@electric-agent/studio 1.12.1 → 1.13.1

package/dist/server.js

@@ -8,7 +8,7 @@ import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { ActiveSessions } from "./active-sessions.js";
-import { addAgentSchema, addSessionToRoomSchema, createRoomSchema, createSandboxSchema, createSessionSchema, iterateRoomSessionSchema, iterateSessionSchema, resumeSessionSchema, sendRoomMessageSchema, } from "./api-schemas.js";
+import { addAgentSchema, addSessionToRoomSchema, createAppRoomSchema, createRoomSchema, createSandboxSchema, createSessionSchema, iterateRoomSessionSchema, iterateSessionSchema, resumeSessionSchema, sendRoomMessageSchema, } from "./api-schemas.js";
 import { PRODUCTION_ALLOWED_TOOLS } from "./bridge/claude-code-base.js";
 import { ClaudeCodeDockerBridge } from "./bridge/claude-code-docker.js";
 import { ClaudeCodeSpritesBridge, } from "./bridge/claude-code-sprites.js";
@@ -20,6 +20,7 @@ import { ghListAccounts, ghListBranches, ghListRepos, isGhAuthenticated } from "
 import { createOrgRepo, getInstallationToken } from "./github-app.js";
 import { generateInviteCode } from "./invite-code.js";
 import { resolveProjectDir } from "./project-utils.js";
+import { Registry } from "./registry.js";
 import { RoomRouter } from "./room-router.js";
 import { deriveGlobalHookSecret, deriveHookToken, deriveRoomToken, deriveSessionToken, validateGlobalHookSecret, validateHookToken, validateRoomToken, validateSessionToken, } from "./session-auth.js";
 import { getRoomStreamConnectionInfo, getStreamConnectionInfo, } from "./streams.js";
@@ -544,6 +545,7 @@ export function createApp(config) {
         if (hookEvent.type === "ask_user_question") {
             const toolUseId = hookEvent.tool_use_id;
             console.log(`[hook-event] Blocking for ask_user_question gate: ${toolUseId}`);
+            config.sessions.update(sessionId, { needsInput: true });
             try {
                 const gateTimeout = 5 * 60 * 1000; // 5 minutes
                 const result = await Promise.race([
@@ -551,6 +553,7 @@ export function createApp(config) {
                     new Promise((_, reject) => setTimeout(() => reject(new Error("AskUserQuestion gate timed out")), gateTimeout)),
                 ]);
                 console.log(`[hook-event] ask_user_question gate resolved: ${toolUseId}`);
+                config.sessions.update(sessionId, { needsInput: false });
                 return c.json({
                     hookSpecificOutput: {
                         hookEventName: "PreToolUse",
@@ -564,6 +567,7 @@ export function createApp(config) {
             }
             catch (err) {
                 console.error(`[hook-event] ask_user_question gate error:`, err);
+                config.sessions.update(sessionId, { needsInput: false });
                 return c.json({ ok: true }); // Don't block Claude Code on timeout
             }
         }
@@ -685,6 +689,7 @@ export function createApp(config) {
         if (hookEvent.type === "ask_user_question") {
             const toolUseId = hookEvent.tool_use_id;
             console.log(`[hook] Blocking for ask_user_question gate: ${toolUseId}`);
+            config.sessions.update(sessionId, { needsInput: true });
             try {
                 const gateTimeout = 5 * 60 * 1000;
                 const result = await Promise.race([
@@ -692,6 +697,7 @@ export function createApp(config) {
                     new Promise((_, reject) => setTimeout(() => reject(new Error("AskUserQuestion gate timed out")), gateTimeout)),
                 ]);
                 console.log(`[hook] ask_user_question gate resolved: ${toolUseId}`);
+                config.sessions.update(sessionId, { needsInput: false });
                 return c.json({
                     sessionId,
                     hookSpecificOutput: {
@@ -706,6 +712,7 @@ export function createApp(config) {
             }
             catch (err) {
                 console.error(`[hook] ask_user_question gate error:`, err);
+                config.sessions.update(sessionId, { needsInput: false });
                 return c.json({ ok: true, sessionId });
             }
         }
@@ -805,8 +812,12 @@ echo "Start claude in this project — the session will appear in the studio UI.
         if (isResponse(body))
             return body;
         // In prod mode, use server-side API key; ignore user-provided credentials
-        const apiKey = config.devMode ? body.apiKey : process.env.ANTHROPIC_API_KEY;
-        const oauthToken = config.devMode ? body.oauthToken : undefined;
+        const apiKey = config.devMode
+            ? body.apiKey || process.env.ANTHROPIC_API_KEY
+            : process.env.ANTHROPIC_API_KEY;
+        const oauthToken = config.devMode
+            ? body.oauthToken || process.env.CLAUDE_OAUTH_TOKEN
+            : undefined;
         const ghToken = config.devMode ? body.ghToken : undefined;
         // Block freeform sessions in production mode
         if (body.freeform && !config.devMode) {
@@ -956,7 +967,7 @@ echo "Start claude in this project — the session will appear in the studio UI.
                 apiKey,
                 oauthToken,
                 ghToken,
-                ...(!config.devMode && {
+                ...((!config.devMode || GITHUB_APP_ID) && {
                     prodMode: {
                         sessionToken: deriveSessionToken(config.streamConfig.secret, sessionId),
                         studioUrl: resolveStudioUrl(config.port),
@@ -1027,9 +1038,9 @@ echo "Start claude in this project — the session will appear in the studio UI.
