@ivan-bekker/ghav 0.0.0-stage → 0.1.0

package/dist/server/index.js

@@ -0,0 +1,2330 @@
+#!/usr/bin/env node
+
+// src/server/index.ts
+import { execFile as execFile3 } from "node:child_process";
+import { existsSync as existsSync4, mkdirSync as mkdirSync6 } from "node:fs";
+import path11 from "node:path";
+import { fileURLToPath } from "node:url";
+import { serve } from "@hono/node-server";
+
+// src/server/app.ts
+import { createReadStream, statSync as statSync2 } from "node:fs";
+import path7 from "node:path";
+import { Readable } from "node:stream";
+import { serveStatic } from "@hono/node-server/serve-static";
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import { streamSSE } from "hono/streaming";
+import { z } from "zod";
+
+// src/shared/types.ts
+var FINAL_STATUSES = ["success", "failure", "cancelled", "error"];
+var DEFAULT_PLATFORMS = [
+  "ubuntu-latest=catthehacker/ubuntu:act-latest",
+  "ubuntu-22.04=catthehacker/ubuntu:act-22.04",
+  "ubuntu-20.04=catthehacker/ubuntu:act-20.04"
+];
+var MIN_CONCURRENT_RUNS = 1;
+var MAX_CONCURRENT_RUNS = 8;
+var DEFAULT_CONCURRENT_RUNS = 4;
+var DEFAULT_REPO_CONFIG = {
+  platforms: DEFAULT_PLATFORMS,
+  env: {},
+  vars: {},
+  pull: false,
+  offline: false,
+  containerArchitecture: ""
+};
+
+// src/server/act/exec.ts
+import { execFile } from "node:child_process";
+
+// src/server/workflows.ts
+import { readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { parse } from "yaml";
+var WORKFLOWS_DIR = ".github/workflows";
+var isObj = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+var isScalar = (x) => typeof x === "string" || typeof x === "number" || typeof x === "boolean";
+function toList(x) {
+  if (typeof x === "string") return [x];
+  if (Array.isArray(x)) return x.filter((e) => typeof e === "string");
+  return [];
+}
+function parseEvents(on) {
+  if (typeof on === "string") return [on];
+  if (Array.isArray(on)) return on.filter((e) => typeof e === "string");
+  if (isObj(on)) return Object.keys(on);
+  return [];
+}
+function parseInputs(on) {
+  if (!isObj(on) || !isObj(on.workflow_dispatch)) return [];
+  const inputs = on.workflow_dispatch.inputs;
+  if (!isObj(inputs)) return [];
+  return Object.entries(inputs).map(([name, def]) => {
+    const d = isObj(def) ? def : {};
+    return {
+      name,
+      description: typeof d.description === "string" ? d.description : void 0,
+      type: typeof d.type === "string" ? d.type : void 0,
+      default: isScalar(d.default) ? String(d.default) : void 0,
+      required: d.required === true,
+      options: Array.isArray(d.options) ? d.options.filter(isScalar).map(String) : void 0
+    };
+  });
+}
+function parseRunsOn(x) {
+  if (typeof x === "string") return x;
+  if (Array.isArray(x)) return x.filter((e) => typeof e === "string").join(",");
+  if (isObj(x)) return toList(x.labels).join(",") || (typeof x.group === "string" ? x.group : "");
+  return "";
+}
+function parseEnvironment(x) {
+  const name = typeof x === "string" ? x : isObj(x) && typeof x.name === "string" ? x.name : void 0;
+  return name && !name.includes("${{") ? name : void 0;
+}
+function hasContainerOptions(x) {
+  return isObj(x) && typeof x.options === "string" && x.options.trim() !== "";
+}
+function parseMatrix(strategy) {
+  if (!isObj(strategy) || strategy.matrix === void 0) return { matrix: null, matrixDynamic: false };
+  const m = strategy.matrix;
+  if (typeof m === "string") return { matrix: null, matrixDynamic: true };
+  if (!isObj(m)) return { matrix: null, matrixDynamic: false };
+  const axes = {};
+  let dynamic = false;
+  for (const [key, val] of Object.entries(m)) {
+    if (key === "include" || key === "exclude") {
+      if (typeof val === "string") dynamic = true;
+      continue;
+    }
+    if (Array.isArray(val)) axes[key] = val.filter(isScalar);
+    else if (typeof val === "string") dynamic = true;
+  }
+  return { matrix: Object.keys(axes).length ? axes : null, matrixDynamic: dynamic };
+}
+var HIDE_DIRECTIVE = /^#\s*gha-view:\s*hide$/i;
+function isHidden(text) {
+  for (const raw of text.replace(/^/, "").split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line === "" || line === "---") continue;
+    if (!line.startsWith("#")) return false;
+    if (HIDE_DIRECTIVE.test(line)) return true;
+  }
+  return false;
+}
+function parseWorkflow(file, text) {
+  const hidden = isHidden(text) ? { hidden: true } : {};
+  const empty = { file, name: file, events: [], inputs: [], jobs: [], ...hidden };
+  let doc;
+  try {
+    doc = parse(text);
+  } catch (e) {
+    return { ...empty, error: `Invalid YAML: ${e.message.split("\n")[0]}` };
+  }
+  if (!isObj(doc)) return { ...empty, error: "Workflow file is empty or not a mapping" };
+  const jobs = [];
+  if (isObj(doc.jobs)) {
+    for (const [id, raw] of Object.entries(doc.jobs)) {
+      const j = isObj(raw) ? raw : {};
+      jobs.push({
+        id,
+        name: typeof j.name === "string" ? j.name : id,
+        needs: toList(j.needs),
+        runsOn: parseRunsOn(j["runs-on"]),
+        uses: typeof j.uses === "string" ? j.uses : void 0,
+        environment: parseEnvironment(j.environment),
+        ...hasContainerOptions(j.container) ? { containerOptions: true } : {},
+        ...parseMatrix(j.strategy)
+      });
+    }
+  }
+  return {
+    file,
+    name: typeof doc.name === "string" ? doc.name : file,
+    events: parseEvents(doc.on),
+    inputs: parseInputs(doc.on),
+    jobs,
+    ...hidden
+  };
+}
+async function loadWorkflows(repoPath) {
+  const dir = path.join(repoPath, WORKFLOWS_DIR);
+  let names;
+  try {
+    names = (await readdir(dir)).filter((n) => /\.ya?ml$/.test(n)).sort();
+  } catch {
+    return [];
+  }
+  return Promise.all(
+    names.map(async (file) => {
+      try {
+        return parseWorkflow(file, await readFile(path.join(dir, file), "utf8"));
+      } catch (e) {
+        return { file, name: file, events: [], inputs: [], jobs: [], error: e.message };
+      }
+    })
+  );
+}
+
+// src/server/act/validate.ts
+import path2 from "node:path";
+var EVENT_RE = /^[a-z][a-z0-9_]*$/;
+var JOB_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+var KEY_RE = /^[A-Za-z_][A-Za-z0-9_.-]*$/;
+var WORKFLOW_FILE_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*\.ya?ml$/;
+var SECRET_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var PLATFORM_RE = /^[^=\s]+=\S+$/;
+var ENVIRONMENT_RE = /^[a-z0-9][a-z0-9_-]{0,31}$/;
+var ARCH_RE = /^linux\/(amd64|arm64|arm\/v7|386)$/;
+var RESERVED_SECRET_NAMES = /* @__PURE__ */ new Set([
+  "PATH",
+  "HOME",
+  "USER",
+  "SHELL",
+  "TMPDIR",
+  "PWD",
+  "LANG",
+  "TERM",
+  "IFS",
+  "CI"
+]);
+var RESERVED_SECRET_PREFIXES = ["GITHUB_", "LD_", "DYLD_", "XDG_", "DOCKER_", "NODE_", "ACTIONS_", "RUNNER_"];
+var ValidationError = class extends Error {
+};
+function fail(msg) {
+  throw new ValidationError(msg);
+}
+function noNul(label, v) {
+  if (v.includes("\0")) fail(`${label} contains a NUL byte`);
+}
+function eventName(v) {
+  if (!EVENT_RE.test(v)) fail(`invalid event name: ${v}`);
+  return v;
+}
+function jobId(v) {
+  if (!JOB_RE.test(v)) fail(`invalid job id: ${v}`);
+  return v;
+}
+function workflowFile(v) {
+  if (!WORKFLOW_FILE_RE.test(v)) fail(`invalid workflow file name: ${v}`);
+  return v;
+}
+function workflowPath(p) {
+  noNul("workflow path", p);
+  if (!path2.isAbsolute(p)) fail(`workflow path must be absolute: ${p}`);
+  workflowFile(path2.basename(p));
+  return p;
+}
+function keyValueMap(label, m) {
+  const out = {};
+  for (const [k, v] of Object.entries(m ?? {})) {
+    if (!KEY_RE.test(k)) fail(`invalid ${label} name: ${k}`);
+    if (typeof v !== "string") fail(`${label} ${k} must be a string`);
+    noNul(`${label} ${k}`, v);
+    out[k] = v;
+  }
+  return out;
+}
+function secretName(v) {
+  if (!SECRET_NAME_RE.test(v)) fail(`invalid secret name: ${v}`);
+  const upper = v.toUpperCase();
+  if (v === "GITHUB_TOKEN") return v;
+  if (RESERVED_SECRET_NAMES.has(upper) || RESERVED_SECRET_PREFIXES.some((p) => upper.startsWith(p))) {
+    fail(`secret name is reserved: ${v}`);
+  }
+  return v;
+}
+function environmentName(v) {
+  if (!ENVIRONMENT_RE.test(v)) fail(`invalid environment name: "${v}" (use lowercase letters, digits, - and _, up to 32 characters)`);
+  return v;
+}
+function platform(v) {
+  if (!PLATFORM_RE.test(v)) fail(`invalid platform mapping (expected label=image): ${v}`);
+  return v;
+}
+function containerArchitecture(v) {
+  if (v !== "" && !ARCH_RE.test(v)) fail(`unsupported container architecture: ${v}`);
+  return v;
+}
+function port(v) {
+  if (!Number.isInteger(v) || v < 1 || v > 65535) fail("port must be an integer from 1 to 65535");
+  return v;
+}
+function isHostPlatform(mapping) {
+  const image = mapping.slice(mapping.indexOf("=") + 1);
+  return image.startsWith("-");
+}
+
+// src/server/act/list.ts
+var COLUMNS = ["Stage", "Job ID", "Job name", "Workflow name", "Workflow file", "Events"];
+function parseActList(stdout) {
+  const lines = stdout.split("\n").map((l) => l.replace(/\r$/, ""));
+  const headerIdx = lines.findIndex((l) => l.startsWith("Stage") && l.includes("Job ID"));
+  if (headerIdx < 0) return [];
+  const header = lines[headerIdx];
+  const starts = COLUMNS.map((c) => header.indexOf(c));
+  if (starts.some((s) => s < 0)) return [];
+  const jobs = [];
+  for (const line of lines.slice(headerIdx + 1)) {
+    if (line.trim() === "") continue;
+    const cell = (i) => line.slice(starts[i], i + 1 < starts.length ? starts[i + 1] : void 0).trim();
+    const stage = Number(cell(0));
+    if (!Number.isInteger(stage)) continue;
+    jobs.push({
+      stage,
+      jobId: cell(1),
+      jobName: cell(2),
+      workflowName: cell(3),
+      workflowFile: cell(4),
+      events: cell(5).split(",").map((e) => e.trim()).filter(Boolean)
+    });
+  }
+  return jobs;
+}
+
+// src/server/act/exec.ts
+function runAct(cfg, args, cwd, timeoutMs = 15e3) {
+  return new Promise((resolve) => {
+    execFile(cfg.actBin, args, { cwd, timeout: timeoutMs, maxBuffer: 8 * 1024 * 1024 }, (err, stdout, stderr) => {
+      const exit = err?.code;
+      const code = err ? typeof exit === "number" ? exit : 1 : 0;
+      resolve({ code, stdout: String(stdout), stderr: String(stderr) });
+    });
+  });
+}
+var NOISE = [/Couldn't get a valid docker connection/, /Apple M-series chip/, /Using docker host/];
+function stripActNoise(text) {
+  return text.split("\n").filter((l) => !NOISE.some((re) => re.test(l))).join("\n").trim();
+}
+async function enrichWithStages(cfg, repoPath, workflows) {
+  return Promise.all(
+    workflows.map(async (wf) => {
+      if (wf.error || wf.jobs.length === 0) return wf;
+      const res = await runAct(cfg, ["--list", "-W", `${WORKFLOWS_DIR}/${workflowFile(wf.file)}`], repoPath);
+      if (res.code !== 0) return wf;
+      const stages = new Map(parseActList(res.stdout).map((j) => [j.jobId, j.stage]));
+      const jobs = wf.jobs.map((j) => ({ ...j, stage: stages.get(j.id) }));
+      return { ...wf, jobs };
+    })
+  );
+}
+async function validateWorkflow(cfg, repoPath, file) {
+  const res = await runAct(cfg, ["--validate", "-W", `${WORKFLOWS_DIR}/${workflowFile(file)}`], repoPath);
+  const output = stripActNoise(res.stdout + "\n" + res.stderr);
+  return { ok: res.code === 0, output: output || (res.code === 0 ? "Workflow is valid." : "Validation failed.") };
+}
+
+// src/server/doctor.ts
+import { execFile as execFile2 } from "node:child_process";
+import { accessSync, constants, mkdirSync } from "node:fs";
+var REQUIRED_ACT_FLAGS = [
+  "json",
+  "workflows",
+  "platform",
+  "artifact-server-addr",
+  "artifact-server-path",
+  "artifact-server-port",
+  "cache-server-addr",
+  "rm",
+  "pull",
+  "matrix",
+  "input",
+  "secret",
+  "var",
+  "env",
+  "eventpath",
+  "job",
+  "dryrun",
+  "container-architecture",
+  "action-offline-mode",
+  "list",
+  "validate",
+  "network",
+  "container-options"
+];
+function run(bin, args, timeoutMs) {
+  return new Promise((resolve) => {
+    execFile2(bin, args, { timeout: timeoutMs, maxBuffer: 4 * 1024 * 1024 }, (err, stdout) => {
+      if (err) resolve({ ok: false, stdout: String(stdout ?? ""), error: err.code === "ENOENT" ? "not found" : err.message });
+      else resolve({ ok: true, stdout: String(stdout) });
+    });
+  });
+}
+async function actVersion(cfg) {
+  const r = await run(cfg.actBin, ["--version"], 8e3);
+  if (!r.ok) return void 0;
+  return /(\d+\.\d+\.\d+)/.exec(r.stdout)?.[1];
+}
+async function dockerReachable(cfg) {
+  const r = await run(cfg.dockerBin, ["info", "--format", "{{.ServerVersion}}"], 8e3);
+  return r.ok ? { ok: true, version: r.stdout.trim() } : { ok: false, error: r.error };
+}
+async function runDoctor(cfg) {
+  const checks = [];
+  const version = await actVersion(cfg);
+  if (!version) {
+    checks.push({
+      id: "act",
+      title: "act",
+      status: "fail",
+      detail: `Could not run "${cfg.actBin} --version".`,
+      fix: "Install act (brew install act) or set GHA_VIEW_ACT_BIN to its path."
