || !body.prompt.trim()) {
+                    return sendJson(input.response, 400, { error: "prompt is required" });
+                }
+                const result = await runControlJob(input, body, { sessionId, cwd: session.cwd });
+                return sendJson(input.response, 200, result);
+            }
+        }
+        if (input.request.method === "GET" && url.pathname === "/jobs") {
+            return sendJson(input.response, 200, { jobs: input.store.listJobs(50) });
+        }
+        const jobEventsRoute = /^\/jobs\/([^/]+)\/events$/.exec(url.pathname);
+        if (jobEventsRoute && input.request.method === "GET") {
+            const jobId = decodeURIComponent(jobEventsRoute[1]);
+            const job = input.store.getJob(jobId);
+            if (!job) {
+                return sendJson(input.response, 404, { error: "job not found" });
+            }
+            const limit = readLimit(url.searchParams.get("limit"), 100);
+            return sendJson(input.response, 200, {
+                events: input.store.listJobAuditEvents(jobId, limit).map(toEventView)
+            });
+        }
+        const jobApprovalRoute = /^\/jobs\/([^/]+)\/approvals\/([^/]+)$/.exec(url.pathname);
+        if (jobApprovalRoute && input.request.method === "POST") {
+            const jobId = decodeURIComponent(jobApprovalRoute[1]);
+            const toolUseId = decodeURIComponent(jobApprovalRoute[2]);
+            const body = await readJson(input.request);
+            const job = input.store.getJob(jobId);
+            if (!job) {
+                return sendJson(input.response, 404, { error: "job not found" });
+            }
+            const decision = readApprovalDecision(body);
+            if (decision === undefined) {
+                return sendJson(input.response, 400, { error: "decision must be approve, deny, approved, denied, true, or false" });
+            }
+            try {
+                const interaction = input.interactions.resolveApproval({ jobId, toolUseId, approved: decision });
+                input.store.recordAudit({
+                    sessionId: job.sessionId,
+                    jobId,
+                    action: "control.approval.resolved",
+                    target: toolUseId,
+                    metadata: {
+                        status: "resolved",
+                        interactionKind: "approval",
+                        toolUseId,
+                        approved: decision,
+                        responder: readOptionalString(body.responder),
+                        interaction
+                    }
+                });
+                return sendJson(input.response, 200, { ok: true, interaction });
+            }
+            catch (error) {
+                return sendInteractionError(input.response, error);
+            }
+        }
+        const jobQuestionRoute = /^\/jobs\/([^/]+)\/questions\/([^/]+)$/.exec(url.pathname);
+        if (jobQuestionRoute && input.request.method === "POST") {
+            const jobId = decodeURIComponent(jobQuestionRoute[1]);
+            const toolUseId = decodeURIComponent(jobQuestionRoute[2]);
+            const body = await readJson(input.request);
+            const job = input.store.getJob(jobId);
+            if (!job) {
+                return sendJson(input.response, 404, { error: "job not found" });
+            }
+            try {
+                const pending = input.interactions.getPendingQuestion({ jobId, toolUseId });
+                const answer = normalizeControlQuestionAnswer(body, pending.question);
+                const interaction = input.interactions.resolveQuestion({ jobId, toolUseId, answer });
+                input.store.recordAudit({
+                    sessionId: job.sessionId,
+                    jobId,
+                    action: "control.user_question.resolved",
+                    target: toolUseId,
+                    metadata: {
+                        status: "resolved",
+                        interactionKind: "question",
+                        toolUseId,
+                        answer,
+                        responder: readOptionalString(body.responder),
+                        interaction
+                    }
+                });
+                return sendJson(input.response, 200, { ok: true, interaction });
+            }
+            catch (error) {
+                return sendInteractionError(input.response, error);
+            }
+        }
+        const jobInteractionCancelRoute = /^\/jobs\/([^/]+)\/(approvals|questions)\/([^/]+)\/cancel$/.exec(url.pathname);
+        if (jobInteractionCancelRoute && input.request.method === "POST") {
