@jabezpauls/agentbox 0.1.10 → 0.1.11

package/dist/agentbox.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// agentbox-cli v0.1.10
+// agentbox-cli v0.1.11
 import { createRequire as __agentboxCreateRequire } from "node:module";
 const require = __agentboxCreateRequire(import.meta.url);
 var __create = Object.create;
@@ -2272,12 +2272,12 @@ var require_extension = __commonJS({
 var require_websocket = __commonJS({
   "../node_modules/ws/lib/websocket.js"(exports, module) {
     "use strict";
-    var EventEmitter4 = __require("events");
+    var EventEmitter5 = __require("events");
     var https2 = __require("https");
     var http4 = __require("http");
-    var net5 = __require("net");
+    var net6 = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes10, createHash: createHash5 } = __require("crypto");
+    var { randomBytes: randomBytes13, createHash: createHash6 } = __require("crypto");
     var { Duplex: Duplex3, Readable: Readable2 } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2304,7 +2304,7 @@ var require_websocket = __commonJS({
     var protocolVersions = [8, 13];
     var readyStates = ["CONNECTING", "OPEN", "CLOSING", "CLOSED"];
     var subprotocolRegex = /^[!#$%&'*+\-.0-9A-Z^_`|a-z~]+$/;
-    var WebSocket2 = class _WebSocket extends EventEmitter4 {
+    var WebSocket2 = class _WebSocket extends EventEmitter5 {
       /**
        * Create a new `WebSocket`.
        *
@@ -2815,7 +2815,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes10(16).toString("base64");
+      const key = randomBytes13(16).toString("base64");
       const request2 = isSecure ? https2.request : http4.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -2945,7 +2945,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket2, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash5("sha1").update(key + GUID).digest("base64");
+        const digest = createHash6("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket2, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3019,12 +3019,12 @@ var require_websocket = __commonJS({
     }
     function netConnect(options) {
       options.path = options.socketPath;
-      return net5.connect(options);
+      return net6.connect(options);
     }
     function tlsConnect(options) {
       options.path = void 0;
       if (!options.servername && options.servername !== "") {
-        options.servername = net5.isIP(options.host) ? "" : options.host;
+        options.servername = net6.isIP(options.host) ? "" : options.host;
       }
       return tls.connect(options);
     }
@@ -3311,10 +3311,10 @@ var require_subprotocol = __commonJS({
 var require_websocket_server = __commonJS({
   "../node_modules/ws/lib/websocket-server.js"(exports, module) {
     "use strict";
-    var EventEmitter4 = __require("events");
+    var EventEmitter5 = __require("events");
     var http4 = __require("http");
     var { Duplex: Duplex3 } = __require("stream");
-    var { createHash: createHash5 } = __require("crypto");
+    var { createHash: createHash6 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -3324,7 +3324,7 @@ var require_websocket_server = __commonJS({
     var RUNNING = 0;
     var CLOSING = 1;
     var CLOSED = 2;
-    var WebSocketServer2 = class extends EventEmitter4 {
+    var WebSocketServer2 = class extends EventEmitter5 {
       /**
        * Create a `WebSocketServer` instance.
        *
@@ -3621,7 +3621,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket2, 503);
-        const digest = createHash5("sha1").update(key + GUID).digest("base64");
+        const digest = createHash6("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -3860,15 +3860,15 @@ function int(options, name, min, max) {
   if (!Number.isInteger(n) || n < min || n > max) throw new UsageError(`--${name} must be a whole number from ${min} to ${max}`);
   return n;
 }
-function parseSize(raw) {
-  const m = /^(\d+(?:\.\d+)?)\s*([kmg]?)(i?b)?$/i.exec(raw.trim());
-  if (!m) throw new UsageError(`"${raw}" is not a size (e.g. 8M, 512K)`);
+function parseSize(raw2) {
+  const m = /^(\d+(?:\.\d+)?)\s*([kmg]?)(i?b)?$/i.exec(raw2.trim());
+  if (!m) throw new UsageError(`"${raw2}" is not a size (e.g. 8M, 512K)`);
   const unit = { "": 1, k: 1024, m: 1024 ** 2, g: 1024 ** 3 }[(m[2] ?? "").toLowerCase()];
   return Math.floor(Number(m[1]) * unit);
 }
 
 // src/version.ts
-var VERSION = true ? "v0.1.10" : "0.0.0-dev";
+var VERSION = true ? "v0.1.11" : "0.0.0-dev";
 var STANDALONE = typeof __AGENTBOX_STANDALONE__ === "boolean" && __AGENTBOX_STANDALONE__;
 var MIN_NODE_MAJOR = 20;
 function nodeMajor(version = process.versions.node) {
@@ -4345,12 +4345,12 @@ function openTunnel(client, target, opts = {}) {
     ws.once("error", (err) => fail(new CliError(`could not open a tunnel to ${client.origin}: ${err.message}`, EXIT.UNREACHABLE)));
   });
 }
-function parseForwardSpec(raw) {
-  const m = /^(\d{1,5})(?::(\d{1,5}))?$/.exec(raw);
+function parseForwardSpec(raw2) {
+  const m = /^(\d{1,5})(?::(\d{1,5}))?$/.exec(raw2);
   const remote = Number(m?.[1]);
   const local = m?.[2] !== void 0 ? Number(m[2]) : remote;
   if (!m || remote < 1 || remote > 65535 || local < 1 || local > 65535) {
-    throw new UsageError(`"${raw}" is not a port to forward: give <port> or <remote port>:<local port>`);
+    throw new UsageError(`"${raw2}" is not a port to forward: give <port> or <remote port>:<local port>`);
   }
   return { remote, local };
 }
@@ -4442,10 +4442,10 @@ var forward = command({
 var FORWARD_COMMANDS = [forward];
 
 // src/commands/apps.ts
-function parseExpiry(raw) {
-  if (raw === "never") return null;
-  const m = /^(\d+)([smhdw])$/.exec(raw.trim());
-  if (!m) throw new UsageError(`"${raw}" is not an expiry: give e.g. 30m, 12h, 7d, 2w or never`);
+function parseExpiry(raw2) {
+  if (raw2 === "never") return null;
+  const m = /^(\d+)([smhdw])$/.exec(raw2.trim());
+  if (!m) throw new UsageError(`"${raw2}" is not an expiry: give e.g. 30m, 12h, 7d, 2w or never`);
   const unit = { s: 1, m: 60, h: 3600, d: 86400, w: 604800 }[m[2]];
   return Number(m[1]) * unit;
 }
@@ -4690,15 +4690,15 @@ function checkBoxName(name) {
   }
   return name;
 }
-function normalizeBoxUrl(raw) {
-  let s = raw.trim();
+function normalizeBoxUrl(raw2) {
+  let s = raw2.trim();
   if (s === "") throw new UsageError("give the box's address, e.g. https://work.example.com");
   if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(s)) s = `https://${s}`;
   let url;
   try {
     url = new URL(s);
   } catch {
-    throw new UsageError(`"${raw}" is not a URL`);
+    throw new UsageError(`"${raw2}" is not a URL`);
   }
   if (url.protocol !== "https:" && url.protocol !== "http:") {
     throw new UsageError(`a box is reached over https (or http on your own machine), not ${url.protocol}`);
@@ -4734,9 +4734,9 @@ var ConfigStore = class {
   lockTimeoutMs;
   /** The configuration as it is on disk now; empty when there is none yet. */
   load() {
-    let raw;
+    let raw2;
     try {
-      raw = fs2.readFileSync(this.file, "utf8");
+      raw2 = fs2.readFileSync(this.file, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return emptyConfig();
       throw new CliError(`cannot read ${this.file}: ${err.message}`);
@@ -4744,7 +4744,7 @@ var ConfigStore = class {
     this.tighten();
     let data;
     try {
-      data = JSON.parse(raw);
+      data = JSON.parse(raw2);
     } catch {
       throw new CliError(`${this.file} is not valid JSON; fix it or remove it and sign in again`);
     }
@@ -4991,9 +4991,9 @@ import os3 from "node:os";
 import path5 from "node:path";
 
 // ../shared/src/index.ts
-function encodePathParam(path22) {
+function encodePathParam(path33) {
   let out = "";
-  for (const ch of path22) {
+  for (const ch of path33) {
     const cp = ch.codePointAt(0) ?? 0;
     out += cp >= 56448 && cp <= 56575 ? `%${(cp - 56320).toString(16).toUpperCase()}` : encodeURIComponent(ch);
   }
@@ -5605,11 +5605,11 @@ var sshSetup = command({
 `);
   }
 });
-function parseTarget(raw) {
-  if (raw === "herdr") return { kind: "herdr" };
-  const m = /^tcp:(\d{1,5})$/.exec(raw);
+function parseTarget(raw2) {
+  if (raw2 === "herdr") return { kind: "herdr" };
+  const m = /^tcp:(\d{1,5})$/.exec(raw2);
   const port = Number(m?.[1]);
-  if (!m || port < 1 || port > 65535) throw new UsageError(`"${raw}" is not a tunnel target: give tcp:<port> or herdr`);
+  if (!m || port < 1 || port > 65535) throw new UsageError(`"${raw2}" is not a tunnel target: give tcp:<port> or herdr`);
   return { kind: "tcp", port };
 }
 var proxy = command({
@@ -6573,13 +6573,13 @@ var CMD_SAFE = /^[A-Za-z0-9 _.:\\()~-]+$/;
 function editorCommand(editor, file, platform, env = process.env) {
   if (platform !== "win32") return { command: "/bin/sh", args: ["-c", `trap : INT QUIT; ${editor} "$@"`, "sh", file], shell: false };
   const [first = "notepad", ...rest] = splitCommand(editor);
-  const resolved = /[\\/]/.test(first) ? first : findOnPath(first, env, "win32") ?? first;
-  if (!/\.(cmd|bat)$/i.test(resolved)) return { command: resolved, args: [...rest, file], shell: false };
+  const resolved2 = /[\\/]/.test(first) ? first : findOnPath(first, env, "win32") ?? first;
+  if (!/\.(cmd|bat)$/i.test(resolved2)) return { command: resolved2, args: [...rest, file], shell: false };
   if (!CMD_SAFE.test(file)) {
     throw new CliError(`the temporary file's path (${file}) has characters cmd.exe would act on; set TEMP to a plain folder, or use an editor that is an .exe`);
   }
   const quote2 = (w) => `"${w.replace(/"/g, "")}"`;
-  return { command: [resolved, ...rest, file].map(quote2).join(" "), args: [], shell: true };
+  return { command: [resolved2, ...rest, file].map(quote2).join(" "), args: [], shell: true };
 }
 function runEditor(editor, file, platform = process.platform, env = process.env) {
   return new Promise((resolve, reject) => {
@@ -6807,10 +6807,10 @@ var add = command({
 var HERDR_COMMANDS = [add, call, socket];
 
 // src/commands/node.ts
-import { spawn as spawn7 } from "node:child_process";
-import fs20 from "node:fs";
+import { spawn as spawn9 } from "node:child_process";
+import fs22 from "node:fs";
 import os11 from "node:os";
-import path18 from "node:path";
+import path29 from "node:path";
 
 // src/node/control.ts
 import { randomBytes as randomBytes4, timingSafeEqual } from "node:crypto";
@@ -6870,7 +6870,7 @@ function writePrivate2(file, contents, mode = 384) {
 }
 
 // src/node/control.ts
-var COMMANDS = /* @__PURE__ */ new Set(["status", "pause", "resume", "leave"]);
+var COMMANDS = /* @__PURE__ */ new Set(["status", "pause", "resume", "leave", "preview", "preview-list", "preview-stop"]);
 async function startControl(socketPath, secretFile, handle) {
   const secret = randomBytes4(32).toString("base64url");
   writePrivate2(secretFile, secret);
@@ -6898,7 +6898,8 @@ async function startControl(socketPath, secretFile, handle) {
       const got = Buffer.from(typeof req.secret === "string" ? req.secret : "");
       if (got.length !== want.length || !timingSafeEqual(got, want)) return reply({ ok: false, error: "refused" });
       if (typeof req.command !== "string" || !COMMANDS.has(req.command)) return reply({ ok: false, error: "unknown command" });
-      handle(req.command).then(
+      const args = typeof req.args === "object" && req.args !== null && !Array.isArray(req.args) ? req.args : {};
+      handle(req.command, args).then(
         (out) => reply({ ok: true, ...out }),
         (err) => reply({ ok: false, error: err.message })
       );
@@ -6919,7 +6920,7 @@ async function startControl(socketPath, secretFile, handle) {
     }
   };
 }
-function callControl(socketPath, secretFile, command2, timeoutMs = 1e4) {
+function callControl(socketPath, secretFile, command2, timeoutMs = 1e4, args = {}) {
   let secret;
   try {
     secret = fs9.readFileSync(secretFile, "utf8").trim();
@@ -6933,7 +6934,7 @@ function callControl(socketPath, secretFile, command2, timeoutMs = 1e4) {
       sock.destroy();
       resolve(null);
     }, timeoutMs);
-    sock.on("connect", () => sock.write(`${JSON.stringify({ secret, command: command2 })}
+    sock.on("connect", () => sock.write(`${JSON.stringify({ secret, command: command2, args })}
 `));
     sock.on("data", (c) => buf += c.toString("utf8"));
     sock.on("end", () => {
@@ -7044,7 +7045,9 @@ function decodeOpen(payload) {
   } catch {
   }
   const id = (s) => typeof s === "string" && /^[A-Za-z0-9_-]{1,128}$/.test(s) ? s : null;
-  return { kind: v.kind === "upgrade" ? "upgrade" : "http", session: id(v.session), grant: id(v.grant) };
+  const out = { kind: v.kind === "upgrade" ? "upgrade" : "http", session: id(v.session), grant: id(v.grant) };
+  if (typeof v.app === "number" && Number.isInteger(v.app) && v.app >= 1 && v.app <= 65535) out.app = v.app;
+  return out;
 }
 function windowPayload(n) {
   const b = Buffer.allocUnsafe(4);
@@ -7243,16 +7246,16 @@ var StreamTable = class {
 
 // src/node/credentials.ts
 function readCredentials(file) {
-  let raw;
+  let raw2;
   try {
-    raw = fs10.readFileSync(file, "utf8");
+    raw2 = fs10.readFileSync(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
   }
   let c;
   try {
-    c = JSON.parse(raw);
+    c = JSON.parse(raw2);
   } catch {
     throw new CliError(`${file} is not valid JSON; this machine cannot link until it is fixed or re-joined`);
   }
@@ -7272,7 +7275,7 @@ import fs12 from "node:fs";
 import path11 from "node:path";
 
 // ../../images/machine/agents.md
-var agents_default = "# You are working on {{machine}}, through agentbox\n\n{{machine}} is one of the owner's own computers, joined to their agentbox. You\nrun here as the owner, with their files, their tools and their network. The\nowner watches your terminal from their browser, on agentbox's machines page.\n\n- **To show the owner an app** you started (a dev server, say), tell them the\n  port it listens on; they open it themselves.\n- **Never make anything public.** Do not use tunnels (ngrok, cloudflared,\n  localtunnel), external hosting, claude.ai Artifacts or similar to show a web\n  app unless the owner explicitly asks for that.\n- **Docker and ports are this machine's own.** Containers you start and ports\n  you listen on are on {{machine}}, not in an agentbox sandbox; clean up what\n  you start.\n";
+var agents_default = "# You are working on {{machine}}, through agentbox\n\n{{machine}} is one of the owner's own computers, joined to their agentbox. You\nrun here as the owner, with their files, their tools and their network. The\nowner watches your terminal from their browser, on agentbox's machines page.\n\n- **To show the owner an app** you started (a dev server, say), run\n  `agentbox-preview <port>` once it listens (on 127.0.0.1 or [::1]): it appears\n  in the owner's Preview on the machines page. `agentbox-preview list` and\n  `agentbox-preview stop <port>` manage them.\n- **Never make anything public.** Do not use tunnels (ngrok, cloudflared,\n  localtunnel), external hosting, claude.ai Artifacts or similar to show a web\n  app unless the owner explicitly asks for that.\n- **Docker and ports are this machine's own.** Containers you start and ports\n  you listen on are on {{machine}}, not in an agentbox sandbox; clean up what\n  you start.\n";
 
 // src/node/update.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
@@ -7353,16 +7356,16 @@ function asset(v, where, versioned) {
   return entry;
 }
 function parseManifest(bytes) {
-  let raw;
+  let raw2;
   try {
-    raw = JSON.parse(bytes.toString("utf8"));
+    raw2 = JSON.parse(bytes.toString("utf8"));
   } catch {
     throw new UpdateRefused("the release manifest is not JSON");
   }
-  if (!raw || typeof raw !== "object" || raw.schema !== 1) throw new UpdateRefused("the release manifest is of a kind this node does not know; update it by hand");
-  if (typeof raw.version !== "string" || !parseVersion(raw.version)) throw new UpdateRefused("the release manifest has no version");
+  if (!raw2 || typeof raw2 !== "object" || raw2.schema !== 1) throw new UpdateRefused("the release manifest is of a kind this node does not know; update it by hand");
+  if (typeof raw2.version !== "string" || !parseVersion(raw2.version)) throw new UpdateRefused("the release manifest has no version");
   const platforms = {};
-  const given = raw.platforms ?? {};
+  const given = raw2.platforms ?? {};
   for (const p of MACHINE_PLATFORMS) {
     const e = given[p];
     if (!e) continue;
@@ -7374,7 +7377,7 @@ function parseManifest(bytes) {
     if (e.nodeGui !== void 0) entry.nodeGui = asset(e.nodeGui, `${p} windowless node`, false);
     platforms[p] = entry;
   }
-  return { schema: 1, version: raw.version, platforms };
+  return { schema: 1, version: raw2.version, platforms };
 }
 
 // src/node/update.ts
@@ -7684,14 +7687,14 @@ function expand(p, home2) {
   return p;
 }
 function parsePolicy(text, home2) {
-  let raw;
+  let raw2;
   try {
-    raw = JSON.parse(text);
+    raw2 = JSON.parse(text);
   } catch {
     return broken("policy.json is not valid JSON");
   }
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return broken("policy.json is not an object");
-  const o = raw;
+  if (typeof raw2 !== "object" || raw2 === null || Array.isArray(raw2)) return broken("policy.json is not an object");
+  const o = raw2;
   for (const k of Object.keys(o)) if (!KEYS.has(k)) return broken(`policy.json has "${k}", which this node does not know`);
   const policy = { ...DENY_ALL, files: [] };
   for (const k of ["terminals", "ports", "share", "paused"]) {
@@ -7962,7 +7965,13 @@ var NodeLink = class extends EventEmitter {
     return this.paused;
   }
   sendPolicy(policy) {
-    if (this.stateNow === "online" && this.ws?.readyState === import_websocket.default.OPEN) this.ws.send(encodeControl({ type: "policy", policy }));
+    this.sendControl({ type: "policy", policy });
+  }
+  /** Say `message` to the box while online; false when not online. */
+  sendControl(message) {
+    if (this.stateNow !== "online" || this.ws?.readyState !== import_websocket.default.OPEN) return false;
+    this.ws.send(encodeControl(message));
+    return true;
   }
   /** Tell the box this machine is leaving; resolves whether it was told. */
   leave(timeoutMs = 5e3) {
@@ -8340,8 +8349,8 @@ var Prompter = class {
 };
 
 // src/node/run.ts
-import fs19 from "node:fs";
-import path17 from "node:path";
+import fs21 from "node:fs";
+import path28 from "node:path";
 
 // ../hostcore/src/herdr/socket.ts
 import net4 from "node:net";
@@ -8993,9 +9002,9 @@ function control(a, msg, size) {
       break;
   }
 }
-function parse(raw) {
+function parse(raw2) {
   try {
-    return JSON.parse(raw.toString());
+    return JSON.parse(raw2.toString());
   } catch {
     return null;
   }
@@ -9015,8 +9024,8 @@ function single(socket2, streams, pane, cols, rows) {
     }
   };
   const attachment = streams.attach(pane, viewer, cols, rows);
-  socket2.on("message", (raw) => {
-    const msg = parse(raw);
+  socket2.on("message", (raw2) => {
+    const msg = parse(raw2);
     if (msg) control(attachment, msg, { cols, rows });
   });
   socket2.on("close", () => attachment.detach());
@@ -9047,8 +9056,8 @@ function shared(socket2, streams) {
     const attachment = streams.attach(pane, viewer, size.cols, size.rows);
     if (live) channels.set(ch, { attachment, size });
   };
-  socket2.on("message", (raw) => {
-    const msg = parse(raw);
+  socket2.on("message", (raw2) => {
+    const msg = parse(raw2);
     if (!msg) return;
     const ch = Number(msg.ch);
     if (!Number.isInteger(ch) || ch < 0 || ch > 65535) return;
@@ -9299,218 +9308,2370 @@ var HerdrSupervisor = class extends EventEmitter2 {
 
