@hearsay-tools/squawk 0.0.0-stage → 0.17.0-pr3058.5683

package/dist/server/open-in-terminal.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Open a real terminal window at `cwd` running `command` — the "take over the
+ * agent session locally" handoff. Cross-platform strategy ported from
+ * github-janitor's `openInTerminal.ts`: macOS via osascript, Windows via
+ * cmd/start, Linux by probing common emulators with a temp launch script
+ * (which sidesteps per-emulator quoting rules). WSL (#361) reuses the Linux
+ * script but hands it to a Windows-side terminal through interop, re-entering
+ * the distro with `wsl.exe` — there is no Linux desktop of its own to open
+ * `x-terminal-emulator` etc. on.
+ *
+ * Returns true when a launcher was started without an immediate error; the
+ * caller shows a copy-the-command fallback otherwise.
+ */
+export declare function openInTerminal(cwd: string, command: string, 
+/** Environment the opened shell must carry — today, the agent account's config dir (spec
+ *  2026-07-29-agent-profiles). Rendered per platform and made to PERSIST, because the window
+ *  stays open and the user types the next `claude` in it themselves. An empty/absent env
+ *  changes nothing about the command. Returns false without launching anything when the
+ *  values cannot be embedded safely: a terminal silently aimed at the wrong account is worse
+ *  than no terminal, since nothing in the window would say so. */
+env?: Record<string, string>): Promise<boolean>;
+/** The Windows-side (bin, args) candidates for launching `scriptPath` inside `distro` through
+ *  WSL interop, in try-order — Windows Terminal first, a classic console window as fallback. Pure
+ *  (no spawning) so the exact command line is unit-testable without a real WSL host.
+ *
+ *  Every launcher here is shell-free by construction, and must stay that way: routing through
+ *  `cmd.exe` (`/c start …`) would reintroduce BatBadBut (CVE-2024-27980, see #459). Passing an
+ *  argument array is NOT protection when the binary is a shell — libuv only quotes arguments
+ *  containing space, tab or quote, so a space-free `distro` like `a&calc&` would reach `cmd`
+ *  live and be interpreted. `wt.exe` and `conhost.exe` parse no metacharacters, so the same
+ *  input is inert. `distro` is additionally validated at the source (`wslDistroName`). */
+export declare function wslTerminalLaunchers(scriptPath: string, distro: string): Array<[string, string[]]>;
+/** Grace period before a launch script's directory is removed. Generous next to the
+ *  ~250 ms each emulator candidate is given, because the cost of being early is a
+ *  window that never opens, and the cost of being late is a few hundred bytes. */
+export declare const LAUNCH_SCRIPT_TTL_MS = 60000;
+/**
+ * Writes the temp launch script shared by the plain-Linux and WSL branches — `cd` into
+ * the worktree, run `command`, then drop into an interactive shell so the window stays
+ * open — and schedules its own removal (#785).
+ *
+ * Every "open in terminal" used to leave its `cez-term-*` directory behind forever. On a
+ * host whose `/tmp` is a tmpfs that never reboots, cezar's own litter is part of what
+ * exhausts the directory the agents' output capture depends on, so the opener cleans up
+ * after itself. Deleting the script mid-run is safe: the emulator has already `exec`'d
+ * bash on it, and POSIX keeps an unlinked file's inode alive for every open descriptor.
+ * The timer is `unref`'d — a pending cleanup must never be the reason `cezar serve`
+ * refuses to exit.
+ *
+ * Exported for the regression test, which must prove the directory does not survive
+ * without spawning a real terminal emulator.
+ */
+export declare function createLaunchScript(cwd: string, command: string, ttlMs?: number): string;
+/**
+ * A test that reaches a real launcher opens a window on the developer's machine — a Terminal on
+ * macOS, a `cmd` window on Windows, an emulator on Linux — and #820 is what that looks like: a
+ * suite run left a Terminal sitting in a `cez-profiles-home-*` fixture directory the same run had
+ * already deleted. Throwing beats returning `false`: a silent refusal would let the omission
+ * survive as a passing test, and the fix is always the same one line — inject the launcher seam
+ * (`openTerminal` / `openFile` / `openApp` on `ServerDeps`) instead of reaching the real one.
+ *
+ * `CEZ_ALLOW_TEST_SPAWN=1` is the deliberate exception, for a file that has replaced
+ * `node:child_process` with a mock: nothing reaches a real process there, and asserting the argv a
+ * launcher WOULD pass is exactly how the Windows launcher-safety cases (#469, BatBadBut) are
+ * pinned. Set it around those tests, never process-wide.
+ *
+ * Exported so `open-in-app.ts` shares this one definition rather than keeping a second copy that
+ * could drift.
+ */
+export declare function refuseSpawnUnderTest(bin: string, args: readonly string[]): void;
+/** Starts a launcher cezar never stops; success = no spawn error within a short settle window.
+ *  Exported so `open-in-app.ts` launches through the same guard. */
+export declare function runDetached(bin: string, args: string[]): Promise<boolean>;

