@gorlitzer-labs/apiary 1.13.3

package/dist/chunk-CZHO4DBN.js

@@ -0,0 +1,1719 @@
+import {
+  FileBackedStorage,
+  Room
+} from "./chunk-PEB6HEFT.js";
+import {
+  TokenManager,
+  buildShareUrl
+} from "./chunk-AYQJIAR5.js";
+import {
+  randomName,
+  randomRoomName
+} from "./chunk-D7DXZQWT.js";
+import {
+  can,
+  formatTimestamp
+} from "./chunk-QL66XSDB.js";
+import {
+  AttachmentSchema,
+  createEvent
+} from "./chunk-BZ4VDWC2.js";
+
+// src/cli/bind.ts
+import { networkInterfaces } from "os";
+function isTailnetAddress(address) {
+  const octets = address.split(".").map(Number);
+  if (octets.length !== 4 || octets.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) {
+    return false;
+  }
+  return octets[0] === 100 && octets[1] >= 64 && octets[1] <= 127;
+}
+function localAddresses() {
+  const out = [];
+  for (const [iface, addrs] of Object.entries(networkInterfaces())) {
+    for (const addr of addrs ?? []) {
+      if (addr.family === "IPv4" && !addr.internal) out.push({ iface, address: addr.address });
+    }
+  }
+  return out;
+}
+function tailnetAddress(addrs = localAddresses()) {
+  return addrs.find((a) => isTailnetAddress(a.address))?.address ?? null;
+}
+function lanAddress(addrs = localAddresses()) {
+  return addrs.find((a) => !isTailnetAddress(a.address))?.address ?? null;
+}
+var ALL_INTERFACES = "0.0.0.0";
+var LOOPBACK = "127.0.0.1";
+function resolveBindAddress(spec) {
+  const value = spec.trim();
+  if (!value) return { ok: false, error: "empty --bind value" };
+  switch (value.toLowerCase()) {
+    case "tailscale":
+    case "tailnet":
+    case "ts": {
+      const address = tailnetAddress();
+      if (!address) {
+        return {
+          ok: false,
+          error: "no Tailscale address found (100.64.0.0/10). Is Tailscale up? Check with: tailscale ip -4"
+        };
+      }
+      return { ok: true, address, note: "tailnet \u2014 reachable from your other tailnet devices only" };
+    }
+    case "lan": {
+      const address = lanAddress();
+      if (!address) return { ok: false, error: "no LAN address found on this machine" };
+      return { ok: true, address, note: "LAN \u2014 reachable from this network only" };
+    }
+    case "all":
+    case "any":
+    case ALL_INTERFACES:
+      return {
+        ok: true,
+        address: ALL_INTERFACES,
+        note: "ALL interfaces \u2014 including any untrusted network this machine joins"
+      };
+    case "localhost":
+    case LOOPBACK:
+      return { ok: true, address: LOOPBACK, note: "this machine only" };
+    default:
+      break;
+  }
+  const owner = localAddresses().find((a) => a.address === value);
+  if (!owner) {
+    const available = localAddresses().map((a) => `${a.address} (${a.iface})`).join(", ");
+    return {
+      ok: false,
+      error: `"${value}" is not an address on this machine.` + (available ? ` Available: ${available}` : "") + ` Or use: tailscale, lan, all, localhost.`
+    };
+  }
+  return {
+    ok: true,
+    address: value,
+    note: isTailnetAddress(value) ? `tailnet (${owner.iface}) \u2014 reachable from your other tailnet devices only` : `${owner.iface}`
+  };
+}
+function advertisedAddress(bound, addrs = localAddresses()) {
+  if (bound !== ALL_INTERFACES) return bound;
+  return tailnetAddress(addrs) ?? lanAddress(addrs) ?? LOOPBACK;
+}
+
+// src/core/rules.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join as pathJoin, dirname } from "path";
+var DEFAULT_RULES = [
+  "Never push to main. Open a PR.",
+  "Don't touch repos you don't own \u2014 your cwd is your hive.",
+  "No force-push, no `git reset --hard`, no `rm -rf` on anything you didn't make this session.",
+  'Announce destructive intent before you act. "About to delete X" beats "I deleted X, sorry."',
+  "If a human is in the room, wait for their ack before merging, deploying, or running anything irreversible.",
+  "Stay in your lane. If a task belongs to another agent, @mention them \u2014 don't poach.",
+  "When uncertain, ask in the room with send_message \u2014 nobody reads your terminal. A clarifying question costs a token; a wrong commit costs an afternoon."
+];
+var RULES_MAX = 12;
+var APIARY_DIR = pathJoin(homedir(), ".apiary");
+var GLOBAL_DEFAULT_PATH = pathJoin(APIARY_DIR, "rules.default.md");
+var ROOMS_DIR = pathJoin(APIARY_DIR, "rooms");
+function roomRulesPath(roomName) {
+  return pathJoin(ROOMS_DIR, `${roomName}.rules.md`);
+}
+function parseRulesMarkdown(content) {
+  let body = content.trimStart();
+  if (body.startsWith("---")) {
+    const end = body.indexOf("\n---", 3);
+    if (end !== -1) body = body.slice(end + 4);
+  }
+  const rules = [];
+  for (const rawLine of body.split("\n")) {
+    const line = rawLine.trim();
+    if (line.startsWith("- ")) rules.push(line.slice(2).trim());
+    else if (line.startsWith("* ")) rules.push(line.slice(2).trim());
+  }
+  return rules.filter((r) => r.length > 0);
+}
+function formatRulesMarkdown(rules) {
+  const header = "# Room rules\n\n";
+  const body = rules.map((r) => `- ${r}`).join("\n");
+  return header + body + "\n";
+}
+function loadRulesForRoom(roomName) {
+  const roomPath = roomRulesPath(roomName);
+  const candidates = [roomPath, GLOBAL_DEFAULT_PATH];
+  for (const p of candidates) {
+    if (existsSync(p)) {
+      try {
+        const parsed = parseRulesMarkdown(readFileSync(p, "utf-8"));
+        if (parsed.length > 0) return parsed.slice(0, RULES_MAX);
+      } catch {
+      }
+    }
+  }
+  return [...DEFAULT_RULES];
+}
+function saveRulesForRoom(roomName, rules) {
+  const p = roomRulesPath(roomName);
+  mkdirSync(dirname(p), { recursive: true });
+  writeFileSync(p, formatRulesMarkdown(rules.slice(0, RULES_MAX)));
+}
+function seedRulesIfMissing(roomName) {
+  const p = roomRulesPath(roomName);
+  if (existsSync(p)) return null;
+  const initial = existsSync(GLOBAL_DEFAULT_PATH) ? parseRulesMarkdown(readFileSync(GLOBAL_DEFAULT_PATH, "utf-8")) : [...DEFAULT_RULES];
+  saveRulesForRoom(roomName, initial.length > 0 ? initial : [...DEFAULT_RULES]);
+  return p;
+}
+
+// src/cli/config.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join } from "path";
+var CONFIG_DIR = join(homedir2(), ".apiary");
+var CONFIG_PATH = join(CONFIG_DIR, "config.json");
+function loadConfig() {
+  if (!existsSync2(CONFIG_PATH)) return {};
+  try {
+    return JSON.parse(readFileSync2(CONFIG_PATH, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function saveConfig(config) {
+  if (!existsSync2(CONFIG_DIR)) mkdirSync2(CONFIG_DIR, { recursive: true });
+  writeFileSync2(CONFIG_PATH, JSON.stringify(config, null, 2) + "\n");
+}
+function stableIndex(seed, poolSize) {
+  let hash = 0;
+  for (const c of seed) hash = (hash << 5) - hash + c.charCodeAt(0) | 0;
+  return (hash % poolSize + poolSize) % poolSize;
+}
+var BUG_POOL = [
+  "\u{1F41D}",
+  "\u{1F41B}",
+  "\u{1F98B}",
+  "\u{1F41E}",
+  "\u{1FAB2}",
+  "\u{1F41C}",
+  "\u{1F997}",
+  "\u{1FAB3}",
+  "\u{1F982}",
+  "\u{1F577}\uFE0F",
+  "\u{1FAB0}",
+  "\u{1F99F}",
+  "\u{1F40C}",
+  "\u{1F419}",
+  "\u{1F991}",
+  "\u{1F980}",
+  "\u{1FAB1}",
+  "\u{1F9A0}",
+  "\u{1F9EC}",
+  "\u{1F52C}"
+];
+var HIVE_POOL = ["\u{1F36F}", "\u{1F41D}", "\u{1F3E0}", "\u{1FABA}", "\u{1F338}"];
+function agentEmoji(agentName) {
+  return BUG_POOL[stableIndex(agentName, BUG_POOL.length)];
+}
+function roomEmoji(roomName) {
+  return HIVE_POOL[stableIndex(roomName, HIVE_POOL.length)];
+}
+
+// src/cli/agent-session.ts
+import { writeFileSync as writeFileSync3, readFileSync as readFileSync3, readdirSync, existsSync as existsSync3, mkdirSync as mkdirSync3, rmSync } from "fs";
+import { join as join2 } from "path";
+import { homedir as homedir3 } from "os";
+var SESSION_DIR = join2(homedir3(), ".apiary", "sessions");
+function sessionPath(runtime, name) {
+  return join2(SESSION_DIR, `${runtime}_${name}.json`);
+}
+function saveAgentSession(session) {
+  if (!existsSync3(SESSION_DIR)) mkdirSync3(SESSION_DIR, { recursive: true });
