@evalops/maestro 0.10.8 → 0.10.11

package/dist/server/handlers/session-attachments.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-attachments.js","sourceRoot":"","sources":["../../../src/server/handlers/session-attachments.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACR,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AAErE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEhD,SAAS,uBAAuB,CAC/B,OAAsC,EACtC,YAAoB;IAQpB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC9C,MAAM,gBAAgB,GAAI,GAAiC,CAAC,WAAW,CAAC;QACxE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAE/C,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAS;YAC9C,MAAM,CAAC,GAAG,GAOT,CAAC;YACF,IAAI,CAAC,CAAC,EAAE,KAAK,YAAY;gBAAE,SAAS;YACpC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC/D,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC/D,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC7D,OAAO;gBACN,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,aAAa,EAAE,CAAC,CAAC,OAAO;gBACxB,IAAI,EACH,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;oBACpD,CAAC,CAAC,CAAC,CAAC,IAAI;oBACR,CAAC,CAAC,SAAS;gBACb,aAAa,EACZ,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;oBAChE,CAAC,CAAC,CAAC,CAAC,aAAa;oBACjB,CAAC,CAAC,SAAS;aACb,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,GAAoB,EACpB,GAAmB,EACnB,MAA4C,EAC5C,IAA4B;IAE5B,MAAM,cAAc,GAAG,8BAA8B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEjE,IAAI,CAAC;QACJ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO;QACR,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAEzC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO;QACR,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAClE,OAAO;QACR,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO;QACR,CAAC;QAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACjE,OAAO;QACR,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAE9D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,MAAM,CAAC;QAE/D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YAClB,cAAc,EAAE,UAAU,CAAC,QAAQ;YACnC,gBAAgB,EAAE,KAAK,CAAC,MAAM;YAC9B,eAAe,EAAE,uBAAuB;YACxC,GAAG,CAAC,cAAc;gBACjB,CAAC,CAAC;oBACA,qBAAqB,EAAE,uBAAuB,CAAC,UAAU,CAAC,QAAQ,CAAC;iBACnE;gBACF,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,IAAI;SACP,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CACnD,GAAoB,EACpB,GAAmB,EACnB,MAA4C,EAC5C,IAA4B;IAE5B,MAAM,cAAc,GAAG,8BAA8B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEjE,IAAI,CAAC;QACJ,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO;QACR,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAEzC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO;QACR,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAClE,OAAO;QACR,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;QAEtD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO;QACR,CAAC;QAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACjE,OAAO;QACR,CAAC;QAED,IAAI,UAAU,CAAC,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9C,QAAQ,CACP,GAAG,EACH,GAAG,EACH;gBACC,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC;gBAC1B,SAAS,EAAE,KAAK;gBAChB,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,MAAM,EAAE,IAAI;aACZ,EACD,IAAI,EACJ,GAAG,CACH,CAAC;YACF,OAAO;QACR,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC;YAC3C,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC7B,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,WAAW,IAAI,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YAChE,IAAI,CAAC;gBACJ,cAAc,CAAC,wBAAwB,CACtC,WAAW,EACX,YAAY,EACZ,SAAS,CAAC,aAAa,CACvB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACR,8DAA8D;YAC/D,CAAC;QACF,CAAC;QAED,QAAQ,CACP,GAAG,EACH,GAAG,EACH;YACC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,IAAI,EAAE,SAAS,CAAC,SAAS;YACzB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,aAAa,EAAE,SAAS,CAAC,aAAa;SACtC,EACD,IAAI,EACJ,GAAG,CACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;AACF,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { extractDocumentText } from \"../../utils/document-extractor.js\";\nimport {\n\tbuildContentDisposition,\n\trespondWithApiError,\n\tsendJson,\n} from \"../server-utils.js\";\nimport { createSessionManagerForRequest } from \"../session-scope.js\";\n\nconst sessionIdPattern = /^[a-zA-Z0-9._-]+$/;\nconst attachmentIdPattern = /^[a-zA-Z0-9._-]+$/;\n\nfunction findAttachmentInSession(\n\tsession: { messages?: Array<unknown> },\n\tattachmentId: string,\n): {\n\tfileName: string;\n\tmimeType: string;\n\tcontentBase64: string;\n\tsize?: number;\n\textractedText?: string;\n} | null {\n\tconst messages = Array.isArray(session.messages) ? session.messages : [];\n\tfor (const msg of messages) {\n\t\tif (!msg || typeof msg !== \"object\") continue;\n\t\tconst maybeAttachments = (msg as { attachments?: unknown }).attachments;\n\t\tif (!Array.isArray(maybeAttachments)) continue;\n\n\t\tfor (const att of maybeAttachments) {\n\t\t\tif (!att || typeof att !== \"object\") continue;\n\t\t\tconst a = att as {\n\t\t\t\tid?: unknown;\n\t\t\t\tfileName?: unknown;\n\t\t\t\tmimeType?: unknown;\n\t\t\t\tcontent?: unknown;\n\t\t\t\tsize?: unknown;\n\t\t\t\textractedText?: unknown;\n\t\t\t};\n\t\t\tif (a.id !== attachmentId) continue;\n\t\t\tif (typeof a.fileName !== \"string\" || !a.fileName) return null;\n\t\t\tif (typeof a.mimeType !== \"string\" || !a.mimeType) return null;\n\t\t\tif (typeof a.content !== \"string\" || !a.content) return null;\n\t\t\treturn {\n\t\t\t\tfileName: a.fileName,\n\t\t\t\tmimeType: a.mimeType,\n\t\t\t\tcontentBase64: a.content,\n\t\t\t\tsize:\n\t\t\t\t\ttypeof a.size === \"number\" && Number.isFinite(a.size)\n\t\t\t\t\t\t? a.size\n\t\t\t\t\t\t: undefined,\n\t\t\t\textractedText:\n\t\t\t\t\ttypeof a.extractedText === \"string\" && a.extractedText.length > 0\n\t\t\t\t\t\t? a.extractedText\n\t\t\t\t\t\t: undefined,\n\t\t\t};\n\t\t}\n\t}\n\treturn null;\n}\n\nexport async function handleSessionAttachment(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tparams: { id: string; attachmentId: string },\n\tcors: Record<string, string>,\n) {\n\tconst sessionManager = createSessionManagerForRequest(req, true);\n\n\ttry {\n\t\tif (req.method !