 // src/node/server.ts
 import http from "node:http";
-var MAX_BODY = 64 * 1024;
-function json(res, status3, body) {
-  const text = JSON.stringify(body);
-  res.writeHead(status3, { "content-type": "application/json", "content-length": Buffer.byteLength(text), "cache-control": "no-store" });
-  res.end(text);
+
+// ../hostcore/src/files/entries.ts
+import fsp2 from "node:fs/promises";
+import path16 from "node:path";
+
+// ../hostcore/src/files/names.ts
+var strict = new TextDecoder("utf-8", { fatal: true });
+function decodeName(bytes) {
+  try {
+    return strict.decode(bytes);
+  } catch {
+    return decodeLossless(bytes);
+  }
 }
-function readJson(req) {
-  return new Promise((resolve) => {
-    const chunks = [];
-    let size = 0;
-    req.on("data", (c) => {
-      size += c.length;
-      if (size > MAX_BODY) {
-        resolve(null);
-        req.destroy();
-        return;
-      }
-      chunks.push(c);
-    });
-    req.on("end", () => {
-      try {
-        const v = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
-        resolve(typeof v === "object" && v !== null && !Array.isArray(v) ? v : null);
-      } catch {
-        resolve(null);
-      }
-    });
-    req.on("error", () => resolve(null));
-  });
+function decodeLossless(b) {
+  let out = "";
+  let i = 0;
+  while (i < b.length) {
+    const c = b[i];
+    if (c < 128) {
+      out += String.fromCharCode(c);
+      i += 1;
+      continue;
+    }
+    const len = sequenceLength(b, i);
+    if (len === 0) {
+      out += String.fromCharCode(56320 + c);
+      i += 1;
+      continue;
+    }
+    out += strict.decode(b.subarray(i, i + len));
+    i += len;
+  }
+  return out;
 }
-function refuseSocket(socket2, status3, body) {
-  const text = JSON.stringify(body);
-  socket2.end(
-    `HTTP/1.1 ${status3} ${http.STATUS_CODES[status3] ?? ""}\r
-Connection: close\r
-Content-Type: application/json\r
-Content-Length: ${Buffer.byteLength(text)}\r
-\r
-${text}`
-  );
+function sequenceLength(b, i) {
+  const c = b[i];
+  const cont = (k, lo = 128, hi = 191) => {
+    const v = b[i + k];
+    return v !== void 0 && v >= lo && v <= hi;
+  };
+  if (c >= 194 && c <= 223) return cont(1) ? 2 : 0;
+  if (c === 224) return cont(1, 160) && cont(2) ? 3 : 0;
+  if (c >= 225 && c <= 236 || c === 238 || c === 239) return cont(1) && cont(2) ? 3 : 0;
+  if (c === 237) return cont(1, 128, 159) && cont(2) ? 3 : 0;
+  if (c === 240) return cont(1, 144) && cont(2) && cont(3) ? 4 : 0;
+  if (c >= 241 && c <= 243) return cont(1) && cont(2) && cont(3) ? 4 : 0;
+  if (c === 244) return cont(1, 128, 143) && cont(2) && cont(3) ? 4 : 0;
+  return 0;
+}
+function hasEscapes(s) {
+  return new RegExp("\\p{Cs}", "u").test(s);
+}
+var NameError = class extends Error {
+};
+function encodeName(s) {
+  if (!hasEscapes(s)) return Buffer.from(s, "utf8");
+  const parts = [];
+  let run4 = "";
+  for (const ch of s) {
+    const cp = ch.codePointAt(0);
+    if (cp >= 56448 && cp <= 56575) {
+      if (run4) parts.push(Buffer.from(run4, "utf8"));
+      run4 = "";
+      parts.push(Buffer.from([cp - 56320]));
+    } else if (cp >= 55296 && cp <= 57343) {
+      throw new NameError("path contains an unpaired surrogate");
+    } else {
+      run4 += ch;
+    }
+  }
+  if (run4) parts.push(Buffer.from(run4, "utf8"));
+  return Buffer.concat(parts);
 }
-var NodeServer = class {
-  constructor(o) {
-    this.o = o;
-    this.server = http.createServer({ requestTimeout: 0, headersTimeout: 3e4, keepAliveTimeout: 6e4 }, (req, res) => {
-      void this.handle(req, res).catch((err) => {
-        o.log?.(`server: ${err.message}`);
-        if (!res.headersSent) json(res, 500, { error: "internal" });
-        else res.destroy();
-      });
-    });
-    this.server.on("upgrade", (req, socket2, head) => this.upgrade(req, socket2, head));
-    this.server.on("clientError", (_err, socket2) => socket2.destroy());
+function fsPath(s) {
+  return hasEscapes(s) ? encodeName(s) : s;
+}
+function parseQuery(rawUrl) {
+  const out = /* @__PURE__ */ new Map();
+  const q = rawUrl.indexOf("?");
+  if (q === -1) return out;
+  for (const pair of rawUrl.slice(q + 1).split("&")) {
+    if (pair === "") continue;
+    const eq = pair.indexOf("=");
+    const key = decodeComponent(eq === -1 ? pair : pair.slice(0, eq));
+    const value = eq === -1 ? "" : decodeComponent(pair.slice(eq + 1));
+    const list = out.get(key);
+    if (list) list.push(value);
+    else out.set(key, [value]);
   }
-  o;
-  server;
-  wss = new import_websocket_server.default({ noServer: true, maxPayload: 1024 * 1024 });
-  opens = /* @__PURE__ */ new WeakMap();
-  channels = /* @__PURE__ */ new Set();
-  /** A stream from the link: a connection to this server. */
-  accept(stream, open3) {
-    this.opens.set(stream, open3);
-    this.server.emit("connection", stream);
+  return out;
+}
+function decodeComponent(s, plusIsSpace = true) {
+  const bytes = [];
+  for (let i = 0; i < s.length; i++) {
+    const ch = s.charCodeAt(i);
+    if (ch === 37 && /^[0-9a-fA-F]{2}$/.test(s.slice(i + 1, i + 3))) {
+      bytes.push(parseInt(s.slice(i + 1, i + 3), 16));
+      i += 2;
+    } else if (ch === 43 && plusIsSpace) {
+      bytes.push(32);
+    } else if (ch < 128) {
+      bytes.push(ch);
+    } else {
+      const cp = s.codePointAt(i);
+      for (const b of Buffer.from(String.fromCodePoint(cp), "utf8")) bytes.push(b);
+      if (cp > 65535) i += 1;
+    }
   }
-  openOf(req) {
-    return this.opens.get(req.socket) ?? { kind: "http", session: null, grant: null };
+  return decodeName(Uint8Array.from(bytes));
+}
+
+// ../hostcore/src/files/roots.ts
+import fsp from "node:fs/promises";
+import path15 from "node:path";
+var FilesError = class extends Error {
+  constructor(status3, message, code2) {
+    super(message);
+    this.status = status3;
+    this.code = code2;
+    this.name = "FilesError";
   }
-  /** Why `need` is not allowed for this stream now, or `null`. */
-  refusal(need, open3) {
-    const l = this.o.policy();
-    if (need === "terminals" && !l.policy.terminals) {
-      return {
-        status: 403,
-        body: { error: "terminals_off", message: l.problem ? `this machine's policy denies everything: ${l.problem}` : "terminals are off in this machine's policy.json" }
-      };
-    }
-    if (!this.o.presence.check(open3.grant, open3.session)) {
-      return { status: 401, body: { error: "presence", message: "this machine wants proof that you are there: the machines passphrase" } };
+  status;
+  code;
+};
+var MAX_PATH = 4096;
+var RESERVED = ["trash", "uploads", "clones"];
+function within2(child, parent) {
+  if (child === parent) return true;
+  const base = parent.endsWith(path15.sep) ? parent : parent + path15.sep;
+  return child.startsWith(base);
+}
+var Roots = class {
+  /** Where a relative path hangs: the first root configured. */
+  primary;
+  home;
+  roots;
+  all;
+  realCache = /* @__PURE__ */ new Map();
+  caseInsensitive;
+  isHidden;
+  isWriteDenied;
+  refusePath;
+  constructor(opts) {
+    this.roots = opts.roots.map((r) => ({ id: r.id, path: path15.resolve(r.path), mode: r.mode, stateDir: path15.resolve(r.stateDir) }));
+    const first = this.roots[0];
+    if (!first) throw new Error("at least one root is required");
+    this.primary = first;
+    this.home = this.roots.find((r) => r.id === "home");
+    this.all = [...this.roots].sort((a, b) => b.path.length - a.path.length);
+    this.caseInsensitive = opts.caseInsensitive ?? false;
+    this.isHidden = opts.isHidden;
+    this.isWriteDenied = opts.isWriteDenied;
+    this.refusePath = opts.refusePath;
+  }
+  byId(id) {
+    const root = this.roots.find((r) => r.id === id);
+    if (!root) throw new FilesError(404, `no root named ${id}`, "not-found");
+    return root;
+  }
+  list() {
+    return [...this.roots];
+  }
+  /** {@link within}, ignoring case when the roots were configured to. */
+  inside(child, parent) {
+    return this.caseInsensitive ? within2(child.toLowerCase(), parent.toLowerCase()) : within2(child, parent);
+  }
+  /** True when a resolved path is hidden by the configured predicate. */
+  hidden(realPath) {
+    return this.isHidden?.(realPath) ?? false;
+  }
+  /** A resolved path that is hidden reads as one that does not exist. */
+  assertVisible(realPath, where) {
+    if (this.hidden(realPath)) throw new FilesError(404, `${where} does not exist`, "not-found");
+  }
+  /** Refuse a change under a read-only root, or to a path the predicate denies. */
+  assertWritable(root, realPath, where) {
+    if (root.mode === "read") throw new FilesError(403, `${root.path} is read-only`, "read-only");
+    if (this.isWriteDenied?.(realPath)) throw new FilesError(403, `permission denied: ${where}`, "denied");
+  }
+  /** The root's own real path, resolved once. */
+  async realRoot(root) {
+    const cached = this.realCache.get(root.path);
+    if (cached) return cached;
+    let real;
+    try {
+      real = await fsp.realpath(root.path);
+    } catch {
+      throw new FilesError(404, `${root.path} does not exist`);
+    }
+    this.realCache.set(root.path, real);
+    return real;
+  }
+  /** The state directory of a root, e.g. `/workspace/.agentbox`. */
+  stateDir(root) {
+    return root.stateDir;
+  }
+  /** The state directory's name when it sits directly in its root, e.g. `.agentbox`. */
+  stateName(root) {
+    return path15.dirname(root.stateDir) === root.path ? path15.basename(root.stateDir) : null;
+  }
+  /** The state directory as resolved on disk, or null when it cannot be. */
+  async realStateDir(root) {
+    if (within2(root.stateDir, root.path)) {
+      const real = await this.realRoot(root).catch(() => null);
+      return real === null ? null : path15.join(real, path15.relative(root.path, root.stateDir));
+    }
+    return fsp.realpath(root.stateDir).catch(() => null);
+  }
+  /** Place a client path lexically. Throws for anything outside every root. */
+  locate(input) {
+    if (typeof input !== "string") throw new FilesError(400, "path required");
+    if (input.length > MAX_PATH) throw new FilesError(400, "path too long");
+    if (input.includes("\0")) throw new FilesError(400, "path contains a NUL byte");
+    const refused = this.refusePath?.(input) ?? null;
+    if (refused !== null) throw new FilesError(400, refused, "refused");
+    if (hasEscapes(input)) {
+      try {
+        encodeName(input);
+      } catch (err) {
+        if (err instanceof NameError) throw new FilesError(400, err.message);
+        throw err;
+      }
+    }
+    let abs;
+    if (input === "~" || input.startsWith("~/")) {
+      if (!this.home) throw new FilesError(403, `${input} is outside every root`, "outside");
+      abs = path15.resolve(this.home.path, "." + input.slice(1));
+    } else abs = path15.resolve(this.primary.path, input === "" ? "." : input);
+    const root = this.all.find((r) => this.inside(abs, r.path));
+    if (!root) throw new FilesError(403, `${input} is outside ${this.outsideWhat()}`, "outside");
+    return { root, abs };
+  }
+  /** What a path outside every root is said to be outside of. */
+  outsideWhat() {
+    const ids = this.roots.map((r) => r.id);
+    if (ids.length === 2 && ids[0] === "workspace" && ids[1] === "home") return "the workspace and home";
+    return "every root";
+  }
+  /** True when `abs` is the root itself or inside its reserved state dirs. */
+  isReserved(loc) {
+    if (loc.abs === loc.root.path) return true;
+    const state = this.stateDir(loc.root);
+    if (this.inside(loc.abs, state) && this.inside(state, loc.abs)) return true;
+    return RESERVED.some((d) => this.inside(loc.abs, path15.join(state, d)));
+  }
+  /**
+   * Refuse to change the root itself or the API's own state, anything under a
+   * read-only root, and a path the write-denied predicate names (checked on
+   * the resolved path when the reference carries one).
+   */
+  assertMutable(loc) {
+    if (loc.abs === loc.root.path) throw new FilesError(403, "the root itself cannot be changed", "reserved");
+    if (this.isReserved(loc)) {
+      throw new FilesError(403, `${loc.abs} holds agentbox's own state`, "reserved");
     }
-    return null;
+    this.assertWritable(loc.root, "fs" in loc ? loc.fs : loc.abs, loc.abs);
   }
-  /** Close every channel the policy or presence no longer allows. Returns how many. */
-  enforce() {
-    let n = 0;
-    for (const ch of [...this.channels]) {
-      if (this.refusal(ch.need, ch.open) === null) continue;
-      this.channels.delete(ch);
-      ch.close();
-      n += 1;
+  /**
+   * Refuse to copy or move anything that is, holds, or sits inside a root's
+   * `.agentbox`. Carrying the trash and upload scratch along is never what a
+   * person meant — and a copy is built inside that very scratch space, so a
+   * copy of it would copy itself until the disk filled. Checked on the path
+   * as named and as resolved, since a link can lead there.
+   */
+  async assertMovable(ref) {
+    for (const root of this.all) {
+      const lexical = this.stateDir(root);
+      const real = await this.realStateDir(root);
+      for (const [p, state] of [
+        [ref.abs, lexical],
+        [ref.fs, real]
+      ]) {
+        if (state && (this.inside(p, state) || this.inside(state, p))) {
+          throw new FilesError(403, `${ref.abs} holds agentbox's own state`, "reserved");
+        }
+      }
     }
-    return n;
   }
-  /** Track a channel for as long as `until` lasts; holds its grant from idling out. */
-  channel(need, open3, close, onEnd) {
-    const ch = { need, open: open3, close };
-    this.channels.add(ch);
-    const release = open3.grant ? this.o.presence.hold(open3.grant) : () => {
-    };
-    onEnd(() => {
-      this.channels.delete(ch);
-      release();
-    });
+  /** Resolve through every symlink; the destination must stay in the root. */
+  async target(input) {
+    const loc = this.locate(input);
+    const rootReal = await this.realRoot(loc.root);
+    let real;
+    try {
+      real = decodeName(await fsp.realpath(fsPath(loc.abs), { encoding: "buffer" }));
+    } catch (err) {
+      throw fsError(err, loc.abs);
+    }
+    if (!this.inside(real, rootReal)) {
+      throw new FilesError(403, `${loc.abs} leads outside its root`, "outside");
+    }
+    this.assertVisible(real, loc.abs);
+    return { ...loc, real };
   }
-  get openChannels() {
-    return this.channels.size;
+  /**
+   * Address an existing entry itself (a symlink, not what it points at). The
+   * parent is resolved and confined; the entry must exist.
+   */
+  async entry(input) {
+    const loc = this.locate(input);
+    if (loc.abs === loc.root.path) {
+      return { ...loc, fs: await this.realRoot(loc.root) };
+    }
+    const parent = await this.realParent(loc);
+    const fsp_ = path15.join(parent, path15.basename(loc.abs));
+    this.assertVisible(fsp_, loc.abs);
+    try {
+      await fsp.lstat(fsPath(fsp_));
+    } catch (err) {
+      throw fsError(err, loc.abs);
+    }
+    return { ...loc, fs: fsp_ };
   }
-  async handle(req, res) {
-    const url = new URL(req.url ?? "/", "http://machine");
-    const open3 = this.openOf(req);
-    const route = `${req.method} ${url.pathname}`;
-    switch (route) {
-      case "GET /api/health": {
-        const hub = this.o.hub();
-        const l = this.o.policy();
-        return json(res, 200, {
-          ok: true,
-          herdr: { connected: hub?.connected ?? false, version: hub?.version ?? null, protocol: hub?.protocol ?? null },
-          workspaceRoot: this.o.home,
-          homeRoot: this.o.home,
-          sharing: false,
-          publicUrl: null,
-          machine: { terminals: l.policy.terminals, problem: l.problem, presenceLocked: this.o.presence.locked() }
-        });
-      }
-      case "POST /presence/challenge": {
-        await readJson(req);
-        const c = this.o.presence.challenge(open3.session);
-        if (c === null) return json(res, 400, { error: "no_session", message: "no machines session" });
-        if ("locked" in c) return json(res, 429, { error: "locked", until: c.until, message: lockedMessage(c.until) });
-        return json(res, 200, c);
+  /**
+   * Address a path to create. The nearest existing ancestor is resolved and
+   * confined; missing directories in between are not created here (see
+   * {@link ensureParent}). Whether the final name exists is the caller's call.
+   */
+  async creatable(input) {
+    const loc = this.locate(input);
+    if (loc.abs === loc.root.path) throw new FilesError(409, "the root already exists", "exists");
+    const rootReal = await this.realRoot(loc.root);
+    const missing = [path15.basename(loc.abs)];
+    let dir = path15.dirname(loc.abs);
+    for (; ; ) {
+      try {
+        const real = decodeName(await fsp.realpath(fsPath(dir), { encoding: "buffer" }));
+        if (!this.inside(real, rootReal)) throw new FilesError(403, `${loc.abs} leads outside its root`, "outside");
+        const st = await fsp.stat(fsPath(real));
+        if (!st.isDirectory()) throw new FilesError(409, `${dir} is not a directory`, "not-a-directory");
+        const created = path15.join(real, ...missing.reverse());
+        this.assertVisible(created, loc.abs);
+        this.assertWritable(loc.root, created, loc.abs);
+        return { ...loc, fs: created };
+      } catch (err) {
+        if (err instanceof FilesError) throw err;
+        const code2 = err.code;
+        if (code2 !== "ENOENT" || dir === loc.root.path) throw fsError(err, dir);
+        missing.push(path15.basename(dir));
+        dir = path15.dirname(dir);
       }
-      case "POST /presence/answer": {
-        const b = await readJson(req);
-        const r = this.o.presence.answer(open3.session, typeof b?.challenge === "string" ? b.challenge : "", typeof b?.answer === "string" ? b.answer : "");
-        if (r.ok) return json(res, 200, { grant: r.grant, expiresAt: r.expiresAt });
-        if (r.error === "locked") return json(res, 429, { error: "locked", until: r.until, message: lockedMessage(r.until) });
-        if (r.error === "wrong") return json(res, 401, { error: "wrong", message: "That is not this machine's passphrase.", failures: r.failures });
-        return json(res, 400, { error: r.error, message: "That challenge has expired; try again." });
+    }
+  }
+  /**
+   * Create the missing directories between a {@link creatable} path's real
+   * ancestor and its parent. Each is created (never followed) in turn, so a
+   * link planted on the way cannot divert the write.
+   */
+  async ensureParent(ref) {
+    const parent = path15.dirname(ref.fs);
+    const rootReal = await this.realRoot(ref.root);
+    const parts = [];
+    let dir = parent;
+    for (; ; ) {
+      try {
+        const st = await fsp.lstat(fsPath(dir));
+        if (st.isDirectory()) break;
+        throw new FilesError(409, `${dir} is not a directory`, "not-a-directory");
+      } catch (err) {
+        if (err instanceof FilesError) throw err;
+        if (err.code !== "ENOENT") throw fsError(err, dir);
+        parts.push(dir);
+        dir = path15.dirname(dir);
       }
-      case "GET /api/session":
-      case "POST /api/rpc": {
-        const no = this.refusal("terminals", open3);
-        if (no) return json(res, no.status, no.body);
-        const socket2 = this.o.herdrSocket();
-        if (!socket2) return json(res, 503, { error: "herdr", message: "herdr is starting on this machine" });
-        this.channel(
-          "terminals",
-          open3,
-          () => res.destroy(),
-          (cb) => res.once("close", cb)
-        );
-        if (route === "GET /api/session") {
-          const hub = this.o.hub();
-          if (!hub) return json(res, 503, { error: "herdr", message: "herdr is starting on this machine" });
-          try {
-            return json(res, 200, await hub.snapshot());
-          } catch (err) {
-            return json(res, 502, { error: "herdr", message: err.message });
-          }
-        }
-        const b = await readJson(req);
-        const method = b?.method;
-        if (typeof method !== "string") return json(res, 400, { error: "method required" });
-        if (!isAllowed(method)) return json(res, 403, { error: "method not allowed" });
-        const params = typeof b?.params === "object" && b.params !== null ? b.params : {};
-        try {
-          return json(res, 200, { result: await request(socket2, method, params) });
-        } catch (err) {
-          if (err instanceof HerdrError) return json(res, 502, { error: { code: err.code, message: err.message } });
-          return json(res, 502, { error: { code: "unreachable", message: err.message } });
-        }
+    }
+    if (!this.inside(dir, rootReal)) throw new FilesError(403, `${ref.abs} leads outside its root`, "outside");
+    for (const d of parts.reverse()) {
+      try {
+        await fsp.mkdir(fsPath(d));
+      } catch (err) {
+        if (err.code !== "EEXIST") throw fsError(err, d);
+        const st = await fsp.lstat(fsPath(d));
+        if (!st.isDirectory()) throw new FilesError(409, `${d} is not a directory`, "not-a-directory");
       }
-      default:
-        return json(res, 404, { error: "not found" });
     }
   }
-  upgrade(req, socket2, head) {
-    socket2.on("error", () => socket2.destroy());
-    const url = new URL(req.url ?? "/", "http://machine");
-    const open3 = this.openOf(req);
-    if (url.pathname !== "/ws/terminal" && url.pathname !== "/ws/events") return refuseSocket(socket2, 404, { error: "not found" });
-    const no = this.refusal("terminals", open3);
-    if (no) return refuseSocket(socket2, no.status, no.body);
-    const streams = this.o.streams();
-    const hub = this.o.hub();
-    if (!streams || !hub) return refuseSocket(socket2, 503, { error: "herdr", message: "herdr is starting on this machine" });
-    this.wss.handleUpgrade(req, socket2, head, (ws) => {
-      this.channel(
-        "terminals",
-        open3,
-        () => ws.terminate(),
-        (cb) => ws.once("close", cb)
-      );
-      if (url.pathname === "/ws/terminal") {
-        serveTerminalSocket(ws, streams, { pane: url.searchParams.get("pane") ?? void 0, cols: url.searchParams.get("cols") ?? void 0, rows: url.searchParams.get("rows") ?? void 0 });
-        return;
-      }
-      this.events(ws, hub);
-    });
+  async realParent(loc) {
+    const rootReal = await this.realRoot(loc.root);
+    const dir = path15.dirname(loc.abs);
+    let real;
+    try {
+      real = decodeName(await fsp.realpath(fsPath(dir), { encoding: "buffer" }));
+    } catch (err) {
+      throw fsError(err, loc.abs);
+    }
+    if (!this.inside(real, rootReal)) throw new FilesError(403, `${loc.abs} leads outside its root`, "outside");
+    return real;
   }
-  /** `/ws/events`: a fresh snapshot, then every hub message as it comes. */
+  /** The lexical path a real path inside a root is reported as. */
+  present(root, rootReal, real) {
+    if (real === rootReal) return root.path;
+    return path15.join(root.path, real.slice(rootReal.length + 1));
+  }
+};
+function fsError(err, where) {
+  if (err instanceof FilesError) return err;
+  const code2 = err?.code;
+  switch (code2) {
+    case "ENOENT":
+      return new FilesError(404, `${where} does not exist`, "not-found");
+    case "EEXIST":
+    case "ENOTEMPTY":
+      return new FilesError(409, `${where} already exists`, "exists");
+    case "ENOTDIR":
+      return new FilesError(409, `a parent of ${where} is not a directory`, "not-a-directory");
+    case "EISDIR":
+      return new FilesError(409, `${where} is a directory`, "is-a-directory");
+    case "ELOOP":
+      return new FilesError(400, `${where} is a symlink loop`, "loop");
+    case "EACCES":
+    case "EPERM":
+      return new FilesError(403, `permission denied: ${where}`, "denied");
+    case "ENAMETOOLONG":
+      return new FilesError(400, `name too long: ${where}`, "too-long");
+    case "ENOSPC":
+    case "EDQUOT":
+      return new FilesError(507, "no space left on the volume", "no-space");
+    case "EINVAL":
+      return new FilesError(400, `invalid operation on ${where}`, "invalid");
+    default:
+      return err instanceof Error ? err : new Error(String(err));
+  }
+}
+
+// ../hostcore/src/files/entries.ts
+var MAX_PAGE = 5e3;
+function typeOf(st) {
+  if (st.isSymbolicLink()) return "symlink";
+  if (st.isDirectory()) return "dir";
+  if (st.isFile()) return "file";
+  return "other";
+}
+async function describe(abs, fs26, rootReal, git) {
+  let st;
+  try {
+    st = await fsp2.lstat(fsPath(fs26));
+  } catch (err) {
+    throw fsError(err, abs);
+  }
+  return describeStat(abs, fs26, st, rootReal, git);
+}
+async function describeStat(abs, fs26, st, rootReal, git) {
+  const name = abs === "/" ? "/" : path16.basename(abs);
+  const type = typeOf(st);
+  const entry = {
+    name,
+    path: abs,
+    type,
+    size: type === "dir" ? 0 : st.size,
+    mtime: Math.round(st.mtimeMs)
+  };
+  if (hasEscapes(name)) entry.rawName = true;
+  if (type === "symlink") {
+    try {
+      entry.target = decodeName(await fsp2.readlink(fsPath(fs26), { encoding: "buffer" }));
+    } catch {
+      entry.target = "";
+    }
+    entry.targetType = null;
+    try {
+      const real = decodeName(await fsp2.realpath(fsPath(fs26), { encoding: "buffer" }));
+      if (within2(real, rootReal)) {
+        const t2 = typeOf(await fsp2.stat(fsPath(real)));
+        entry.targetType = t2 === "symlink" ? null : t2;
+      }
+    } catch {
+    }
+  }
+  if (git) entry.git = git(abs, type === "dir" || entry.targetType === "dir");
+  return entry;
+}
+var collator = new Intl.Collator(void 0, { numeric: true, sensitivity: "base" });
+var ListingCache = class {
+  cache = /* @__PURE__ */ new Map();
+  held = 0;
+  ttlMs;
+  maxDirs;
+  maxNames;
+  settleMs;
+  constructor(opts = {}) {
+    this.ttlMs = opts.ttlMs ?? 5e3;
+    this.maxDirs = opts.maxDirs ?? 64;
+    this.maxNames = opts.maxNames ?? 2e5;
+    this.settleMs = opts.settleMs ?? 2e3;
+  }
+  /** What is held now: directories, and names across them. */
+  get size() {
+    return { dirs: this.cache.size, names: this.held };
+  }
+  async names(real, where) {
+    const now = Date.now();
+    this.expire(now);
+    let stamp;
+    let mtimeMs;
+    let dirents;
+    try {
+      const st = await fsp2.stat(fsPath(real), { bigint: true });
+      stamp = `${st.ino}:${st.mtimeNs}:${st.ctimeNs}`;
+      mtimeMs = Number(st.mtimeNs / 1000000n);
+      const hit = this.cache.get(real);
+      if (hit && hit.stamp === stamp) {
+        this.cache.delete(real);
+        this.cache.set(real, hit);
+        return hit.names;
+      }
+      dirents = await fsp2.readdir(fsPath(real), { withFileTypes: true, encoding: "buffer" });
+    } catch (err) {
+      throw fsError(err, where);
+    }
+    const names = dirents.map((d) => ({ name: decodeName(d.name), dir: d.isDirectory() })).sort((a, b) => a.dir === b.dir ? collator.compare(a.name, b.name) : a.dir ? -1 : 1);
+    this.forget(real);
+    const settled = now - mtimeMs >= this.settleMs;
+    if (this.ttlMs > 0 && settled && names.length <= this.maxNames) {
+      this.cache.set(real, { at: now, stamp, names });
+      this.held += names.length;
+      while (this.cache.size > this.maxDirs || this.held > this.maxNames) this.forget(this.cache.keys().next().value);
+    }
+    return names;
+  }
+  forget(real) {
+    const kept = this.cache.get(real);
+    if (!kept) return;
+    this.cache.delete(real);
+    this.held -= kept.names.length;
+  }
+  /** Drop what has outlived its time, used or not, so nothing idles in memory. */
+  expire(now) {
+    for (const [real, kept] of this.cache) if (now - kept.at >= this.ttlMs) this.forget(real);
+  }
+};
+async function listDirectory(roots, dir, opts) {
+  const rootReal = await roots.realRoot(dir.root);
+  const all = await (opts.cache ?? new ListingCache({ ttlMs: 0 })).names(dir.real, dir.abs);
+  const shown = all.filter((d) => !roots.hidden(path16.join(dir.real, d.name)));
+  const named = opts.hidden ? shown : shown.filter((d) => !d.name.startsWith("."));
+  const page = named.slice(opts.offset, opts.offset + opts.limit);
+  const entries = await mapLimit(page, 64, async (d) => {
+    const abs = path16.join(dir.abs, d.name);
+    try {
+      return await describe(abs, path16.join(dir.real, d.name), rootReal, opts.git);
+    } catch (err) {
+      if (err instanceof FilesError && err.status === 404) return null;
+      throw err;
+    }
+  });
+  const kept = entries.filter((e) => e !== null);
+  return {
+    path: dir.abs,
+    // The wire type names the box's two roots; a machine's are its own ids.
+    root: dir.root.id,
+    entries: kept,
+    total: named.length,
+    offset: opts.offset,
+    truncated: opts.offset + page.length < named.length
+  };
+}
+async function mapLimit(items, limit, fn) {
+  const out = new Array(items.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < items.length) {
+      const i = next++;
+      out[i] = await fn(items[i]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+  return out;
+}
+
+// ../hostcore/src/files/git.ts
+import { spawn as spawn7 } from "node:child_process";
+import fsp3 from "node:fs/promises";
+import path17 from "node:path";
+function runGit(args, opts) {
+  return new Promise((resolve, reject) => {
+    const child = spawn7(opts.git ?? "git", args, {
+      cwd: opts.cwd,
+      // Status must never take the index lock: an agent committing in the
+      // same repository would otherwise see "index.lock exists" at random.
+      env: { ...process.env, GIT_OPTIONAL_LOCKS: "0", LC_ALL: "C", GIT_TERMINAL_PROMPT: "0" },
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const chunks = [];
+    let size = 0;
+    const max = opts.maxBytes ?? 64 * 1024 * 1024;
+    let stderr = "";
+    const timer = setTimeout(() => child.kill("SIGKILL"), opts.timeoutMs ?? 1e4);
+    child.stdout.on("data", (c) => {
+      size += c.length;
+      if (size > max) child.kill("SIGKILL");
+      else chunks.push(c);
+    });
+    child.stderr.on("data", (c) => {
+      if (stderr.length < 4096) stderr += c.toString();
+    });
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+    child.on("close", (code2, signal) => {
+      clearTimeout(timer);
+      if (code2 === 0) resolve(Buffer.concat(chunks));
+      else reject(new Error(`git ${args[0]} failed (${signal ?? code2}): ${stderr.trim().slice(0, 300)}`));
+    });
+  });
+}
+function parseStatus(top, out) {
+  const status3 = {
+    top,
+    branch: null,
+    detached: false,
+    upstream: null,
+    ahead: 0,
+    behind: 0,
+    files: /* @__PURE__ */ new Map(),
+    dirty: /* @__PURE__ */ new Set(),
+    changed: 0
+  };
+  const records = [];
+  let start = 0;
+  for (let i = 0; i < out.length; i++) {
+    if (out[i] === 0) {
+      records.push(out.subarray(start, i));
+      start = i + 1;
+    }
+  }
+  if (start < out.length) records.push(out.subarray(start));
+  const add2 = (p, s) => {
+    const rel = p.replace(/\/+$/, "");
+    status3.files.set(rel, s);
+    if (s === "ignored") return;
+    status3.changed += 1;
+    let dir = path17.posix.dirname(rel);
+    for (; ; ) {
+      const key = dir === "." ? "" : dir;
+      if (status3.dirty.has(key)) break;
+      status3.dirty.add(key);
+      if (key === "") break;
+      dir = path17.posix.dirname(dir);
+    }
+  };
+  for (let r = 0; r < records.length; r++) {
+    const rec = decodeName(records[r]);
+    if (rec.startsWith("# ")) {
+      const [key, ...rest] = rec.slice(2).split(" ");
+      const value = rest.join(" ");
+      if (key === "branch.head") {
+        status3.detached = value === "(detached)";
+        status3.branch = status3.detached ? null : value;
