@farhanic017/octocode 3.5.0

package/src/server/routes/instance/httpapi/handlers/permission.ts

@@ -0,0 +1,41 @@
+import { PermissionV1 } from "@octocode-ai/core/v1/permission"
+import { Permission } from "@/permission"
+import { Effect } from "effect"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { InstanceHttpApi } from "../api"
+import { PermissionNotFoundError } from "../errors"
+
+export const permissionHandlers = HttpApiBuilder.group(InstanceHttpApi, "permission", (handlers) =>
+  Effect.gen(function* () {
+    const svc = yield* Permission.Service
+
+    const list = Effect.fn("PermissionHttpApi.list")(function* () {
+      return yield* svc.list()
+    })
+
+    const reply = Effect.fn("PermissionHttpApi.reply")(function* (ctx: {
+      params: { requestID: PermissionV1.ID }
+      payload: PermissionV1.ReplyBody
+    }) {
+      yield* svc
+        .reply({
+          requestID: ctx.params.requestID,
+          reply: ctx.payload.reply,
+          message: ctx.payload.message,
+        })
+        .pipe(
+          Effect.catchTag("Permission.NotFoundError", (error) =>
+            Effect.fail(
+              new PermissionNotFoundError({
+                requestID: String(error.requestID),
+                message: `Permission request not found: ${error.requestID}`,
+              }),
+            ),
+          ),
+        )
+      return true
+    })
+
+    return handlers.handle("list", list).handle("reply", reply)
+  }),
+)

package/src/server/routes/instance/httpapi/handlers/project-copy.ts

@@ -0,0 +1,157 @@
+import { ProjectCopy } from "@octocode-ai/core/project/copy"
+import { Git } from "@octocode-ai/core/git"
+import { ProjectV2 } from "@octocode-ai/core/project"
+import { AbsolutePath } from "@octocode-ai/core/schema"
+import { InstanceState } from "@/effect/instance-state"
+import { Effect, Stream } from "effect"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { InstanceHttpApi } from "../api"
+import { ApiProjectCopyError, CreatePayload, RemovePayload } from "../groups/project-copy"
+import { Agent } from "@/agent/agent"
+import { LLM } from "@/session/llm"
+import { LLMEvent } from "@octocode-ai/llm"
+import { MessageID, SessionID } from "@/session/schema"
+import { Provider } from "@/provider/provider"
+import { Slug } from "@octocode-ai/core/util/slug"
+
+const FALLBACK_AGENT: Agent.Info = {
+  name: "title",
+  mode: "primary" as const,
+  permission: [],
+  options: {},
+  native: true,
+  prompt: "",
+}
+
+function badRequest<A, R>(effect: Effect.Effect<A, ProjectCopy.Error, R>) {
+  return effect.pipe(
+    Effect.mapError(
+      (error) =>
+        new ApiProjectCopyError({
+          name: "ProjectCopyError",
+          data: {
+            message: message(error),
+            forceRequired: error instanceof Git.WorktreeError ? error.forceRequired : undefined,
+          },
+        }),
+    ),
+  )
+}
+
+export const projectCopyHandlers = HttpApiBuilder.group(InstanceHttpApi, "projectCopy", (handlers) =>
+  Effect.gen(function* () {
+    const llm = yield* LLM.Service
+    const agent = yield* Agent.Service
+    const provider = yield* Provider.Service
+    const service = yield* ProjectCopy.Service
+
+    const generateName = Effect.fn("ProjectCopyHttpApi.generateName")(function* (context: string | undefined) {
+      const text = context?.trim()
+      if (!text) return Slug.create()
+      const [titleAgent, fallback] = yield* Effect.all(
+        [
+          agent.get("title").pipe(Effect.catch(() => Effect.succeed(FALLBACK_AGENT))),
+          provider.defaultModel().pipe(Effect.catch(() => Effect.succeed(undefined))),
+        ],
+        { concurrency: 2 },
+      )
+      if (!fallback) return Slug.create()
+      const model = titleAgent.model
+        ? yield* provider.getModel(titleAgent.model.providerID, titleAgent.model.modelID)
+        : ((yield* provider.getSmallModel(fallback.providerID)) ??