== \"GET\") {\n\t\t\tsendJson(res, 405, { error: \"Method not allowed\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tconst sessionId = params.id;\n\t\tconst attachmentId = params.attachmentId;\n\n\t\tif (!sessionIdPattern.test(sessionId)) {\n\t\t\tsendJson(res, 400, { error: \"Invalid session id\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\t\tif (!attachmentIdPattern.test(attachmentId)) {\n\t\t\tsendJson(res, 400, { error: \"Invalid attachment id\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tconst session = await sessionManager.loadSession(sessionId);\n\t\tif (!session) {\n\t\t\tsendJson(res, 404, { error: \"Session not found\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tconst attachment = findAttachmentInSession(session, attachmentId);\n\t\tif (!attachment) {\n\t\t\tsendJson(res, 404, { error: \"Attachment not found\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tconst bytes = Buffer.from(attachment.contentBase64, \"base64\");\n\n\t\tconst requestUrl = new URL(req.url || \"/\", \"http://localhost\");\n\t\tconst download = requestUrl.searchParams.get(\"download\");\n\t\tconst shouldDownload = download === \"1\" || download === \"true\";\n\n\t\tres.writeHead(200, {\n\t\t\t\"Content-Type\": attachment.mimeType,\n\t\t\t\"Content-Length\": bytes.length,\n\t\t\t\"Cache-Control\": \"private, max-age=3600\",\n\t\t\t...(shouldDownload\n\t\t\t\t? {\n\t\t\t\t\t\t\"Content-Disposition\": buildContentDisposition(attachment.fileName),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\t...cors,\n\t\t});\n\t\tres.end(bytes);\n\t} catch (error) {\n\t\trespondWithApiError(res, error, 500, cors, req);\n\t}\n}\n\nexport async function handleSessionAttachmentExtract(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tparams: { id: string; attachmentId: string },\n\tcors: Record<string, string>,\n) {\n\tconst sessionManager = createSessionManagerForRequest(req, true);\n\n\ttry {\n\t\tif (req.method !== \"POST\") {\n\t\t\tsendJson(res, 405, { error: \"Method not allowed\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tconst sessionId = params.id;\n\t\tconst attachmentId = params.attachmentId;\n\n\t\tif (!sessionIdPattern.test(sessionId)) {\n\t\t\tsendJson(res, 400, { error: \"Invalid session id\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\t\tif (!attachmentIdPattern.test(attachmentId)) {\n\t\t\tsendJson(res, 400, { error: \"Invalid attachment id\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tconst requestUrl = new URL(req.url || \"/\", \"http://localhost\");\n\t\tconst force = requestUrl.searchParams.get(\"force\");\n\t\tconst shouldForce = force === \"1\" || force === \"true\";\n\n\t\tconst session = await sessionManager.loadSession(sessionId);\n\t\tif (!session) {\n\t\t\tsendJson(res, 404, { error: \"Session not found\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tconst attachment = findAttachmentInSession(session, attachmentId);\n\t\tif (!attachment) {\n\t\t\tsendJson(res, 404, { error: \"Attachment not found\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tif (attachment.extractedText && !shouldForce) {\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t200,\n\t\t\t\t{\n\t\t\t\t\tfileName: attachment.fileName,\n\t\t\t\t\tformat: \"unknown\",\n\t\t\t\t\tsize: attachment.size ?? 0,\n\t\t\t\t\ttruncated: false,\n\t\t\t\t\textractedText: attachment.extractedText,\n\t\t\t\t\tcached: true,\n\t\t\t\t},\n\t\t\t\tcors,\n\t\t\t\treq,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\tconst bytes = Buffer.from(attachment.contentBase64, \"base64\");\n\t\tconst extracted = await extractDocumentText({\n\t\t\tbuffer: bytes,\n\t\t\tfileName: attachment.fileName,\n\t\t\tmimeType: attachment.mimeType,\n\t\t});\n\n\t\tconst sessionFile = sessionManager.getSessionFileById(sessionId);\n\t\tif (sessionFile && typeof extracted.extractedText === \"string\") {\n\t\t\ttry {\n\t\t\t\tsessionManager.saveAttachmentExtraction(\n\t\t\t\t\tsessionFile,\n\t\t\t\t\tattachmentId,\n\t\t\t\t\textracted.extractedText,\n\t\t\t\t);\n\t\t\t} catch {\n\t\t\t\t// ignore persistence errors; extraction result still returned\n\t\t\t}\n\t\t}\n\n\t\tsendJson(\n\t\t\tres,\n\t\t\t200,\n\t\t\t{\n\t\t\t\tfileName: attachment.fileName,\n\t\t\t\tformat: extracted.format,\n\t\t\t\tsize: extracted.sizeBytes,\n\t\t\t\ttruncated: extracted.truncated,\n\t\t\t\textractedText: extracted.extractedText,\n\t\t\t},\n\t\t\tcors,\n\t\t\treq,\n\t\t);\n\t} catch (error) {\n\t\trespondWithApiError(res, error, 500, cors, req);\n\t}\n}\n"]}
+{"version":3,"file":"session-attachments.js","sourceRoot":"","sources":["../../../src/server/handlers/session-attachments.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,GACR,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AAExE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEhD,SAAS,uBAAuB,CAC/B,OAAsC,EACtC,YAAoB;IAQpB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC9C,MAAM,gBAAgB,GAAI,GAAiC,CAAC,WAAW,CAAC;QACxE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAE/C,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAS;YAC9C,MAAM,CAAC,GAAG,GAOT,CAAC;YACF,IAAI,CAAC,CAAC,EAAE,KAAK,YAAY;gBAAE,SAAS;YACpC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC/D,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC/D,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC7D,OAAO;gBACN,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,aAAa,EAAE,CAAC,CAAC,OAAO;gBACxB,IAAI,EACH,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;oBACpD,CAAC,CAAC,CAAC,CAAC,IAAI;oBACR,CAAC,CAAC,SAAS;gBACb,aAAa,EACZ,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