@galda/cli 0.10.0

package/engine/manager.mjs

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+// Manager for AI — minimal verify-proof loop (dogfood v0)
+//
+//   node engine/manager.mjs examples/task-001
+//
+// Loop: hand the task to a Claude Code worker (flat-rate, `claude -p`)
+//   → Manager independently verifies against the explicit pass condition
+//     (headless Chrome; the worker's self-report is never trusted)
+//   → on fail, retry with the failure evidence, up to maxAttempts
+//   → on pass, emit proof (video + screenshot) — only then is the task "done".
+
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, writeFileSync, readFileSync } from 'node:fs';
+import { resolve, dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { createProofPR } from './pr.mjs';
+import { runVerification } from './verify.mjs';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const WORKER_TIMEOUT_MS = 8 * 60 * 1000;
+
+const taskDir = resolve(process.argv[2] ?? '');
+if (!taskDir) { console.error('usage: node engine/manager.mjs <taskDir>'); process.exit(2); }
+
+const task = JSON.parse(readFileSync(join(taskDir, 'task.json'), 'utf8'));
+const appDir = resolve(ROOT, task.app);
+const entryUrl = pathToFileURL(join(appDir, task.entry)).href;
+const { default: verify } = await import(pathToFileURL(join(taskDir, task.verify)).href);
+
+const runDir = join(taskDir, 'runs', new Date().toISOString().replace(/[:.]/g, '-'));
+mkdirSync(runDir, { recursive: true });
+
+const log = (m) => console.log(`[manager] ${m}`);
+
+function workerPrompt(attempt, lastFailure) {
+  return [
+    `You are a worker inside an autonomous verify loop ("Manager for AI"). Attempt ${attempt}/${task.maxAttempts}.`,
+    ``,
+    `TASK: ${task.prompt}`,
+    ``,
+    `EXPLICIT PASS CONDITION (checked externally by a headless browser after you finish — NOT by you): ${task.passCondition}`,
+    lastFailure ? `\nPREVIOUS ATTEMPT FAILED VERIFICATION: ${lastFailure}\nThe code on disk includes your previous changes. Diagnose why verification failed and fix it.` : '',
+    ``,
+    `RULES: Edit only files inside this directory. Keep the change minimal. Do not claim completion — the external verifier decides. When you believe the fix is in place, just stop.`,
+  ].join('\n');
+}
+
+function runWorker(attempt, lastFailure) {
+  const prompt = workerPrompt(attempt, lastFailure);
+  log(`attempt ${attempt}: handing task to Claude Code worker…`);
+  const t0 = Date.now();
+  const res = spawnSync('claude', [
+    '-p', prompt,
+    '--model', 'sonnet',
+    '--permission-mode', 'acceptEdits',
+    '--allowedTools', 'Edit,Write,Read,Glob,Grep',
+  ], { cwd: appDir, encoding: 'utf8', timeout: WORKER_TIMEOUT_MS });
+  const secs = ((Date.now() - t0) / 1000).toFixed(1);
+  const out = (res.stdout ?? '') + (res.stderr ? `\n[stderr]\n${res.stderr}` : '');
+  writeFileSync(join(runDir, `attempt-${attempt}-worker.log`), out);
+  if (res.error) throw res.error;
+  log(`attempt ${attempt}: worker finished in ${secs}s (exit ${res.status})`);
+  return { secs, exit: res.status };
+}
+
+async function verifyAttempt(attempt) {
+  log(`attempt ${attempt}: verifying against pass condition (headless)…`);
+  return runVerification({ entryUrl, verify, outBase: join(runDir, `attempt-${attempt}`) });
+}
+
+const attempts = [];
+let final = null;
+for (let attempt = 1; attempt <= task.maxAttempts; attempt++) {
+  const worker = runWorker(attempt, attempts.at(-1)?.detail);
+  const v = await verifyAttempt(attempt);
+  attempts.push({ attempt, workerSecs: worker.secs, ...v });
+  log(`attempt ${attempt}: ${v.pass ? 'PASS' : 'FAIL'} — ${v.detail}`);
+  if (v.pass) { final = attempts.at(-1); break; }
+}
+
+const report = {
+  task: { id: task.id, title: task.title, passCondition: task.passCondition },
+  status: final ? 'done' : 'failed',
+  attempts: attempts.map(({ attempt, workerSecs, pass, detail, shotPath, videoPath }) =>
+    ({ attempt, workerSecs, pass, detail, proofScreenshot: shotPath, proofVideo: videoPath })),
+  runDir,
+  finishedAt: new Date().toISOString(),