package/dist/server/open-in-terminal.js

@@ -0,0 +1,160 @@
+import { productEnv } from '../core/product-env.js';
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { shellQuote, withEnvPrefix } from '../core/shell-env.js';
+import { startAndForget } from '../detached-process.js';
+import { isWsl, wslDistroName } from './wsl.js';
+/**
+ * Open a real terminal window at `cwd` running `command` — the "take over the
+ * agent session locally" handoff. Cross-platform strategy ported from
+ * github-janitor's `openInTerminal.ts`: macOS via osascript, Windows via
+ * cmd/start, Linux by probing common emulators with a temp launch script
+ * (which sidesteps per-emulator quoting rules). WSL (#361) reuses the Linux
+ * script but hands it to a Windows-side terminal through interop, re-entering
+ * the distro with `wsl.exe` — there is no Linux desktop of its own to open
+ * `x-terminal-emulator` etc. on.
+ *
+ * Returns true when a launcher was started without an immediate error; the
+ * caller shows a copy-the-command fallback otherwise.
+ */
+export async function openInTerminal(cwd, command, 
+/** Environment the opened shell must carry — today, the agent account's config dir (spec
+ *  2026-07-29-agent-profiles). Rendered per platform and made to PERSIST, because the window
+ *  stays open and the user types the next `claude` in it themselves. An empty/absent env
+ *  changes nothing about the command. Returns false without launching anything when the
+ *  values cannot be embedded safely: a terminal silently aimed at the wrong account is worse
+ *  than no terminal, since nothing in the window would say so. */
+env = {}) {
+    const prefixed = withEnvPrefix(command, env, process.platform);
+    if (prefixed === null)
+        return false;
+    if (process.platform === 'darwin') {
+        const script = `cd ${shellQuote(cwd)} && ${prefixed}`;
+        return runDetached('osascript', [
+            '-e',
+            'tell application "Terminal" to activate',
+            '-e',
+            `tell application "Terminal" to do script ${appleScriptQuote(script)}`,
+        ]);
+    }
+    if (process.platform === 'win32') {
+        const inner = `cd /d "${cwd}" && ${prefixed}`;
+        // Windows Terminal first, classic cmd window as fallback.
+        if (await runDetached('cmd', ['/c', 'start', '', 'wt', '-d', cwd, 'cmd', '/K', prefixed])) {
+            return true;
+        }
+        return runDetached('cmd', ['/c', 'start', '', 'cmd', '/K', inner]);
+    }
+    // Linux/other: a temp script avoids each emulator's own quoting rules. It reaps
+    // itself afterwards (#785) — see `createLaunchScript`.
+    const scriptPath = createLaunchScript(cwd, prefixed);
+    if (isWsl()) {
+        // No Linux GUI here — go through interop to a Windows terminal, which re-enters this same
+        // distro (`wsl.exe -d <distro>`) to run the script we just wrote. `scriptPath`/`cwd` stay
+        // POSIX: `wsl.exe` interprets its command line inside the distro, not on the Windows side.
+        for (const [bin, args] of wslTerminalLaunchers(scriptPath, wslDistroName())) {
+            if (await runDetached(bin, args))
+                return true;
+        }
+        return false;
+    }
+    const candidates = [
+        ['x-terminal-emulator', ['-e', scriptPath]],
+        ['gnome-terminal', ['--', scriptPath]],
+        ['konsole', ['-e', scriptPath]],
+        ['wezterm', ['start', '--', scriptPath]],
+        ['kitty', [scriptPath]],
+        ['alacritty', ['-e', scriptPath]],
+        ['xterm', ['-e', scriptPath]],
+    ];
+    for (const [bin, args] of candidates) {
+        if (await runDetached(bin, args))
+            return true;
+    }
+    return false;
+}
+/** The Windows-side (bin, args) candidates for launching `scriptPath` inside `distro` through
+ *  WSL interop, in try-order — Windows Terminal first, a classic console window as fallback. Pure
+ *  (no spawning) so the exact command line is unit-testable without a real WSL host.
+ *
+ *  Every launcher here is shell-free by construction, and must stay that way: routing through
+ *  `cmd.exe` (`/c start …`) would reintroduce BatBadBut (CVE-2024-27980, see #459). Passing an
+ *  argument array is NOT protection when the binary is a shell — libuv only quotes arguments
