@kelceyp/caw-server 0.0.5 → 0.0.9

package/dist/main.js

@@ -44596,9 +44596,18 @@ var import_cors = __toESM(require_lib3(), 1);
 import { createServer } from "http";
 
 // src/common/Auth.js
-var HARDCODED_TOKEN = "test-token-123";
-var create = () => {
-  const middleware = (req, res, next) => {
+var getProjectByToken = async (store, token) => {
+  return store.getProjectByToken(token);
+};
+var validateToken = async (store, token) => {
+  const project = await getProjectByToken(store, token);
+  if (!project) {
+    throw new Error("Invalid token");
+  }
+  return project.id;
+};
+var create = ({ store } = {}) => {
+  const middleware = async (req, res, next) => {
     const authHeader = req.headers.authorization;
     if (!authHeader) {
       return res.status(401).json({
@@ -44606,33 +44615,123 @@ var create = () => {
         message: "Missing Authorization header"
       });
     }
-    const token = authHeader.replace(/^Bearer\s+/, "");
-    if (token !== HARDCODED_TOKEN) {
+    const token = authHeader.replace(/^Bearer\s+/i, "");
+    if (!store) {
+      return res.status(500).json({
+        error: "Internal server error",
+        message: "Auth store not configured"
+      });
+    }
+    try {
+      const projectId = await validateToken(store, token);
+      req.projectId = projectId;
+      req.token = token;
+      next();
+    } catch (error) {
       return res.status(401).json({
         error: "Unauthorized",
         message: "Invalid token"
       });
     }
-    next();
   };
   return Object.freeze({
     middleware
   });
 };
-var Auth_default = { create };
+var Auth_default = { create, getProjectByToken, validateToken };
 
 // src/api/ApiRoutes.js
-var create2 = (app) => {
-  const auth = Auth_default.create();
+var create2 = (app, { store } = {}) => {
+  const auth = Auth_default.create({ store });
   app.get("/api/hello", auth.middleware, (req, res) => {
     res.json({
-      message: "Hello from CAW"
+      message: "Hello from CAW",
+      projectId: req.projectId
     });
   });
   return Object.freeze({});
 };
 var ApiRoutes_default = { create: create2 };
 
+// src/api/ProjectRoutes.js
+var create3 = (app, { store }) => {
+  const auth = Auth_default.create({ store });
+  app.get("/api/projects", async (req, res) => {
+    try {
+      const projects = await store.getProjects();
+      res.json(projects);
+    } catch (error) {
+      console.error("[ProjectRoutes] Error listing projects:", error);
+      res.status(500).json({
+        error: "Internal server error",
+        message: "Failed to list projects"
+      });
+    }
+  });
+  app.post("/api/projects", async (req, res) => {
+    const { name, path } = req.body;
+    if (!name || typeof name !== "string") {
+      return res.status(400).json({
+        error: "Bad request",
+        message: "name is required and must be a string"
+      });
+    }
+    if (!path || typeof path !== "string") {
+      return res.status(400).json({
+        error: "Bad request",
+        message: "path is required and must be a string"
+      });
+    }
+    try {
+      const project = await store.createProject({ name, path });
+      res.status(201).json(project);
+    } catch (error) {
+      console.error("[ProjectRoutes] Error creating project:", error);
+      res.status(500).json({
+        error: "Internal server error",
+        message: "Failed to create project"
+      });
+    }
+  });
+  app.get("/api/projects/:projectId", auth.middleware, async (req, res) => {
+    const projectId = parseInt(req.params.projectId, 10);
+    if (isNaN(projectId)) {
+      return res.status(400).json({
+        error: "Bad request",
+        message: "projectId must be an integer"
+      });
+    }
+    if (req.projectId !== projectId) {
+      return res.status(403).json({
+        error: "Forbidden",
+        message: "Token does not match requested project"
+      });
+    }
+    try {
+      const project = await store.getProject(projectId);
+      if (!project) {
+        return res.status(404).json({
+          error: "Not found",
+          message: "Project not found"