+  writeFileSync3(sessionPath(session.runtime, session.agentName), JSON.stringify(session, null, 2));
+}
+function clearAgentSession(runtime, name) {
+  try {
+    rmSync(sessionPath(runtime, name));
+  } catch {
+  }
+}
+function listAgentSessions(runtime) {
+  if (!existsSync3(SESSION_DIR)) return [];
+  const prefix = `${runtime}_`;
+  const sessions = [];
+  for (const f of readdirSync(SESSION_DIR)) {
+    if (!f.startsWith(prefix) || !f.endsWith(".json")) continue;
+    try {
+      sessions.push(JSON.parse(readFileSync3(join2(SESSION_DIR, f), "utf-8")));
+    } catch {
+    }
+  }
+  return sessions;
+}
+function isAgentAlive(session) {
+  try {
+    process.kill(session.pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/cli/tmux.ts
+import { execFileSync, spawn } from "child_process";
+function sanitizeSessionName(name) {
+  return name.replace(/[.:$%]/g, "_");
+}
+function tmuxAvailable() {
+  try {
+    execFileSync("tmux", ["-V"], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function tmuxSessionExists(session) {
+  try {
+    const name = sanitizeSessionName(session);
+    execFileSync("tmux", ["has-session", "-t", name], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var AGENT_PANE_COLS = 200;
+var AGENT_PANE_ROWS = 50;
+function tmuxCreateSession(session, title, size = { cols: AGENT_PANE_COLS, rows: AGENT_PANE_ROWS }) {
+  const name = sanitizeSessionName(session);
+  execFileSync("tmux", [
+    "new-session",
+    "-d",
+    "-s",
+    name,
+    "-x",
+    String(size.cols),
+    "-y",
+    String(size.rows)
+  ]);
+  execFileSync("tmux", ["set", "-t", name, "status", "off"]);
+  try {
+    execFileSync("tmux", ["set-option", "-t", name, "window-size", "manual"]);
+    execFileSync("tmux", ["resize-window", "-t", name, "-x", String(size.cols), "-y", String(size.rows)]);
+  } catch {
+  }
+  if (title) {
+    execFileSync("tmux", ["set", "-t", name, "set-titles", "on"]);
+    execFileSync("tmux", ["set", "-t", name, "set-titles-string", title]);
+  }
+}
+function tmuxSendCommand(session, command) {
+  const name = sanitizeSessionName(session);
+  execFileSync("tmux", ["send-keys", "-t", name, "-l", command]);
+  execFileSync("tmux", ["send-keys", "-t", name, "Enter"]);
+}
+function tmuxInjectText(session, text) {
+  const name = sanitizeSessionName(session);
+  execFileSync("tmux", ["send-keys", "-t", name, "-l", text]);
+}
+function tmuxInjectPaste(session, text) {
+  const name = sanitizeSessionName(session);
+  execFileSync("tmux", ["send-keys", "-t", name, "-l", `\x1B[200~${text}\x1B[201~`]);
+}
+function tmuxSendEnter(session) {
+  const name = sanitizeSessionName(session);
+  execFileSync("tmux", ["send-keys", "-t", name, "Enter"]);
+}
+function tmuxAttach(session) {
+  const name = sanitizeSessionName(session);
+  if (process.env.TMUX) {
+    try {
+      execFileSync("tmux", ["switch-client", "-t", name], { stdio: "ignore" });
+    } catch {
+    }
+    return new Promise((resolve2) => {
+      const poll = setInterval(() => {
+        try {
+          execFileSync("tmux", ["has-session", "-t", name], { stdio: "ignore" });
+        } catch {
+          clearInterval(poll);
+          resolve2();
+        }
+      }, 500);
+    });
+  }
+  return new Promise((resolve2) => {
+    const child = spawn("tmux", ["attach", "-t", name], { stdio: "inherit" });
+    child.on("exit", () => resolve2());
+    child.on("error", () => resolve2());
+  });
+}
+function tmuxCapturePane(session) {
+  try {
+    const name = sanitizeSessionName(session);
+    const output = execFileSync("tmux", ["capture-pane", "-t", name, "-p"], {
+      encoding: "utf-8"
+    });
+    return trimTrailingBlankLines(output.split("\n"));
+  } catch {
+    return [];
+  }
+}
+function trimTrailingBlankLines(lines) {
+  let end = lines.length;
+  while (end > 0 && lines[end - 1].trim() === "") end--;
+  return lines.slice(0, end);
+}
+function tmuxSendKey(session, key) {
+  const name = sanitizeSessionName(session);
+  execFileSync("tmux", ["send-keys", "-t", name, key]);
+}
+function tmuxKillSession(session) {
+  try {
+    const name = sanitizeSessionName(session);
+    execFileSync("tmux", ["kill-session", "-t", name], { stdio: "ignore" });
+  } catch {
+  }
+}
+function resetTerminal() {
+  if (!process.stdin.isTTY) return;
+  try {
+    execFileSync("stty", ["sane"], { stdio: "inherit" });
+  } catch {
+  }
+}
+var SHELL_COMMANDS = /* @__PURE__ */ new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "fish",
+  "dash",
+  "ksh",
+  "mksh",
+  "tcsh",
+  "csh",
+  "nu",
+  "pwsh",
+  "powershell",
+  "login",
+  "elvish",
+  "xonsh"
+]);
+function tmuxPaneCommand(session) {
+  try {
+    const name = sanitizeSessionName(session);
+    const out = execFileSync("tmux", ["display-message", "-p", "-t", name, "#{pane_current_command}"], {
+      encoding: "utf-8",
+      timeout: 5e3
+    }).trim();
+    return out || null;
+  } catch {
+    return null;
+  }
+}
+function tmuxPaneIsShell(session) {
+  const cmd = tmuxPaneCommand(session);
+  if (!cmd) return false;
+  return SHELL_COMMANDS.has(cmd.toLowerCase().replace(/^-/, ""));
+}
+
+// src/cli/serve.ts
+import { createServer } from "http";
+import { spawn as spawn2, execFileSync as execFileSync2 } from "child_process";
+import { randomUUID } from "crypto";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync4, rmSync as rmSync2 } from "fs";
+import { createRequire } from "module";
+import { homedir as homedir4, tmpdir } from "os";
+import { join as pathJoin2, resolve, sep } from "path";
+import { watchFile, unwatchFile } from "fs";
+
+// src/cli/terminate-agent.ts
+var RUNTIMES = ["claude", "codex", "opencode"];
+function terminateLocalAgent(agentName, deps = {}) {
+  const list = deps.list ?? listAgentSessions;
+  const alive = deps.alive ?? isAgentAlive;
+  const kill = deps.kill ?? ((pid, signal) => {
+    process.kill(pid, signal);
+  });
+  const clear = deps.clear ?? clearAgentSession;
+  for (const runtime of RUNTIMES) {
+    const session = list(runtime).find((s) => s.agentName === agentName);
+    if (!session) continue;
+    if (!alive(session)) {
+      clear(runtime, agentName);
+      return { stopped: false, reason: "already-exited" };
+    }
+    try {
+      kill(session.pid, "SIGTERM");
+    } catch {
+    }
+    if (session.tmuxSession && deps.killTmux) {
+      try {
+        deps.killTmux(session.tmuxSession);
+      } catch {
+      }
+    }
+    clear(runtime, agentName);
+    return {
+      stopped: true,
+      runtime,
+      pid: session.pid,
+      tmuxSession: session.tmuxSession ?? ""
+    };
+  }
+  return { stopped: false, reason: "not-local" };
+}
+function seatsToEvict(seats, joining) {
+  if (joining.type !== "agent") return [];
+  return seats.filter((s) => s.type === "agent" && s.name === joining.name);
+}
+
+// src/cli/serve.ts
+var SESSION_DIR2 = pathJoin2(homedir4(), ".apiary", "sessions");
+var INVITES_DIR = pathJoin2(homedir4(), ".apiary", "invites");
+function roomSessionPath(name) {
+  return pathJoin2(SESSION_DIR2, `room_${name}.json`);
+}
+function saveRoomSession(session) {
+  if (!existsSync4(SESSION_DIR2)) mkdirSync4(SESSION_DIR2, { recursive: true });
+  writeFileSync4(roomSessionPath(session.roomName), JSON.stringify(session, null, 2));
+}
+function clearRoomSession(name) {
+  try {
+    rmSync2(roomSessionPath(name));
+  } catch {
+  }
+}
+function listRoomSessions() {
+  if (!existsSync4(SESSION_DIR2)) return [];
+  const files = readdirSync2(SESSION_DIR2);
+  const sessions = [];
+  for (const f of files) {
+    if (!f.startsWith("room_") || !f.endsWith(".json")) continue;
+    try {
+      sessions.push(JSON.parse(readFileSync4(pathJoin2(SESSION_DIR2, f), "utf-8")));
+    } catch {
+    }
+  }
+  return sessions;
+}
+function removeRoomSession(name) {
+  try {
+    rmSync2(pathJoin2(SESSION_DIR2, `room_${name}.json`));
+  } catch {
+  }
+}
+async function enrichAndSend(res, event, room) {
+  if (event.type === "MessageSent" && event.message.reply_to_id) {