+          (yield* provider.getModel(fallback.providerID, fallback.modelID)))
+      const sessionID = SessionID.descending()
+      const result = yield* llm
+        .stream({
+          agent: titleAgent,
+          user: {
+            id: MessageID.ascending(),
+            sessionID,
+            role: "user",
+            time: { created: Date.now() },
+            agent: titleAgent.name,
+            model: { providerID: model.providerID, modelID: model.id },
+          },
+          system: [],
+          small: true,
+          tools: {},
+          model,
+          sessionID,
+          retries: 2,
+          messages: [
+            {
+              role: "user",
+              content: `Generate a short 3-4 word name that describes this task:\n${text}`,
+            },
+          ],
+        })
+        .pipe(
+          Stream.filter(LLMEvent.is.textDelta),
+          Stream.map((event) => event.text),
+          Stream.mkString,
+        )
+      const output = result.trim()
+      return output ? slugify(output.split(/\s+/).slice(0, 4).join(" ")) : Slug.create()
+    })
+
+    const create = Effect.fn("ProjectCopyHttpApi.create")(function* (ctx: {
+      params: { projectID: ProjectV2.ID }
+      payload: typeof CreatePayload.Type
+    }) {
+      const name =
+        ctx.payload.name ??
+        (yield* generateName(ctx.payload.context).pipe(Effect.catch(() => Effect.succeed(Slug.create()))))
+      return yield* badRequest(
+        service.create({
+          ...ctx.payload,
+          name,
+          projectID: ctx.params.projectID,
+          sourceDirectory: AbsolutePath.make((yield* InstanceState.context).worktree),
+        }),
+      )
+    })
+
+    const remove = Effect.fn("ProjectCopyHttpApi.remove")(function* (ctx: {
+      params: { projectID: ProjectV2.ID }
+      payload: typeof RemovePayload.Type
+    }) {
+      yield* badRequest(
+        service.remove({
+          ...ctx.payload,
+          projectID: ctx.params.projectID,
+        }),
+      )
+    })
+
+    const refresh = Effect.fn("ProjectCopyHttpApi.refresh")(function* (ctx: { params: { projectID: ProjectV2.ID } }) {
+      yield* badRequest(
+        service.refresh({
+          projectID: ctx.params.projectID,
+        }),
+      )
+    })
+
+    return handlers.handle("create", create).handle("remove", remove).handle("refresh", refresh)
+  }),
+)
+
+function slugify(input: string) {
+  return input
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+/, "")
+    .replace(/-+$/, "")
+}
+
+function message(error: ProjectCopy.Error) {
+  if (error instanceof ProjectCopy.SourceDirectoryNotFoundError)
+    return `Project copy source not found: ${error.directory}`
+  if (error instanceof ProjectCopy.DestinationExistsError)
+    return `Project copy destination already exists: ${error.directory}`
+  if (error instanceof ProjectCopy.DirectoryUnavailableError)
+    return `Project copy directory unavailable: ${error.directory}`
+  if (error instanceof ProjectCopy.StrategyNotFoundError)
+    return `Project copy strategy not found for: ${error.directory}`
+  return error.message
+}

package/src/server/routes/instance/httpapi/handlers/project.ts

@@ -0,0 +1,63 @@
+import * as InstanceState from "@/effect/instance-state"
+import { Project } from "@/project/project"
+import { ProjectV2 } from "@octocode-ai/core/project"
+import { Effect } from "effect"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { InstanceHttpApi } from "../api"
+import { ProjectNotFoundError } from "../errors"
+import { markInstanceForReload } from "../lifecycle"
+
+export const projectHandlers = HttpApiBuilder.group(InstanceHttpApi, "project", (handlers) =>
+  Effect.gen(function* () {
+    const svc = yield* Project.Service
+    const project = yield* ProjectV2.Service