+    });
+  } else {
+    const opts = await run(cfg.actBin, ["--list-options"], 8e3);
+    let missing = [];
+    try {
+      const names = new Set(JSON.parse(opts.stdout).map((o) => o.name));
+      missing = REQUIRED_ACT_FLAGS.filter((f) => !names.has(f));
+    } catch {
+    }
+    checks.push(
+      missing.length ? { id: "act", title: "act", status: "fail", detail: `act ${version} lacks flags the viewer needs: ${missing.join(", ")}.`, fix: "Upgrade act (brew upgrade act)." } : { id: "act", title: "act", status: "ok", detail: `act ${version}` }
+    );
+  }
+  const docker = await dockerReachable(cfg);
+  checks.push(
+    docker.ok ? { id: "docker", title: "Docker", status: "ok", detail: `Docker daemon ${docker.version}` } : {
+      id: "docker",
+      title: "Docker",
+      status: "fail",
+      detail: "The Docker daemon is not reachable. Runs that use container images will fail.",
+      fix: "Start Docker Desktop and wait for it to finish starting. Dry runs and host-mode platforms still work."
+    }
+  );
+  if (process.platform === "darwin" && process.arch === "arm64") {
+    checks.push({
+      id: "arch",
+      title: "Apple Silicon",
+      status: "warn",
+      detail: "Some actions and images are amd64-only and may fail or run slowly under emulation.",
+      fix: "If a run fails with an exec format error, set the repo's container architecture to linux/amd64 in Settings."
+    });
+  }
+  try {
+    mkdirSync(cfg.dataDir, { recursive: true });
+    accessSync(cfg.dataDir, constants.W_OK);
+    checks.push({ id: "data", title: "Data directory", status: "ok", detail: cfg.dataDir });
+  } catch (e) {
+    checks.push({ id: "data", title: "Data directory", status: "fail", detail: `${cfg.dataDir} is not writable: ${e.message}` });
+  }
+  return checks;
+}
+
+// src/server/repos.ts
+import { createHash } from "node:crypto";
+import { readdir as readdir2, realpath, stat } from "node:fs/promises";
+import os from "node:os";
+import path3 from "node:path";
+var RepoError = class extends Error {
+  constructor(message, status = 400) {
+    super(message);
+    this.status = status;
+  }
+  status;
+};
+function repoIdFor(realPath) {
+  return createHash("sha1").update(realPath).digest("hex").slice(0, 10);
+}
+function normalizeConfig(input, base = DEFAULT_REPO_CONFIG) {
+  const platforms = (input.platforms ?? base.platforms).map((p) => platform(p.trim())).filter(Boolean);
+  return {
+    platforms,
+    env: keyValueMap("env", input.env ?? base.env),
+    vars: keyValueMap("var", input.vars ?? base.vars),
+    pull: input.pull ?? base.pull,
+    offline: input.offline ?? base.offline,
+    containerArchitecture: containerArchitecture(input.containerArchitecture ?? base.containerArchitecture)
+  };
+}
+var RepoService = class {
+  constructor(store, secrets) {
+    this.store = store;
+    this.secrets = secrets;
+  }
+  store;
+  secrets;
+  async stateOf(p) {
+    try {
+      if (!(await stat(p)).isDirectory()) return "missing";
+    } catch {
+      return "missing";
+    }
+    try {
+      const names = await readdir2(path3.join(p, WORKFLOWS_DIR));
+      return names.some((n) => /\.ya?ml$/.test(n)) ? "ok" : "no-workflows";
+    } catch {
+      return "no-workflows";
+    }
+  }
+  async toRepo(row) {
+    return {
+      id: row.id,
+      path: row.path,
+      name: row.name,
+      config: row.config,
+      secretNames: this.secrets.names(row.id),
+      state: await this.stateOf(row.path)
+    };
+  }
+  async list() {
+    return Promise.all(this.store.listRepos().map((r) => this.toRepo(r)));
+  }
+  async get(id) {
+    const row = this.store.getRepo(id);
+    if (!row) throw new RepoError("repo not found", 404);
+    return this.toRepo(row);
+  }
+  async add(inputPath) {
+    let p = inputPath.trim();
+    if (p === "~" || p.startsWith("~/")) p = path3.join(os.homedir(), p.slice(1));
+    if (!path3.isAbsolute(p)) throw new RepoError("Use an absolute path, e.g. /Users/you/code/my-repo");
+    let real;
+    try {
+      real = await realpath(p);
+    } catch {
+      throw new RepoError(`Path does not exist: ${p}`);
+    }
+    if (!(await stat(real)).isDirectory()) throw new RepoError(`Not a directory: ${real}`);
+    if (await this.stateOf(real) !== "ok") {
+      throw new RepoError(`No workflow files found in ${path3.join(real, WORKFLOWS_DIR)}`);
+    }
+    if (this.store.getRepoByPath(real)) throw new RepoError("This repo is already added", 409);
+    const row = {
+      id: repoIdFor(real),
+      path: real,
+      name: path3.basename(real),
+      config: normalizeConfig({}),
+      addedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    this.store.insertRepo(row);
+    return this.toRepo(row);
+  }
+  async update(id, fields) {
+    const row = this.store.getRepo(id);
+    if (!row) throw new RepoError("repo not found", 404);
+    const name = fields.name?.trim();
+    if (fields.name !== void 0 && !name) throw new RepoError("name cannot be empty");
+    this.store.updateRepo(id, {
+      name,
+      config: fields.config ? normalizeConfig(fields.config, row.config) : void 0
+    });
+    return this.get(id);
+  }
+  /** Removes the repo and its secrets. Run history is removed by the caller (it owns the log files). */
+  remove(id) {
+    if (!this.store.getRepo(id)) throw new RepoError("repo not found", 404);
+    this.store.deleteRepo(id);
+    this.secrets.deleteAll(id);
+  }
+};
+
+// src/server/runs/artifacts.ts
+import { randomBytes } from "node:crypto";
+import { closeSync, createWriteStream, existsSync, mkdirSync as mkdirSync2, openSync, readdirSync, readSync, renameSync, rmSync, statSync } from "node:fs";
+import path4 from "node:path";
+import { pipeline } from "node:stream/promises";
+import { open as openZip } from "yauzl";
+var DIR = "artifacts";
+var EXTRACTED = ".extracted";
+var EXTRACT_LIMITS = { maxEntries: 1e4, maxBytes: 2 * 1024 ** 3 };
+var isZip = (name) => /\.zip$/i.test(name);
+function walk(dir, rel) {
+  const out = [];
+  for (const ent of readdirSync(dir, { withFileTypes: true })) {
+    if (ent.name.startsWith(".")) continue;
+    const childRel = rel ? `${rel}/${ent.name}` : ent.name;
+    const abs = path4.join(dir, ent.name);
+    if (ent.isDirectory()) {
+      const children = walk(abs, childRel);
+      out.push({
+        name: ent.name,
+        path: childRel,
+        type: "dir",
+        size: children.reduce((n, c) => n + c.size, 0),
+        children
+      });
+    } else if (ent.isFile()) {
+      const node = { name: ent.name, path: childRel, type: "file", size: statSync(abs).size };
+      const extracted = isZip(ent.name) ? path4.join(dir, EXTRACTED, ent.name) : void 0;
+      if (extracted && existsSync(extracted)) {
+        node.extracted = true;
+        node.children = walk(extracted, `${rel ? `${rel}/` : ""}${EXTRACTED}/${ent.name}`);
+      }
+      out.push(node);
+    }
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+function listArtifacts(runDir) {
+  const root = path4.join(runDir, DIR);
+  if (!existsSync(root)) return [];
+  const top = walk(root, "");
+  if (top.length > 0 && top.every((n) => n.type === "dir" && /^\d+$/.test(n.name))) {
+    return mergeByName(top.flatMap((n) => n.children ?? []));
+  }
+  return top;
+}
+function mergeByName(nodes) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const n of nodes) {
+    const prev = byName.get(n.name);
+    if (!prev) {
+      byName.set(n.name, n);
+    } else if (prev.type === "dir" && n.type === "dir") {
+      byName.set(n.name, {
+        ...prev,
+        size: prev.size + n.size,
+        children: mergeByName([...prev.children ?? [], ...n.children ?? []])
+      });
+    }
+  }
+  return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+function segment(s) {
+  if (!s || s === "." || s === ".." || s.includes("\0") || /[/\\]/.test(s) || s.length > 255) {
+    throw new RepoError("file not found", 404);
+  }
+  return s;
+}
+function resolveArtifactFile(runDir, rel) {
+  const parts = rel.split("/").map(segment);
+  const root = path4.resolve(runDir, DIR);
+  const abs = path4.resolve(root, ...parts);
+  if (abs !== root && !abs.startsWith(root + path4.sep)) throw new RepoError("file not found", 404);
+  if (!existsSync(abs) || !statSync(abs).isFile()) throw new RepoError("file not found", 404);
+  return { abs, downloadName: parts[parts.length - 1] };
+}
+var extracting = /* @__PURE__ */ new Set();
+function entryParts(name) {
+  const parts = name.replace(/\/$/, "").split("/");
+  for (const p of parts) {
+    if (!p || p === "." || p === ".." || p.includes("\0") || p.includes("\\") || p.length > 255) {
+      throw new RepoError(`zip entry has an unsafe path: ${JSON.stringify(name)}`, 400);
+    }
+  }
+  return parts;
+}
+var formatLimit = (n) => n >= 1024 ** 3 ? `${+(n / 1024 ** 3).toFixed(1)} GiB` : `${n} bytes`;
+var isSymlink = (e) => (e.externalFileAttributes >>> 16 & 61440) === 40960;
+function unzipInto(zipPath, outDir, limits) {
+  return new Promise((resolve, reject) => {
+    openZip(zipPath, { lazyEntries: true, validateEntrySizes: true }, (err, zip) => {
+      if (err) return reject(new RepoError(`could not read the zip: ${err.message}`, 400));
+      let entries = 0;
+      let bytes = 0;
+      const fail2 = (e) => {
+        zip.close();
+        reject(e instanceof RepoError ? e : new RepoError(`could not extract the zip: ${e.message}`, 400));
+      };
+      const handle = async (entry) => {
+        if (++entries > limits.maxEntries) throw new RepoError(`zip has more than ${limits.maxEntries} entries; extract it by hand`, 400);
+        bytes += entry.uncompressedSize;
+        if (bytes > limits.maxBytes) throw new RepoError(`zip would unpack to more than ${formatLimit(limits.maxBytes)}; extract it by hand`, 400);
+        if (isSymlink(entry)) return;
+        const parts = entryParts(entry.fileName);
+        const dest = path4.resolve(outDir, ...parts);
+        if (!dest.startsWith(outDir + path4.sep)) throw new RepoError(`zip entry has an unsafe path: ${JSON.stringify(entry.fileName)}`, 400);
+        if (entry.fileName.endsWith("/")) {
+          mkdirSync2(dest, { recursive: true });
+          return;
+        }
+        mkdirSync2(path4.dirname(dest), { recursive: true });
+        const src = await new Promise(
+          (res, rej) => zip.openReadStream(entry, (e, stream) => e ? rej(e) : res(stream))
+        );
+        await pipeline(src, createWriteStream(dest, { flags: "wx", mode: 420 }));
+      };
+      zip.on("error", fail2);
+      zip.on("end", resolve);
+      zip.on("entry", (entry) => handle(entry).then(() => zip.readEntry(), fail2));
+      zip.readEntry();
+    });
+  });
+}
+async function extractArtifactZip(runDir, rel, limits = EXTRACT_LIMITS) {
+  const { abs, downloadName } = resolveArtifactFile(runDir, rel);
+  if (!isZip(downloadName)) throw new RepoError("only .zip artifacts can be extracted", 400);
+  const holder = path4.join(path4.dirname(abs), EXTRACTED);
+  const target = path4.join(holder, downloadName);
+  if (existsSync(target)) throw new RepoError("this zip is already extracted", 409);
+  if (extracting.has(abs)) throw new RepoError("this zip is being extracted right now", 409);
+  extracting.add(abs);
+  const tmp = path4.join(holder, `.tmp-${randomBytes(6).toString("hex")}`);
+  try {
+    mkdirSync2(tmp, { recursive: true });
+    await unzipInto(abs, tmp, limits);