+            const jobId = decodeURIComponent(jobInteractionCancelRoute[1]);
+            const interactionType = jobInteractionCancelRoute[2] === "approvals" ? "approval" : "question";
+            const toolUseId = decodeURIComponent(jobInteractionCancelRoute[3]);
+            const body = await readJson(input.request);
+            const job = input.store.getJob(jobId);
+            if (!job) {
+                return sendJson(input.response, 404, { error: "job not found" });
+            }
+            try {
+                const interaction = input.interactions.cancelInteraction({
+                    jobId,
+                    toolUseId,
+                    reason: readOptionalString(body.reason) ?? "cancelled by control API"
+                });
+                input.store.recordAudit({
+                    sessionId: job.sessionId,
+                    jobId,
+                    action: interactionType === "approval" ? "control.approval.cancelled" : "control.user_question.cancelled",
+                    target: toolUseId,
+                    metadata: {
+                        status: "cancelled",
+                        interactionKind: interactionType,
+                        toolUseId,
+                        reason: interaction.cancelReason,
+                        interaction
+                    }
+                });
+                return sendJson(input.response, 200, { ok: true, interaction });
+            }
+            catch (error) {
+                return sendInteractionError(input.response, error);
+            }
+        }
+        const jobRoute = /^\/jobs\/([^/]+)$/.exec(url.pathname);
+        if (jobRoute && input.request.method === "GET") {
+            const job = input.store.getJob(decodeURIComponent(jobRoute[1]));
+            return job ? sendJson(input.response, 200, { job }) : sendJson(input.response, 404, { error: "job not found" });
+        }
+        const jobCancelRoute = /^\/jobs\/([^/]+)\/cancel$/.exec(url.pathname);
+        if (jobCancelRoute && input.request.method === "POST") {
+            const jobId = decodeURIComponent(jobCancelRoute[1]);
+            const body = await readJson(input.request);
+            const running = input.runningJobs.get(jobId);
+            const reason = readOptionalString(body.reason) ?? "cancelled by control API";
+            if (running) {
+                running.controller.abort(reason);
+                input.store.recordAudit({
+                    sessionId: running.sessionId,
+                    jobId,
+                    action: "control.job.cancel_requested",
+                    target: jobId,
+                    metadata: { reason }
+                });
+                return sendJson(input.response, 200, { ok: true, status: "cancelling", jobId, reason });
+            }
+            const job = input.store.getJob(jobId);
+            if (!job) {
+                return sendJson(input.response, 404, { error: "job not found" });
+            }
+            if (job.status === "running") {
+                input.store.updateJobStatus({
+                    id: jobId,
+                    status: "cancelled",
+                    metadata: { reason, cancelledWithoutActiveRunner: true }
+                });
+                input.store.recordAudit({
+                    sessionId: job.sessionId,
+                    jobId,
+                    action: "control.job.cancelled",
+                    target: jobId,
+                    metadata: { reason, cancelledWithoutActiveRunner: true }
+                });
+                return sendJson(input.response, 200, { ok: true, status: "cancelled", jobId, reason });
+            }
+            return sendJson(input.response, 409, { error: `job is ${job.status}` });
+        }
+        if (input.request.method === "GET" && url.pathname === "/agents") {
+            return sendJson(input.response, 200, { tasks: input.store.listAgentTasks(50) });
+        }
+        if (input.request.method === "GET" && url.pathname === "/providers") {
+            return sendJson(input.response, 200, {
+                providers: Object.entries(input.config.providers).map(([name, provider]) => ({
+                    name,
+                    type: provider.type,
+                    defaultModel: provider.defaultModel,
+                    configured: Boolean(provider.apiKeyEnv ? input.env?.[provider.apiKeyEnv] : true)
+                })),
+                aliases: input.config.models.aliases
+            });
+        }
+        if (input.request.method === "GET" && url.pathname === "/plugins") {
+            return sendJson(input.response, 200, {
+                plugins: listLocalPlugins(input.paths),