                             ts: ts(),
                         });
                     }
-                    // In prod mode, create GitHub repo and initialize git in the sandbox
+                    // Create GitHub repo via GitHub App when credentials are available
                     let prodGitConfig;
-                    if (!config.devMode && GITHUB_APP_ID && GITHUB_INSTALLATION_ID && GITHUB_PRIVATE_KEY) {
+                    if (GITHUB_APP_ID && GITHUB_INSTALLATION_ID && GITHUB_PRIVATE_KEY) {
                         try {
                             // Repo name matches the project name (already has random slug)
                             const repoSlug = projectName;
@@ -1263,8 +1274,47 @@ echo "Start claude in this project — the session will appear in the studio UI.
         if (!handle || !config.sandbox.isAlive(handle)) {
             return c.json({ error: "Container is not running" }, 400);
         }
+        // Ensure we have a CC bridge (not just a stream writer).
+        // After server restart, bridges are lost — getOrCreateBridge would create
+        // a HostedStreamBridge that can only write to the stream but can't spawn
+        // Claude Code processes. We need a ClaudeCodeDockerBridge to restart the agent.
+        let bridge = bridges.get(sessionId);
+        if (!bridge) {
+            const hookToken = deriveHookToken(config.streamConfig.secret, sessionId);
+            const claudeConfig = config.sandbox.runtime === "sprites"
+                ? {
+                    prompt: body.request,
+                    cwd: session.sandboxProjectDir || handle.projectDir,
+                    studioUrl: resolveStudioUrl(config.port),
+                    hookToken,
+                }
+                : {
+                    prompt: body.request,
+                    cwd: session.sandboxProjectDir || handle.projectDir,
+                    studioPort: config.port,
+                    hookToken,
+                };
+            bridge = createClaudeCodeBridge(config, sessionId, claudeConfig);
+            // Re-register basic event tracking callbacks
+            bridge.onAgentEvent((event) => {
+                if (event.type === "session_start") {
+                    const ccSessionId = event.session_id;
+                    if (ccSessionId) {
+                        config.sessions.update(sessionId, { lastCoderSessionId: ccSessionId });
+                    }
+                }
+                if (event.type === "session_end") {
+                    accumulateSessionCost(config, sessionId, event);
+                }
+            });
+            bridge.onComplete(async (success) => {
+                config.sessions.update(sessionId, {
+                    status: success ? "complete" : "error",
+                });
+            });
+            console.log(`[iterate] Recreated CC bridge for session ${sessionId} after restart`);
+        }
         // Write user prompt to the stream
-        const bridge = getOrCreateBridge(config, sessionId);
         await bridge.emit({ type: "user_prompt", message: body.request, ts: ts() });
         config.sessions.update(sessionId, { status: "running" });
         await bridge.sendCommand({
@@ -1627,8 +1677,12 @@ echo "Start claude in this project — the session will appear in the studio UI.
         return c.req.header("X-Room-Token") ?? c.req.query("token") ?? undefined;
     }
     // Protect room-scoped routes via X-Room-Token header
+    // "create-app" is a creation endpoint — no room token exists yet
+    const roomAuthExemptIds = new Set(["create-app"]);
     app.use("/api/rooms/:id/*", async (c, next) => {
         const id = c.req.param("id");
+        if (roomAuthExemptIds.has(id))
+            return next();
         const token = extractRoomToken(c);
         if (!token || !validateRoomToken(config.streamConfig.secret, id, token)) {
             return c.json({ error: "Invalid or missing room token" }, 401);
@@ -1636,15 +1690,697 @@ echo "Start claude in this project — the session will appear in the studio UI.
         return next();
     });
     app.use("/api/rooms/:id", async (c, next) => {
+        const id = c.req.param("id");
+        if (roomAuthExemptIds.has(id))
+            return next();
         if (c.req.method !== "GET" && c.req.method !== "DELETE")
             return next();
-        const id = c.req.param("id");
         const token = extractRoomToken(c);
         if (!token || !validateRoomToken(config.streamConfig.secret, id, token)) {
             return c.json({ error: "Invalid or missing room token" }, 401);
         }
         return next();
     });
+    // Create a room with 3 agents for multi-agent app creation
+    app.post("/api/rooms/create-app", async (c) => {
+        const body = await validateBody(c, createAppRoomSchema);
+        if (isResponse(body))
+            return body;
+        // In prod mode, use server-side API key; ignore user-provided credentials
+        const apiKey = config.devMode
+            ? body.apiKey || process.env.ANTHROPIC_API_KEY
+            : process.env.ANTHROPIC_API_KEY;
+        const oauthToken = config.devMode
+            ? body.oauthToken || process.env.CLAUDE_OAUTH_TOKEN
+            : undefined;
+        const ghToken = config.devMode ? body.ghToken : undefined;
+        // Rate-limit session creation in production mode
+        if (!config.devMode) {
+            const ip = extractClientIp(c);
+            if (!checkSessionRateLimit(ip)) {
+                return c.json({ error: "Too many sessions. Please try again later." }, 429);
+            }
+            if (checkGlobalSessionCap(config.sessions)) {
+                return c.json({ error: "Service at capacity, please try again later" }, 503);
+            }
+        }
+        const roomId = crypto.randomUUID();
+        const roomName = body.name || `app-${roomId.slice(0, 8)}`;
+        // Create the room's durable stream
+        const roomConn = roomStream(config, roomId);
+        try {
+            await DurableStream.create({
+                url: roomConn.url,
+                headers: roomConn.headers,
+                contentType: "application/json",
+            });
+        }
+        catch (err) {
+            console.error(`[room:create-app] Failed to create room stream:`, err);
+            return c.json({ error: "Failed to create room stream" }, 500);
+        }
+        // Create and start the router
+        const router = new RoomRouter(roomId, roomName, config.streamConfig);
+        await router.start();
+        roomRouters.set(roomId, router);
+        // Save to room registry
+        const code = generateInviteCode();
+        await config.rooms.addRoom({
+            id: roomId,