;oBAChE,CAAC,CAAC,CAAC,CAAC,aAAa;oBACjB,CAAC,CAAC,SAAS;aACb,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,GAAoB,EACpB,GAAmB,EACnB,MAA4C,EAC5C,IAA4B;IAE5B,MAAM,cAAc,GAAG,iCAAiC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEpE,IAAI,CAAC;QACJ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO;QACR,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAEzC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO;QACR,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAClE,OAAO;QACR,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO;QACR,CAAC;QAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACjE,OAAO;QACR,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAE9D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,MAAM,CAAC;QAE/D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YAClB,cAAc,EAAE,UAAU,CAAC,QAAQ;YACnC,gBAAgB,EAAE,KAAK,CAAC,MAAM;YAC9B,eAAe,EAAE,uBAAuB;YACxC,GAAG,CAAC,cAAc;gBACjB,CAAC,CAAC;oBACA,qBAAqB,EAAE,uBAAuB,CAAC,UAAU,CAAC,QAAQ,CAAC;iBACnE;gBACF,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,IAAI;SACP,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CACnD,GAAoB,EACpB,GAAmB,EACnB,MAA4C,EAC5C,IAA4B;IAE5B,MAAM,cAAc,GAAG,iCAAiC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEpE,IAAI,CAAC;QACJ,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO;QACR,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAEzC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO;QACR,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAClE,OAAO;QACR,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;QAEtD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO;QACR,CAAC;QAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACjE,OAAO;QACR,CAAC;QAED,IAAI,UAAU,CAAC,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9C,QAAQ,CACP,GAAG,EACH,GAAG,EACH;gBACC,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC;gBAC1B,SAAS,EAAE,KAAK;gBAChB,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,MAAM,EAAE,IAAI;aACZ,EACD,IAAI,EACJ,GAAG,CACH,CAAC;YACF,OAAO;QACR,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC;YAC3C,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC7B,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,WAAW,IAAI,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YAChE,IAAI,CAAC;gBACJ,cAAc,CAAC,wBAAwB,CACtC,WAAW,EACX,YAAY,EACZ,SAAS,CAAC,aAAa,CACvB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACR,8DAA8D;YAC/D,CAAC;QACF,CAAC;QAED,QAAQ,CACP,GAAG,EACH,GAAG,EACH;YACC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,IAAI,EAAE,SAAS,CAAC,SAAS;YACzB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,aAAa,EAAE,SAAS,CAAC,aAAa;SACtC,EACD,IAAI,EACJ,GAAG,CACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;AACF,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { extractDocumentText } from \"../../utils/document-extractor.js\";\nimport {\n\tbuildContentDisposition,\n\trespondWithApiError,\n\tsendJson,\n} from \"../server-utils.js\";\nimport { createWebSessionManagerForRequest } from \"../session-scope.js\";\n\nconst sessionIdPattern = /^[a-zA-Z0-9._-]+$/;\nconst attachmentIdPattern = /^[a-zA-Z0-9._-]+$/;\n\nfunction findAttachmentInSession(\n\tsession: { messages?: Array<unknown> },\n\tattachmentId: string,\n): {\n\tfileName: string;\n\tmimeType: string;\n\tcontentBase64: string;\n\tsize?: number;\n\textractedText?: string;\n} | null {\n\tconst messages = Array.isArray(session.messages) ? session.messages : [];\n\tfor (const msg of messages) {\n\t\tif (!msg || typeof msg !== \"object\") continue;\n\t\tconst maybeAttachments = (msg as { attachments?: unknown }).attachments;\n\t\tif (!Array.isArray(maybeAttachments)) continue;\n\n\t\tfor (const att of maybeAttachments) {\n\t\t\tif (!att || typeof att !== \"object\") continue;\n\t\t\tconst a = att as {\n\t\t\t\tid?: unknown;\n\t\t\t\tfileName?: unknown;\n\t\t\t\tmimeType?: unknown;\n\t\t\t\tcontent?: unknown;\n\t\t\t\tsize?: unknown;\n\t\t\t\textractedText?: unknown;\n\t\t\t};\n\t\t\tif (a.id !== attachmentId) continue;\n\t\t\tif (typeof a.fileName !== \"string\" || !a.fileName) return null;\n\t\t\tif (typeof a.mimeType !== \"string\" || !a.mimeType) return null;\n\t\t\tif (typeof a.content !== \"string\" || !a.content) return null;\n\t\t\treturn {\n\t\t\t\tfileName: a.fileName,\n\t\t\t\tmimeType: a.mimeType,\n\t\t\t\tcontentBase64: a.content,\n\t\t\t\tsize:\n\t\t\t\t\ttypeof a.size === \"number\" && Number.isFinite(a.size)\n\t\t\t\t\t\t? a.size\n\t\t\t\t\t\t: undefined,\n\t\t\t\textractedText:\n\t\t\t\t\ttypeof a.extractedText === \"string\" && a.extractedText.length > 0\n\t\t\t\t\t\t? a.extractedText\n\t\t\t\t\t\t: undefined,\n\t\t\t};\n\t\t}\n\t}\n\treturn null;\n}\n\nexport async function handleSessionAttachment(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tparams: { id: string; attachmentId: string },\n\tcors: Record<string, string>,\n) {\n\tconst sessionManager = createWebSessionManagerForRequest(req, true);\n\n\ttry {\n\t\tif (req.method !== \"GET\") {\n\t\t\tsendJson(res, 405, { error: \"Method not allowed\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tconst sessionId = params.id;\n\t\tconst attachmentId = params.attachmentId;\n\n\t\tif (!sessionIdPattern.test(sessionId)) {\n\t\t\tsendJson(res, 400, { error: \"Invalid session id\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\t\tif (!attachmentIdPattern.test(attachmentId)) {\n\t\t\tsendJson(res, 400, { error: \"Invalid attachment id\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tconst session = await sessionManager.loadSession(sessionId);\n\t\tif (!session) {\n\t\t\tsendJson(res, 404, { error: \"Session not found\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tconst attachment = findAttachmentInSession(session, attachmentId);\n\t\tif (!attachment) {\n\t\t\tsendJson(res, 404, { error: \"Attachment not found\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tconst bytes = Buffer.from(attachment.contentBase64, \"base64\");\n\n\t\tconst requestUrl = new URL(req.url || \"/\", \"http://localhost\");\n\t\tconst download = requestUrl.searchParams.get(\"download\");\n\t\tconst shouldDownload = download === \"1\" || download === \"true\";\n\n\t\tres.writeHead(200, {\n\t\t\t\"Content-Type\": attachment.mimeType,\n\t\t\t\"Content-Length\": bytes.length,\n\t\t\t\"Cache-Control\": \"private, max-age=3600\",\n\t\t\t...