+
+    const list = Effect.fn("ProjectHttpApi.list")(function* () {
+      return yield* svc.list()
+    })
+
+    const current = Effect.fn("ProjectHttpApi.current")(function* () {
+      return (yield* InstanceState.context).project
+    })
+
+    const initGit = Effect.fn("ProjectHttpApi.initGit")(function* () {
+      const ctx = yield* InstanceState.context
+      const next = yield* svc.initGit({ directory: ctx.directory, project: ctx.project })
+      if (next.id === ctx.project.id && next.vcs === ctx.project.vcs && next.worktree === ctx.project.worktree)
+        return next
+      yield* markInstanceForReload(ctx, {
+        directory: ctx.directory,
+        worktree: ctx.directory,
+        project: next,
+      })
+      return next
+    })
+
+    const update = Effect.fn("ProjectHttpApi.update")(function* (ctx: {
+      params: { projectID: ProjectV2.ID }
+      payload: Project.UpdatePayload
+    }) {
+      return yield* svc.update({ ...ctx.payload, projectID: ctx.params.projectID }).pipe(
+        Effect.catchTag("Project.NotFoundError", (error) =>
+          Effect.fail(
+            new ProjectNotFoundError({
+              projectID: error.projectID,
+              message: `Project not found: ${error.projectID}`,
+            }),
+          ),
+        ),
+      )
+    })
+
+    const directories = Effect.fn("ProjectHttpApi.directories")((ctx: { params: { projectID: ProjectV2.ID } }) =>
+      project.directories({ projectID: ctx.params.projectID }),
+    )
+
+    return handlers
+      .handle("list", list)
+      .handle("current", current)
+      .handle("initGit", initGit)
+      .handle("update", update)
+      .handle("directories", directories)
+  }),
+)

package/src/server/routes/instance/httpapi/handlers/provider.ts

@@ -0,0 +1,113 @@
+import { ProviderAuth } from "@/provider/auth"
+import { Config } from "@/config/config"
+import { ModelsDev } from "@octocode-ai/core/models-dev"
+import { Provider } from "@/provider/provider"
+
+import { mapValues } from "remeda"
+import { Effect, Schema } from "effect"
+import { HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { InstanceHttpApi } from "../api"
+import { ProviderAuthApiError } from "../groups/provider"
+import { ProviderV2 } from "@octocode-ai/core/provider"
+
+function mapProviderAuthError<A, R>(self: Effect.Effect<A, ProviderAuth.Error, R>) {
+  return self.pipe(
+    Effect.mapError((error) => {
+      if (error instanceof ProviderAuth.OauthMissing) {
+        return new ProviderAuthApiError({ name: error._tag, data: { providerID: error.providerID } })
+      }
+      if (error instanceof ProviderAuth.OauthCodeMissing) {
+        return new ProviderAuthApiError({ name: error._tag, data: { providerID: error.providerID } })
+      }
+      if (error instanceof ProviderAuth.OauthCallbackFailed) {
+        return new ProviderAuthApiError({ name: error._tag, data: {} })
+      }
+      if (error instanceof ProviderAuth.ValidationFailed) {
+        return new ProviderAuthApiError({ name: error._tag, data: { field: error.field, message: error.message } })
+      }
+      return new ProviderAuthApiError({ name: "BadRequest", data: {} })
+    }),
+  )
+}
+
+export const providerHandlers = HttpApiBuilder.group(InstanceHttpApi, "provider", (handlers) =>
+  Effect.gen(function* () {
+    const cfg = yield* Config.Service
+    const provider = yield* Provider.Service
+    const svc = yield* ProviderAuth.Service
+
+    const list = Effect.fn("ProviderHttpApi.list")(function* () {
+      const config = yield* cfg.get()
+      const all = yield* ModelsDev.Service.use((s) => s.get())
+      const disabled = new Set(config.disabled_providers ?? [])
+      const enabled = config.enabled_providers ? new Set(config.enabled_providers) : undefined