+ *  containing space, tab or quote, so a space-free `distro` like `a&calc&` would reach `cmd`
+ *  live and be interpreted. `wt.exe` and `conhost.exe` parse no metacharacters, so the same
+ *  input is inert. `distro` is additionally validated at the source (`wslDistroName`). */
+export function wslTerminalLaunchers(scriptPath, distro) {
+    return [
+        ['wt.exe', ['wsl.exe', '-d', distro, '--', scriptPath]],
+        ['conhost.exe', ['wsl.exe', '-d', distro, '--', scriptPath]],
+    ];
+}
+/** Grace period before a launch script's directory is removed. Generous next to the
+ *  ~250 ms each emulator candidate is given, because the cost of being early is a
+ *  window that never opens, and the cost of being late is a few hundred bytes. */
+export const LAUNCH_SCRIPT_TTL_MS = 60_000;
+/**
+ * Writes the temp launch script shared by the plain-Linux and WSL branches — `cd` into
+ * the worktree, run `command`, then drop into an interactive shell so the window stays
+ * open — and schedules its own removal (#785).
+ *
+ * Every "open in terminal" used to leave its `cez-term-*` directory behind forever. On a
+ * host whose `/tmp` is a tmpfs that never reboots, cezar's own litter is part of what
+ * exhausts the directory the agents' output capture depends on, so the opener cleans up
+ * after itself. Deleting the script mid-run is safe: the emulator has already `exec`'d
+ * bash on it, and POSIX keeps an unlinked file's inode alive for every open descriptor.
+ * The timer is `unref`'d — a pending cleanup must never be the reason `cezar serve`
+ * refuses to exit.
+ *
+ * Exported for the regression test, which must prove the directory does not survive
+ * without spawning a real terminal emulator.
+ */
+export function createLaunchScript(cwd, command, ttlMs = LAUNCH_SCRIPT_TTL_MS) {
+    const dir = mkdtempSync(join(tmpdir(), 'cez-term-'));
+    const scriptPath = join(dir, 'launch.sh');
+    writeFileSync(scriptPath, `#!/usr/bin/env bash\ncd ${shellQuote(cwd)}\n${command}\nexec bash\n`, 'utf8');
+    chmodSync(scriptPath, 0o755);
+    const timer = setTimeout(() => {
+        try {
+            rmSync(dir, { recursive: true, force: true });
+        }
+        catch {
+            // best-effort: a launch script we cannot remove is litter, not a failure.
+        }
+    }, ttlMs);
+    timer.unref?.();
+    return scriptPath;
+}
+/**
+ * A test that reaches a real launcher opens a window on the developer's machine — a Terminal on
+ * macOS, a `cmd` window on Windows, an emulator on Linux — and #820 is what that looks like: a
+ * suite run left a Terminal sitting in a `cez-profiles-home-*` fixture directory the same run had
+ * already deleted. Throwing beats returning `false`: a silent refusal would let the omission
+ * survive as a passing test, and the fix is always the same one line — inject the launcher seam
+ * (`openTerminal` / `openFile` / `openApp` on `ServerDeps`) instead of reaching the real one.
+ *
+ * `CEZ_ALLOW_TEST_SPAWN=1` is the deliberate exception, for a file that has replaced
+ * `node:child_process` with a mock: nothing reaches a real process there, and asserting the argv a
+ * launcher WOULD pass is exactly how the Windows launcher-safety cases (#469, BatBadBut) are
+ * pinned. Set it around those tests, never process-wide.
+ *
+ * Exported so `open-in-app.ts` shares this one definition rather than keeping a second copy that
+ * could drift.
+ */
+export function refuseSpawnUnderTest(bin, args) {
+    if (!process.env.VITEST || productEnv('ALLOW_TEST_SPAWN') === '1')
+        return;
+    throw new Error(`refusing to spawn a launcher from a test: ${[bin, ...args].join(' ')}\n` +
+        'Inject the launcher (ServerDeps.openTerminal / openFile / openApp) instead of calling the real one.');
+}
+/** Starts a launcher cezar never stops; success = no spawn error within a short settle window.
+ *  Exported so `open-in-app.ts` launches through the same guard. */
+export async function runDetached(bin, args) {
+    refuseSpawnUnderTest(bin, args);
+    return startAndForget(bin, args);
+}
+function appleScriptQuote(s) {
+    return `"${s.replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
+}
+//# sourceMappingURL=open-in-terminal.js.map