+};
+writeFileSync(join(runDir, 'report.json'), JSON.stringify(report, null, 2));
+
+if (final) {
+  log(`✅ DONE with proof — ${final.detail}`);
+  log(`proof: ${final.shotPath}${final.videoPath ? ` + ${final.videoPath}` : ''}`);
+  if (task.pr) {
+    try {
+      const { url } = createProofPR({
+        repoDir: appDir,
+        taskId: task.id,
+        title: task.title,
+        passCondition: task.passCondition,
+        attempts: report.attempts,
+        finalProof: final,
+      });
+      report.pr = url;
+      writeFileSync(join(runDir, 'report.json'), JSON.stringify(report, null, 2));
+      log(`PR opened: ${url}`);
+    } catch (e) {
+      log(`PR creation skipped (proof still saved locally): ${e.message}`);
+    }
+  }
+} else {
+  log(`🟠 NOT done after ${task.maxAttempts} attempts — needs a human decision (never claimed "done" without proof).`);
+}
+log(`report: ${join(runDir, 'report.json')}`);
+process.exit(final ? 0 : 1);

package/engine/mcp.mjs

@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+// Manager for AI — MCP server (stdio, zero dependencies)
+//
+// Bridges any MCP client (Claude Code, Claude Desktop, …) to the local
+// Manager server. Register once:
+//   claude mcp add -s user manager-for-ai \
+//     -e MANAGER_BASE=http://localhost:4400 -e MANAGER_KEY=<key> \
+//     -- node /path/to/galda2/engine/mcp.mjs
+//
+// Then just talk: "create a goal in galda2: …", "what's the status?",
+// "reply to goal 12: …".
+
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve, dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createInterface } from 'node:readline';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const DATA_DIR = process.env.MANAGER_HOME
+  ?? (existsSync(join(ROOT, '.git')) ? join(ROOT, 'engine') : join(process.env.HOME ?? '', '.manager-for-ai'));
+const BASE = process.env.MANAGER_BASE ?? 'http://localhost:4400';
+const KEY = process.env.MANAGER_KEY
+  ?? (existsSync(join(DATA_DIR, 'secret.key')) ? readFileSync(join(DATA_DIR, 'secret.key'), 'utf8').trim() : '');
+
+async function api(path, opts = {}) {
+  const sep = path.includes('?') ? '&' : '?';
+  const r = await fetch(`${BASE}${path}${sep}key=${KEY}`, opts);
+  if (!r.ok) throw new Error(`Manager server ${r.status}: ${(await r.text()).slice(0, 200)}`);
+  return r.json();
+}
+
+const fmtGoal = (g, tasks) => {
+  const gt = tasks.filter((t) => t.goalId === g.id);
+  const lines = gt.map((t) => `  - [${t.status}] ${t.num} ${t.title}${t.secs ? ` (${t.secs}s)` : ''}${t.proof ? ` proof:${t.proof.pass ? 'PASS' : 'FAIL'}` : ''}`);
+  return [`goal ${g.id} [${g.status}] (${g.projectId}) ${g.text.replace(/\s+/g, ' ').slice(0, 120)}`,
+    g.pr ? `  PR: ${g.pr}` : '', ...lines].filter(Boolean).join('\n');
+};
+
+const TOOLS = [
+  {
+    name: 'manager_create_goal',
+    description: 'Hand a goal to Manager for AI. It is decomposed into tasks, implemented by Claude Code workers, tested, optionally verified against a pass condition (with video proof), and optionally turned into a pull request. Write the goal in natural language; include explicit pass conditions ("clicking X shows Y") when you want independent verification.',
+    inputSchema: { type: 'object', properties: {
+      project: { type: 'string', description: 'project id (e.g. galda1, galda2)' },
+      text: { type: 'string', description: 'the goal, natural language' },
+      deliverable: { type: 'string', enum: ['auto', 'pr', 'none'], description: 'pull request or not (default auto-detect)' },
+      model: { type: 'string', enum: ['sonnet', 'opus', 'haiku'], description: 'worker model (default sonnet)' },
+    }, required: ['project', 'text'] },
+    run: async (a) => {
+      const g = await api('/api/tasks', { method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ projectId: a.project, text: a.text, pr: a.deliverable, model: a.model, source: 'mcp' }) });
+      return `Accepted: goal ${g.id} [${g.status}] in ${g.projectId}. It runs in the background; check with manager_status.`;
+    },
+  },
+  {