+      } else if (key === "branch.upstream") {
+        status3.upstream = value;
+      } else if (key === "branch.ab") {
+        const m = /^\+(\d+) -(\d+)$/.exec(value);
+        if (m) {
+          status3.ahead = Number(m[1]);
+          status3.behind = Number(m[2]);
+        }
+      }
+      continue;
+    }
+    const kind = rec[0];
+    if (kind === "?") add2(rec.slice(2), "untracked");
+    else if (kind === "!") add2(rec.slice(2), "ignored");
+    else if (kind === "1") add2(fieldsAfter(rec, 8), classify(rec.slice(2, 4)));
+    else if (kind === "2") {
+      add2(fieldsAfter(rec, 9), "renamed");
+      r += 1;
+    } else if (kind === "u") add2(fieldsAfter(rec, 10), "conflicted");
+  }
+  return status3;
+}
+function fieldsAfter(rec, n) {
+  let i = 0;
+  for (let k = 0; k < n; k++) {
+    i = rec.indexOf(" ", i) + 1;
+    if (i === 0) return "";
+  }
+  return rec.slice(i);
+}
+function classify(xy) {
+  if (xy.includes("D")) return "deleted";
+  if (xy.includes("A")) return "added";
+  return "modified";
+}
+var GitStatusCache = class {
+  ttlMs;
+  timeoutMs;
+  git;
+  cache = /* @__PURE__ */ new Map();
+  constructor(opts = {}) {
+    this.ttlMs = opts.ttlMs ?? 2e3;
+    this.timeoutMs = opts.timeoutMs ?? 1e4;
+    this.git = opts.git ?? "git";
+  }
+  /**
+   * The top of the repository containing `dir`, looking no higher than
+   * `stop` (a root): the nearest ancestor with a `.git` entry.
+   */
+  async repoFor(dir, stop) {
+    let d = dir;
+    for (; ; ) {
+      try {
+        await fsp3.lstat(fsPath(path17.join(d, ".git")));
+        return d;
+      } catch {
+      }
+      if (d === stop || !within2(d, stop)) return null;
+      d = path17.dirname(d);
+    }
+  }
+  /** The status of the repository at `top`, or null when git cannot say. */
+  status(top) {
+    const now = Date.now();
+    const hit = this.cache.get(top);
+    if (hit && now - hit.at < this.ttlMs) return hit.value;
+    if (hasEscapes(top)) return Promise.resolve(null);
+    const value = runGit(
+      ["status", "--porcelain=v2", "-z", "--branch", "--untracked-files=normal", "--ignored=traditional"],
+      { cwd: top, timeoutMs: this.timeoutMs, git: this.git }
+    ).then(
+      (out) => parseStatus(top, out),
+      () => null
+    );
+    this.cache.set(top, { at: now, value });
+    if (this.cache.size > 256) {
+      for (const [k, v] of this.cache) if (now - v.at >= this.ttlMs) this.cache.delete(k);
+    }
+    return value;
+  }
+  /** Seconds-since-epoch of the last commit, in milliseconds, or null. */
+  async lastCommit(top) {
+    try {
+      const out = await runGit(["log", "-1", "--format=%ct"], { cwd: top, timeoutMs: this.timeoutMs, git: this.git });
+      const n = Number(out.toString().trim());
+      return Number.isFinite(n) && n > 0 ? n * 1e3 : null;
+    } catch {
+      return null;
+    }
+  }
+  /** A per-entry lookup for listing `dir`, or undefined outside any repository. */
+  async lookupFor(dir, stop) {
+    const top = await this.repoFor(dir, stop);
+    if (!top) return void 0;
+    const st = await this.status(top);
+    if (!st) return void 0;
+    return (abs, isDir2) => statusOf(st, path17.relative(top, abs).split(path17.sep).join("/"), isDir2);
+  }
+};
+function statusOf(st, rel, isDir2) {
+  if (rel === ".git" || rel.startsWith(".git/")) return null;
+  const own = st.files.get(rel);
+  if (own) return own;
+  if (isDir2 && st.dirty.has(rel)) return "modified";
+  let dir = path17.posix.dirname(rel);
+  while (dir !== "." && dir !== "") {
+    const s = st.files.get(dir);
+    if (s === "untracked" || s === "ignored") return s;
+    dir = path17.posix.dirname(dir);
+  }
+  return null;
+}
+
+// ../hostcore/src/files/ops.ts
+import fsp5 from "node:fs/promises";
+import path19 from "node:path";
+
+// ../hostcore/src/files/tree.ts
+import { randomBytes as randomBytes8 } from "node:crypto";
+import { constants } from "node:fs";
+import fsp4 from "node:fs/promises";
+import path18 from "node:path";
+async function copyTree(src, dst) {
+  const st = await fsp4.lstat(fsPath(src));
+  if (st.isSymbolicLink()) {
+    const link = await fsp4.readlink(fsPath(src), { encoding: "buffer" });
+    await fsp4.symlink(link, fsPath(dst));
+  } else if (st.isDirectory()) {
+    await fsp4.mkdir(fsPath(dst), { mode: st.mode & 4095 });
+    const names = await fsp4.readdir(fsPath(src), { encoding: "buffer" });
+    for (const raw2 of names) {
+      const name = decodeName(raw2);
+      await copyTree(path18.join(src, name), path18.join(dst, name));
+    }
+  } else if (st.isFile()) {
+    await fsp4.copyFile(fsPath(src), fsPath(dst), constants.COPYFILE_EXCL);
+  }
+}
+async function removeTree(p) {
+  await fsp4.rm(fsPath(p), { recursive: true, force: true });
+}
+function scratchName(dir, label) {
+  return path18.join(dir, `.${label}-${randomBytes8(8).toString("hex")}`);
+}
+async function moveTree(src, dst, scratchDir) {
+  try {
+    await fsp4.rename(fsPath(src), fsPath(dst));
+    return;
+  } catch (err) {
+    if (err.code !== "EXDEV") throw err;
+  }
+  await fsp4.mkdir(fsPath(scratchDir), { recursive: true });
+  const tmp = scratchName(scratchDir, "move");
+  try {
+    await copyTree(src, tmp);
+    await noClobberRename(tmp, dst);
+  } catch (err) {
+    await removeTree(tmp).catch(() => {
+    });
+    throw err;
+  }
+  await removeTree(src);
+}
+async function noClobberRename(src, dst) {
+  const st = await fsp4.lstat(fsPath(src));
+  if (st.isFile()) {
+    try {
+      await fsp4.link(fsPath(src), fsPath(dst));
+      await fsp4.unlink(fsPath(src));
+      return;
+    } catch (err) {
+      const code2 = err.code;
+      if (code2 !== "EPERM" && code2 !== "ENOTSUP" && code2 !== "EOPNOTSUPP" && code2 !== "EXDEV") throw err;
+    }
+  }
+  try {
+    await fsp4.lstat(fsPath(dst));
+    const err = new Error(`${dst} exists`);
+    err.code = "EEXIST";
+    throw err;
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  await fsp4.rename(fsPath(src), fsPath(dst));
+}
+
+// ../hostcore/src/files/ops.ts
+var MAX_WRITE2 = 1024 * 1024;
+var FileOps = class {
+  constructor(roots, trash) {
+    this.roots = roots;
+    this.trash = trash;
+  }
+  roots;
+  trash;
+  scratch(ref) {
+    return path19.join(this.roots.stateDir(ref.root), "uploads");
+  }
+  async realRoot(ref) {
+    return this.roots.realRoot(ref.root);
+  }
+  /** Write a small text file: new by default, replaced with `overwrite`. */
+  async write(body) {
+    if (typeof body.content !== "string") throw new FilesError(400, "content must be text");
+    const data = Buffer.from(body.content, "utf8");
+    if (data.length > MAX_WRITE2) throw new FilesError(413, `write takes at most ${MAX_WRITE2} bytes; upload larger files`);
+    const dest = await this.roots.creatable(body.path);
+    this.roots.assertMutable(dest);
+    await this.roots.ensureParent(dest);
+    if (body.overwrite === true) {
+      const existing = await fsp5.lstat(fsPath(dest.fs)).catch(() => null);
+      if (existing?.isDirectory()) throw new FilesError(409, `${dest.abs} is a directory`, "is-a-directory");
+      const dir = this.scratch(dest);
+      await fsp5.mkdir(dir, { recursive: true });
+      const tmp = scratchName(dir, "write");
+      await fsp5.writeFile(tmp, data);
+      if (existing?.isFile()) await fsp5.chmod(tmp, existing.mode & 4095);
+      try {
+        await fsp5.rename(tmp, fsPath(dest.fs));
+      } catch (err) {
+        await fsp5.rm(tmp, { force: true });
+        throw fsError(err, dest.abs);
+      }
+    } else {
+      try {
+        await fsp5.writeFile(fsPath(dest.fs), data, { flag: "wx" });
+      } catch (err) {
+        throw fsError(err, dest.abs);
+      }
+    }
+    return describe(dest.abs, dest.fs, await this.realRoot(dest));
+  }
+  /** Make a directory and any missing parents. An existing directory is fine. */
+  async mkdir(body) {
+    const dest = await this.roots.creatable(body.path);
+    this.roots.assertMutable(dest);
+    await this.roots.ensureParent(dest);
+    try {
+      await fsp5.mkdir(fsPath(dest.fs));
+    } catch (err) {
+      if (err.code !== "EEXIST") throw fsError(err, dest.abs);
+      const st = await fsp5.lstat(fsPath(dest.fs));
+      if (!st.isDirectory()) throw new FilesError(409, `${dest.abs} exists and is not a directory`, "exists");
+    }
+    return describe(dest.abs, dest.fs, await this.realRoot(dest));
+  }
+  /** Rename or move `from` to `to` — the entry itself, not what a link points at. */
+  async move(body) {
+    const src = await this.roots.entry(body.from);
+    this.roots.assertMutable(src);
+    await this.roots.assertMovable(src);
+    const dest = await this.roots.creatable(body.to);
+    this.roots.assertMutable(dest);
+    if (dest.abs === src.abs) return describe(src.abs, src.fs, await this.roots.realRoot(src.root));
+    await this.refuseIntoItself(src.fs, dest.fs, src.abs);
+    await this.clear(dest, body.overwrite === true);
+    await this.roots.ensureParent(dest);
+    try {
+      if (src.root.id === dest.root.id) await noClobberRename(src.fs, dest.fs);
+      else await moveTree(src.fs, dest.fs, this.scratch(dest));
+    } catch (err) {
+      throw fsError(err, dest.abs);
+    }
+    return describe(dest.abs, dest.fs, await this.realRoot(dest));
+  }
+  /**
+   * Copy `from` to `to`. A directory is copied whole, symlinks as symlinks.
+   * The copy is built under a scratch name and renamed into place, so the
+   * destination never shows a half-finished tree.
+   */
+  async copy(body) {
+    const src = await this.roots.entry(body.from);
+    await this.roots.assertMovable(src);
+    const dest = await this.roots.creatable(body.to);
+    this.roots.assertMutable(dest);
+    if (dest.abs === src.abs) throw new FilesError(409, "a copy needs a different name", "exists");
+    await this.refuseIntoItself(src.fs, dest.fs, src.abs);
+    await this.clear(dest, body.overwrite === true);
+    await this.roots.ensureParent(dest);
+    const dir = this.scratch(dest);
+    await fsp5.mkdir(dir, { recursive: true });
+    const tmp = scratchName(dir, "copy");
+    try {
+      await copyTree(src.fs, tmp);
+      await noClobberRename(tmp, dest.fs);
+    } catch (err) {
+      await removeTree(tmp).catch(() => {
+      });
+      throw fsError(err, dest.abs);
+    }
+    return describe(dest.abs, dest.fs, await this.realRoot(dest));
+  }
+  /** A directory cannot be moved or copied into its own subtree. */
+  async refuseIntoItself(srcFs, destFs, abs) {
+    const st = await fsp5.lstat(fsPath(srcFs));
+    if (st.isDirectory() && within2(destFs, srcFs)) {
+      throw new FilesError(400, `${abs} cannot go inside itself`, "into-itself");
+    }
+  }
+  /** Make way at `dest`: refuse, or with `overwrite` move what is there to the trash. */
+  async clear(dest, overwrite) {
+    const st = await fsp5.lstat(fsPath(dest.fs)).catch(() => null);
+    if (!st) return;
+    if (!overwrite) throw new FilesError(409, `${dest.abs} already exists`, "exists");
+    await this.trash.put(dest.root, dest.abs, dest.fs);
+  }
+};
+
+// ../hostcore/src/files/trash.ts
+import { randomBytes as randomBytes9 } from "node:crypto";
+import fsp6 from "node:fs/promises";
+import path20 from "node:path";
+var TRASH_ID = /^[0-9a-f]{24}$/;
+var Trash = class {
+  constructor(roots) {
+    this.roots = roots;
+  }
+  roots;
+  dir(root) {
+    return path20.join(this.roots.stateDir(root), "trash");
+  }
+  async trash(paths2) {
+    if (!Array.isArray(paths2) || paths2.length === 0) throw new FilesError(400, "paths required");
+    const result = { trashed: [], missing: [] };
+    for (const p of paths2) {
+      const loc = this.roots.locate(p);
+      this.roots.assertMutable(loc);
+      let ref;
+      try {
+        ref = await this.roots.entry(p);
+      } catch (err) {
+        if (err instanceof FilesError && err.status === 404) {
+          result.missing.push(loc.abs);
+          continue;
+        }
+        throw err;
+      }
+      result.trashed.push(await this.put(ref.root, ref.abs, ref.fs));
+    }
+    return result;
+  }
+  /** Move the entry at real path `fs` (reported as `abs`) into `root`'s trash. */
+  async put(root, abs, fs26) {
+    const st = await fsp6.lstat(fsPath(fs26)).catch((err) => {
+      throw fsError(err, abs);
+    });
+    const id = randomBytes9(12).toString("hex");
+    const home2 = path20.join(this.dir(root), id);
+    const type = typeOf(st);
+    const meta = {
+      v: 1,
+      id,
+      name: path20.basename(abs),
+      originalPath: abs,
+      root: root.id,
+      type,
+      size: type === "file" ? st.size : null,
+      trashedAt: Date.now()
+    };
+    await fsp6.mkdir(home2, { recursive: true });
+    await writeJson(path20.join(home2, "meta.json"), meta);
+    try {
+      await moveTree(fs26, path20.join(home2, "item"), home2);
+    } catch (err) {
+      await removeTree(home2).catch(() => {
+      });
+      throw fsError(err, abs);
+    }
+    return view(meta);
+  }
+  /** Everything in every root's trash, most recent first. */
+  async list() {
+    const items = [];
+    for (const root of this.roots.list()) {
+      let ids;
+      try {
+        ids = await fsp6.readdir(this.dir(root));
+      } catch {
+        continue;
+      }
+      for (const id of ids) {
+        if (!TRASH_ID.test(id)) continue;
+        const meta = await this.read(root, id);
+        if (meta) items.push(view(meta));
+      }
+    }
+    return items.sort((a, b) => b.trashedAt - a.trashedAt);
+  }
+  async read(root, id) {
+    try {
+      const parsed = JSON.parse(await fsp6.readFile(path20.join(this.dir(root), id, "meta.json"), "utf8"));
+      return parsed && parsed.id === id ? parsed : null;
+    } catch {
+      return null;
+    }
+  }
+  async find(id) {
+    if (!TRASH_ID.test(id)) throw new FilesError(400, "invalid trash id");
+    for (const root of this.roots.list()) {
+      const meta = await this.read(root, id);
+      if (meta) return { root, meta };
+    }
+    throw new FilesError(404, "no such item in the trash", "not-found");
+  }
+  /**
+   * Put an item back where it came from, or at `to`. The destination must not
+   * exist; missing parent directories are recreated.
+   */
+  async restore(id, to) {
+    const { root, meta } = await this.find(id);
+    const home2 = path20.join(this.dir(root), id);
+    const dest = await this.roots.creatable(to === void 0 ? meta.originalPath : to);
+    this.roots.assertMutable(dest);
+    try {
+      await fsp6.lstat(fsPath(path20.join(home2, "item")));
+    } catch {
+      await removeTree(home2);
+      throw new FilesError(410, "the trashed item is gone", "gone");
+    }
+    await this.roots.ensureParent(dest);
+    try {
+      await fsp6.lstat(fsPath(dest.fs));
+      throw new FilesError(409, `${dest.abs} already exists`, "exists");
+    } catch (err) {
+      if (err instanceof FilesError) throw err;
+    }
+    try {
+      if (dest.root.id === root.id) await noClobberRename(path20.join(home2, "item"), dest.fs);
+      else await moveTree(path20.join(home2, "item"), dest.fs, path20.join(this.roots.stateDir(dest.root), "uploads"));
+    } catch (err) {
+      throw fsError(err, dest.abs);
+    }
+    await removeTree(home2);
+    return describe(dest.abs, dest.fs, await this.roots.realRoot(dest.root));
+  }
+  /** Delete an item for good. */
+  async remove(id) {
+    const { root } = await this.find(id);
+    await removeTree(path20.join(this.dir(root), id));
+  }
+  /**
+   * Delete for good what was trashed before `before` (ms), and entries whose
+   * metadata cannot be read; returns how many went. The box keeps its trash
+   * until it is emptied; a machine's node sweeps its own after 7 days.
+   */
+  async expire(before) {
+    let n = 0;
+    for (const root of this.roots.list()) {
+      let ids;
+      try {
+        ids = await fsp6.readdir(this.dir(root));
+      } catch {
+        continue;
+      }
+      for (const id of ids) {
+        if (!TRASH_ID.test(id)) continue;
+        const meta = await this.read(root, id);
+        if (meta && meta.trashedAt >= before) continue;
+        if (!meta) {
+          const st = await fsp6.stat(path20.join(this.dir(root), id)).catch(() => null);
+          if (st && st.mtimeMs >= before) continue;
+        }
+        await removeTree(path20.join(this.dir(root), id)).catch(() => {
+        });
+        n += 1;
+      }
+    }
+    return n;
+  }
+  /** Delete everything in the trash for good; returns how many items went. */
+  async empty() {
+    const items = await this.list();
+    for (const item of items) await this.remove(item.id).catch(() => {
+    });
+    return items.length;
+  }
+};
+function view(meta) {
+  return {
+    id: meta.id,
+    name: meta.name,
+    originalPath: meta.originalPath,
+    root: meta.root,
+    type: meta.type,
+    size: meta.size,
+    trashedAt: meta.trashedAt
+  };
+}
+async function writeJson(file, value) {
+  const tmp = `${file}.${randomBytes9(4).toString("hex")}.tmp`;
+  await fsp6.writeFile(tmp, JSON.stringify(value));
+  await fsp6.rename(tmp, file);
+}
+
+// ../hostcore/src/files/uploads.ts
+import { randomBytes as randomBytes10 } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import fsp7 from "node:fs/promises";
+import path21 from "node:path";
+import { Transform as Transform2 } from "node:stream";
+import { pipeline } from "node:stream/promises";
+var MAX_CHUNK2 = 50 * 1024 * 1024;
+var UPLOAD_TTL_MS = 24 * 60 * 60 * 1e3;
+var UPLOAD_ID = /^[0-9a-f]{32}$/;
+var Uploads = class {
+  constructor(roots, trash, opts = {}) {
+    this.roots = roots;
+    this.trash = trash;
+    this.opts = opts;
+  }
+  roots;
+  trash;
+  opts;
+  queues = /* @__PURE__ */ new Map();
+  dir(root) {
+    return path21.join(this.roots.stateDir(root), "uploads");
+  }
+  /** Run `work` after any earlier work on the same upload has settled. */
+  serial(id, work) {
+    const prev = this.queues.get(id) ?? Promise.resolve();
+    const next = prev.then(work, work);
+    const tail = next.then(
+      () => {
+      },
+      () => {
+      }
+    );
+    this.queues.set(id, tail);
+    void tail.then(() => {
+      if (this.queues.get(id) === tail) this.queues.delete(id);
+    });
+    return next;
+  }
+  async start(body) {
+    const size = body.size;
+    if (typeof size !== "number" || !Number.isSafeInteger(size) || size < 0) {
+      throw new FilesError(400, "size must be a byte count");
+    }
+    const overwrite = body.overwrite === true;
+    const dest = await this.roots.creatable(body.path);
+    this.roots.assertMutable(dest);
+    await this.checkDestination(dest.fs, dest.abs, overwrite);
+    const root = dest.root;
+    const dir = this.dir(root);
+    await fsp7.mkdir(dir, { recursive: true });
+    const fsStat = await fsp7.statfs(dir);
+    if (size > fsStat.bavail * fsStat.bsize) {
+      throw new FilesError(507, "not enough space left on the volume for this upload", "no-space");
+    }
+    const id = randomBytes10(16).toString("hex");
+    const now = Date.now();
+    const rec = {
+      v: 1,
+      id,
+      root: root.id,
+      path: dest.abs,
+      size,
+      received: 0,
+      overwrite,
+      created: now,
+      updated: now,
+      done: false
+    };
+    await fsp7.writeFile(path21.join(dir, `${id}.part`), "");
+    await this.save(rec);
+    return view2(rec);
+  }
+  async checkDestination(fs26, abs, overwrite) {
+    try {
+      const st = await fsp7.lstat(fsPath(fs26));
+      if (st.isDirectory()) throw new FilesError(409, `${abs} is a directory`, "is-a-directory");
+      if (!overwrite) throw new FilesError(409, `${abs} already exists`, "exists");
+    } catch (err) {
+      if (err instanceof FilesError) throw err;
+      if (err.code !== "ENOENT") throw fsError(err, abs);
+    }
+  }
+  async save(rec) {
+    const file = path21.join(this.dir(this.roots.byId(rec.root)), `${rec.id}.json`);
+    const tmp = `${file}.${randomBytes10(4).toString("hex")}.tmp`;
+    await fsp7.writeFile(tmp, JSON.stringify(rec));
+    await fsp7.rename(tmp, file);
+  }
+  async load(id) {
+    if (!UPLOAD_ID.test(id)) throw new FilesError(400, "invalid upload id");
+    for (const root of this.roots.list()) {
+      try {
+        const rec = JSON.parse(await fsp7.readFile(path21.join(this.dir(root), `${id}.json`), "utf8"));
+        if (rec.id === id) return rec;
+      } catch {
+      }
+    }
+    throw new FilesError(404, "no such upload", "not-found");
+  }
+  async get(id) {
+    return view2(await this.load(id));
+  }
+  /**
+   * Write one chunk at `offset`. `length` is the declared body length when the
+   * request gave one, checked before a byte is read.
+   */
+  put(id, offset, body, length) {
+    return this.serial(id, async () => {
+      const rec = await this.load(id);
+      if (rec.done) throw new FilesError(409, "this upload has already finished", "finished");
+      const at = Number(offset);
+      if (!Number.isSafeInteger(at) || at < 0) throw new FilesError(400, "offset must be a byte offset");
+      if (at > rec.received) {
+        throw new FilesError(409, `expected a chunk at offset ${rec.received}`, `offset:${rec.received}`);
+      }
+      const max = this.opts.maxChunk ?? MAX_CHUNK2;
+      if (length !== null && length > max) throw new FilesError(413, `a chunk may be at most ${max} bytes`, "too-large");
+      if (length !== null && at + length > rec.size) {
+        throw new FilesError(400, "the chunk runs past the declared size", "past-end");
+      }
+      let written = 0;
+      const limit = new Transform2({
+        transform(chunk, _enc, cb) {
+          written += chunk.length;
+          if (written > max) cb(new FilesError(413, `a chunk may be at most ${max} bytes`, "too-large"));
+          else if (at + written > rec.size) cb(new FilesError(400, "the chunk runs past the declared size", "past-end"));
+          else cb(null, chunk);
+        }
+      });
+      const part = path21.join(this.dir(this.roots.byId(rec.root)), `${id}.part`);
+      await pipeline(body, limit, createWriteStream(part, { flags: "r+", start: at }));
+      rec.received = Math.max(rec.received, at + written);
+      rec.updated = Date.now();
+      await this.save(rec);
+      return view2(rec);
+    });
+  }
+  /** Move the finished file into place. Repeating it answers the same. */
+  finish(id) {
+    return this.serial(id, async () => {
+      const rec = await this.load(id);
+      if (rec.done && rec.entry) return rec.entry;
+      if (rec.received !== rec.size) {
+        throw new FilesError(409, `only ${rec.received} of ${rec.size} bytes have arrived`, `offset:${rec.received}`);
+      }
+      const root = this.roots.byId(rec.root);
+      const part = path21.join(this.dir(root), `${id}.part`);
+      const fh = await fsp7.open(part, "r+");
+      try {
+        await fh.truncate(rec.size);
+        await fh.sync();
+      } finally {
+        await fh.close();
+      }
+      const dest = await this.roots.creatable(rec.path);
+      this.roots.assertMutable(dest);
+      await this.checkDestination(dest.fs, dest.abs, rec.overwrite);
+      await this.roots.ensureParent(dest);
+      const existing = await fsp7.lstat(fsPath(dest.fs)).catch(() => null);
+      if (existing) {
+        if (existing.isFile()) await fsp7.chmod(part, existing.mode & 4095);
+        await this.trash.put(dest.root, dest.abs, dest.fs);
+      }
+      try {
+        await noClobberRename(part, dest.fs);
+      } catch (err) {
+        throw fsError(err, dest.abs);
+      }
+      const entry = await describe(dest.abs, dest.fs, await this.roots.realRoot(dest.root));
+      rec.done = true;
+      rec.entry = entry;
+      rec.updated = Date.now();
+      await this.save(rec);
+      return entry;
+    });
+  }
+  /** Abandon an upload and its data. */
+  cancel(id) {
+    return this.serial(id, async () => {
+      const rec = await this.load(id);
+      const dir = this.dir(this.roots.byId(rec.root));
+      await fsp7.rm(path21.join(dir, `${id}.part`), { force: true });
+      await fsp7.rm(path21.join(dir, `${id}.json`), { force: true });
+    });
+  }
+  /**
+   * Remove uploads (finished or not) untouched for longer than the TTL, plus
+   * any scratch file left behind by an interrupted copy or move.
+   */
+  async sweep(now = Date.now()) {
+    const ttl = this.opts.ttlMs ?? UPLOAD_TTL_MS;
+    let removed = 0;
+    for (const root of this.roots.list()) {
+      const dir = this.dir(root);
+      let names;
+      try {
+        names = await fsp7.readdir(dir);
+      } catch {
+        continue;
+      }
+      for (const name of names) {
+        const file = path21.join(dir, name);
+        const st = await fsp7.lstat(file).catch(() => null);
+        if (!st || now - st.mtimeMs < ttl) continue;
+        const m = /^([0-9a-f]{32})\.(json|part)$/.exec(name);
+        if (m && name.endsWith(".json")) {
+          const rec = await this.load(m[1]).catch(() => null);
+          if (rec && now - rec.updated < ttl) continue;
+        }
+        await removeTree(file).catch(() => {
+        });
+        removed += 1;
+      }
+    }
+    return removed;
+  }
+  /** Sweep now and then every hour, until the returned stop is called. */
+  startSweeping(everyMs = 60 * 60 * 1e3) {
+    void this.sweep().catch(() => {
+    });
+    const timer = setInterval(() => void this.sweep().catch(() => {
+    }), everyMs);
+    timer.unref?.();
+    return () => clearInterval(timer);
+  }
+};
+function view2(rec) {
+  return {
+    id: rec.id,
+    path: rec.path,
+    size: rec.size,
+    received: rec.received,
+    overwrite: rec.overwrite,
+    created: rec.created,
+    updated: rec.updated,
+    done: rec.done
+  };
+}
+
+// ../hostcore/src/files/service.ts
+var FilesService = class {
+  roots;
+  git;
+  trash;
+  uploads;
+  ops;
+  fd;
+  /** Sorted directory names, shared by the listing and WebDAV. */
+  listings = new ListingCache();
+  constructor(opts) {
+    this.roots = new Roots({
+      roots: opts.roots,
+      ...opts.caseInsensitive === void 0 ? {} : { caseInsensitive: opts.caseInsensitive },
+      ...opts.isHidden === void 0 ? {} : { isHidden: opts.isHidden },
+      ...opts.isWriteDenied === void 0 ? {} : { isWriteDenied: opts.isWriteDenied },
+      ...opts.refusePath === void 0 ? {} : { refusePath: opts.refusePath }
+    });
+    this.git = new GitStatusCache(opts.gitTtlMs === void 0 ? {} : { ttlMs: opts.gitTtlMs });
+    this.trash = new Trash(this.roots);
+    this.uploads = new Uploads(this.roots, this.trash, opts.maxChunk === void 0 ? {} : { maxChunk: opts.maxChunk });
+    this.ops = new FileOps(this.roots, this.trash);
+    this.fd = opts.fd;
+  }
+  /** Sweep abandoned uploads now and hourly; returns a stop. */
+  startMaintenance() {
+    return this.uploads.startSweeping();
+  }
+};
+
+// ../hostcore/src/files/http.ts
+import { createReadStream } from "node:fs";
+import fsp9 from "node:fs/promises";
+import path23 from "node:path";
+import { pipeline as pipeline2 } from "node:stream";
+
+// ../hostcore/src/files/raw.ts
+var INLINE_TYPES = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".bmp": "image/bmp",
+  ".ico": "image/x-icon",
+  ".pdf": "application/pdf"
+};
+var DOWNLOAD_TYPES = {
+  ...INLINE_TYPES,
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".svg": "image/svg+xml",
+  ".json": "application/json",
+  // Never a script or stylesheet type: with nosniff, a browser then refuses
+  // to run the file as code even if it is asked to (see loadedAsCode).
+  ".js": "text/plain",
+  ".mjs": "text/plain",
+  ".css": "text/plain",
+  ".md": "text/markdown",
+  ".txt": "text/plain",
+  ".csv": "text/csv",
+  ".xml": "application/xml",
+  ".zip": "application/zip",
+  ".gz": "application/gzip",
+  ".tar": "application/x-tar",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".woff2": "font/woff2"
+};
+function etagOf(st) {
+  return `"${st.size.toString(16)}-${Math.round(st.mtimeMs).toString(16)}"`;
+}
+function looksLikeText(head) {
+  if (head.includes(0)) return false;
+  for (let cut = 0; cut < 4 && cut <= head.length; cut++) {
+    try {
+      new TextDecoder("utf-8", { fatal: true }).decode(head.subarray(0, head.length - cut));
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function disposition(kind, name) {
+  const ascii = name.replace(/[^\x20-\x7e]|["\\%;]/g, "_") || "download";
+  const exact = [...encodeName(name)].map((b) => /[A-Za-z0-9!#$&+.^_`|~-]/.test(String.fromCharCode(b)) ? String.fromCharCode(b) : `%${b.toString(16).toUpperCase().padStart(2, "0")}`).join("");
+  return `${kind}; filename="${ascii}"; filename*=UTF-8''${exact}`;
+}
+function parseRange(header, size) {
+  if (!header) return null;
+  const m = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+  if (!m) return null;
+  const [, a, b] = m;
+  if (a === "" && b === "") return null;
+  let start;
+  let end;
+  if (a === "") {
+    const n = Number(b);
+    if (n === 0) return "bad";
+    start = Math.max(0, size - n);
+    end = size - 1;
+  } else {
+    start = Number(a);
+    end = b === "" ? size - 1 : Math.min(Number(b), size - 1);
+  }
+  if (start >= size || start > end) return "bad";
+  return { start, end };
+}
+
+// ../hostcore/src/files/search.ts
+import { spawn as spawn8 } from "node:child_process";
+import fs17 from "node:fs";
+import fsp8 from "node:fs/promises";
+import path22 from "node:path";
+var SKIP = /* @__PURE__ */ new Set([".git", "node_modules", ".agentbox"]);
+var fdCache;
+function findFd(env = process.env) {
+  if (fdCache !== void 0) return fdCache;
+  fdCache = null;
+  for (const dir of (env.PATH ?? "").split(path22.delimiter)) {
+    for (const name of ["fdfind", "fd"]) {
+      const candidate = path22.join(dir, name);
+      try {
+        fs17.accessSync(candidate, fs17.constants.X_OK);
+        fdCache = candidate;
+        return fdCache;
+      } catch {
+      }
+    }
+  }
+  return fdCache;
+}
+function score(rel, query) {
+  const q = query.toLowerCase();
+  const name = path22.basename(rel).toLowerCase();
+  let s = name === q ? 0 : name.startsWith(q) ? 1 : name.includes(q) ? 2 : 3;
+  s = s * 1e3 + rel.split("/").length * 10 + Math.min(rel.length, 9);
+  return s;
+}
+async function searchNames(opts) {
+  const query = opts.query.trim();
+  if (!query) return [];
+  const fd = opts.fd === void 0 ? findFd() : opts.fd;
+  const gather = Math.min(opts.limit * 10, 2e3);
+  const found = fd ? await runFd(fd, opts.dir, query, gather, opts.timeoutMs ?? 5e3) : await walk(opts.dir, query, gather);
+  const scored = found.filter((p) => within2(p, opts.dir) && p !== opts.dir).map((p) => ({ p, s: score(path22.relative(opts.dir, p), query) })).sort((a, b) => a.s - b.s || a.p.localeCompare(b.p));
+  return scored.slice(0, opts.limit).map((x) => x.p);
+}
+function runFd(bin, dir, query, max, timeoutMs) {
+  const args = [
+    "--fixed-strings",
+    "--ignore-case",
+    "--absolute-path",
+    "--print0",
+    "--color=never",
+    "--max-results",
+    String(max),
+    ...[...SKIP].flatMap((d) => ["--exclude", d])
+  ];
+  if (query.includes("/")) args.push("--full-path");
+  args.push("--", query, dir);
+  return new Promise((resolve) => {
+    const child = spawn8(bin, args, { stdio: ["ignore", "pipe", "ignore"] });
+    const chunks = [];
+    const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
+    child.stdout.on("data", (c) => chunks.push(c));
+    const done = () => {
+      clearTimeout(timer);
+      const out = Buffer.concat(chunks);
+      const paths2 = [];
+      let start = 0;
+      for (let i = 0; i < out.length; i++) {
+        if (out[i] === 0) {
+          paths2.push(decodeName(out.subarray(start, i)).replace(/\/+$/, ""));
+          start = i + 1;
