@joeyshi12/casper 0.1.0

package/dist/server.js

@@ -0,0 +1,3506 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// server/src/paths.ts
+import os from "node:os";
+import path from "node:path";
+function fromEnv(name) {
+  const v = process.env[name];
+  return v === void 0 || v.trim() === "" ? void 0 : v;
+}
+function configFilePath() {
+  const base = fromEnv("XDG_CONFIG_HOME") ?? path.join(os.homedir(), ".config");
+  return path.join(base, "casper", "config.json");
+}
+function dataDirPath() {
+  return fromEnv("CASPER_DATA_DIR") ?? path.join(os.homedir(), ".casper");
+}
+var init_paths = __esm({
+  "server/src/paths.ts"() {
+    "use strict";
+  }
+});
+
+// server/src/cli/settings.ts
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path2 from "node:path";
+function readSettings(file) {
+  try {
+    const doc = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (typeof doc !== "object" || doc === null || Array.isArray(doc)) return {};
+    return doc;
+  } catch {
+    return {};
+  }
+}
+function updateSettings(file, changes) {
+  const merged = { ...readSettings(file), ...changes };
+  fs.mkdirSync(path2.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, `${JSON.stringify(merged, null, 2)}
+`, { mode: 384 });
+  fs.renameSync(tmp, file);
+}
+function generateToken() {
+  return crypto.randomBytes(24).toString("hex");
+}
+function printTokenBlock(token, heading) {
+  const line = "\u2500".repeat(Math.max(heading.length, token.length) + 2);
+  process.stdout.write(
+    `
+\u250C${line}\u2510
+\u2502 ${heading.padEnd(line.length - 2)} \u2502
+\u2502 ${"".padEnd(line.length - 2)} \u2502
+\u2502 ${token.padEnd(line.length - 2)} \u2502
+\u2514${line}\u2518
+
+`
+  );
+}
+var init_settings = __esm({
+  "server/src/cli/settings.ts"() {
+    "use strict";
+  }
+});
+
+// server/src/cli/agentFile.ts
+var agentFile_exports = {};
+__export(agentFile_exports, {
+  installAgentFile: () => installAgentFile
+});
+import crypto2 from "node:crypto";
+import fs2 from "node:fs";
+import path3 from "node:path";
+import url from "node:url";
+function sourceFile() {
+  const here = path3.dirname(url.fileURLToPath(import.meta.url));
+  const packaged = path3.resolve(here, "agents/casper.json");
+  const workspace = path3.resolve(here, "../../../assets/agents/casper.json");
+  return fs2.existsSync(packaged) ? packaged : workspace;
+}
+function sha256(text) {
+  return crypto2.createHash("sha256").update(text).digest("hex");
+}
+function installAgentFile(home2, dataDir) {
+  const src = sourceFile();
+  const target = path3.join(home2, ".kiro", "agents", "casper.json");
+  if (!fs2.existsSync(src)) return { action: "no-source", target };
+  const desired = fs2.readFileSync(src, "utf8");
+  const stampFile = path3.join(dataDir, "agent-stamp");
+  const stamp = fs2.existsSync(stampFile) ? fs2.readFileSync(stampFile, "utf8").trim() : "";
+  const write = () => {
+    fs2.mkdirSync(path3.dirname(target), { recursive: true });
+    fs2.writeFileSync(target, desired);
+    fs2.mkdirSync(dataDir, { recursive: true });
+    fs2.writeFileSync(stampFile, `${sha256(desired)}
+`);
+  };
+  let current;
+  try {
+    current = fs2.lstatSync(target);
+  } catch {
+    current = void 0;
+  }
+  if (!current) {
+    write();
+    return { action: "installed", target };
+  }
+  if (current.isSymbolicLink()) {
+    fs2.rmSync(target);
+    write();
+    return { action: "updated", target };
+  }
+  const onDisk = fs2.readFileSync(target, "utf8");
+  if (sha256(onDisk) === sha256(desired)) return { action: "unchanged", target };
+  if (stamp !== "" && sha256(onDisk) === stamp) {
+    write();
+    return { action: "updated", target };
+  }
+  return { action: "kept-yours", target };
+}
+var init_agentFile = __esm({
+  "server/src/cli/agentFile.ts"() {
+    "use strict";
+  }
+});
+
+// server/src/util/logger.ts
+import pino from "pino";
+var logger;
+var init_logger = __esm({
+  "server/src/util/logger.ts"() {
+    "use strict";
+    logger = pino({
+      level: process.env.LOG_LEVEL ?? "info",
+      transport: process.env.NODE_ENV === "production" ? void 0 : {
+        target: "pino/file",
+        options: { destination: 2 }
+        // stderr, so stdout stays clean
+      }
+    });
+  }
+});
+
+// server/src/config.ts
+import { execFileSync } from "node:child_process";
+import fs3 from "node:fs";
+import os2 from "node:os";
+import path4 from "node:path";
+import url2 from "node:url";
+function env(name, fallback) {
+  const v = process.env[name];
+  return v === void 0 || v === "" ? fallback : v;
+}
+function defaultWebDist() {
+  const here = path4.dirname(url2.fileURLToPath(import.meta.url));
+  const bundled = path4.join(here, "web");
+  const workspace = path4.resolve(here, "../../web/dist");
+  return fs3.existsSync(bundled) ? bundled : workspace;
+}
+function parseConfigDoc(raw, onWarn = () => {
+}) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    onWarn("config: invalid JSON, ignoring the file entirely", err);
+    return {};
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    onWarn("config: expected a JSON object, ignoring");
+    return {};
+  }
+  const obj = parsed;
+  const unknown = Object.keys(obj).filter((k) => !KNOWN_KEYS.has(k));
+  if (unknown.length > 0) onWarn("config: ignoring unrecognised keys", unknown);
+  return obj;
+}
+function loadConfigFile() {
+  const file = configFilePath();
+  let raw;
+  try {
+    raw = fs3.readFileSync(file, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      logger.warn({ file, err }, "config: unreadable, falling back to defaults");
+    }
+    return {};
+  }
+  const obj = parseConfigDoc(raw, (msg, detail) => logger.warn({ file, detail }, msg));
+  if (typeof obj.token === "string" && obj.token !== "") {
+    try {
+      const mode = fs3.statSync(file).mode & 63;
+      if (mode !== 0) {
+        logger.warn({ file }, "config: holds a token but is readable by others; chmod 600 it");
+      }
+    } catch {
+    }
+  }
+  return obj;
+}
+function pickString(fromEnv2, fromFile, fallback) {
+  if (fromEnv2 !== void 0 && fromEnv2 !== "") return fromEnv2;
+  if (typeof fromFile === "string" && fromFile !== "") return fromFile;
+  return fallback;
+}
+function pickInt(fromEnv2, fromFile, fallback) {
+  if (fromEnv2 !== void 0 && fromEnv2 !== "") {
+    const n = Number.parseInt(fromEnv2, 10);
+    if (Number.isFinite(n)) return n;
+  }
+  if (typeof fromFile === "number" && Number.isFinite(fromFile)) return fromFile;
+  if (typeof fromFile === "string") {
+    const n = Number.parseInt(fromFile, 10);
+    if (Number.isFinite(n)) return n;
+  }
+  return fallback;
+}
+function resolveKiroBin(explicit, home2) {
+  if (explicit.includes("/") && fs3.existsSync(explicit)) return explicit;
+  try {
+    const found = execFileSync("/bin/sh", ["-lc", `command -v ${explicit}`], {
+      encoding: "utf8"
+    }).trim();
+    if (found && fs3.existsSync(found)) return found;
+  } catch {
+  }
+  const candidates = [
+    path4.join(home2, ".toolbox", "bin", explicit),
+    path4.join(home2, ".local", "bin", explicit),
+    path4.join("/usr", "local", "bin", explicit),
+    path4.join("/opt", "homebrew", "bin", explicit)
+  ];
+  for (const c of candidates) {
+    if (fs3.existsSync(c)) return c;
+  }
+  return explicit;
+}
+var home, KNOWN_KEYS, fileConfig, setting, settingInt, config;
+var init_config = __esm({
+  "server/src/config.ts"() {
+    "use strict";
+    init_paths();
+    init_logger();
+    home = os2.homedir();
+    KNOWN_KEYS = /* @__PURE__ */ new Set([
+      "host",
+      "port",
+      "token",
+      "sessionTtlSeconds",
+      "kiroBin",
+      "defaultCwd",
+      "maxLiveSessions",
+      "defaultAgent",
+      "fileRoot",
+      "eventBufferSize",
+      "maxUploadBytes"
+    ]);
+    fileConfig = loadConfigFile();
+    setting = (envName, key, fallback) => pickString(process.env[envName], fileConfig[key], fallback);
+    settingInt = (envName, key, fallback) => pickInt(process.env[envName], fileConfig[key], fallback);
+    config = {
+      host: setting("HOST", "host", "0.0.0.0"),
+      port: settingInt("PORT", "port", 4319),
+      /** Shared-secret token required to log in. Empty string disables auth (dev only). */
+      token: setting("CASPER_TOKEN", "token", ""),
+      /** Device-login lifetime in seconds; slid forward on activity. Default 7 days. */
+      sessionTtlSeconds: settingInt("CASPER_SESSION_TTL_SECONDS", "sessionTtlSeconds", 60 * 60 * 24 * 7),
+      kiroBin: resolveKiroBin(setting("KIRO_BIN", "kiroBin", "kiro-cli"), home),
+      defaultCwd: setting("DEFAULT_CWD", "defaultCwd", process.cwd()),
+      maxLiveSessions: settingInt("MAX_LIVE_SESSIONS", "maxLiveSessions", 6),
+      defaultAgent: setting("DEFAULT_AGENT", "defaultAgent", "kiro_default"),
+      /**
+       * Filesystem root that file-serving endpoints (/api/fs/dirs, /api/fs/image)
+       * are confined to. Requests resolving outside this root are rejected.
+       * Defaults to the filesystem root (/), so file browsing spans everything the
+       * server process can read. Set CASPER_FILE_ROOT to a narrower path (e.g. the
+       * user's home directory) to stop authenticated users from reading system
+       * files such as /etc or SSH keys.
+       */
+      fileRoot: path4.resolve(setting("CASPER_FILE_ROOT", "fileRoot", "/")),
+      /** Directory where kiro-cli persists its own session files. */
+      kiroSessionsDir: path4.join(home, ".kiro", "sessions", "cli"),
+      /** Where casper.db lives. Env-only: it says where data is, and the config
+       *  file isn't there. */
+      casperDataDir: dataDirPath(),
+      /** Built web app to serve. Env-only: install layout, not a user preference. */
+      webDist: env("CASPER_WEB_DIST", defaultWebDist()),
+      /** Per-session in-memory event ring buffer size. */
+      eventBufferSize: settingInt("EVENT_BUFFER_SIZE", "eventBufferSize", 5e3),
+      /** Max size (bytes) for a single uploaded file. Default 100 MB. */
+      maxUploadBytes: settingInt("CASPER_MAX_UPLOAD_BYTES", "maxUploadBytes", 100 * 1024 * 1024),
+      /** Absolute path of the settings file, for diagnostics. */
+      configFile: configFilePath()
+    };
+  }
+});
+
+// server/src/session/db.ts
+import fs4 from "node:fs";
+import path5 from "node:path";
+import { DatabaseSync } from "node:sqlite";
+function db() {
+  if (!handle) handle = open();
+  return handle;
+}
+function open() {
+  fs4.mkdirSync(config.casperDataDir, { recursive: true, mode: 448 });
+  const file = path5.join(config.casperDataDir, "casper.db");
+  const d = new DatabaseSync(file);
+  d.exec("PRAGMA journal_mode = WAL");
+  d.exec(SCHEMA);
+  restrict(config.casperDataDir, 448);
+  for (const f of [file, `${file}-wal`, `${file}-shm`]) restrict(f, 384);
+  return d;
+}
+function restrict(target, mode) {
+  try {
+    if ((fs4.statSync(target).mode & 511) !== mode) fs4.chmodSync(target, mode);
+  } catch {
+  }
+}
+var SCHEMA, handle;
+var init_db = __esm({
+  "server/src/session/db.ts"() {
+    "use strict";
+    init_config();
+    SCHEMA = `
+CREATE TABLE IF NOT EXISTS sessions (
+  session_id TEXT PRIMARY KEY,
+  title      TEXT,
+  cwd        TEXT
+);
+CREATE TABLE IF NOT EXISTS logins (
+  id           TEXT PRIMARY KEY,
+  hash         TEXT NOT NULL UNIQUE,
+  created_at   TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  user_agent   TEXT
+);
+CREATE INDEX IF NOT EXISTS logins_hash ON logins (hash);
+`;
+  }
+});
+
+// server/src/session/logins.ts
+var logins_exports = {};
+__export(logins_exports, {
+  LoginStore: () => LoginStore
+});
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+function sha2562(s) {
+  return createHash("sha256").update(s).digest("hex");
+}
+function sameHash(a, b) {
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+}
+var LAST_SEEN_WRITE_INTERVAL_MS, str, toRecord, LoginStore;
+var init_logins = __esm({
+  "server/src/session/logins.ts"() {
+    "use strict";
+    init_config();
+    init_db();
+    LAST_SEEN_WRITE_INTERVAL_MS = 6e4;
+    str = (v) => typeof v === "string" ? v : "";
+    toRecord = (r) => ({
+      id: str(r.id),
+      hash: str(r.hash),
+      createdAt: str(r.created_at),
+      lastSeenAt: str(r.last_seen_at),
+      userAgent: typeof r.user_agent === "string" ? r.user_agent : void 0
+    });
+    LoginStore = class {
+      constructor() {
+        this.pruneExpired();
+      }
+      ttlMs() {
+        return config.sessionTtlSeconds * 1e3;
+      }
+      /** Drop logins whose last activity is older than the TTL. */
+      pruneExpired(now = Date.now()) {
+        const cutoff = new Date(now - this.ttlMs()).toISOString();
+        db().prepare("DELETE FROM logins WHERE last_seen_at < ?").run(cutoff);
+      }
+      /** Create a login. Returns the raw token to set as the cookie value. */
+      create(userAgent) {
+        const token = randomBytes(32).toString("base64url");
+        const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+        const record = {
+          id: randomBytes(9).toString("base64url"),
+          hash: sha2562(token),
+          createdAt: nowIso,
+          lastSeenAt: nowIso,
+          userAgent
+        };
+        db().prepare(
+          `INSERT INTO logins (id, hash, created_at, last_seen_at, user_agent)
+         VALUES (?, ?, ?, ?, ?)`
+        ).run(record.id, record.hash, nowIso, nowIso, userAgent ?? null);
+        return { token, record };
+      }
+      /**
+       * Verify a raw token. Returns the record (sliding its expiry forward) or null
+       * if unknown/expired. Writes the lastSeen bump at most once a minute.