(shouldDownload\n\t\t\t\t? {\n\t\t\t\t\t\t\"Content-Disposition\": buildContentDisposition(attachment.fileName),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\t...cors,\n\t\t});\n\t\tres.end(bytes);\n\t} catch (error) {\n\t\trespondWithApiError(res, error, 500, cors, req);\n\t}\n}\n\nexport async function handleSessionAttachmentExtract(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tparams: { id: string; attachmentId: string },\n\tcors: Record<string, string>,\n) {\n\tconst sessionManager = createWebSessionManagerForRequest(req, true);\n\n\ttry {\n\t\tif (req.method !== \"POST\") {\n\t\t\tsendJson(res, 405, { error: \"Method not allowed\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tconst sessionId = params.id;\n\t\tconst attachmentId = params.attachmentId;\n\n\t\tif (!sessionIdPattern.test(sessionId)) {\n\t\t\tsendJson(res, 400, { error: \"Invalid session id\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\t\tif (!attachmentIdPattern.test(attachmentId)) {\n\t\t\tsendJson(res, 400, { error: \"Invalid attachment id\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tconst requestUrl = new URL(req.url || \"/\", \"http://localhost\");\n\t\tconst force = requestUrl.searchParams.get(\"force\");\n\t\tconst shouldForce = force === \"1\" || force === \"true\";\n\n\t\tconst session = await sessionManager.loadSession(sessionId);\n\t\tif (!session) {\n\t\t\tsendJson(res, 404, { error: \"Session not found\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tconst attachment = findAttachmentInSession(session, attachmentId);\n\t\tif (!attachment) {\n\t\t\tsendJson(res, 404, { error: \"Attachment not found\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\tif (attachment.extractedText && !shouldForce) {\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t200,\n\t\t\t\t{\n\t\t\t\t\tfileName: attachment.fileName,\n\t\t\t\t\tformat: \"unknown\",\n\t\t\t\t\tsize: attachment.size ?? 0,\n\t\t\t\t\ttruncated: false,\n\t\t\t\t\textractedText: attachment.extractedText,\n\t\t\t\t\tcached: true,\n\t\t\t\t},\n\t\t\t\tcors,\n\t\t\t\treq,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\tconst bytes = Buffer.from(attachment.contentBase64, \"base64\");\n\t\tconst extracted = await extractDocumentText({\n\t\t\tbuffer: bytes,\n\t\t\tfileName: attachment.fileName,\n\t\t\tmimeType: attachment.mimeType,\n\t\t});\n\n\t\tconst sessionFile = sessionManager.getSessionFileById(sessionId);\n\t\tif (sessionFile && typeof extracted.extractedText === \"string\") {\n\t\t\ttry {\n\t\t\t\tsessionManager.saveAttachmentExtraction(\n\t\t\t\t\tsessionFile,\n\t\t\t\t\tattachmentId,\n\t\t\t\t\textracted.extractedText,\n\t\t\t\t);\n\t\t\t} catch {\n\t\t\t\t// ignore persistence errors; extraction result still returned\n\t\t\t}\n\t\t}\n\n\t\tsendJson(\n\t\t\tres,\n\t\t\t200,\n\t\t\t{\n\t\t\t\tfileName: attachment.fileName,\n\t\t\t\tformat: extracted.format,\n\t\t\t\tsize: extracted.sizeBytes,\n\t\t\t\ttruncated: extracted.truncated,\n\t\t\t\textractedText: extracted.extractedText,\n\t\t\t},\n\t\t\tcors,\n\t\t\treq,\n\t\t);\n\t} catch (error) {\n\t\trespondWithApiError(res, error, 500, cors, req);\n\t}\n}\n"]}

package/dist/server/handlers/session-timeline.d.ts

@@ -0,0 +1,11 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { HostedRunnerContext } from "../app-context.js";
+interface SessionTimelineParams {
+    id?: string;
+}
+interface SessionTimelineOptions {
+    hostedRunner?: HostedRunnerContext;
+}
+export declare function handleSessionTimeline(req: IncomingMessage, res: ServerResponse, params: SessionTimelineParams, cors: Record<string, string>, options?: SessionTimelineOptions): Promise<void>;
+export {};
+//# sourceMappingURL=session-timeline.d.ts.map

package/dist/server/handlers/session-timeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-timeline.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/session-timeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAQ7D,UAAU,qBAAqB;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;CACZ;AAED,UAAU,sBAAsB;IAC/B,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACnC;AA8CD,wBAAsB,qBAAqB,CAC1C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,qBAAqB,EAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,CAAC,EAAE,sBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAgDf"}

package/dist/server/handlers/session-timeline.js

@@ -0,0 +1,77 @@
+import { tryListMaestroTimelineWithPlatform } from "../../platform/maestro-timeline-client.js";
+import { safeReadSessionEntries } from "../../session/session-context.js";
+import { getAuthSubject } from "../authz.js";
+import { getPendingComposerRequests } from "../pending-request-payload.js";
+import { ApiError, respondWithApiError, sendJson } from "../server-utils.js";
+import { createWebSessionManagerForRequest } from "../session-scope.js";
+import { buildComposerRunTimeline } from "../session-timeline.js";
+import { sessionIdPattern, verifySessionOwnership } from "./sessions.js";
+function requireSessionId(params) {
+    const sessionId = params.id?.trim();
+    if (!sessionId || !sessionIdPattern.test(sessionId)) {
+        throw new ApiError(400, "Invalid session id");
+    }
+    return sessionId;
+}
+function hostedRunnerMatchesSession(hostedRunner, sessionId) {
+    if (!hostedRunner?.enabled) {
+        return false;
+    }
+    const activeSessionId = hostedRunner.activeMaestroSessionId ??