+    name: 'manager_request_review',
+    description: 'Put an item in the Manager Review lane for a human to look at / approve — WITHOUT running any worker. Use for "please confirm / decide / eyeball this" that needs human judgment, not implementation (a design call, a go/no-go, a thing you already did and want signed off). It appears in the Review column; the human taps Approve (files it to Done) or Dismiss (drops it). No Claude worker is spawned, no PR is opened. Prefer this over manager_create_goal whenever you only need a decision, not work.',
+    inputSchema: { type: 'object', properties: {
+      project: { type: 'string', description: 'project id (e.g. galda1, galda2)' },
+      text: { type: 'string', description: 'the one-line ask / what to decide (shown as the requirement)' },
+      note: { type: 'string', description: 'optional detail / context / what you did, for the reviewer to read' },
+    }, required: ['project', 'text'] },
+    run: async (a) => {
+      const g = await api('/api/tasks', { method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ projectId: a.project, text: a.text, note: a.note, review: true, source: 'mcp' }) });
+      return `Filed for review: goal ${g.id} [${g.status}] in ${g.projectId}. No worker started — waiting on a human Approve/Dismiss.`;
+    },
+  },
+  {
+    name: 'manager_status',
+    description: 'List goals and their tasks (status, proof, PR links). Optionally filter by project id.',
+    inputSchema: { type: 'object', properties: { project: { type: 'string' } } },
+    run: async (a) => {
+      const s = await api('/api/state');
+      const goals = s.goals.filter((g) => !a.project || g.projectId === a.project).slice(-12);
+      return goals.length ? goals.map((g) => fmtGoal(g, s.tasks)).join('\n\n') : 'No goals yet.';
+    },
+  },
+  {
+    name: 'manager_reply',
+    description: 'Reply in a goal thread. The reply resumes the worker session for that goal, so context carries over.',
+    inputSchema: { type: 'object', properties: {
+      goalId: { type: 'number' }, text: { type: 'string' },
+    }, required: ['goalId', 'text'] },
+    run: async (a) => {
+      const t = await api(`/api/goals/${a.goalId}/reply`, { method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ text: a.text }) });
+      return `Reply queued as task ${t.id} on goal ${a.goalId}.`;
+    },
+  },
+];
+
+function reply(id, result) { process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id, result }) + '\n'); }
+function replyErr(id, message) { process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id, error: { code: -32000, message } }) + '\n'); }
+
+const rl = createInterface({ input: process.stdin });
+rl.on('line', async (line) => {
+  let msg;
+  try { msg = JSON.parse(line); } catch { return; }
+  const { id, method, params } = msg;
+  try {
+    if (method === 'initialize') {
+      reply(id, {
+        protocolVersion: params?.protocolVersion ?? '2024-11-05',
+        capabilities: { tools: {} },
+        serverInfo: { name: 'manager-for-ai', version: '0.4.0' },
+      });
+    } else if (method === 'tools/list') {
+      reply(id, { tools: TOOLS.map(({ name, description, inputSchema }) => ({ name, description, inputSchema })) });
+    } else if (method === 'tools/call') {
+      const tool = TOOLS.find((t) => t.name === params?.name);
+      if (!tool) return replyErr(id, `unknown tool: ${params?.name}`);
+      const text = await tool.run(params?.arguments ?? {});
+      reply(id, { content: [{ type: 'text', text }] });
+    } else if (method === 'ping') {
+      reply(id, {});
+    } else if (id !== undefined) {
+      replyErr(id, `unsupported method: ${method}`);
+    }
+  } catch (e) {
+    if (id !== undefined) replyErr(id, String(e.message ?? e).slice(0, 300));
+  }
+});

package/engine/pr.mjs

@@ -0,0 +1,144 @@
+// Manager for AI — proof-carrying PR creation (worktree-based)
+//
+// NEVER touches the user's working tree or current branch: all commits happen
+// in a temporary `git worktree` created from HEAD, which is removed afterwards.