+       */
+      verify(token) {
+        if (!token) return null;
+        const now = Date.now();
+        const row = db().prepare("SELECT * FROM logins WHERE hash = ?").get(sha2562(token));
+        if (!row) return null;
+        const record = toRecord(row);
+        if (now - Date.parse(record.lastSeenAt) > this.ttlMs()) {
+          db().prepare("DELETE FROM logins WHERE id = ?").run(record.id);
+          return null;
+        }
+        if (now - Date.parse(record.lastSeenAt) >= LAST_SEEN_WRITE_INTERVAL_MS) {
+          record.lastSeenAt = new Date(now).toISOString();
+          db().prepare("UPDATE logins SET last_seen_at = ? WHERE id = ?").run(record.lastSeenAt, record.id);
+        }
+        return record;
+      }
+      /** List all active devices, marking the one owning `currentToken`. */
+      list(currentToken) {
+        this.pruneExpired();
+        const currentHash = currentToken ? sha2562(currentToken) : void 0;
+        const rows = db().prepare("SELECT * FROM logins ORDER BY last_seen_at DESC").all();
+        return rows.map(toRecord).map((r) => ({
+          id: r.id,
+          createdAt: r.createdAt,
+          lastSeenAt: r.lastSeenAt,
+          userAgent: r.userAgent,
+          current: currentHash !== void 0 && sameHash(r.hash, currentHash)
+        }));
+      }
+      /** Revoke the device holding this token (used on logout). */
+      revokeToken(token) {
+        if (!token) return;
+        db().prepare("DELETE FROM logins WHERE hash = ?").run(sha2562(token));
+      }
+      /** Revoke a device by its public id. Returns false if there was no such device. */
+      revokeId(id) {
+        const res = db().prepare("DELETE FROM logins WHERE id = ?").run(id);
+        return res.changes > 0;
+      }
+      /** Log out every device. */
+      revokeAll() {
+        db().prepare("DELETE FROM logins").run();
+      }
+    };
+  }
+});
+
+// server/src/cli/service.ts
+var service_exports = {};
+__export(service_exports, {
+  hasUserSystemd: () => hasUserSystemd,
+  serviceActive: () => serviceActive,
+  serviceInstall: () => serviceInstall,
+  serviceStatus: () => serviceStatus,
+  serviceUninstall: () => serviceUninstall
+});
+import { execFileSync as execFileSync2, spawnSync } from "node:child_process";
+import fs5 from "node:fs";
+import os3 from "node:os";
+import path6 from "node:path";
+import url3 from "node:url";
+function unitPath() {
+  const base = process.env.XDG_CONFIG_HOME?.trim() || path6.join(os3.homedir(), ".config");
+  return path6.join(base, "systemd", "user", SERVICE);
+}
+function systemctl(args, quiet = false) {
+  const r = spawnSync("systemctl", ["--user", ...args], {
+    stdio: quiet ? "ignore" : "inherit"
+  });
+  return r.status ?? 1;
+}
+function hasUserSystemd() {
+  const r = spawnSync("systemctl", ["--user", "show-environment"], { stdio: "ignore" });
+  return r.status === 0;
+}
+function entryScript() {
+  const here = path6.dirname(url3.fileURLToPath(import.meta.url));
+  const bundled = path6.join(here, "casper.js");
+  if (fs5.existsSync(bundled)) return bundled;
+  return path6.resolve(here, "../index.js");
+}
+function serviceInstall() {
+  if (!hasUserSystemd()) {
+    process.stderr.write(
+      "casper: no user systemd here. Run Casper with `casper`, or start it from your own init system.\n"
+    );
+    return 1;
+  }
+  const unit = unitPath();
+  fs5.mkdirSync(path6.dirname(unit), { recursive: true });
+  fs5.writeFileSync(
+    unit,
+    `[Unit]
+Description=Casper (kiro-cli web client)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=${os3.homedir()}
+Environment=NODE_ENV=production
+ExecStart=${process.execPath} ${entryScript()}
+Restart=on-failure
+RestartSec=3
+
+[Install]
+WantedBy=default.target
+`
+  );
+  process.stdout.write(`wrote ${unit}
+`);
+  try {
+    execFileSync2("loginctl", ["enable-linger", os3.userInfo().username], { stdio: "ignore" });
+  } catch {
+    process.stderr.write(
+      `! could not enable linger; the service may stop at logout. Run: sudo loginctl enable-linger ${os3.userInfo().username}
+`
+    );
+  }
+  systemctl(["daemon-reload"]);
+  if (systemctl(["enable", "--now", SERVICE]) !== 0) {
+    process.stderr.write(`! could not start the service. Check: systemctl --user status ${SERVICE}
+`);
+    return 1;
+  }
+  process.stdout.write("casper is running as a systemd user service\n");
+  return 0;
+}
+function serviceUninstall() {
+  if (!hasUserSystemd()) {
+    process.stderr.write("casper: no user systemd here; nothing to remove.\n");
+    return 1;
+  }
+  systemctl(["disable", "--now", SERVICE], true);
+  const unit = unitPath();
+  if (fs5.existsSync(unit)) {
+    fs5.rmSync(unit);
+    process.stdout.write(`removed ${unit}
+`);
+  }
+  systemctl(["daemon-reload"], true);
+  process.stdout.write("service removed; your sessions and settings are untouched\n");
+  return 0;
+}
+function serviceStatus() {
+  if (!hasUserSystemd()) {
+    process.stdout.write("no user systemd here; Casper is not running as a service\n");
+    return 0;
+  }
+  return systemctl(["status", "--no-pager", SERVICE]);
+}
+function serviceActive() {
+  return spawnSync("systemctl", ["--user", "is-active", "--quiet", SERVICE], { stdio: "ignore" }).status === 0;
+}
+var SERVICE;
+var init_service = __esm({
+  "server/src/cli/service.ts"() {
+    "use strict";
+    SERVICE = "casper.service";
+  }
+});
+
+// shared/dist/acp.js
+function isJsonRpcResponse(m) {
+  return "id" in m && m.id !== void 0 && ("result" in m || "error" in m);
+}
+function isJsonRpcError(m) {
+  return "error" in m;
+}
+function isJsonRpcNotification(m) {
+  return !("id" in m) && "method" in m;
+}
+var ACP_METHODS, KIRO_NOTIFICATIONS;
+var init_acp = __esm({
+  "shared/dist/acp.js"() {
+    "use strict";
+    ACP_METHODS = {
+      initialize: "initialize",
+      sessionNew: "session/new",
+      sessionLoad: "session/load",
+      sessionPrompt: "session/prompt",
+      sessionCancel: "session/cancel",
+      sessionSetMode: "session/set_mode",
+      sessionSetModel: "session/set_model",
+      sessionUpdate: "session/update",
+      commandsExecute: "_kiro.dev/commands/execute"
+    };
+    KIRO_NOTIFICATIONS = {
+      metadata: "_kiro.dev/metadata",
+      subagentListUpdate: "_kiro.dev/subagent/list_update",
+      mcpServerInitialized: "_kiro.dev/mcp/server_initialized",
+      mcpServerInitFailure: "_kiro.dev/mcp/server_init_failure",
+      commandsAvailable: "_kiro.dev/commands/available",
+      mcpOauthRequest: "_kiro.dev/mcp/oauth_request",
+      compactionStatus: "_kiro.dev/compaction/status"
+    };
+  }
+});
+
+// shared/dist/attachments.js
+function attachmentPaths(text) {
+  const line = text.split("\n").find((l) => l.startsWith(ATTACHMENTS_PREFIX));
+  if (!line)
+    return [];
+  return line.slice(ATTACHMENTS_PREFIX.length).split(", ").map((s) => s.trim()).filter(Boolean);
+}
+function imageAttachmentPaths(text) {
+  return attachmentPaths(text).filter((p) => {
+    const lower = p.toLowerCase();
+    return IMAGE_EXTS.some((ext) => lower.endsWith(ext));
+  });
+}
+function stripAttachmentsLine(text) {
+  return text.split("\n").filter((l) => !l.startsWith(ATTACHMENTS_PREFIX)).join("\n").trim();
+}
+var ATTACHMENTS_PREFIX, IMAGE_EXTS;
+var init_attachments = __esm({
+  "shared/dist/attachments.js"() {
+    "use strict";
+    ATTACHMENTS_PREFIX = "Attached files: ";
+    IMAGE_EXTS = [".png", ".jpg", ".jpeg", ".gif", ".webp", ".svg", ".bmp", ".ico", ".avif"];
+  }
+});
+
+// shared/dist/observability.js
+function emptyObservabilitySnapshot() {
+  return {
+    turnStatus: "idle",
+    creditsSpent: 0,
+    lastTurnCredits: 0,
+    contextUsagePercentage: 0,
+    lastTurnDurationMs: 0,
+    subagents: [],
+    pendingStages: [],
+    mcpServers: [],
+    availableCommands: [],
+    oauthPrompts: [],
+    compacting: false
+  };
+}
+var init_observability = __esm({
+  "shared/dist/observability.js"() {
+    "use strict";
+  }
+});
+
+// shared/dist/rest-dto.js
+var init_rest_dto = __esm({
+  "shared/dist/rest-dto.js"() {
+    "use strict";
+  }
+});
+
+// shared/dist/ws-protocol.js
+var init_ws_protocol = __esm({
+  "shared/dist/ws-protocol.js"() {
+    "use strict";
+  }
+});
+
+// shared/dist/index.js
+var init_dist = __esm({
+  "shared/dist/index.js"() {
+    "use strict";
+    init_acp();
+    init_attachments();
+    init_observability();
+    init_rest_dto();
+    init_ws_protocol();
+  }
+});
+
+// server/src/util/paths.ts
+import fs6 from "node:fs";
+import fsp from "node:fs/promises";
+import path7 from "node:path";
+function isWithinRoot(root, target) {
+  const resolved = path7.resolve(target);
+  if (root === path7.sep) return true;
+  return resolved === root || resolved.startsWith(root + path7.sep);
+}
+function confineToRoot(root, input) {
+  const resolved = path7.resolve(root, input);
+  return isWithinRoot(root, resolved) ? resolved : null;
+}
+function resolveRealRoot(root) {
+  if (realRootCache && realRootCache.root === root) return realRootCache.real;
+  let real;
+  try {
+    real = fs6.realpathSync(root);
+  } catch {
+    real = root;
+  }
+  realRootCache = { root, real };
+  return real;
+}
+async function realConfineToRoot(root, absPath) {
+  let realTarget;
+  try {
+    realTarget = await fsp.realpath(absPath);
+  } catch {
+    return null;
+  }
+  return isWithinRoot(resolveRealRoot(root), realTarget) ? realTarget : null;
+}
+function isValidSessionId(id) {
+  return /^[A-Za-z0-9._-]+$/.test(id) && id !== "." && !id.includes("..");
+}
+var realRootCache;
+var init_paths2 = __esm({
+  "server/src/util/paths.ts"() {
+    "use strict";
+    realRootCache = null;
+  }
+});
+
+// server/src/acp/errors.ts
+function describeError(error) {
+  const detail = detailText(error.data);
+  return detail ? `${detail} (${error.message}, code ${error.code})` : `${error.message} (code ${error.code})`;
+}
+function detailText(data) {
+  if (data == null) return "";
+  if (typeof data === "string") return truncate(data.trim());
+  if (typeof data === "number" || typeof data === "boolean") return String(data);
+  if (typeof data === "object") {
+    const rec = data;
+    for (const key of ["message", "error", "detail", "details", "reason", "cause"]) {
+      const v = rec[key];
+      if (typeof v === "string" && v.trim()) return truncate(v.trim());
+    }
+    try {
+      return truncate(JSON.stringify(data));
+    } catch {
+      return "";
+    }
+  }
+  return "";
+}
+var MAX_DETAIL, truncate;
+var init_errors = __esm({
+  "server/src/acp/errors.ts"() {
+    "use strict";
+    MAX_DETAIL = 2e3;
+    truncate = (s) => s.length > MAX_DETAIL ? `${s.slice(0, MAX_DETAIL)}\u2026 (truncated)` : s;
+  }
+});
+
+// server/src/acp/AcpClient.ts
+import { EventEmitter } from "node:events";
+import split2 from "split2";
+var AcpClient;
+var init_AcpClient = __esm({
+  "server/src/acp/AcpClient.ts"() {
+    "use strict";
+    init_dist();
+    init_errors();
+    AcpClient = class extends EventEmitter {
+      nextId = 1;
+      pending = /* @__PURE__ */ new Map();
+      writable;
+      log;
+      closed = false;
+      constructor(readable, writable, log) {
+        super();
+        this.writable = writable;
+        this.log = log;
+        readable.pipe(split2()).on("data", (line) => {
+          const trimmed = line.trim();
+          if (!trimmed) return;
+          let msg;
+          try {
+            msg = JSON.parse(trimmed);
+          } catch (err) {
+            this.emit("parseError", err, trimmed);
+            this.log.warn({ line: trimmed.slice(0, 200) }, "acp: failed to parse line");
+            return;
+          }
+          this.handleMessage(msg);
+        });
+      }
+      handleMessage(msg) {
+        if (isJsonRpcResponse(msg)) {
+          const id = "id" in msg ? msg.id : null;
+          if (id === null) return;
+          const pending = this.pending.get(id);
+          if (!pending) {
+            this.log.warn({ id }, "acp: response for unknown request id");
+            return;
+          }
+          this.pending.delete(id);
+          if (pending.timer) clearTimeout(pending.timer);
+          if (isJsonRpcError(msg)) {
+            pending.reject(new Error(`ACP ${pending.method} failed: ${describeError(msg.error)}`));
+          } else {
+            pending.resolve(msg.result);
+          }
+          return;
+        }
+        if (isJsonRpcNotification(msg)) {
+          this.emit("notification", msg);
+          return;
+        }
+        if ("id" in msg && "method" in msg) {
+          this.emit("serverRequest", msg);
+        }
+      }
+      /** Send a request and await its result. */
+      request(method, params, timeoutMs = 12e4) {
+        if (this.closed) return Promise.reject(new Error("ACP client is closed"));
+        const id = this.nextId++;
+        const payload = { jsonrpc: "2.0", id, method, params };
+        return new Promise((resolve, reject) => {
+          const timer = timeoutMs > 0 ? setTimeout(() => {
+            this.pending.delete(id);
+            reject(new Error(`ACP ${method} timed out after ${timeoutMs}ms`));
+          }, timeoutMs) : void 0;
+          this.pending.set(id, {
+            resolve,
+            reject,
+            method,
+            timer
+          });
+          this.write(payload);
+        });
+      }
+      notify(method, params) {
+        if (this.closed) return;
+        this.write({ jsonrpc: "2.0", method, params });
+      }
+      respond(id, result) {
+        if (this.closed) return;
+        this.write({ jsonrpc: "2.0", id, result });
+      }
+      write(msg) {
+        this.writable.write(JSON.stringify(msg) + "\n");
+      }
+      /**
+       * Reject all pending requests; call when the child process exits. The reason
+       * is passed through verbatim because it reaches the user as a turn_error -
+       * the caller supplies something readable, so don't bury it behind a prefix
+       * about ACP internals.