+      const filtered: Record<string, (typeof all)[string]> = {}
+      for (const [key, value] of Object.entries(all)) {
+        if ((enabled ? enabled.has(key) : true) && !disabled.has(key)) filtered[key] = value
+      }
+      const connected = yield* provider.list()
+      const providers = Object.assign(
+        mapValues(filtered, (item) => Provider.fromModelsDevProvider(item)),
+        connected,
+      )
+      return {
+        all: Object.values(providers).map(Provider.toPublicInfo),
+        default: Provider.defaultModelIDs(providers),
+        connected: Object.keys(connected),
+      }
+    })
+
+    const auth = Effect.fn("ProviderHttpApi.auth")(function* () {
+      return yield* svc.methods()
+    })
+
+    const authorize = Effect.fn("ProviderHttpApi.authorize")(function* (ctx: {
+      params: { providerID: ProviderV2.ID }
+      payload: ProviderAuth.AuthorizeInput
+    }) {
+      return yield* mapProviderAuthError(
+        svc.authorize({
+          providerID: ctx.params.providerID,
+          method: ctx.payload.method,
+          inputs: ctx.payload.inputs,
+        }),
+      )
+    })
+
+    const authorizeRaw = Effect.fn("ProviderHttpApi.authorizeRaw")(function* (ctx: {
+      params: { providerID: ProviderV2.ID }
+      request: HttpServerRequest.HttpServerRequest
+    }) {
+      const body = yield* Effect.orDie(ctx.request.text)
+      const payload = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(ProviderAuth.AuthorizeInput))(body).pipe(
+        Effect.mapError(() => new ProviderAuthApiError({ name: "BadRequest", data: {} })),
+      )
+      // Match legacy route behavior: when authorize() resolves without a
+      // result (e.g. no further redirect), serialize as JSON `null` instead
+      // of an empty body so clients can `.json()` parse the response.
+      const result = yield* authorize({ params: ctx.params, payload })
+      return HttpServerResponse.jsonUnsafe(result ?? null)
+    })
+
+    const callback = Effect.fn("ProviderHttpApi.callback")(function* (ctx: {
+      params: { providerID: ProviderV2.ID }
+      payload: ProviderAuth.CallbackInput
+    }) {
+      yield* mapProviderAuthError(
+        svc.callback({
+          providerID: ctx.params.providerID,
+          method: ctx.payload.method,
+          code: ctx.payload.code,
+        }),
+      )
+      return true
+    })
+
+    return handlers
+      .handle("list", list)
+      .handle("auth", auth)
+      .handleRaw("authorize", authorizeRaw)
+      .handle("callback", callback)
+  }),
+)

package/src/server/routes/instance/httpapi/handlers/pty.ts

@@ -0,0 +1,258 @@
+import * as InstanceState from "@/effect/instance-state"
+import { registerDisposer } from "@/effect/instance-registry"
+import { InstanceRef, WorkspaceRef } from "@/effect/instance-ref"
+import { PtyPreparation } from "@/pty-preparation"
+import { Pty } from "@octocode-ai/core/pty"
+import { handlePtyInput } from "@octocode-ai/core/pty/input"
+import { PtyID } from "@octocode-ai/core/pty/schema"
+import { PtyTicket } from "@octocode-ai/core/pty/ticket"
+import { LocationServiceMap } from "@octocode-ai/core/location-layer"
+import { AbsolutePath } from "@octocode-ai/core/schema"
+import { Shell } from "@/shell/shell"
+import { EffectBridge } from "@/effect/bridge"
+import { CorsConfig, isAllowedRequestOrigin, type CorsOptions } from "@/server/cors"
+import {
+  PTY_CONNECT_TICKET_QUERY,
+  PTY_CONNECT_TOKEN_HEADER,
+  PTY_CONNECT_TOKEN_HEADER_VALUE,
+} from "@/server/shared/pty-ticket"
+import { Effect, Layer, Option, Schema } from "effect"
+import { HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import * as Socket from "effect/unstable/socket/Socket"
+import { InstanceHttpApi } from "../api"
+import * as ApiError from "../errors"
+import { CursorQuery, PtyConnectApi } from "../groups/pty"