+        });
+      }
+      const { token, ...projectWithoutToken } = project;
+      res.json(projectWithoutToken);
+    } catch (error) {
+      console.error("[ProjectRoutes] Error getting project:", error);
+      res.status(500).json({
+        error: "Internal server error",
+        message: "Failed to get project"
+      });
+    }
+  });
+  return Object.freeze({});
+};
+var ProjectRoutes_default = { create: create3 };
+
+// src/mcp/McpRoutes.js
+import { randomUUID as randomUUID2 } from "crypto";
+
 // node_modules/@modelcontextprotocol/sdk/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
@@ -56167,11 +56266,33 @@ var EMPTY_COMPLETION_RESULT = {
   }
 };
 // src/mcp/McpServer.js
-var createMcpServer = ({ sessionManager } = {}) => {
+var createMcpServer = ({ sessionManager, projectId, token, getMcpSessionId, mcpSessions } = {}) => {
   const server = new McpServer({
     name: "caw-server",
     version: "0.0.1"
   });
+  const context = {
+    projectId,
+    token,
+    getMcpSessionId,
+    mcpSessions
+  };
+  const getCurrentMcpSession = () => {
+    const mcpSessionId = context.getMcpSessionId();
+    if (!mcpSessionId || !context.mcpSessions)
+      return null;
+    return context.mcpSessions.get(mcpSessionId);
+  };
+  const verifyClaimedError = (pageId) => {
+    const mcpSessionId = context.getMcpSessionId();
+    if (!sessionManager || !mcpSessionId) {
+      return { error: true, message: "Session context not available" };
+    }
+    if (!sessionManager.isClaimedBy(pageId, mcpSessionId)) {
+      return { error: true, message: "MUST_CLAIM_FIRST: You must claim this session before sending commands" };
+    }
+    return { error: false };
+  };
   server.registerTool("list_sessions", {
     title: "List Active Sessions",
     description: "List all active WebSocket sessions with their pageIds and states",
@@ -56179,36 +56300,128 @@ var createMcpServer = ({ sessionManager } = {}) => {
   }, async () => {
     if (!sessionManager) {
       return {
-        content: [
-          {
-            type: "text",
-            text: "Error: SessionManager not initialized"
-          }
-        ],
+        content: [{ type: "text", text: "Error: SessionManager not initialized" }],
         isError: true
       };
     }
     const sessions = sessionManager.getAllSessions();
     if (sessions.length === 0) {
       return {
-        content: [
-          {
-            type: "text",
-            text: "No active sessions"
-          }
-        ]
+        content: [{ type: "text", text: "No active sessions" }]
       };
     }
-    const sessionList = sessions.map((s) => `• ${s.pageId} (${s.state}, capabilities: ${s.capabilities.join(", ")})`).join(`
+    const mcpSessionId = context.getMcpSessionId();
+    const sessionList = sessions.map((s) => {
+      const claimStatus = s.claimedBy === null ? "unclaimed" : s.claimedBy === mcpSessionId ? "claimed by you" : "claimed by another";
+      return `• ${s.pageId} (${s.state}, ${claimStatus})`;
+    }).join(`
 `);
     return {
-      content: [
-        {
-          type: "text",
-          text: `Active sessions (${sessions.length}):
-${sessionList}`
-        }
-      ]
+      content: [{ type: "text", text: `Active sessions (${sessions.length}):
+${sessionList}` }]
+    };
+  });
+  server.registerTool("claim_session", {
+    title: "Claim Session",
+    description: "Claim an unclaimed WebSocket session so you can send commands to it",
+    inputSchema: exports_external2.object({
+      pageId: exports_external2.string().describe("Page ID of the tab to claim")
+    })
+  }, async ({ pageId }) => {
+    if (!sessionManager) {
+      return {
+        content: [{ type: "text", text: "Error: SessionManager not initialized" }],
+        isError: true
+      };
+    }
+    const mcpSessionId = context.getMcpSessionId();
+    if (!mcpSessionId) {
+      return {
+        content: [{ type: "text", text: "Error: MCP session not initialized" }],
+        isError: true
+      };
+    }
+    const result = sessionManager.claimSession(pageId, mcpSessionId);