+        hostedRunner.configuredMaestroSessionId;
+    return activeSessionId === sessionId;
+}
+async function tryBuildPlatformTimeline(sessionId, pendingRequestCount, options) {
+    const hostedRunner = options?.hostedRunner;
+    if (!hostedRunnerMatchesSession(hostedRunner, sessionId)) {
+        return null;
+    }
+    const agentRunId = hostedRunner?.agentRunId;
+    const remoteRunnerSessionId = hostedRunner?.runnerSessionId;
+    if (!agentRunId && !remoteRunnerSessionId) {
+        return null;
+    }
+    return await tryListMaestroTimelineWithPlatform({
+        sessionId,
+        agentRunId,
+        remoteRunnerSessionId,
+        workspaceId: hostedRunner?.workspaceId,
+        pendingRequestCount,
+    });
+}
+export async function handleSessionTimeline(req, res, params, cors, options) {
+    try {
+        if (req.method !== "GET") {
+            res.writeHead(405, cors);
+            res.end();
+            return;
+        }
+        const sessionId = requireSessionId(params);
+        const sessionManager = createWebSessionManagerForRequest(req, true);
+        const session = await sessionManager.loadSession(sessionId);
+        if (!session) {
+            throw new ApiError(404, "Session not found");
+        }
+        const subject = getAuthSubject(req);
+        if (!verifySessionOwnership(session, subject)) {
+            throw new ApiError(403, "Access denied: session belongs to another user");
+        }
+        const sessionPath = sessionManager.getSessionFileById(sessionId);
+        const entries = sessionPath ? safeReadSessionEntries(sessionPath) : [];
+        const pendingRequests = getPendingComposerRequests(session.id);
+        const responseBody = (await tryBuildPlatformTimeline(session.id, pendingRequests.length, options)) ??
+            buildComposerRunTimeline({
+                sessionId: session.id,
+                entries,
+                messages: session.messages || [],
+                pendingRequests,
+            });
+        sendJson(res, 200, responseBody, cors, req);
+    }
+    catch (error) {
+        if (!respondWithApiError(res, error, 500, cors, req)) {
+            sendJson(res, 500, { error: "Failed to load session timeline" }, cors, req);
+        }
+    }
+}
+//# sourceMappingURL=session-timeline.js.map

package/dist/server/handlers/session-timeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-timeline.js","sourceRoot":"","sources":["../../../src/server/handlers/session-timeline.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kCAAkC,EAAE,MAAM,2CAA2C,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAUzE,SAAS,gBAAgB,CAAC,MAA6B;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,0BAA0B,CAClC,YAA6C,EAC7C,SAAiB;IAEjB,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,eAAe,GACpB,YAAY,CAAC,sBAAsB;QACnC,YAAY,CAAC,0BAA0B,CAAC;IACzC,OAAO,eAAe,KAAK,SAAS,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,wBAAwB,CACtC,SAAiB,EACjB,mBAA2B,EAC3B,OAA2C;IAE3C,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;IAC3C,IAAI,CAAC,0BAA0B,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,EAAE,UAAU,CAAC;IAC5C,MAAM,qBAAqB,GAAG,YAAY,EAAE,eAAe,CAAC;IAC5D,IAAI,CAAC,UAAU,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,MAAM,kCAAkC,CAAC;QAC/C,SAAS;QACT,UAAU;QACV,qBAAqB;QACrB,WAAW,EAAE,YAAY,EAAE,WAAW;QACtC,mBAAmB;KACnB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,GAAoB,EACpB,GAAmB,EACnB,MAA6B,EAC7B,IAA4B,EAC5B,OAAgC;IAEhC,IAAI,CAAC;QACJ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACzB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACR,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,iCAAiC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,eAAe,GAAG,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,YAAY,GACjB,CAAC,MAAM,wBAAwB,CAC9B,OAAO,CAAC,EAAE,EACV,eAAe,CAAC,MAAM,EACtB,OAAO,CACP,CAAC;YACF,wBAAwB,CAAC;gBACxB,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,OAAO;gBACP,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;gBAChC,eAAe;aACf,CAAC,CAAC;QAEJ,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACtD,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAC5C,IAAI,EACJ,GAAG,CACH,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { ComposerRunTimelineResponse } from \"@evalops/contracts\";\nimport { tryListMaestroTimelineWithPlatform } from \"../../platform/maestro-timeline-client.js\";\nimport { safeReadSessionEntries } from \"../../session/session-context.js\";\nimport type { HostedRunnerContext } from \"../app-context.js\";\nimport { getAuthSubject } from \"../authz.js\";\nimport { getPendingComposerRequests } from \"../pending-request-payload.js\";\nimport { ApiError, respondWithApiError, sendJson } from \"../server-utils.js\";\nimport { createWebSessionManagerForRequest } from \"../session-scope.js\";\nimport { buildComposerRunTimeline } from \"../session-timeline.js\";\nimport { sessionIdPattern, verifySessionOwnership } from \"./sessions.js\";\n\ninterface SessionTimelineParams {\n\tid?: string;\n}\n\ninterface SessionTimelineOptions {\n\thostedRunner?: HostedRunnerContext;\n}\n\nfunction requireSessionId(params: SessionTimelineParams): string {\n\tconst sessionId = params.id?.trim();\n\tif (!sessionId || !sessionIdPattern.test(sessionId)) {\n\t\tthrow new ApiError(400, \"Invalid session id\");\n\t}\n\treturn sessionId;\n}\n\nfunction hostedRunnerMatchesSession(\n\thostedRunner: HostedRunnerContext | undefined,\n\tsessionId: string,\n): boolean {\n\tif (!hostedRunner?.enabled) {\n\t\treturn false;\n\t}\n\tconst activeSessionId =\n\t\thostedRunner.activeMaestroSessionId ??\n\t\thostedRunner.configuredMaestroSessionId;\n\treturn activeSessionId === sessionId;\n}\n\nasync function tryBuildPlatformTimeline(\n\tsessionId: string,\n\tpendingRequestCount: number,\n\toptions: SessionTimelineOptions | undefined,\n): Promise<ComposerRunTimelineResponse | null> {\n\tconst hostedRunner = options?.hostedRunner;\n\tif (!hostedRunnerMatchesSession(hostedRunner, sessionId)) {\n\t\treturn null;\n\t}\n\tconst agentRunId = hostedRunner?.agentRunId;\n\tconst remoteRunnerSessionId = hostedRunner?.runnerSessionId;\n\tif (!agentRunId && !remoteRunnerSessionId) {\n\t\treturn null;\n\t}\n\treturn await tryListMaestroTimelineWithPlatform({\n\t\tsessionId,\n\t\tagentRunId,\n\t\tremoteRunnerSessionId,\n\t\tworkspaceId: hostedRunner?.workspaceId,\n\t\tpendingRequestCount,\n\t});\n}\n\nexport async function handleSessionTimeline(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tparams: SessionTimelineParams,\n\tcors: Record<string, string>,\n\toptions?: SessionTimelineOptions,\n): Promise<void> {\n\ttry {\n\t\tif (req.method !== \"GET\") {\n\t\t\tres.writeHead(405, cors);\n\t\t\tres.end();\n\t\t\treturn;\n\t\t}\n\n\t\tconst sessionId = requireSessionId(params);\n\t\tconst sessionManager = createWebSessionManagerForRequest(req, true);\n\t\tconst session = await sessionManager.loadSession(sessionId);\n\t\tif (!session) {\n\t\t\tthrow new ApiError(404, \"Session not found\");\n\t\t}\n\n\t\tconst subject = getAuthSubject(req);\n\t\tif (!verifySessionOwnership(session, subject)) {\n\t\t\tthrow new ApiError(403, \"Access denied: session belongs to another user\");\n\t\t}\n\n\t\tconst sessionPath = sessionManager.getSessionFileById(sessionId);\n\t\tconst entries = sessionPath ? safeReadSessionEntries(sessionPath) : [];\n\t\tconst pendingRequests = getPendingComposerRequests(session.id);\n\t\tconst responseBody: ComposerRunTimelineResponse =\n\t\t\t(await tryBuildPlatformTimeline(\n\t\t\t\tsession.id,\n\t\t\t\tpendingRequests.length,\n\t\t\t\toptions,\n\t\t\t)) ??\n\t\t\tbuildComposerRunTimeline({\n\t\t\t\tsessionId: session.id,\n\t\t\t\tentries,\n\t\t\t\tmessages: session.messages || [],\n\t\t\t\tpendingRequests,\n\t\t\t});\n\n\t\tsendJson(res, 200, responseBody, cors, req);\n\t} catch (error) {\n\t\tif (!respondWithApiError(res, error, 500, cors, req)) {\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t500,\n\t\t\t\t{ error: \"Failed to load session timeline\" },\n\t\t\t\tcors,\n\t\t\t\treq,\n\t\t\t);\n\t\t}\n\t}\n}\n"]}

package/dist/server/handlers/sessions.d.ts

@@ -1,6 +1,17 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 export { checkShareRateLimit, resetShareRateLimit, stopShareRateLimiter, } from "./session-share-store.js";
 export type { SessionExportFormat, SessionShareOptions, SessionUpdateBody, } from "./session-share-store.js";
+export declare const sessionIdPattern: RegExp;
+/**
+ * Verify that the authenticated subject has access to the session.
+ * Prevents IDOR attacks by checking session ownership fields.
+ *
+ * Returns true if access is allowed, false otherwise.
