@getpaseo/server 0.1.16 → 0.1.18

package/dist/src/server/agent-attention-policy.js

@@ -0,0 +1,40 @@
+function hasActiveClientOnAgent(allClientStates, agentId) {
+    return allClientStates.some((state) => state.focusedAgentId === agentId && state.appVisible && !state.isStale);
+}
+function hasActiveWebClient(allClientStates) {
+    return allClientStates.some((state) => state.deviceType === "web" && !state.isStale);
+}
+function hasOtherCompetingClient(clientState, allClientStates) {
+    return allClientStates.some((state) => state !== clientState && (state.deviceType === "mobile" || state.deviceType === null));
+}
+function hasActiveForegroundMobileClient(allClientStates) {
+    return allClientStates.some((state) => state.deviceType === "mobile" && state.appVisible && !state.isStale);
+}
+export function computeShouldNotifyClient({ clientState, allClientStates, agentId, }) {
+    if (hasActiveClientOnAgent(allClientStates, agentId)) {
+        return false;
+    }
+    if (clientState.deviceType === null) {
+        return true;
+    }
+    if (!clientState.isStale && clientState.appVisible && clientState.focusedAgentId !== null) {
+        return true;
+    }
+    if (!clientState.isStale) {
+        return false;
+    }
+    if (clientState.deviceType === "mobile") {
+        return !hasActiveWebClient(allClientStates);
+    }
+    if (clientState.deviceType === "web") {
+        return !hasOtherCompetingClient(clientState, allClientStates);
+    }
+    return true;
+}
+export function computeShouldSendPush({ reason, allClientStates, }) {
+    if (reason === "error") {
+        return false;
+    }
+    return !hasActiveWebClient(allClientStates) && !hasActiveForegroundMobileClient(allClientStates);
+}
+//# sourceMappingURL=agent-attention-policy.js.map

package/dist/src/server/agent-attention-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-attention-policy.js","sourceRoot":"","sources":["../../../src/server/agent-attention-policy.ts"],"names":[],"mappings":"AAoBA,SAAS,sBAAsB,CAC7B,eAAuC,EACvC,OAAe;IAEf,OAAO,eAAe,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,OAAO,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAClF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,eAAuC;IACjE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,uBAAuB,CAC9B,WAAiC,EACjC,eAAuC;IAEvC,OAAO,eAAe,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CACxF,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,eAAuC;IAC9E,OAAO,eAAe,CAAC,IAAI,CACzB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAC/E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,EACxC,WAAW,EACX,eAAe,EACf,OAAO,GACwB;IAC/B,IAAI,sBAAsB,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,WAAW,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,WAAW,CAAC,UAAU,IAAI,WAAW,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,WAAW,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,WAAW,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACrC,OAAO,CAAC,uBAAuB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,EACpC,MAAM,EACN,eAAe,GACc;IAC7B,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,+BAA+B,CAAC,eAAe,CAAC,CAAC;AACnG,CAAC"}

package/dist/src/server/allowed-hosts.js

@@ -0,0 +1,94 @@
+import net from "node:net";
+function normalizeHostname(hostname) {
+    return hostname.trim().toLowerCase();
+}
+function parseHostnameFromHostHeader(hostHeader) {
+    const trimmed = hostHeader.trim();
+    if (!trimmed)
+        return null;
+    // IPv6 in brackets: [::1]:6767
+    if (trimmed.startsWith("[")) {
+        const end = trimmed.indexOf("]");
+        if (end === -1)
+            return null;
+        return normalizeHostname(trimmed.slice(1, end));
+    }
+    // IPv4/hostname with optional port: localhost:6767
+    const colonIndex = trimmed.indexOf(":");
+    if (colonIndex === -1) {
+        return normalizeHostname(trimmed);
+    }
+    return normalizeHostname(trimmed.slice(0, colonIndex));
+}
+function matchesAllowedHostPattern(hostname, pattern) {
+    const normalizedPattern = normalizeHostname(pattern);
+    if (!normalizedPattern)
+        return false;
+    if (normalizedPattern.startsWith(".")) {
+        const base = normalizedPattern.slice(1);
+        if (!base)
+            return false;
+        return hostname === base || hostname.endsWith(`.${base}`);
+    }
+    return hostname === normalizedPattern;
+}
+function isDefaultAllowedHostname(hostname) {
+    // Vite-style defaults: localhost, *.localhost, and all IP addresses.