package/dist/server/open-in-terminal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-in-terminal.js","sourceRoot":"","sources":["../../src/server/open-in-terminal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,OAAe;AACf;;;;;kEAKkE;AAClE,GAAG,GAA2B,EAAE;IAEhC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAEpC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,QAAQ,EAAE,CAAC;QACtD,OAAO,WAAW,CAAC,WAAW,EAAE;YAC9B,IAAI;YACJ,yCAAyC;YACzC,IAAI;YACJ,4CAA4C,gBAAgB,CAAC,MAAM,CAAC,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,UAAU,GAAG,QAAQ,QAAQ,EAAE,CAAC;QAC9C,0DAA0D;QAC1D,IAAI,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,WAAW,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,gFAAgF;IAChF,uDAAuD;IACvD,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAErD,IAAI,KAAK,EAAE,EAAE,CAAC;QACZ,0FAA0F;QAC1F,0FAA0F;QAC1F,2FAA2F;QAC3F,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,oBAAoB,CAAC,UAAU,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;YAC5E,IAAI,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAA8B;QAC5C,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC3C,CAAC,gBAAgB,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACtC,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/B,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACxC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;QACvB,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACjC,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;KAC9B,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;QACrC,IAAI,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;0FAS0F;AAC1F,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,MAAc;IACrE,OAAO;QACL,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACvD,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED;;kFAEkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAW,EACX,OAAe,EACf,KAAK,GAAW,oBAAoB;IAEpC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC1C,aAAa,CAAC,UAAU,EAAE,2BAA2B,UAAU,CAAC,GAAG,CAAC,KAAK,OAAO,eAAe,EAAE,MAAM,CAAC,CAAC;IACzG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC,EAAE,KAAK,CAAC,CAAC;IACV,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,IAAuB;IACvE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,UAAU,CAAC,kBAAkB,CAAC,KAAK,GAAG;QAAE,OAAO;IAC1E,MAAM,IAAI,KAAK,CACb,6CAA6C,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;QACvE,qGAAqG,CACxG,CAAC;AACJ,CAAC;AAED;oEACoE;AACpE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,IAAc;IAC3D,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;AAClE,CAAC"}

package/dist/server/preview-cdp-socket.d.ts

@@ -0,0 +1,21 @@
+import type { PreviewHost } from '../preview/host.ts';
+import { type PreviewSocket } from './preview-socket.ts';
+/**
+ * The agent's CDP proxy socket (hearsay-tools/cezarion#784, spec 2026-10-26-preview-agent-cdp):
+ * `CEZ_PREVIEW_CDP_URL` points here, and `agent-browser --cdp <url>` connects to it as it would to
+ * Chromium's own browser endpoint. Workspace-level: the token alone names the run.
+ *
+ * Refused before the handshake: the feature off, a `Host` that is neither loopback nor the cockpit's
+ * own bound origin (DNS rebinding), any `Origin` (a web page; an agent's CDP client sends none), and
+ * a token no live session holds.
+ */
+export declare const PREVIEW_CDP_WS_PATHS: string[];
+export type PreviewCdpHost = Pick<PreviewHost, 'hasAgentGrant' | 'connectAgent'>;
+export interface PreviewCdpSocketDeps {
+    /** Absent when `CEZ_PREVIEW` was off at boot: the path answers 404. */
+    host?: PreviewCdpHost | undefined;
+    /** The cockpit's bound origin (`CEZ_COCKPIT_URL`), whose host the agent's address names. */
+    cockpitOrigin?: () => string | undefined;
+    heartbeatMs?: number;
+}
+export declare function createPreviewCdpSocket(deps: PreviewCdpSocketDeps): PreviewSocket;