+       */
+      fail(reason) {
+        this.closed = true;
+        for (const [id, pending] of this.pending) {
+          if (pending.timer) clearTimeout(pending.timer);
+          pending.reject(new Error(reason));
+          this.pending.delete(id);
+        }
+      }
+    };
+  }
+});
+
+// server/src/session/KiroProcess.ts
+import { spawn } from "node:child_process";
+import { EventEmitter as EventEmitter2 } from "node:events";
+import split22 from "split2";
+var STDERR_KEEP, KiroProcess;
+var init_KiroProcess = __esm({
+  "server/src/session/KiroProcess.ts"() {
+    "use strict";
+    init_dist();
+    init_config();
+    init_AcpClient();
+    STDERR_KEEP = 8;
+    KiroProcess = class extends EventEmitter2 {
+      client;
+      child;
+      log;
+      disposed = false;
+      recentStderr = [];
+      constructor(opts, log) {
+        super();
+        this.log = log;
+        const args = ["acp", "--trust-all-tools"];
+        if (opts.agent) args.push("--agent", opts.agent);
+        if (opts.model) args.push("--model", opts.model);
+        this.log.info({ bin: config.kiroBin, args, cwd: opts.cwd }, "spawning kiro-cli acp");
+        this.child = spawn(config.kiroBin, args, {
+          cwd: opts.cwd,
+          stdio: ["pipe", "pipe", "pipe"],
+          env: { ...process.env }
+        });
+        this.client = new AcpClient(this.child.stdout, this.child.stdin, log);
+        this.client.on("notification", (n) => {
+          this.emit("notification", n);
+        });
+        this.client.on("serverRequest", (req) => {
+          this.log.debug({ method: req.method }, "acp: unhandled server request");
+          this.client.respond(req.id, {});
+        });
+        this.child.stderr.pipe(split22()).on("data", (line) => {
+          if (!line.trim()) return;
+          this.log.debug({ stderr: line }, "kiro-cli stderr");
+          this.recentStderr.push(line.trim());
+          if (this.recentStderr.length > STDERR_KEEP) this.recentStderr.shift();
+        });
+        this.child.on("exit", (code2, signal) => {
+          this.client.fail(this.exitReason(code2, signal));
+          if (!this.disposed) {
+            this.log.warn({ code: code2, signal }, "kiro-cli acp exited unexpectedly");
+          }
+          this.emit("exit", code2, signal);
+        });
+        this.child.on("error", (err) => {
+          this.log.error({ err }, "kiro-cli acp spawn error");
+          this.client.fail(err.message);
+        });
+        this.child.stdin.on("error", () => {
+        });
+        this.child.stdout.on("error", () => {
+        });
+      }
+      /** Perform the ACP initialize handshake. Idempotent. */
+      async initialize() {
+        const result = await this.client.request(ACP_METHODS.initialize, {
+          protocolVersion: 1,
+          clientCapabilities: {
+            fs: { readTextFile: false, writeTextFile: false },
+            terminal: false
+          },
+          // Informational only - kiro logs it and nothing reads it back, so it isn't
+          // worth wiring to package.json.
+          clientInfo: { name: "casper", version: "0.5.0" }
+        });
+        return result;
+      }
+      newSession(params) {
+        return this.client.request(ACP_METHODS.sessionNew, params);
+      }
+      loadSession(params) {
+        return this.client.request(ACP_METHODS.sessionLoad, params);
+      }
+      /** Run a prompt turn to completion. Resolves with the stop reason. */
+      prompt(params) {
+        return this.client.request(
+          ACP_METHODS.sessionPrompt,
+          params,
+          0
+        );
+      }
+      cancel(sessionId) {
+        this.client.notify(ACP_METHODS.sessionCancel, { sessionId });
+      }
+      setMode(sessionId, modeId) {
+        return this.client.request(ACP_METHODS.sessionSetMode, { sessionId, modeId });
+      }
+      setModel(sessionId, modelId) {
+        return this.client.request(ACP_METHODS.sessionSetModel, { sessionId, modelId });
+      }
+      execCommand(sessionId, command, args) {
+        return this.client.request(ACP_METHODS.commandsExecute, {
+          sessionId,
+          command: { command: command.replace(/^\//, ""), args: args ? { input: args } : {} }
+        });
+      }
+      /** Cleanly shut down: close stdin (triggers kiro's graceful exit), then kill. */
+      /**
+       * Recent stderr from kiro, for attaching to a failure.
+       *
+       * A failed request doesn't always carry its cause in the JSON-RPC error - when
+       * it doesn't, kiro has usually written something here. Shared across turns, so
+       * treat it as context rather than proof.
+       */
+      stderrTail() {
+        return this.recentStderr.join("\n").trim();
+      }
+      /**
+       * Why the child died, in terms a user can act on. The exit code alone is
+       * opaque, so append what kiro printed - that's where "credentials have
+       * expired, run kiro-cli login" and friends show up.
+       */
+      exitReason(code2, signal) {
+        const base = signal ? `kiro-cli exited on ${signal}` : `kiro-cli exited with code ${code2}`;
+        const tail = this.recentStderr.join("\n").trim();
+        return tail ? `${base}: ${tail}` : base;
+      }
+      dispose() {
+        if (this.disposed) return;
+        this.disposed = true;
+        try {
+          this.child.stdin.end();
+        } catch {
+        }
+        setTimeout(() => {
+          if (this.child.exitCode === null) this.child.kill("SIGTERM");
+        }, 1e3).unref();
+      }
+      /**
+       * Dispose and resolve once the child has actually exited. kiro writes its
+       * session file on shutdown, so a caller that then deletes those files must
+       * wait for exit first, or kiro's write recreates them.
+       */
+      disposeAndWait(timeoutMs = 4e3) {
+        if (this.child.exitCode !== null) {
+          this.dispose();
+          return Promise.resolve();
+        }
+        return new Promise((resolve) => {
+          let settled = false;
+          const finish = () => {
+            if (settled) return;
+            settled = true;
+            resolve();
+          };
+          this.child.once("exit", finish);
+          this.dispose();
+          setTimeout(finish, timeoutMs).unref();
+        });
+      }
+    };
+  }
+});
+
+// server/src/session/EventStore.ts
+import { EventEmitter as EventEmitter3 } from "node:events";
+var EventStore;
+var init_EventStore = __esm({
+  "server/src/session/EventStore.ts"() {
+    "use strict";
+    init_config();
+    EventStore = class extends EventEmitter3 {
+      sessionId;
+      buffer = [];
+      capacity;
+      seq = 0;
+      constructor(sessionId) {
+        super();
+        this.sessionId = sessionId;
+        this.capacity = config.eventBufferSize;
+      }
+      /** Append an event, assign it the next seq, and fan it out. */
+      append(payload) {
+        this.seq += 1;
+        const event = {
+          seq: this.seq,
+          ts: Date.now(),
+          sessionId: this.sessionId,
+          payload
+        };
+        this.buffer.push(event);
+        if (this.buffer.length > this.capacity) this.buffer.shift();
+        this.emit("event", event);
+        return event;
+      }
+      /** Highest assigned seq. Clients start their cursor here after a full refetch. */
+      head() {
+        return this.seq;
+      }
+      /** Oldest seq still in the buffer (0 if empty). */
+      tail() {
+        return this.buffer.length > 0 ? this.buffer[0].seq : 0;
+      }
+      /**
+       * Events with seq > cursor, in order. Returns { events, gap } - gap is true
+       * when the cursor is older than the buffer tail, meaning some events were
+       * evicted and the client must resync (full transcript refetch).
+       */
+      getSince(cursor) {
+        if (this.buffer.length === 0) {
+          return { events: [], gap: cursor > 0 };
+        }
+        const tail = this.tail();
+        const gap = cursor > 0 && cursor < tail - 1;
+        const events = this.buffer.filter((e) => e.seq > cursor);
+        return { events, gap };
+      }
+      dispose() {
+        this.removeAllListeners();
+      }
+    };
+  }
+});
+
+// server/src/session/TurnState.ts
+var TurnState;
+var init_TurnState = __esm({
+  "server/src/session/TurnState.ts"() {
+    "use strict";
+    init_dist();
+    TurnState = class {
+      snapshot = emptyObservabilitySnapshot();
+      get() {
+        return this.snapshot;
+      }
+      /** Apply one event; returns the updated snapshot. */
+      apply(payload) {
+        const s = this.snapshot;
+        switch (payload.kind) {
+          case "turn_started": {
+            this.snapshot = { ...s, turnStatus: "running", currentTurnStartedAt: Date.now() };
+            break;
+          }
+          case "turn_ended": {
+            this.snapshot = { ...s, turnStatus: "idle", currentTurnStartedAt: void 0 };
+            break;
+          }
+          case "turn_error": {
+            this.snapshot = { ...s, turnStatus: "idle", currentTurnStartedAt: void 0 };
+            break;
+          }
+          case "process_exited": {
+            this.snapshot = { ...s, turnStatus: "idle", currentTurnStartedAt: void 0 };
+            break;
+          }
+          case "metadata": {
+            const p = payload.params;
+            const turnCredits = (p.meteringUsage ?? []).reduce((sum, m) => sum + m.value, 0);
+            this.snapshot = {
+              ...s,
+              contextUsagePercentage: p.contextUsagePercentage ?? s.contextUsagePercentage,
+              // meteringUsage is emitted per-turn; accumulate into the session total.
+              creditsSpent: turnCredits > 0 ? s.creditsSpent + turnCredits : s.creditsSpent,
+              lastTurnCredits: turnCredits > 0 ? turnCredits : s.lastTurnCredits,
+              lastTurnDurationMs: p.turnDurationMs ?? s.lastTurnDurationMs
+            };
+            break;
+          }
+          case "subagent_update": {
+            this.snapshot = {
+              ...s,
+              subagents: payload.params.subagents,
+              pendingStages: payload.params.pendingStages
+            };
+            break;
+          }
+          case "mcp_health": {
+            const { serverName, error } = payload.params;
+            const status = payload.ok ? "initialized" : "failed";
+            const next = s.mcpServers.filter((m) => m.serverName !== serverName);
+            next.push({ serverName, status, error, updatedAt: Date.now() });
+            this.snapshot = { ...s, mcpServers: next };
+            break;
+          }
+          case "commands_available": {
+            this.snapshot = { ...s, availableCommands: payload.params.commands };
+            break;
+          }
+          case "compaction": {
+            this.snapshot = { ...s, compacting: payload.params.status.type === "started" };
+            break;
+          }
+          case "oauth_request": {
+            const prompts = [
+              ...s.oauthPrompts,
+              {
+                serverName: payload.params.serverName,
+                url: payload.params.url,
+                createdAt: Date.now()
+              }
+            ];
+            this.snapshot = { ...s, oauthPrompts: prompts };
+            break;
+          }
+          default:
+            break;
+        }
+        return this.snapshot;
+      }
+      /** Seed cumulative credits/context from kiro's persisted metadata on resume. */
+      seed(creditsSpent, contextUsagePercentage) {
+        this.snapshot = { ...this.snapshot, creditsSpent, contextUsagePercentage };
+      }
+    };
+  }
+});
+
+// server/src/session/kiroFiles.ts
+import fs7 from "node:fs/promises";
+import path8 from "node:path";
+function isContentBlock(v) {
+  return isRecord(v) && typeof v.kind === "string";
+}
+function toolUseData(b) {
+  if (b.kind !== "toolUse" || !isRecord(b.data)) return null;
+  const { toolUseId, name, input } = b.data;
+  if (typeof toolUseId !== "string") return null;
+  return { toolUseId, name: typeof name === "string" ? name : void 0, input };
+}
+function toolResultData(b) {
+  if (b.kind !== "toolResult" || !isRecord(b.data)) return null;
+  const { toolUseId, status, content } = b.data;
+  if (typeof toolUseId !== "string") return null;
+  return { toolUseId, status: typeof status === "string" ? status : void 0, content };
+}
+function contentBlocks(content) {
+  return Array.isArray(content) ? content.filter(isContentBlock) : [];
+}
+function blockText(c) {
+  if (typeof c.data === "string") return c.data;
+  if (isRecord(c.data) && typeof c.data.text === "string") return c.data.text;
+  return "";
+}
+function renderableBlocks(content) {
+  return contentBlocks(content).filter((b) => b.kind !== "image");
+}
+function summarize(j) {
+  const state = j.session_state;
+  const turns = state?.conversation_metadata?.user_turn_metadatas ?? [];
+  const creditsSpent = turns.reduce(
+    (sum, t) => sum + (t.metering_usage ?? []).reduce((a, m) => a + m.value, 0),
+    0
+  );
+  const contextUsagePercentage = state?.rts_model_state?.context_usage_percentage ?? turns[turns.length - 1]?.context_usage_percentage;
+  return {
+    sessionId: j.session_id,
+    title: j.title?.trim() || "Untitled session",
+    cwd: j.cwd,
+    createdAt: j.created_at,
+    updatedAt: j.updated_at,
+    liveness: "dormant",
+    agentId: state?.agent_name,
+    modelId: state?.rts_model_state?.model_info?.model_id,
+    running: false,
+    creditsSpent,
+    contextUsagePercentage
+  };
+}
+async function listPersistedSessions(log) {
+  let files;
+  try {
+    files = await fs7.readdir(config.kiroSessionsDir);
+  } catch {
+    return [];
+  }
+  const jsonFiles = files.filter((f) => f.endsWith(".json"));
+  const summaries = [];
+  await Promise.all(
+    jsonFiles.map(async (f) => {
+      try {
+        const raw = await fs7.readFile(path8.join(config.kiroSessionsDir, f), "utf8");
+        summaries.push(summarize(JSON.parse(raw)));
+      } catch (err) {
+        log.debug({ err, f }, "kiroFiles: skipping unreadable session file");
+      }
+    })
+  );
+  summaries.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+  return summaries;
+}
+async function deletePersistedSession(sessionId) {
+  if (!isValidSessionId(sessionId)) return;
+  const targets = [
+    path8.join(config.kiroSessionsDir, `${sessionId}.json`),
+    path8.join(config.kiroSessionsDir, `${sessionId}.jsonl`),
+    path8.join(config.kiroSessionsDir, `${sessionId}.history`),
+    path8.join(config.kiroSessionsDir, sessionId)
+  ];
+  await Promise.all(targets.map((f) => fs7.rm(f, { recursive: true, force: true })));
+}
+async function readPersistedSession(sessionId) {
+  if (!isValidSessionId(sessionId)) return null;
+  try {
+    const raw = await fs7.readFile(
+      path8.join(config.kiroSessionsDir, `${sessionId}.json`),
+      "utf8"
+    );
+    return summarize(JSON.parse(raw));
+  } catch {
+    return null;
+  }
+}
+async function hydrateTranscript(sessionId) {
+  if (!isValidSessionId(sessionId)) return [];
+  let raw;
+  try {
+    raw = await fs7.readFile(
+      path8.join(config.kiroSessionsDir, `${sessionId}.jsonl`),
+      "utf8"
+    );
+  } catch {
+    return [];
+  }
+  const items = [];
+  const toolsById = /* @__PURE__ */ new Map();
+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let entry;
+    try {
+      entry = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const content = contentBlocks(entry.data.content);
+    const textOf = (kind) => content.filter((c) => c.kind === kind).map(blockText).join("");
+    const baseId = entry.data.message_id ?? `${items.length}`;
+    const ts = entry.data.meta?.timestamp;
+    const pushMsg = (msg) => items.push({ type: "message", message: msg });
+    if (entry.kind === "Prompt") {
+      const raw2 = textOf("text");
+      const text = stripAttachmentsLine(raw2);
+      const imagePaths = imageAttachmentPaths(raw2);
+      if (text.trim() || imagePaths.length)
+        pushMsg({ id: `u-${baseId}`, role: "user", text, timestamp: ts, imagePaths });
+    } else if (entry.kind === "AssistantMessage") {
+      const thinking = textOf("thinking");
+      if (thinking.trim())
+        pushMsg({ id: `t-${baseId}`, role: "thinking", text: thinking, timestamp: ts });
+      const text = textOf("text");
+      if (text.trim())
+        pushMsg({ id: `a-${baseId}`, role: "assistant", text, timestamp: ts });
+      for (const c of content) {
+        const d = toolUseData(c);
+        if (!d) continue;
+        const tool = {
+          id: d.toolUseId,
+          name: d.name,
+          title: d.name ?? d.toolUseId,
+          status: "completed",
+          input: d.input,
+          content: []
+        };
+        toolsById.set(d.toolUseId, tool);
+        items.push({ type: "tool_call", tool });
+      }
+    } else if (entry.kind === "ToolResults") {
+      for (const c of content) {
+        const d = toolResultData(c);
+        if (!d) continue;
+        const tool = toolsById.get(d.toolUseId);
+        if (!tool) continue;
+        tool.status = d.status === "error" ? "failed" : "completed";
+        tool.content = renderableBlocks(d.content);
+      }
+    } else if (entry.kind === "Compaction") {
+      const summary = entry.data.summary ?? "";
+      if (summary.trim())
+        items.push({ type: "compaction", id: `c-${baseId}`, summary, timestamp: ts });
+    }
+  }
+  return items;
+}
+var isRecord;
+var init_kiroFiles = __esm({
+  "server/src/session/kiroFiles.ts"() {
+    "use strict";
+    init_dist();
+    init_config();
+    init_paths2();
+    isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+  }
+});
+
+// server/src/session/sessionStore.ts
+var SessionStore;
+var init_sessionStore = __esm({
+  "server/src/session/sessionStore.ts"() {
+    "use strict";
+    init_db();
+    SessionStore = class {
+      getTitle(sessionId) {
+        return this.read(sessionId, "title");
+      }
+      setTitle(sessionId, title) {
+        this.write(sessionId, "title", title);
+      }
+      getCwd(sessionId) {
+        return this.read(sessionId, "cwd");
+      }
+      setCwd(sessionId, cwd) {
+        this.write(sessionId, "cwd", cwd);
+      }
+      /** Forget every override for a session, when it's permanently deleted. */
+      remove(sessionId) {
+        db().prepare("DELETE FROM sessions WHERE session_id = ?").run(sessionId);
+      }
+      read(sessionId, column) {
+        const row = db().prepare(`SELECT ${column} AS value FROM sessions WHERE session_id = ?`).get(sessionId);
+        return row?.value ?? void 0;
+      }
+      write(sessionId, column, value) {
+        db().prepare(
+          `INSERT INTO sessions (session_id, ${column}) VALUES (?, ?)