+            code,
+            name: roomName,
+            createdAt: new Date().toISOString(),
+            revoked: false,
+        });
+        // Define the 3 agents with randomized display names
+        const agentSuffixes = [
+            "fox",
+            "owl",
+            "lynx",
+            "wolf",
+            "bear",
+            "hawk",
+            "pine",
+            "oak",
+            "elm",
+            "ivy",
+            "ray",
+            "arc",
+            "reef",
+            "dusk",
+            "ash",
+            "sage",
+        ];
+        const pick = () => agentSuffixes[Math.floor(Math.random() * agentSuffixes.length)];
+        const usedSuffixes = new Set();
+        const uniquePick = () => {
+            let s = pick();
+            while (usedSuffixes.has(s))
+                s = pick();
+            usedSuffixes.add(s);
+            return s;
+        };
+        const agentDefs = [
+            { name: `coder-${uniquePick()}`, role: "coder" },
+            { name: `reviewer-${uniquePick()}`, role: "reviewer" },
+            { name: `designer-${uniquePick()}`, role: "ui-designer" },
+        ];
+        // Create session IDs and streams upfront for all 3 agents
+        const sessions = [];
+        for (const agentDef of agentDefs) {
+            const sessionId = crypto.randomUUID();
+            const conn = sessionStream(config, sessionId);
+            try {
+                await DurableStream.create({
+                    url: conn.url,
+                    headers: conn.headers,
+                    contentType: "application/json",
+                });
+            }
+            catch (err) {
+                console.error(`[room:create-app] Failed to create stream for ${agentDef.name}:`, err);
+                return c.json({ error: `Failed to create stream for ${agentDef.name}` }, 500);
+            }
+            const sessionToken = deriveSessionToken(config.streamConfig.secret, sessionId);
+            sessions.push({ name: agentDef.name, role: agentDef.role, sessionId, sessionToken });
+        }
+        const roomToken = deriveRoomToken(config.streamConfig.secret, roomId);
+        console.log(`[room:create-app] Created room ${roomId} with agents: ${sessions.map((s) => s.name).join(", ")}`);
+        // Return immediately so the client can show the room + sessions
+        // The async flow handles sandbox creation, skill injection, and agent startup
+        // Sessions are created in agentDefs order: [coder, reviewer, ui-designer]
+        const coderSession = sessions[0];
+        const reviewerSession = sessions[1];
+        const uiDesignerSession = sessions[2];
+        const coderBridge = getOrCreateBridge(config, coderSession.sessionId);
+        // Record all sessions
+        for (const s of sessions) {
+            const projectName = s.role === "coder" && config.devMode
+                ? body.name ||
+                    body.description
+                        .slice(0, 40)
+                        .replace(/[^a-z0-9]+/gi, "-")
+                        .replace(/^-|-$/g, "")
+                        .toLowerCase()
+                : `room-${s.name}-${s.sessionId.slice(0, 8)}`;
+            const sandboxProjectDir = `/home/agent/workspace/${projectName}`;
+            const session = {
+                id: s.sessionId,
+                projectName,
+                sandboxProjectDir,
+                description: s.role === "coder" ? body.description : `Room agent: ${s.name} (${s.role})`,
+                createdAt: new Date().toISOString(),
+                lastActiveAt: new Date().toISOString(),
+                status: "running",
+            };
+            config.sessions.add(session);
+        }
+        // Write user prompt to coder's stream
+        await coderBridge.emit({ type: "user_prompt", message: body.description, ts: ts() });
+        // Gather GitHub accounts for the infra config gate (dev mode only)
+        let ghAccounts = [];
+        if (config.devMode && ghToken && isGhAuthenticated(ghToken)) {
+            try {
+                ghAccounts = ghListAccounts(ghToken);
+            }
+            catch {
+                // gh not available
+            }
+        }
+        // Emit infra config gate on coder's stream
+        const coderProjectName = config.sessions.get(coderSession.sessionId)?.projectName ?? coderSession.name;
+        await coderBridge.emit({
+            type: "infra_config_prompt",
+            projectName: coderProjectName,
+            ghAccounts,
+            runtime: config.sandbox.runtime,
+            ts: ts(),
+        });
+        // Async flow: wait for gate, create sandboxes, start agents
+        const asyncFlow = async () => {
+            // 1. Wait for infra config gate on coder's session
+            await router.sendMessage("system", `Waiting for setup — open ${coderSession.name}'s session to confirm infrastructure.`);
+            console.log(`[room:create-app:${roomId}] Waiting for infra_config gate...`);
+            let infra;
+            let repoConfig = null;
+            let claimId;
+            try {
+                const gateValue = await createGate(coderSession.sessionId, "infra_config");
+                console.log(`[room:create-app:${roomId}] Infra gate resolved: mode=${gateValue.mode}`);
+                if (gateValue.mode === "cloud" || gateValue.mode === "claim") {
+                    infra = {
+                        mode: "cloud",
+                        databaseUrl: gateValue.databaseUrl,
+                        electricUrl: gateValue.electricUrl,
+                        sourceId: gateValue.sourceId,
+                        secret: gateValue.secret,
+                    };
+                    if (gateValue.mode === "claim") {
+                        claimId = gateValue.claimId;
+                    }
+                }
+                else {
+                    infra = { mode: "local" };
+                }
+                // Extract repo config if provided
+                if (gateValue.repoAccount && gateValue.repoName?.trim()) {
+                    repoConfig = {
+                        account: gateValue.repoAccount,
+                        repoName: gateValue.repoName,
+                        visibility: gateValue.repoVisibility ?? "private",
+                    };
+                    config.sessions.update(coderSession.sessionId, {
+                        git: {
+                            branch: "main",
+                            remoteUrl: null,
+                            repoName: `${repoConfig.account}/${repoConfig.repoName}`,
+                            repoVisibility: repoConfig.visibility,
+                            lastCommitHash: null,