+    renameSync(tmp, target);
+  } finally {
+    rmSync(tmp, { recursive: true, force: true });
+    extracting.delete(abs);
+  }
+}
+var TEXT = /* @__PURE__ */ new Set(["txt", "log", "md", "yml", "yaml", "csv", "xml", "toml", "ini", "env", "ts", "tsx", "sh", "bash"]);
+var MIME = {
+  zip: "application/zip",
+  pdf: "application/pdf",
+  json: "application/json; charset=utf-8",
+  css: "text/css; charset=utf-8",
+  js: "text/javascript; charset=utf-8",
+  mjs: "text/javascript; charset=utf-8",
+  html: "text/html; charset=utf-8",
+  htm: "text/html; charset=utf-8",
+  svg: "image/svg+xml",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  avif: "image/avif",
+  bmp: "image/bmp",
+  ico: "image/x-icon",
+  mp4: "video/mp4",
+  webm: "video/webm",
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  ogg: "audio/ogg"
+};
+var ACTIVE = /* @__PURE__ */ new Set(["html", "htm", "svg"]);
+function looksLikeText(abs) {
+  const fd = openSync(abs, "r");
+  try {
+    const buf = Buffer.alloc(8192);
+    const n = readSync(fd, buf, 0, buf.length, 0);
+    if (buf.subarray(0, n).includes(0)) return false;
+    try {
+      new TextDecoder("utf-8", { fatal: true }).decode(buf.subarray(0, n), { stream: true });
+      return true;
+    } catch {
+      return false;
+    }
+  } finally {
+    closeSync(fd);
+  }
+}
+function fileResponseHeaders(downloadName, inline, abs) {
+  const ext = downloadName.includes(".") ? downloadName.slice(downloadName.lastIndexOf(".") + 1).toLowerCase() : "";
+  let type = MIME[ext] ?? (TEXT.has(ext) ? "text/plain; charset=utf-8" : void 0);
+  if (!type) type = inline && abs && looksLikeText(abs) ? "text/plain; charset=utf-8" : "application/octet-stream";
+  const showInline = inline && ext !== "zip" && type !== "application/octet-stream";
+  const safe = downloadName.replace(/["\\\r\n]/g, "_");
+  const headers = {
+    "content-type": type,
+    "content-disposition": `${showInline ? "inline" : "attachment"}; filename="${safe}"`,
+    "x-content-type-options": "nosniff"
+  };
+  if (showInline && ACTIVE.has(ext)) headers["content-security-policy"] = "sandbox allow-scripts";
+  return headers;
+}
+
+// src/server/runs/manager.ts
+import { spawn } from "node:child_process";
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync, rmSync as rmSync2, writeFileSync } from "node:fs";
+import path6 from "node:path";
+import net from "node:net";
+import { StringDecoder } from "node:string_decoder";
+
+// src/server/act/args.ts
+function buildActArgs(inv) {
+  const args = [
+    eventName(inv.event),
+    "--json",
+    "-W",
+    inv.workflowPath ? workflowPath(inv.workflowPath) : `.github/workflows/${workflowFile(inv.workflowFile)}`
+  ];
+  for (const p of inv.platforms) args.push("-P", platform(p));
+  const arch = containerArchitecture(inv.containerArchitecture);
+  if (arch) args.push("--container-architecture", arch);
+  args.push(
+    "--artifact-server-path",
+    inv.artifactDir,
+    "--artifact-server-port",
+    String(port(inv.artifactPort)),
+    "--rm",
+    `--pull=${inv.pull ? "true" : "false"}`
+  );
+  if (inv.offline) args.push("--action-offline-mode");
+  if (inv.dryRun) args.push("-n");
+  if (inv.liveView) {
+    const port2 = port(inv.liveView.port);
+    args.push("--network", "bridge", "--container-options", `-p 127.0.0.1:${port2}:${port2}`);
+  }
+  if (inv.job) args.push("-j", jobId(inv.job));
+  for (const [k, val] of Object.entries(keyValueMap("matrix", inv.matrix))) args.push("--matrix", `${k}:${val}`);
+  for (const [k, val] of Object.entries(keyValueMap("input", inv.inputs))) args.push("--input", `${k}=${val}`);
+  if (inv.eventPayloadPath) args.push("-e", inv.eventPayloadPath);
+  for (const [k, val] of Object.entries(keyValueMap("env", inv.env))) args.push("--env", `${k}=${val}`);
+  for (const [k, val] of Object.entries(keyValueMap("var", inv.vars))) args.push("--var", `${k}=${val}`);
+  for (const name of inv.secretNames) args.push("-s", secretName(name));
+  return args;
+}
+
+// src/server/act/parse.ts
+function matrixSuffix(matrix) {
+  if (!matrix) return "";
+  const keys = Object.keys(matrix).sort();
+  if (keys.length === 0) return "";
+  return "#" + keys.map((k) => `${k}=${JSON.stringify(matrix[k])}`).join(",");
+}
+function mapLevel(level) {
+  switch (level) {
+    case "warning":
+      return "warning";
+    case "error":
+    case "fatal":
+    case "panic":
+      return "error";
+    case "debug":
+    case "trace":
+      return "debug";
+    default:
+      return "info";
+  }
+}
+function stepIdOf(o) {
+  const raw = o.stepID ?? o.stepid;
+  if (Array.isArray(raw)) return raw.join(".");
+  if (typeof raw === "string") return raw;
+  return void 0;
+}
+function jobNameOf(job) {
+  if (!job) return void 0;
+  const i = job.indexOf("/");
+  return (i >= 0 ? job.slice(i + 1) : job).trim();
+}
+function parseActLine(line, stream, seq, fallbackTs) {
+  if (line.trim() === "") return null;
+  let o = null;
+  if (line.startsWith("{")) {
+    try {
+      const parsed = JSON.parse(line);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) o = parsed;
+    } catch {
+    }
+  }
+  if (!o || typeof o.msg !== "string") {
+    if (stream === "stderr") {
+      const logfmt = /^(?:time="[^"]*"\s+)?level=(\w+)\s+msg="?(.*?)"?\s*$/.exec(line);
+      if (logfmt) {
+        return { seq, ts: fallbackTs, kind: "stderr", level: mapLevel(logfmt[1]), text: logfmt[2].trim() };
+      }
+      return {
+        seq,
+        ts: fallbackTs,
+        kind: "stderr",
+        level: /^(error|fatal)\b/i.test(line) ? "error" : "warning",
+        text: line
+      };
+    }
+    return { seq, ts: fallbackTs, kind: "raw", level: "info", text: line };
+  }
+  const matrix = o.matrix && typeof o.matrix === "object" ? o.matrix : void 0;
+  const jobKey = o.jobID ? o.jobID + matrixSuffix(matrix) : void 0;
+  const stepId = stepIdOf(o);
+  const base = {
+    seq,
+    ts: o.time ?? fallbackTs,
+    kind: "log",
+    level: mapLevel(o.level),
+    text: o.msg.trim(),
+    jobKey,
+    jobId: o.jobID,
+    jobName: jobNameOf(o.job),
+    matrix,
+    stepKey: jobKey && stepId ? `${jobKey}/${stepId}` : void 0,
+    step: o.step,
+    stage: o.stage
+  };
+  if (stream === "stderr") base.kind = "stderr";
+  if (o.jobResult) {
+    return { ...base, kind: "job-end", result: o.jobResult };
+  }
+  if (o.stepResult) {
+    return {
+      ...base,
+      kind: "step-end",
+      result: o.stepResult,
+      durationMs: typeof o.executionTime === "number" ? Math.round(o.executionTime / 1e6) : void 0
+    };
+  }
+  if (o.raw_output === true) {
+    return { ...base, kind: "output", text: o.msg.replace(/\r?\n$/, "") };
+  }
+  if (o.command) {
+    const arg = (o.arg ?? "").trim();
+    if (o.command === "error" || o.command === "warning" || o.command === "notice") {
+      return {
+        ...base,
+        kind: "annotation",
+        level: o.command === "notice" ? "info" : o.command,
+        text: arg || base.text
+      };
+    }
+    if (o.command === "group") return { ...base, kind: "group", text: arg };
+    if (o.command === "endgroup") return { ...base, kind: "group", text: "", groupEnd: true };
+    return { ...base, kind: "command" };
+  }
+  if (o.step && o.msg.startsWith("\u2B50 Run ")) {
+    return { ...base, kind: "step-start" };
+  }
+  return base;
+}
+
+// src/server/workflows-lookup.ts
+import { readFile as readFile2, realpath as realpath2, stat as stat2 } from "node:fs/promises";
+import path5 from "node:path";
+var MAX_SOURCE_BYTES = 1024 * 1024;
+async function loadWorkflow(repoPath, file) {
+  const name = workflowFile(file);
+  try {
+    return parseWorkflow(name, await readFile2(path5.join(repoPath, WORKFLOWS_DIR, name), "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+async function readWorkflowSource(repoPath, file) {
+  const name = workflowFile(file);
+  let real;
+  try {
+    real = await realpath2(path5.join(repoPath, WORKFLOWS_DIR, name));
+  } catch {
+    throw new RepoError(`${name} no longer exists. Refresh the workflow list.`, 404);
+  }
+  const root = await realpath2(repoPath);
+  if (!real.startsWith(root + path5.sep)) throw new RepoError(`${name} is a link to a file outside the repo, so it is not shown.`);
+  const info = await stat2(real);
+  if (!info.isFile()) throw new RepoError(`${name} is not a regular file.`);
+  if (info.size > MAX_SOURCE_BYTES) throw new RepoError(`${name} is larger than 1 MB, so it is not shown. Open it in your editor.`);
+  return { file: name, text: await readFile2(real, "utf8") };
+}
+
+// src/server/runs/env.ts
+var REF = /\\\$\{|\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+function unquote(value) {
+  const q = value[0];
+  if (value.length >= 2 && (q === '"' || q === "'") && value.at(-1) === q) {
+    return { text: value.slice(1, -1), expand: q === '"' };
+  }
+  return { text: value, expand: true };
+}
+function resolveEnv(raw) {
+  const done = /* @__PURE__ */ new Map();
+  const visiting = /* @__PURE__ */ new Set();
+  const resolve = (name) => {
+    const cached = done.get(name);
+    if (cached !== void 0) return cached;
+    if (!Object.hasOwn(raw, name) || visiting.has(name)) return void 0;
+    visiting.add(name);
+    const { text, expand } = unquote(raw[name]);
+    const out = expand ? text.replace(REF, (m, ref) => ref === void 0 ? "${" : resolve(ref) ?? m) : text;
+    visiting.delete(name);
+    done.set(name, out);
+    return out;
+  };
+  return Object.fromEntries(Object.keys(raw).map((name) => [name, resolve(name)]));
+}
+
+// src/server/runs/context.ts
+function layer(layers, mask, resolved) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const [source, values] of layers) {
+    for (const [name, value] of Object.entries(values ?? {})) merged.set(name, { name, value: mask(resolved?.[name] ?? value), source });
+  }
+  return [...merged.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+function mergedEnv(repoEnv, environmentEnv, runEnv) {
+  return resolveEnv({ ...repoEnv, ...environmentEnv, ...runEnv });
+}
+function buildRunContext(l) {
+  const { request } = l;
+  const secrets = /* @__PURE__ */ new Map();
+  for (const name of l.repoSecrets) secrets.set(name, { name, source: "repo" });
+  for (const name of l.environment?.secrets ?? []) secrets.set(name, { name, source: "environment" });
+  return {
+    recorded: true,
+    environment: request.environment,
+    workflowFile: l.workflowFile,
+    env: layer(
+      [["repo", l.repoEnv], ["environment", l.environment?.env], ["run", request.env], ["viewer", l.viewerEnv]],
+      l.mask,
+      { ...mergedEnv(l.repoEnv, l.environment?.env, request.env), ...l.viewerEnv }
+    ),
+    vars: layer([["repo", l.repoVars], ["run", request.vars], ["viewer", l.viewerVars]], l.mask),
+    inputs: layer([["run", request.inputs]], l.mask).map(({ name, value }) => ({ name, value })),
+    secrets: [...secrets.values()].sort((a, b) => a.name.localeCompare(b.name))
+  };
+}
+function contextFromRequest(request) {
+  return {
+    ...buildRunContext({ request, repoEnv: {}, repoVars: {}, repoSecrets: [], mask: (v) => v }),
+    recorded: false
+  };
+}
+
+// src/server/runs/isolate.ts
+import { isAlias, isMap, parseDocument } from "yaml";
+function isolateWorkflow(text, suffix) {
+  const doc = parseDocument(text);
+  if (doc.errors.length > 0) return void 0;
+  const jobs = doc.get("jobs", true);
+  if (!isMap(jobs)) return void 0;