+// Only the files the Manager hands over are copied in and committed.
+
+import { spawnSync } from 'node:child_process';
+import { buildProofBody, hasGitChanges } from './lib.mjs';
+import { copyFileSync, writeFileSync, mkdirSync, rmSync, existsSync } from 'node:fs';
+import { basename, dirname, join, relative } from 'node:path';
+
+function sh(cmd, args, opts = {}) {
+  const res = spawnSync(cmd, args, { encoding: 'utf8', ...opts });
+  if (res.status !== 0) {
+    throw new Error(`${cmd} ${args.join(' ')} failed: ${(res.stderr || res.stdout || '').trim().slice(0, 400)}`);
+  }
+  return res.stdout.trim();
+}
+
+const FOOTER = [
+  '',
+  'Generated with [Claude Code](https://claude.com/claude-code)',
+  '',
+  'https://claude.ai/code/session_01AAByzSBZo4CwwrUxae7iw8',
+].join('\n');
+
+const TRAILERS = [
+  '',
+  'Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>',
+  'Claude-Session: https://claude.ai/code/session_01AAByzSBZo4CwwrUxae7iw8',
+].join('\n');
+
+// Core: commit `files` (paths relative to repo root; may be dirs) plus
+// `extraCopies` [{src, destRel}] on a fresh branch in a temp worktree,
+// push, open a PR. Returns { branch, url }.
+//
+// Passing `existingBranch` + `existingPrUrl` (rework: the goal already has an
+// open PR) switches this to update mode instead: the same branch is fetched
+// and reused rather than branching a new one, and `gh pr create` is skipped
+// entirely — pushing new commits to a branch that already has an open PR
+// makes GitHub refresh that PR's diff on its own, so calling `gh pr create`
+// again would either error (duplicate) or open a second PR for the goal.
+export function openPR({ repoDir, slug, title, body, files = [], extraCopies = [], extraWrites = [], buildBody = null, existingBranch = null, existingPrUrl = null }) {
+  const repoRoot = sh('git', ['-C', repoDir, 'rev-parse', '--show-toplevel']);
+  const branch = existingBranch ?? `manager-ai/${slug}-${Date.now()}`;
+  const wt = join(repoRoot, '.manager-wt', branch.replace(/[\/]/g, '-'));
+  mkdirSync(dirname(wt), { recursive: true });
+  if (existingBranch) {
+    sh('git', ['-C', repoRoot, 'fetch', 'origin', existingBranch]);
+    sh('git', ['-C', repoRoot, 'worktree', 'add', wt, '-B', existingBranch, `origin/${existingBranch}`]);
+  } else {
+    sh('git', ['-C', repoRoot, 'worktree', 'add', wt, '-b', branch]);
+  }
+  try {
+    for (const f of files) {
+      const rel = f.replace(/\/+$/, '');
+      const src = join(repoRoot, rel);
+      if (!existsSync(src)) continue; // deleted files: skip in v0
+      const dst = join(wt, rel);
+      mkdirSync(dirname(dst), { recursive: true });
+      rmSync(dst, { recursive: true, force: true });
+      sh('cp', ['-R', src, dst]);
+    }
+    for (const { src, destRel } of extraCopies) {
+      const dst = join(wt, destRel);
+      mkdirSync(dirname(dst), { recursive: true });
+      copyFileSync(src, dst);
+    }
+    for (const { destRel, content } of extraWrites) {
+      const dst = join(wt, destRel);
+      mkdirSync(dirname(dst), { recursive: true });
+      writeFileSync(dst, content);
+    }
+    sh('git', ['-C', wt, 'add', '-A']);
+    // proof artifacts live under gitignored paths in the main tree — force-add them here
+    for (const rel of [...extraCopies.map((c) => c.destRel), ...extraWrites.map((w) => w.destRel)]) {
+      sh('git', ['-C', wt, 'add', '-f', rel]);
+    }
+    const status = sh('git', ['-C', wt, 'status', '--porcelain']);
+    // A rework round can land with nothing new to commit (e.g. a comment-only
+    // reply task) — skip commit/push rather than let `git commit` fail on an
+    // empty tree. Only valid in update mode: the initial-creation caller
+    // already checked files.length before calling openPR.