+ */
+export declare function verifySessionOwnership(session: {
+    owner?: unknown;
+    subject?: unknown;
+}, subject: string): boolean;
 /**
  * Handle session list and CRUD operations
  */

package/dist/server/handlers/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/sessions.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAyCjE,OAAO,EACN,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACX,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GACjB,MAAM,0BAA0B,CAAC;AAmPlC;;GAEG;AACH,wBAAsB,cAAc,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBAgN5B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACvC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBAiG5B;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EACzB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBA8C5B;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CAClD,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAC/C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBA4D5B;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBAqI5B"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/sessions.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AA4CjE,OAAO,EACN,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACX,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,GACjB,MAAM,0BAA0B,CAAC;AAGlC,eAAO,MAAM,gBAAgB,QAAsB,CAAC;AAuBpD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACrC,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAC/C,OAAO,EAAE,MAAM,GACb,OAAO,CAiBT;AAyGD;;GAEG;AACH,wBAAsB,cAAc,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBA4N5B;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACvC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBAiG5B;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EACzB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBA8C5B;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CAClD,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,EAC/C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBA4D5B;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,iBAyI5B"}

package/dist/server/handlers/sessions.js

@@ -10,6 +10,7 @@
  * |--------|------|-------------|
  * | GET | `/api/sessions` | List all sessions with pagination |
  * | GET | `/api/sessions/:id` | Get a specific session with messages |
+ * | GET | `/api/sessions/:id/timeline` | Get a redacted run timeline |
  * | POST | `/api/sessions` | Create a new session |
  * | PATCH | `/api/sessions/:id` | Update session metadata (title, tags, favorite) |
  * | DELETE | `/api/sessions/:id` | Delete a session |
@@ -37,80 +38,21 @@ import crypto from "node:crypto";
 import { readFileSync } from "node:fs";
 import { scanOutboundSensitiveContent, summarizeOutboundSensitiveFindings, } from "../../safety/outbound-secret-preflight.js";
 import { safeReadSessionEntries } from "../../session/session-context.js";
+import { recordMaestroSessionEvent } from "../../telemetry/maestro-event-bus.js";
 import { createLogger } from "../../utils/logger.js";
 import { getAuthSubject } from "../authz.js";
-import { serverRequestManager } from "../server-request-manager.js";
+import { isHostedSessionManager } from "../hosted-session-manager.js";
+import { getPendingServerRequestPayload } from "../pending-request-payload.js";
 import { buildContentDisposition, readJsonBody, respondWithApiError, sendJson, } from "../server-utils.js";
-import { createSessionManagerForRequest, createSessionManagerForScope, decodeScopedSessionId, encodeScopedSessionId, resolveSessionScope, } from "../session-scope.js";
+import { webSessionEventEnv } from "../session-event-env.js";
+import { createWebSessionManagerForRequest, createWebSessionManagerForScope, decodeScopedSessionId, encodeScopedSessionId, resolveSessionScope, } from "../session-scope.js";
 import { convertAppMessagesToComposer } from "../session-serialization.js";
 import { exportToMarkdown, exportToText } from "./session-export-formatters.js";
 import { checkShareRateLimit, createSharedSessionInDb, deleteExpiredShares, deleteShareByToken, tryAccessShare, } from "./session-share-store.js";
 export { checkShareRateLimit, resetShareRateLimit, stopShareRateLimiter, } from "./session-share-store.js";
 const logger = createLogger("sessions-handler");
-const sessionIdPattern = /^[a-zA-Z0-9._-]+$/;
+export const sessionIdPattern = /^[a-zA-Z0-9._-]+$/;
 const attachmentIdPattern = /^[a-zA-Z0-9._-]+$/;
-function getPendingServerRequestPayload(sessionId) {
-    const pending = serverRequestManager.listPending({ sessionId });
-    const pendingApprovalRequests = pending
-        .filter((entry) => entry.kind === "approval")
-        .map((entry) => ({
-        id: entry.id,
-        toolName: entry.toolName,
-        displayName: entry.displayName,
-        summaryLabel: entry.summaryLabel,
-        actionDescription: entry.actionDescription,
-        args: entry.args,
-        reason: entry.reason,
-    }));
-    const pendingClientToolRequests = pending
-        .filter((entry) => entry.kind === "client_tool" ||
-        entry.kind === "mcp_elicitation" ||
-        entry.kind === "user_input")
-        .map((entry) => ({
-        toolCallId: entry.callId,
-        toolName: entry.toolName,
-        args: entry.args,
-        kind: entry.kind,
-        reason: entry.reason,
-    }));
-    const pendingToolRetryRequests = pending
-        .filter((entry) => entry.kind === "tool_retry")
-        .map((entry) => {
-        const args = entry.args &&
-            typeof entry.args === "object" &&
-            !Array.isArray(entry.args)
-            ? entry.args
-            : {};
-        return {
-            id: entry.id,
-            toolCallId: typeof args.tool_call_id === "string"
-                ? args.tool_call_id
-                : entry.callId,
-            toolName: entry.toolName,
-            args: args.args,
-            errorMessage: typeof args.error_message === "string"
-                ? args.error_message
-                : entry.reason,
-            attempt: typeof args.attempt === "number" && Number.isFinite(args.attempt)
-                ? args.attempt
-                : 1,
-            maxAttempts: typeof args.max_attempts === "number" &&
-                Number.isFinite(args.max_attempts)
-                ? args.max_attempts
-                : undefined,
-            summary: typeof args.summary === "string" ? args.summary : undefined,
-        };
-    });
-    return {
-        ...(pendingApprovalRequests.length > 0 ? { pendingApprovalRequests } : {}),
-        ...(pendingClientToolRequests.length > 0
-            ? { pendingClientToolRequests }
-            : {}),
-        ...(pendingToolRetryRequests.length > 0
-            ? { pendingToolRetryRequests }
-            : {}),
-    };
-}
 function sendSensitiveContentBlockedResponse(req, res, cors, action, findings) {
     sendJson(res, 409, {
         error: `Sensitive content detected. Review and confirm before continuing with this ${action}.`,
@@ -124,7 +66,7 @@ function sendSensitiveContentBlockedResponse(req, res, cors, action, findings) {
  *
  * Returns true if access is allowed, false otherwise.