+    const replyMsg = await room.getMessage(event.message.reply_to_id);
+    const enriched = {
+      ...event,
+      _replyToName: replyMsg?.sender_name ?? null
+    };
+    res.write(`data: ${JSON.stringify(enriched)}
+
+`);
+    return;
+  }
+  res.write(`data: ${JSON.stringify(event)}
+
+`);
+}
+var ROOMS_DIR2 = pathJoin2(homedir4(), ".apiary", "rooms");
+function validateSavePath(p) {
+  const resolved = resolve(p);
+  if (!resolved.endsWith(".json")) throw new Error("Save/load path must end with .json");
+  const cwd = process.cwd();
+  const tmp = tmpdir();
+  const apiaryDir = pathJoin2(homedir4(), ".apiary");
+  if (!resolved.startsWith(cwd + sep) && !resolved.startsWith(tmp + sep) && !resolved.startsWith(apiaryDir + sep))
+    throw new Error(`Path must be under ${cwd}, ${tmp}, or ${apiaryDir}`);
+  return resolved;
+}
+async function serve(options) {
+  const roomName = options.room ?? randomRoomName();
+  const port = options.port ?? 7890;
+  const boundAddress = options.bind ?? (options.expose ? ALL_INTERFACES : LOOPBACK);
+  const serverUrl = `http://${advertisedAddress(boundAddress)}:${port}`;
+  const log = options.headless ? () => {
+  } : logServer;
+  let publicUrl = serverUrl;
+  let tunnelProcess = null;
+  if (options.save) options.save = validateSavePath(options.save);
+  if (options.load) options.load = validateSavePath(options.load);
+  mkdirSync4(ROOMS_DIR2, { recursive: true });
+  const defaultPath = pathJoin2(ROOMS_DIR2, `${roomName}.json`);
+  const savePath = options.save ?? options.load ?? defaultPath;
+  const shouldAutoLoad = !options.save && !options.load && existsSync4(defaultPath);
+  let storage;
+  if (options.load || shouldAutoLoad) {
+    const loadPath = options.load ?? defaultPath;
+    try {
+      storage = await FileBackedStorage.load(loadPath);
+      log(`loaded room state from ${loadPath}`);
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        storage = new FileBackedStorage(loadPath);
+        log(`no existing file at ${loadPath}, starting fresh`);
+      } else {
+        throw err;
+      }
+    }
+  } else {
+    storage = new FileBackedStorage(savePath);
+  }
+  const room = new Room(roomName, storage);
+  seedRulesIfMissing(roomName);
+  let currentRules = loadRulesForRoom(roomName);
+  const rulesFilePath = roomRulesPath(roomName);
+  const onRulesFileChange = (curr, prev) => {
+    if (curr.mtimeMs === prev.mtimeMs) return;
+    try {
+      const next = loadRulesForRoom(roomName);
+      if (JSON.stringify(next) === JSON.stringify(currentRules)) return;
+      currentRules = next;
+      broadcastRulesChanged(currentRules, "[system]");
+      log(`rules reloaded from disk (${currentRules.length} rules)`);
+    } catch {
+    }
+  };
+  watchFile(rulesFilePath, { interval: 2e3 }, onRulesFileChange);
+  const tokens = new TokenManager({ shareTtlMs: options.shareTtlMs });
+  const participants = /* @__PURE__ */ new Map();
+  const guests = /* @__PURE__ */ new Map();
+  const idToSession = /* @__PURE__ */ new Map();
+  const sseConnections = /* @__PURE__ */ new Map();
+  const lastSeenAt = /* @__PURE__ */ new Map();
+  const presenceStatus = /* @__PURE__ */ new Map();
+  const UNRESPONSIVE_AFTER_MS = parseInt(process.env.APIARY_UNRESPONSIVE_MS ?? "90000", 10);
+  const OFFLINE_AFTER_MS = parseInt(process.env.APIARY_OFFLINE_MS ?? String(UNRESPONSIVE_AFTER_MS * 2), 10);
+  const PRESENCE_CHECK_INTERVAL_MS = parseInt(process.env.APIARY_PRESENCE_CHECK_MS ?? "30000", 10);
+  function touchParticipant(id) {
+    lastSeenAt.set(id, Date.now());
+  }
+  function broadcastToAll(event) {
+    const frame = `data: ${JSON.stringify(event)}
+
+`;
+    for (const [, sseRes] of sseConnections) {
+      sseRes.write(frame);
+    }
+  }
+  const agentStates = /* @__PURE__ */ new Map();
+  const AGENT_STATE_TTL_MS = 15e3;
+  function agentStateFor(participantId) {
+    const entry = agentStates.get(participantId);
+    if (!entry) return void 0;
+    return Date.now() - entry.at < AGENT_STATE_TTL_MS ? entry.state : void 0;
+  }
+  function participantSummaries() {
+    return room.listParticipants().map((p) => ({
+      id: p.id,
+      name: p.name,
+      type: p.type,
+      authority: p.authority ?? "member",
+      /** "idle" | "working" | "blocked", or absent if the runtime doesn't report. */
+      agentState: agentStateFor(p.id)
+    }));
+  }
+  function broadcastStatusChange(participantId, name, status, previousStatus, reason) {
+    const event = createEvent({
+      type: "StatusChanged",
+      category: "PRESENCE",
+      room_id: room.roomId,
+      participant_id: participantId,
+      name,
+      status,
+      previous_status: previousStatus,
+      reason
+    });
+    broadcastToAll(event);
+  }
+  function broadcastRulesChanged(rules, updatedBy) {
+    const event = createEvent({
+      type: "RulesChanged",
+      category: "ACTIVITY",
+      room_id: room.roomId,
+      participant_id: "[system]",
+      rules,
+      updated_by: updatedBy
+    });
+    broadcastToAll(event);
+  }
+  const MAX_ATTACHMENT_BYTES = 10 * 1024 * 1024;
+  const MAX_ATTACHMENT_STORE_BYTES = 256 * 1024 * 1024;
+  const attachmentStore = /* @__PURE__ */ new Map();
+  let attachmentStoreBytes = 0;
+  function evictAttachmentsToFit(neededBytes) {
+    if (neededBytes > MAX_ATTACHMENT_STORE_BYTES) return;
+    while (attachmentStoreBytes + neededBytes > MAX_ATTACHMENT_STORE_BYTES) {
+      const oldest = attachmentStore.entries().next();
+      if (oldest.done) break;
+      const [oldestId, oldestAtt] = oldest.value;
+      attachmentStore.delete(oldestId);
+      attachmentStoreBytes -= oldestAtt.size;
+    }
+  }
+  function attachmentUrl(id) {
+    return `${publicUrl}/attachment/${id}`;
+  }
+  async function parseBody(req) {
+    const chunks = [];
+    for await (const chunk of req) chunks.push(chunk);
+    try {
+      return JSON.parse(Buffer.concat(chunks).toString());
+    } catch {
+      return {};
+    }
+  }
+  function extractSessionToken(req, url, body) {
+    const h = req.headers.authorization;
+    if (h?.startsWith("Bearer ")) return h.slice(7);
+    return url.searchParams.get("token") ?? (body?.token ? String(body.token) : null);
+  }
+  function getSession(token) {
+    if (!token) return null;
+    const p = participants.get(token);
+    if (p) return { ...p, kind: "participant" };
+    const g = guests.get(token);
+    if (g) return { ...g, kind: "guest" };
+    return null;
+  }
+  function clampInt(val, def, min, max) {
+    const n = parseInt(val ?? String(def), 10);
+    return isNaN(n) ? def : Math.max(min, Math.min(max, n));
+  }
+  function jsonError(res, status, error) {
+    res.writeHead(status, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error }));
+  }
+  function jsonOk(res, data = {}) {
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ ok: true, ...data }));
+  }
+  const allowedOrigins = /* @__PURE__ */ new Set([
+    `http://127.0.0.1:${port}`,
+    `http://localhost:${port}`,
+    ...options.corsOrigins ?? []
+  ]);
+  function addCorsOrigin(origin) {
+    allowedOrigins.add(origin);
+  }
+  function getCorsHeaders(req) {
+    const origin = req.headers.origin;
+    if (!origin) return {};
+    if (allowedOrigins.has(origin)) {
+      return {
+        "Access-Control-Allow-Origin": origin,
+        "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+        "Access-Control-Allow-Headers": "Content-Type, Authorization, Accept",
+        "Access-Control-Max-Age": "86400",
+        Vary: "Origin"
+      };
+    }
+    return {};
+  }
+  class RateLimiter {
+    constructor(_max, _windowMs) {
+      this._max = _max;
+      this._windowMs = _windowMs;
+    }
+    _max;
+    _windowMs;
+    _buckets = /* @__PURE__ */ new Map();
+    _opsSincePrune = 0;
+    check(key) {
+      const now = Date.now();
+      if (++this._opsSincePrune >= 256) {
+        this._opsSincePrune = 0;
+        for (const [k, b] of this._buckets) {
+          if (now >= b.resetAt) this._buckets.delete(k);