+    if (hostname === "localhost")
+        return true;
+    if (hostname.endsWith(".localhost"))
+        return true;
+    if (net.isIP(hostname) !== 0)
+        return true;
+    return false;
+}
+/**
+ * Vite-style allowed hosts check, adapted to raw Host headers.
+ *
+ * Semantics:
+ * - `allowedHosts === true` => allow any host.
+ * - `allowedHosts === []` or `undefined` => allow localhost, *.localhost, and all IPs.
+ * - `allowedHosts === ['.example.com', 'myhost']` => allow those *in addition* to defaults.
+ */
+export function isHostAllowed(hostHeader, allowedHosts) {
+    const hostname = hostHeader ? parseHostnameFromHostHeader(hostHeader) : null;
+    if (!hostname)
+        return false;
+    if (allowedHosts === true)
+        return true;
+    // Defaults are always allowed.
+    if (isDefaultAllowedHostname(hostname))
+        return true;
+    const patterns = allowedHosts ?? [];
+    for (const pattern of patterns) {
+        if (matchesAllowedHostPattern(hostname, pattern))
+            return true;
+    }
+    return false;
+}
+export function mergeAllowedHosts(values) {
+    let merged = [];
+    for (const value of values) {
+        if (value === true)
+            return true;
+        if (!value)
+            continue;
+        merged = merged.concat(value);
+    }
+    const deduped = Array.from(new Set(merged.map((v) => v.trim()).filter((v) => v.length > 0)));
+    return deduped;
+}
+export function parseAllowedHostsEnv(raw) {
+    if (!raw)
+        return undefined;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return undefined;
+    if (trimmed.toLowerCase() === "true")
+        return true;
+    return trimmed
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+//# sourceMappingURL=allowed-hosts.js.map

package/dist/src/server/allowed-hosts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowed-hosts.js","sourceRoot":"","sources":["../../../src/server/allowed-hosts.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAI3B,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,2BAA2B,CAAC,UAAkB;IACrD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,+BAA+B;IAC/B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,mDAAmD;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB,EAAE,OAAe;IAClE,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAErC,IAAI,iBAAiB,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO,QAAQ,KAAK,iBAAiB,CAAC;AACxC,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IAChD,qEAAqE;IACrE,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,UAA8B,EAC9B,YAAgC;IAEhC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE5B,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvC,+BAA+B;IAC/B,IAAI,wBAAwB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,MAAM,QAAQ,GAAG,YAAY,IAAI,EAAE,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,yBAAyB,CAAC,QAAQ,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAAiC;IAEjC,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACxB,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CACjE,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAuB;IAEvB,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC"}

package/dist/src/server/bootstrap.js

@@ -0,0 +1,498 @@
+import express from "express";
+import { createServer as createHTTPServer } from "http";
+import { createReadStream, unlinkSync, existsSync } from "fs";
+import { stat } from "fs/promises";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+function parseListenString(listen) {
+    // Unix socket: starts with / or ~ or contains .sock
+    if (listen.startsWith("/") || listen.startsWith("~") || listen.includes(".sock")) {
+        return { type: "socket", path: listen };
+    }
+    // Explicit unix:// prefix
+    if (listen.startsWith("unix://")) {
+        return { type: "socket", path: listen.slice(7) };
+    }
+    // TCP: host:port or just port
+    if (listen.includes(":")) {
+        const [host, portStr] = listen.split(":");
+        const port = parseInt(portStr, 10);
+        if (!Number.isFinite(port)) {