+  for (const pair of jobs.items) {
+    const job = pair.value;
+    if (isAlias(job)) return void 0;
+    if (!isMap(job)) continue;
+    const id = String(pair.key.value ?? pair.key);
+    const name = job.get("name");
+    job.set("name", `${name === void 0 || name === null ? id : String(name)} ${suffix}`);
+  }
+  return doc.toString({ lineWidth: 0, flowCollectionPadding: false });
+}
+function isolationSuffix(runId) {
+  return `[${runId.split("-")[1] ?? runId}]`;
+}
+
+// src/server/runs/manager.ts
+var RUN_ID_RE = /^[a-z0-9]+-[a-f0-9]{6}$/;
+var MAX_PAYLOAD_BYTES = 1024 * 1024;
+var KILL_GRACE_MS = 1e4;
+var LIVE_VIEW_PROBE_MS = 500;
+var CONTEXT_FILE = "context.json";
+var CLONE_ERROR_RE = /Unable to clone|remote not found/i;
+var CLONE_HINT = "act could not clone an action while other runs were active. Run it again: if it works, the runs probably clashed in act's shared action cache. If it fails again, check the action's name and your network.";
+function isRunId(id) {
+  return RUN_ID_RE.test(id);
+}
+function redactionPatterns(secrets) {
+  const out = /* @__PURE__ */ new Set();
+  for (const value of Object.values(secrets)) {
+    for (const part of [value, ...value.split(/\r?\n/)]) {
+      if (part.length < 4) continue;
+      out.add(part);
+      out.add(JSON.stringify(part).slice(1, -1));
+    }
+  }
+  return [...out].sort((a, b) => b.length - a.length);
+}
+function redact(line, patterns) {
+  let result = line;
+  for (const p of patterns) if (result.includes(p)) result = result.split(p).join("***");
+  return result;
+}
+function scrub(value, patterns, hits) {
+  if (typeof value === "string") {
+    const r = redact(value, patterns);
+    if (r !== value) hits.n++;
+    return r;
+  }
+  if (Array.isArray(value)) return value.map((x) => scrub(x, patterns, hits));
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([k, x]) => [k, scrub(x, patterns, hits)]));
+  }
+  return value;
+}
+function redactLine(line, patterns) {
+  if (patterns.length === 0) return line;
+  let out = line;
+  if (line.startsWith("{")) {
+    try {
+      const hits = { n: 0 };
+      const scrubbed = scrub(JSON.parse(line), patterns, hits);
+      if (hits.n > 0) out = JSON.stringify(scrubbed);
+    } catch {
+    }
+  }
+  return redact(out, patterns);
+}
+function needsDocker(wf, jobId2, platforms) {
+  const jobs = jobId2 ? wf.jobs.filter((j) => j.id === jobId2) : wf.jobs;
+  return jobs.some((j) => {
+    const label = j.runsOn.split(",")[0]?.trim().toLowerCase();
+    if (!label || label.includes("${{")) return false;
+    const mapping = platforms.find((p) => p.toLowerCase().startsWith(label + "="));
+    return !!mapping && !isHostPlatform(mapping);
+  });
+}
+function jobsToRun(wf, jobId2) {
+  if (!jobId2) return wf.jobs;
+  const byId = new Map(wf.jobs.map((j) => [j.id, j]));
+  const out = /* @__PURE__ */ new Map();
+  const visit = (id) => {
+    const job = byId.get(id);
+    if (!job || out.has(id)) return;
+    out.set(id, job);
+    job.needs.forEach(visit);
+  };
+  visit(jobId2);
+  return [...out.values()];
+}
+function platformOf(job, platforms) {
+  const label = job.runsOn.split(",")[0]?.trim().toLowerCase();
+  if (job.uses || !label || label.includes("${{")) return "unknown";
+  const mapping = platforms.find((p) => p.toLowerCase().startsWith(label + "="));
+  return mapping && isHostPlatform(mapping) ? "host" : "docker";
+}
+var NO_DOCKER_NOTE = "Live view needs a job that runs in Docker; none of this run's jobs do.";
+function matrixCombinations(job, pin) {
+  if (!job.matrix) return 1;
+  return Object.entries(job.matrix).reduce((n, [axis, values]) => n * (axis in pin ? 1 : Math.max(values.length, 1)), 1);
+}
+function planLiveView(wf, jobId2, platforms, matrixPin) {
+  const jobs = jobsToRun(wf, jobId2);
+  const platformById = new Map(jobs.map((j) => [j.id, platformOf(j, platforms)]));
+  const docker = jobs.filter((j) => platformById.get(j.id) === "docker");
+  if (!docker.length && ![...platformById.values()].includes("unknown")) return { enabled: false, notes: [NO_DOCKER_NOTE] };
+  const byId = new Map(jobs.map((j) => [j.id, j]));
+  const depth = /* @__PURE__ */ new Map();
+  const stageOf = (j, seen = /* @__PURE__ */ new Set()) => {
+    const known = depth.get(j.id);
+    if (known !== void 0) return known;
+    if (seen.has(j.id)) return 0;
+    seen.add(j.id);
+    const d = Math.max(-1, ...j.needs.flatMap((n) => byId.has(n) ? [stageOf(byId.get(n), seen)] : [])) + 1;
+    depth.set(j.id, d);
+    return d;
+  };
+  const byStage = /* @__PURE__ */ new Map();
+  for (const j of docker) byStage.set(stageOf(j), [...byStage.get(stageOf(j)) ?? [], j]);
+  const together = [...byStage.values()].find((g) => g.length > 1);
+  if (together) {
+    const names = together.map((j) => `"${j.name}"`);
+    return {
+      enabled: false,
+      notes: [`Live view skipped: jobs ${names.slice(0, -1).join(", ")} and ${names.at(-1)} run at the same time, and each would publish the live-view port. Pick one job (and a matrix value) in the Run dialog to use it.`]
+    };
+  }
+  const wide = docker.find((j) => matrixCombinations(j, matrixPin) > 1);
+  if (wide) {
+    return {
+      enabled: false,
+      notes: [`Live view skipped: job "${wide.name}" runs ${matrixCombinations(wide, matrixPin)} matrix combinations at the same time, and each would publish the live-view port. Pin a matrix value in the Run dialog to use it.`]
+    };
+  }
+  const own = docker.filter((j) => j.containerOptions);
+  return {
+    enabled: true,
+    notes: own.length ? [`Live view unavailable for ${own.map((j) => `"${j.name}"`).join(", ")}: ${own.length === 1 ? "it sets" : "they set"} container.options, which act uses instead of the viewer's.`] : []
+  };
+}
+function wantsIsolation(wf, jobId2, platforms) {
+  return jobsToRun(wf, jobId2).some((j) => platformOf(j, platforms) !== "host");
+}
+function runLockKeys(wf, jobId2, repoId, platforms, isolated) {
+  const anyHost = platforms.some((p) => isHostPlatform(p));
+  const hostKey = `host:${repoId}`;
+  const keys = /* @__PURE__ */ new Set();
+  for (const job of jobsToRun(wf, jobId2)) {
+    const jobKey = `job:${wf.name}/${job.name}`;
+    const platform2 = platformOf(job, platforms);
+    if (platform2 === "host") {
+      keys.add(hostKey);
+      continue;
+    }
+    if (!isolated) keys.add(jobKey);
+    if (platform2 === "unknown" && anyHost) keys.add(hostKey);
+  }
+  return [...keys];
+}
+function waitReason(lockKey, holder, running, cap) {
+  if (lockKey?.startsWith("host:")) {
+    return "Waiting for another host-mode run in this repo. Host-mode steps share the repo's working directory. This starts when that run ends.";
+  }
+  if (lockKey) {
+    const job = lockKey.slice("job:".length);
+    const by = holder ? ` (${holder.summary.workflow})` : "";
+    return `Waiting for another run of "${job}"${by}. act names containers after the workflow and job, so two at once would remove each other's. This starts when that run ends.`;
+  }
+  return `Waiting for a free slot: ${running} running, limit ${cap}. This starts when one ends. You can raise the limit in Setup check.`;
+}
+function probeFreePort() {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.unref();
+    server.once("error", reject);
+    server.listen(0, () => {
+      const { port: port2 } = server.address();
+      server.close(() => resolve(port2));
+    });
+  });
+}
+var RunManager = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  deps;
+  active = /* @__PURE__ */ new Map();
+  queue = [];
+  reservedPorts = /* @__PURE__ */ new Set();
+  shuttingDown = false;
+  cachedActVersion;
+  actVersionLoaded = false;
+  runDir(id) {
+    if (!isRunId(id)) throw new RepoError("invalid run id");
+    return path6.join(this.deps.cfg.dataDir, "runs", id);
+  }
+  /** Mark leftovers from a previous crash as failed. Call once at startup. */
+  recover() {
+    this.deps.store.failInterruptedRuns((/* @__PURE__ */ new Date()).toISOString());
+  }
+  // --- creating runs ---------------------------------------------------------
+  async create(req) {
+    const { store, repos } = this.deps;
+    const repo = await repos.get(req.repoId);
+    if (repo.state !== "ok") throw new RepoError(`Repo is not usable (${repo.state}).`);
+    const file = workflowFile(req.workflow);
+    const wf = await this.deps.getWorkflow(repo.path, file);
+    if (!wf) throw new RepoError(`Workflow not found: ${file}`, 404);
+    if (wf.error) throw new RepoError(`Workflow has errors: ${wf.error}`);
+    const event = eventName(req.event);
+    if (!wf.events.includes(event)) {
+      throw new RepoError(`${file} does not listen for "${event}" (it listens for: ${wf.events.join(", ") || "nothing"}).`);
+    }
+    if (req.job !== void 0) {
+      jobId(req.job);
+      if (!wf.jobs.some((j) => j.id === req.job)) throw new RepoError(`Job not found in ${file}: ${req.job}`);
+    }
+    if (event === "workflow_dispatch" && req.inputs) {
+      const known = new Set(wf.inputs.map((i) => i.name));
+      for (const name of Object.keys(req.inputs)) {
+        if (!known.has(name)) throw new RepoError(`Unknown workflow_dispatch input: ${name}`);
+      }
+    }
+    if (req.eventPayload?.trim()) {
+      if (Buffer.byteLength(req.eventPayload) > MAX_PAYLOAD_BYTES) throw new RepoError("Event payload is too large (1 MB max).");
+      try {
+        const parsed = JSON.parse(req.eventPayload);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("not an object");
+      } catch {
+        throw new RepoError("Event payload must be a JSON object.");
+      }
+    }
+    keyValueMap("matrix", req.matrix);
+    keyValueMap("input", req.inputs);
+    keyValueMap("env", req.env);
+    keyValueMap("var", req.vars);
+    if (req.environment) this.deps.environments.get(req.environment);
+    const id = `${Date.now().toString(36)}-${randomBytes2(3).toString("hex")}`;
+    const dir = this.runDir(id);
+    mkdirSync3(dir, { recursive: true });
+    const isolation = await this.isolate(repo.path, file, wf, req.job, repo.config.platforms, id, dir);
+    const summary = {
+      id,
+      repoId: repo.id,
+      workflow: file,
+      event,
+      job: req.job,
+      status: "queued",
+      dryRun: req.dryRun === true,
+      queuedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      request: { ...req, repoId: repo.id, workflow: file, event }
+    };
+    store.insertRun(summary);
+    this.active.set(id, {
+      summary,
+      repoPath: repo.path,
+      workflowInfo: wf,
+      seq: 0,
+      cancelRequested: false,
+      sawJobEnd: false,
+      subscribers: /* @__PURE__ */ new Set(),
+      decoders: { stdout: new StringDecoder("utf8"), stderr: new StringDecoder("utf8") },
+      residual: { stdout: "", stderr: "" },
+      logFile: path6.join(dir, "log.ndjson"),
+      redactions: [],
+      lockKeys: runLockKeys(wf, req.job, repo.id, repo.config.platforms, isolation !== void 0),
+      isolation,
+      overlapped: false,
+      sawCloneError: false
+    });
+    this.queue.push(id);
+    this.tick();
+    return { ...summary };
+  }
+  /**
+   * Write the per-run workflow copy that lets this run share a workflow with other runs (see
+   * runs/isolate.ts), when it has a Docker job and the file can be rewritten. The copy is a snapshot taken
+   * now and keeps the file's base name, so a workflow without a `name:` is still named after its file.