  */
-function verifySessionOwnership(session, subject) {
+export function verifySessionOwnership(session, subject) {
     // Check explicit owner field
     if (typeof session.owner === "string" && session.owner) {
         return session.owner === subject;
@@ -209,7 +151,7 @@ async function resolveSharedSessionAccess(req, res, shareToken, cors) {
  * Handle session list and CRUD operations
  */
 export async function handleSessions(req, res, params, cors) {
-    const sessionManager = createSessionManagerForRequest(req, true);
+    const sessionManager = createWebSessionManagerForRequest(req, true);
     const sessionId = params.id;
     const url = new URL(req.url || "/api/sessions", "http://localhost");
     const limitParam = url.searchParams.get("limit");
@@ -312,20 +254,25 @@ export async function handleSessions(req, res, params, cors) {
                 sendJson(res, 403, { error: "Access denied: session belongs to another user" }, cors, req);
                 return;
             }
-            const sessionPath = sessionManager.getSessionFileById(sessionId);
-            if (!sessionPath) {
-                sendJson(res, 404, { error: "Session file not found" }, cors, req);
-                return;
-            }
-            // Apply updates - SessionManager supports favorite, title, and tags via meta entries
-            if (updates.favorite !== undefined) {
-                sessionManager.setSessionFavorite(sessionPath, updates.favorite);
-            }
-            if (updates.title !== undefined) {
-                sessionManager.setSessionTitle(sessionPath, updates.title);
+            if (isHostedSessionManager(sessionManager)) {
+                await sessionManager.updateSessionMetadata(sessionId, updates);
             }
-            if (updates.tags !== undefined) {
-                sessionManager.setSessionTags(sessionPath, updates.tags);
+            else {
+                const sessionPath = sessionManager.getSessionFileById(sessionId);
+                if (!sessionPath) {
+                    sendJson(res, 404, { error: "Session file not found" }, cors, req);
+                    return;
+                }
+                // Apply updates - SessionManager supports favorite, title, and tags via meta entries
+                if (updates.favorite !== undefined) {
+                    sessionManager.setSessionFavorite(sessionPath, updates.favorite);
+                }
+                if (updates.title !== undefined) {
+                    sessionManager.setSessionTitle(sessionPath, updates.title);
+                }
+                if (updates.tags !== undefined) {
+                    sessionManager.setSessionTags(sessionPath, updates.tags);
+                }
             }
             // Return the updated values directly (writes are applied synchronously to the file)
             sendJson(res, 200, {
@@ -356,6 +303,14 @@ export async function handleSessions(req, res, params, cors) {
                 return;
             }
             await sessionManager.deleteSession(sessionId);
+            recordMaestroSessionEvent("MAESTRO_SESSION_STATE_CLOSED", {
+                sessionId,
+                closeReason: "MAESTRO_CLOSE_REASON_USER_STOPPED",
+                closeMessage: "Web session deleted",
+                correlation: { principal_id: subject },
+                env: webSessionEventEnv(),
+                metadata: { operation: "session.delete" },
+            });
             res.writeHead(204, cors);
             res.end();
         }
@@ -375,7 +330,7 @@ export async function handleSessions(req, res, params, cors) {
  * Handle session sharing - generate a shareable link
  */
 export async function handleSessionShare(req, res, params, cors) {
-    const sessionManager = createSessionManagerForRequest(req, true);
+    const sessionManager = createWebSessionManagerForRequest(req, true);
     const sessionId = params.id;
     try {
         if (req.method !== "POST") {
@@ -450,7 +405,7 @@ export async function handleSharedSession(req, res, params, cors) {
             return;
         }
         const { scope, sessionId } = decodeScopedSessionId(resolvedSessionId);
-        const sessionManager = createSessionManagerForScope(scope, true);
+        const sessionManager = createWebSessionManagerForScope(scope, true);
         const session = await sessionManager.loadSession(sessionId);
         if (!session) {
             sendJson(res, 404, { error: "Session not found" }, cors, req);
@@ -499,7 +454,7 @@ export async function handleSharedSessionAttachment(req, res, params, cors) {
             return;
         }
         const { scope, sessionId } = decodeScopedSessionId(resolvedSessionId);
-        const sessionManager = createSessionManagerForScope(scope, true);
+        const sessionManager = createWebSessionManagerForScope(scope, true);
         const session = await sessionManager.loadSession(sessionId);
         if (!session) {
             sendJson(res, 404, { error: "Session not found" }, cors, req);
@@ -535,7 +490,7 @@ export async function handleSharedSessionAttachment(req, res, params, cors) {
  * Handle session export
  */
 export async function handleSessionExport(req, res, params, cors) {
-    const sessionManager = createSessionManagerForRequest(req, true);
+    const sessionManager = createWebSessionManagerForRequest(req, true);
     const sessionId = params.id;
     try {
         if (req.method !== "POST") {
@@ -560,23 +515,32 @@ export async function handleSessionExport(req, res, params, cors) {
         const options = await readJsonBody(req);
         const format = options.format || "json";
         const messages = session.messages || [];
-        const jsonlEntries = format === "jsonl"
-            ? (() => {
-                const sessionFile = sessionManager.getSessionFileById(sessionId);
-                if (!sessionFile) {
+        let jsonlEntries = undefined;
+        let jsonlSessionFile = null;
+        if (format === "jsonl") {
+            if (isHostedSessionManager(sessionManager)) {
+                jsonlEntries = await sessionManager.loadEntries(sessionId);
+                if (!jsonlEntries) {
+                    sendJson(res, 404, { error: "Session not found" }, cors, req);
+                    return;
+                }
+            }
+            else {
+                jsonlSessionFile = sessionManager.getSessionFileById(sessionId);
+                if (!jsonlSessionFile) {
                     sendJson(res, 404, { error: "Session file not found" }, cors, req);
-                    return null;
+                    return;
                 }
-                return safeReadSessionEntries(sessionFile);
-            })()
-            : undefined;
-        if (format === "jsonl" && !jsonlEntries) {
-            return;
+                jsonlEntries = safeReadSessionEntries(jsonlSessionFile);
+                if (!jsonlEntries) {
+                    return;
+                }
+            }
         }
         if (!options.allowSensitiveContent) {
             const scan = scanOutboundSensitiveContent({
                 title: session.title,
-                messages: format === "jsonl" ? jsonlEntries : messages,
+                messages: format === "jsonl" ? (jsonlEntries ?? []) : messages,
             });
             if (scan.blockingFindings.length > 0) {
                 sendSensitiveContentBlockedResponse(req, res, cors, "export", summarizeOutboundSensitiveFindings(scan.blockingFindings));
@@ -588,12 +552,16 @@ export async function handleSessionExport(req, res, params, cors) {
         let filename;
         switch (format) {
             case "jsonl": {
-                const sessionFile = sessionManager.getSessionFileById(sessionId);
-                if (!sessionFile) {
-                    sendJson(res, 404, { error: "Session file not found" }, cors, req);
-                    return;
+                if (isHostedSessionManager(sessionManager)) {
+                    content = `${(jsonlEntries ?? []).map((entry) => JSON.stringify(entry)).join("\n")}\n`;
+                }
+                else {
+                    if (!jsonlSessionFile) {
+                        sendJson(res, 404, { error: "Session file not found" }, cors, req);
+                        return;
+                    }
+                    content = readFileSync(jsonlSessionFile, "utf8");
                 }
-                content = readFileSync(sessionFile, "utf8");
                 contentType = "application/x-ndjson";
                 filename = `session-${sessionId}.jsonl`;
                 break;