package/dist/server/preview-cdp-socket.js

@@ -0,0 +1,112 @@
+import { WebSocketServer } from 'ws';
+import { previewToolEnabled } from '../ci-wait/tools.js';
+import { isLoopbackHostHeader } from './capabilities.js';
+import { keepAlive, reject } from './preview-socket.js';
+import { matchPath } from './upgrade-router.js';
+/**
+ * The agent's CDP proxy socket (hearsay-tools/cezarion#784, spec 2026-10-26-preview-agent-cdp):
+ * `CEZ_PREVIEW_CDP_URL` points here, and `agent-browser --cdp <url>` connects to it as it would to
+ * Chromium's own browser endpoint. Workspace-level: the token alone names the run.
+ *
+ * Refused before the handshake: the feature off, a `Host` that is neither loopback nor the cockpit's
+ * own bound origin (DNS rebinding), any `Origin` (a web page; an agent's CDP client sends none), and
+ * a token no live session holds.
+ */
+export const PREVIEW_CDP_WS_PATHS = ['/api/v1/preview/cdp/:token'];
+/** Same reaping cadence as the subscription hub and the pane socket. */
+const HEARTBEAT_MS = 30_000;
+/** A CDP command is small, but `Runtime.evaluate` can carry a whole script; Chrome itself takes far more. */
+const MAX_PAYLOAD_BYTES = 32 * 1024 * 1024;
+/** A WebSocket close reason holds at most 123 bytes. */
+const MAX_REASON_BYTES = 123;
+function reasonOf(text) {
+    const bytes = Buffer.from(text, 'utf8');
+    return bytes.length <= MAX_REASON_BYTES ? text : bytes.subarray(0, MAX_REASON_BYTES).toString('utf8').replace(/�+$/, '');
+}
+export function createPreviewCdpSocket(deps) {
+    const heartbeatMs = deps.heartbeatMs ?? HEARTBEAT_MS;
+    const wss = new WebSocketServer({ noServer: true, maxPayload: MAX_PAYLOAD_BYTES, perMessageDeflate: false });
+    const open = new Set();
+    let closed = false;
+    const connected = (ws, host, token) => {
+        open.add(ws);
+        let link;
+        let gone = false;
+        // Commands sent before the browser is ready wait here, in order.
+        const early = [];
+        const stopBeat = keepAlive(ws, heartbeatMs);
+        ws.on('message', (raw, isBinary) => {
+            if (isBinary)
+                return;
+            const text = String(raw);
+            if (link)
+                link.fromClient(text);
+            else
+                early.push(text);
+        });
+        ws.on('close', () => {
+            gone = true;
+            stopBeat();
+            open.delete(ws);
+            link?.close();
+        });
+        // A socket error is followed by `close`; without a listener ws would throw it.
+        ws.on('error', () => undefined);
+        void host
+            .connectAgent(token, {
+            send: text => {
+                if (ws.readyState === 1)
+                    ws.send(text);
+            },
+            close: (code, reason) => ws.close(code, reasonOf(reason)),
+        })
+            .then(result => {
+            if ('refused' in result)
+                return ws.close(1008, reasonOf(result.refused));
+            if (gone)
+                return result.close();
+            link = result;
+            for (const text of early.splice(0))
+                result.fromClient(text);
+        })
+            .catch(() => ws.close(1011, 'The preview browser is not available'));
+    };
+    const allowedHost = (host) => {
+        if (isLoopbackHostHeader(host))
+            return true;
+        const origin = deps.cockpitOrigin?.();
+        try {
+            return !!host && !!origin && new URL(origin).host === host;
+        }
+        catch {
+            return false;
+        }
+    };
+    const handle = (req, socket, head, params) => {
+        socket.on('error', () => socket.destroy());
+        const host = deps.host;
+        if (closed || !host || !previewToolEnabled())
+            return reject(socket, 404);
+        if (!allowedHost(req.headers.host) || req.headers.origin !== undefined)
+            return reject(socket, 403);
+        const token = params.token;
+        if (!token || !host.hasAgentGrant(token))
+            return reject(socket, 403);
+        wss.handleUpgrade(req, socket, head, ws => connected(ws, host, token));
+    };
+    return {
+        route: {
+            match: matchPath(PREVIEW_CDP_WS_PATHS),
+            handle,
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            for (const ws of [...open])
+                ws.terminate();
+            wss.close();
+        },
+    };
+}
+//# sourceMappingURL=preview-cdp-socket.js.map

package/dist/server/preview-cdp-socket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-cdp-socket.js","sourceRoot":"","sources":["../../src/server/preview-cdp-socket.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAkB,MAAM,IAAI,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAsB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,4BAA4B,CAAC,CAAC;AAEnE,wEAAwE;AACxE,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,6GAA6G;AAC7G,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3C,wDAAwD;AACxD,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAY7B,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3H,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7G,MAAM,IAAI,GAAG,IAAI,GAAG,EAAa,CAAC;IAClC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,SAAS,GAAG,CAAC,EAAa,EAAE,IAAoB,EAAE,KAAa,EAAQ,EAAE;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,IAA8B,CAAC;QACnC,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,iEAAiE;QACjE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QAC5C,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;YACjC,IAAI,QAAQ;gBAAE,OAAO;YACrB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,IAAI;gBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;;gBAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,IAAI,GAAG,IAAI,CAAC;YACZ,QAAQ,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChB,IAAI,EAAE,KAAK,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,+EAA+E;QAC/E,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChC,KAAK,IAAI;aACN,YAAY,CAAC,KAAK,EAAE;YACnB,IAAI,EAAE,IAAI,CAAC,EAAE;gBACX,IAAI,EAAE,CAAC,UAAU,KAAK,CAAC;oBAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;YACD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;SAC1D,CAAC;aACD,IAAI,CAAC,MAAM,CAAC,EAAE;YACb,IAAI,SAAS,IAAI,MAAM;gBAAE,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACzE,IAAI,IAAI;gBAAE,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,GAAG,MAAM,CAAC;YACd,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,IAAwB,EAAW,EAAE;QACxD,IAAI,oBAAoB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,GAAoB,EAAE,MAAc,EAAE,IAAY,EAAE,MAA8B,EAAQ,EAAE;QAC1G,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACrE,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE;YACL,KAAK,EAAE,SAAS,CAAC,oBAAoB,CAAC;YACtC,MAAM;SACP;QACD,KAAK;YACH,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC;gBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/preview-socket.d.ts