+   * Any problem means no copy, so the run falls back to the lock it had before.
+   */
+  async isolate(repoPath, file, wf, job, platforms, id, dir) {
+    if (!wantsIsolation(wf, job, platforms)) return void 0;
+    try {
+      const suffix = isolationSuffix(id);
+      const copy = isolateWorkflow((await readWorkflowSource(repoPath, file)).text, suffix);
+      if (copy === void 0) return void 0;
+      const target = path6.resolve(dir, "wf", file);
+      mkdirSync3(path6.dirname(target), { recursive: true });
+      writeFileSync(target, copy);
+      return { suffix, file: target };
+    } catch {
+      return void 0;
+    }
+  }
+  async rerun(id) {
+    const run2 = this.deps.store.getRun(id);
+    if (!run2) throw new RepoError("run not found", 404);
+    return this.create(run2.request);
+  }
+  // --- scheduling ------------------------------------------------------------
+  /** The saved limit (Setup check), else the configured default. */
+  maxConcurrentRuns() {
+    const saved = Number(this.deps.store.getSetting("maxConcurrentRuns"));
+    return Number.isInteger(saved) && saved >= MIN_CONCURRENT_RUNS && saved <= MAX_CONCURRENT_RUNS ? saved : this.deps.cfg.maxConcurrentRuns;
+  }
+  /** Save a new limit and start whatever it lets through. Running runs are never stopped by a lower one. */
+  setMaxConcurrentRuns(n) {
+    if (!Number.isInteger(n) || n < MIN_CONCURRENT_RUNS || n > MAX_CONCURRENT_RUNS) {
+      throw new RepoError(`The run limit must be a whole number from ${MIN_CONCURRENT_RUNS} to ${MAX_CONCURRENT_RUNS}.`);
+    }
+    this.deps.store.setSetting("maxConcurrentRuns", String(n));
+    this.tick();
+    return n;
+  }
+  /** Start queued runs, oldest first, while there is a free slot and no running run holds one of their locks. */
+  tick() {
+    if (this.shuttingDown) return;
+    const cap = this.maxConcurrentRuns();
+    const running = [...this.active.values()].filter((a) => a.summary.status === "running");
+    let slots = cap - running.length;
+    const holders = /* @__PURE__ */ new Map();
+    for (const r of running) for (const k of r.lockKeys) holders.set(k, r);
+    let runningCount = running.length;
+    for (const id of [...this.queue]) {
+      const a = this.active.get(id);
+      if (!a) {
+        this.queue = this.queue.filter((q) => q !== id);
+        continue;
+      }
+      const blocked = a.lockKeys.find((k) => holders.has(k));
+      if (blocked || slots <= 0) {
+        this.setWaiting(a, waitReason(blocked, blocked ? holders.get(blocked) : void 0, runningCount, cap));
+        continue;
+      }
+      this.queue = this.queue.filter((q) => q !== id);
+      for (const k of a.lockKeys) holders.set(k, a);
+      slots--;
+      runningCount++;
+      void this.start(a);
+    }
+  }
+  /** Record why a queued run is waiting. Stored in `note`, so every endpoint and the SSE stream carry it. */
+  setWaiting(a, reason) {
+    if (a.summary.note === reason) return;
+    a.summary.note = reason;
+    this.deps.store.updateRun(a.summary);
+    this.notifyStatus(a);
+  }
+  async start(a) {
+    a.summary.status = "running";
+    a.summary.startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    a.summary.note = void 0;
+    const running = [...this.active.values()].filter((r) => r.summary.status === "running");
+    if (running.length > 1) for (const r of running) r.overlapped = true;
+    this.deps.store.updateRun(a.summary);
+    this.notifyStatus(a);
+    try {
+      await this.execute(a);
+    } catch (e) {
+      this.emit(a, "stderr", [`Error: ${e.message}`]);
+      this.finish(a, "error", void 0, `The viewer could not start this run: ${e.message}`);
+    }
+  }
+  async execute(a) {
+    const { cfg, repos, secrets, environments } = this.deps;
+    const s = a.summary;
+    const req = s.request;
+    const repo = await repos.get(s.repoId);
+    const dir = this.runDir(s.id);
+    const artifactDir = path6.join(dir, "artifacts");
+    mkdirSync3(artifactDir, { recursive: true });
+    let eventPayloadPath;
+    if (req.eventPayload?.trim()) {
+      eventPayloadPath = path6.join(dir, "event.json");
+      writeFileSync(eventPayloadPath, req.eventPayload);
+    }
+    const environment = req.environment ? environments.resolve(req.environment) : void 0;
+    const repoSecrets = secrets.values(repo.id);
+    const secretValues = { ...repoSecrets, ...environment?.secrets };
+    a.redactions = redactionPatterns(secretValues);
+    const artifactPort = a.artifactPort = await this.reservePort();
+    const layerEnv = mergedEnv(repo.config.env, environment?.env, req.env);
+    let viewerEnv;
+    let liveView;
+    if (req.viewable === true && !s.dryRun) {
+      const plan = planLiveView(a.workflowInfo, s.job, repo.config.platforms, req.matrix ?? {});
+      if (plan.enabled) {
+        a.viewablePort = await this.reservePort();
+        liveView = { port: a.viewablePort };
+        viewerEnv = { VNC_PORT: String(a.viewablePort) };
+      }
+      if (plan.notes.length) {
+        s.note = plan.notes.join(" ");
+        this.deps.store.updateRun(s);
+        this.notifyStatus(a);
+      }
+    }
+    const args = buildActArgs({
+      event: s.event,
+      workflowFile: s.workflow,
+      workflowPath: a.isolation?.file,
+      job: s.job,
+      matrix: req.matrix ?? {},
+      inputs: req.inputs ?? {},
+      eventPayloadPath,
+      dryRun: s.dryRun,
+      env: { ...layerEnv, ...viewerEnv },
+      vars: { ...repo.config.vars, ...req.vars, ...viewerEnv },
+      secretNames: Object.keys(secretValues),
+      platforms: repo.config.platforms,
+      pull: req.pull ?? repo.config.pull,
+      offline: req.offline ?? repo.config.offline,
+      containerArchitecture: repo.config.containerArchitecture,
+      artifactDir,
+      artifactPort,
+      liveView
+    });
+    const context = buildRunContext({
+      request: req,
+      repoEnv: repo.config.env,
+      repoVars: repo.config.vars,
+      repoSecrets: Object.keys(repoSecrets),
+      environment: environment && { env: environment.env, secrets: Object.keys(environment.secrets) },
+      workflowFile: a.isolation ? "job-names" : "original",
+      viewerEnv,
+      viewerVars: viewerEnv,
+      mask: (value) => redact(value, a.redactions)
+    });
+    writeFileSync(path6.join(dir, CONTEXT_FILE), JSON.stringify(context));
+    if (!this.actVersionLoaded) {
+      this.cachedActVersion = await actVersion(cfg);
+      this.actVersionLoaded = true;
+    }
+    s.actVersion = this.cachedActVersion;
+    if (!s.dryRun && needsDocker(a.workflowInfo, s.job, repo.config.platforms)) {
+      const docker = await dockerReachable(cfg);
+      if (!docker.ok) {
+        const msg = "Docker is not running. Start Docker Desktop, then run again (a dry run works without Docker).";
+        this.emit(a, "stderr", [`Error: ${msg}`]);
+        this.finish(a, "error", void 0, msg);
+        return;
+      }
+    }
+    if (a.cancelRequested) {
+      this.finish(a, "cancelled");
+      return;
+    }
+    const child = spawn(cfg.actBin, args, {
+      cwd: repo.path,
+      env: { ...process.env, ...secretValues },
+      detached: true,
+      // own process group, so cancel can signal act and everything it started
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    a.child = child;
+    if (a.viewablePort !== void 0) this.watchLiveView(a, a.viewablePort);
+    child.on("error", (err) => {
+      const msg = err.code === "ENOENT" ? `Could not find "${cfg.actBin}". Install act (brew install act).` : err.message;
+      this.emit(a, "stderr", [`Error: ${msg}`]);
+      this.finish(a, "error", void 0, msg);
+    });
+    child.stdout.on("data", (chunk) => this.ingest(a, "stdout", chunk));
+    child.stderr.on("data", (chunk) => this.ingest(a, "stderr", chunk));
+    child.on("close", (code) => {
+      for (const stream of ["stdout", "stderr"]) {
+        const tail = a.residual[stream] + a.decoders[stream].end();
+        a.residual[stream] = "";
+        if (tail) this.emit(a, stream, [tail]);
+      }
+      this.finish(a, void 0, code);
+    });
+  }
+  /**
+   * The live-view URL is published once the player answers, not when the container starts: the container and
+   * the player's own startup take seconds, and Docker accepts connections on a published port before anything
+   * listens behind it, so only an HTTP answer says the player is up. Any status counts (it is up either way).
+   */
+  watchLiveView(a, port2) {
+    let probing = false;
+    a.viewableTimer = setInterval(() => {
+      if (probing) return;
+      probing = true;
+      fetch(`http://127.0.0.1:${port2}/vnc.html`, { signal: AbortSignal.timeout(1500) }).then((res) => {
+        void res.body?.cancel();
+        if (FINAL_STATUSES.includes(a.summary.status)) return;
+        clearInterval(a.viewableTimer);
+        a.summary.liveViewUrl = `http://localhost:${port2}/vnc.html?autoconnect=1&resize=scale`;
+        this.notifyStatus(a);
+      }).catch(() => {
+      }).finally(() => {
+        probing = false;
+      });
+    }, LIVE_VIEW_PROBE_MS);
+    a.viewableTimer.unref();
+  }
+  /**
+   * act's artifact server listens on one fixed port by default, so each run needs its own, and live view needs
+   * one more. The probe only says the port is free right now; `reservedPorts` stops two of our runs probing
+   * the same one. `finish` gives them back.