+    if (existingBranch && existingPrUrl && !hasGitChanges(status)) {
+      return { branch, url: existingPrUrl, pushed: false };
+    }
+    sh('git', ['-C', wt, 'commit', '-m', `${title}${TRAILERS}`]);
+    // Proof bundles (mp4/gif/png) make the push exceed git's default ~1MB
+    // http.postBuffer, so git falls back to chunked transfer-encoding — which
+    // GitHub's smart-HTTP endpoint rejects with "RPC failed; HTTP 400 … send-pack:
+    // unexpected disconnect while reading sideband packet", leaving the goal stuck
+    // in review with a prError and no PR. Raising the buffer above the push size
+    // forces a single Content-Length POST, which succeeds. (Set on the shared repo
+    // config so every branch push from here uses it.)
+    sh('git', ['-C', wt, 'config', 'http.postBuffer', '524288000']);
+    sh('git', ['-C', wt, 'push', '-u', 'origin', branch]);
+    if (existingBranch && existingPrUrl) return { branch, url: existingPrUrl, pushed: true };
+    const finalBody = buildBody ? buildBody(branch) : body;
+    const url = sh('gh', ['pr', 'create', '--title', title, '--body', `${finalBody}${FOOTER}`, '--head', branch], { cwd: wt });
+    return { branch, url: url.split('\n').pop(), pushed: true };
+  } finally {
+    try { sh('git', ['-C', repoRoot, 'worktree', 'remove', '--force', wt]); } catch { /* best effort */ }
+  }
+}
+
+// Verify-proof loop entry point (called by manager.mjs after PASS):
+// commits the app change + proof screenshot/video, links them in the PR body.
+export function createProofPR({ repoDir, taskId, title, passCondition, attempts, finalProof }) {
+  const repoRoot = sh('git', ['-C', repoDir, 'rev-parse', '--show-toplevel']);
+  const changed = sh('git', ['-C', repoRoot, 'status', '--porcelain'])
+    .split('\n').filter(Boolean).map((l) => l.slice(3))
+    // keep the PR reviewable: run artifacts and logs stay local, proof goes in via extraCopies
+    .filter((f) => !/\/runs\/|\.webm$|\.log$/.test(f));
+
+  const proofRel = join('.manager-proof', taskId);
+  const extraCopies = [{ src: finalProof.shotPath, destRel: join(proofRel, basename(finalProof.shotPath)) }];
+  if (finalProof.videoPath) {
+    extraCopies.push({ src: finalProof.videoPath, destRel: join(proofRel, basename(finalProof.videoPath)) });
+  }
+  if (finalProof.gifPath) {
+    extraCopies.push({ src: finalProof.gifPath, destRel: join(proofRel, basename(finalProof.gifPath)) });
+  }
+
+  const appRel = relative(repoRoot, repoDir);
+  const owner = sh('gh', ['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner'], { cwd: repoRoot });
+  const shotName = basename(finalProof.shotPath);
+  const videoName = finalProof.videoPath ? basename(finalProof.videoPath) : null;
+  const gifName = finalProof.gifPath ? basename(finalProof.gifPath) : null;
+  // PROOF.md content is branch-dependent only through relative links, so it
+  // can be written up front; the PR body is built once the branch is known.
+  return openPR({
+    repoDir, slug: taskId,
+    title: `Manager for AI: ${title}`,
+    body: 'placeholder', // replaced by buildBody once the branch name is known
+    files: changed,
+    extraCopies,
+    extraWrites: [{
+      destRel: join(proofRel, 'PROOF.md'),
+      content: buildProofBody({ owner, branch: 'x', proofRel, shotName, videoName, gifName, passCondition, attempts, appRel }).proofMd,
+    }],
+    buildBody: (branch) =>
+      buildProofBody({ owner, branch, proofRel, shotName, videoName, gifName, passCondition, attempts, appRel }).body,
+  });
+}

package/engine/relay-client.mjs

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+// Agent Manager — relay client (the outbound half of the shared entrance)
+//
+// Connects this machine's local engine to a relay over an OUTBOUND
+// WebSocket, so the user needs no tunnel, no port forwarding, no ngrok.
+// Requests arriving from the relay are replayed against the local server
+// (with the local access key injected) and streamed back.