+                marketplaces: discoverLocalMarketplaceSources(input.paths).map(loadMarketplace)
+            });
+        }
+        if (input.request.method === "GET" && url.pathname === "/skills") {
+            return sendJson(input.response, 200, { skills: listSkills(input.paths) });
+        }
+        if (input.request.method === "POST" && url.pathname === "/agents") {
+            const body = await readJson(input.request);
+            if (body.role !== "explorer" && body.role !== "worker") {
+                return sendJson(input.response, 400, { error: "role must be explorer or worker" });
+            }
+            if (typeof body.prompt !== "string" || !body.prompt.trim()) {
+                return sendJson(input.response, 400, { error: "prompt is required" });
+            }
+            const writeFiles = Array.isArray(body.writeFiles)
+                ? body.writeFiles.filter((item) => typeof item === "string")
+                : [];
+            const cwd = typeof body.cwd === "string" ? body.cwd : input.cwd;
+            const sessionId = input.store.createSession({ title: `control agent task ${body.role}`, cwd });
+            const task = spawnAgentTask(input.store, {
+                role: body.role,
+                prompt: body.prompt,
+                cwd,
+                sessionId,
+                writeFiles
+            });
+            const hooks = await triggerHooks({
+                event: "task_created",
+                hooks: input.config.hooks,
+                store: input.store,
+                sessionId,
+                cwd,
+                env: input.env,
+                context: {
+                    taskId: task.id,
+                    taskSubject: task.prompt,
+                    taskDescription: task.prompt,
+                    agentId: task.id,
+                    agentType: task.role
+                }
+            });
+            return sendJson(input.response, 200, {
+                task,
+                hooks
+            });
+        }
+        const agentAction = /^\/agents\/([^/]+)\/(start|wait|cancel|complete)$/.exec(url.pathname);
+        if (agentAction && input.request.method === "POST") {
+            const [, taskId, action] = agentAction;
+            const body = await readJson(input.request);
+            if (action === "start") {
+                const task = waitAgentTask(input.store, startAgentTask(input.store, taskId).id);
+                const sessionId = task.sessionId ?? input.store.createSession({ title: "control agent start", cwd: task.cwd });
+                const hooks = await triggerHooks({
+                    event: "subagent_start",
+                    hooks: input.config.hooks,
+                    store: input.store,
+                    sessionId,
+                    cwd: task.cwd,
+                    env: input.env,
+                    context: {
+                        agentId: task.id,
+                        agentType: task.role,
+                        taskId: task.id,
+                        taskSubject: task.prompt
+                    }
+                });
+                return sendJson(input.response, 200, { task, hooks });
+            }
+            if (action === "wait") {
+                return sendJson(input.response, 200, { task: waitAgentTask(input.store, taskId) });
+            }
+            if (action === "cancel") {
+                const task = cancelAgentTask(input.store, taskId);
+                const sessionId = task.sessionId ?? input.store.createSession({ title: "control agent stop", cwd: task.cwd });
+                const hooks = await triggerHooks({
+                    event: "stop",
+                    hooks: input.config.hooks,
+                    store: input.store,
+                    sessionId,
+                    cwd: task.cwd,
+                    env: input.env,
+                    context: {
+                        message: `Agent task ${task.id} cancelled`,
+                        notificationType: "agent_task_cancelled",
+                        lastAssistantMessage: task.result ?? undefined
+                    }
+                });
+                const subagentHooks = await triggerHooks({
+                    event: "subagent_stop",
+                    hooks: input.config.hooks,
+                    store: input.store,
+                    sessionId,
+                    cwd: task.cwd,
+                    env: input.env,
+                    context: {
+                        agentId: task.id,
+                        agentType: task.role,
+                        taskId: task.id,
+                        taskSubject: task.prompt,
+                        message: `Agent task ${task.id} cancelled`,