+   */
+  async reservePort() {
+    for (let attempt = 0; attempt < 5; attempt++) {
+      const port2 = await probeFreePort();
+      if (this.reservedPorts.has(port2)) continue;
+      this.reservedPorts.add(port2);
+      return port2;
+    }
+    throw new Error("could not find a free local port");
+  }
+  // --- log pipeline ------------------------------------------------------------
+  ingest(a, stream, chunk) {
+    const text = a.residual[stream] + a.decoders[stream].write(chunk);
+    const lines = text.split("\n");
+    a.residual[stream] = lines.pop() ?? "";
+    if (lines.length) this.emit(a, stream, lines);
+  }
+  /** Parse lines, persist them, then fan out. Persisting first means replays never miss an event. */
+  emit(a, stream, lines) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const events = [];
+    const records = [];
+    for (const raw of lines) {
+      let line = redactLine(raw.replace(/\r$/, ""), a.redactions);
+      if (a.isolation) line = line.split(` ${a.isolation.suffix}`).join("");
+      if (!a.sawCloneError && CLONE_ERROR_RE.test(line)) a.sawCloneError = true;
+      const ev = parseActLine(line, stream, a.seq, now);
+      if (!ev) continue;
+      a.seq++;
+      events.push(ev);
+      records.push(JSON.stringify({ s: stream === "stdout" ? "o" : "e", t: now, l: line }));
+    }
+    if (!events.length) return;
+    appendFileSync(a.logFile, records.join("\n") + "\n");
+    if (events.some((e) => e.kind === "job-end")) a.sawJobEnd = true;
+    for (const sub of a.subscribers) sub.onEvents(events);
+  }
+  finish(a, forced, code, note) {
+    const s = a.summary;
+    if (FINAL_STATUSES.includes(s.status)) return;
+    if (a.killTimer) clearTimeout(a.killTimer);
+    clearInterval(a.viewableTimer);
+    for (const port2 of [a.artifactPort, a.viewablePort]) if (port2 !== void 0) this.reservedPorts.delete(port2);
+    a.artifactPort = a.viewablePort = void 0;
+    s.liveViewUrl = void 0;
+    if (s.status === "queued") s.note = void 0;
+    const cloneHint = a.sawCloneError && a.overlapped ? CLONE_HINT : void 0;
+    let status = forced;
+    if (!status) {
+      if (a.cancelRequested) status = "cancelled";
+      else if (code === 0) status = "success";
+      else if (a.sawJobEnd) {
+        status = "failure";
+        note ??= cloneHint;
+      } else {
+        status = "error";
+        note ??= cloneHint ?? `act exited with code ${code ?? "unknown"} before any job finished. See the log for details.`;
+      }
+    }
+    s.status = status;
+    s.exitCode = code ?? void 0;
+    s.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+    if (note) s.note = note;
+    this.deps.store.updateRun(s);
+    this.notifyStatus(a);
+    for (const sub of a.subscribers) sub.onEnd();
+    a.subscribers.clear();
+    this.active.delete(s.id);
+    this.queue = this.queue.filter((q) => q !== s.id);
+    this.prune(s.repoId);
+    this.tick();
+  }
+  notifyStatus(a) {
+    const copy = { ...a.summary };
+    for (const sub of a.subscribers) sub.onStatus(copy);
+  }
+  prune(repoId) {
+    for (const id of this.deps.store.runsToPrune(repoId, this.deps.cfg.retentionRuns)) {
+      rmSync2(this.runDir(id), { recursive: true, force: true });
+      this.deps.store.deleteRun(id);
+    }
+  }
+  // --- cancel ------------------------------------------------------------------
+  cancel(id) {
+    const a = this.active.get(id);
+    if (!a) {
+      const run2 = this.deps.store.getRun(id);
+      if (!run2) throw new RepoError("run not found", 404);
+      throw new RepoError("This run has already finished.", 409);
+    }
+    if (a.summary.status === "queued") {
+      a.cancelRequested = true;
+      this.finish(a, "cancelled");
+      return { ...a.summary };
+    }
+    a.cancelRequested = true;
+    this.signalGroup(a, "SIGTERM");
+    a.killTimer ??= setTimeout(() => this.signalGroup(a, "SIGKILL"), KILL_GRACE_MS);
+    return { ...a.summary };
+  }
+  signalGroup(a, signal) {
+    const pid = a.child?.pid;
+    if (!pid) return;
+    try {
+      process.kill(-pid, signal);
+    } catch {
+    }
+  }
+  async shutdown() {
+    this.shuttingDown = true;
+    for (const a of [...this.active.values()]) {
+      a.cancelRequested = true;
+      if (a.summary.status === "queued") this.finish(a, "cancelled");
+      else this.signalGroup(a, "SIGTERM");
+    }
+    const deadline = Date.now() + 5e3;
+    while (this.active.size > 0 && Date.now() < deadline) await new Promise((r) => setTimeout(r, 50));
+    for (const a of this.active.values()) this.signalGroup(a, "SIGKILL");
+  }
+  // --- reading -----------------------------------------------------------------
+  /** Every event of a run from `from` on, read from the on-disk log. */
+  readEvents(id, from = 0) {
+    const file = path6.join(this.runDir(id), "log.ndjson");
+    if (!existsSync2(file)) return [];
+    const out = [];
+    const lines = readFileSync(file, "utf8").split("\n");
+    for (let seq = from; seq < lines.length; seq++) {
+      const rec = lines[seq];
+      if (!rec) continue;
+      try {
+        const { s, t, l } = JSON.parse(rec);
+        const ev = parseActLine(l, s === "o" ? "stdout" : "stderr", seq, t);
+        if (ev) out.push(ev);
+      } catch {
+      }
+    }
+    return out;
+  }
+  /**
+   * Replay from `from`, then (if the run is live) attach to it. The file read and the attach
+   * happen in one synchronous step, so no event can fall between them.
+   */
+  subscribe(id, from, sub) {
+    const a = this.active.get(id);
+    const backlog = this.readEvents(id, from);
+    if (a) {
+      a.subscribers.add(sub);
+      return { backlog, run: { ...a.summary }, live: true, unsubscribe: () => void a.subscribers.delete(sub) };
+    }
+    const run2 = this.deps.store.getRun(id);
+    if (!run2) return void 0;
+    return { backlog, run: run2, live: false, unsubscribe: () => {
+    } };
+  }
+  /** What the run was started with. Falls back to the request alone when none was recorded. */
+  readContext(run2) {
+    try {
+      return JSON.parse(readFileSync(path6.join(this.runDir(run2.id), CONTEXT_FILE), "utf8"));
+    } catch {
+      return contextFromRequest(run2.request);
+    }
+  }
+  /** Plain-text rendering for the "download log" button. */
+  logText(id) {
+    return this.readEvents(id).filter((e) => e.kind !== "step-start" && e.kind !== "group").map((e) => e.jobKey ? `[${e.jobKey}] ${e.text}` : e.text).join("\n");
+  }
+  // --- deleting ----------------------------------------------------------------
+  deleteRun(id) {
+    if (this.active.has(id)) throw new RepoError("Cancel the run before deleting it.", 409);
+    if (!this.deps.store.getRun(id)) throw new RepoError("run not found", 404);
+    rmSync2(this.runDir(id), { recursive: true, force: true });
+    this.deps.store.deleteRun(id);
+  }
+  /** Remove all history for a repo. Refuses while one of its runs is active. */
+  deleteRunsForRepo(repoId) {
+    for (const a of this.active.values()) {
+      if (a.summary.repoId === repoId) throw new RepoError("Cancel this repo's running workflows first.", 409);
+    }
+    for (const id of this.deps.store.runIdsForRepo(repoId)) {
+      rmSync2(this.runDir(id), { recursive: true, force: true });
+      this.deps.store.deleteRun(id);
+    }
+  }
+  /** Wipe finished runs (logs, artifacts, build data). Queued and running runs are left alone. */
+  clearFinishedRuns(repoId, workflow) {
+    for (const id of this.deps.store.finishedRunIds(repoId, workflow)) {
+      if (this.active.has(id)) continue;
+      rmSync2(this.runDir(id), { recursive: true, force: true });
+      this.deps.store.deleteRun(id);
+    }
+  }
+};
+
+// src/server/app.ts
+var kv = z.record(z.string(), z.string());
+var RunRequestSchema = z.object({
+  repoId: z.string().min(1),
+  workflow: z.string().min(1),
+  event: z.string().min(1),
+  job: z.string().min(1).optional(),
+  matrix: kv.optional(),
+  inputs: kv.optional(),
+  eventPayload: z.string().optional(),
+  dryRun: z.boolean().optional(),
+  viewable: z.boolean().optional(),
+  env: kv.optional(),
+  vars: kv.optional(),
+  pull: z.boolean().optional(),
+  offline: z.boolean().optional(),
+  environment: z.string().min(1).optional()
+}).strict();
+var ConfigSchema = z.object({
+  platforms: z.array(z.string()).optional(),
+  env: kv.optional(),
+  vars: kv.optional(),
+  pull: z.boolean().optional(),
+  offline: z.boolean().optional(),
+  containerArchitecture: z.string().optional()
+}).strict();
+var RepoPatchSchema = z.object({ name: z.string().optional(), config: ConfigSchema.optional() }).strict();
+var SettingsSchema = z.object({ maxConcurrentRuns: z.number() }).strict();
+var EnvironmentCreateSchema = z.object({ name: z.string().min(1), env: kv.optional() }).strict();
+var EnvironmentPatchSchema = z.object({ env: kv }).strict();
+var SecretValueSchema = z.object({ value: z.string() }).strict();
+var BadRequest = class extends Error {
+};
+function createApp(deps) {
+  const { cfg, security, repos, environments, secrets, runs, store } = deps;
+  const app = new Hono();
+  app.use("*", security.middleware());
+  app.use("/api/*", bodyLimit({ maxSize: 2 * 1024 * 1024, onError: (c) => c.json({ error: "request body too large" }, 413) }));
+  app.onError((err, c) => {
+    if (err instanceof RepoError) return c.json({ error: err.message }, err.status);
+    if (err instanceof ValidationError || err instanceof BadRequest) return c.json({ error: err.message }, 400);
+    if (err instanceof z.ZodError) {
+      const issue = err.issues[0];
+      const where = issue?.path.length ? `${issue.path.join(".")}: ` : "";
+      return c.json({ error: `${where}${issue?.message ?? "invalid request"}` }, 400);
+    }
+    if (err instanceof SyntaxError) return c.json({ error: "request body is not valid JSON" }, 400);
+    console.error(err);
+    return c.json({ error: "internal error" }, 500);
+  });
+  async function json(c, schema) {
+    return schema.parse(await c.req.json());
+  }
+  app.get("/api/session", (c) => c.json({ token: security.token, version: cfg.version }));
+  let doctorCache;
+  app.get("/api/health", async (c) => {
+    if (!doctorCache || c.req.query("refresh") === "1" || Date.now() - doctorCache.at > 15e3) {
+      doctorCache = { at: Date.now(), checks: await runDoctor(cfg) };
+    }
+    return c.json(doctorCache.checks);
+  });
+  app.get("/api/settings", (c) => c.json({ maxConcurrentRuns: runs.maxConcurrentRuns() }));
+  app.put("/api/settings", async (c) => {
+    const body = await json(c, SettingsSchema);
+    return c.json({ maxConcurrentRuns: runs.setMaxConcurrentRuns(body.maxConcurrentRuns) });
+  });
+  app.get("/api/repos", async (c) => c.json(await repos.list()));
+  app.post("/api/repos", async (c) => {
+    const { path: p } = await json(c, z.object({ path: z.string().min(1) }).strict());
+    return c.json(await repos.add(p), 201);
+  });
+  app.patch("/api/repos/:id", async (c) => c.json(await repos.update(c.req.param("id"), await json(c, RepoPatchSchema))));
+  app.delete("/api/repos/:id", async (c) => {
+    const id = c.req.param("id");
+    await repos.get(id);
+    runs.deleteRunsForRepo(id);
+    repos.remove(id);
+    return c.body(null, 204);
+  });
+  app.put("/api/repos/:id/secrets/:name", async (c) => {