+            throw new Error(`Invalid port in listen string: ${listen}`);
+        }
+        return { type: "tcp", host: host || "127.0.0.1", port };
+    }
+    // Just a port number
+    const port = parseInt(listen, 10);
+    if (Number.isFinite(port)) {
+        return { type: "tcp", host: "127.0.0.1", port };
+    }
+    throw new Error(`Invalid listen string: ${listen}`);
+}
+import { VoiceAssistantWebSocketServer } from "./websocket-server.js";
+import { DownloadTokenStore } from "./file-download/token-store.js";
+import { initializeSpeechRuntime } from "./speech/speech-runtime.js";
+import { AgentManager } from "./agent/agent-manager.js";
+import { AgentStorage } from "./agent/agent-storage.js";
+import { attachAgentStoragePersistence } from "./persistence-hooks.js";
+import { createAgentMcpServer } from "./agent/mcp-server.js";
+import { createAllClients, shutdownProviders } from "./agent/provider-registry.js";
+import { createTerminalManager } from "../terminal/terminal-manager.js";
+import { createConnectionOfferV2, encodeOfferToFragmentUrl, } from "./connection-offer.js";
+import { loadOrCreateDaemonKeyPair } from "./daemon-keypair.js";
+import { startRelayTransport } from "./relay-transport.js";
+import { getOrCreateServerId } from "./server-id.js";
+import { resolveDaemonVersion } from "./daemon-version.js";
+import { acquirePidLock, releasePidLock } from "./pid-lock.js";
+import { isHostAllowed } from "./allowed-hosts.js";
+import { createVoiceMcpSocketBridgeManager, } from "./voice-mcp-bridge.js";
+import { resolveVoiceMcpBridgeFromRuntime } from "./voice-mcp-bridge-command.js";
+function resolveVoiceMcpBridgeCommand(logger) {
+    const decision = resolveVoiceMcpBridgeFromRuntime({
+        bootstrapModuleUrl: import.meta.url,
+        execPath: process.execPath,
+        explicitScriptPath: process.env.PASEO_MCP_STDIO_SOCKET_BRIDGE_SCRIPT,
+    });
+    logger.info({
+        source: decision.source,
+        command: decision.resolved.command,
+        baseArgs: decision.resolved.baseArgs,
+    }, "Resolved voice MCP bridge command");
+    return decision.resolved;
+}
+export async function createPaseoDaemon(config, rootLogger) {
+    const logger = rootLogger.child({ module: "bootstrap" });
+    const daemonVersion = resolveDaemonVersion(import.meta.url);
+    const pidLockMode = config.pidLock?.mode ?? "self";
+    const pidLockOwnerPid = config.pidLock?.ownerPid;
+    const ownsPidLock = pidLockMode === "self";
+    // Acquire PID lock before expensive bootstrap work so duplicate starts fail immediately.
+    if (ownsPidLock) {
+        await acquirePidLock(config.paseoHome, config.listen, {
+            ownerPid: pidLockOwnerPid,
+        });
+    }
+    try {
+        const serverId = getOrCreateServerId(config.paseoHome, { logger });
+        const daemonKeyPair = await loadOrCreateDaemonKeyPair(config.paseoHome, logger);
+        let relayTransport = null;
+        const staticDir = config.staticDir;
+        const downloadTokenTtlMs = config.downloadTokenTtlMs ?? 60000;
+        const downloadTokenStore = new DownloadTokenStore({ ttlMs: downloadTokenTtlMs });
+        const listenTarget = parseListenString(config.listen);
+        const app = express();
+        // Host allowlist / DNS rebinding protection (vite-like semantics).
+        // For non-TCP (unix sockets), skip host validation.
+        if (listenTarget.type === "tcp") {
+            app.use((req, res, next) => {
+                const hostHeader = typeof req.headers.host === "string" ? req.headers.host : undefined;
+                if (!isHostAllowed(hostHeader, config.allowedHosts)) {
+                    res.status(403).json({ error: "Invalid Host header" });
+                    return;
+                }
+                next();
+            });
+        }
+        // CORS - allow same-origin + configured origins
+        const allowedOrigins = new Set([
+            ...config.corsAllowedOrigins,
+            // Tauri desktop app WebView origin (used for fetch/WebSocket in production builds).