+        }
+      }
+      resolve(paths2);
+    };
+    child.on("error", done);
+    child.on("close", done);
+  });
+}
+async function walk(dir, query, max) {
+  const q = query.toLowerCase();
+  const full = q.includes("/");
+  const out = [];
+  const queue = [dir];
+  let visited = 0;
+  while (queue.length > 0 && out.length < max && visited < 2e4) {
+    const d = queue.shift();
+    visited += 1;
+    let names;
+    try {
+      names = await fsp8.readdir(fsPath(d), { encoding: "buffer" });
+    } catch {
+      continue;
+    }
+    for (const raw2 of names) {
+      const name = decodeName(raw2);
+      if (name.startsWith(".") || SKIP.has(name)) continue;
+      const p = path22.join(d, name);
+      const hay = (full ? path22.relative(dir, p) : name).toLowerCase();
+      if (hay.includes(q)) out.push(p);
+      const st = await fsp8.lstat(fsPath(p)).catch(() => null);
+      if (st?.isDirectory()) queue.push(p);
+    }
+  }
+  return out;
+}
+
+// ../hostcore/src/files/http.ts
+var MAX_JSON = 64 * 1024;
+var MAX_WRITE_JSON = 6 * 1024 * 1024;
+function send(res, status3, body) {
+  const text = JSON.stringify(body);
+  res.writeHead(status3, { "content-type": "application/json", "content-length": Buffer.byteLength(text), "cache-control": "no-store" });
+  res.end(text);
+}
+function sendError(res, err) {
+  const e = fsError(err, "path");
+  if (!(e instanceof FilesError)) throw e;
+  send(res, e.status, e.code ? { error: e.message, code: e.code } : { error: e.message });
+}
+function readBody(req, max) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    req.on("data", (c) => {
+      size += c.length;
+      if (size > max) {
+        reject(new FilesError(413, "request body too large"));
+        req.destroy();
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on("end", () => {
+      const text = Buffer.concat(chunks).toString("utf8");
+      if (text.trim() === "") return resolve({});
+      try {
+        const v = JSON.parse(text);
+        if (typeof v === "object" && v !== null && !Array.isArray(v)) return resolve(v);
+      } catch {
+      }
+      reject(new FilesError(400, "the body must be a JSON object"));
+    });
+    req.on("error", reject);
+  });
+}
+function one(q, key) {
+  return q.get(key)?.[0];
+}
+function flag(q, key) {
+  const v = one(q, key);
+  return v !== void 0 && v !== "0" && v !== "false";
+}
+function int2(q, key, fallback, min, max) {
+  const v = Number(one(q, key));
+  return Number.isFinite(v) ? Math.min(max, Math.max(min, Math.trunc(v))) : fallback;
+}
+var CODE = /* @__PURE__ */ new Set(["script", "worker", "sharedworker", "serviceworker", "style", "audioworklet", "paintworklet", "xslt"]);
+async function isText(file, size) {
+  if (size === 0) return true;
+  const fh = await fsp9.open(fsPath(file), "r");
+  try {
+    const buf = Buffer.alloc(Math.min(8192, size));
+    const { bytesRead } = await fh.read(buf, 0, buf.length, 0);
+    return looksLikeText(buf.subarray(0, bytesRead));
+  } finally {
+    await fh.close();
+  }
+}
+async function raw(files, req, res, q) {
+  const dest = req.headers["sec-fetch-dest"];
+  if (typeof dest === "string" && CODE.has(dest.toLowerCase())) throw new FilesError(403, "a file cannot be loaded as a script or stylesheet", "not-code");
+  const ref = await files.roots.target(one(q, "path"));
+  const st = await fsp9.stat(fsPath(ref.real));
+  if (!st.isFile()) throw new FilesError(409, `${ref.abs} is not a file`, "not-a-file");
+  const name = path23.basename(ref.abs);
+  const inline = flag(q, "inline") && await isText(ref.real, st.size);
+  const headers = {
+    "content-type": inline ? "text/plain; charset=utf-8" : "application/octet-stream",
+    "content-disposition": disposition(inline ? "inline" : "attachment", name),
+    "cache-control": "private, no-cache",
+    "last-modified": st.mtime.toUTCString(),
+    etag: etagOf(st)
+  };
+  const range = parseRange(req.headers.range, st.size);
+  if (range === "bad") {
+    res.writeHead(416, { ...headers, "content-range": `bytes */${st.size}`, "content-length": "0" });
+    res.end();
+    return;
+  }
+  const start = range ? range.start : 0;
+  const end = range ? range.end : st.size - 1;
+  const length = st.size === 0 ? 0 : end - start + 1;
+  if (range) headers["content-range"] = `bytes ${start}-${end}/${st.size}`;
+  headers["content-length"] = String(length);
+  res.writeHead(range ? 206 : 200, headers);
+  if (req.method === "HEAD" || length === 0) {
+    res.end();
+    return;
+  }
+  pipeline2(createReadStream(fsPath(ref.real), { start, end }), res, () => {
+  });
+}
+async function search(files, q) {
+  const { roots } = files;
+  const dir = await roots.target(one(q, "path") ?? "");
+  const rootReal = await roots.realRoot(dir.root);
+  const found = await searchNames({
+    dir: dir.real,
+    query: one(q, "q") ?? "",
+    limit: int2(q, "limit", 50, 1, 200),
+    ...files.fd === void 0 ? {} : { fd: files.fd }
+  });
+  const out = [];
+  for (const real of found) {
+    if (!roots.inside(real, rootReal) || roots.hidden(real)) continue;
+    try {
+      out.push(await describe(roots.present(dir.root, rootReal, real), real, rootReal));
+    } catch {
+    }
+  }
+  return out;
+}
+var TRASH_ITEM = /^\/api\/files\/trash\/([0-9a-f]{24})(\/restore)?$/;
+var UPLOAD = /^\/api\/files\/uploads\/([0-9a-f]{32})(\/finish)?$/;
+async function serveFiles(files, req, res) {
+  const url = req.url ?? "/";
+  const pathname = url.split("?", 1)[0] ?? "/";
+  if (pathname !== "/api/files" && !pathname.startsWith("/api/files/")) return false;
+  const method = req.method ?? "GET";
+  const q = parseQuery(url);
+  const { roots, ops, trash, uploads } = files;
+  try {
+    const route = `${method} ${pathname}`;
+    switch (route) {
+      case "GET /api/files/list": {
+        const dir = await roots.target(one(q, "path") ?? "");
+        const st = await fsp9.stat(fsPath(dir.real));
+        if (!st.isDirectory()) throw new FilesError(409, `${dir.abs} is not a directory`, "not-a-directory");
+        send(
+          res,
+          200,
+          await listDirectory(roots, dir, {
+            hidden: flag(q, "hidden"),
+            offset: int2(q, "offset", 0, 0, Number.MAX_SAFE_INTEGER),
+            limit: int2(q, "limit", MAX_PAGE, 1, MAX_PAGE),
+            cache: files.listings
+          })
+        );
+        return true;
+      }
+      case "GET /api/files/stat": {
+        const ref = await roots.entry(one(q, "path") ?? "");
+        send(res, 200, await describe(ref.abs, ref.fs, await roots.realRoot(ref.root)));
+        return true;
+      }
+      case "GET /api/files/raw":
+      case "HEAD /api/files/raw":
+        await raw(files, req, res, q);
+        return true;
+      case "GET /api/files/zip":
+        send(res, 501, { error: "folders cannot be downloaded as a zip from a machine yet; download its files one by one", code: "unsupported" });
+        return true;
+      case "GET /api/files/search":
+        send(res, 200, await search(files, q));
+        return true;
+      case "POST /api/files/write":
+        send(res, 200, await ops.write(await readBody(req, MAX_WRITE_JSON)));
+        return true;
+      case "POST /api/files/mkdir":
+        send(res, 200, await ops.mkdir(await readBody(req, MAX_JSON)));
+        return true;
+      case "POST /api/files/move":
+        send(res, 200, await ops.move(await readBody(req, MAX_JSON)));
+        return true;
+      case "POST /api/files/copy":
+        send(res, 200, await ops.copy(await readBody(req, MAX_JSON)));
+        return true;
+      case "POST /api/files/trash":
+        send(res, 200, await trash.trash((await readBody(req, MAX_JSON)).paths));
+        return true;
+      case "GET /api/files/trash":
+        send(res, 200, await trash.list());
+        return true;
+      case "DELETE /api/files/trash":
+        send(res, 200, { removed: await trash.empty() });
+        return true;
+      case "POST /api/files/uploads": {
+        const session = await uploads.start(await readBody(req, MAX_JSON));
+        send(res, 200, { uploadId: session.id, ...session });
+        return true;
+      }
+    }
+    const t2 = TRASH_ITEM.exec(pathname);
+    if (t2) {
+      const id = t2[1];
+      if (t2[2] && method === "POST") {
+        send(res, 200, await trash.restore(id, (await readBody(req, MAX_JSON)).to));
+        return true;
+      }
+      if (!t2[2] && method === "DELETE") {
+        await trash.remove(id);
+        res.writeHead(204, { "cache-control": "no-store" });
+        res.end();
+        return true;
+      }
+    }
+    const u = UPLOAD.exec(pathname);
+    if (u) {
+      const id = u[1];
+      if (u[2] && method === "POST") {
+        send(res, 200, await uploads.finish(id));
+        return true;
+      }
+      if (!u[2]) {
+        if (method === "GET") {
+          send(res, 200, await uploads.get(id));
+          return true;
+        }
+        if (method === "DELETE") {
+          await uploads.cancel(id);
+          res.writeHead(204, { "cache-control": "no-store" });
+          res.end();
+          return true;
+        }
+        if (method === "PUT") {
+          const declared = req.headers["content-length"];
+          const length = declared === void 0 ? null : Number(declared);
+          const done = await uploads.put(id, one(q, "offset"), req, Number.isFinite(length) ? length : null);
+          if (!req.readableEnded) res.setHeader("connection", "close");
+          send(res, 200, done);
+          return true;
+        }
+      }
+    }
+    send(res, 404, { error: "not found" });
+  } catch (err) {
+    if (!req.readableEnded) res.setHeader("connection", "close");
+    if (res.headersSent) res.destroy();
+    else sendError(res, err);
+  }
+  return true;
+}
+
+// src/node/preview.ts
+import { EventEmitter as EventEmitter3 } from "node:events";
+import net5 from "node:net";
+import path25 from "node:path";
+
+// src/node/service-linux.ts
+import { execFile } from "node:child_process";
+import fs18 from "node:fs";
+import os9 from "node:os";
+import path24 from "node:path";
+var UNIT_NAME = "agentbox-node.service";
+var runCommand = (cmd, args) => new Promise((resolve) => {
+  execFile(cmd, args, { timeout: 3e4 }, (err, stdout, stderr) => {
+    const code2 = err ? typeof err.code === "number" ? err.code : 127 : 0;
+    resolve({ code: code2, stdout: String(stdout), stderr: String(stderr) });
+  });
+});
+function unitDir(env = process.env, home2 = os9.homedir()) {
+  const xdg = env.XDG_CONFIG_HOME;
+  return path24.join(xdg && path24.isAbsolute(xdg) ? xdg : path24.join(home2, ".config"), "systemd", "user");
+}
+function execStart(execPath = process.execPath, script = process.argv[1]) {
+  const isSea = script === void 0 || path24.resolve(script) === path24.resolve(execPath);
+  return isSea ? [execPath, "node", "run"] : [execPath, path24.resolve(script), "node", "run"];
+}
+function quote(arg) {
+  return `"${arg.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%")}"`;
+}
+function unitText(command2) {
+  return [
+    "[Unit]",
+    "Description=agentbox node: this machine's link to its box",
+    "After=network-online.target",
+    "Wants=network-online.target",
+    "",
+    "[Service]",
+    "Type=simple",
+    `ExecStart=${command2.map(quote).join(" ")}`,
+    "Restart=on-failure",
+    "RestartSec=5",
+    // herdr, and the agents in it, outlive a restart of the node (an
+    // update, a crash); the next node adopts it.
+    "KillMode=process",
+    "",
+    "[Install]",
+    "WantedBy=default.target",
+    ""
+  ].join("\n");
+}
+async function installService(opts) {
+  const run4 = opts.run ?? runCommand;
+  const dir = unitDir(opts.env);
+  fs18.mkdirSync(dir, { recursive: true });
+  const unitFile = path24.join(dir, UNIT_NAME);
+  fs18.writeFileSync(unitFile, unitText(opts.command), { mode: 420 });
+  for (const args of [["--user", "daemon-reload"], ["--user", "enable", UNIT_NAME], ["--user", "restart", UNIT_NAME]]) {
+    const r = await run4("systemctl", args);
+    if (r.code !== 0) {
+      throw new Error(`systemctl ${args.join(" ")} failed: ${(r.stderr || r.stdout).trim() || `exit ${r.code}`}`);
+    }
+  }
+  const user = opts.user ?? os9.userInfo().username;
+  const linger = await run4("loginctl", ["enable-linger", user]);
+  if (linger.code === 0) return { unitFile, lingering: true, note: null };
+  const cron = `@reboot ${opts.command.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ")}`;
+  return {
+    unitFile,
+    lingering: false,
+    note: `This machine does not let the node keep running after you log out (loginctl enable-linger was refused), so it runs while you are logged in. To start it at boot instead, add this line with \`crontab -e\`:
+    ${cron}`
+  };
+}
+async function removeService(opts = {}) {
+  const run4 = opts.run ?? runCommand;
+  const unitFile = path24.join(unitDir(opts.env), UNIT_NAME);
+  if (!fs18.existsSync(unitFile)) return false;
+  await run4("systemctl", ["--user", "disable", "--now", UNIT_NAME]);
+  fs18.rmSync(unitFile, { force: true });
+  await run4("systemctl", ["--user", "daemon-reload"]);
+  return true;
+}
+function serviceInstalled(env = process.env) {
+  return fs18.existsSync(path24.join(unitDir(env), UNIT_NAME));
+}
+
+// src/node/preview.ts
+var MAX_APPS = 64;
+var CLOSED_GRACE_MS = 6e4;
+var CHECK_MS2 = 5e3;
+function connectLocal(port, timeoutMs = 5e3) {
+  const attempt2 = (host) => new Promise((resolve, reject) => {
+    const s = net5.connect({ host, port });
+    const timer = setTimeout(() => s.destroy(new Error("timed out")), timeoutMs);
+    s.once("connect", () => {
+      clearTimeout(timer);
+      s.off("error", reject);
+      resolve(s);
+    });
+    s.once("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+  return attempt2("127.0.0.1").catch(() => attempt2("::1"));
+}
+async function answers(port) {
+  try {
+    const s = await connectLocal(port, 2e3);
+    s.destroy();
+    return true;
+  } catch {
+    return false;
+  }
+}
+function cleanName(raw2, port) {
+  const s = typeof raw2 === "string" ? raw2.replace(/[^\w .()+@-]/g, "").trim().slice(0, 64) : "";
+  return s || `port ${port}`;
+}
+var Previews = class extends EventEmitter3 {
+  constructor(o = {}) {
+    super();
+    this.o = o;
+  }
+  o;
+  apps = /* @__PURE__ */ new Map();
+  timer = null;
+  get now() {
+    return (this.o.now ?? Date.now)();
+  }
+  list() {
+    return [...this.apps.values()].map(({ port, name, registeredAt }) => ({ port, name, registeredAt }));
+  }
+  has(port) {
+    return this.apps.has(port);
+  }
+  /** Register `port` (it must answer now). */
+  async register(rawPort, rawName) {
+    const port = typeof rawPort === "number" ? rawPort : Number(rawPort);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) return { ok: false, error: "a port is a number from 1 to 65535" };
+    const existing = this.apps.get(port);
+    if (!existing && this.apps.size >= MAX_APPS) return { ok: false, error: `this machine has ${MAX_APPS} apps registered already; stop one first` };
+    if (!await (this.o.probe ?? answers)(port)) return { ok: false, error: `nothing answers on port ${port} (on 127.0.0.1 or [::1]); start the server first` };
+    const name = rawName === void 0 && existing ? existing.name : cleanName(rawName, port);
+    const app = { port, name, registeredAt: existing?.registeredAt ?? this.now, closedSince: null };
+    this.apps.set(port, app);
+    if (!existing || existing.name !== name) this.emit("change");
+    return { ok: true, app: { port, name, registeredAt: app.registeredAt }, existed: existing !== void 0 };
+  }
+  remove(port) {
+    const had = this.apps.delete(port);
+    if (had) this.emit("change");
+    return had;
+  }
+  clear() {
+    if (this.apps.size === 0) return;
+    this.apps.clear();
+    this.emit("change");
+  }
+  /** Probe every port; drop those closed for the grace period. */
+  async check() {
+    let changed = false;
+    for (const app of [...this.apps.values()]) {
+      const up = await (this.o.probe ?? answers)(app.port);
+      if (this.apps.get(app.port) !== app) continue;
+      if (up) app.closedSince = null;
+      else if (app.closedSince === null) app.closedSince = this.now;
+      else if (this.now - app.closedSince >= (this.o.graceMs ?? CLOSED_GRACE_MS)) {
+        this.apps.delete(app.port);
+        changed = true;
+      }
+    }
+    if (changed) this.emit("change");
+  }
+  start(everyMs = CHECK_MS2) {
+    if (this.timer) return;
+    let busy = false;
+    this.timer = setInterval(() => {
+      if (busy) return;
+      busy = true;
+      void this.check().finally(() => busy = false);
+    }, everyMs);
+    this.timer.unref();
+  }
+  stop() {
+    if (this.timer) clearInterval(this.timer);
+    this.timer = null;
+  }
+};
+function shQuote2(s) {
+  return `'${s.replace(/'/g, "'\\''")}'`;
+}
+function writePreviewShim(shims, command2 = execStart().slice(0, -2)) {
+  const file = path25.join(shims, "agentbox-preview");
+  writePrivate2(
+    file,
+    `#!/bin/sh
+# agentbox: show an app on this machine in the owner's Preview. Written by the node.
+exec ${command2.map(shQuote2).join(" ")} node preview "$@"
+`,
+    448
+  );
+  return file;
+}
+
+// src/node/server.ts
+var HOP = /* @__PURE__ */ new Set(["connection", "keep-alive", "proxy-connection", "transfer-encoding", "upgrade", "te", "trailer"]);
+var MAX_BODY = 64 * 1024;
+function json(res, status3, body) {
+  const text = JSON.stringify(body);
+  res.writeHead(status3, { "content-type": "application/json", "content-length": Buffer.byteLength(text), "cache-control": "no-store" });
+  res.end(text);
+}
+function readJson(req) {
+  return new Promise((resolve) => {
+    const chunks = [];
+    let size = 0;
+    req.on("data", (c) => {
+      size += c.length;
+      if (size > MAX_BODY) {
+        resolve(null);
+        req.destroy();
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on("end", () => {
+      try {
+        const v = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+        resolve(typeof v === "object" && v !== null && !Array.isArray(v) ? v : null);
+      } catch {
+        resolve(null);
+      }
+    });
+    req.on("error", () => resolve(null));
+  });
+}
+function refuseSocket(socket2, status3, body) {
+  const text = JSON.stringify(body);
+  socket2.end(
+    `HTTP/1.1 ${status3} ${http.STATUS_CODES[status3] ?? ""}\r
+Connection: close\r
+Content-Type: application/json\r
+Content-Length: ${Buffer.byteLength(text)}\r
+\r
+${text}`
+  );
+}
+var NodeServer = class {
+  constructor(o) {
+    this.o = o;
+    this.server = http.createServer({ requestTimeout: 0, headersTimeout: 3e4, keepAliveTimeout: 6e4 }, (req, res) => {
+      void this.handle(req, res).catch((err) => {
+        o.log?.(`server: ${err.message}`);
+        if (!res.headersSent) json(res, 500, { error: "internal" });
+        else res.destroy();
+      });
+    });
+    this.server.on("upgrade", (req, socket2, head) => this.upgrade(req, socket2, head));
+    this.server.on("clientError", (_err, socket2) => socket2.destroy());
+    this.appServer = http.createServer({ requestTimeout: 0, headersTimeout: 3e4, keepAliveTimeout: 6e4 }, (req, res) => this.app(req, res));
+    this.appServer.on("upgrade", (req, socket2, head) => this.appUpgrade(req, socket2, head));
+    this.appServer.on("clientError", (_err, socket2) => socket2.destroy());
+  }
+  o;
+  server;
+  /** Streams for an app: every request on one goes to its registered port. */
+  appServer;
+  wss = new import_websocket_server.default({ noServer: true, maxPayload: 1024 * 1024 });
+  opens = /* @__PURE__ */ new WeakMap();
+  channels = /* @__PURE__ */ new Set();
+  /** A stream from the link: a connection to this server (or, for an app, to the app's). */
+  accept(stream, open3) {
+    this.opens.set(stream, open3);
+    (open3.app === void 0 ? this.server : this.appServer).emit("connection", stream);
+  }
+  openOf(req) {
+    return this.opens.get(req.socket) ?? { kind: "http", session: null, grant: null };
+  }
+  /** Why `need` is not allowed for this stream now, or `null`. */
+  refusal(need, open3) {
+    const l = this.o.policy();
+    const denied = (error, what) => ({
+      status: 403,
+      body: { error, message: l.problem ? `this machine's policy denies everything: ${l.problem}` : what }
+    });
+    if (need === "terminals" && !l.policy.terminals) return denied("terminals_off", "terminals are off in this machine's policy.json");
+    if (need === "files" && l.policy.files.length === 0) return denied("files_off", "this machine's policy.json allows no folders");
+    if (need === "ports") {
+      if (!l.policy.ports) return denied("ports_off", "apps are off in this machine's policy.json (ports)");
+      return null;
+    }
+    if (!this.o.presence.check(open3.grant, open3.session)) {
+      return { status: 401, body: { error: "presence", message: "this machine wants proof that you are there: the machines passphrase" } };
+    }
+    return null;
+  }
+  /** Close every channel the policy or presence no longer allows. Returns how many. */
+  enforce() {
+    let n = 0;
+    for (const ch of [...this.channels]) {
+      if (this.refusal(ch.need, ch.open) === null && (ch.still?.() ?? true)) continue;
+      this.channels.delete(ch);
+      ch.close();
+      n += 1;
+    }
+    return n;
+  }
+  /** Track a channel for as long as `until` lasts; holds its grant from idling out. */
+  channel(need, open3, close, onEnd, still) {
+    const ch = still ? { need, open: open3, close, still } : { need, open: open3, close };
+    this.channels.add(ch);
+    const release = open3.grant ? this.o.presence.hold(open3.grant) : () => {
+    };
+    onEnd(() => {
+      this.channels.delete(ch);
+      release();
+    });
+  }
+  get openChannels() {
+    return this.channels.size;
+  }
+  async handle(req, res) {
+    const url = new URL(req.url ?? "/", "http://machine");
+    const open3 = this.openOf(req);
+    const route = `${req.method} ${url.pathname}`;
+    switch (route) {
+      case "GET /api/health": {
+        const hub = this.o.hub();
+        const l = this.o.policy();
+        return json(res, 200, {
+          ok: true,
+          herdr: { connected: hub?.connected ?? false, version: hub?.version ?? null, protocol: hub?.protocol ?? null },
+          workspaceRoot: this.o.home,
+          homeRoot: this.o.home,
+          sharing: false,
+          publicUrl: null,
+          machine: {
+            terminals: l.policy.terminals,
+            files: l.policy.files.map((f) => ({ path: f.path, mode: f.mode })),
+            ports: l.policy.ports,
+            problem: l.problem,
+            presenceLocked: this.o.presence.locked()
+          }
+        });
+      }
+      case "POST /presence/challenge": {
+        await readJson(req);
+        const c = this.o.presence.challenge(open3.session);
+        if (c === null) return json(res, 400, { error: "no_session", message: "no machines session" });
+        if ("locked" in c) return json(res, 429, { error: "locked", until: c.until, message: lockedMessage(c.until) });
+        return json(res, 200, c);
+      }
+      case "POST /presence/answer": {
+        const b = await readJson(req);
+        const r = this.o.presence.answer(open3.session, typeof b?.challenge === "string" ? b.challenge : "", typeof b?.answer === "string" ? b.answer : "");
+        if (r.ok) return json(res, 200, { grant: r.grant, expiresAt: r.expiresAt });
+        if (r.error === "locked") return json(res, 429, { error: "locked", until: r.until, message: lockedMessage(r.until) });
+        if (r.error === "wrong") return json(res, 401, { error: "wrong", message: "That is not this machine's passphrase.", failures: r.failures });
+        return json(res, 400, { error: r.error, message: "That challenge has expired; try again." });
+      }
+      case "GET /api/session":
+      case "POST /api/rpc": {
+        const no = this.refusal("terminals", open3);
+        if (no) return json(res, no.status, no.body);
+        const socket2 = this.o.herdrSocket();
+        if (!socket2) return json(res, 503, { error: "herdr", message: "herdr is starting on this machine" });
+        this.channel(
+          "terminals",
+          open3,
+          () => res.destroy(),
+          (cb) => res.once("close", cb)
+        );
+        if (route === "GET /api/session") {
+          const hub = this.o.hub();
+          if (!hub) return json(res, 503, { error: "herdr", message: "herdr is starting on this machine" });
+          try {
+            return json(res, 200, await hub.snapshot());
+          } catch (err) {
+            return json(res, 502, { error: "herdr", message: err.message });
+          }
+        }
+        const b = await readJson(req);
+        const method = b?.method;
+        if (typeof method !== "string") return json(res, 400, { error: "method required" });
+        if (!isAllowed(method)) return json(res, 403, { error: "method not allowed" });
+        const params = typeof b?.params === "object" && b.params !== null ? b.params : {};
+        try {
+          return json(res, 200, { result: await request(socket2, method, params) });
+        } catch (err) {
+          if (err instanceof HerdrError) return json(res, 502, { error: { code: err.code, message: err.message } });
+          return json(res, 502, { error: { code: "unreachable", message: err.message } });
+        }
+      }
+      default: {
+        if (url.pathname === "/api/files" || url.pathname.startsWith("/api/files/")) return this.files(req, res, open3);
+        return json(res, 404, { error: "not found" });
+      }
+    }
+  }
+  async files(req, res, open3) {
+    const no = this.refusal("files", open3);
+    if (no) {
+      req.resume();
+      return json(res, no.status, no.body);
+    }
+    const svc = this.o.files?.() ?? null;
+    if (!svc) return json(res, 403, { error: "files_off", message: "this machine's policy.json allows no folders" });
+    this.channel(
+      "files",
+      open3,
+      () => res.destroy(),
+      (cb) => res.once("close", cb),
+      () => this.o.files?.() === svc
+    );
+    await serveFiles(svc, req, res);
+  }
+  /** The port an app stream is for, if it may be served now; else the refusal to send. */
+  appPort(open3) {
+    const no = this.refusal("ports", open3);
+    if (no) return no;
+    const port = open3.app;
+    if (port === void 0 || !this.o.previews?.has(port)) return { status: 404, body: { error: "not_found", message: "no app is registered on that port here" } };
+    return { port };
+  }
+  /** A request for an app: passed on to its port as it came, its answer back as it comes (the gate applies the app policy). */
+  app(req, res) {
+    const open3 = this.openOf(req);
+    const p = this.appPort(open3);
+    if (!("port" in p)) {
+      req.resume();
+      return json(res, p.status, p.body);
+    }
+    const { port } = p;
+    const headers = {};
+    for (const [k, v] of Object.entries(req.headers)) if (v !== void 0 && !HOP.has(k)) headers[k] = v;
+    if (req.headers["transfer-encoding"] !== void 0 && req.headers["content-length"] === void 0) headers["transfer-encoding"] = "chunked";
+    connectLocal(port).then(
+      (sock) => {
+        if (res.destroyed) return void sock.destroy();
+        const up = http.request({ method: req.method, path: req.url ?? "/", headers, createConnection: () => sock }, (upRes) => {
+          const raw2 = [];
+          for (let i = 0; i + 1 < upRes.rawHeaders.length; i += 2) {
+            if (HOP.has(upRes.rawHeaders[i].toLowerCase())) continue;
+            raw2.push(upRes.rawHeaders[i], upRes.rawHeaders[i + 1]);
+          }
+          res.writeHead(upRes.statusCode ?? 502, upRes.statusMessage, raw2);
+          upRes.pipe(res);
+          upRes.on("error", () => res.destroy());
+        });
+        up.on("error", () => res.headersSent ? res.destroy() : json(res, 502, { error: "app", message: `the app on port ${port} did not answer` }));
+        res.once("close", () => {
+          if (!res.writableFinished) up.destroy();
+        });
+        this.channel("ports", open3, () => res.destroy(), (cb) => res.once("close", cb), () => this.o.previews?.has(port) ?? false);
+        req.pipe(up);
+      },
+      () => {
+        req.resume();
+        json(res, 502, { error: "app", message: `nothing answers on port ${port} here` });
+      }
+    );
+  }
+  /** An app's WebSocket (or any upgrade): its request head to the port, then bytes both ways. */
+  appUpgrade(req, socket2, head) {
+    socket2.on("error", () => socket2.destroy());
+    const open3 = this.openOf(req);
+    const p = this.appPort(open3);
+    if (!("port" in p)) return refuseSocket(socket2, p.status, p.body);
+    const { port } = p;
+    connectLocal(port).then(
+      (up) => {
+        if (socket2.destroyed) return void up.destroy();
+        let block = `${req.method ?? "GET"} ${req.url ?? "/"} HTTP/1.1\r
+`;
+        for (let i = 0; i + 1 < req.rawHeaders.length; i += 2) block += `${req.rawHeaders[i]}: ${req.rawHeaders[i + 1]}\r
+`;
+        up.write(`${block}\r
+`);
+        if (head.length) up.write(head);
+        const end = () => {
+          up.destroy();
+          socket2.destroy();
+        };
+        up.on("error", end);
+        up.on("close", end);
+        socket2.on("close", end);
+        this.channel("ports", open3, end, (cb) => socket2.once("close", cb), () => this.o.previews?.has(port) ?? false);
+        up.pipe(socket2);
+        socket2.pipe(up);
+      },
+      () => refuseSocket(socket2, 502, { error: "app", message: `nothing answers on port ${port} here` })
+    );
+  }
+  upgrade(req, socket2, head) {
+    socket2.on("error", () => socket2.destroy());
+    const url = new URL(req.url ?? "/", "http://machine");
+    const open3 = this.openOf(req);
+    if (url.pathname !== "/ws/terminal" && url.pathname !== "/ws/events") return refuseSocket(socket2, 404, { error: "not found" });
+    const no = this.refusal("terminals", open3);
+    if (no) return refuseSocket(socket2, no.status, no.body);
+    const streams = this.o.streams();
+    const hub = this.o.hub();
+    if (!streams || !hub) return refuseSocket(socket2, 503, { error: "herdr", message: "herdr is starting on this machine" });
+    this.wss.handleUpgrade(req, socket2, head, (ws) => {
+      this.channel(
+        "terminals",
+        open3,
+        () => ws.terminate(),
+        (cb) => ws.once("close", cb)
+      );
+      if (url.pathname === "/ws/terminal") {
+        serveTerminalSocket(ws, streams, { pane: url.searchParams.get("pane") ?? void 0, cols: url.searchParams.get("cols") ?? void 0, rows: url.searchParams.get("rows") ?? void 0 });
+        return;
+      }
+      this.events(ws, hub);
+    });
+  }
+  /** `/ws/events`: a fresh snapshot, then every hub message as it comes. */
   events(ws, hub) {
     heartbeat(ws);
     let off = null;
-    const send = (m) => {
+    const send2 = (m) => {
       if (ws.readyState === ws.OPEN) ws.send(JSON.stringify(m));
     };
     hub.snapshot().then(
       (snapshot) => {
         if (ws.readyState !== ws.OPEN) return;
-        send({ kind: "snapshot", snapshot });
-        off = hub.on(send);
+        send2({ kind: "snapshot", snapshot });
+        off = hub.on(send2);
       },
       () => ws.close()
     );
@@ -9521,6 +11682,7 @@ var NodeServer = class {
     this.channels.clear();
     this.wss.close();
     this.server.close();
+    this.appServer.close();
   }
 };
 function lockedMessage(until) {
@@ -9528,91 +11690,11 @@ function lockedMessage(until) {
   return `Too many wrong passphrases: this machine has locked presence for ${mins} more minute${mins === 1 ? "" : "s"}.`;
 }
 