+import { WebSocketTracker } from "../websocket-tracker"
+
+function validOrigin(request: HttpServerRequest.HttpServerRequest, opts: CorsOptions | undefined) {
+  return isAllowedRequestOrigin(request.headers.origin, request.headers.host, opts)
+}
+
+const ticketScope = Effect.gen(function* () {
+  const instance = yield* InstanceRef
+  const workspaceID = yield* WorkspaceRef
+  return { directory: instance?.directory, workspaceID }
+})
+
+export const ptyHandlers = HttpApiBuilder.group(InstanceHttpApi, "pty", (handlers) =>
+  Effect.gen(function* () {
+    const tickets = yield* PtyTicket.Service
+    const cors = yield* CorsConfig
+    const locations = yield* LocationServiceMap
+    const unregister = registerDisposer((directory) =>
+      Effect.runPromise(locations.invalidate({ directory: AbsolutePath.make(directory) })),
+    )
+    yield* Effect.addFinalizer(() => Effect.sync(unregister))
+
+    const pty = Effect.fnUntraced(function* <A, E, R>(effect: Effect.Effect<A, E, R>) {
+      return yield* effect.pipe(
+        Effect.provide(locations.get({ directory: AbsolutePath.make((yield* InstanceState.context).directory) })),
+      )
+    })
+
+    const shells = Effect.fn("PtyHttpApi.shells")(function* () {
+      return yield* Effect.promise(() => Shell.list())
+    })
+
+    const list = Effect.fn("PtyHttpApi.list")(function* () {
+      return yield* pty(Pty.Service.use((service) => service.list()))
+    })
+
+    const create = Effect.fn("PtyHttpApi.create")(function* (ctx: { payload: typeof Pty.CreateInput.Type }) {
+      return yield* pty(
+        Pty.Service.use((service) =>
+          Effect.flatMap(
+            PtyPreparation.prepareCreate({
+              ...ctx.payload,
+              args: ctx.payload.args ? [...ctx.payload.args] : undefined,
+              env: ctx.payload.env ? { ...ctx.payload.env } : undefined,
+            }),
+            service.create,
+          ),
+        ),
+      )
+    })
+
+    const get = Effect.fn("PtyHttpApi.get")(function* (ctx: { params: { ptyID: PtyID } }) {
+      return yield* pty(Pty.Service.use((service) => service.get(ctx.params.ptyID))).pipe(
+        Effect.catchTag("Pty.NotFoundError", (error) =>
+          Effect.fail(
+            new ApiError.PtyNotFoundError({
+              ptyID: error.ptyID,
+              message: `PTY session not found: ${error.ptyID}`,
+            }),
+          ),
+        ),
+      )
+    })
+
+    const update = Effect.fn("PtyHttpApi.update")(function* (ctx: {
+      params: { ptyID: PtyID }
+      payload: typeof Pty.UpdateInput.Type
+    }) {
+      return yield* pty(
+        Pty.Service.use((service) =>
+          service.update(ctx.params.ptyID, {
+            ...ctx.payload,
+            size: ctx.payload.size ? { ...ctx.payload.size } : undefined,
+          }),
+        ),
+      ).pipe(
+        Effect.catchTag("Pty.NotFoundError", (error) =>
+          Effect.fail(
+            new ApiError.PtyNotFoundError({
+              ptyID: error.ptyID,
+              message: `PTY session not found: ${error.ptyID}`,
+            }),
+          ),
+        ),
+      )
+    })
+
+    const remove = Effect.fn("PtyHttpApi.remove")(function* (ctx: { params: { ptyID: PtyID } }) {
+      yield* pty(Pty.Service.use((service) => service.remove(ctx.params.ptyID))).pipe(
+        Effect.catchTag("Pty.NotFoundError", (error) =>
+          Effect.fail(
+            new ApiError.PtyNotFoundError({
+              ptyID: error.ptyID,
+              message: `PTY session not found: ${error.ptyID}`,
+            }),
+          ),
+        ),
+      )
+      return true
+    })
+
+    const connectToken = Effect.fn("PtyHttpApi.connectToken")(function* (ctx: { params: { ptyID: PtyID } }) {
+      const request = yield* HttpServerRequest.HttpServerRequest