+            // This origin can't be produced by normal websites, so it's safe to allow by default.
+            "tauri://localhost",
+            // For TCP, add localhost variants
+            ...(listenTarget.type === "tcp"
+                ? [
+                    `http://${listenTarget.host}:${listenTarget.port}`,
+                    `http://localhost:${listenTarget.port}`,
+                    `http://127.0.0.1:${listenTarget.port}`,
+                ]
+                : []),
+        ]);
+        app.use((req, res, next) => {
+            const origin = req.headers.origin;
+            if (origin && allowedOrigins.has(origin)) {
+                res.setHeader("Access-Control-Allow-Origin", origin);
+                res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+                res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+                res.setHeader("Access-Control-Allow-Credentials", "true");
+            }
+            if (req.method === "OPTIONS") {
+                res.status(204).end();
+                return;
+            }
+            next();
+        });
+        // Serve static files from public directory
+        app.use("/public", express.static(staticDir));
+        // Middleware
+        app.use(express.json());
+        // Health check endpoint
+        app.get("/api/health", (_req, res) => {
+            res.json({ status: "ok", timestamp: new Date().toISOString() });
+        });
+        app.get("/api/files/download", async (req, res) => {
+            const token = typeof req.query.token === "string" && req.query.token.trim().length > 0
+                ? req.query.token.trim()
+                : null;
+            if (!token) {
+                res.status(400).json({ error: "Missing download token" });
+                return;
+            }
+            const entry = downloadTokenStore.consumeToken(token);
+            if (!entry) {
+                res.status(403).json({ error: "Invalid or expired token" });
+                return;
+            }
+            try {
+                const fileStats = await stat(entry.absolutePath);
+                if (!fileStats.isFile()) {
+                    res.status(404).json({ error: "File not found" });
+                    return;
+                }
+                const safeFileName = entry.fileName.replace(/["\r\n]/g, "_");
+                res.setHeader("Content-Type", entry.mimeType);
+                res.setHeader("Content-Disposition", `attachment; filename="${safeFileName}"`);
+                res.setHeader("Content-Length", entry.size.toString());
+                const stream = createReadStream(entry.absolutePath);
+                stream.on("error", (err) => {
+                    logger.error({ err }, "Failed to stream download");
+                    if (!res.headersSent) {
+                        res.status(500).json({ error: "Failed to read file" });
+                    }
+                    else {
+                        res.end();
+                    }
+                });
+                stream.pipe(res);
+            }
+            catch (err) {
+                logger.error({ err }, "Failed to download file");
+                if (!res.headersSent) {
+                    res.status(404).json({ error: "File not found" });
+                }
+            }
+        });
+        const httpServer = createHTTPServer(app);
+        const agentStorage = new AgentStorage(config.agentStoragePath, logger);
+        const agentManager = new AgentManager({
+            clients: {
+                ...createAllClients(logger, {
+                    runtimeSettings: config.agentProviderSettings,
+                }),
+                ...config.agentClients,
+            },
+            registry: agentStorage,
+            logger,
+        });
+        const terminalManager = createTerminalManager();
+        const detachAgentStoragePersistence = attachAgentStoragePersistence(logger, agentManager, agentStorage);
+        await agentStorage.initialize();
+        const persistedRecords = await agentStorage.list();
+        logger.info(`Agent registry loaded (${persistedRecords.length} record${persistedRecords.length === 1 ? "" : "s"}); agents will initialize on demand`);
+        logger.info("Voice mode configured for agent-scoped resume flow (no dedicated voice assistant provider)");
+        let wsServer = null;
+        let voiceMcpBridgeManager = null;
+        let unsubscribeSpeechReadiness = null;
+        // Create in-memory transport for Session's Agent MCP client (voice assistant tools)
+        const createInMemoryAgentMcpTransport = async () => {
+            const agentMcpServer = await createAgentMcpServer({
+                agentManager,
+                agentStorage,
+                terminalManager,