-// src/node/service-linux.ts
-import { execFile } from "node:child_process";
-import fs17 from "node:fs";
-import os9 from "node:os";
-import path15 from "node:path";
-var UNIT_NAME = "agentbox-node.service";
-var runCommand = (cmd, args) => new Promise((resolve) => {
-  execFile(cmd, args, { timeout: 3e4 }, (err, stdout, stderr) => {
-    const code2 = err ? typeof err.code === "number" ? err.code : 127 : 0;
-    resolve({ code: code2, stdout: String(stdout), stderr: String(stderr) });
-  });
-});
-function unitDir(env = process.env, home2 = os9.homedir()) {
-  const xdg = env.XDG_CONFIG_HOME;
-  return path15.join(xdg && path15.isAbsolute(xdg) ? xdg : path15.join(home2, ".config"), "systemd", "user");
-}
-function execStart(execPath = process.execPath, script = process.argv[1]) {
-  const isSea = script === void 0 || path15.resolve(script) === path15.resolve(execPath);
-  return isSea ? [execPath, "node", "run"] : [execPath, path15.resolve(script), "node", "run"];
-}
-function quote(arg) {
-  return `"${arg.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%")}"`;
-}
-function unitText(command2) {
-  return [
-    "[Unit]",
-    "Description=agentbox node: this machine's link to its box",
-    "After=network-online.target",
-    "Wants=network-online.target",
-    "",
-    "[Service]",
-    "Type=simple",
-    `ExecStart=${command2.map(quote).join(" ")}`,
-    "Restart=on-failure",
-    "RestartSec=5",
-    // herdr, and the agents in it, outlive a restart of the node (an
-    // update, a crash); the next node adopts it.
-    "KillMode=process",
-    "",
-    "[Install]",
-    "WantedBy=default.target",
-    ""
-  ].join("\n");
-}
-async function installService(opts) {
-  const run4 = opts.run ?? runCommand;
-  const dir = unitDir(opts.env);
-  fs17.mkdirSync(dir, { recursive: true });
-  const unitFile = path15.join(dir, UNIT_NAME);
-  fs17.writeFileSync(unitFile, unitText(opts.command), { mode: 420 });
-  for (const args of [["--user", "daemon-reload"], ["--user", "enable", UNIT_NAME], ["--user", "restart", UNIT_NAME]]) {
-    const r = await run4("systemctl", args);
-    if (r.code !== 0) {
-      throw new Error(`systemctl ${args.join(" ")} failed: ${(r.stderr || r.stdout).trim() || `exit ${r.code}`}`);
-    }
-  }
-  const user = opts.user ?? os9.userInfo().username;
-  const linger = await run4("loginctl", ["enable-linger", user]);
-  if (linger.code === 0) return { unitFile, lingering: true, note: null };
-  const cron = `@reboot ${opts.command.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ")}`;
-  return {
-    unitFile,
-    lingering: false,
-    note: `This machine does not let the node keep running after you log out (loginctl enable-linger was refused), so it runs while you are logged in. To start it at boot instead, add this line with \`crontab -e\`:
-    ${cron}`
-  };
-}
-async function removeService(opts = {}) {
-  const run4 = opts.run ?? runCommand;
-  const unitFile = path15.join(unitDir(opts.env), UNIT_NAME);
-  if (!fs17.existsSync(unitFile)) return false;
-  await run4("systemctl", ["--user", "disable", "--now", UNIT_NAME]);
-  fs17.rmSync(unitFile, { force: true });
-  await run4("systemctl", ["--user", "daemon-reload"]);
-  return true;
-}
-function serviceInstalled(env = process.env) {
-  return fs17.existsSync(path15.join(unitDir(env), UNIT_NAME));
-}
-
 // src/node/specs.ts
 import { execFile as execFile2 } from "node:child_process";
-import fs18 from "node:fs";
+import fs19 from "node:fs";
 import os10 from "node:os";
-import path16 from "node:path";
+import path26 from "node:path";
 function run(cmd, args, timeoutMs = 3e3) {
   return new Promise((resolve) => {
     execFile2(cmd, args, { timeout: timeoutMs, windowsHide: true, maxBuffer: 256 * 1024 }, (err, stdout) => resolve(err ? null : stdout));
@@ -9620,10 +11702,10 @@ function run(cmd, args, timeoutMs = 3e3) {
 }
 function onPath(cmd, env) {
   const exts = process.platform === "win32" ? [".exe", ".cmd", ""] : [""];
-  for (const dir of (env.PATH ?? "").split(path16.delimiter)) {
+  for (const dir of (env.PATH ?? "").split(path26.delimiter)) {
     for (const ext of exts) {
       try {
-        fs18.accessSync(path16.join(dir, cmd + ext), fs18.constants.X_OK);
+        fs19.accessSync(path26.join(dir, cmd + ext), fs19.constants.X_OK);
         return true;
       } catch {
       }
@@ -9648,15 +11730,15 @@ async function gpus(env) {
 }
 function freeBytes(dir) {
   try {
-    const s = fs18.statfsSync(dir);
+    const s = fs19.statfsSync(dir);
     return s.bavail * s.bsize;
   } catch {
     return null;
   }
 }
 async function claudeVersion(binDir, env) {
-  const own = path16.join(binDir, process.platform === "win32" ? "claude.exe" : "claude");
-  const cmd = fs18.existsSync(own) ? own : onPath("claude", env) ? "claude" : null;
+  const own = path26.join(binDir, process.platform === "win32" ? "claude.exe" : "claude");
+  const cmd = fs19.existsSync(own) ? own : onPath("claude", env) ? "claude" : null;
   if (!cmd) return null;
   const out = await run(cmd, ["--version"], 5e3);
   return out ? /\d+\.\d+\.\d+/.exec(out)?.[0] ?? null : null;
@@ -9682,6 +11764,204 @@ async function gatherSpecs(opts) {
   };
 }
 