@@ -0,0 +1,36 @@
+import type { IncomingMessage } from 'node:http';
+import type { Duplex } from 'node:stream';
+import { type WebSocket } from 'ws';
+import type { PreviewHost, RunContext } from '../preview/host.ts';
+import { type UpgradeRoute } from './upgrade-router.ts';
+import type { WsUpgradeVerdict } from './ws.ts';
+/**
+ * Per-open-pane preview socket on scoped and boot-alias routes. Refuse disabled, untrusted or
+ * unknown targets before handshake. A missing worktree is reported after handshake as pane
+ * state.
+ */
+export declare const PREVIEW_WS_PATHS: string[];
+export type PreviewSocketHost = Pick<PreviewHost, 'handle' | 'detach'>;
+export type PreviewSocketProject = {
+    store: RunContext['store'];
+    dataDir: string;
+};
+export interface PreviewSocketDeps {
+    /** Absent when `CEZ_PREVIEW` was off at boot: the path answers 404. */
+    host?: PreviewSocketHost | undefined;
+    verify: (req: IncomingMessage) => WsUpgradeVerdict;
+    /** `undefined` is the boot project. An unknown or unusable project resolves to undefined. */
+    resolveProject: (projectId: string | undefined) => Promise<PreviewSocketProject | undefined>;
+    heartbeatMs?: number;
+    log?: (line: string) => void;
+}
+export interface PreviewSocket {
+    route: UpgradeRoute;
+    /** Terminates every open socket. Idempotent. */
+    close(): void;
+}
+/** Refuses an upgrade before the handshake. Shared with the agent's CDP socket. */
+export declare function reject(socket: Duplex, status: 403 | 404): void;
+/** Pings `ws` every `heartbeatMs` and terminates it after a missed pong. Returns the stop. */
+export declare function keepAlive(ws: WebSocket, heartbeatMs: number): () => void;
+export declare function createPreviewSocket(deps: PreviewSocketDeps): PreviewSocket;