+                            lastCommitMessage: null,
+                            lastCheckpointAt: null,
+                        },
+                    });
+                }
+            }
+            catch (err) {
+                console.log(`[room:create-app:${roomId}] Infra gate error (defaulting to local):`, err);
+                infra = { mode: "local" };
+            }
+            // 2. Create sandboxes in parallel
+            // Coder gets full scaffold, reviewer/ui-designer get minimal
+            await router.sendMessage("system", "Creating sandboxes");
+            await coderBridge.emit({
+                type: "log",
+                level: "build",
+                message: "Creating sandboxes for all agents...",
+                ts: ts(),
+            });
+            const sandboxOpts = (sid) => ({
+                ...((!config.devMode || GITHUB_APP_ID) && {
+                    prodMode: {
+                        sessionToken: deriveSessionToken(config.streamConfig.secret, sid),
+                        studioUrl: resolveStudioUrl(config.port),
+                    },
+                }),
+            });
+            const coderInfo = config.sessions.get(coderSession.sessionId);
+            if (!coderInfo)
+                throw new Error("Coder session not found in registry");
+            const reviewerInfo = config.sessions.get(reviewerSession.sessionId);
+            if (!reviewerInfo)
+                throw new Error("Reviewer session not found in registry");
+            const uiDesignerInfo = config.sessions.get(uiDesignerSession.sessionId);
+            if (!uiDesignerInfo)
+                throw new Error("UI designer session not found in registry");
+            const [coderHandle, reviewerHandle, uiDesignerHandle] = await Promise.all([
+                config.sandbox.create(coderSession.sessionId, {
+                    projectName: coderInfo.projectName,
+                    infra,
+                    apiKey,
+                    oauthToken,
+                    ghToken,
+                    ...sandboxOpts(coderSession.sessionId),
+                }),
+                config.sandbox.create(reviewerSession.sessionId, {
+                    projectName: reviewerInfo.projectName,
+                    infra: { mode: "none" },
+                    apiKey,
+                    oauthToken,
+                    ghToken,
+                    ...sandboxOpts(reviewerSession.sessionId),
+                }),
+                config.sandbox.create(uiDesignerSession.sessionId, {
+                    projectName: uiDesignerInfo.projectName,
+                    infra: { mode: "none" },
+                    apiKey,
+                    oauthToken,
+                    ghToken,
+                    ...sandboxOpts(uiDesignerSession.sessionId),
+                }),
+            ]);
+            const handles = [
+                { session: coderSession, handle: coderHandle },
+                { session: reviewerSession, handle: reviewerHandle },
+                { session: uiDesignerSession, handle: uiDesignerHandle },
+            ];
+            // Update session info with sandbox details
+            for (const { session: s, handle } of handles) {
+                config.sessions.update(s.sessionId, {
+                    appPort: handle.port,
+                    sandboxProjectDir: handle.projectDir,
+                    previewUrl: handle.previewUrl,
+                    ...(s.role === "coder" && claimId ? { claimId } : {}),
+                });
+            }
+            await coderBridge.emit({
+                type: "log",
+                level: "done",
+                message: "All sandboxes ready",
+                ts: ts(),
+            });
+            // 3. Set up coder sandbox (full scaffold + CLAUDE.md + skills + GitHub repo)
+            {
+                const handle = coderHandle;
+                // Copy scaffold
+                await coderBridge.emit({
+                    type: "log",
+                    level: "build",
+                    message: "Setting up project...",
+                    ts: ts(),
+                });
+                try {
+                    if (config.sandbox.runtime === "docker") {
+                        await config.sandbox.exec(handle, `cp -r /opt/scaffold-base '${handle.projectDir}'`);
+                        await config.sandbox.exec(handle, `cd '${handle.projectDir}' && sed -i 's/"name": "scaffold-base"/"name": "${coderInfo.projectName.replace(/[^a-z0-9_-]/gi, "-")}"/' package.json`);
+                    }
+                    else {
+                        await config.sandbox.exec(handle, `source /etc/profile.d/npm-global.sh 2>/dev/null; electric-agent scaffold '${handle.projectDir}' --name '${coderInfo.projectName}' --skip-git`);
+                    }
+                    await coderBridge.emit({
+                        type: "log",
+                        level: "done",
+                        message: "Project ready",
+                        ts: ts(),
+                    });
+                }
+                catch (err) {
+                    console.error(`[room:create-app:${roomId}] Project setup failed:`, err);
+                    await coderBridge.emit({
+                        type: "log",
+                        level: "error",
+                        message: `Project setup failed: ${err instanceof Error ? err.message : "unknown"}`,
+                        ts: ts(),
+                    });
+                }
+                // GitHub repo creation (uses GitHub App when credentials are available)
+                let repoUrl = null;
+                let prodGitConfig;
+                if (GITHUB_APP_ID && GITHUB_INSTALLATION_ID && GITHUB_PRIVATE_KEY) {
+                    try {
+                        const repoSlug = coderInfo.projectName;
+                        await coderBridge.emit({
+                            type: "log",
+                            level: "build",
+                            message: "Creating GitHub repository...",
+                            ts: ts(),
+                        });
+                        const { token } = await getInstallationToken(GITHUB_APP_ID, GITHUB_INSTALLATION_ID, GITHUB_PRIVATE_KEY);
+                        const repo = await createOrgRepo(GITHUB_ORG, repoSlug, token);
+                        if (repo) {
+                            const actualRepoName = `${GITHUB_ORG}/${repo.htmlUrl.split("/").pop()}`;
+                            await config.sandbox.exec(handle, `cd '${handle.projectDir}' && git init -b main && git remote add origin '${repo.cloneUrl}'`);
+                            prodGitConfig = {