+// src/node/files.ts
+import { createHash as createHash5 } from "node:crypto";
+import fs20 from "node:fs";
+import path27 from "node:path";
+function pathOf(platform) {
+  return platform === "win32" ? path27.win32 : path27.posix;
+}
+function pathLists(o) {
+  const platform = o.platform ?? process.platform;
+  const env = o.env ?? process.env;
+  const P = pathOf(platform);
+  const H = o.home;
+  const N = o.nodeDir;
+  const j = (...parts) => P.join(...parts);
+  const nodeSecrets = ["credentials.json", "secrets", "claude", "control.secret", "control.sock", "state"].map((f) => j(N, f));
+  const ci = platform === "win32" || platform === "darwin";
+  const fold = (p) => ci ? P.normalize(p).toLowerCase() : P.normalize(p);
+  const home2 = fold(H);
+  const onPath2 = (env.PATH ?? env.Path ?? "").split(P.delimiter).filter((d) => d !== "" && P.isAbsolute(d) && fold(d) !== home2 && fold(d).startsWith(home2 + P.sep));
+  if (platform === "win32") {
+    const A = env.APPDATA && P.isAbsolute(env.APPDATA) ? env.APPDATA : j(H, "AppData", "Roaming");
+    const L = env.LOCALAPPDATA && P.isAbsolute(env.LOCALAPPDATA) ? env.LOCALAPPDATA : j(H, "AppData", "Local");
+    return {
+      hidden: [
+        j(H, ".ssh"),
+        j(H, ".gnupg"),
+        j(A, "gnupg"),
+        j(A, "agentbox"),
+        j(H, ".config", "agentbox"),
+        ...nodeSecrets,
+        j(H, ".claude", ".credentials.json"),
+        j(A, "Microsoft", "Credentials"),
+        j(L, "Microsoft", "Credentials"),
+        j(A, "Microsoft", "Protect"),
+        j(L, "Google", "Chrome", "User Data"),
+        j(L, "Microsoft", "Edge", "User Data"),
+        j(L, "BraveSoftware"),
+        j(L, "Chromium"),
+        j(L, "Vivaldi"),
+        j(A, "Opera Software"),
+        j(A, "Mozilla", "Firefox"),
+        j(L, "Mozilla", "Firefox")
+      ],
+      writeDenied: [
+        N,
+        ...onPath2,
+        j(H, "Documents", "PowerShell"),
+        j(H, "Documents", "WindowsPowerShell"),
+        j(A, "Microsoft", "Windows", "Start Menu", "Programs", "Startup"),
+        j(H, ".gitconfig"),
+        j(H, ".config", "git"),
+        // Git Bash reads these.
+        j(H, ".bashrc"),
+        j(H, ".bash_profile"),
+        j(H, ".profile"),
+        j(H, ".ssh", "authorized_keys")
+      ]
+    };
+  }
+  const configs = [.../* @__PURE__ */ new Set([env.XDG_CONFIG_HOME && P.isAbsolute(env.XDG_CONFIG_HOME) ? env.XDG_CONFIG_HOME : j(H, ".config"), j(H, ".config")])];
+  const inConfig = (...parts) => configs.map((c) => j(c, ...parts));
+  const mac = platform === "darwin" ? j(H, "Library") : null;
+  return {
+    hidden: [
+      j(H, ".ssh"),
+      j(H, ".gnupg"),
+      ...inConfig("agentbox"),
+      ...nodeSecrets,
+      j(H, ".claude", ".credentials.json"),
+      j(H, ".mozilla"),
+      j(H, ".librewolf"),
+      j(H, "snap", "firefox"),
+      j(H, "snap", "chromium"),
+      j(H, ".var", "app", "org.mozilla.firefox"),
+      j(H, ".var", "app", "com.google.Chrome"),
+      j(H, ".var", "app", "org.chromium.Chromium"),
+      j(H, ".var", "app", "com.brave.Browser"),
+      ...["google-chrome", "google-chrome-beta", "google-chrome-unstable", "chromium", "BraveSoftware", "microsoft-edge", "vivaldi", "opera"].flatMap((b) => inConfig(b)),
+      ...mac ? [
+        j(mac, "Keychains"),
+        j(mac, "Cookies"),
+        j(mac, "Safari"),
+        j(mac, "Application Support", "Google", "Chrome"),
+        j(mac, "Application Support", "Firefox"),
+        j(mac, "Application Support", "BraveSoftware"),
+        j(mac, "Application Support", "Microsoft Edge"),
+        j(mac, "Application Support", "Chromium")
+      ] : []
+    ],
+    writeDenied: [
+      N,
+      ...onPath2,
+      j(H, ".local", "bin"),
+      j(H, "bin"),
+      j(H, ".local", "share", "applications"),
+      j(H, ".pam_environment"),
+      ...[".bashrc", ".bash_aliases", ".bash_profile", ".bash_login", ".bash_logout", ".profile", ".zshrc", ".zshenv", ".zprofile", ".zlogin", ".zlogout", ".xprofile", ".xsession", ".xinitrc"].map((f) => j(H, f)),
+      ...inConfig("fish"),
+      ...inConfig("powershell"),
+      ...inConfig("systemd", "user"),
+      ...inConfig("environment.d"),
+      ...inConfig("autostart"),
+      ...inConfig("git"),
+      j(H, ".ssh", "authorized_keys"),
+      j(H, ".gitconfig"),
+      ...mac ? [j(mac, "LaunchAgents")] : []
+    ]
+  };
+}
+function resolved(p) {
+  try {
+    return fs20.realpathSync.native(p);
+  } catch {
+    try {
+      return path27.join(fs20.realpathSync.native(path27.dirname(p)), path27.basename(p));
+    } catch {
+      return null;
+    }
+  }
+}
+function refuseWindowsPath(input) {
+  const s = input.replace(/\//g, "\\");
+  if (s.startsWith("\\\\")) {
+    return /^\\\\[.?]\\/.test(s) || s === "\\\\." || s === "\\\\?" ? "device paths (\\\\.\\, \\\\?\\) are refused" : "network (UNC) paths are refused";
+  }
+  const rest = s.replace(/^\\?[A-Za-z]:/, "");
+  if (rest.includes(":")) return "alternate data streams (a `:` in a name) are refused";
+  for (const part of rest.split("\\")) {
+    if (part === "" || part === "." || part === "..") continue;
+    if (/[. ]$/.test(part)) return "a name ending in a dot or a space is refused";
+    if (/^(con|prn|aux|nul|com[0-9¹²³]|lpt[0-9¹²³]|conin\$|conout\$)(\..*)?$/i.test(part)) return "DOS device names are refused";
+  }
+  return null;
+}
+function pathRules(o) {
+  const platform = o.platform ?? process.platform;
+  const P = pathOf(platform);
+  const caseInsensitive = platform === "win32" || platform === "darwin";
+  const fold = (p) => {
+    const n = P.normalize(p);
+    const t2 = n.length > 1 && n.endsWith(P.sep) && !/^[A-Za-z]:\\$/.test(n) ? n.slice(0, -1) : n;
+    return caseInsensitive ? t2.toLowerCase() : t2;
+  };
+  const lists = pathLists(o);
+  const expand2 = (list) => {
+    const out = /* @__PURE__ */ new Set();
+    for (const p of list) {
+      out.add(p);
+      if (o.resolve ?? platform === process.platform) {
+        const r = resolved(p);
+        if (r) out.add(r);
+      }
+    }
+    return [...out];
+  };
+  const hidden = expand2(lists.hidden);
+  const writeDenied = expand2(lists.writeDenied);
+  const hiddenF = hidden.map(fold);
+  const deniedF = writeDenied.map(fold);
+  const under = (p, list) => {
+    const f = fold(p);
+    return list.some((e) => f === e || f.startsWith(e.endsWith(P.sep) ? e : e + P.sep));
+  };
+  const gitRuns = (p) => {
+    const parts = fold(p).split(P.sep);
+    for (let i = 0; i + 1 < parts.length; i++) {
+      if (parts[i] === ".git" && (parts[i + 1] === "hooks" || parts[i + 1] === "config")) return true;
+    }
+    return false;
+  };
+  return {
+    caseInsensitive,
+    hidden,
+    writeDenied,
+    isHidden: (p) => under(p, hiddenF),
+    isWriteDenied: (p) => under(p, deniedF) || gitRuns(p),
+    refusePath: (input) => platform === "win32" ? refuseWindowsPath(input) : null
+  };
+}
+function rootId(folder) {
+  return `r${createHash5("sha256").update(folder).digest("hex").slice(0, 12)}`;
+}
+function filesFor(policy, paths2, rules) {
+  if (policy.files.length === 0) return null;
+  const roots = policy.files.map((f) => {
+    const id = rootId(f.path);
+    return { id, path: f.path, mode: f.mode, stateDir: path27.join(paths2.state, "files", id) };
+  });
+  return new FilesService({
+    roots,
+    caseInsensitive: rules.caseInsensitive,
+    isHidden: rules.isHidden,
+    isWriteDenied: rules.isWriteDenied,
+    refusePath: rules.refusePath
+  });
+}
+var TRASH_DAYS = 7;
+
 // src/node/run.ts
 var RESTART_EXIT = 75;
 var HEADLESS = { cols: 200, rows: 50, ms: 3e4 };
@@ -9699,13 +11979,41 @@ async function runNode(o) {
   let policy = loadPolicy(o.paths.policy, o.home);
   const claude = claudePaths(o.paths);
   prepareClaude(claude, { home: o.home, machine: creds.name });
-  const herdrEnv = { ...process.env, PATH: [claude.shims, o.paths.bin, process.env.PATH ?? ""].join(path17.delimiter) };
+  const herdrEnv = { ...process.env, PATH: [claude.shims, o.paths.bin, process.env.PATH ?? ""].join(path28.delimiter) };
   delete herdrEnv.CLAUDE_CODE_OAUTH_TOKEN;
+  const rules = pathRules({ home: o.home, nodeDir: o.paths.dir });
+  let files = null;
+  let filesKey = "";
+  let stopUploads = () => {
+  };
+  const setFiles = (l) => {
+    const key = JSON.stringify(l.policy.files);
+    if (key === filesKey) return;
+    filesKey = key;
+    stopUploads();
+    files = filesFor(l.policy, o.paths, rules);
+    stopUploads = files ? files.startMaintenance() : () => {
+    };
+  };
+  setFiles(policy);
+  const sweepTrash = () => {
+    void files?.trash.expire(now() - TRASH_DAYS * 24 * 60 * 6e4).then(
+      (n) => n && o.log(`files: ${n} item(s) older than ${TRASH_DAYS} days removed from the trash`),
+      () => {
+      }
+    );
+  };
+  sweepTrash();
+  const trashSweeper = setInterval(sweepTrash, 60 * 6e4);
+  trashSweeper.unref();
+  const previews = new Previews({ now });
+  previews.start();
+  writePreviewShim(claude.shims);
   const presence = new PresenceGate({ presence: creds.presence, machineId: creds.machineId, hours: () => policy.policy.presenceHours, now, log: o.log });
   let hub = null;
   let streams = null;
-  const herdrBin = path17.join(o.paths.bin, process.platform === "win32" ? "herdr.exe" : "herdr");
-  const herdr = fs19.existsSync(herdrBin) ? new HerdrSupervisor({ bin: herdrBin, dir: o.paths.dir, env: herdrEnv }) : null;
+  const herdrBin = path28.join(o.paths.bin, process.platform === "win32" ? "herdr.exe" : "herdr");
+  const herdr = fs21.existsSync(herdrBin) ? new HerdrSupervisor({ bin: herdrBin, dir: o.paths.dir, env: herdrEnv }) : null;
   if (!herdr) o.log(`herdr is not installed (${herdrBin}); terminals and agents are unavailable until \`agentbox node join\` installs it`);
   const server = new NodeServer({
     herdrSocket: () => herdr?.socketPath ?? null,
@@ -9714,6 +12022,8 @@ async function runNode(o) {
     policy: () => policy,
     presence,
     home: o.home,
+    files: () => files,
+    previews,
     log: o.log
   });
   herdr?.on("log", (line) => o.log(line));
@@ -9767,6 +12077,14 @@ async function runNode(o) {
     ...o.link ?? {}
   });
   link.on("log", (line) => o.log(line));
+  const sendApps = () => {
+    link.sendControl({ type: "apps", apps: previews.list().map((a) => ({ port: a.port, name: a.name })) });
+  };
+  previews.on("change", () => {
+    sendApps();
+    server.enforce();
+  });
+  link.on("welcome", sendApps);
   link.on("stream", (stream, open3) => server.accept(stream, open3));
   link.on("control", (m) => {
     if (m.type !== "claude-token") return;
@@ -9779,6 +12097,8 @@ async function runNode(o) {
   const stopWatching = watchPolicy(o.paths.policy, o.home, (l) => {
     policy = l;
     sayPolicy(l);
+    setFiles(l);
+    if (!l.policy.ports) previews.clear();
     const closed = server.enforce();
     if (closed) o.log(`policy: closed ${closed} channel(s) it no longer allows`);
     if (l.policy.paused && !link.isPaused) link.pause();
@@ -9788,8 +12108,23 @@ async function runNode(o) {
   let finish = () => {
   };
   const done = new Promise((r) => finish = r);
-  const control2 = await startControl(o.paths.control, o.paths.controlSecret, async (command2) => {
+  const control2 = await startControl(o.paths.control, o.paths.controlSecret, async (command2, args) => {
     switch (command2) {
+      case "preview": {
+        if (!policy.policy.ports) throw new Error(`apps are off in this machine's policy.json ("ports": false)`);
+        if (args.share === true) throw new Error("apps on a machine cannot be shared publicly yet");
+        const r = await previews.register(args.port, args.name);
+        if (!r.ok) throw new Error(r.error);
+        o.log(`preview: port ${r.app.port} registered as "${r.app.name}"`);
+        return { app: r.app, existed: r.existed, online: link.state === "online" };
+      }
+      case "preview-list":
+        return { apps: previews.list() };
+      case "preview-stop": {
+        const port = Number(args.port);
+        if (!previews.remove(port)) throw new Error(`no app is registered on port ${args.port}`);
+        return { removed: port };
+      }
       case "status":
         return {
           state: link.state,
@@ -9819,7 +12154,7 @@ async function runNode(o) {
     }
   });
   link.on("revoked", () => {
-    fs19.rmSync(o.paths.secrets, { recursive: true, force: true });
+    fs21.rmSync(o.paths.secrets, { recursive: true, force: true });
     writeCredentials(o.paths.credentials, { ...creds, revokedAt: now() });
     o.log(`${creds.box} revoked this machine. Its shared secrets are wiped; everything else is kept. Re-join it to use it again.`);
     finish(EXIT.OK);
@@ -9839,7 +12174,7 @@ async function runNode(o) {
         running: o.version,
         // Only the standalone executable replaces itself; agentbox.mjs under Node does not.
         nodePath: execStart().length === 3 ? process.execPath : null,
-        ...fs19.existsSync(herdrPath) ? { herdr: { path: herdrPath, version: HERDR_VERSION } } : {},
+        ...fs21.existsSync(herdrPath) ? { herdr: { path: herdrPath, version: HERDR_VERSION } } : {},
         ...installedClaude(claude) ? { claude: { path: claude.bin, version: installedClaude(claude), versionFile: claude.versionFile } } : {},
         // Agents live in herdr: herdr and Claude Code are replaced only while none runs.
         idle: () => herdr ? herdr.idle() : true
@@ -9869,6 +12204,9 @@ async function runNode(o) {
   link.start();
   const code2 = await done;
   clearInterval(enforcer);
+  clearInterval(trashSweeper);
+  stopUploads();
+  previews.stop();
   server.close();
   herdr?.stop();
   hub?.stop();
@@ -9888,22 +12226,22 @@ function paths(ctx) {
 function home(ctx) {
   return ctx.env.HOME || os11.homedir();
 }
-function parseFolders(raw, homeDir2) {
+function parseFolders(raw2, homeDir2) {
   const out = [];
-  for (const part of raw.split(",").map((s) => s.trim()).filter(Boolean)) {
+  for (const part of raw2.split(",").map((s) => s.trim()).filter(Boolean)) {
     const m = /^(.*?)(?::(read|write))?$/.exec(part);
     let p = m[1];
     if (p === "~") p = homeDir2;
-    else if (p.startsWith("~/")) p = path18.join(homeDir2, p.slice(2));
-    p = path18.resolve(p);
-    if (p === path18.resolve(homeDir2)) throw new UsageError("not the whole home folder: name the project folders the box may use");
+    else if (p.startsWith("~/")) p = path29.join(homeDir2, p.slice(2));
+    p = path29.resolve(p);
+    if (p === path29.resolve(homeDir2)) throw new UsageError("not the whole home folder: name the project folders the box may use");
     out.push({ path: p, mode: m[2] ?? "write" });
   }
   return out;
 }
 function printPolicy(ctx, p) {
   try {
-    ctx.err(`${fs20.readFileSync(p.policy, "utf8")}`);
+    ctx.err(`${fs22.readFileSync(p.policy, "utf8")}`);
   } catch {
     ctx.err("(no policy.json)\n");
   }
@@ -10078,9 +12416,9 @@ var leave = command({
       link.stop();
     }
     if (ctx.platform === "linux") await removeService({ env: ctx.env });
-    fs20.rmSync(np.secrets, { recursive: true, force: true });
-    fs20.rmSync(np.credentials, { force: true });
-    fs20.rmSync(np.controlSecret, { force: true });
+    fs22.rmSync(np.secrets, { recursive: true, force: true });
+    fs22.rmSync(np.credentials, { force: true });
+    fs22.rmSync(np.controlSecret, { force: true });
     ctx.err(told ? `Left ${creds.box}.
 ` : `Left here; ${creds.box} could not be told, so it lists this machine until the owner removes it.
 `);
@@ -10097,7 +12435,7 @@ var logs = command({
   async run(ctx, p) {
     const args = ["--user", "-u", UNIT_NAME, "-n", "200", "--no-pager", ...bool(p.options, "follow") ? ["-f"] : []];
     return new Promise((resolve) => {
-      const child = spawn7("journalctl", args, { stdio: "inherit" });
+      const child = spawn9("journalctl", args, { stdio: "inherit" });
       child.on("error", () => {
         ctx.err("journalctl is not available here; run `agentbox node run` in a terminal to see the log.\n");
         resolve(EXIT.FAILURE);
@@ -10125,26 +12463,81 @@ var passphrase = command({
     ctx.err("This machine now proves presence with the new passphrase.\n");
   }
 });
-var NODE_COMMANDS = [join, run2, status2, pause, resume, leave, logs, passphrase];
+var preview = command({
+  path: ["node", "preview"],
+  summary: "show an app on this machine in the owner's Preview (agentbox-preview)",
+  usage: "<port> | open <port> | list | stop <port>",
+  details: [
+    "agentbox-preview <port> [--name n]   register a server already listening on <port>",
+    "agentbox-preview list                what is registered",
+    "agentbox-preview stop <port>         take it off the Preview",
+    "",
+    "Only registered ports are ever reached, on 127.0.0.1 or [::1]. A registration ends when",
+    "the port has not answered for 60 seconds, or when the node restarts. Apps on a machine are",
+    "private: the owner opens them from the machines page. `start -- <command>` is not",
+    "available on a machine yet: start the server yourself, then register its port."
+  ].join("\n"),
+  operands: { min: 1, max: 2 },
+  json: true,
+  options: [{ name: "name", type: "string", value: "name", description: "what to call it (default: the port)" }],
+  async run(ctx, p) {
+    const np = paths(ctx);
+    const [verb, arg] = p.operands;
+    const ask2 = async (command2, args = {}) => {
+      const r2 = await callControl(np.control, np.controlSecret, command2, 15e3, args);
+      if (r2 === null) throw new CliError("the node is not running on this machine (`agentbox node status`)", EXIT.UNREACHABLE);
+      if (r2.ok !== true) throw new CliError(String(r2.error ?? "the node refused"));
+      return r2;
+    };
+    if (verb === "list") {
+      const r2 = await ask2("preview-list");
+      const apps = Array.isArray(r2.apps) ? r2.apps : [];
+      if (ctx.json) return ctx.printJson({ apps });
+      if (apps.length === 0) ctx.out("No apps registered on this machine.\n");
+      for (const a of apps) ctx.out(`${a.port}	${safeText(a.name)}
+`);
+      return;
+    }
+    if (verb === "start") throw new UsageError("`start` is not available on a machine yet: start the server yourself, then `agentbox-preview <port>`");
+    if (verb === "stop") {
+      if (!arg) throw new UsageError("stop needs a port");
+      await ask2("preview-stop", { port: Number(arg) });
+      ctx.err(`Port ${arg} is off the Preview.
+`);
+      return;
+    }
+    const port = verb === "open" ? arg : verb;
+    if (!port || !/^\d{1,5}$/.test(port)) throw new UsageError("name a port: agentbox-preview <port>");
+    const name = str(p.options, "name");
+    const r = await ask2("preview", { port: Number(port), ...name === void 0 ? {} : { name } });
+    const app = r.app;
+    if (ctx.json) return ctx.printJson({ app, online: r.online === true });
+    ctx.err(
+      `Port ${app.port} is in the owner's Preview as "${safeText(app.name)}" (the machines page, this machine, Preview).${r.online === true ? "" : " The machine is not linked to its box right now; it shows there once it is."}
+`
+    );
+  }
+});
+var NODE_COMMANDS = [join, run2, status2, pause, resume, leave, logs, passphrase, preview];
 