+    const repo = await repos.get(c.req.param("id"));
+    const { value } = await json(c, SecretValueSchema);
+    secrets.set(repo.id, c.req.param("name"), value);
+    return c.json(await repos.get(repo.id));
+  });
+  app.delete("/api/repos/:id/secrets/:name", async (c) => {
+    const repo = await repos.get(c.req.param("id"));
+    secrets.delete(repo.id, c.req.param("name"));
+    return c.json(await repos.get(repo.id));
+  });
+  app.get("/api/repos/:id/workflows", async (c) => {
+    const repo = await repos.get(c.req.param("id"));
+    return c.json(await enrichWithStages(cfg, repo.path, await loadWorkflows(repo.path)));
+  });
+  app.get("/api/repos/:id/workflows/:file/source", async (c) => {
+    const repo = await repos.get(c.req.param("id"));
+    return c.json(await readWorkflowSource(repo.path, c.req.param("file")));
+  });
+  app.post("/api/repos/:id/validate", async (c) => {
+    const repo = await repos.get(c.req.param("id"));
+    const { workflow } = await json(c, z.object({ workflow: z.string() }).strict());
+    return c.json(await validateWorkflow(cfg, repo.path, workflowFile(workflow)));
+  });
+  app.get("/api/environments", (c) => c.json(environments.list()));
+  app.post("/api/environments", async (c) => {
+    const { name, env } = await json(c, EnvironmentCreateSchema);
+    return c.json(environments.create(name, env), 201);
+  });
+  app.patch(
+    "/api/environments/:name",
+    async (c) => c.json(environments.update(c.req.param("name"), (await json(c, EnvironmentPatchSchema)).env))
+  );
+  app.delete("/api/environments/:name", (c) => {
+    environments.remove(c.req.param("name"));
+    return c.body(null, 204);
+  });
+  app.put("/api/environments/:name/secrets/:secret", async (c) => {
+    const { value } = await json(c, SecretValueSchema);
+    return c.json(environments.setSecret(c.req.param("name"), c.req.param("secret"), value));
+  });
+  app.delete(
+    "/api/environments/:name/secrets/:secret",
+    (c) => c.json(environments.deleteSecret(c.req.param("name"), c.req.param("secret")))
+  );
+  app.post("/api/runs", async (c) => c.json(await runs.create(await json(c, RunRequestSchema)), 202));
+  app.get("/api/runs", (c) => {
+    const limit = Math.min(Math.max(Number(c.req.query("limit") ?? 100) || 100, 1), 500);
+    return c.json(store.listRuns(c.req.query("repoId") || void 0, limit));
+  });
+  app.delete("/api/runs", async (c) => {
+    const repoId = c.req.query("repoId");
+    if (!repoId) throw new BadRequest("repoId is required");
+    await repos.get(repoId);
+    const wf = c.req.query("workflow");
+    runs.clearFinishedRuns(repoId, wf ? workflowFile(wf) : void 0);
+    return c.body(null, 204);
+  });
+  function requireRun(id) {
+    if (!isRunId(id)) throw new RepoError("run not found", 404);
+    const run2 = store.getRun(id);
+    if (!run2) throw new RepoError("run not found", 404);
+    return run2;
+  }
+  app.get("/api/runs/:id", (c) => c.json(requireRun(c.req.param("id"))));
+  app.post("/api/runs/:id/cancel", async (c) => {
+    requireRun(c.req.param("id"));
+    return c.json(runs.cancel(c.req.param("id")));
+  });
+  app.post("/api/runs/:id/rerun", async (c) => {
+    requireRun(c.req.param("id"));
+    return c.json(await runs.rerun(c.req.param("id")), 202);
+  });
+  app.delete("/api/runs/:id", (c) => {
+    requireRun(c.req.param("id"));
+    runs.deleteRun(c.req.param("id"));
+    return c.body(null, 204);
+  });
+  app.get("/api/runs/:id/context", (c) => c.json(runs.readContext(requireRun(c.req.param("id")))));
+  app.get("/api/runs/:id/log", (c) => {
+    const run2 = requireRun(c.req.param("id"));
+    return c.body(runs.logText(run2.id), 200, {
+      "content-type": "text/plain; charset=utf-8",
+      "content-disposition": `attachment; filename="${run2.workflow.replace(/\.ya?ml$/, "")}-${run2.id}.log"`
+    });
+  });
+  app.get("/api/runs/:id/artifacts", (c) => {
+    const run2 = requireRun(c.req.param("id"));
+    return c.json(listArtifacts(runs.runDir(run2.id)));
+  });
+  const sendArtifact = (c, runId, rel, inline) => {
+    const file = resolveArtifactFile(runs.runDir(runId), rel);
+    return c.body(Readable.toWeb(createReadStream(file.abs)), 200, {
+      ...fileResponseHeaders(file.downloadName, inline, file.abs),
+      "content-length": String(statSync2(file.abs).size)
+    });
+  };
+  app.get("/api/runs/:id/artifacts/file", (c) => {
+    const run2 = requireRun(c.req.param("id"));
+    const rel = c.req.query("path");
+    if (!rel) throw new BadRequest("missing path");
+    return sendArtifact(c, run2.id, rel, false);
+  });
+  app.get("/api/runs/:id/artifacts/raw/*", (c) => {
+    const run2 = requireRun(c.req.param("id"));
+    const prefix = `/api/runs/${run2.id}/artifacts/raw/`;
+    const pathname = new URL(c.req.url).pathname;
+    if (!pathname.startsWith(prefix)) throw new RepoError("file not found", 404);
+    let rel;
+    try {
+      rel = pathname.slice(prefix.length).split("/").map(decodeURIComponent).join("/");
+    } catch {
+      throw new RepoError("file not found", 404);
+    }
+    return sendArtifact(c, run2.id, rel, true);
+  });
+  app.post("/api/runs/:id/artifacts/extract", async (c) => {
+    const run2 = requireRun(c.req.param("id"));
+    const body = z.object({ path: z.string().min(1) }).strict().parse(await c.req.json());
+    if (!FINAL_STATUSES.includes(run2.status)) {
+      throw new RepoError("this run has not finished yet; extract the zip once it has", 409);
+    }
+    await extractArtifactZip(runs.runDir(run2.id), body.path);
+    return c.json(listArtifacts(runs.runDir(run2.id)));
+  });
+  app.get("/api/runs/:id/events", (c) => {
+    const id = c.req.param("id");
+    requireRun(id);
+    const last = c.req.header("last-event-id");
+    const from = last ? Number(last) + 1 : Number(c.req.query("from") ?? 0);
+    if (!Number.isInteger(from) || from < 0) throw new BadRequest("invalid resume position");
+    return streamSSE(c, async (stream) => {
+      let chain = Promise.resolve();
+      const enqueue = (fn) => {
+        chain = chain.then(fn).catch(() => {
+        });
+      };
+      let finish;
+      const finished = new Promise((resolve) => finish = resolve);
+      const sub = {
+        onEvents: (events) => enqueue(async () => {
+          for (const e of events) await stream.writeSSE({ id: String(e.seq), data: JSON.stringify(e) });
+        }),
+        onStatus: (run2) => enqueue(() => stream.writeSSE({ event: "status", data: JSON.stringify(run2) })),
+        onEnd: () => enqueue(async () => {
+          await stream.writeSSE({ event: "end", data: "" });
+          finish();
+        })
+      };
+      const sc = runs.subscribe(id, from, sub);
+      if (!sc) return;
+      enqueue(async () => {
+        await stream.writeSSE({ event: "status", data: JSON.stringify(sc.run) });
+        for (const e of sc.backlog) await stream.writeSSE({ id: String(e.seq), data: JSON.stringify(e) });
+        if (!sc.live) {
+          await stream.writeSSE({ event: "end", data: "" });
+          finish();
+        }
+      });
+      const ping = setInterval(() => enqueue(() => stream.writeSSE({ event: "ping", data: "" })), 2e4);
+      stream.onAbort(finish);
+      await finished;
+      clearInterval(ping);
+      sc.unsubscribe();
+    });
+  });
+  app.all("/api/*", (c) => c.json({ error: "not found" }, 404));
+  if (deps.staticDir) {
+    const rel = path7.relative(process.cwd(), deps.staticDir) || ".";
+    app.use("/*", serveStatic({ root: rel }));
+    app.get("*", serveStatic({ path: path7.join(rel, "index.html") }));
+  }
+  return app;
+}
+
+// src/server/config.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import os2 from "node:os";
+import path8 from "node:path";
+function readVersion() {
+  try {
+    const pkg = JSON.parse(readFileSync2(new URL("../../package.json", import.meta.url), "utf8"));
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function loadConfig(overrides = {}) {
+  return {
+    dataDir: process.env.GHA_VIEW_HOME ?? path8.join(os2.homedir(), ".gha-view"),
+    actBin: process.env.GHA_VIEW_ACT_BIN ?? "act",
+    dockerBin: process.env.GHA_VIEW_DOCKER_BIN ?? "docker",
+    maxConcurrentRuns: DEFAULT_CONCURRENT_RUNS,
+    retentionRuns: 200,
+    version: readVersion(),
+    ...overrides
+  };
+}
+
+// src/server/environments.ts
+var scope = (name) => `env-${name}`;
+var EnvironmentService = class {
+  constructor(store, secrets) {
+    this.store = store;
+    this.secrets = secrets;
+  }
+  store;
+  secrets;
+  info(row) {
+    return { name: row.name, env: row.env, secretNames: this.secrets.names(scope(row.name)), createdAt: row.createdAt };
+  }
+  row(name) {
+    const row = this.store.getEnvironment(environmentName(name));
+    if (!row) throw new RepoError(`Environment "${name}" not found. Create it on the Environments page, or pick another.`, 404);
+    return row;
+  }
+  list() {
+    return this.store.listEnvironments().map((r) => this.info(r));
+  }
+  get(name) {
+    return this.info(this.row(name));
+  }
+  create(name, env = {}) {
+    environmentName(name);
+    if (this.store.getEnvironment(name)) throw new RepoError(`Environment "${name}" already exists`, 409);
+    const row = { name, env: keyValueMap("env", env), createdAt: (/* @__PURE__ */ new Date()).toISOString() };
+    this.store.insertEnvironment(row);
+    return this.info(row);
+  }
+  update(name, env) {
+    this.row(name);
+    this.store.updateEnvironment(name, keyValueMap("env", env));
+    return this.get(name);
+  }
+  remove(name) {
+    this.row(name);
+    this.store.deleteEnvironment(name);
+    this.secrets.deleteAll(scope(name));
+  }
+  setSecret(name, secret, value) {
+    this.row(name);
+    this.secrets.set(scope(name), secret, value);
+    return this.get(name);
+  }
+  deleteSecret(name, secret) {
+    this.row(name);
+    this.secrets.delete(scope(name), secret);
+    return this.get(name);
+  }
+  /** Env vars and secret values for a run. Throws if the environment was deleted after the run was queued. */
+  resolve(name) {
+    return { env: this.row(name).env, secrets: this.secrets.values(scope(name)) };
+  }
+};
+
+// src/server/secrets.ts
+import { chmodSync, existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync3, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import path9 from "node:path";
+var SecretStore = class {
+  dir;
+  constructor(dataDir) {
+    this.dir = path9.join(dataDir, "secrets");
+    mkdirSync4(this.dir, { recursive: true, mode: 448 });
+  }
+  file(scope2) {
+    return path9.join(this.dir, `${scope2}.json`);
+  }
+  read(scope2) {
+    const f = this.file(scope2);
+    if (!existsSync3(f)) return {};
+    try {
+      return JSON.parse(readFileSync3(f, "utf8"));
+    } catch {
+      return {};
+    }
+  }
+  write(scope2, data) {
+    const f = this.file(scope2);
+    writeFileSync2(f, JSON.stringify(data), { mode: 384 });
+    chmodSync(f, 384);
+  }
+  names(scope2) {
+    return Object.keys(this.read(scope2)).sort();
+  }
+  /** Values, for building a run's environment. Never expose through the API. */
+  values(scope2) {
+    return this.read(scope2);
+  }
+  set(scope2, name, value) {
+    secretName(name);
+    if (value.includes("\0")) throw new Error("secret value contains a NUL byte");