+    if (!result.success) {
+      return {
+        content: [{ type: "text", text: `Error: ${result.error}` }],
+        isError: true
+      };
+    }
+    const mcpSession = getCurrentMcpSession();
+    if (mcpSession) {
+      mcpSession.claimedConnections.add(pageId);
+    }
+    return {
+      content: [{ type: "text", text: `Successfully claimed session: ${pageId}` }]
+    };
+  });
+  server.registerTool("release_session", {
+    title: "Release Session",
+    description: "Release a claimed WebSocket session so other MCP sessions can claim it",
+    inputSchema: exports_external2.object({
+      pageId: exports_external2.string().describe("Page ID of the tab to release")
+    })
+  }, async ({ pageId }) => {
+    if (!sessionManager) {
+      return {
+        content: [{ type: "text", text: "Error: SessionManager not initialized" }],
+        isError: true
+      };
+    }
+    const mcpSessionId = context.getMcpSessionId();
+    if (!mcpSessionId) {
+      return {
+        content: [{ type: "text", text: "Error: MCP session not initialized" }],
+        isError: true
+      };
+    }
+    const result = sessionManager.releaseSession(pageId, mcpSessionId);
+    if (!result.success) {
+      return {
+        content: [{ type: "text", text: `Error: ${result.error}` }],
+        isError: true
+      };
+    }
+    const mcpSession = getCurrentMcpSession();
+    if (mcpSession) {
+      mcpSession.claimedConnections.delete(pageId);
+    }
+    return {
+      content: [{ type: "text", text: `Successfully released session: ${pageId}` }]
+    };
+  });
+  server.registerTool("list_my_sessions", {
+    title: "List My Sessions",
+    description: "List only the WebSocket sessions claimed by this MCP session",
+    inputSchema: exports_external2.object({})
+  }, async () => {
+    if (!sessionManager) {
+      return {
+        content: [{ type: "text", text: "Error: SessionManager not initialized" }],
+        isError: true
+      };
+    }
+    const mcpSession = getCurrentMcpSession();
+    if (!mcpSession) {
+      return {
+        content: [{ type: "text", text: "Error: MCP session not found" }],
+        isError: true
+      };
+    }
+    const claimedPageIds = Array.from(mcpSession.claimedConnections);
+    if (claimedPageIds.length === 0) {
+      return {
+        content: [{ type: "text", text: "No claimed sessions" }]
+      };
+    }
+    const allSessions = sessionManager.getAllSessions();
+    const mySessions = allSessions.filter((s) => claimedPageIds.includes(s.pageId));
+    const sessionList = mySessions.map((s) => `• ${s.pageId} (${s.state})`).join(`
+`);
+    return {
+      content: [{ type: "text", text: `Your claimed sessions (${mySessions.length}):
+${sessionList}` }]
     };
   });
   server.registerTool("get_state", {
@@ -56220,33 +56433,25 @@ ${sessionList}`
   }, async ({ pageId }) => {
     if (!sessionManager) {
       return {
-        content: [
-          {
-            type: "text",
-            text: "Error: SessionManager not initialized"
-          }
-        ],
+        content: [{ type: "text", text: "Error: SessionManager not initialized" }],
+        isError: true
+      };
+    }
+    const claimCheck = verifyClaimedError(pageId);
+    if (claimCheck.error) {
+      return {
+        content: [{ type: "text", text: `Error: ${claimCheck.message}` }],
         isError: true
       };
     }
     try {
       const result = await sessionManager.sendCommand(pageId, "getState", {});
       return {
-        content: [
-          {
-            type: "text",
-            text: `ChatGPT state: ${result.state}`
-          }
-        ]
+        content: [{ type: "text", text: `ChatGPT state: ${result.state}` }]
       };
     } catch (error) {
       return {
-        content: [
-          {
-            type: "text",
-            text: `Error: ${error.message}`
-          }
-        ],
+        content: [{ type: "text", text: `Error: ${error.message}` }],
         isError: true
       };
     }
@@ -56262,35 +56467,27 @@ ${sessionList}`
   }, async ({ pageId, text, timeout }) => {