 // src/commands/mount.ts
-import fs21 from "node:fs";
+import fs23 from "node:fs";
 import os12 from "node:os";
-import path19 from "node:path";
+import path30 from "node:path";
 
 // src/dav.ts
-import { randomBytes as randomBytes8, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
+import { randomBytes as randomBytes11, timingSafeEqual as timingSafeEqual4 } from "node:crypto";
 import http2 from "node:http";
 var REMOTE_PREFIX = "/api/dav";
 var BadPath = class extends Error {
 };
 function percentDecode(s) {
   const out = [];
-  const raw = Buffer.from(s, "utf8");
-  for (let i = 0; i < raw.length; i++) {
-    const b = raw[i];
-    if (b === 37 && i + 2 < raw.length) {
-      const hex = String.fromCharCode(raw[i + 1], raw[i + 2]);
+  const raw2 = Buffer.from(s, "utf8");
+  for (let i = 0; i < raw2.length; i++) {
+    const b = raw2[i];
+    if (b === 37 && i + 2 < raw2.length) {
+      const hex = String.fromCharCode(raw2[i + 1], raw2[i + 2]);
       if (/^[0-9A-Fa-f]{2}$/.test(hex)) {
         out.push(parseInt(hex, 16));
         i += 2;
@@ -10242,7 +12635,7 @@ var DROP_REQUEST = /* @__PURE__ */ new Set(["host", "authorization", "proxy-auth
 var DROP_RESPONSE = /* @__PURE__ */ new Set(["set-cookie", "www-authenticate", "strict-transport-security", "alt-svc"]);
 var MAX_REWRITE = 64 * 1024 * 1024;
 function newCredentials() {
-  return { user: "agentbox", password: randomBytes8(24).toString("base64url") };
+  return { user: "agentbox", password: randomBytes11(24).toString("base64url") };
 }
 function basicMatches(header, want) {
   const m = /^Basic\s+([A-Za-z0-9+/=]+)\s*$/i.exec(header ?? "");
@@ -10255,7 +12648,7 @@ var DavFront = class {
   constructor(client, opts = {}) {
     this.client = client;
     this.opts = opts;
-    this.secret = opts.secret ?? randomBytes8(16).toString("base64url");
+    this.secret = opts.secret ?? randomBytes11(16).toString("base64url");
     this.credentials = opts.credentials === void 0 ? newCredentials() : opts.credentials;
   }
   client;
@@ -10433,7 +12826,7 @@ function encodeQuery(query, rawQuery) {
   for (const [k, v] of Object.entries(query ?? {})) {
     if (v === void 0) continue;
     const values = Array.isArray(v) ? v : [String(v)];
-    for (const one of values) parts.push(`${encodeURIComponent(k)}=${encodeURIComponent(one)}`);
+    for (const one2 of values) parts.push(`${encodeURIComponent(k)}=${encodeURIComponent(one2)}`);
   }
   if (rawQuery) parts.push(rawQuery);
   return parts.length ? `?${parts.join("&")}` : "";
@@ -10487,7 +12880,7 @@ var BoxClient = class {
   get hasToken() {
     return this.token !== null;
   }
-  request(method, path22, opts = {}) {
+  request(method, path33, opts = {}) {
     const headers = { ...this.baseHeaders(opts.auth !== false), ...opts.headers ?? {} };
     let payload = null;
     const body = opts.body;
@@ -10502,7 +12895,7 @@ var BoxClient = class {
       }
       if (Buffer.isBuffer(payload)) headers["content-length"] = String(payload.length);
     }
-    const target = `${path22}${encodeQuery(opts.query, opts.rawQuery)}`;
+    const target = `${path33}${encodeQuery(opts.query, opts.rawQuery)}`;
     const lib = this.url.protocol === "https:" ? https : http3;
     return new Promise((resolve, reject) => {
       const req = lib.request(
@@ -10548,21 +12941,21 @@ var BoxClient = class {
    * A JSON call: the parsed answer on 2xx, else an {@link ApiError} with what
    * the box said. `what` names the action for the message ("listing /x").
    */
-  async json(method, path22, opts = {}) {
-    const res = await this.request(method, path22, { ...opts, headers: { accept: "application/json", ...opts.headers ?? {} } });
+  async json(method, path33, opts = {}) {
+    const res = await this.request(method, path33, { ...opts, headers: { accept: "application/json", ...opts.headers ?? {} } });
     const text = await res.text();
-    if (res.status < 200 || res.status >= 300) throw apiErrorFrom(res.status, text, opts.what ?? `${method} ${path22}`);
+    if (res.status < 200 || res.status >= 300) throw apiErrorFrom(res.status, text, opts.what ?? `${method} ${path33}`);
     if (res.status === 204 || text === "") return void 0;
     try {
       return JSON.parse(text);
     } catch {
-      throw new CliError(`${opts.what ?? path22}: the box answered with something that is not JSON (is ${this.origin} an agentbox?)`);
+      throw new CliError(`${opts.what ?? path33}: the box answered with something that is not JSON (is ${this.origin} an agentbox?)`);
     }
   }
   /** A request whose answer must be 2xx; the body is left to the caller. */
-  async ok(method, path22, opts = {}) {
-    const res = await this.request(method, path22, opts);
-    if (res.status < 200 || res.status >= 300) throw apiErrorFrom(res.status, await res.text(), opts.what ?? `${method} ${path22}`);
+  async ok(method, path33, opts = {}) {
+    const res = await this.request(method, path33, opts);
+    if (res.status < 200 || res.status >= 300) throw apiErrorFrom(res.status, await res.text(), opts.what ?? `${method} ${path33}`);
     return res;
   }
   close() {
@@ -10576,11 +12969,11 @@ async function gvfsFolder(root, port, secret, ms) {
   for (; ; ) {
     let names = [];
     try {
-      names = fs21.readdirSync(root);
+      names = fs23.readdirSync(root);
     } catch {
     }
     const name = gvfsMountName(names, port, secret);
-    if (name) return path19.join(root, name);
+    if (name) return path30.join(root, name);
     if (Date.now() > deadline) return null;
     await new Promise((r) => setTimeout(r, 100));
   }
@@ -10649,14 +13042,14 @@ password  ${credentials.password}
         throw new CliError(`${plan.helper} was not found, so the box cannot be mounted here: ${plan.install}. Or serve it with \`agentbox mount --no-mount\` and use any WebDAV client.`);
       }
       let madeMountpoint = false;
-      if (plan.mountpoint && !fs21.existsSync(plan.mountpoint)) {
-        fs21.mkdirSync(plan.mountpoint, { recursive: true });
+      if (plan.mountpoint && !fs23.existsSync(plan.mountpoint)) {
+        fs23.mkdirSync(plan.mountpoint, { recursive: true });
         madeMountpoint = true;
       }
-      if (plan.link && fs21.existsSync(plan.link)) throw new CliError(`${plan.link} already exists; name a new folder for the link, or leave it out`);
+      if (plan.link && fs23.existsSync(plan.link)) throw new CliError(`${plan.link} already exists; name a new folder for the link, or leave it out`);
       const mounted = await runStep(plan.mount, helper, ctx.env);
       if (mounted.code !== 0) {
-        if (madeMountpoint) fs21.rmSync(plan.mountpoint, { recursive: false, force: true });
+        if (madeMountpoint) fs23.rmSync(plan.mountpoint, { recursive: false, force: true });
         throw new CliError(`${plan.helper} could not mount it${mounted.output ? `: ${mounted.output}` : ""}`);
       }
       let where = plan.where;
@@ -10678,7 +13071,7 @@ password  ${credentials.password}
       }
       let linked = false;
       if (plan.link && where) {
-        fs21.symlinkSync(where, plan.link, "dir");
+        fs23.symlinkSync(where, plan.link, "dir");
         linked = true;
       }
       if (!gioOnly) {
@@ -10693,10 +13086,10 @@ password  ${credentials.password}
         const done = await runStep(unmount, findOnPath(unmount.command, ctx.env, ctx.platform) ?? unmount.command, ctx.env);
         if (done.code !== 0) ctx.warn(`${unmount.command} ${unmount.args.join(" ")} failed${done.output ? `: ${done.output}` : ""}; unmount it yourself`);
       }
-      if (linked) fs21.rmSync(plan.link, { force: true });
+      if (linked) fs23.rmSync(plan.link, { force: true });
       if (madeMountpoint) {
         try {
-          fs21.rmdirSync(plan.mountpoint);
+          fs23.rmdirSync(plan.mountpoint);
         } catch {
         }
       }
@@ -10708,12 +13101,12 @@ password  ${credentials.password}
 var MOUNT_COMMANDS = [mount];
 