+    const data = this.read(scope2);
+    data[name] = value;
+    this.write(scope2, data);
+  }
+  delete(scope2, name) {
+    const data = this.read(scope2);
+    delete data[name];
+    this.write(scope2, data);
+  }
+  deleteAll(scope2) {
+    rmSync3(this.file(scope2), { force: true });
+  }
+};
+
+// src/server/security.ts
+import { randomBytes as randomBytes3, timingSafeEqual } from "node:crypto";
+var TOKEN_HEADER = "x-gha-view-token";
+var Security = class {
+  token = randomBytes3(24).toString("hex");
+  hosts = /* @__PURE__ */ new Set();
+  origins = /* @__PURE__ */ new Set();
+  /** Allow the loopback names for a port. */
+  allowPort(port2) {
+    for (const h of ["localhost", "127.0.0.1", "[::1]"]) {
+      this.hosts.add(`${h}:${port2}`);
+      this.origins.add(`http://${h}:${port2}`);
+    }
+  }
+  tokenOk(given) {
+    if (!given) return false;
+    const a = Buffer.from(given);
+    const b = Buffer.from(this.token);
+    return a.length === b.length && timingSafeEqual(a, b);
+  }
+  middleware() {
+    return async (c, next) => {
+      const host = (c.req.header("host") ?? "").toLowerCase();
+      if (!this.hosts.has(host)) return c.json({ error: "forbidden host" }, 403);
+      const origin = c.req.header("origin");
+      if (origin && !this.origins.has(origin.toLowerCase())) return c.json({ error: "forbidden origin" }, 403);
+      const m = c.req.method;
+      if (m !== "GET" && m !== "HEAD" && m !== "OPTIONS") {
+        if (!(c.req.header("content-type") ?? "").toLowerCase().startsWith("application/json")) {
+          return c.json({ error: "content-type must be application/json" }, 415);
+        }
+        if (!this.tokenOk(c.req.header(TOKEN_HEADER))) return c.json({ error: "missing or invalid token" }, 403);
+      }
+      await next();
+    };
+  }
+};
+
+// src/server/store.ts
+import { mkdirSync as mkdirSync5 } from "node:fs";
+import path10 from "node:path";
+import { DatabaseSync } from "node:sqlite";
+var SCHEMA = `
+PRAGMA journal_mode = WAL;
+CREATE TABLE IF NOT EXISTS repos (
+  id TEXT PRIMARY KEY,
+  path TEXT NOT NULL UNIQUE,
+  name TEXT NOT NULL,
+  config_json TEXT NOT NULL,
+  added_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS environments (
+  name TEXT PRIMARY KEY,
+  env_json TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS settings (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS runs (
+  id TEXT PRIMARY KEY,
+  repo_id TEXT NOT NULL,
+  workflow TEXT NOT NULL,
+  event TEXT NOT NULL,
+  job TEXT,
+  status TEXT NOT NULL,
+  exit_code INTEGER,
+  dry_run INTEGER NOT NULL DEFAULT 0,
+  act_version TEXT,
+  request_json TEXT NOT NULL,
+  queued_at TEXT NOT NULL,
+  started_at TEXT,
+  finished_at TEXT,
+  note TEXT
+);
+CREATE INDEX IF NOT EXISTS runs_repo_queued ON runs (repo_id, queued_at DESC);
+`;
+function toRun(r) {
+  return {
+    id: r.id,
+    repoId: r.repo_id,
+    workflow: r.workflow,
+    event: r.event,
+    job: r.job ?? void 0,
+    status: r.status,
+    exitCode: r.exit_code ?? void 0,
+    dryRun: r.dry_run === 1,
+    actVersion: r.act_version ?? void 0,
+    queuedAt: r.queued_at,
+    startedAt: r.started_at ?? void 0,
+    finishedAt: r.finished_at ?? void 0,
+    note: r.note ?? void 0,
+    request: JSON.parse(r.request_json)
+  };
+}
+function toRepo(r) {
+  return { id: r.id, path: r.path, name: r.name, config: JSON.parse(r.config_json), addedAt: r.added_at };
+}
+function toEnvironment(r) {
+  return { name: r.name, env: JSON.parse(r.env_json), createdAt: r.created_at };
+}
+var Store = class {
+  db;
+  constructor(file) {
+    if (file !== ":memory:") mkdirSync5(path10.dirname(file), { recursive: true });
+    this.db = new DatabaseSync(file);
+    this.db.exec(SCHEMA);
+  }
+  close() {
+    this.db.close();
+  }
+  // --- settings ------------------------------------------------------------
+  getSetting(key) {
+    const r = this.db.prepare("SELECT value FROM settings WHERE key = ?").get(key);
+    return r?.value;
+  }
+  setSetting(key, value) {
+    this.db.prepare("INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, value);
+  }
+  // --- repos ---------------------------------------------------------------
+  listRepos() {
+    return this.db.prepare("SELECT * FROM repos ORDER BY name COLLATE NOCASE").all().map(toRepo);
+  }
+  getRepo(id) {
+    const r = this.db.prepare("SELECT * FROM repos WHERE id = ?").get(id);
+    return r && toRepo(r);
+  }
+  getRepoByPath(p) {
+    const r = this.db.prepare("SELECT * FROM repos WHERE path = ?").get(p);
+    return r && toRepo(r);
+  }
+  insertRepo(repo) {
+    this.db.prepare("INSERT INTO repos (id, path, name, config_json, added_at) VALUES (?, ?, ?, ?, ?)").run(repo.id, repo.path, repo.name, JSON.stringify(repo.config), repo.addedAt);
+  }
+  updateRepo(id, fields) {
+    if (fields.name !== void 0) this.db.prepare("UPDATE repos SET name = ? WHERE id = ?").run(fields.name, id);
+    if (fields.config) this.db.prepare("UPDATE repos SET config_json = ? WHERE id = ?").run(JSON.stringify(fields.config), id);
+  }
+  deleteRepo(id) {
+    this.db.prepare("DELETE FROM repos WHERE id = ?").run(id);
+  }
+  // --- environments --------------------------------------------------------
+  listEnvironments() {
+    return this.db.prepare("SELECT * FROM environments ORDER BY name").all().map(toEnvironment);
+  }
+  getEnvironment(name) {
+    const r = this.db.prepare("SELECT * FROM environments WHERE name = ?").get(name);
+    return r && toEnvironment(r);
+  }
+  insertEnvironment(e) {
+    this.db.prepare("INSERT INTO environments (name, env_json, created_at) VALUES (?, ?, ?)").run(e.name, JSON.stringify(e.env), e.createdAt);
+  }
+  updateEnvironment(name, env) {
+    this.db.prepare("UPDATE environments SET env_json = ? WHERE name = ?").run(JSON.stringify(env), name);
+  }
+  deleteEnvironment(name) {
+    this.db.prepare("DELETE FROM environments WHERE name = ?").run(name);
+  }
+  // --- runs ----------------------------------------------------------------
+  insertRun(r) {
+    this.db.prepare(
+      `INSERT INTO runs (id, repo_id, workflow, event, job, status, exit_code, dry_run, act_version,
+                           request_json, queued_at, started_at, finished_at, note)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(
+      r.id,
+      r.repoId,
+      r.workflow,
+      r.event,
+      r.job ?? null,
+      r.status,
+      r.exitCode ?? null,
+      r.dryRun ? 1 : 0,
+      r.actVersion ?? null,
+      JSON.stringify(r.request),
+      r.queuedAt,
+      r.startedAt ?? null,
+      r.finishedAt ?? null,
+      r.note ?? null
+    );
+  }
+  updateRun(r) {
+    this.db.prepare(
+      `UPDATE runs SET status = ?, exit_code = ?, act_version = ?, started_at = ?, finished_at = ?, note = ?
+         WHERE id = ?`
+    ).run(r.status, r.exitCode ?? null, r.actVersion ?? null, r.startedAt ?? null, r.finishedAt ?? null, r.note ?? null, r.id);
+  }
+  getRun(id) {
+    const r = this.db.prepare("SELECT * FROM runs WHERE id = ?").get(id);
+    return r && toRun(r);
+  }
+  listRuns(repoId, limit) {
+    const rows = repoId ? this.db.prepare("SELECT * FROM runs WHERE repo_id = ? ORDER BY queued_at DESC LIMIT ?").all(repoId, limit) : this.db.prepare("SELECT * FROM runs ORDER BY queued_at DESC LIMIT ?").all(limit);
+    return rows.map(toRun);
+  }
+  deleteRun(id) {
+    this.db.prepare("DELETE FROM runs WHERE id = ?").run(id);
+  }
+  runIdsForRepo(repoId) {
+    return this.db.prepare("SELECT id FROM runs WHERE repo_id = ?").all(repoId).map((r) => r.id);
+  }
+  /** Finished runs only. Optional `workflow` is a file name (already validated by the caller). */
+  finishedRunIds(repoId, workflow) {
+    const rows = workflow ? this.db.prepare(`SELECT id FROM runs WHERE repo_id = ? AND workflow = ? AND status NOT IN ('queued','running')`).all(repoId, workflow) : this.db.prepare(`SELECT id FROM runs WHERE repo_id = ? AND status NOT IN ('queued','running')`).all(repoId);
+    return rows.map((r) => r.id);
+  }
+  /** Finished runs beyond the newest `keep` for a repo. Returned so callers can delete their logs. */
+  runsToPrune(repoId, keep) {
+    const rows = this.db.prepare(
+      `SELECT id FROM runs WHERE repo_id = ? AND status NOT IN ('queued','running')
+         ORDER BY queued_at DESC LIMIT -1 OFFSET ?`
+    ).all(repoId, keep);
+    return rows.map((r) => r.id);
+  }
+  /** After a crash or kill, nothing is really running any more. */
+  failInterruptedRuns(now) {
+    const res = this.db.prepare(
+      `UPDATE runs SET status = 'error', finished_at = ?, note = 'The viewer stopped while this run was in progress.'
+         WHERE status IN ('queued','running')`
+    ).run(now);
+    return Number(res.changes);
+  }
+};
+
+// src/server/index.ts
+var DEFAULT_PORT = 4780;
+var DEV_WEB_PORT = 5173;
+var here = path11.dirname(fileURLToPath(import.meta.url));
+var staticDir = path11.resolve(here, "../../dist/web");
+function listen(app, security, port2, strict) {
+  return new Promise((resolve, reject) => {
+    const attempt = (p, left) => {
+      security.allowPort(p);
+      const server = serve({ fetch: app.fetch, port: p, hostname: "127.0.0.1" });
+      server.once("listening", () => resolve({ server, port: p }));
+      server.once("error", (err) => {
+        if (err.code === "EADDRINUSE" && !strict && left > 0) attempt(p + 1, left - 1);
+        else reject(err);
+      });
+    };
+    attempt(port2, 20);
+  });
+}
+async function main() {
+  const cfg = loadConfig();
+  mkdirSync6(cfg.dataDir, { recursive: true, mode: 448 });
+  const store = new Store(path11.join(cfg.dataDir, "db.sqlite"));
+  const secrets = new SecretStore(cfg.dataDir);
+  const repos = new RepoService(store, secrets);
+  const environments = new EnvironmentService(store, secrets);
+  const runs = new RunManager({ cfg, store, repos, secrets, environments, getWorkflow: loadWorkflow });
+  runs.recover();
+  const security = new Security();
+  const dev = process.env.GHA_VIEW_DEV === "1";
+  if (dev) security.allowPort(DEV_WEB_PORT);
+  const app = createApp({ cfg, security, store, repos, environments, secrets, runs, staticDir: !dev && existsSync4(staticDir) ? staticDir : void 0 });
+  const requested = process.env.GHA_VIEW_PORT ? Number(process.env.GHA_VIEW_PORT) : DEFAULT_PORT;
+  const { server, port: port2 } = await listen(app, security, requested, Boolean(process.env.GHA_VIEW_PORT) || dev);
+  const url = `http://localhost:${port2}`;
+  console.log(`github-action-view ${cfg.version} listening on ${url}`);
+  console.log(`data: ${cfg.dataDir}`);
+  if (!dev && !existsSync4(staticDir)) console.log("UI not built yet: run `npm run build` (or use `npm run dev`).");
+  if (!dev && process.stdout.isTTY && process.platform === "darwin" && existsSync4(staticDir) && !process.env.GHA_VIEW_NO_OPEN) {
+    execFile3("open", [url], () => {
+    });
+  }
+  let stopping = false;
+  const stop = async () => {
+    if (stopping) return;
+    stopping = true;
+    console.log("\nstopping: cancelling running workflows...");
+    await runs.shutdown();
+    server.close();
+    store.close();
+    process.exit(0);
+  };
+  process.on("SIGINT", stop);
+  process.on("SIGTERM", stop);
+}
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});