+                        notificationType: "agent_task_cancelled",
+                        lastAssistantMessage: task.result ?? undefined
+                    }
+                });
+                return sendJson(input.response, 200, { task, hooks: [...hooks, ...subagentHooks] });
+            }
+            const task = completeAgentTask(input.store, taskId, typeof body.result === "string" ? body.result : "");
+            const sessionId = task.sessionId ?? input.store.createSession({ title: "control agent notification", cwd: task.cwd });
+            const hooks = await triggerHooks({
+                event: "notification",
+                hooks: input.config.hooks,
+                store: input.store,
+                sessionId,
+                cwd: task.cwd,
+                env: input.env,
+                context: {
+                    message: `Agent task ${task.id} completed`,
+                    title: "Agent task completed",
+                    notificationType: "agent_task_completed",
+                    lastAssistantMessage: task.result ?? undefined
+                }
+            });
+            const taskHooks = await triggerHooks({
+                event: "task_completed",
+                hooks: input.config.hooks,
+                store: input.store,
+                sessionId,
+                cwd: task.cwd,
+                env: input.env,
+                context: {
+                    taskId: task.id,
+                    taskSubject: task.prompt,
+                    taskDescription: task.prompt,
+                    agentId: task.id,
+                    agentType: task.role,
+                    lastAssistantMessage: task.result ?? undefined
+                }
+            });
+            const subagentHooks = await triggerHooks({
+                event: "subagent_stop",
+                hooks: input.config.hooks,
+                store: input.store,
+                sessionId,
+                cwd: task.cwd,
+                env: input.env,
+                context: {
+                    agentId: task.id,
+                    agentType: task.role,
+                    taskId: task.id,
+                    taskSubject: task.prompt,
+                    lastAssistantMessage: task.result ?? undefined
+                }
+            });
+            return sendJson(input.response, 200, { task, hooks: [...hooks, ...taskHooks, ...subagentHooks] });
+        }
+        if (input.request.method === "GET" && url.pathname === "/audit") {
+            return sendJson(input.response, 200, { audit: input.store.listAuditEvents(100) });
+        }
+        if (input.request.method === "GET" && url.pathname === "/events.json") {
+            const limit = readLimit(url.searchParams.get("limit"), 100);
+            const sessionId = readOptionalString(url.searchParams.get("sessionId") ?? undefined);
+            const jobId = readOptionalString(url.searchParams.get("jobId") ?? undefined);
+            return sendJson(input.response, 200, {
+                events: input.store.listRecentAuditEvents({ sessionId, jobId, limit }).map(toEventView)
+            });
+        }
+        if (input.request.method === "POST" && url.pathname === "/jobs") {
+            const body = await readJson(input.request);
+            if (typeof body.prompt !== "string" || !body.prompt.trim()) {
+                return sendJson(input.response, 400, { error: "prompt is required" });
+            }
+            const sessionId = readOptionalString(body.sessionId);
+            const existingSession = sessionId ? input.store.getSession(sessionId) : undefined;
+            if (sessionId && !existingSession) {
+                return sendJson(input.response, 404, { error: "session not found" });
+            }
+            if (body.background === true || body.async === true) {
+                const result = startBackgroundControlJob(input, body, {
+                    sessionId,
+                    cwd: existingSession?.cwd
+                });
+                return sendJson(input.response, 202, result);
+            }
+            const result = await runControlJob(input, body, {
+                sessionId,
+                cwd: existingSession?.cwd
+            });
+            return sendJson(input.response, 200, result);
+        }
+        const activeInteractionsRoute = /^\/jobs\/([^/]+)\/interactions$/.exec(url.pathname);
+        if (activeInteractionsRoute && input.request.method === "GET") {
+            const jobId = decodeURIComponent(activeInteractionsRoute[1]);
+            const job = input.store.getJob(jobId);
+            if (!job) {
+                return sendJson(input.response, 404, { error: "job not found" });