 // src/commands/terminal.ts
-import fs22 from "node:fs";
+import fs24 from "node:fs";
 import os13 from "node:os";
-import path20 from "node:path";
+import path31 from "node:path";
 
 // src/ttyd.ts
-import { EventEmitter as EventEmitter3 } from "node:events";
+import { EventEmitter as EventEmitter4 } from "node:events";
 var CLIENT = { INPUT: 48, RESIZE: 49, PAUSE: 50, RESUME: 51 };
 var SERVER = { OUTPUT: 48, TITLE: 49, PREFERENCES: 50 };
 function handshakeFrame(columns, rows, authToken = "") {
@@ -10748,7 +13141,7 @@ function parseServerFrame(frame) {
       return { kind: "unknown", command: command2 ?? -1 };
   }
 }
-var TtydSession = class extends EventEmitter3 {
+var TtydSession = class extends EventEmitter4 {
   constructor(client, basePath) {
     super();
     this.client = client;
@@ -11083,13 +13476,13 @@ function runTerminal(opts) {
       opts.onCrash ?? defaultCrash(stderr)
     );
     const held = [];
-    const send = (data) => {
+    const send2 = (data) => {
       if (started) session.input(data);
       else held.push(data);
     };
     const onInput = (chunk) => {
       const { forward: forward2, detach } = filter.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
-      if (forward2.length) send(forward2);
+      if (forward2.length) send2(forward2);
       if (detach) session.detach();
     };
     const onResize = () => {
@@ -11243,7 +13636,7 @@ the network: faster, and no redraw glitches. Install it now with herdr's install
     return null;
   }
   const home2 = (win ? ctx.env.USERPROFILE : ctx.env.HOME) || os13.homedir();
-  return findOnPath("herdr", ctx.env, ctx.platform) ?? [path20.join(home2, ".local", "bin", "herdr")].find((f) => fs22.existsSync(f)) ?? null;
+  return findOnPath("herdr", ctx.env, ctx.platform) ?? [path31.join(home2, ".local", "bin", "herdr")].find((f) => fs24.existsSync(f)) ?? null;
 }
 var attach = command({
   path: ["attach"],
@@ -11294,10 +13687,10 @@ var TERMINAL_COMMANDS = [attach, shell];
 
 // src/commands/update.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { randomBytes as randomBytes9 } from "node:crypto";
-import fs23 from "node:fs";
+import { randomBytes as randomBytes12 } from "node:crypto";
+import fs25 from "node:fs";
 import os14 from "node:os";
-import path21 from "node:path";
+import path32 from "node:path";
 var MAX_BUNDLE = 16 * 1024 * 1024;
 function bundleVersion(bundle) {
   const head = (typeof bundle === "string" ? bundle : bundle.subarray(0, 512).toString("utf8")).split("\n", 3);
@@ -11310,17 +13703,17 @@ function selfInstall(argv1) {
   if (!argv1) return null;
   let file;
   try {
-    file = fs23.realpathSync(argv1);
+    file = fs25.realpathSync(argv1);
   } catch {
     return null;
   }
   let checkout = false;
   let npm = false;
   try {
-    const root = path21.join(path21.dirname(file), "..");
-    const pkg = JSON.parse(fs23.readFileSync(path21.join(root, "package.json"), "utf8"));
+    const root = path32.join(path32.dirname(file), "..");
+    const pkg = JSON.parse(fs25.readFileSync(path32.join(root, "package.json"), "utf8"));
     if (pkg.name === NPM_PACKAGE) {
-      if (fs23.existsSync(path21.join(root, "src", "cli.ts"))) checkout = true;
+      if (fs25.existsSync(path32.join(root, "src", "cli.ts"))) checkout = true;
       else npm = true;
     }
   } catch {
@@ -11334,13 +13727,13 @@ function npmVersionFor(boxVersion) {
 function nodeCredentials(env, platform = process.platform) {
   const candidates = [];
   if (platform === "win32") {
-    if (env.LOCALAPPDATA && path21.win32.isAbsolute(env.LOCALAPPDATA)) candidates.push(path21.join(env.LOCALAPPDATA, "agentbox", "node", "credentials.json"));
+    if (env.LOCALAPPDATA && path32.win32.isAbsolute(env.LOCALAPPDATA)) candidates.push(path32.join(env.LOCALAPPDATA, "agentbox", "node", "credentials.json"));
   } else {
     const xdg = env.XDG_DATA_HOME;
-    if (xdg && path21.isAbsolute(xdg)) candidates.push(path21.join(xdg, "agentbox", "node", "credentials.json"));
-    candidates.push(path21.join(env.HOME || os14.homedir(), ".local", "share", "agentbox", "node", "credentials.json"));
+    if (xdg && path32.isAbsolute(xdg)) candidates.push(path32.join(xdg, "agentbox", "node", "credentials.json"));
+    candidates.push(path32.join(env.HOME || os14.homedir(), ".local", "share", "agentbox", "node", "credentials.json"));
   }
-  return candidates.find((f) => fs23.existsSync(f)) ?? null;
+  return candidates.find((f) => fs25.existsSync(f)) ?? null;
 }
 function signedUpdatesOnly(env, platform = process.platform, standalone = STANDALONE) {
   const creds = nodeCredentials(env, platform);
@@ -11408,7 +13801,7 @@ var update = command({
       }
       return;
     }
-    const current = fs23.readFileSync(self.file);
+    const current = fs25.readFileSync(self.file);
     if (bundle.equals(current)) {
       ctx.out(`Already up to date: agentbox ${VERSION}, the same build ${name} serves.
 `);
@@ -11419,24 +13812,24 @@ var update = command({
 `);
       return;
     }
-    const dir = path21.dirname(self.file);
-    const tmp = path21.join(dir, `.agentbox-update-${randomBytes9(4).toString("hex")}.mjs`);
+    const dir = path32.dirname(self.file);
+    const tmp = path32.join(dir, `.agentbox-update-${randomBytes12(4).toString("hex")}.mjs`);
     try {
-      fs23.writeFileSync(tmp, bundle, { mode: 493 });
-      fs23.chmodSync(tmp, 493);
+      fs25.writeFileSync(tmp, bundle, { mode: 493 });
+      fs25.chmodSync(tmp, 493);
     } catch (err) {
-      fs23.rmSync(tmp, { force: true });
+      fs25.rmSync(tmp, { force: true });
       throw new CliError(`cannot write to ${dir} (${err.message}); reinstall with the box's install script`);
     }
     const check = spawnSync3(process.execPath, [tmp, "--version"], { encoding: "utf8", timeout: 3e4 });
     if (check.status !== 0) {
-      fs23.rmSync(tmp, { force: true });
+      fs25.rmSync(tmp, { force: true });
       throw new CliError(`the downloaded build does not run here: ${(check.stderr || check.stdout || "").trim().slice(0, 300)}`);
     }
     try {
-      fs23.renameSync(tmp, self.file);
+      fs25.renameSync(tmp, self.file);
     } catch (err) {
-      fs23.rmSync(tmp, { force: true });
+      fs25.rmSync(tmp, { force: true });
       throw new CliError(`cannot replace ${self.file}: ${err.message}`);
     }
     ctx.out(`Updated agentbox ${VERSION} \u2192 ${safeText(version)} from ${name}.
@@ -11461,8 +13854,8 @@ var COMMANDS2 = [
   ...UPDATE_COMMANDS
 ];
 function optionLine(o) {
-  const flag = `${o.short ? `-${o.short}, ` : "    "}--${o.name}${o.value ? ` <${o.value}>` : ""}`;
-  return `  ${flag.padEnd(26)} ${o.description}`;
+  const flag2 = `${o.short ? `-${o.short}, ` : "    "}--${o.name}${o.value ? ` <${o.value}>` : ""}`;
+  return `  ${flag2.padEnd(26)} ${o.description}`;
 }
 function mainHelp() {
   const width2 = Math.max(...COMMANDS2.filter((c) => !c.hidden).map((c) => c.path.join(" ").length));