     if (!sessionManager) {
       return {
-        content: [
-          {
-            type: "text",
-            text: "Error: SessionManager not initialized"
-          }
-        ],
+        content: [{ type: "text", text: "Error: SessionManager not initialized" }],
+        isError: true
+      };
+    }
+    const claimCheck = verifyClaimedError(pageId);
+    if (claimCheck.error) {
+      return {
+        content: [{ type: "text", text: `Error: ${claimCheck.message}` }],
         isError: true
       };
     }
     try {
       const result = await sessionManager.sendCommand(pageId, "sendMessage", { text, timeout }, timeout || 120000);
       return {
-        content: [
-          {
-            type: "text",
-            text: `ChatGPT response (turn ${result.turn}, ${result.duration}ms):
+        content: [{ type: "text", text: `ChatGPT response (turn ${result.turn}, ${result.duration}ms):
 
-${result.text}`
-          }
-        ]
+${result.text}` }]
       };
     } catch (error) {
       return {
-        content: [
-          {
-            type: "text",
-            text: `Error: ${error.message}`
-          }
-        ],
+        content: [{ type: "text", text: `Error: ${error.message}` }],
         isError: true
       };
     }
@@ -56304,12 +56501,14 @@ ${result.text}`
   }, async ({ pageId }) => {
     if (!sessionManager) {
       return {
-        content: [
-          {
-            type: "text",
-            text: "Error: SessionManager not initialized"
-          }
-        ],
+        content: [{ type: "text", text: "Error: SessionManager not initialized" }],
+        isError: true
+      };
+    }
+    const claimCheck = verifyClaimedError(pageId);
+    if (claimCheck.error) {
+      return {
+        content: [{ type: "text", text: `Error: ${claimCheck.message}` }],
         isError: true
       };
     }
@@ -56317,31 +56516,205 @@ ${result.text}`
       const result = await sessionManager.sendCommand(pageId, "getLastMessage", {});
       if (result.text) {
         return {
-          content: [
-            {
-              type: "text",
-              text: result.text
-            }
-          ]
+          content: [{ type: "text", text: result.text }]
         };
       } else {
         return {
-          content: [
-            {
-              type: "text",
-              text: "No message found"
-            }
-          ]
+          content: [{ type: "text", text: "No message found" }]
         };
       }
     } catch (error) {
       return {
-        content: [
-          {
-            type: "text",
-            text: `Error: ${error.message}`
-          }
-        ],
+        content: [{ type: "text", text: `Error: ${error.message}` }],
+        isError: true
+      };
+    }
+  });
+  server.registerTool("get_message_count", {
+    title: "Get Message Count",
+    description: "Get the total number of turns (message pairs) in the conversation",
+    inputSchema: exports_external2.object({
+      pageId: exports_external2.string().describe("Page ID of the ChatGPT tab")
+    })
+  }, async ({ pageId }) => {
+    if (!sessionManager) {
+      return {
+        content: [{ type: "text", text: "Error: SessionManager not initialized" }],
+        isError: true
+      };
+    }
+    const claimCheck = verifyClaimedError(pageId);
+    if (claimCheck.error) {
+      return {
+        content: [{ type: "text", text: `Error: ${claimCheck.message}` }],
+        isError: true
+      };
+    }
+    try {
+      const result = await sessionManager.sendCommand(pageId, "getMessageCount", {});
+      return {
+        content: [{ type: "text", text: `Message count: ${result.count} turns` }]
+      };
+    } catch (error) {
+      return {
+        content: [{ type: "text", text: `Error: ${error.message}` }],
+        isError: true
+      };
+    }
+  });
+  server.registerTool("get_message", {
+    title: "Get Message",
+    description: 'Get a specific message by turn number and role, or by address notation (e.g., "5u", "3a", "7u.5-10")',
+    inputSchema: exports_external2.object({