+//
+//   RELAY_URL=wss://relay.example/agent RELAY_AGENT_TOKEN=… node engine/relay-client.mjs
+
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve, dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const DATA_DIR = process.env.MANAGER_HOME
+  ?? (existsSync(join(ROOT, '.git')) ? join(ROOT, 'engine') : join(homedir(), '.manager-for-ai'));
+const LOCAL = process.env.MANAGER_LOCAL ?? `http://localhost:${process.env.MANAGER_PORT ?? 4400}`;
+const KEY = existsSync(join(DATA_DIR, 'secret.key')) ? readFileSync(join(DATA_DIR, 'secret.key'), 'utf8').trim() : '';
+const RELAY = process.env.RELAY_URL ?? 'ws://localhost:5500/agent';
+// The relay (P3.1) authenticates the agent by its signed LICENSE TOKEN — only
+// the billing Worker can mint one for a verified email, so the relay binds this
+// socket to that email's id (no shared token, unspoofable). Falls back to an
+// explicit RELAY_AGENT_TOKEN, and to a dev email for local testing.
+const LICENSE = existsSync(join(DATA_DIR, 'license.token')) ? readFileSync(join(DATA_DIR, 'license.token'), 'utf8').trim() : '';
+const TOKEN = process.env.RELAY_AGENT_TOKEN ?? LICENSE;
+const DEV_EMAIL = process.env.RELAY_DEV_EMAIL ?? '';
+
+const live = new Map(); // reqId -> AbortController
+
+function connect(retryMs = 1000) {
+  const auth = DEV_EMAIL ? `devEmail=${encodeURIComponent(DEV_EMAIL)}` : `token=${encodeURIComponent(TOKEN)}`;
+  const ws = new WebSocket(`${RELAY}?${auth}`);
+  ws.onopen = () => { retryMs = 1000; console.log(`[agent] connected to relay ${RELAY}`); };
+  ws.onmessage = async (ev) => {
+    let m; try { m = JSON.parse(ev.data); } catch { return; }
+    if (m.type === 'abort') { live.get(m.id)?.abort(); live.delete(m.id); return; }
+    const ctl = new AbortController();
+    live.set(m.id, ctl);
+    try {
+      // Authoritatively SET the access key on the forwarded request. Blindly
+      // appending (?|&)key= meant a client URL that ALREADY carried an (empty)
+      // key — e.g. a proof <img src="/proof/…?key="> rendered when the browser
+      // had no ?key= in its address bar (AKEY='') — became "?key=&key=<KEY>",
+      // and the server's searchParams.get('key') reads the FIRST (empty) value
+      // → 403, so every proof image/video silently broke through the relay.
+      // URL.searchParams.set replaces any existing key with exactly ours.
+      const fwd = new URL(m.url, LOCAL);
+      if (KEY) fwd.searchParams.set('key', KEY);
+      const r = await fetch(fwd, {
+        method: m.method,
+        headers: m.headers?.['content-type'] ? { 'content-type': m.headers['content-type'] } : undefined,
+        body: m.body ? Buffer.from(m.body, 'base64') : undefined,
+        signal: ctl.signal,
+      });
+      ws.send(JSON.stringify({ id: m.id, type: 'head', status: r.status,
+        headers: { 'content-type': r.headers.get('content-type') ?? 'application/octet-stream' } }));
+      for await (const chunk of r.body ?? []) {
+        ws.send(JSON.stringify({ id: m.id, type: 'chunk', data: Buffer.from(chunk).toString('base64') }));
+      }
+      ws.send(JSON.stringify({ id: m.id, type: 'end' }));
+    } catch (e) {
+      if (!ctl.signal.aborted) {
+        try {
+          ws.send(JSON.stringify({ id: m.id, type: 'head', status: 502, headers: { 'content-type': 'text/plain' } }));
+          ws.send(JSON.stringify({ id: m.id, type: 'chunk', data: Buffer.from(String(e.message ?? e)).toString('base64') }));
+          ws.send(JSON.stringify({ id: m.id, type: 'end' }));
+        } catch { /* ws already gone */ }
+      }
+    } finally {
+      live.delete(m.id);
+    }
+  };
+  ws.onclose = () => {
+    console.log(`[agent] relay connection lost — retrying in ${retryMs}ms`);
+    setTimeout(() => connect(Math.min(retryMs * 2, 15000)), retryMs);
+  };
+  ws.onerror = () => { /* onclose follows */ };
+}
+
+connect();