+        }
+      }
+      const bucket = this._buckets.get(key);
+      if (!bucket || now >= bucket.resetAt) {
+        this._buckets.set(key, { count: 1, resetAt: now + this._windowMs });
+        return { allowed: true };
+      }
+      if (bucket.count >= this._max) {
+        return { allowed: false, retryAfter: Math.ceil((bucket.resetAt - now) / 1e3) };
+      }
+      bucket.count++;
+      return { allowed: true };
+    }
+  }
+  const joinLimiter = new RateLimiter(10, 6e4);
+  const messageLimiter = new RateLimiter(30, 6e4);
+  const shareLimiter = new RateLimiter(10, 6e4);
+  const getLimiter = new RateLimiter(60, 6e4);
+  const sseLimiter = new RateLimiter(5, 6e4);
+  function getClientIp(req) {
+    return req.socket.remoteAddress ?? "unknown";
+  }
+  function rateLimitError(res, retryAfter) {
+    res.writeHead(429, {
+      "Content-Type": "application/json",
+      "Retry-After": String(retryAfter)
+    });
+    res.end(JSON.stringify({ error: "Too many requests" }));
+  }
+  const httpServer = createServer(async (req, res) => {
+    const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+    if (req.method === "OPTIONS") {
+      const corsHeaders2 = getCorsHeaders(req);
+      if (Object.keys(corsHeaders2).length > 0) {
+        res.writeHead(204, corsHeaders2);
+      } else {
+        res.writeHead(204);
+      }
+      res.end();
+      return;
+    }
+    const corsHeaders = getCorsHeaders(req);
+    for (const [k, v] of Object.entries(corsHeaders)) {
+      res.setHeader(k, v);
+    }
+    if (url.pathname === "/events" && (req.method === "GET" || req.method === "POST")) {
+      const sseCheck = sseLimiter.check(getClientIp(req));
+      if (!sseCheck.allowed) return rateLimitError(res, sseCheck.retryAfter);
+      const authHeader = req.headers.authorization;
+      const sessionToken = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
+      const session = getSession(sessionToken);
+      if (!session) {
+        jsonError(res, 401, "Invalid session token");
+        return;
+      }
+      res.writeHead(200, {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        "Connection": "keep-alive"
+      });
+      res.flushHeaders();
+      res.socket?.setNoDelay(true);
+      sseConnections.set(session.id, res);
+      if (session.kind === "participant") {
+        touchParticipant(session.id);
+        const prev = presenceStatus.get(session.id);
+        if (prev === "unresponsive" || prev === "offline") {
+          presenceStatus.set(session.id, "online");
+          broadcastStatusChange(session.id, session.name, "online", prev, "recovered");
+          log(`${session.name} recovered`);
+        } else if (!prev) {
+          presenceStatus.set(session.id, "online");
+        }
+      }
+      let cleaned = false;
+      const cleanup = () => {
+        if (cleaned) return;
+        cleaned = true;
+        clearInterval(heartbeat);
+        sseConnections.delete(session.id);
+        try {
+          res.end();
+        } catch {
+        }
+      };
+      const heartbeat = setInterval(() => {
+        try {
+          const ok = res.write(":heartbeat\n\n");
+          if (!ok && res.destroyed) {
+            cleanup();
+            return;
+          }
+        } catch {
+          cleanup();
+          return;
+        }
+        if (session.kind === "participant") touchParticipant(session.id);
+      }, 3e4);
+      const history = await room.listEvents(void 0, 50);
+      for (const event of [...history.items].reverse()) {
+        if (event.type === "MessageSent" && (event.message.recipients?.length ?? 0) > 0) {
+          const isParticipant = event.message.recipients.includes(session.id) || event.message.sender_id === session.id;
+          if (!isParticipant) continue;
+        }
+        await enrichAndSend(res, event, room);
+      }
+      const streamEvents = async () => {
+        try {
+          for await (const event of session.channel) {
+            if (event.type === "MessageSent" && (event.message.recipients?.length ?? 0) > 0) {
+              const isParticipant = event.message.recipients.includes(session.id) || event.message.sender_id === session.id;
+              if (!isParticipant) continue;
+            }
+            await enrichAndSend(res, event, room);
+            if (session.kind === "participant") touchParticipant(session.id);
+          }
+        } catch {
+        }
+      };
+      streamEvents();
+      req.on("close", cleanup);
+      return;
+    }
+    if (req.method === "GET") {
+      const sessionToken = extractSessionToken(req, url);
+      const session = getSession(sessionToken);
+      if (sessionToken) {
+        const getCheck = getLimiter.check(sessionToken);
+        if (!getCheck.allowed) return rateLimitError(res, getCheck.retryAfter);
+      }
+      if (session && session.kind === "participant") touchParticipant(session.id);
+      if (url.pathname === "/participants") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        const list = participantSummaries();
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ participants: list }));
+        return;
+      }
+      if (url.pathname === "/rules") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ rules: currentRules }));
+        return;
+      }
+      if (url.pathname.startsWith("/message/")) {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        const messageId = url.pathname.slice("/message/".length);
+        const msg = await room.getMessage(messageId);
+        if (!msg) return jsonError(res, 404, "Message not found");
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ message: msg }));
+        return;
+      }
+      if (url.pathname === "/messages") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        const count = clampInt(url.searchParams.get("count"), 30, 1, 100);
+        const cursor = url.searchParams.get("cursor") ?? null;
+        const result = await room.listMessages(count, cursor);
+        const filtered = {
+          ...result,
+          items: result.items.filter((m) => {
+            if (!m.recipients?.length) return true;
+            if (!session.id) return false;
+            return m.sender_id === session.id || m.recipients.includes(session.id);
+          })
+        };
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(filtered));
+        return;
+      }
+      if (url.pathname === "/events/history") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        const category = url.searchParams.get("category") ?? null;
+        const count = clampInt(url.searchParams.get("count"), 50, 1, 200);
+        const cursor = url.searchParams.get("cursor") ?? null;
+        const result = await room.listEvents(category, count, cursor);
+        const filteredEvents = {
+          ...result,
+          items: result.items.filter((e) => {
+            if (e.type !== "MessageSent" || !e.message.recipients?.length) return true;
+            if (!session.id) return false;
+            return e.message.sender_id === session.id || e.message.recipients.includes(session.id);
+          })
+        };
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(filteredEvents));
+        return;
+      }
+      if (url.pathname === "/search") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        const query = url.searchParams.get("query") ?? "";
+        if (!query) return jsonError(res, 400, "Missing query parameter");
+        const count = clampInt(url.searchParams.get("count"), 10, 1, 50);
+        const cursor = url.searchParams.get("cursor") ?? null;
+        const result = await room.searchMessages(query, count, cursor);
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(result));
+        return;
+      }
+      if (url.pathname.startsWith("/attachment/")) {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        const id = url.pathname.slice("/attachment/".length);
+        const stored = attachmentStore.get(id);