+      pageId: exports_external2.string().describe("Page ID of the ChatGPT tab"),
+      turn: exports_external2.number().optional().describe("Turn number (1-based)"),
+      role: exports_external2.enum(["user", "assistant"]).optional().describe("Message role"),
+      address: exports_external2.string().optional().describe('Address notation (e.g., "5u", "3a", "7u.5-10")')
+    })
+  }, async ({ pageId, turn, role, address }) => {
+    if (!sessionManager) {
+      return {
+        content: [{ type: "text", text: "Error: SessionManager not initialized" }],
+        isError: true
+      };
+    }
+    const claimCheck = verifyClaimedError(pageId);
+    if (claimCheck.error) {
+      return {
+        content: [{ type: "text", text: `Error: ${claimCheck.message}` }],
+        isError: true
+      };
+    }
+    if (!address && (turn === undefined || !role)) {
+      return {
+        content: [{ type: "text", text: "Error: Either address or (turn + role) is required" }],
+        isError: true
+      };
+    }
+    try {
+      const result = await sessionManager.sendCommand(pageId, "getMessage", { turn, role, address });
+      if (result.error) {
+        return {
+          content: [{ type: "text", text: `Error: ${result.error}` }],
+          isError: true
+        };
+      }
+      if (result.text) {
+        return {
+          content: [{ type: "text", text: result.text }]
+        };
+      } else {
+        return {
+          content: [{ type: "text", text: "Message not found" }]
+        };
+      }
+    } catch (error) {
+      return {
+        content: [{ type: "text", text: `Error: ${error.message}` }],
+        isError: true
+      };
+    }
+  });
+  server.registerTool("get_conversation", {
+    title: "Get Conversation",
+    description: "Get the full conversation history as a structured array of messages",
+    inputSchema: exports_external2.object({
+      pageId: exports_external2.string().describe("Page ID of the ChatGPT tab")
+    })
+  }, async ({ pageId }) => {
+    if (!sessionManager) {
+      return {
+        content: [{ type: "text", text: "Error: SessionManager not initialized" }],
+        isError: true
+      };
+    }
+    const claimCheck = verifyClaimedError(pageId);
+    if (claimCheck.error) {
+      return {
+        content: [{ type: "text", text: `Error: ${claimCheck.message}` }],
+        isError: true
+      };
+    }
+    try {
+      const result = await sessionManager.sendCommand(pageId, "getConversation", {});
+      const messages = result.messages || [];
+      if (messages.length === 0) {
+        return {
+          content: [{ type: "text", text: "No messages in conversation" }]
+        };
+      }
+      const formatted = messages.map((m) => {
+        const roleChar = m.role === "user" ? "u" : "a";
+        const addr = `${m.turn}${roleChar}`;
+        const preview = m.text.length > 100 ? m.text.substring(0, 100) + "..." : m.text;
+        return `[${addr}] ${m.role}: ${preview}`;
+      }).join(`
+
+`);
+      return {
+        content: [{ type: "text", text: `Conversation (${messages.length} messages):
+
+${formatted}` }]
+      };
+    } catch (error) {
+      return {
+        content: [{ type: "text", text: `Error: ${error.message}` }],
+        isError: true
+      };
+    }
+  });
+  server.registerTool("find_message", {
+    title: "Find Message",
+    description: "Search conversation messages using a regex pattern",
+    inputSchema: exports_external2.object({
+      pageId: exports_external2.string().describe("Page ID of the ChatGPT tab"),
+      pattern: exports_external2.string().describe("Regex pattern to search for"),
+      role: exports_external2.enum(["user", "assistant", "all"]).optional().describe("Filter by role (default: all)"),
+      firstMatch: exports_external2.boolean().optional().describe("Stop after first match (default: false)"),
+      caseInsensitive: exports_external2.boolean().optional().describe("Case insensitive search (default: false)")
+    })
+  }, async ({ pageId, pattern, role, firstMatch, caseInsensitive }) => {
+    if (!sessionManager) {
+      return {