+         ON CONFLICT(session_id) DO UPDATE SET ${column} = excluded.${column}`
+        ).run(sessionId, value);
+      }
+    };
+  }
+});
+
+// server/src/session/SessionManager.ts
+import fs8 from "node:fs";
+import path9 from "node:path";
+function resolveCwd(input) {
+  const raw = input?.trim();
+  const abs = raw ? path9.resolve(config.defaultCwd, raw) : config.defaultCwd;
+  if (!isWithinRoot(config.fileRoot, abs)) {
+    throw new Error(`Working directory is outside the allowed root: ${abs}`);
+  }
+  let stat;
+  try {
+    stat = fs8.statSync(abs);
+  } catch {
+    stat = void 0;
+  }
+  if (stat && !stat.isDirectory()) {
+    throw new Error(`Working directory path is a file, not a directory: ${abs}`);
+  }
+  if (!stat) {
+    fs8.mkdirSync(abs, { recursive: true });
+  }
+  return abs;
+}
+function mapNotification(n) {
+  switch (n.method) {
+    case "session/update":
+      return { kind: "session_update", update: n.params.update };
+    case KIRO_NOTIFICATIONS.metadata:
+      return { kind: "metadata", params: n.params };
+    case KIRO_NOTIFICATIONS.subagentListUpdate:
+      return { kind: "subagent_update", params: n.params };
+    case KIRO_NOTIFICATIONS.mcpServerInitialized:
+      return { kind: "mcp_health", params: n.params, ok: true };
+    case KIRO_NOTIFICATIONS.mcpServerInitFailure:
+      return { kind: "mcp_health", params: n.params, ok: false };
+    case KIRO_NOTIFICATIONS.commandsAvailable:
+      return { kind: "commands_available", params: n.params };
+    case KIRO_NOTIFICATIONS.compactionStatus:
+      return { kind: "compaction", params: n.params };
+    case KIRO_NOTIFICATIONS.mcpOauthRequest:
+      return { kind: "oauth_request", params: n.params };
+    default:
+      return null;
+  }
+}
+var Session, TRANSCRIPT_PAGE_SIZE, SessionManager;
+var init_SessionManager = __esm({
+  "server/src/session/SessionManager.ts"() {
+    "use strict";
+    init_dist();
+    init_config();
+    init_paths2();
+    init_KiroProcess();
+    init_EventStore();
+    init_TurnState();
+    init_kiroFiles();
+    init_sessionStore();
+    Session = class {
+      sessionId;
+      store;
+      turnState = new TurnState();
+      cwd;
+      agentId;
+      modelId;
+      currentModeId;
+      availableModes = [];
+      title = "New session";
+      createdAt = (/* @__PURE__ */ new Date()).toISOString();
+      updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      lastActivity = Date.now();
+      running = false;
+      // True once kiro has created or loaded this session id.
+      everLive = false;
+      proc;
+      // In-flight spawn, so concurrent actions share one process.
+      spawning;
+      // True while kiro is replaying history during session/load. The transcript is
+      // already hydrated from disk, so replayed notifications must not be appended
+      // to the live store (doing so floods the chat with duplicate tool calls).
+      replaying = false;
+      constructor(sessionId, store, cwd) {
+        this.sessionId = sessionId;
+        this.store = store;
+        this.cwd = cwd;
+      }
+      markLive() {
+        this.everLive = true;
+      }
+      get hasBeenLive() {
+        return this.everLive;
+      }
+      /**
+       * Single append path: fold the event into the live snapshot AND persist/fan
+       * it out. Using this everywhere keeps turnState in sync with the event log,
+       * so a client that refetches mid-turn sees turnStatus 'running' rather than
+       * a stale 'idle'.
+       */
+      record(payload) {
+        this.turnState.apply(payload);
+        return this.store.append(payload);
+      }
+    };
+    TRANSCRIPT_PAGE_SIZE = 80;
+    SessionManager = class {
+      sessions = /* @__PURE__ */ new Map();
+      log;
+      store = new SessionStore();
+      constructor(log) {
+        this.log = log;
+      }
+      /** Set a user title override for a session. */
+      renameSession(sessionId, title) {
+        this.store.setTitle(sessionId, title);
+        const s = this.sessions.get(sessionId);
+        if (s) s.title = title.trim() || s.title;
+      }
+      /**
+       * Re-point a session at a different working directory. A session's cwd is
+       * fixed at creation, so this is needed when the original folder was moved or
+       * deleted (the workspace endpoints and the kiro process are scoped to it).
+       *
+       * The target is validated and created exactly like a new session's cwd, so a
+       * folder is only created on this explicit action - never silently on resume.
+       * Any live kiro process was spawned with the old cwd, so it's disposed here;
+       * the next turn respawns in the new directory with the transcript intact
+       * (kiro reloads the session from its own file).
+       *
+       * Returns the resolved absolute path.
+       */
+      async setSessionCwd(sessionId, input) {
+        const resolved = resolveCwd(input);
+        const s = await this.ensureOpen(sessionId);
+        this.store.setCwd(sessionId, resolved);
+        if (s.cwd !== resolved) {
+          s.cwd = resolved;
+          s.proc?.dispose();
+          s.proc = void 0;
+          this.log.info({ sessionId, cwd: resolved }, "session working directory changed");
+        }
+        return resolved;
+      }
+      get liveCount() {
+        let n = 0;
+        for (const s of this.sessions.values()) if (s.proc) n++;
+        return n;
+      }
+      // -------------------------------------------------------------------------
+      // Event subscription - works for any opened session, spawned or not.
+      // -------------------------------------------------------------------------
+      onEvent(sessionId, cb) {
+        const s = this.sessions.get(sessionId);
+        if (!s) return null;
+        s.store.on("event", cb);
+        return () => s.store.off("event", cb);
+      }
+      getStore(sessionId) {
+        return this.sessions.get(sessionId)?.store;
+      }
+      /** Get a session's working directory. Opens the session in memory if needed. */
+      async getSessionCwd(sessionId) {
+        const s = await this.ensureOpen(sessionId);
+        return s.cwd;
+      }
+      /** Open a session in memory (store + metadata) WITHOUT spawning a process. */
+      async ensureOpen(sessionId) {
+        const existing = this.sessions.get(sessionId);
+        if (existing) return existing;
+        const persisted = await readPersistedSession(sessionId);
+        if (!persisted) throw new Error(`Unknown session: ${sessionId}`);
+        const effectiveCwd = this.store.getCwd(sessionId) ?? persisted.cwd;
+        if (!isWithinRoot(config.fileRoot, effectiveCwd)) {
+          throw new Error(
+            `Session working directory is outside the allowed root: ${effectiveCwd}`
+          );
+        }
+        const store = new EventStore(sessionId);
+        const s = new Session(sessionId, store, effectiveCwd);
+        s.title = persisted.title;
+        s.agentId = persisted.agentId;
+        s.currentModeId = persisted.agentId;
+        s.modelId = persisted.modelId;
+        s.createdAt = persisted.createdAt;
+        s.updatedAt = persisted.updatedAt;
+        s.markLive();
+        s.turnState.seed(
+          persisted.creditsSpent ?? 0,
+          persisted.contextUsagePercentage ?? 0
+        );
+        this.sessions.set(sessionId, s);
+        return s;
+      }
+      // -------------------------------------------------------------------------
+      // Lazy process spawning
+      // -------------------------------------------------------------------------
+      wire(s, proc) {
+        proc.on("notification", (n) => {
+          if (s.replaying) return;
+          const payload = mapNotification(n);
+          if (!payload) return;
+          s.record(payload);
+        });
+        proc.on("exit", (code2, signal) => {
+          if (s.proc !== proc) return;
+          s.record({ kind: "process_exited", code: code2, signal });
+          s.proc = void 0;
+          s.running = false;
+        });
+      }
+      /** Get (or spawn + initialize + create/load) the kiro process for a session. */
+      async ensureProc(s) {
+        if (s.proc) return s.proc;
+        if (s.spawning) return s.spawning;
+        s.spawning = (async () => {
+          await this.ensureCapacity();
+          const proc = new KiroProcess(
+            { cwd: s.cwd, agent: s.agentId, model: s.modelId },
+            this.log
+          );
+          this.wire(s, proc);
+          await proc.initialize();
+          let res;
+          if (s.hasBeenLive) {
+            s.replaying = true;
+            try {
+              res = await proc.loadSession({ sessionId: s.sessionId, cwd: s.cwd, mcpServers: [] });
+            } finally {
+              s.replaying = false;
+            }
+          } else {
+            res = await proc.newSession({ cwd: s.cwd, mcpServers: [] });
+          }
+          if (!s.hasBeenLive && res.sessionId !== s.sessionId) {
+            this.sessions.delete(s.sessionId);
+            s.sessionId = res.sessionId;
+            this.sessions.set(res.sessionId, s);
+          }
+          s.availableModes = res.modes.availableModes;
+          s.currentModeId = res.modes.currentModeId;
+          s.agentId = res.modes.currentModeId ?? s.agentId;
+          s.markLive();
+          s.proc = proc;
+          s.spawning = void 0;
+          return proc;
+        })();
+        try {
+          return await s.spawning;
+        } catch (err) {
+          s.spawning = void 0;
+          throw err;
+        }
+      }
+      async ensureCapacity() {
+        const liveIds = [...this.sessions.values()].filter((s) => s.proc);
+        if (liveIds.length < config.maxLiveSessions) return;
+        let victim = null;
+        let oldest = Infinity;
+        for (const s of liveIds) {
+          if (!s.running && s.lastActivity < oldest) {
+            oldest = s.lastActivity;
+            victim = s;
+          }
+        }
+        if (victim) {
+          this.log.info({ sessionId: victim.sessionId }, "idle process evicted for capacity");
+          victim.proc?.dispose();
+          victim.proc = void 0;
+        } else {
+          this.log.warn("at capacity but all processes are busy");
+        }
+      }
+      // -------------------------------------------------------------------------
+      // Creating / opening
+      // -------------------------------------------------------------------------
+      /** Create a new session. Spawns immediately so we get a real kiro sessionId. */
+      async createSession(opts) {
+        const cwd = resolveCwd(opts.cwd);
+        const tempId = `pending-${Date.now()}-${Math.floor(this.sessions.size)}`;
+        const store = new EventStore(tempId);
+        const s = new Session(tempId, store, cwd);
+        s.agentId = opts.agentId ?? config.defaultAgent;
+        s.currentModeId = s.agentId;
+        s.modelId = opts.modelId;
+        this.sessions.set(tempId, s);
+        try {
+          await this.ensureProc(s);
+        } catch (err) {
+          this.evict(s.sessionId);
+          throw err;
+        }
+        const folder = path9.basename(s.cwd);
+        if (folder) {
+          this.store.setTitle(s.sessionId, folder);
+          s.title = folder;
+        }
+        return this.buildDetail(s, []);
+      }
+      // -------------------------------------------------------------------------
+      // Actions - these spawn the process lazily.