+                                mode: "pre-created",
+                                repoName: actualRepoName,
+                                repoUrl: repo.htmlUrl,
+                            };
+                            repoUrl = repo.htmlUrl;
+                            config.sessions.update(coderSession.sessionId, {
+                                git: {
+                                    branch: "main",
+                                    remoteUrl: repo.htmlUrl,
+                                    repoName: actualRepoName,
+                                    lastCommitHash: null,
+                                    lastCommitMessage: null,
+                                    lastCheckpointAt: null,
+                                },
+                            });
+                            await coderBridge.emit({
+                                type: "log",
+                                level: "done",
+                                message: `GitHub repo created: ${repo.htmlUrl}`,
+                                ts: ts(),
+                            });
+                        }
+                    }
+                    catch (err) {
+                        console.error(`[room:create-app:${roomId}] GitHub repo creation error:`, err);
+                    }
+                }
+                else if (repoConfig) {
+                    repoUrl = `https://github.com/${repoConfig.account}/${repoConfig.repoName}`;
+                }
+                // Write CLAUDE.md to coder sandbox
+                const claudeMd = generateClaudeMd({
+                    description: body.description,
+                    projectName: coderInfo.projectName,
+                    projectDir: handle.projectDir,
+                    runtime: config.sandbox.runtime,
+                    production: !config.devMode,
+                    ...(prodGitConfig
+                        ? { git: prodGitConfig }
+                        : repoConfig
+                            ? {
+                                git: {
+                                    mode: "create",
+                                    repoName: `${repoConfig.account}/${repoConfig.repoName}`,
+                                    visibility: repoConfig.visibility,
+                                },
+                            }
+                            : {}),
+                });
+                try {
+                    await config.sandbox.exec(handle, `cat > '${handle.projectDir}/CLAUDE.md' << 'CLAUDEMD_EOF'\n${claudeMd}\nCLAUDEMD_EOF`);
+                }
+                catch (err) {
+                    console.error(`[room:create-app:${roomId}] Failed to write CLAUDE.md:`, err);
+                }
+                // Write create-app skill to coder sandbox
+                if (createAppSkillContent) {
+                    try {
+                        const skillDir = `${handle.projectDir}/.claude/skills/create-app`;
+                        const skillB64 = Buffer.from(createAppSkillContent).toString("base64");
+                        await config.sandbox.exec(handle, `mkdir -p '${skillDir}' && echo '${skillB64}' | base64 -d > '${skillDir}/SKILL.md'`);
+                    }
+                    catch (err) {
+                        console.error(`[room:create-app:${roomId}] Failed to write create-app skill:`, err);
+                    }
+                }
+                // Write room-messaging skill to coder sandbox
+                if (roomMessagingSkillContent) {
+                    try {
+                        const skillDir = `${handle.projectDir}/.claude/skills/room-messaging`;
+                        const skillB64 = Buffer.from(roomMessagingSkillContent).toString("base64");
+                        await config.sandbox.exec(handle, `mkdir -p '${skillDir}' && echo '${skillB64}' | base64 -d > '${skillDir}/SKILL.md'`);
+                    }
+                    catch (err) {
+                        console.error(`[room:create-app:${roomId}] Failed to write room-messaging skill to coder:`, err);
+                    }
+                }
+                // 4. Create Claude Code bridge for coder
+                const coderPrompt = `/create-app ${body.description}`;
+                const coderHookToken = deriveHookToken(config.streamConfig.secret, coderSession.sessionId);
+                const coderClaudeConfig = config.sandbox.runtime === "sprites"
+                    ? {
+                        prompt: coderPrompt,
+                        cwd: handle.projectDir,
+                        studioUrl: resolveStudioUrl(config.port),
+                        hookToken: coderHookToken,
+                        agentName: coderSession.name,
+                    }
+                    : {
+                        prompt: coderPrompt,
+                        cwd: handle.projectDir,
+                        studioPort: config.port,
+                        hookToken: coderHookToken,
+                        agentName: coderSession.name,
+                    };
+                const coderCcBridge = createClaudeCodeBridge(config, coderSession.sessionId, coderClaudeConfig);
+                // Track coder events
+                coderCcBridge.onAgentEvent((event) => {
+                    if (event.type === "session_start") {
+                        const ccSessionId = event.session_id;
+                        if (ccSessionId) {
+                            config.sessions.update(coderSession.sessionId, {
+                                lastCoderSessionId: ccSessionId,
+                            });
+                        }
+                    }
+                    if (event.type === "session_end") {
+                        accumulateSessionCost(config, coderSession.sessionId, event);
+                    }
+                    // Route assistant_message output to the room router
+                    if (event.type === "assistant_message" && "text" in event) {
+                        router
+                            .handleAgentOutput(coderSession.sessionId, event.text)
+                            .catch((err) => {
+                            console.error(`[room:create-app:${roomId}] handleAgentOutput error (coder):`, err);
+                        });
+                    }
+                    // Notify room when coder is waiting for user input
+                    if (event.type === "ask_user_question") {
+                        config.sessions.update(coderSession.sessionId, { needsInput: true });
+                        router
+                            .sendMessage("system", `${coderSession.name} needs input — open their session to respond.`)
+                            .catch((err) => {