+        if (!stored) return jsonError(res, 404, "Attachment not found");
+        res.writeHead(200, {
+          "Content-Type": stored.mimeType,
+          "Content-Length": String(stored.size),
+          "Content-Disposition": `inline; filename="${stored.name}"`
+        });
+        res.end(stored.bytes);
+        return;
+      }
+    }
+    if (req.method === "POST" && url.pathname === "/attachment") {
+      const attSessionToken = extractSessionToken(req, url);
+      const attSession = getSession(attSessionToken);
+      if (!attSession) return jsonError(res, 401, "Invalid session token");
+      if (!can(attSession.authority, "send_message")) return jsonError(res, 403, "Guests cannot upload attachments");
+      const chunks = [];
+      let totalBytes = 0;
+      let tooBig = false;
+      for await (const chunk of req) {
+        totalBytes += chunk.length;
+        if (totalBytes > MAX_ATTACHMENT_BYTES) {
+          tooBig = true;
+          break;
+        }
+        chunks.push(chunk);
+      }
+      if (tooBig) return jsonError(res, 413, `Attachment too large (max ${MAX_ATTACHMENT_BYTES / 1024 / 1024}MB)`);
+      const bytes = Buffer.concat(chunks);
+      const mimeType = (req.headers["content-type"] ?? "application/octet-stream").split(";")[0].trim();
+      const disposition = req.headers["content-disposition"] ?? "";
+      const filenameMatch = disposition.match(/filename\*?=(?:UTF-8'')?["']?([^"';\r\n]+)/i);
+      const rawName = filenameMatch?.[1]?.trim() ?? req.headers["x-filename"] ?? "attachment";
+      let name;
+      try {
+        name = decodeURIComponent(rawName);
+      } catch {
+        name = rawName;
+      }
+      const id = randomUUID();
+      evictAttachmentsToFit(bytes.length);
+      attachmentStore.set(id, {
+        id,
+        name,
+        mimeType,
+        size: bytes.length,
+        roomId: room.roomId,
+        bytes,
+        uploadedAt: Date.now()
+      });
+      attachmentStoreBytes += bytes.length;
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ id, url: attachmentUrl(id), name, mime_type: mimeType, size: bytes.length }));
+      return;
+    }
+    if (req.method === "PUT" && url.pathname === "/rules") {
+      const sessionToken = extractSessionToken(req, url);
+      const session = getSession(sessionToken);
+      if (!session) return jsonError(res, 401, "Invalid session token");
+      if (!can(session.authority, "clear_history")) {
+        return jsonError(res, 403, "Only admins can update rules");
+      }
+      const body = await parseBody(req);
+      const rawRules = body.rules;
+      if (!Array.isArray(rawRules) || rawRules.some((r) => typeof r !== "string")) {
+        return jsonError(res, 400, "Body must be { rules: string[] }");
+      }
+      const cleaned = rawRules.map((r) => r.trim()).filter((r) => r.length > 0).slice(0, RULES_MAX);
+      currentRules = cleaned;
+      saveRulesForRoom(roomName, currentRules);
+      const adminP = sessionToken ? participants.get(sessionToken) : void 0;
+      broadcastRulesChanged(currentRules, adminP?.name ?? "admin");
+      log(`rules updated by ${adminP?.name ?? session.id} (${currentRules.length} rules)`);
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ rules: currentRules }));
+      return;
+    }
+    if (req.method === "POST") {
+      const body = await parseBody(req);
+      if (url.pathname === "/join") {
+        const joinCheck = joinLimiter.check(getClientIp(req));
+        if (!joinCheck.allowed) return rateLimitError(res, joinCheck.retryAfter);
+        const shareToken = String(body.shareToken ?? body.token ?? "");
+        const legacyType = String(body.type ?? "");
+        let authority;
+        if (shareToken) {
+          const tokenAuthority = tokens.validateShareToken(shareToken);
+          if (!tokenAuthority) return jsonError(res, 403, "Invalid share token");
+          authority = tokenAuthority;
+        } else if (legacyType === "guest") {
+          authority = "guest";
+        } else {
+          authority = "member";
+        }
+        const participantType = String(body.type ?? "human");
+        const name = String(body.name ?? randomName());
+        if (authority === "guest") {
+          const id2 = `obs_${randomUUID().slice(0, 8)}`;
+          const channel2 = room.observe();
+          const sessionToken3 = tokens.createSessionToken(id2, "guest");
+          guests.set(sessionToken3, { id: id2, authority: "guest", channel: channel2, sessionToken: sessionToken3 });
+          idToSession.set(id2, sessionToken3);
+          const participantList2 = participantSummaries();
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({
+            sessionToken: sessionToken3,
+            participantId: id2,
+            roomName,
+            roomId: room.roomId,
+            participants: participantList2,
+            authority: "guest"
+          }));
+          return;
+        }
+        {
+          const entries = [...participants.entries()];
+          const evicting = new Set(
+            seatsToEvict(entries.map(([, p]) => p), { name, type: participantType }).map((s) => s.id)
+          );
+          for (const [tok, existing] of entries) {
+            if (!evicting.has(existing.id)) continue;
+            log(`agent "${name}" rejoined \u2014 replacing its previous seat (${existing.id})`);
+            try {
+              await existing.channel.disconnect(true);
+            } catch {
+            }
+            participants.delete(tok);
+            idToSession.delete(existing.id);
+            tokens.revokeSessionToken(tok);
+            sseConnections.get(existing.id)?.end();
+            sseConnections.delete(existing.id);
+            presenceStatus.delete(existing.id);
+            lastSeenAt.delete(existing.id);
+          }
+        }
+        const id = `${participantType}_${randomUUID().slice(0, 8)}`;
+        const channel = await room.connect(id, name, { type: participantType, authority });
+        const sessionToken2 = tokens.createSessionToken(id, authority);
+        participants.set(sessionToken2, { id, name, type: participantType, authority, channel, sessionToken: sessionToken2 });
+        idToSession.set(id, sessionToken2);
+        touchParticipant(id);
+        presenceStatus.set(id, "online");
+        const participantList = room.listParticipants().map((p) => ({
+          id: p.id,
+          name: p.name,
+          type: p.type,
+          authority: p.authority ?? "member"
+        }));
+        log(`${name} joined (${authority})`);
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({
+          sessionToken: sessionToken2,
+          participantId: id,
+          roomName,
+          roomId: room.roomId,
+          participants: participantList,
+          authority
+        }));
+        return;
+      }
+      const sessionToken = extractSessionToken(req, url, body) ?? "";
+      const session = getSession(sessionToken);
+      if (session && session.kind === "participant") touchParticipant(session.id);
+      if (url.pathname === "/message") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        if (sessionToken) {
+          const msgCheck = messageLimiter.check(sessionToken);
+          if (!msgCheck.allowed) return rateLimitError(res, msgCheck.retryAfter);
+        }
+        if (!can(session.authority, "send_message")) return jsonError(res, 403, "Guests cannot send messages");
+        const content = String(body.content ?? "");
+        const replyTo = body.replyTo ? String(body.replyTo) : void 0;
+        if (!content) return jsonError(res, 400, "Empty message");
+        if (content.length > 5e4) return jsonError(res, 400, "Message too long (max 50000 chars)");
+        const p = participants.get(sessionToken);
+        if (!p) return jsonError(res, 403, "Not a participant");
+        let rawAttachments;
+        if (Array.isArray(body.attachments) && body.attachments.length > 0) {
+          const parsed = AttachmentSchema.array().safeParse(body.attachments);