+      // -------------------------------------------------------------------------
+      async runPrompt(sessionId, content) {
+        const s = await this.ensureOpen(sessionId);
+        const proc = await this.ensureProc(s);
+        if (s.running) throw new Error("A turn is already running for this session");
+        s.running = true;
+        s.lastActivity = Date.now();
+        s.record({ kind: "turn_started", prompt: content });
+        proc.prompt({ sessionId: s.sessionId, prompt: content }).then((res) => s.record({ kind: "turn_ended", stopReason: res.stopReason })).catch((err) => {
+          this.log.error({ err, sessionId: s.sessionId }, "prompt turn failed");
+          const tail = proc.stderrTail();
+          const message = tail && !err.message.includes(tail) ? `${err.message}
+
+kiro-cli output:
+${tail}` : err.message;
+          s.record({ kind: "turn_error", message });
+        }).finally(() => {
+          s.running = false;
+          s.lastActivity = Date.now();
+        });
+      }
+      cancel(sessionId) {
+        const s = this.sessions.get(sessionId);
+        s?.proc?.cancel(s.sessionId);
+      }
+      async setMode(sessionId, modeId) {
+        const s = await this.ensureOpen(sessionId);
+        const proc = await this.ensureProc(s);
+        await proc.setMode(s.sessionId, modeId);
+        s.currentModeId = modeId;
+        s.agentId = modeId;
+        s.lastActivity = Date.now();
+      }
+      async setModel(sessionId, modelId) {
+        const s = await this.ensureOpen(sessionId);
+        const proc = await this.ensureProc(s);
+        await proc.setModel(s.sessionId, modelId);
+        s.modelId = modelId;
+        s.lastActivity = Date.now();
+      }
+      async execCommand(sessionId, command, args) {
+        const s = await this.ensureOpen(sessionId);
+        const proc = await this.ensureProc(s);
+        await proc.execCommand(s.sessionId, command, args);
+        s.lastActivity = Date.now();
+      }
+      // -------------------------------------------------------------------------
+      // Listing / detail - never spawns.
+      // -------------------------------------------------------------------------
+      async listSessions() {
+        const persisted = await listPersistedSessions(this.log);
+        const byId = /* @__PURE__ */ new Map();
+        for (const p of persisted) {
+          byId.set(p.sessionId, {
+            ...p,
+            title: this.store.getTitle(p.sessionId) ?? p.title,
+            cwd: this.store.getCwd(p.sessionId) ?? p.cwd
+          });
+        }
+        for (const s of this.sessions.values()) {
+          const snap = s.turnState.get();
+          const base = byId.get(s.sessionId);
+          byId.set(s.sessionId, {
+            sessionId: s.sessionId,
+            title: this.store.getTitle(s.sessionId) ?? base?.title ?? s.title,
+            cwd: s.cwd,
+            createdAt: base?.createdAt ?? s.createdAt,
+            updatedAt: base?.updatedAt ?? s.updatedAt,
+            liveness: s.proc ? "live" : "dormant",
+            agentId: s.agentId ?? base?.agentId,
+            modelId: s.modelId ?? base?.modelId,
+            running: s.running,
+            creditsSpent: snap.creditsSpent || base?.creditsSpent,
+            contextUsagePercentage: snap.contextUsagePercentage || base?.contextUsagePercentage
+          });
+        }
+        return [...byId.values()].sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+      }
+      async getDetail(sessionId) {
+        const transcript = await hydrateTranscript(sessionId);
+        const s = this.sessions.get(sessionId);
+        if (s) return this.buildDetail(s, transcript);
+        const persisted = await readPersistedSession(sessionId);
+        if (!persisted) throw new Error(`Unknown session: ${sessionId}`);
+        return {
+          summary: {
+            ...persisted,
+            title: this.store.getTitle(sessionId) ?? persisted.title,
+            cwd: this.store.getCwd(sessionId) ?? persisted.cwd
+          },
+          modes: [],
+          currentModeId: persisted.agentId,
+          transcript: transcript.slice(-TRANSCRIPT_PAGE_SIZE),
+          transcriptTotal: transcript.length,
+          observability: {
+            ...emptyObservabilitySnapshot(),
+            creditsSpent: persisted.creditsSpent ?? 0,
+            contextUsagePercentage: persisted.contextUsagePercentage ?? 0
+          },
+          head: 0
+        };
+      }
+      /**
+       * A slice of the transcript for lazy "load older on scroll up". Re-hydrates
+       * from disk (fast: ~150ms even for a multi-MB session) and returns the
+       * requested window. offset/limit are clamped to the transcript bounds.
+       */
+      async getTranscriptPage(sessionId, offset, limit) {
+        const transcript = await hydrateTranscript(sessionId);
+        const start = Math.max(0, Math.min(offset, transcript.length));
+        const end = Math.max(start, Math.min(start + limit, transcript.length));
+        return transcript.slice(start, end);
+      }
+      buildDetail(s, transcript) {
+        const snap = s.turnState.get();
+        const firstMessage = transcript.find((it) => it.type === "message");
+        const firstText = firstMessage?.type === "message" ? firstMessage.message.text : void 0;
+        return {
+          summary: {
+            sessionId: s.sessionId,
+            title: this.store.getTitle(s.sessionId) ?? (firstText?.slice(0, 60) || s.title),
+            cwd: s.cwd,
+            createdAt: s.createdAt,
+            updatedAt: s.updatedAt,
+            liveness: s.proc ? "live" : "dormant",
+            agentId: s.agentId,
+            modelId: s.modelId,
+            running: s.running,
+            creditsSpent: snap.creditsSpent,
+            contextUsagePercentage: snap.contextUsagePercentage
+          },
+          modes: s.availableModes,
+          currentModeId: s.currentModeId,
+          // Only the tail is sent on load; replayHead/title use the full transcript.
+          transcript: transcript.slice(-TRANSCRIPT_PAGE_SIZE),
+          transcriptTotal: transcript.length,
+          observability: snap,
+          head: this.replayHead(s, transcript)
+        };
+      }
+      /**
+       * The cursor a reconnecting client should start from. Normally the store
+       * head, but while a turn is in flight the prompt/response are not yet in
+       * kiro's persisted jsonl (kiro writes a turn only when it completes), so the
+       * hydrated transcript is missing them. Rewind to just before the in-flight
+       * turn_started so the WS replays the whole in-flight turn. Guarded against
+       * duplication in case kiro ever persists the prompt at turn start.
+       */
+      replayHead(s, transcript) {
+        const head = s.store.head();
+        if (!s.running) return head;
+        const { events } = s.store.getSince(0);
+        let started;
+        for (let i = events.length - 1; i >= 0; i--) {
+          if (events[i].payload.kind === "turn_started") {
+            started = events[i];
+            break;
+          }
+        }
+        if (!started || started.payload.kind !== "turn_started") return head;
+        const promptText = stripAttachmentsLine(
+          started.payload.prompt.filter((b) => b.type === "text").map((b) => b.text).join("")
+        ).trim();
+        for (let i = transcript.length - 1; i >= 0; i--) {
+          const it = transcript[i];
+          if (it.type === "message" && it.message.role === "user") {
+            if (promptText && it.message.text.trim() === promptText) return head;
+            break;
+          }
+        }
+        return started.seq - 1;
+      }
+      // -------------------------------------------------------------------------
+      // Teardown
+      // -------------------------------------------------------------------------
+      evict(sessionId) {
+        const s = this.sessions.get(sessionId);
+        if (!s) return;
+        this.sessions.delete(sessionId);
+        s.proc?.dispose();
+        s.store.dispose();
+      }
+      // Permanently delete a session: evict it from memory, remove its on-disk
+      // files, and drop any title override.
+      async deleteSession(sessionId) {
+        const s = this.sessions.get(sessionId);
+        if (s?.proc) {
+          await s.proc.disposeAndWait().catch(() => {
+          });
+          s.proc = void 0;
+          s.running = false;
+        }
+        this.evict(sessionId);
+        this.store.remove(sessionId);
+        await deletePersistedSession(sessionId);
+        setTimeout(() => void deletePersistedSession(sessionId).catch(() => {
+        }), 2500).unref?.();
+      }
+      disposeAll() {
+        for (const id of [...this.sessions.keys()]) this.evict(id);
+      }
+    };
+  }
+});
+
+// server/src/util/rateLimit.ts
+var AttemptLimiter;
+var init_rateLimit = __esm({
+  "server/src/util/rateLimit.ts"() {
+    "use strict";
+    AttemptLimiter = class {
+      constructor(max, windowMs) {
+        this.max = max;
+        this.windowMs = windowMs;
+      }
+      hits = /* @__PURE__ */ new Map();
+      /** Whether this key may attempt again, and how long to wait if not. */
+      check(key, now = Date.now()) {
+        this.prune(now);
+        const hit = this.hits.get(key);
+        if (!hit || hit.count < this.max) return { allowed: true };
+        return { allowed: false, retryAfterSeconds: Math.ceil((hit.resetAt - now) / 1e3) };
+      }
+      /** Record a failure, starting a fresh window if the previous one has expired. */
+      fail(key, now = Date.now()) {
+        this.prune(now);
+        const hit = this.hits.get(key);
+        if (!hit) {
+          this.hits.set(key, { count: 1, resetAt: now + this.windowMs });
+          return;
+        }
+        hit.count += 1;
+      }
+      /** Forget a key's failures, called after a successful attempt. */
+      succeed(key) {
+        this.hits.delete(key);
+      }
+      /**
+       * Drop expired entries. Without this the map grows with every distinct source
+       * address, which would turn the defence into a memory leak.
+       */
+      prune(now) {
+        for (const [key, hit] of this.hits) {
+          if (hit.resetAt <= now) this.hits.delete(key);
+        }
+      }
+    };
+  }
+});
+
+// server/src/routes/auth.ts
+import crypto3 from "node:crypto";
+import fastifyCookie from "@fastify/cookie";
+function secretMatches(supplied, expected) {
+  if (typeof supplied !== "string") return false;
+  const a = crypto3.createHash("sha256").update(supplied).digest();
+  const b = crypto3.createHash("sha256").update(expected).digest();
+  return crypto3.timingSafeEqual(a, b);
+}
+function extractToken(req) {
+  const auth = req.headers["authorization"];
+  if (typeof auth === "string" && auth.startsWith("Bearer ")) {
+    return auth.slice("Bearer ".length).trim();
+  }
+  const q = req.query;
+  if (q?.token) return q.token;
+  return void 0;
+}
+function authDisabled() {
+  return !config.token;
+}
+function sessionToken(req) {
+  return req.cookies?.[SESSION_COOKIE];
+}
+function hasValidSession(req) {
+  return logins.verify(sessionToken(req)) !== null;
+}
+function cookieOptions() {
+  return {
+    path: "/",
+    httpOnly: true,
+    sameSite: "lax",
+    secure: "auto",
+    maxAge: config.sessionTtlSeconds
+  };
+}
+async function registerAuth(app) {
+  await app.register(fastifyCookie);
+  app.post("/api/login", async (req, reply) => {
+    if (!authDisabled()) {
+      const limit = loginLimiter.check(req.ip);
+      if (!limit.allowed) {
+        return reply.code(429).header("retry-after", String(limit.retryAfterSeconds)).send({ error: `Too many attempts; try again in ${limit.retryAfterSeconds}s` });
+      }
+      const body = req.body ?? {};
+      const supplied = body.token ?? extractToken(req);
+      if (!secretMatches(supplied, config.token)) {
+        loginLimiter.fail(req.ip);
+        return reply.code(401).send({ error: "Invalid token" });
+      }
+      loginLimiter.succeed(req.ip);
+    }
+    const ua = req.headers["user-agent"];
+    const { token } = logins.create(typeof ua === "string" ? ua : void 0);
+    reply.setCookie(SESSION_COOKIE, token, cookieOptions());
+    return { ok: true };
+  });
+  app.post("/api/logout", async (req, reply) => {
+    logins.revokeToken(sessionToken(req));
+    reply.clearCookie(SESSION_COOKIE, { path: "/" });
+    return { ok: true };
+  });
+  app.get("/api/devices", async (req) => {
+    return { devices: logins.list(sessionToken(req)) };
+  });
+  app.delete("/api/devices/:id", async (req, reply) => {
+    const { id } = req.params;
+    const current = logins.list(sessionToken(req)).find((d) => d.current);
+    const removed = logins.revokeId(id);
+    if (current?.id === id) reply.clearCookie(SESSION_COOKIE, { path: "/" });
+    return { ok: removed };
+  });
+  app.post("/api/logout-all", async (_req, reply) => {
+    logins.revokeAll();
+    reply.clearCookie(SESSION_COOKIE, { path: "/" });
+    return { ok: true };
+  });
+  app.addHook("onRequest", async (req, reply) => {
+    if (!req.url.startsWith("/api/")) return;
+    if (req.url === "/api/health" || req.url === "/api/login") return;
+    if (authDisabled()) return;
+    if (hasValidSession(req)) return;
+    reply.code(401).send({ error: "Unauthorized: log in first" });
+  });
+}
+var SESSION_COOKIE, logins, loginLimiter;
+var init_auth = __esm({
+  "server/src/routes/auth.ts"() {
+    "use strict";
+    init_config();
+    init_logins();
+    init_rateLimit();
+    SESSION_COOKIE = "casper.sid";
+    logins = new LoginStore();
+    loginLimiter = new AttemptLimiter(10, 15 * 60 * 1e3);
+  }
+});
+
+// server/src/session/models.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+async function listModels(log) {
+  if (cache) return cache;
+  const { stdout } = await execFileAsync(
+    config.kiroBin,
+    ["chat", "--list-models", "-f", "json"],
+    { maxBuffer: 4 * 1024 * 1024 }
+  );
+  const parsed = JSON.parse(stdout);
+  cache = parsed.models.map((m, i) => ({
+    modelId: m.model_id,
+    modelName: m.model_name,
+    description: m.description,
+    contextWindowTokens: m.context_window_tokens,
+    rateMultiplier: m.rate_multiplier,
+    rateUnit: m.rate_unit,
+    isDefault: m.default_model ?? i === 0
+  }));
+  log.info({ count: cache.length }, "loaded model list");
+  return cache;
+}
+async function kiroVersion() {
+  try {
+    const { stdout } = await execFileAsync(config.kiroBin, ["--version"]);
+    return stdout.trim();
+  } catch {
+    return void 0;
+  }
+}
+var execFileAsync, cache;
+var init_models = __esm({
+  "server/src/session/models.ts"() {
+    "use strict";
+    init_config();
+    execFileAsync = promisify(execFile);
+    cache = null;
+  }
+});
+
+// server/src/routes/models.ts
+function registerModelRoutes(app) {
+  app.get("/api/models", async () => {
+    const models = await listModels(app.log);
+    return { models };
+  });
+}
+var init_models2 = __esm({
+  "server/src/routes/models.ts"() {
+    "use strict";
+    init_models();
+  }
+});
+
+// server/src/session/agents.ts
+import { execFile as execFile2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+async function listAgents() {
+  if (cache2) return cache2;
+  const found = /* @__PURE__ */ new Map();
+  for (const b of BUILTIN) found.set(b.id, b);
+  try {
+    const { stdout, stderr } = await execFileAsync2(config.kiroBin, ["agent", "list"], {
+      cwd: config.defaultCwd,
+      maxBuffer: 2 * 1024 * 1024
+    });
+    const text = (stderr || "") + "\n" + (stdout || "");
+    for (const rawLine of text.split("\n")) {
+      const line = rawLine.replace(ANSI, "");
+      const m = /^\s{0,2}(\*\s)?([A-Za-z0-9_-]+)\s{2,}(Global|Workspace|Local)\b/.exec(
+        line
+      );
+      if (!m) continue;