package/dist/server/preview-socket.js

@@ -0,0 +1,142 @@
+import { existsSync } from 'node:fs';
+import { previewClientMessageSchema } from '../contract/index.js';
+import { WebSocketServer } from 'ws';
+import { previewToolEnabled } from '../ci-wait/tools.js';
+import { PROJECT_ID_RE } from '../workspace/config.js';
+import { matchPath } from './upgrade-router.js';
+import { withProjectAdmission } from './cockpit-ownership.js';
+/**
+ * Per-open-pane preview socket on scoped and boot-alias routes. Refuse disabled, untrusted or
+ * unknown targets before handshake. A missing worktree is reported after handshake as pane
+ * state.
+ */
+export const PREVIEW_WS_PATHS = ['/api/v1/p/:projectId/runs/:id/preview/ws', '/api/v1/runs/:id/preview/ws'];
+/** Same reaping cadence as the subscription hub. */
+const HEARTBEAT_MS = 30_000;
+/** Input frames are small; a paste through `insertText` is the largest legitimate one. */
+const MAX_PAYLOAD_BYTES = 256 * 1024;
+/** Refuses an upgrade before the handshake. Shared with the agent's CDP socket. */
+export function reject(socket, status) {
+    socket.write(`HTTP/1.1 ${status} ${status === 403 ? 'Forbidden' : 'Not Found'}\r\nconnection: close\r\n\r\n`);
+    socket.destroy();
+}
+/** Pings `ws` every `heartbeatMs` and terminates it after a missed pong. Returns the stop. */
+export function keepAlive(ws, heartbeatMs) {
+    let alive = true;
+    const beat = setInterval(() => {
+        if (!alive)
+            return ws.terminate();
+        alive = false;
+        ws.ping();
+    }, heartbeatMs);
+    beat.unref?.();
+    ws.on('pong', () => {
+        alive = true;
+    });
+    return () => clearInterval(beat);
+}
+export function createPreviewSocket(deps) {
+    const heartbeatMs = deps.heartbeatMs ?? HEARTBEAT_MS;
+    const log = deps.log ?? ((line) => console.warn(line));
+    const wss = new WebSocketServer({ noServer: true, maxPayload: MAX_PAYLOAD_BYTES });
+    const open = new Set();
+    /** Upgrades still resolving their project: not WebSockets yet, so `closeAllConnections` skips
+     *  them, and an undestroyed one would hold the listener open through shutdown. */
+    const pending = new Set();
+    let closed = false;
+    const connected = (ws, req, ctx) => {
+        open.add(ws);
+        let warned = false;
+        const send = (msg) => {
+            if (ws.readyState === 1)
+                ws.send(JSON.stringify(msg));
+        };
+        const viewer = {
+            userAgent: req.headers['user-agent'] ?? 'another tab',
+            send,
+            sendFrame: (buf) => {
+                if (ws.readyState === 1)
+                    ws.send(buf, { binary: true });
+            },
+            close: (code, reason) => ws.close(code, reason),
+        };
+        const stopBeat = keepAlive(ws, heartbeatMs);
+        ws.on('close', () => {
+            stopBeat();
+            open.delete(ws);
+            if (ctx)
+                deps.host?.detach(ctx.runId, viewer);
+        });
+        // A socket error is followed by `close`; without a listener ws would throw it.
+        ws.on('error', () => undefined);
+        if (!ctx) {
+            send({ t: 'state', stage: 'worktree-removed' });
+            return;
+        }
+        ws.on('message', (raw, isBinary) => {
+            let parsed;
+            try {
+                parsed = isBinary ? undefined : JSON.parse(String(raw));
+            }
+            catch { /* not JSON: dropped below */ }
+            const msg = previewClientMessageSchema.safeParse(parsed);
+            if (!msg.success) {
+                if (!warned)
+                    log(`preview ${ctx.runId}: dropped an invalid client message`);
+                warned = true;
+                return;
+            }
+            const host = deps.host;
+            if (!host)
+                return;
+            // Each action (open a pane, start a dev server or Chromium) holds the project's migration
+            // admission until it ends; a fenced project closes the pane instead.
+            void withProjectAdmission(ctx.dataDir, function previewAction() {
+                return host.handle(ctx, viewer, msg.data);
+            }, () => { ws.close(1013, 'project migration in progress'); }).catch(() => undefined);
+        });
+    };
+    const handle = async (req, socket, head, params) => {
+        // The socket may close while the project resolves; ws must not see an unhandled 'error'.
+        socket.on('error', () => socket.destroy());
+        const host = deps.host;
+        if (closed || !host || !previewToolEnabled())
+            return reject(socket, 404);
+        const verdict = deps.verify(req);
+        if (!verdict || !verdict.trusted)
+            return reject(socket, 403);
+        const { projectId, id } = params;
+        if (projectId !== undefined && !PROJECT_ID_RE.test(projectId))
+            return reject(socket, 404);
+        pending.add(socket);
+        const project = await deps.resolveProject(projectId).catch(() => undefined).finally(() => pending.delete(socket));
+        if (closed)
+            return void socket.destroy();
+        const run = id === undefined ? undefined : project?.store.getRun(id);
+        if (!project || !run)
+            return reject(socket, 404);
+        if (socket.destroyed)
+            return;
+        const ctx = run.worktreePath && existsSync(run.worktreePath)
+            ? { runId: run.id, title: run.title, worktreePath: run.worktreePath, dataDir: project.dataDir, store: project.store }
+            : undefined;
+        wss.handleUpgrade(req, socket, head, (ws) => connected(ws, req, ctx));
+    };
+    return {
+        route: {
+            match: matchPath(PREVIEW_WS_PATHS),
+            handle: (req, socket, head, params) => void handle(req, socket, head, params),
+        },
+        close() {
+            if (closed)
+                return;
+            closed = true;
+            for (const socket of [...pending])
+                socket.destroy();
+            for (const ws of [...open])
+                ws.terminate();
+            wss.close();
+        },
+    };
+}
+//# sourceMappingURL=preview-socket.js.map