+          if (!parsed.success) return jsonError(res, 400, `Invalid attachments: ${parsed.error.issues[0]?.message ?? "bad shape"}`);
+          rawAttachments = parsed.data;
+        }
+        let recipientIds;
+        if (Array.isArray(body.recipients) && body.recipients.length > 0) {
+          recipientIds = [];
+          const allParticipants = room.listParticipants();
+          for (const name of body.recipients) {
+            const matches = allParticipants.filter((pp) => pp.name === name);
+            if (matches.length === 0) return jsonError(res, 400, `Unknown participant "${name}"`);
+            if (matches.length > 1) return jsonError(res, 400, `Ambiguous participant name "${name}"`);
+            recipientIds.push(matches[0].id);
+          }
+        }
+        const msg = await p.channel.sendMessage(content, replyTo, void 0, rawAttachments, recipientIds);
+        if (recipientIds && recipientIds.length > 0) {
+          const recipientNames = recipientIds.map((id) => room.listParticipants().find((pp) => pp.id === id)?.name ?? id);
+          const whisperNotified = createEvent({
+            type: "WhisperNotified",
+            category: "ACTIVITY",
+            room_id: room.roomId,
+            participant_id: p.id,
+            sender_id: p.id,
+            sender_name: p.name,
+            recipient_ids: recipientIds,
+            recipient_names: recipientNames
+          });
+          for (const [participantId, sseRes] of sseConnections) {
+            if (!recipientIds.includes(participantId) && participantId !== p.id) {
+              sseRes.write(`data: ${JSON.stringify(whisperNotified)}
+
+`);
+            }
+          }
+        }
+        jsonOk(res, { messageId: msg.id });
+        return;
+      }
+      if (url.pathname === "/event") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        if (!can(session.authority, "send_message")) return jsonError(res, 403, "Guests cannot emit events");
+        const event = body.event;
+        if (!event) return jsonError(res, 400, "Missing event");
+        const p = participants.get(sessionToken);
+        if (!p) return jsonError(res, 403, "Not a participant");
+        await p.channel.emit(event);
+        jsonOk(res);
+        return;
+      }
+      if (url.pathname === "/metrics") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        const p = participants.get(sessionToken);
+        if (!p) return jsonError(res, 403, "Not a participant");
+        const detail = {
+          input_tokens: Number(body.input_tokens) || 0,
+          output_tokens: Number(body.output_tokens) || 0,
+          cache_read_tokens: Number(body.cache_read_tokens) || 0,
+          cache_create_tokens: Number(body.cache_create_tokens) || 0,
+          last_ctx_tokens: Number(body.last_ctx_tokens) || 0,
+          model: typeof body.model === "string" ? body.model : "",
+          participant_name: p.name
+        };
+        await p.channel.emit(createEvent({
+          type: "Activity",
+          category: "ACTIVITY",
+          room_id: room.roomId,
+          participant_id: p.id,
+          action: "metrics",
+          detail
+        }));
+        jsonOk(res);
+        return;
+      }
+      if (url.pathname === "/activity") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        const p = participants.get(sessionToken);
+        if (!p) return jsonError(res, 403, "Not a participant");
+        const label = body.label === null || body.label === void 0 ? null : String(body.label).slice(0, 120);
+        const rawState = body.state === void 0 ? void 0 : String(body.state);
+        const state = rawState === "idle" || rawState === "working" || rawState === "blocked" ? rawState : void 0;
+        if (state) agentStates.set(p.id, { state, at: Date.now() });
+        await p.channel.emit(createEvent({
+          type: "Activity",
+          category: "ACTIVITY",
+          room_id: room.roomId,
+          participant_id: p.id,
+          action: "status_label",
+          detail: { label, participant_name: p.name, ...state ? { state } : {} }
+        }));
+        jsonOk(res);
+        return;
+      }
+      if (url.pathname === "/set-mode") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        const targetId = body.participantId ? String(body.participantId) : session.id;
+        const mode = String(body.mode ?? "");
+        if (!mode) return jsonError(res, 400, "Missing mode");
+        if (targetId !== session.id && !can(session.authority, "set_mode_for")) {
+          return jsonError(res, 403, "Only admins and product owners can change other participants' modes");
+        }
+        const p = participants.get(sessionToken);
+        if (!p) return jsonError(res, 403, "Not a participant");
+        await p.channel.emit(createEvent({
+          type: "Activity",
+          category: "ACTIVITY",
+          room_id: room.roomId,
+          participant_id: targetId,
+          action: "mode_changed",
+          detail: { mode }
+        }));
+        jsonOk(res);
+        return;
+      }
+      if (url.pathname === "/set-authority") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        if (!can(session.authority, "mute")) {
+          return jsonError(res, 403, "Only admins and product owners can change authority");
+        }
+        const targetId = String(body.participantId ?? "");
+        const newAuthority = String(body.authority ?? "");
+        if (!targetId) return jsonError(res, 400, "Missing participantId");
+        if (!["admin", "product_owner", "member", "guest"].includes(newAuthority)) {
+          return jsonError(res, 400, "Invalid authority. Must be admin, product_owner, member, or guest.");
+        }
+        if (targetId === session.id) return jsonError(res, 400, "Cannot change own authority");
+        if (session.authority === "product_owner") {
+          if (!["member", "guest"].includes(newAuthority)) {
+            return jsonError(res, 403, "Product owners can only set member or guest authority");
+          }
+        }
+        const targetSession = idToSession.get(targetId);
+        if (!targetSession) return jsonError(res, 404, "Participant not found");
+        const target = participants.get(targetSession);
+        if (!target) return jsonError(res, 404, "Participant not found");
+        if (session.authority === "product_owner") {
+          const currentAuthority = target.authority ?? "member";
+          if (currentAuthority === "admin" || currentAuthority === "product_owner") {
+            return jsonError(res, 403, "Cannot change authority of admins or product owners");
+          }
+        }
+        target.authority = newAuthority;
+        tokens.updateSessionAuthority(targetSession, newAuthority);
+        room.setParticipantAuthority(targetId, newAuthority);
+        const adminP = participants.get(sessionToken);
+        const targetParticipant = room.listParticipants().find((p) => p.id === targetId);
+        if (adminP && targetParticipant) {
+          await adminP.channel.emit(createEvent({
+            type: "AuthorityChanged",
+            category: "PRESENCE",
+            room_id: room.roomId,
+            participant_id: targetId,
+            participant: targetParticipant,
+            new_authority: newAuthority,
+            changed_by: adminP.name
+          }));
+        }
+        log(`${target.name} authority \u2192 ${newAuthority}`);
+        jsonOk(res);
+        return;
+      }
+      if (url.pathname === "/ping") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        if (!can(session.authority, "ping")) return jsonError(res, 403, "Guests cannot ping");
+        const targetId = String(body.participantId ?? "");
+        if (!targetId) return jsonError(res, 400, "Missing participantId");
+        const p = participants.get(sessionToken);
+        if (!p) return jsonError(res, 403, "Not a participant");
+        await p.channel.ping(targetId);
+        jsonOk(res);