+      const id = m[2];
+      if (!found.has(id)) found.set(id, { id, name: id });
+    }
+  } catch {
+  }
+  cache2 = [...found.values()];
+  return cache2;
+}
+var execFileAsync2, BUILTIN, cache2, ANSI;
+var init_agents = __esm({
+  "server/src/session/agents.ts"() {
+    "use strict";
+    init_config();
+    execFileAsync2 = promisify2(execFile2);
+    BUILTIN = [
+      { id: "kiro_default", name: "kiro_default", description: "General-purpose Kiro agent" },
+      { id: "kiro_planner", name: "kiro_planner", description: "Planning-focused agent" },
+      { id: "kiro_guide", name: "kiro_guide", description: "Guidance and Q&A agent" }
+    ];
+    cache2 = null;
+    ANSI = /\x1b\[[0-9;]*m/g;
+  }
+});
+
+// server/src/routes/agents.ts
+function registerAgentRoutes(app) {
+  app.get("/api/agents", async () => {
+    return { agents: await listAgents(), defaultAgentId: config.defaultAgent };
+  });
+}
+var init_agents2 = __esm({
+  "server/src/routes/agents.ts"() {
+    "use strict";
+    init_agents();
+    init_config();
+  }
+});
+
+// server/src/routes/fs.ts
+import fs9 from "node:fs/promises";
+import { createReadStream } from "node:fs";
+import path10 from "node:path";
+function confinedPath(input) {
+  return confineToRoot(config.fileRoot, input);
+}
+function registerFsRoutes(app) {
+  app.get(
+    "/api/fs/dirs",
+    async (req, reply) => {
+      const input = (req.query.path ?? "").trim();
+      const base = config.defaultCwd;
+      const endsWithSep = input.endsWith("/");
+      const resolved = input ? path10.resolve(base, input) : base;
+      const dir = endsWithSep || !input ? resolved : path10.dirname(resolved);
+      const prefix = endsWithSep || !input ? "" : path10.basename(resolved);
+      const targetKind = await fs9.stat(resolved).then((s) => s.isDirectory() ? "directory" : "file").catch(() => "missing");
+      if (confinedPath(dir) === null) {
+        reply.code(403);
+        return { error: "Path outside allowed root" };
+      }
+      const realDir = await realConfineToRoot(config.fileRoot, dir);
+      if (!realDir) {
+        return { dir, entries: [], target: resolved, targetKind };
+      }
+      let entries = [];
+      try {
+        const dirents = await fs9.readdir(realDir, { withFileTypes: true });
+        const candidates = dirents.filter((d) => !d.name.startsWith("."));
+        const checks2 = await Promise.all(
+          candidates.map(async (d) => {
+            if (d.isDirectory()) return d.name;
+            if (!d.isSymbolicLink()) return null;
+            const full = path10.join(realDir, d.name);
+            const real = await realConfineToRoot(config.fileRoot, full);
+            if (!real) return null;
+            try {
+              return (await fs9.stat(real)).isDirectory() ? d.name : null;
+            } catch {
+              return null;
+            }
+          })
+        );
+        entries = checks2.filter((name) => name !== null).filter((name) => name.toLowerCase().startsWith(prefix.toLowerCase())).sort((a, b) => a.localeCompare(b)).slice(0, 20).map((name) => path10.join(dir, name));
+      } catch {
+        entries = [];
+      }
+      return { dir, entries, target: resolved, targetKind };
+    }
+  );
+  app.get(
+    "/api/fs/image",
+    async (req, reply) => {
+      const filePath = (req.query.path ?? "").trim();
+      if (!filePath) {
+        reply.code(400);
+        return { error: "path parameter is required" };
+      }
+      if (!path10.isAbsolute(filePath)) {
+        reply.code(400);
+        return { error: "path must be absolute" };
+      }
+      const resolved = confinedPath(filePath);
+      if (resolved === null) {
+        reply.code(403);
+        return { error: "Path outside allowed root" };
+      }
+      const ext = path10.extname(resolved).toLowerCase();
+      const mime = IMAGE_MIMES[ext];
+      if (!mime) {
+        reply.code(400);
+        return { error: `Not a supported image type: ${ext}` };
+      }
+      const real = await realConfineToRoot(config.fileRoot, resolved);
+      if (!real) {
+        reply.code(404);
+        return { error: "File not found" };
+      }
+      let stat;
+      try {
+        stat = await fs9.stat(real);
+      } catch {
+        reply.code(404);
+        return { error: "File not found" };
+      }
+      if (!stat.isFile()) {
+        reply.code(400);
+        return { error: "Path is not a file" };
+      }
+      if (stat.size > MAX_IMAGE_BYTES) {
+        reply.code(413);
+        return { error: "Image too large" };
+      }
+      const etag = `W/"${stat.size}-${stat.mtimeMs}"`;
+      reply.header("Cache-Control", "private, max-age=3600");
+      reply.header("ETag", etag);
+      reply.header("Last-Modified", stat.mtime.toUTCString());
+      if (req.headers["if-none-match"] === etag) {
+        reply.code(304);
+        return reply.send();
+      }
+      reply.header("Content-Type", mime);
+      reply.header("Content-Length", stat.size);
+      return reply.send(createReadStream(real));
+    }
+  );
+}
+var IMAGE_MIMES, MAX_IMAGE_BYTES;
+var init_fs = __esm({
+  "server/src/routes/fs.ts"() {
+    "use strict";
+    init_config();
+    init_paths2();
+    IMAGE_MIMES = {
+      ".png": "image/png",
+      ".jpg": "image/jpeg",
+      ".jpeg": "image/jpeg",
+      ".gif": "image/gif",
+      ".webp": "image/webp",
+      ".svg": "image/svg+xml",
+      ".bmp": "image/bmp",
+      ".ico": "image/x-icon",
+      ".avif": "image/avif"
+    };
+    MAX_IMAGE_BYTES = 20 * 1024 * 1024;
+  }
+});
+
+// server/src/routes/sessions.ts
+function registerSessionRoutes(app, manager) {
+  app.get("/api/sessions", async () => {
+    return { sessions: await manager.listSessions() };
+  });
+  app.post("/api/sessions", async (req, reply) => {
+    const body = req.body ?? {};
+    try {
+      return await manager.createSession({
+        cwd: body.cwd,
+        agentId: body.agentId,
+        modelId: body.modelId
+      });
+    } catch (err) {
+      reply.code(400);
+      return { error: err.message };
+    }
+  });
+  app.get("/api/sessions/:id", async (req, reply) => {
+    try {
+      return await manager.getDetail(req.params.id);
+    } catch (err) {
+      reply.code(404);
+      return { error: err.message };
+    }
+  });
+  app.get(
+    "/api/sessions/:id/transcript",
+    async (req, reply) => {
+      const offset = Number.parseInt(req.query.offset ?? "", 10);
+      const limit = Number.parseInt(req.query.limit ?? "", 10);
+      if (!Number.isFinite(offset) || offset < 0 || !Number.isFinite(limit) || limit <= 0) {
+        reply.code(400);
+        return { error: "offset (>=0) and limit (>0) are required" };
+      }
+      try {
+        return { items: await manager.getTranscriptPage(req.params.id, offset, limit) };
+      } catch (err) {
+        reply.code(404);
+        return { error: err.message };
+      }
+    }
+  );
+  app.post(
+    "/api/sessions/:id/prompt",
+    async (req, reply) => {
+      try {
+        await manager.runPrompt(req.params.id, req.body.prompt);
+        return { ok: true };
+      } catch (err) {
+        reply.code(400);
+        return { error: err.message };
+      }
+    }
+  );
+  app.post("/api/sessions/:id/cancel", async (req) => {
+    manager.cancel(req.params.id);
+    return { ok: true };
+  });
+  app.post(
+    "/api/sessions/:id/model",
+    async (req) => {
+      await manager.setModel(req.params.id, req.body.modelId);
+      return { ok: true };
+    }
+  );
+  app.post(
+    "/api/sessions/:id/mode",
+    async (req) => {
+      await manager.setMode(req.params.id, req.body.modeId);
+      return { ok: true };
+    }
+  );
+  app.post(
+    "/api/sessions/:id/rename",
+    async (req) => {
+      manager.renameSession(req.params.id, req.body.title);
+      return { ok: true };
+    }
+  );
+  app.post(
+    "/api/sessions/:id/cwd",
+    async (req, reply) => {
+      const cwd = (req.body?.cwd ?? "").trim();
+      if (!cwd) {
+        reply.code(400);
+        return { error: "cwd is required" };
+      }
+      try {
+        return { ok: true, cwd: await manager.setSessionCwd(req.params.id, cwd) };
+      } catch (err) {
+        reply.code(400);
+        return { error: err.message };
+      }
+    }
+  );
+  app.delete("/api/sessions/:id", async (req) => {
+    await manager.deleteSession(req.params.id);
+    return { ok: true };
+  });
+}
+var init_sessions = __esm({
+  "server/src/routes/sessions.ts"() {
+    "use strict";
+  }
+});
+
+// server/src/util/filekind.ts
+import path11 from "node:path";
+function mimeForExt(ext) {
+  return MIME_MAP[ext.toLowerCase()] ?? "application/octet-stream";
+}
+function looksBinary(buf) {
+  if (buf.length === 0) return false;
+  if (buf.length >= 2) {
+    const b0 = buf[0];
+    const b1 = buf[1];
+    if (b0 === 255 && b1 === 254 || b0 === 254 && b1 === 255) return true;
+  }
+  let control = 0;
+  for (let i = 0; i < buf.length; i++) {
+    const b = buf[i];
+    if (b === 0) return true;
+    if (b < 32 && b !== 9 && b !== 10 && b !== 12 && b !== 13) control++;
+  }
+  return control / buf.length > 0.3;
+}
+function classifyKind(name) {
+  const ext = path11.extname(name).toLowerCase();
+  if (ext in IMAGE_EXTS2) return "image";
+  if (TEXT_EXTS.has(ext)) return "text";
+  return "binary";
+}
+var IMAGE_EXTS2, TEXT_EXTS, MIME_MAP;
+var init_filekind = __esm({
+  "server/src/util/filekind.ts"() {
+    "use strict";
+    IMAGE_EXTS2 = {
+      ".png": "image/png",
+      ".jpg": "image/jpeg",
+      ".jpeg": "image/jpeg",
+      ".gif": "image/gif",
+      ".webp": "image/webp",
+      ".svg": "image/svg+xml",
+      ".bmp": "image/bmp",
+      ".ico": "image/x-icon",
+      ".avif": "image/avif"
+    };
+    TEXT_EXTS = /* @__PURE__ */ new Set([
+      ".txt",
+      ".md",
+      ".markdown",
+      ".rst",
+      ".log",
+      ".csv",
+      ".tsv",
+      ".json",
+      ".jsonl",
+      ".yaml",
+      ".yml",
+      ".toml",
+      ".ini",
+      ".env",
+      ".cfg",
+      ".conf",
+      ".xml",
+      ".html",
+      ".htm",
+      ".css",
+      ".scss",
+      ".less",
+      ".js",
+      ".mjs",
+      ".cjs",
+      ".jsx",
+      ".ts",
+      ".tsx",
+      ".vue",
+      ".svelte",
+      ".py",
+      ".rb",
+      ".go",
+      ".rs",
+      ".java",
+      ".kt",
+      ".c",
+      ".h",
+      ".cpp",
+      ".hpp",
+      ".cc",
+      ".cs",
+      ".php",
+      ".swift",
+      ".scala",
+      ".sh",
+      ".bash",
+      ".zsh",
+      ".fish",
+      ".sql",
+      ".graphql",
+      ".proto",
+      ".dockerfile",
+      ".makefile",
+      ".gradle",
+      ".diff",
+      ".patch",
+      ".tex"
+    ]);
+    MIME_MAP = {
+      ...IMAGE_EXTS2,
+      ".txt": "text/plain",
+      ".md": "text/markdown",
+      ".csv": "text/csv",
+      ".json": "application/json",
+      ".xml": "application/xml",
+      ".yaml": "text/yaml",
+      ".yml": "text/yaml",
+      ".html": "text/html",
+      ".css": "text/css",
+      ".js": "application/javascript",
+      ".mjs": "application/javascript",
+      ".ts": "text/typescript",
+      ".tsx": "text/typescript",
+      ".toml": "text/plain",
+      ".pdf": "application/pdf",
+      ".zip": "application/zip",
+      ".tar": "application/x-tar",
+      ".gz": "application/gzip",
+      ".wasm": "application/wasm",
+      ".exe": "application/vnd.microsoft.portable-executable",
+      ".dll": "application/vnd.microsoft.portable-executable",
+      ".so": "application/x-sharedlib",
+      ".bin": "application/octet-stream"
+    };
+  }
+});
+
+// server/src/routes/workspace.ts
+import fs10 from "node:fs/promises";
+import { createReadStream as createReadStream2 } from "node:fs";
+import path12 from "node:path";
+function tooLargeForPreview(size, maxBytes) {
+  return {
+    error: `File too large for preview (${(size / 1024 / 1024).toFixed(1)} MB, max ${maxBytes / 1024 / 1024} MB)`
+  };
+}
+function hexdump(buf) {
+  const lines = [];
+  for (let off = 0; off < buf.length; off += 16) {
+    const slice = buf.subarray(off, off + 16);
+    const hex = [];
+    let ascii = "";
+    for (let i = 0; i < 16; i++) {
+      if (i < slice.length) {
+        const b = slice[i];
+        hex.push(b.toString(16).padStart(2, "0"));
+        ascii += b >= 32 && b <= 126 ? String.fromCharCode(b) : ".";
+      } else {
+        hex.push("  ");
+      }
+      if (i === 7) hex.push("");
+    }
+    lines.push(`${off.toString(16).padStart(8, "0")}  ${hex.join(" ")}  |${ascii}|`);
+  }
+  return lines.join("\n");
+}
+function registerWorkspaceRoutes(app, manager) {
+  app.get(
+    "/api/sessions/:id/tree",
+    async (req, reply) => {
+      let cwd;
+      try {
+        cwd = await manager.getSessionCwd(req.params.id);
+      } catch {
+        reply.code(404);
+        return { error: "Session not found" };
+      }
+      const relative = (req.query.path ?? "").replace(/^\/+/, "");
+      const target = confineToRoot(cwd, relative);
+      if (!target) {
+        reply.code(400);
+        return { error: "Invalid path" };
+      }
+      const workspaceMissing = async () => {
+        try {
+          return !(await fs10.stat(cwd)).isDirectory();
+        } catch {
+          return true;
+        }
+      };
+      const notFound = async () => {
+        reply.code(404);
+        return await workspaceMissing() ? { error: `Workspace folder no longer exists: ${cwd}` } : { error: "Directory not found" };
+      };
+      const realTarget = await realConfineToRoot(config.fileRoot, target);
+      if (!realTarget) {
+        return notFound();
+      }
+      let dirents;
+      try {
+        dirents = await fs10.readdir(realTarget, { withFileTypes: true, encoding: "utf8" });
+      } catch {
+        return notFound();
+      }
+      const entries = [];
+      for (const d of dirents) {
+        const name = d.name;
+        const entryRelative = relative ? `${relative}/${name}` : name;
+        const entryAbsolute = path12.join(realTarget, name);
+        let kind = d.isDirectory() ? "directory" : d.isFile() ? "file" : null;
+        let statTarget = entryAbsolute;
+        if (kind === null && d.isSymbolicLink()) {
+          const real = await realConfineToRoot(config.fileRoot, entryAbsolute);
+          if (!real) continue;
+          try {
+            const st = await fs10.stat(real);
+            kind = st.isDirectory() ? "directory" : st.isFile() ? "file" : null;
+            statTarget = real;
+          } catch {
+            continue;
+          }
+        }
+        if (kind === null) continue;
+        if (kind === "directory") {
+          entries.push({ name, path: entryRelative, type: "directory" });
+        } else {
+          try {
+            const stat = await fs10.stat(statTarget);
+            entries.push({
+              name,
+              path: entryRelative,
+              type: "file",
+              size: stat.size,
+              modifiedAt: stat.mtime.toISOString()
+            });
+          } catch {
+          }
+        }
+      }
+      entries.sort((a, b) => {
+        if (a.type !== b.type) return a.type === "directory" ? -1 : 1;
+        return a.name.localeCompare(b.name);
+      });
+      const response = { cwd, relativeTo: relative, entries };
+      return response;
+    }
+  );
+  app.get(
+    "/api/sessions/:id/download",
+    async (req, reply) => {
+      let cwd;
+      try {
+        cwd = await manager.getSessionCwd(req.params.id);
+      } catch {
+        reply.code(404);
+        return { error: "Session not found" };
+      }
+      const relative = (req.query.path ?? "").replace(/^\/+/, "");
+      if (!relative) {
+        reply.code(400);
+        return { error: "path parameter is required" };
+      }
+      const target = confineToRoot(cwd, relative);
+      if (!target) {
+        reply.code(400);