+                            console.error(`[room:create-app:${roomId}] Failed to send gate notification:`, err);
+                        });
+                    }
+                    if (event.type === "gate_resolved") {
+                        config.sessions.update(coderSession.sessionId, { needsInput: false });
+                        router
+                            .sendMessage("system", `${coderSession.name} received input — resuming.`)
+                            .catch(() => { });
+                    }
+                });
+                // Coder completion handler: notify room on success or failure
+                coderCcBridge.onComplete(async (success) => {
+                    const updates = {
+                        status: success ? "complete" : "error",
+                    };
+                    let repoInfo = "";
+                    try {
+                        const gs = await config.sandbox.gitStatus(handle, handle.projectDir);
+                        if (gs.initialized) {
+                            const existing = config.sessions.get(coderSession.sessionId);
+                            updates.git = {
+                                branch: gs.branch ?? "main",
+                                remoteUrl: existing?.git?.remoteUrl ?? null,
+                                repoName: existing?.git?.repoName ?? null,
+                                repoVisibility: existing?.git?.repoVisibility,
+                                lastCommitHash: gs.lastCommitHash ?? null,
+                                lastCommitMessage: gs.lastCommitMessage ?? null,
+                                lastCheckpointAt: existing?.git?.lastCheckpointAt ?? null,
+                            };
+                            if (existing?.git?.repoName) {
+                                repoInfo = ` Repo: https://github.com/${existing.git.repoName}`;
+                            }
+                        }
+                    }
+                    catch {
+                        // Sandbox may be stopped
+                    }
+                    config.sessions.update(coderSession.sessionId, updates);
+                    const msg = success
+                        ? `@room DONE: App is ready.${repoInfo}`
+                        : "@room Coder session ended unexpectedly.";
+                    router.handleAgentOutput(coderSession.sessionId, msg).catch((err) => {
+                        console.error(`[room:create-app:${roomId}] Failed to send coder completion message:`, err);
+                    });
+                });
+                await coderBridge.emit({
+                    type: "log",
+                    level: "build",
+                    message: `Running: claude "/create-app ${body.description}"`,
+                    ts: ts(),
+                });
+                await coderCcBridge.start();
+                // Add coder as room participant
+                const coderParticipant = {
+                    sessionId: coderSession.sessionId,
+                    name: coderSession.name,
+                    role: "coder",
+                    bridge: coderCcBridge,
+                };
+                await router.addParticipant(coderParticipant, false);
+                // Send the initial command to the coder
+                await coderCcBridge.sendCommand({
+                    command: "new",
+                    description: body.description,
+                    projectName: coderInfo.projectName,
+                    baseDir: "/home/agent/workspace",
+                });
+                // Store the repoUrl for reviewer/ui-designer prompts
+                // (we continue setting up those agents now)
+                const finalRepoUrl = repoUrl;
+                // 5. Set up reviewer and ui-designer sandboxes
+                const supportAgents = [
+                    { session: reviewerSession, handle: reviewerHandle },
+                    { session: uiDesignerSession, handle: uiDesignerHandle },
+                ];
+                for (const { session: agentSession, handle: agentHandle } of supportAgents) {
+                    const agentBridge = getOrCreateBridge(config, agentSession.sessionId);
+                    // Write a minimal CLAUDE.md
+                    const minimalClaudeMd = "Room agent workspace";
+                    try {
+                        await config.sandbox.exec(agentHandle, `mkdir -p '${agentHandle.projectDir}' && cat > '${agentHandle.projectDir}/CLAUDE.md' << 'CLAUDEMD_EOF'\n${minimalClaudeMd}\nCLAUDEMD_EOF`);
+                    }
+                    catch (err) {
+                        console.error(`[room:create-app:${roomId}] Failed to write CLAUDE.md for ${agentSession.name}:`, err);
+                    }
+                    // Write room-messaging skill
+                    if (roomMessagingSkillContent) {
+                        try {
+                            const skillDir = `${agentHandle.projectDir}/.claude/skills/room-messaging`;
+                            const skillB64 = Buffer.from(roomMessagingSkillContent).toString("base64");
+                            await config.sandbox.exec(agentHandle, `mkdir -p '${skillDir}' && echo '${skillB64}' | base64 -d > '${skillDir}/SKILL.md'`);
+                        }
+                        catch (err) {
+                            console.error(`[room:create-app:${roomId}] Failed to write room-messaging skill for ${agentSession.name}:`, err);
+                        }
+                    }
+                    // Resolve and inject role skill
+                    const roleSkill = resolveRoleSkill(agentSession.role);
+                    if (roleSkill) {
+                        try {
+                            const skillDir = `${agentHandle.projectDir}/.claude/skills/role`;
+                            const skillB64 = Buffer.from(roleSkill.skillContent).toString("base64");
+                            await config.sandbox.exec(agentHandle, `mkdir -p '${skillDir}' && echo '${skillB64}' | base64 -d > '${skillDir}/SKILL.md'`);
+                        }
+                        catch (err) {
+                            console.error(`[room:create-app:${roomId}] Failed to write role skill for ${agentSession.name}:`, err);
+                        }
+                    }
+                    // Build prompt
+                    const repoRef = finalRepoUrl ? ` The GitHub repo is: ${finalRepoUrl}.` : "";
+                    const agentPrompt = agentSession.role === "reviewer"
+                        ? `You are "reviewer", a code review agent in a multi-agent room. Read .claude/skills/role/SKILL.md for your role guidelines.${repoRef} Wait for the coder to send a @room DONE: message before starting any work.`