+        return;
+      }
+      if (url.pathname === "/kick") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        if (!can(session.authority, "kick")) return jsonError(res, 403, "Only admins can kick");
+        const targetId = String(body.participantId ?? "");
+        if (!targetId) return jsonError(res, 400, "Missing participantId");
+        const targetSession = idToSession.get(targetId);
+        if (targetSession) {
+          const targetParticipant = participants.get(targetSession);
+          const targetGuest = guests.get(targetSession);
+          const target = targetParticipant ?? targetGuest;
+          if (target) {
+            const adminP = participants.get(sessionToken);
+            const roomParticipant = room.listParticipants().find((p) => p.id === targetId);
+            if (adminP && roomParticipant) {
+              await adminP.channel.emit(createEvent({
+                type: "ParticipantKicked",
+                category: "PRESENCE",
+                room_id: room.roomId,
+                participant_id: targetId,
+                participant: roomParticipant,
+                kicked_by: adminP.name
+              }));
+            }
+            if (targetParticipant) {
+              const prevStatus = presenceStatus.get(targetId) ?? "online";
+              if (prevStatus !== "offline") {
+                broadcastStatusChange(targetId, targetParticipant.name, "offline", prevStatus, "kicked");
+              }
+              lastSeenAt.delete(targetId);
+              presenceStatus.delete(targetId);
+            }
+            await target.channel.disconnect(true);
+            participants.delete(targetSession);
+            guests.delete(targetSession);
+            idToSession.delete(targetId);
+            tokens.revokeSessionToken(targetSession);
+            if (targetParticipant?.type === "agent") {
+              const outcome = terminateLocalAgent(targetParticipant.name, { killTmux: tmuxKillSession });
+              if (outcome.stopped) {
+                log(`kicked ${targetParticipant.name}: stopped local ${outcome.runtime} runtime (pid ${outcome.pid})`);
+              } else {
+                log(`kicked ${targetParticipant.name}: disconnected only (${outcome.reason})`);
+              }
+            }
+            const sse = sseConnections.get(targetId);
+            if (sse) {
+              sse.end();
+              sseConnections.delete(targetId);
+            }
+            log(`kicked ${targetId}`);
+          }
+        }
+        jsonOk(res);
+        return;
+      }
+      if (url.pathname === "/clear") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        if (!can(session.authority, "clear_history")) return jsonError(res, 403, "Only admins can clear");
+        await storage.clearRoom(room.roomId);
+        for (const [id, att] of attachmentStore) {
+          if (att.roomId === room.roomId) {
+            attachmentStore.delete(id);
+            attachmentStoreBytes -= att.size;
+          }
+        }
+        const adminP = participants.get(sessionToken);
+        const clearEvent = createEvent({
+          type: "RoomCleared",
+          category: "ACTIVITY",
+          room_id: room.roomId,
+          participant_id: session.id,
+          cleared_by: adminP?.name ?? "admin"
+        });
+        broadcastToAll(clearEvent);
+        log(`room cleared by ${adminP?.name ?? session.id}`);
+        jsonOk(res);
+        return;
+      }
+      if (url.pathname === "/share") {
+        if (!session) return jsonError(res, 401, "Invalid session token");
+        if (sessionToken) {
+          const shareCheck = shareLimiter.check(sessionToken);
+          if (!shareCheck.allowed) return rateLimitError(res, shareCheck.retryAfter);
+        }
+        if (!can(session.authority, "create_share_link")) return jsonError(res, 403, "Guests cannot create share links");
+        const targetAuthority = body.authority ?? void 0;
+        const links = {};
+        if (targetAuthority) {
+          const token = tokens.generateShareToken(session.authority, targetAuthority);
+          if (!token) return jsonError(res, 403, `Cannot generate ${targetAuthority} link`);
+          links[targetAuthority] = buildShareUrl(publicUrl, token);
+        } else {
+          const tiers = ["admin", "product_owner", "member", "guest"];
+          for (const tier of tiers) {
+            const token = tokens.generateShareToken(session.authority, tier);
+            if (token) links[tier] = buildShareUrl(publicUrl, token);
+          }
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ links }));
+        return;
+      }
+      if (url.pathname === "/tunnel") {
+        if (!session || !can(session.authority, "start_tunnel")) return jsonError(res, 403, "Admin only");
+        if (tunnelProcess) {
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ url: publicUrl, alreadyRunning: true }));
+          return;
+        }
+        try {
+          tunnelProcess = await startTunnel(port);
+          if (!tunnelProcess) {
+            return jsonError(res, 500, "Could not start cloudflared \u2014 is it installed?");
+          }
+          const tunnelUrl = await waitForTunnelUrl(tunnelProcess);
+          if (!tunnelUrl) {
+            tunnelProcess.kill();
+            tunnelProcess = null;
+            return jsonError(res, 504, "Tunnel started but timed out waiting for URL");
+          }
+          publicUrl = tunnelUrl;
+          addCorsOrigin(tunnelUrl);
+          saveRoomSession({ roomName, bind: boundAddress, serverUrl, publicUrl, adminToken, memberToken, pid: process.pid });
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ url: tunnelUrl, alreadyRunning: false }));
+        } catch {
+          return jsonError(res, 500, "Failed to start tunnel");
+        }
+        return;
+      }
+      if (url.pathname === "/rotate-token") {
+        if (!session || !sessionToken) return jsonError(res, 401, "Invalid session token");
+        const result = tokens.rotateSessionToken(sessionToken);
+        if (!result) return jsonError(res, 401, "Token expired or invalid");
+        const p = participants.get(sessionToken);
+        if (p) {
+          participants.delete(sessionToken);
+          p.sessionToken = result.newToken;
+          participants.set(result.newToken, p);
+          idToSession.set(p.id, result.newToken);
+        }
+        const g = guests.get(sessionToken);
+        if (g) {
+          guests.delete(sessionToken);
+          g.sessionToken = result.newToken;
+          guests.set(result.newToken, g);
+          idToSession.set(g.id, result.newToken);
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ sessionToken: result.newToken }));
+        return;
+      }
+      if (url.pathname === "/disconnect") {
+        const targetToken = extractSessionToken(req, url, body) ?? "";
+        if (targetToken) {
+          const p = participants.get(targetToken);
+          if (p) {
+            const prevStatus = presenceStatus.get(p.id) ?? "online";
+            if (prevStatus !== "offline") {
+              broadcastStatusChange(p.id, p.name, "offline", prevStatus, "left");
+            }
+            await p.channel.disconnect();
+            participants.delete(targetToken);
+            idToSession.delete(p.id);
+            tokens.revokeSessionToken(targetToken);
+            lastSeenAt.delete(p.id);
+            presenceStatus.delete(p.id);
+            const sse = sseConnections.get(p.id);
+            if (sse) {
+              sse.end();
+              sseConnections.delete(p.id);
+            }
+            log(`${p.name} disconnected`);
+          }
+          const g = guests.get(targetToken);
+          if (g) {
+            await g.channel.disconnect();
+            guests.delete(targetToken);
+            idToSession.delete(g.id);
+            tokens.revokeSessionToken(targetToken);
+            const sse = sseConnections.get(g.id);
+            if (sse) {
+              sse.end();