+      if (request.headers[PTY_CONNECT_TOKEN_HEADER] !== PTY_CONNECT_TOKEN_HEADER_VALUE || !validOrigin(request, cors))
+        return yield* new ApiError.PtyForbiddenError({ message: "Invalid PTY connect token request" })
+      yield* pty(Pty.Service.use((service) => service.get(ctx.params.ptyID))).pipe(
+        Effect.catchTag("Pty.NotFoundError", (error) =>
+          Effect.fail(
+            new ApiError.PtyNotFoundError({
+              ptyID: error.ptyID,
+              message: `PTY session not found: ${error.ptyID}`,
+            }),
+          ),
+        ),
+      )
+      return yield* tickets.issue({ ptyID: ctx.params.ptyID, ...(yield* ticketScope) })
+    })
+
+    return handlers
+      .handle("shells", shells)
+      .handle("list", list)
+      .handle("create", create)
+      .handle("get", get)
+      .handle("update", update)
+      .handle("remove", remove)
+      .handle("connectToken", connectToken)
+  }),
+).pipe(Layer.provide(LocationServiceMap.layer))
+
+export const ptyConnectHandlers = HttpApiBuilder.group(PtyConnectApi, "pty-connect", (handlers) =>
+  Effect.gen(function* () {
+    const tickets = yield* PtyTicket.Service
+    const cors = yield* CorsConfig
+    const locations = yield* LocationServiceMap
+    const unregister = registerDisposer((directory) =>
+      Effect.runPromise(locations.invalidate({ directory: AbsolutePath.make(directory) })),
+    )
+    yield* Effect.addFinalizer(() => Effect.sync(unregister))
+
+    const pty = Effect.fnUntraced(function* <A, E, R>(effect: Effect.Effect<A, E, R>) {
+      return yield* effect.pipe(
+        Effect.provide(locations.get({ directory: AbsolutePath.make((yield* InstanceState.context).directory) })),
+      )
+    })
+
+    return handlers.handleRaw(
+      "connect",
+      Effect.fn("PtyHttpApi.connect")(function* (ctx: {
+        params: { ptyID: PtyID }
+        request: HttpServerRequest.HttpServerRequest
+      }) {
+        const exists = yield* pty(Pty.Service.use((service) => service.get(ctx.params.ptyID))).pipe(
+          Effect.as(true),
+          Effect.catchTag("Pty.NotFoundError", () => Effect.succeed(false)),
+        )
+        if (!exists) return HttpServerResponse.empty({ status: 404 })
+
+        const query = Schema.decodeUnknownOption(CursorQuery)(yield* HttpServerRequest.ParsedSearchParams)
+        if (Option.isNone(query)) return HttpServerResponse.empty({ status: 400 })
+        const ticket = new URL(ctx.request.url, "http://localhost").searchParams.get(PTY_CONNECT_TICKET_QUERY)
+        if (ticket) {
+          const valid = validOrigin(ctx.request, cors)
+            ? yield* tickets.consume({ ticket, ptyID: ctx.params.ptyID, ...(yield* ticketScope) })
+            : false
+          if (!valid) return HttpServerResponse.empty({ status: 403 })
+        }
+        const parsedCursor = query.value.cursor === undefined ? undefined : Number(query.value.cursor)
+        const cursor =
+          parsedCursor !== undefined && Number.isSafeInteger(parsedCursor) && parsedCursor >= -1
+            ? parsedCursor
+            : undefined
+        const socket = yield* Effect.orDie(ctx.request.upgrade)
+        const write = yield* socket.writer
+        const closeAccepted = (event: Socket.CloseEvent) =>
+          socket
+            .runRaw(() => Effect.void, { onOpen: write(event).pipe(Effect.catch(() => Effect.void)) })
+            .pipe(
+              Effect.timeout("1 second"),
+              Effect.catchReason("SocketError", "SocketCloseError", () => Effect.void),
+              Effect.catch(() => Effect.void),
+            )
+        const registered = yield* WebSocketTracker.register(write(WebSocketTracker.SERVER_CLOSING_EVENT()))
+        if (!registered) {