+        return { error: "Invalid path" };
+      }
+      const realTarget = await realConfineToRoot(config.fileRoot, target);
+      if (!realTarget) {
+        reply.code(404);
+        return { error: "File not found" };
+      }
+      let stat;
+      try {
+        stat = await fs10.stat(realTarget);
+      } catch {
+        reply.code(404);
+        return { error: "File not found" };
+      }
+      if (!stat.isFile()) {
+        reply.code(400);
+        return { error: "Path is not a file" };
+      }
+      if (stat.size > MAX_DOWNLOAD_BYTES) {
+        reply.code(413);
+        return { error: `File too large (${(stat.size / 1024 / 1024).toFixed(1)} MB, max 100 MB)` };
+      }
+      const ext = path12.extname(realTarget);
+      const filename = path12.basename(realTarget);
+      const asciiName = filename.replace(/[^\w.\-]/g, "_");
+      reply.header("Content-Type", mimeForExt(ext));
+      reply.header(
+        "Content-Disposition",
+        `attachment; filename="${asciiName}"; filename*=UTF-8''${encodeURIComponent(filename)}`
+      );
+      reply.header("Content-Length", stat.size);
+      return reply.send(createReadStream2(realTarget));
+    }
+  );
+  app.get(
+    "/api/sessions/:id/preview",
+    async (req, reply) => {
+      let cwd;
+      try {
+        cwd = await manager.getSessionCwd(req.params.id);
+      } catch {
+        reply.code(404);
+        return { error: "Session not found" };
+      }
+      const relative = (req.query.path ?? "").replace(/^\/+/, "");
+      if (!relative) {
+        reply.code(400);
+        return { error: "path parameter is required" };
+      }
+      const target = confineToRoot(cwd, relative);
+      if (!target) {
+        reply.code(400);
+        return { error: "Invalid path" };
+      }
+      const realTarget = await realConfineToRoot(config.fileRoot, target);
+      if (!realTarget) {
+        reply.code(404);
+        return { error: "File not found" };
+      }
+      let stat;
+      try {
+        stat = await fs10.stat(realTarget);
+      } catch {
+        reply.code(404);
+        return { error: "File not found" };
+      }
+      if (!stat.isFile()) {
+        reply.code(400);
+        return { error: "Path is not a file" };
+      }
+      const ext = path12.extname(realTarget).toLowerCase();
+      const mime = mimeForExt(ext);
+      const isImage = mime.startsWith("image/");
+      const isPdf = mime === "application/pdf";
+      const kind = classifyKind(realTarget);
+      if (isImage || isPdf) {
+        if (stat.size > MAX_IMAGE_PREVIEW_BYTES) {
+          reply.code(413);
+          return tooLargeForPreview(stat.size, MAX_IMAGE_PREVIEW_BYTES);
+        }
+      } else if (kind !== "binary") {
+        if (stat.size > MAX_TEXT_PREVIEW_BYTES) {
+          reply.code(413);
+          return tooLargeForPreview(stat.size, MAX_TEXT_PREVIEW_BYTES);
+        }
+      }
+      if (isImage || isPdf) {
+        const etag = `W/"${stat.size}-${stat.mtimeMs}"`;
+        reply.header("Cache-Control", "private, max-age=3600");
+        reply.header("ETag", etag);
+        reply.header("Last-Modified", stat.mtime.toUTCString());
+        const ifNoneMatch = req.headers["if-none-match"];
+        if (ifNoneMatch === etag) {
+          reply.code(304);
+          return reply.send();
+        }
+        reply.header("Content-Type", mime);
+        reply.header("Content-Disposition", "inline");
+        reply.header("Content-Length", stat.size);
+        return reply.send(createReadStream2(realTarget));
+      }
+      if (kind === "binary") {
+        let fh;
+        try {
+          fh = await fs10.open(realTarget, "r");
+          const buf = Buffer.alloc(Math.min(HEXDUMP_BYTES, stat.size));
+          const { bytesRead } = await fh.read(buf, 0, buf.length, 0);
+          const head = buf.subarray(0, bytesRead);
+          if (!looksBinary(head)) {
+            if (stat.size > MAX_TEXT_PREVIEW_BYTES) {
+              reply.code(413);
+              return tooLargeForPreview(stat.size, MAX_TEXT_PREVIEW_BYTES);
+            }
+            reply.header("Content-Type", "text/plain; charset=utf-8");
+            reply.header("Content-Disposition", "inline");
+            reply.header("Content-Length", stat.size);
+            return reply.send(createReadStream2(realTarget));
+          }
+          const dump = hexdump(head);
+          const header = `Binary file - ${stat.size} bytes
+Showing first ${bytesRead} bytes as hexdump:
+
+`;
+          const body = header + dump + (stat.size > bytesRead ? "\n\n\u2026 (truncated)" : "");
+          reply.header("Content-Type", "text/plain; charset=utf-8");
+          reply.header("Content-Disposition", "inline");
+          return reply.send(body);
+        } finally {
+          await fh?.close();
+        }
+      }
+      reply.header("Content-Type", "text/plain; charset=utf-8");
+      reply.header("Content-Disposition", "inline");
+      reply.header("Content-Length", stat.size);
+      return reply.send(createReadStream2(realTarget));
+    }
+  );
+}
+var MAX_DOWNLOAD_BYTES, HEXDUMP_BYTES, MAX_TEXT_PREVIEW_BYTES, MAX_IMAGE_PREVIEW_BYTES;
+var init_workspace = __esm({
+  "server/src/routes/workspace.ts"() {
+    "use strict";
+    init_config();
+    init_paths2();
+    init_filekind();
+    MAX_DOWNLOAD_BYTES = 100 * 1024 * 1024;
+    HEXDUMP_BYTES = 4096;
+    MAX_TEXT_PREVIEW_BYTES = 1024 * 1024;
+    MAX_IMAGE_PREVIEW_BYTES = 20 * 1024 * 1024;
+  }
+});
+
+// server/src/routes/uploads.ts
+import { createReadStream as createReadStream3, createWriteStream } from "node:fs";
+import fs11 from "node:fs/promises";
+import path13 from "node:path";
+import crypto4 from "node:crypto";
+import { execFile as execFile3 } from "node:child_process";
+import { pipeline } from "node:stream/promises";
+function sanitizeName(raw) {
+  const base = path13.basename(raw).replace(/[^\w.\- ]/g, "_").trim();
+  if (!base || base === "." || base === "..") return `upload-${Date.now()}`;
+  return base.replace(/^\.+/, "") || `upload-${Date.now()}`;
+}
+async function uniquePath(dir, name) {
+  const ext = path13.extname(name);
+  const stem = name.slice(0, name.length - ext.length);
+  let candidate = name;
+  let n = 1;
+  while (true) {
+    try {
+      await fs11.access(path13.join(dir, candidate));
+      candidate = `${stem} (${n++})${ext}`;
+    } catch {
+      return path13.join(dir, candidate);
+    }
+  }
+}
+function sha256File(absPath) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto4.createHash("sha256");
+    createReadStream3(absPath).on("data", (d) => hash.update(d)).on("end", () => resolve(hash.digest("hex"))).on("error", reject);
+  });
+}
+function fileType(absPath) {
+  return new Promise((resolve) => {
+    execFile3("file", ["-b", absPath], { timeout: 5e3 }, (err, stdout) => {
+      resolve(err ? "" : stdout.trim());
+    });
+  });
+}
+async function sampleStrings(absPath, limit = 40) {
+  let fh;
+  try {
+    fh = await fs11.open(absPath, "r");
+    const buf = Buffer.alloc(STRINGS_SCAN_BYTES);
+    const { bytesRead } = await fh.read(buf, 0, STRINGS_SCAN_BYTES, 0);
+    const out = [];
+    let cur = "";
+    for (let i = 0; i < bytesRead; i++) {
+      const c = buf[i];
+      if (c >= 32 && c <= 126) {
+        cur += String.fromCharCode(c);
+      } else {
+        if (cur.length >= 6) out.push(cur);
+        cur = "";
+        if (out.length >= limit) break;
+      }
+    }
+    if (cur.length >= 6 && out.length < limit) out.push(cur);
+    return out;
+  } catch {
+    return [];
+  } finally {
+    await fh?.close();
+  }
+}
+function registerUploadRoutes(app, manager) {
+  app.post(
+    "/api/sessions/:id/uploads",
+    async (req, reply) => {
+      let cwd;
+      try {
+        cwd = await manager.getSessionCwd(req.params.id);
+      } catch {
+        reply.code(404);
+        return { error: "Session not found" };
+      }
+      const uploadDir = path13.join(cwd, UPLOAD_SUBDIR);
+      await fs11.mkdir(uploadDir, { recursive: true });
+      const results = [];
+      const parts = req.files();
+      for await (const part of parts) {
+        const name = sanitizeName(part.filename ?? "upload");
+        if (confineToRoot(uploadDir, name) === null) continue;
+        const dest = await uniquePath(uploadDir, name);
+        try {
+          await pipeline(part.file, createWriteStream(dest));
+        } catch {
+          reply.code(500);
+          return { error: `Failed to store ${name}` };
+        }
+        if (part.file.truncated) {
+          await fs11.rm(dest, { force: true });
+          reply.code(413);
+          return {
+            error: `${name} exceeds the max upload size (${Math.round(config.maxUploadBytes / 1024 / 1024)} MB)`
+          };
+        }
+        const stat = await fs11.stat(dest);
+        const ext = path13.extname(dest);
+        const kind = classifyKind(dest);
+        const relative = path13.relative(cwd, dest);
+        const uploaded = {
+          name: path13.basename(dest),
+          path: relative,
+          size: stat.size,
+          mimeType: mimeForExt(ext),
+          kind
+        };
+        if (kind === "binary") {
+          const [type, sha2563, strings] = await Promise.all([
+            fileType(dest),
+            sha256File(dest),
+            sampleStrings(dest)
+          ]);
+          uploaded.triage = {
+            fileType: type || void 0,
+            sha256: sha2563,
+            strings: strings.length ? strings : void 0
+          };
+        }
+        results.push(uploaded);
+      }
+      const response = { files: results };
+      return response;
+    }
+  );
+}
+var UPLOAD_SUBDIR, STRINGS_SCAN_BYTES;
+var init_uploads = __esm({
+  "server/src/routes/uploads.ts"() {
+    "use strict";
+    init_config();
+    init_filekind();
+    init_paths2();
+    UPLOAD_SUBDIR = path13.join(".casper", "uploads");
+    STRINGS_SCAN_BYTES = 256 * 1024;
+  }
+});
+
+// server/src/routes/health.ts
+function registerHealthRoute(app, manager, startedAt) {
+  app.get("/api/health", async () => {
+    return {
+      status: "ok",
+      kiroVersion: await kiroVersion(),
+      liveSessions: manager.liveCount,
+      uptimeMs: Date.now() - startedAt
+    };
+  });
+}
+var init_health = __esm({
+  "server/src/routes/health.ts"() {
+    "use strict";
+    init_models();
+  }
+});
+
+// server/src/ws/dispatch.ts
+function send(socket, msg) {
+  if (socket.readyState === socket.OPEN) socket.send(JSON.stringify(msg));
+}
+async function handleClientMessage(socket, manager, sessionId, msg) {
+  switch (msg.type) {
+    case "ping":
+      send(socket, { type: "pong" });
+      return;
+    case "hello":
+      return;
+    case "prompt":
+      try {
+        await manager.runPrompt(sessionId, msg.content);
+        send(socket, { type: "ack", action: "prompt", ok: true });
+      } catch (err) {
+        send(socket, {
+          type: "ack",
+          action: "prompt",
+          ok: false,
+          error: err.message
+        });
+      }
+      return;
+    case "cancel":
+      try {
+        manager.cancel(sessionId);
+        send(socket, { type: "ack", action: "cancel", ok: true });
+      } catch (err) {
+        send(socket, {
+          type: "ack",
+          action: "cancel",
+          ok: false,
+          error: err.message
+        });
+      }
+      return;
+    case "set_mode":
+      try {
+        await manager.setMode(sessionId, msg.modeId);
+        send(socket, { type: "ack", action: "set_mode", ok: true });
+      } catch (err) {
+        send(socket, {
+          type: "ack",
+          action: "set_mode",
+          ok: false,
+          error: err.message
+        });
+      }
+      return;
+    case "set_model":
+      try {
+        await manager.setModel(sessionId, msg.modelId);
+        send(socket, { type: "ack", action: "set_model", ok: true });
+      } catch (err) {
+        send(socket, {
+          type: "ack",
+          action: "set_model",
+          ok: false,
+          error: err.message
+        });
+      }
+      return;
+    case "exec_command":
+      try {
+        await manager.execCommand(sessionId, msg.command, msg.args);
+        send(socket, { type: "ack", action: "exec_command", ok: true });
+      } catch (err) {
+        send(socket, {
+          type: "ack",
+          action: "exec_command",
+          ok: false,
+          error: err.message
+        });
+      }
+      return;
+    default:
+      send(socket, { type: "error", message: `Unknown message type` });
+  }
+}
+var init_dispatch = __esm({
+  "server/src/ws/dispatch.ts"() {
+    "use strict";
+  }
+});
+
+// server/src/ws/gateway.ts
+function registerWsGateway(app, manager) {
+  app.get("/ws", { websocket: true }, (socket, req) => {
+    const query = req.query;
+    if (!authDisabled() && !hasValidSession(req)) {
+      send(socket, { type: "error", message: "Unauthorized" });
+      socket.close(1008, "Unauthorized");
+      return;
+    }
+    const sessionId = query.sessionId;
+    if (!sessionId) {
+      send(socket, { type: "error", message: "Missing sessionId" });
+      socket.close(1008, "Missing sessionId");
+      return;
+    }
+    let cursor = Number.parseInt(query.cursor ?? "0", 10) || 0;
+    let unsubscribe = null;
+    let alive = true;
+    let ready = false;
+    const forward = (event) => {
+      if (event.seq <= cursor) return;
+      cursor = event.seq;
+      send(socket, { type: "event", event });
+    };
+    const attach = async () => {
+      try {
+        await manager.ensureOpen(sessionId);
+      } catch (err) {
+        send(socket, { type: "error", message: err.message });
+        socket.close(1011, "open failed");
+        return;
+      }
+      const store = manager.getStore(sessionId);
+      if (!store) {
+        send(socket, { type: "error", message: "Session store unavailable" });
+        socket.close(1011, "no store");
+        return;
+      }
+      const { events, gap } = store.getSince(cursor);
+      if (gap) {
+        send(socket, {
+          type: "resync",
+          reason: "cursor older than buffer; refetch full transcript"
+        });
+        cursor = store.head();
+      } else {
+        for (const e of events) forward(e);
+      }
+      send(socket, { type: "replay_complete", head: store.head() });
+      unsubscribe = manager.onEvent(sessionId, forward);
+      ready = true;
+    };
+    void attach();
+    const heartbeat = setInterval(() => {
+      if (!alive) {
+        socket.terminate();
+        return;
+      }
+      alive = false;
+      try {
+        socket.ping();
+      } catch {
+      }
+    }, HEARTBEAT_MS);
+    heartbeat.unref?.();
+    socket.on("pong", () => {
+      alive = true;
+    });
+    socket.on("message", (raw) => {
+      alive = true;
+      if (!ready) return;
+      let msg;
+      try {
+        msg = JSON.parse(raw.toString());
+      } catch {
+        send(socket, { type: "error", message: "Invalid JSON" });
+        return;
+      }
+      void handleClientMessage(socket, manager, sessionId, msg);
+    });
+    socket.on("close", () => {
+      clearInterval(heartbeat);
+      unsubscribe?.();
+    });
+  });
+}
+var HEARTBEAT_MS;
+var init_gateway = __esm({
+  "server/src/ws/gateway.ts"() {
+    "use strict";
+    init_auth();
+    init_dispatch();
+    HEARTBEAT_MS = 2e4;
+  }
+});
+
+// server/src/app.ts
+import fs12 from "node:fs";
+import Fastify from "fastify";
+import cors from "@fastify/cors";
+import websocket from "@fastify/websocket";
+import fastifyStatic from "@fastify/static";
+import multipart from "@fastify/multipart";
+async function buildApp() {
+  const isProd = process.env.NODE_ENV === "production";
+  const app = Fastify({
+    // Honor X-Forwarded-Proto so `secure: 'auto'` cookies detect HTTPS when the
+    // server sits behind a TLS-terminating tunnel or reverse proxy.