+              sseConnections.delete(g.id);
+            }
+          }
+        }
+        jsonOk(res);
+        return;
+      }
+    }
+    res.writeHead(404).end("Not found");
+  });
+  httpServer.on("error", (err) => {
+    if (err.code === "EADDRINUSE") {
+      console.error(`
+Port ${port} is already in use. Another apiary instance may be running.`);
+      console.error(`  Kill it:   lsof -ti :${port} | xargs kill`);
+      console.error(`  Or use:    apiary --port ${port + 1}
+`);
+      process.exit(1);
+    }
+    throw err;
+  });
+  await new Promise((resolve2) => {
+    httpServer.listen(port, boundAddress, () => resolve2());
+  });
+  const pruneInterval = setInterval(() => tokens.pruneExpired(), 5 * 60 * 1e3);
+  pruneInterval.unref();
+  const OFFLINE_GC_MS = 24 * 60 * 60 * 1e3;
+  const presenceInterval = setInterval(() => {
+    const now = Date.now();
+    for (const [sessionToken, p] of participants) {
+      const last = lastSeenAt.get(p.id) ?? now;
+      const elapsed = now - last;
+      const current = presenceStatus.get(p.id) ?? "online";
+      if (current === "online" && elapsed > UNRESPONSIVE_AFTER_MS) {
+        presenceStatus.set(p.id, "unresponsive");
+        broadcastStatusChange(p.id, p.name, "unresponsive", "online", "ping_timeout");
+        log(`${p.name} unresponsive`);
+      } else if (current === "unresponsive" && elapsed > OFFLINE_AFTER_MS) {
+        presenceStatus.set(p.id, "offline");
+        broadcastStatusChange(p.id, p.name, "offline", "unresponsive", "ping_timeout");
+        log(`${p.name} offline (timeout)`);
+      } else if (current === "offline" && elapsed > OFFLINE_GC_MS) {
+        participants.delete(sessionToken);
+        idToSession.delete(p.id);
+        tokens.revokeSessionToken(sessionToken);
+        const sse = sseConnections.get(p.id);
+        if (sse) {
+          try {
+            sse.end();
+          } catch {
+          }
+          sseConnections.delete(p.id);
+        }
+        lastSeenAt.delete(p.id);
+        presenceStatus.delete(p.id);
+        log(`${p.name} purged after ${Math.round(elapsed / 6e4)}min offline`);
+      }
+    }
+  }, PRESENCE_CHECK_INTERVAL_MS);
+  presenceInterval.unref();
+  if (options.share) {
+    tunnelProcess = await startTunnel(port);
+    if (tunnelProcess) {
+      const tunnelUrl = await waitForTunnelUrl(tunnelProcess);
+      if (tunnelUrl) {
+        publicUrl = tunnelUrl;
+        addCorsOrigin(tunnelUrl);
+      }
+    }
+  }
+  const adminToken = tokens.generateShareToken("admin", "admin", { neverExpires: true });
+  const memberToken = tokens.generateShareToken("admin", "member", { neverExpires: true });
+  saveRoomSession({ roomName, bind: boundAddress, serverUrl, publicUrl, adminToken, memberToken, pid: process.pid });
+  function obfuscate(token) {
+    if (token.length <= 8) return "****";
+    return token.slice(0, 4) + "..." + token.slice(-4);
+  }
+  if (options.headless) {
+    process.stdout.write(JSON.stringify({ serverUrl, publicUrl, roomName, adminToken, memberToken, savePath }) + "\n");
+    process.stderr.write("Warning: raw tokens in stdout \u2014 do not share this output.\n");
+  } else if (!options.quiet) {
+    let version = process.env.npm_package_version ?? "";
+    if (!version) {
+      try {
+        const require2 = createRequire(import.meta.url);
+        const pkg = require2("../../package.json");
+        version = pkg.version ?? "unknown";
+      } catch {
+        version = "unknown";
+      }
+    }
+    const adminUrlObfuscated = buildShareUrl(publicUrl, obfuscate(adminToken));
+    const joinUrlObfuscated = buildShareUrl(publicUrl, obfuscate(memberToken));
+    process.stdout.write(`\x1B]0;${roomEmoji(roomName)} apiary \xB7 ${roomName}\x07`);
+    const Y = "\x1B[33m";
+    const C = "\x1B[36m";
+    const D = "\x1B[2m";
+    const B = "\x1B[1m";
+    const R = "\x1B[0m";
+    console.log(`
+  ${Y}${B}apiary${R} ${D}v${version}${R}
+
+  ${D}Room:${R}    ${Y}${roomName}${R}
+  ${D}Server:${R}  ${C}${serverUrl}${R}${publicUrl !== serverUrl ? `
+  ${D}Tunnel:${R}  ${C}${publicUrl}${R}` : ""}
+  ${D}Saving:${R}  ${D}${savePath}${R}
+
+  ${D}Share:${R}   ${Y}${joinUrlObfuscated}${R}
+  ${D}Admin:${R}   ${Y}${adminUrlObfuscated}${R}
+
+  ${D}Join:${R}   ${C}apiary join${R} ${D}<url>${R}
+  ${D}Agent:${R}  ${C}apiary claude${R} ${D}<name>${R}  ${D}\u2192 tell it the URL, it joins${R}
+`);
+  }
+  const shutdown = async () => {
+    log("shutting down...");
+    clearInterval(presenceInterval);
+    unwatchFile(rulesFilePath, onRulesFileChange);
+    clearRoomSession(roomName);
+    if (!options.save && !options.load) {
+      try {
+        rmSync2(savePath);
+      } catch {
+      }
+    }
+    if (tunnelProcess) {
+      tunnelProcess.kill();
+      tunnelProcess = null;
+    }
+    for (const [id, sse] of sseConnections) {
+      sse.end();
+      sseConnections.delete(id);
+    }
+    for (const p of participants.values()) {
+      await p.channel.disconnect().catch(() => {
+      });
+    }
+    for (const g of guests.values()) {
+      await g.channel.disconnect().catch(() => {
+      });
+    }
+    await new Promise((resolve2, reject) => {
+      httpServer.close((err) => err ? reject(err) : resolve2());
+    });
+    process.exit(0);
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+  const reapTunnel = () => {
+    if (tunnelProcess && !tunnelProcess.killed) {
+      try {
+        tunnelProcess.kill("SIGTERM");
+      } catch {
+      }
+    }
+  };
+  process.on("exit", reapTunnel);
+  process.on("uncaughtException", (err) => {
+    log(`fatal: uncaughtException \u2014 ${err.message}`);
+    reapTunnel();
+    process.exit(1);
+  });
+  process.on("unhandledRejection", (reason) => {
+    log(`fatal: unhandledRejection \u2014 ${reason instanceof Error ? reason.message : String(reason)}`);
+    reapTunnel();
+    process.exit(1);
+  });
+  return { serverUrl, publicUrl, roomName, adminToken, memberToken };
+}
+function logServer(message) {
+  console.log(`  [${formatTimestamp(/* @__PURE__ */ new Date())}] ${message}`);
+}
+function cloudflaredAvailable() {
+  try {
+    execFileSync2("which", ["cloudflared"], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function startTunnel(port) {
+  if (!cloudflaredAvailable()) {
+    console.error("  --share requires cloudflared. Install: brew install cloudflared");
+    return null;
+  }
+  const child = spawn2("cloudflared", ["tunnel", "--url", `http://localhost:${port}`], {
+    stdio: ["ignore", "ignore", "pipe"]
+  });
+  child.on("error", () => {
+  });
+  return child;
+}
+function waitForTunnelUrl(child, timeoutMs = 15e3) {
+  return new Promise((resolve2) => {
+    let resolved = false;
+    let buffer = "";
+    const timer = setTimeout(() => {
+      if (!resolved) {
+        resolved = true;
+        resolve2(null);
+      }
+    }, timeoutMs);
+    child.stderr?.on("data", (chunk) => {
+      buffer += chunk.toString();
+      const match = buffer.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/);
+      if (match && !resolved) {
+        resolved = true;
+        clearTimeout(timer);
+        resolve2(match[0]);
+      }
+    });
+    child.on("exit", () => {
+      if (!resolved) {
+        resolved = true;
+        clearTimeout(timer);
+        resolve2(null);
+      }
+    });
+  });
+}
+
+export {
+  tailnetAddress,
+  lanAddress,
+  ALL_INTERFACES,
+  LOOPBACK,
+  resolveBindAddress,
+  roomRulesPath,
+  loadConfig,
+  saveConfig,
+  agentEmoji,
+  roomEmoji,
+  saveAgentSession,
+  clearAgentSession,
+  listAgentSessions,
+  isAgentAlive,
+  tmuxAvailable,
+  tmuxSessionExists,
+  tmuxCreateSession,
+  tmuxSendCommand,
+  tmuxInjectText,
+  tmuxInjectPaste,
+  tmuxSendEnter,
+  tmuxAttach,
+  tmuxCapturePane,
+  tmuxSendKey,
+  tmuxKillSession,
+  resetTerminal,
+  tmuxPaneIsShell,
+  INVITES_DIR,
+  saveRoomSession,
+  listRoomSessions,
+  removeRoomSession,
+  serve
+};
+//# sourceMappingURL=chunk-CZHO4DBN.js.map