+            }
+            return sendJson(input.response, 200, {
+                interactions: input.interactions.listInteractions({ jobId })
+            });
+        }
+        if (input.request.method === "POST" && url.pathname === "/approvals") {
+            const body = await readJson(input.request);
+            const sessionId = typeof body.sessionId === "string"
+                ? body.sessionId
+                : input.store.createSession({ title: "control approval", cwd: input.cwd });
+            input.store.recordAudit({
+                sessionId,
+                jobId: typeof body.jobId === "string" ? body.jobId : undefined,
+                action: "control.approval.recorded",
+                target: typeof body.decision === "string" ? body.decision : "unknown",
+                metadata: body
+            });
+            return sendJson(input.response, 200, { ok: true, approvalId: randomUUID() });
+        }
+        if (input.request.method === "GET" && url.pathname === "/events") {
+            streamEvents({
+                request: input.request,
+                response: input.response,
+                store: input.store,
+                limit: readLimit(url.searchParams.get("limit"), 50),
+                afterId: readOptionalId(url.searchParams.get("after")),
+                sessionId: readOptionalString(url.searchParams.get("sessionId") ?? undefined),
+                jobId: readOptionalString(url.searchParams.get("jobId") ?? undefined)
+            });
+            return;
+        }
+        return sendJson(input.response, 404, { error: "not found" });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (!input.response.headersSent) {
+            return sendJson(input.response, 500, { error: message });
+        }
+        input.response.end();
+        return;
+    }
+}
+function streamEvents(input) {
+    input.response.writeHead(200, {
+        "content-type": "text/event-stream",
+        "cache-control": "no-cache, no-transform",
+        connection: "keep-alive",
+        "x-accel-buffering": "no"
+    });
+    input.response.write(`event: ready\ndata: ${JSON.stringify({
+        ok: true,
+        sessionId: input.sessionId,
+        jobId: input.jobId
+    })}\n\n`);
+    const historical = input.store.listRecentAuditEvents({
+        sessionId: input.sessionId,
+        jobId: input.jobId,
+        afterId: input.afterId,
+        limit: input.limit,
+        order: "asc"
+    }).map(toEventView);
+    for (const event of historical) {
+        writeSseEvent(input.response, "audit", event);
+    }
+    const unsubscribe = input.store.subscribeAuditEvents((event) => {
+        if (!matchesEventStreamFilter(event, input)) {
+            return;
+        }
+        writeSseEvent(input.response, "audit", toEventView(event));
+    });
+    const heartbeat = setInterval(() => {
+        input.response.write(`: heartbeat ${new Date().toISOString()}\n\n`);
+    }, 15_000);
+    heartbeat.unref?.();
+    const close = () => {
+        clearInterval(heartbeat);
+        unsubscribe();
+        input.response.end();
+    };
+    input.request.once("close", close);
+}
+function writeSseEvent(response, eventName, event) {
+    response.write(`id: ${event.id}\n`);
+    response.write(`event: ${eventName}\n`);
+    response.write(`data: ${JSON.stringify(event)}\n\n`);
+}
+function matchesEventStreamFilter(event, filter) {
+    if (filter.afterId !== undefined && event.id <= filter.afterId) {
+        return false;
+    }
+    if (filter.sessionId && event.sessionId !== filter.sessionId) {
+        return false;
+    }
+    if (filter.jobId && event.jobId !== filter.jobId) {
+        return false;
+    }
+    return true;
+}
+function runControlJob(input, body, options = {}) {
+    return runHeadlessPrompt({
+        prompt: String(body.prompt),
+        cwd: readOptionalString(body.cwd) ?? options.cwd ?? input.cwd,
+        store: input.store,
+        config: input.config,
+        env: input.env,
+        paths: input.paths,
+        stateRoot: input.paths.stateRoot,
+        modelAlias: readOptionalString(body.model),
+        sessionId: options.sessionId,
+        sessionName: readOptionalString(body.sessionName),
+        persistSession: typeof body.persistSession === "boolean" ? body.persistSession : undefined,
+        collectEvents: body.collectEvents === true,
+        permissionMode: readPermissionMode(body.permissionMode) ?? "default",
+        activeInteractions: input.interactions
+    });
+}
+function startBackgroundControlJob(input, body, options = {}) {
+    const cwd = readOptionalString(body.cwd) ?? options.cwd ?? input.cwd;
+    const prompt = String(body.prompt);