+          yield* closeAccepted(WebSocketTracker.SERVER_CLOSING_EVENT())
+          return HttpServerResponse.empty()
+        }
+        const bridge = yield* EffectBridge.make()
+        const writeScoped = (effect: Effect.Effect<void, unknown>) => {
+          bridge.fork(effect.pipe(Effect.catch(() => Effect.void)))
+        }
+        let closed = false
+        const adapter = {
+          get readyState() {
+            return closed ? 3 : 1
+          },
+          send: (data: string | Uint8Array | ArrayBuffer) => {
+            if (closed) return
+            writeScoped(write(data instanceof ArrayBuffer ? new Uint8Array(data) : data))
+          },
+          close: (code?: number, reason?: string) => {
+            if (closed) return
+            closed = true
+            writeScoped(write(new Socket.CloseEvent(code, reason)))
+          },
+        }
+        const handler = yield* pty(
+          Pty.Service.use((service) => service.connect(ctx.params.ptyID, adapter, cursor)),
+        ).pipe(
+          Effect.catchTag("Pty.NotFoundError", () =>
+            closeAccepted(new Socket.CloseEvent(4404, "session not found")).pipe(Effect.as(undefined)),
+          ),
+        )
+        if (!handler) return HttpServerResponse.empty()
+
+        // The handshake runs inside `socket.runRaw`, after the input callback is
+        // registered, so the client cannot send frames before PTY input is wired.
+        yield* socket
+          .runRaw((message) => handlePtyInput(handler, message))
+          .pipe(
+            Effect.catchReason("SocketError", "SocketCloseError", () => Effect.void),
+            Effect.ensuring(
+              Effect.sync(() => {
+                closed = true
+                handler.onClose()
+              }),
+            ),
+            Effect.orDie,
+          )
+        return HttpServerResponse.empty()
+      }),
+    )
+  }),
+).pipe(Layer.provide(LocationServiceMap.layer))

package/src/server/routes/instance/httpapi/handlers/question.ts

@@ -0,0 +1,54 @@
+import { Question } from "@/question"
+import { QuestionID } from "@/question/schema"
+import { Effect } from "effect"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { InstanceHttpApi } from "../api"
+import { QuestionNotFoundError } from "../errors"
+
+export const questionHandlers = HttpApiBuilder.group(InstanceHttpApi, "question", (handlers) =>
+  Effect.gen(function* () {
+    const svc = yield* Question.Service
+
+    const list = Effect.fn("QuestionHttpApi.list")(function* () {
+      return yield* svc.list()
+    })
+
+    const reply = Effect.fn("QuestionHttpApi.reply")(function* (ctx: {
+      params: { requestID: QuestionID }
+      payload: Question.Reply
+    }) {
+      yield* svc
+        .reply({
+          requestID: ctx.params.requestID,
+          answers: ctx.payload.answers,
+        })
+        .pipe(
+          Effect.catchTag("Question.NotFoundError", (error) =>
+            Effect.fail(
+              new QuestionNotFoundError({
+                requestID: String(error.requestID),
+                message: `Question request not found: ${error.requestID}`,
+              }),
+            ),
+          ),
+        )
+      return true
+    })
+
+    const reject = Effect.fn("QuestionHttpApi.reject")(function* (ctx: { params: { requestID: QuestionID } }) {
+      yield* svc.reject(ctx.params.requestID).pipe(
+        Effect.catchTag("Question.NotFoundError", (error) =>
+          Effect.fail(
+            new QuestionNotFoundError({
+              requestID: String(error.requestID),
+              message: `Question request not found: ${error.requestID}`,
+            }),
+          ),
+        ),
+      )
+      return true
+    })
+
+    return handlers.handle("list", list).handle("reply", reply).handle("reject", reject)
+  }),
+)