+                paseoHome: config.paseoHome,
+                enableVoiceTools: false,
+                resolveSpeakHandler: (callerAgentId) => wsServer?.resolveVoiceSpeakHandler(callerAgentId) ?? null,
+                resolveCallerContext: (callerAgentId) => wsServer?.resolveVoiceCallerContext(callerAgentId) ?? null,
+                logger,
+            });
+            const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+            await agentMcpServer.connect(serverTransport);
+            return clientTransport;
+        };
+        const mcpEnabled = config.mcpEnabled ?? true;
+        if (mcpEnabled) {
+            const agentMcpRoute = "/mcp/agents";
+            const agentMcpTransports = new Map();
+            const createAgentMcpTransport = async (callerAgentId) => {
+                const agentMcpServer = await createAgentMcpServer({
+                    agentManager,
+                    agentStorage,
+                    terminalManager,
+                    paseoHome: config.paseoHome,
+                    callerAgentId,
+                    enableVoiceTools: false,
+                    resolveSpeakHandler: (agentId) => wsServer?.resolveVoiceSpeakHandler(agentId) ?? null,
+                    resolveCallerContext: (agentId) => wsServer?.resolveVoiceCallerContext(agentId) ?? null,
+                    logger,
+                });
+                const transport = new StreamableHTTPServerTransport({
+                    sessionIdGenerator: () => randomUUID(),
+                    onsessioninitialized: (sessionId) => {
+                        agentMcpTransports.set(sessionId, transport);
+                        logger.debug({ sessionId }, "Agent MCP session initialized");
+                    },
+                    onsessionclosed: (sessionId) => {
+                        agentMcpTransports.delete(sessionId);
+                        logger.debug({ sessionId }, "Agent MCP session closed");
+                    },
+                    // NOTE: We enforce a Vite-like host allowlist at the app/websocket layer.
+                    // StreamableHTTPServerTransport's built-in check requires exact Host header matches.
+                    enableDnsRebindingProtection: false,
+                });
+                transport.onclose = () => {
+                    if (transport.sessionId) {
+                        agentMcpTransports.delete(transport.sessionId);
+                    }
+                };
+                transport.onerror = (err) => {
+                    logger.error({ err }, "Agent MCP transport error");
+                };
+                await agentMcpServer.connect(transport);
+                return transport;
+            };
+            const handleAgentMcpRequest = async (req, res) => {
+                if (config.mcpDebug) {
+                    logger.debug({
+                        method: req.method,
+                        url: req.originalUrl,
+                        sessionId: req.header("mcp-session-id"),
+                        authorization: req.header("authorization"),
+                        body: req.body,
+                    }, "Agent MCP request");
+                }
+                try {
+                    const sessionId = req.header("mcp-session-id");
+                    let transport = sessionId ? agentMcpTransports.get(sessionId) : undefined;
+                    if (!transport) {
+                        if (req.method !== "POST") {
+                            res.status(400).json({
+                                jsonrpc: "2.0",
+                                error: {
+                                    code: -32000,
+                                    message: "Missing or invalid MCP session",
+                                },
+                                id: null,
+                            });
+                            return;
+                        }
+                        if (!isInitializeRequest(req.body)) {
+                            res.status(400).json({
+                                jsonrpc: "2.0",
+                                error: {
+                                    code: -32000,
+                                    message: "Initialization request expected",
+                                },
+                                id: null,
+                            });
+                            return;
+                        }
+                        const callerAgentIdRaw = req.query.callerAgentId;
+                        const callerAgentId = typeof callerAgentIdRaw === "string"
+                            ? callerAgentIdRaw
+                            : Array.isArray(callerAgentIdRaw) && typeof callerAgentIdRaw[0] === "string"
+                                ? callerAgentIdRaw[0]