package/dist/server/preview-socket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-socket.js","sourceRoot":"","sources":["../../src/server/preview-socket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGrC,OAAO,EAAE,0BAA0B,EAA6B,MAAM,sCAAsC,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAkB,MAAM,IAAI,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAqB,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAG9D;;;;GAIG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,0CAA0C,EAAE,6BAA6B,CAAC,CAAC;AAE5G,oDAAoD;AACpD,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,0FAA0F;AAC1F,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AAsBrC,mFAAmF;AACnF,MAAM,UAAU,MAAM,CAAC,MAAc,EAAE,MAAiB;IACtD,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,+BAA+B,CAAC,CAAC;IAC9G,MAAM,CAAC,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,SAAS,CAAC,EAAa,EAAE,WAAmB;IAC1D,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE;QAC5B,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC,SAAS,EAAE,CAAC;QAClC,KAAK,GAAG,KAAK,CAAC;QACd,EAAE,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC,EAAE,WAAW,CAAC,CAAC;IAChB,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACjB,KAAK,GAAG,IAAI,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAa,CAAC;IAClC;sFACkF;IAClF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,SAAS,GAAG,CAAC,EAAa,EAAE,GAAoB,EAAE,GAA2B,EAAQ,EAAE;QAC3F,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,IAAI,GAAG,CAAC,GAAyB,EAAE,EAAE;YACzC,IAAI,EAAE,CAAC,UAAU,KAAK,CAAC;gBAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC;QACF,MAAM,MAAM,GAAW;YACrB,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,aAAa;YACrD,IAAI;YACJ,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;gBACjB,IAAI,EAAE,CAAC,UAAU,KAAK,CAAC;oBAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;SAChD,CAAC;QACF,MAAM,QAAQ,GAAG,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QAC5C,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,QAAQ,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChB,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,+EAA+E;QAC/E,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;YACjC,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,0BAA0B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACzD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM;oBAAE,GAAG,CAAC,WAAW,GAAG,CAAC,KAAK,qCAAqC,CAAC,CAAC;gBAC5E,MAAM,GAAG,IAAI,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,0FAA0F;YAC1F,qEAAqE;YACrE,KAAK,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,aAAa;gBAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAoB,EAAE,MAAc,EAAE,IAAY,EAAE,MAA8B,EAAiB,EAAE;QACzH,yFAAyF;QACzF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;QACjC,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAClH,IAAI,MAAM;YAAE,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,SAAS;YAAE,OAAO;QAC7B,MAAM,GAAG,GAA2B,GAAG,CAAC,YAAY,IAAI,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;YAClF,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;YACrH,CAAC,CAAC,SAAS,CAAC;QACd,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE;YACL,KAAK,EAAE,SAAS,CAAC,gBAAgB,CAAC;YAClC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;SAC9E;QACD,KAAK;YACH,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YACpD,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC;gBAAE,EAAE,CAAC,SAAS,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/preview-sockets.d.ts

@@ -0,0 +1,14 @@
+import type { PreviewHost } from '../preview/host.ts';
+import { type PreviewSocketDeps } from './preview-socket.ts';
+import type { UpgradeRoute } from './upgrade-router.ts';
+/**
+ * The preview's two upgrade routes, built and closed together: the owner's pane socket (hearsay-tools/cezarion#781) and the
+ * agent's CDP proxy (hearsay-tools/cezarion#784), the only way to the task's Chromium.
+ */
+export declare function createPreviewSockets(deps: Omit<PreviewSocketDeps, 'host'> & {
+    host?: PreviewHost | undefined;
+    cockpitOrigin: () => string | undefined;
+}): {
+    routes: UpgradeRoute[];
+    close(): void;
+};

package/dist/server/preview-sockets.js

@@ -0,0 +1,18 @@
+import { createPreviewCdpSocket } from './preview-cdp-socket.js';
+import { createPreviewSocket } from './preview-socket.js';
+/**
+ * The preview's two upgrade routes, built and closed together: the owner's pane socket (hearsay-tools/cezarion#781) and the
+ * agent's CDP proxy (hearsay-tools/cezarion#784), the only way to the task's Chromium.
+ */
+export function createPreviewSockets(deps) {
+    const pane = createPreviewSocket(deps);
+    const agent = createPreviewCdpSocket({ host: deps.host, cockpitOrigin: deps.cockpitOrigin });
+    return {
+        routes: [pane.route, agent.route],
+        close() {
+            pane.close();
+            agent.close();
+        },
+    };
+}
+//# sourceMappingURL=preview-sockets.js.map

package/dist/server/preview-sockets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-sockets.js","sourceRoot":"","sources":["../../src/server/preview-sockets.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAA0B,MAAM,qBAAqB,CAAC;AAGlF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmH;IACtJ,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;QACjC,KAAK;YACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}