+    const sessionId = options.sessionId ?? input.store.createSession({
+        title: readOptionalString(body.sessionName) ?? prompt.slice(0, 80),
+        cwd,
+        metadata: { mode: "control-background" }
+    });
+    const jobId = randomUUID();
+    const controller = new AbortController();
+    const promise = runHeadlessPrompt({
+        prompt,
+        cwd,
+        store: input.store,
+        config: input.config,
+        env: input.env,
+        paths: input.paths,
+        stateRoot: input.paths.stateRoot,
+        modelAlias: readOptionalString(body.model),
+        jobId,
+        sessionId,
+        sessionName: readOptionalString(body.sessionName),
+        persistSession: true,
+        collectEvents: body.collectEvents === true,
+        permissionMode: readPermissionMode(body.permissionMode) ?? "default",
+        activeInteractions: input.interactions,
+        signal: controller.signal
+    }).finally(() => {
+        input.runningJobs.delete(jobId);
+    });
+    input.runningJobs.set(jobId, { jobId, sessionId, controller, promise });
+    promise.catch(() => undefined);
+    return { sessionId, jobId, status: "running" };
+}
+function isAuthorized(request, store) {
+    const deviceId = headerValue(request.headers["x-magi-device-id"]);
+    const token = headerValue(request.headers.authorization)?.replace(/^Bearer\s+/i, "");
+    return validateDeviceToken({ store, deviceId, token });
+}
+function isLoopbackRequest(request) {
+    const addr = request.socket.remoteAddress ?? "";
+    return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+}
+async function readJson(request) {
+    const chunks = [];
+    for await (const chunk of request) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    const text = Buffer.concat(chunks).toString("utf8").trim();
+    if (!text) {
+        return {};
+    }
+    const parsed = JSON.parse(text);
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
+}
+function sendJson(response, status, body) {
+    response.writeHead(status, { "content-type": "application/json" });
+    response.end(`${JSON.stringify(body)}\n`);
+}
+function sendText(response, status, contentType, body) {
+    response.writeHead(status, { "content-type": contentType });
+    response.end(body);
+}
+function sendInteractionError(response, error) {
+    if (error instanceof ActiveInteractionNotFoundError) {
+        return sendJson(response, 404, { error: error.message });
+    }
+    if (error instanceof ActiveInteractionStateError || error instanceof ActiveInteractionCancelledError) {
+        return sendJson(response, 409, { error: error.message });
+    }
+    return sendJson(response, 400, { error: error instanceof Error ? error.message : String(error) });
+}
+function headerValue(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+function readOptionalString(value) {
+    return typeof value === "string" && value.trim() ? value : undefined;
+}
+function readOptionalRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+}
+function readApprovalDecision(body) {
+    const raw = body.approved ?? body.decision;
+    if (raw === true || raw === "approve" || raw === "approved" || raw === "allow" || raw === "allowed") {
+        return true;
+    }
+    if (raw === false || raw === "deny" || raw === "denied" || raw === "reject" || raw === "rejected") {
+        return false;
+    }
+    return undefined;
+}
+function readPermissionMode(value) {
+    return value === "default" || value === "acceptEdits" || value === "bypassPermissions" || value === "plan"
+        ? value
+        : undefined;
+}
+function normalizeControlQuestionAnswer(body, question) {
+    const rawAnswer = readOptionalRecord(body.answer) ?? body;
+    const candidate = rawAnswer.answers === undefined && Array.isArray(body.selectedLabels)
+        ? {
+            answers: [{
+                    question: question.questions[0]?.question ?? "",
+                    selectedLabels: body.selectedLabels
+                }]
+        }
+        : rawAnswer;
+    return normalizeAskUserQuestionAnswer(question, candidate);
+}
+function readLimit(raw, fallback) {
+    if (raw === null || raw === "") {
+        return fallback;
+    }
+    if (!/^\d+$/.test(raw)) {
+        return fallback;
+    }
+    const value = Number(raw);
+    return Number.isInteger(value) && value >= 1 && value <= 500 ? value : fallback;
+}
+function readOptionalId(raw) {
+    if (raw === null || raw === "") {
+        return undefined;
+    }
+    if (!/^\d+$/.test(raw)) {
+        return undefined;
+    }
+    const value = Number(raw);
+    return Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+}
+//# sourceMappingURL=server.js.map