+                                : undefined;
+                        transport = await createAgentMcpTransport(callerAgentId);
+                    }
+                    await transport.handleRequest(req, res, req.body);
+                }
+                catch (err) {
+                    logger.error({ err }, "Failed to handle Agent MCP request");
+                    if (!res.headersSent) {
+                        res.status(500).json({
+                            jsonrpc: "2.0",
+                            error: {
+                                code: -32603,
+                                message: "Internal MCP server error",
+                            },
+                            id: null,
+                        });
+                    }
+                }
+            };
+            app.post(agentMcpRoute, handleAgentMcpRequest);
+            app.get(agentMcpRoute, handleAgentMcpRequest);
+            app.delete(agentMcpRoute, handleAgentMcpRequest);
+            logger.info({ route: agentMcpRoute }, "Agent MCP server mounted on main app");
+        }
+        else {
+            logger.info("Agent MCP HTTP endpoint disabled");
+        }
+        const voiceMcpSocketDir = path.join(config.paseoHome, "runtime", "voice-mcp");
+        const voiceMcpBridgeCommand = resolveVoiceMcpBridgeCommand(logger);
+        voiceMcpBridgeManager = createVoiceMcpSocketBridgeManager({
+            runtimeDir: voiceMcpSocketDir,
+            logger,
+            createAgentMcpServerForCaller: async (callerAgentId) => {
+                return createAgentMcpServer({
+                    agentManager,
+                    agentStorage,
+                    terminalManager,
+                    paseoHome: config.paseoHome,
+                    callerAgentId,
+                    voiceOnly: true,
+                    resolveSpeakHandler: (agentId) => wsServer?.resolveVoiceSpeakHandler(agentId) ?? null,
+                    resolveCallerContext: (agentId) => wsServer?.resolveVoiceCallerContext(agentId) ?? null,
+                    logger,
+                });
+            },
+        });
+        const { resolveVoiceStt, resolveVoiceTts, resolveDictationStt, getSpeechReadiness, subscribeSpeechReadiness, cleanup: cleanupSpeechRuntime, localModelConfig, } = await initializeSpeechRuntime({
+            logger,
+            openaiConfig: config.openai,
+            speechConfig: config.speech,
+        });
+        wsServer = new VoiceAssistantWebSocketServer(httpServer, logger, serverId, agentManager, agentStorage, downloadTokenStore, config.paseoHome, createInMemoryAgentMcpTransport, { allowedOrigins, allowedHosts: config.allowedHosts }, { stt: resolveVoiceStt, tts: resolveVoiceTts }, terminalManager, {
+            voiceAgentMcpStdio: {
+                command: voiceMcpBridgeCommand.command,
+                baseArgs: [...voiceMcpBridgeCommand.baseArgs],
+                env: {
+                    PASEO_HOME: config.paseoHome,
+                },
+            },
+            ensureVoiceMcpSocketForAgent: (agentId) => voiceMcpBridgeManager?.ensureBridgeForCaller(agentId) ??
+                Promise.reject(new Error("Voice MCP bridge manager is not initialized")),
+            removeVoiceMcpSocketForAgent: (agentId) => voiceMcpBridgeManager?.removeBridgeForCaller(agentId) ?? Promise.resolve(),
+        }, {
+            finalTimeoutMs: config.dictationFinalTimeoutMs,
+            stt: resolveDictationStt,
+            localModels: localModelConfig ?? undefined,
+            getSpeechReadiness,
+        }, config.agentProviderSettings, daemonVersion, (intent) => {
+            try {
+                config.onLifecycleIntent?.(intent);
+            }
+            catch (error) {
+                logger.error({ err: error, intent }, "Failed to handle daemon lifecycle intent");
+            }
+        });
+        unsubscribeSpeechReadiness = subscribeSpeechReadiness((snapshot) => {
+            wsServer?.publishSpeechReadiness(snapshot);
+        });
+        const start = async () => {
+            // Start main HTTP server
+            await new Promise((resolve, reject) => {
+                const onError = (err) => {
+                    httpServer.off("listening", onListening);
+                    reject(err);
+                };
+                const onListening = () => {
+                    httpServer.off("error", onError);
+                    const logAndResolve = async () => {
+                        if (listenTarget.type === "tcp") {
+                            logger.info({ host: listenTarget.host, port: listenTarget.port }, `Server listening on http://${listenTarget.host}:${listenTarget.port}`);
+                            const relayEnabled = config.relayEnabled ?? true;