+                        : `You are "ui-designer", a UI design agent in a multi-agent room. Read .claude/skills/role/SKILL.md for your role guidelines.${repoRef} Wait for the coder to send a @room DONE: message before starting any work.`;
+                    // Create Claude Code bridge
+                    const agentHookToken = deriveHookToken(config.streamConfig.secret, agentSession.sessionId);
+                    const agentClaudeConfig = config.sandbox.runtime === "sprites"
+                        ? {
+                            prompt: agentPrompt,
+                            cwd: agentHandle.projectDir,
+                            studioUrl: resolveStudioUrl(config.port),
+                            hookToken: agentHookToken,
+                            agentName: agentSession.name,
+                            ...(roleSkill?.allowedTools && {
+                                allowedTools: roleSkill.allowedTools,
+                            }),
+                        }
+                        : {
+                            prompt: agentPrompt,
+                            cwd: agentHandle.projectDir,
+                            studioPort: config.port,
+                            hookToken: agentHookToken,
+                            agentName: agentSession.name,
+                            ...(roleSkill?.allowedTools && {
+                                allowedTools: roleSkill.allowedTools,
+                            }),
+                        };
+                    const ccBridge = createClaudeCodeBridge(config, agentSession.sessionId, agentClaudeConfig);
+                    // Track events
+                    ccBridge.onAgentEvent((event) => {
+                        console.log(`[room:create-app:${roomId}] ${agentSession.name} event: type=${event.type}${event.type === "assistant_message" && "text" in event ? ` text=${event.text.slice(0, 120)}` : ""}`);
+                        if (event.type === "session_start") {
+                            const ccSessionId = event.session_id;
+                            if (ccSessionId) {
+                                config.sessions.update(agentSession.sessionId, {
+                                    lastCoderSessionId: ccSessionId,
+                                });
+                            }
+                        }
+                        if (event.type === "session_end") {
+                            accumulateSessionCost(config, agentSession.sessionId, event);
+                        }
+                        if (event.type === "assistant_message" && "text" in event) {
+                            const text = event.text;
+                            console.log(`[room:create-app:${roomId}] ${agentSession.name} assistant_message -> calling handleAgentOutput (sessionId=${agentSession.sessionId})`);
+                            router.handleAgentOutput(agentSession.sessionId, text).catch((err) => {
+                                console.error(`[room:create-app:${roomId}] handleAgentOutput error (${agentSession.name}):`, err);
+                            });
+                        }
+                        if (event.type === "ask_user_question") {
+                            config.sessions.update(agentSession.sessionId, { needsInput: true });
+                            router
+                                .sendMessage("system", `${agentSession.name} needs input — open their session to respond.`)
+                                .catch((err) => {
+                                console.error(`[room:create-app:${roomId}] Failed to send gate notification (${agentSession.name}):`, err);
+                            });
+                        }
+                        if (event.type === "gate_resolved") {
+                            config.sessions.update(agentSession.sessionId, { needsInput: false });
+                            router
+                                .sendMessage("system", `${agentSession.name} received input — resuming.`)
+                                .catch(() => { });
+                        }
+                    });
+                    ccBridge.onComplete(async (success) => {
+                        config.sessions.update(agentSession.sessionId, {
+                            status: success ? "complete" : "error",
+                        });
+                    });
+                    await agentBridge.emit({
+                        type: "log",
+                        level: "done",
+                        message: `Sandbox ready for "${agentSession.name}"`,
+                        ts: ts(),
+                    });
+                    await ccBridge.start();
+                    // Add as room participant (not gated — messages flow freely)
+                    const participant = {
+                        sessionId: agentSession.sessionId,
+                        name: agentSession.name,
+                        role: agentSession.role,
+                        bridge: ccBridge,
+                    };
+                    await router.addParticipant(participant, false);
+                }
+                console.log(`[room:create-app:${roomId}] All 3 agents started and added to room`);
+                await router.sendMessage("system", `All agents ready — ${coderSession.name} is building, ${reviewerSession.name} and ${uiDesignerSession.name} waiting.`);
+            }
+        };
+        asyncFlow().catch(async (err) => {
+            console.error(`[room:create-app:${roomId}] Flow failed:`, err);
+            for (const s of sessions) {
+                config.sessions.update(s.sessionId, { status: "error" });
+            }
+            try {
+                await coderBridge.emit({
+                    type: "log",
+                    level: "error",
+                    message: `Room creation failed: ${err instanceof Error ? err.message : String(err)}`,
+                    ts: ts(),
+                });
+            }
+            catch {
+                // Bridge may not be usable
+            }
+        });
+        return c.json({
+            roomId,
+            code,
+            name: roomName,
+            roomToken,
+            sessions: sessions.map((s) => ({
+                sessionId: s.sessionId,
+                name: s.name,
+                role: s.role,
+                sessionToken: s.sessionToken,
+            })),
+        }, 201);
+    });
     // Create a room
     app.post("/api/rooms", async (c) => {
         const body = await validateBody(c, createRoomSchema);
@@ -1699,18 +2435,31 @@ echo "Start claude in this project — the session will appear in the studio UI.