+    trustProxy: true,
+    // In production, skip the two-lines-per-request access log; our own
+    // logger.info/warn/error calls still fire. Dev keeps it for debugging.
+    disableRequestLogging: isProd,
+    logger: {
+      level: process.env.LOG_LEVEL ?? "info",
+      transport: isProd ? void 0 : { target: "pino/file", options: { destination: 2 } }
+    }
+  });
+  const manager = new SessionManager(logger);
+  const startedAt = Date.now();
+  await app.register(cors, { origin: true });
+  await app.register(websocket, {
+    options: { maxPayload: 16 * 1024 * 1024 }
+  });
+  await app.register(multipart, {
+    limits: { fileSize: config.maxUploadBytes, files: 20 }
+  });
+  await registerAuth(app);
+  registerHealthRoute(app, manager, startedAt);
+  registerModelRoutes(app);
+  registerAgentRoutes(app);
+  registerFsRoutes(app);
+  registerSessionRoutes(app, manager);
+  registerWorkspaceRoutes(app, manager);
+  registerUploadRoutes(app, manager);
+  registerWsGateway(app, manager);
+  if (fs12.existsSync(config.webDist)) {
+    await app.register(fastifyStatic, {
+      root: config.webDist
+    });
+    app.setNotFoundHandler((req, reply) => {
+      const path16 = req.url.split("?")[0] ?? "";
+      const looksLikeAsset = path16.startsWith("/assets/") || /\.[a-zA-Z0-9]+$/.test(path16);
+      if (path16.startsWith("/api/") || path16.startsWith("/ws") || looksLikeAsset) {
+        reply.code(404).send({ error: "Not found" });
+        return;
+      }
+      reply.sendFile("index.html");
+    });
+  }
+  return { app, manager };
+}
+var init_app = __esm({
+  "server/src/app.ts"() {
+    "use strict";
+    init_config();
+    init_logger();
+    init_SessionManager();
+    init_auth();
+    init_models2();
+    init_agents2();
+    init_fs();
+    init_sessions();
+    init_workspace();
+    init_uploads();
+    init_health();
+    init_gateway();
+  }
+});
+
+// server/src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  serve: () => serve
+});
+async function serve() {
+  if (!isWithinRoot(config.fileRoot, config.defaultCwd)) {
+    logger.warn(
+      { fileRoot: config.fileRoot, defaultCwd: config.defaultCwd },
+      "DEFAULT_CWD is outside CASPER_FILE_ROOT; new sessions and the directory picker will be rejected. Set CASPER_FILE_ROOT to an ancestor of DEFAULT_CWD."
+    );
+  }
+  const { app, manager } = await buildApp();
+  await app.listen({ host: config.host, port: config.port });
+  logger.info(
+    { host: config.host, port: config.port, auth: config.token ? "on" : "OFF" },
+    "Casper server listening"
+  );
+  if (!config.token) {
+    logger.warn("CASPER_TOKEN is empty - auth is DISABLED. Set it before exposing on a network.");
+  }
+  const shutdown = async (signal) => {
+    logger.info({ signal }, "shutting down; draining live sessions");
+    manager.disposeAll();
+    await app.close();
+    process.exit(0);
+  };
+  process.on("SIGINT", () => void shutdown("SIGINT"));
+  process.on("SIGTERM", () => void shutdown("SIGTERM"));
+}
+var init_server = __esm({
+  "server/src/server.ts"() {
+    "use strict";
+    init_app();
+    init_config();
+    init_logger();
+    init_paths2();
+  }
+});
+
+// server/src/cli/doctor.ts
+var doctor_exports = {};
+__export(doctor_exports, {
+  doctor: () => doctor
+});
+import { execFileSync as execFileSync3 } from "node:child_process";
+import fs13 from "node:fs";
+import path14 from "node:path";
+function which(bin) {
+  if (bin.includes("/")) return fs13.existsSync(bin) ? bin : void 0;
+  for (const dir of (process.env.PATH ?? "").split(path14.delimiter)) {
+    if (dir === "") continue;
+    const candidate = path14.join(dir, bin);
+    try {
+      fs13.accessSync(candidate, fs13.constants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return void 0;
+}
+function checks() {
+  const out = [];
+  out.push({
+    ok: true,
+    name: "node",
+    detail: `${process.version} at ${process.execPath}`
+  });
+  const kiro = which(config.kiroBin);
+  if (kiro) {
+    let version = "";
+    try {
+      version = execFileSync3(config.kiroBin, ["--version"], { encoding: "utf8" }).trim();
+    } catch {
+      version = "(version unavailable)";
+    }
+    out.push({ ok: true, name: "kiro-cli", detail: `${version} at ${kiro}` });
+  } else {
+    out.push({
+      ok: false,
+      fatal: true,
+      name: "kiro-cli",
+      detail: `not found on PATH (looked for "${config.kiroBin}"). Casper is a client for it, so nothing works without it.`
+    });
+  }
+  const settings = readSettings(config.configFile);
+  const hasToken = typeof settings.token === "string" && settings.token !== "";
+  out.push(
+    fs13.existsSync(config.configFile) ? {
+      ok: hasToken,
+      name: "settings",
+      detail: hasToken ? `${config.configFile} (token set)` : `${config.configFile} exists but has no token - auth is DISABLED`
+    } : {
+      ok: false,
+      name: "settings",
+      detail: `${config.configFile} not found; a token is generated on first run`
+    }
+  );
+  if (fs13.existsSync(config.configFile)) {
+    const mode = fs13.statSync(config.configFile).mode & 511;
+    out.push({
+      ok: mode === 384,
+      name: "settings mode",
+      detail: mode === 384 ? "0600" : `${mode.toString(8).padStart(3, "0")} - it holds the token; chmod 600 it`
+    });
+  }
+  try {
+    fs13.mkdirSync(config.casperDataDir, { recursive: true });
+    fs13.accessSync(config.casperDataDir, fs13.constants.W_OK);
+    const db2 = path14.join(config.casperDataDir, "casper.db");
+    const size = fs13.existsSync(db2) ? `, casper.db ${(fs13.statSync(db2).size / 1024).toFixed(0)} KB` : "";
+    out.push({ ok: true, name: "data dir", detail: `${config.casperDataDir} writable${size}` });
+  } catch (err) {
+    out.push({
+      ok: false,
+      fatal: true,
+      name: "data dir",
+      detail: `${config.casperDataDir} is not writable: ${err.message}`
+    });
+  }
+  out.push(
+    fs13.existsSync(config.webDist) ? { ok: true, name: "web app", detail: config.webDist } : {
+      ok: false,
+      fatal: true,
+      name: "web app",
+      detail: `${config.webDist} not found - the package is incomplete or CASPER_WEB_DIST is wrong`
+    }
+  );
+  const agent = path14.join(config.kiroSessionsDir, "..", "..", "agents", "casper.json");
+  out.push({
+    ok: fs13.existsSync(agent),
+    name: "casper agent",
+    detail: fs13.existsSync(agent) ? agent : `${agent} missing - it is installed on first run`
+  });
+  return out;
+}
+function doctor() {
+  const results = checks();
+  for (const c of results) {
+    const mark = c.ok ? "\x1B[32m\u2713\x1B[0m" : c.fatal ? "\x1B[31m\u2717\x1B[0m" : "\x1B[33m!\x1B[0m";
+    process.stdout.write(`${mark} ${c.name.padEnd(14)} ${c.detail}
+`);
+  }
+  const fatal = results.filter((c) => !c.ok && c.fatal);
+  if (fatal.length > 0) {
+    process.stdout.write(`
+${fatal.length} problem(s) will stop Casper from working.
+`);
+    return 1;
+  }
+  return 0;
+}
+var init_doctor = __esm({
+  "server/src/cli/doctor.ts"() {
+    "use strict";
+    init_config();
+    init_settings();
+  }
+});
+
+// server/src/cli/index.ts
+init_paths();
+init_settings();
+import fs14 from "node:fs";
+import os4 from "node:os";
+import path15 from "node:path";
+var VERSION = true ? "0.1.0" : "dev";
+var USAGE = `casper - web client for kiro-cli
+
+Usage:
+  casper                      run the server in the foreground
+  casper token                print the access token
+  casper reset-token [value]  set a new token and sign every device out
+  casper doctor               check kiro-cli, settings, data dir and web app
+  casper service install      run Casper as a systemd user service
+  casper service uninstall    remove the service
+  casper service status       show the service status
+
+Settings live in ${configFilePath()}.
+Update with: npm install -g @joeyshi12/casper
+`;
+async function bootstrap() {
+  const file = configFilePath();
+  const settings = readSettings(file);
+  if (typeof settings.token !== "string" || settings.token === "") {
+    const token = generateToken();
+    updateSettings(file, { token });
+    printTokenBlock(token, "Your Casper access token (paste it at the login screen):");
+    process.stdout.write(`Saved to ${file}. Print it again with: casper token
+
+`);
+  }
+  const { installAgentFile: installAgentFile2 } = await Promise.resolve().then(() => (init_agentFile(), agentFile_exports));
+  const agent = installAgentFile2(os4.homedir(), dataDirPath());
+  if (agent.action === "installed" || agent.action === "updated") {
+    process.stdout.write(`casper agent ${agent.action}: ${agent.target}
+`);
+  } else if (agent.action === "kept-yours") {
+    process.stdout.write(`keeping your edited agent file at ${agent.target}
+`);
+  }
+}
+function printToken() {
+  const file = configFilePath();
+  const token = readSettings(file).token;
+  if (typeof token !== "string" || token === "") {
+    process.stderr.write(
+      `casper: no token in ${file} - authentication is disabled.
+  One is generated the first time you run \`casper\`.
+`
+    );
+    return 1;
+  }
+  process.stdout.write(`${token}
+`);
+  return 0;
+}
+async function resetToken(value) {
+  const token = value && value !== "" ? value : generateToken();
+  const file = configFilePath();
+  updateSettings(file, { token });
+  process.stdout.write(`wrote a new token to ${file}
+`);
+  const dbFile = path15.join(dataDirPath(), "casper.db");
+  if (fs14.existsSync(dbFile)) {
+    const { LoginStore: LoginStore2 } = await Promise.resolve().then(() => (init_logins(), logins_exports));
+    new LoginStore2().revokeAll();
+    process.stdout.write("revoked all device sessions\n");
+  }
+  if ((await Promise.resolve().then(() => (init_service(), service_exports))).serviceActive()) {
+    const { spawnSync: spawnSync2 } = await import("node:child_process");
+    spawnSync2("systemctl", ["--user", "restart", "casper.service"], { stdio: "ignore" });
+    process.stdout.write("restarted the service\n");
+  } else {
+    process.stdout.write("restart Casper for the new token to take effect\n");
+  }
+  printTokenBlock(token, "New access token:");
+  return 0;
+}
+async function main(argv) {
+  const [cmd, ...rest] = argv;
+  switch (cmd) {
+    case void 0:
+    case "start": {
+      await bootstrap();
+      const { serve: serve2 } = await Promise.resolve().then(() => (init_server(), server_exports));
+      await serve2();
+      return 0;
+    }
+    case "token":
+      return printToken();
+    case "reset-token":
+      return resetToken(rest[0]);
+    case "doctor":
+      return (await Promise.resolve().then(() => (init_doctor(), doctor_exports))).doctor();
+    case "service": {
+      const svc = await Promise.resolve().then(() => (init_service(), service_exports));
+      switch (rest[0]) {
+        case "install":
+          return svc.serviceInstall();
+        case "uninstall":
+          return svc.serviceUninstall();
+        case "status":
+        case void 0:
+          return svc.serviceStatus();
+        default:
+          process.stderr.write(`casper: unknown service command "${rest[0]}"
+`);
+          return 2;
+      }
+    }
+    case "help":
+    case "--help":
+    case "-h":
+      process.stdout.write(USAGE);
+      return 0;
+    case "version":
+    case "--version":
+    case "-v":
+      process.stdout.write(`${VERSION}
+`);
+      return 0;
+    default:
+      process.stderr.write(`casper: unknown command "${cmd}"
+
+${USAGE}`);
+      return 2;
+  }
+}
+var code = await main(process.argv.slice(2));
+if (code !== 0) process.exit(code);
+export {
+  main
+};