+                            const relayEndpoint = config.relayEndpoint ?? "relay.paseo.sh:443";
+                            const relayPublicEndpoint = config.relayPublicEndpoint ?? relayEndpoint;
+                            const appBaseUrl = config.appBaseUrl ?? "https://app.paseo.sh";
+                            if (relayEnabled) {
+                                const offer = await createConnectionOfferV2({
+                                    serverId,
+                                    daemonPublicKeyB64: daemonKeyPair.publicKeyB64,
+                                    relay: { endpoint: relayPublicEndpoint },
+                                });
+                                const url = encodeOfferToFragmentUrl({ offer, appBaseUrl });
+                                logger.info({ url }, "pairing_offer");
+                            }
+                            if (relayEnabled) {
+                                relayTransport?.stop().catch(() => undefined);
+                                relayTransport = startRelayTransport({
+                                    logger,
+                                    attachSocket: (ws, metadata) => {
+                                        if (!wsServer) {
+                                            throw new Error("WebSocket server not initialized");
+                                        }
+                                        return wsServer.attachExternalSocket(ws, metadata);
+                                    },
+                                    relayEndpoint,
+                                    serverId,
+                                    daemonKeyPair: daemonKeyPair.keyPair,
+                                });
+                            }
+                        }
+                        else {
+                            logger.info({ path: listenTarget.path }, `Server listening on ${listenTarget.path}`);
+                        }
+                    };
+                    logAndResolve().then(resolve, reject);
+                };
+                httpServer.once("error", onError);
+                httpServer.once("listening", onListening);
+                if (listenTarget.type === "tcp") {
+                    httpServer.listen(listenTarget.port, listenTarget.host);
+                }
+                else {
+                    // Remove stale socket file if it exists
+                    if (existsSync(listenTarget.path)) {
+                        unlinkSync(listenTarget.path);
+                    }
+                    httpServer.listen(listenTarget.path);
+                }
+            });
+        };
+        const stop = async () => {
+            await closeAllAgents(logger, agentManager);
+            await agentManager.flush().catch(() => undefined);
+            detachAgentStoragePersistence();
+            await agentStorage.flush().catch(() => undefined);
+            await shutdownProviders(logger, {
+                runtimeSettings: config.agentProviderSettings,
+            });
+            terminalManager.killAll();
+            unsubscribeSpeechReadiness?.();
+            unsubscribeSpeechReadiness = null;
+            cleanupSpeechRuntime();
+            await relayTransport?.stop().catch(() => undefined);
+            if (wsServer) {
+                await wsServer.close();
+            }
+            if (voiceMcpBridgeManager) {
+                await voiceMcpBridgeManager.stop().catch(() => undefined);
+            }
+            await new Promise((resolve) => {
+                httpServer.close(() => resolve());
+            });
+            // Clean up socket files
+            if (listenTarget.type === "socket" && existsSync(listenTarget.path)) {
+                unlinkSync(listenTarget.path);
+            }
+            // Release PID lock
+            if (ownsPidLock) {
+                await releasePidLock(config.paseoHome, {
+                    ownerPid: pidLockOwnerPid,
+                });
+            }
+        };
+        return {
+            config,
+            agentManager,
+            agentStorage,
+            terminalManager,
+            start,
+            stop,
+        };
+    }
+    catch (err) {
+        if (ownsPidLock) {
+            await releasePidLock(config.paseoHome, {
+                ownerPid: pidLockOwnerPid,
+            }).catch(() => undefined);
+        }
+        throw err;
+    }
+}
+async function closeAllAgents(logger, agentManager) {
+    const agents = agentManager.listAgents();
+    for (const agent of agents) {
+        try {
+            await agentManager.closeAgent(agent.id);
+        }
+        catch (err) {
+            logger.error({ err, agentId: agent.id }, "Failed to close agent");
+        }
+    }
+}
+//# sourceMappingURL=bootstrap.js.map