     app.get("/api/rooms/:id", (c) => {
         const roomId = c.req.param("id");
         const router = roomRouters.get(roomId);
-        if (!router)
+        if (router) {
+            return c.json({
+                roomId,
+                state: router.state,
+                roundCount: router.roundCount,
+                participants: router.participants.map((p) => ({
+                    sessionId: p.sessionId,
+                    name: p.name,
+                    role: p.role,
+                    running: p.bridge.isRunning(),
+                    needsInput: config.sessions.get(p.sessionId)?.needsInput ?? false,
+                })),
+            });
+        }
+        // No active router — check if room exists in the registry (e.g. after server restart)
+        const roomEntry = config.rooms.getRoom(roomId);
+        if (!roomEntry)
             return c.json({ error: "Room not found" }, 404);
+        // Return basic room state without live participants
+        // Sessions are still readable via their individual SSE streams
         return c.json({
             roomId,
-            state: router.state,
-            roundCount: router.roundCount,
-            participants: router.participants.map((p) => ({
-                sessionId: p.sessionId,
-                name: p.name,
-                role: p.role,
-                running: p.bridge.isRunning(),
-            })),
+            state: "closed",
+            roundCount: 0,
+            participants: [],
         });
     });
     // Add an agent to a room
@@ -1732,8 +2481,12 @@ echo "Start claude in this project — the session will appear in the studio UI.
                 return c.json({ error: "Service at capacity, please try again later" }, 503);
             }
         }
-        const apiKey = config.devMode ? body.apiKey : process.env.ANTHROPIC_API_KEY;
-        const oauthToken = config.devMode ? body.oauthToken : undefined;
+        const apiKey = config.devMode
+            ? body.apiKey || process.env.ANTHROPIC_API_KEY
+            : process.env.ANTHROPIC_API_KEY;
+        const oauthToken = config.devMode
+            ? body.oauthToken || process.env.CLAUDE_OAUTH_TOKEN
+            : undefined;
         const ghToken = config.devMode ? body.ghToken : undefined;
         const sessionId = crypto.randomUUID();
         const randomSuffix = sessionId.slice(0, 6);
@@ -1786,7 +2539,7 @@ echo "Start claude in this project — the session will appear in the studio UI.
                     apiKey,
                     oauthToken,
                     ghToken,
-                    ...(!config.devMode && {
+                    ...((!config.devMode || GITHUB_APP_ID) && {
                         prodMode: {
                             sessionToken: deriveSessionToken(config.streamConfig.secret, sessionId),
                             studioUrl: resolveStudioUrl(config.port),
@@ -2008,12 +2761,13 @@ echo "Start claude in this project — the session will appear in the studio UI.
         await router.sendMessage(body.from, body.body, body.to);
         return c.json({ ok: true });
     });
-    // SSE proxy for room events
+    // SSE proxy for room events (works even after server restart — reads from durable stream)
     app.get("/api/rooms/:id/events", async (c) => {
         const roomId = c.req.param("id");
-        const router = roomRouters.get(roomId);
-        if (!router)
+        // Verify room exists in registry or has active router
+        if (!roomRouters.has(roomId) && !config.rooms.getRoom(roomId)) {
             return c.json({ error: "Room not found" }, 404);
+        }
         const connection = roomStream(config, roomId);
         const lastEventId = c.req.header("Last-Event-ID") || c.req.query("offset") || "-1";
         const reader = new DurableStream({
@@ -2567,16 +3321,38 @@ export async function startWebServer(opts) {
     if (devMode) {
         console.log("[studio] Dev mode enabled — keychain endpoint active");
     }
+    // Hydrate session registry from durable stream (survives restarts)
+    const registry = await Registry.create(opts.streamConfig);
     const config = {
         port: opts.port ?? 4400,
         dataDir: opts.dataDir ?? path.resolve(process.cwd(), ".electric-agent"),
-        sessions: new ActiveSessions(),
+        sessions: ActiveSessions.fromRegistry(registry),
         rooms: opts.rooms,
         sandbox: opts.sandbox,
         streamConfig: opts.streamConfig,
         bridgeMode: opts.bridgeMode ?? "claude-code",
         devMode,
     };
+    // Reconnect to surviving sandbox containers (Docker only)
+    if (config.sandbox.runtime === "docker") {
+        const dockerProvider = config.sandbox;
+        const allSessions = registry.listSessions();
+        dockerProvider.reconnect(allSessions);
+        // Mark sessions with live containers as "complete" (not stale),
+        // and sessions without containers as "error"
+        for (const session of allSessions) {
+            if (session.status === "running") {
+                const handle = dockerProvider.get(session.id);
+                config.sessions.update(session.id, {
+                    status: handle ? "complete" : "error",
+                });
+            }
+        }
+    }
+    else {
+        // Non-Docker: mark all running sessions as stale
+        registry.cleanupStaleSessions(0);
+    }
     fs.mkdirSync(config.dataDir, { recursive: true });
     const app = createApp(config);
     const hostname = process.env.NODE_ENV === "production" ? "0.0.0.0" : "127.0.0.1";