+        content: [{ type: "text", text: "Error: SessionManager not initialized" }],
+        isError: true
+      };
+    }
+    const claimCheck = verifyClaimedError(pageId);
+    if (claimCheck.error) {
+      return {
+        content: [{ type: "text", text: `Error: ${claimCheck.message}` }],
+        isError: true
+      };
+    }
+    try {
+      const result = await sessionManager.sendCommand(pageId, "findMessage", {
+        pattern,
+        role: role || "all",
+        firstMatch: firstMatch || false,
+        caseInsensitive: caseInsensitive || false
+      });
+      if (result.error) {
+        return {
+          content: [{ type: "text", text: `Error: ${result.error}` }],
+          isError: true
+        };
+      }
+      const matches = result.matches || [];
+      if (matches.length === 0) {
+        return {
+          content: [{ type: "text", text: "No matches found" }]
+        };
+      }
+      const formatted = matches.map((m) => `• ${m.address} (turn ${m.turn}, ${m.role})`).join(`
+`);
+      return {
+        content: [{ type: "text", text: `Found ${result.count} match(es):
+${formatted}` }]
+      };
+    } catch (error) {
+      return {
+        content: [{ type: "text", text: `Error: ${error.message}` }],
         isError: true
       };
     }
@@ -56351,41 +56724,160 @@ ${result.text}`
 var McpServer_default = createMcpServer;
 
 // src/mcp/McpRoutes.js
-var create3 = (app, { sessionManager } = {}) => {
-  const auth = Auth_default.create();
-  const mcpServer = McpServer_default({ sessionManager });
+var IDLE_TIMEOUT_MS = 60 * 60 * 1000;
+var CLEANUP_INTERVAL_MS = 5 * 60 * 1000;
+var create4 = (app, { sessionManager, store } = {}) => {
+  const auth = Auth_default.create({ store });
+  const mcpSessions = new Map;
+  const cleanupInterval = setInterval(() => {
+    const now = Date.now();
+    for (const [sessionId, session] of mcpSessions) {
+      if (now - session.lastActivity > IDLE_TIMEOUT_MS) {
+        console.log(`Cleaning up idle MCP session: ${sessionId}`);
+        if (sessionManager) {
+          sessionManager.releaseAllForMcpSession(sessionId);
+        }
+        session.transport.close();
+        mcpSessions.delete(sessionId);
+      }
+    }
+  }, CLEANUP_INTERVAL_MS);
+  cleanupInterval.unref();
+  const getSessionIdFromHeaders = (req) => {
+    return req.headers["mcp-session-id"] || req.headers["Mcp-Session-Id"];
+  };
   app.post("/api/mcp", auth.middleware, async (req, res) => {
+    const existingSessionId = getSessionIdFromHeaders(req);
+    const { projectId, token } = req;
+    if (existingSessionId && mcpSessions.has(existingSessionId)) {
+      const session = mcpSessions.get(existingSessionId);
+      if (session.token !== token) {
+        return res.status(401).json({
+          jsonrpc: "2.0",
+          error: { code: -32001, message: "Token mismatch for session" },
+          id: null
+        });
+      }
+      console.log(`Reusing MCP session: ${existingSessionId}`);
+      session.lastActivity = Date.now();
+      res.setHeader("Mcp-Session-Id", existingSessionId);
+      try {
+        await session.transport.handleRequest(req, res, req.body);
+      } catch (error) {
+        console.error("Error handling MCP request:", error);
+        if (!res.headersSent) {
+          res.status(500).json({
+            jsonrpc: "2.0",
+            error: { code: -32603, message: "Internal server error" },
+            id: null
+          });
+        }
+      }
+      return;
+    }
+    console.log(`Creating new MCP session for project: ${projectId}`);
+    let newSessionId = null;
+    const transport = new StreamableHTTPServerTransport({
+      sessionIdGenerator: () => {
+        newSessionId = randomUUID2();
+        return newSessionId;
+      },
+      onsessioninitialized: (sessionId) => {
+        console.log(`MCP session initialized: ${sessionId}`);
+        res.setHeader("Mcp-Session-Id", sessionId);
+      }
+    });
+    const server = McpServer_default({
+      sessionManager,
+      projectId,
+      token,
+      getMcpSessionId: () => newSessionId,
+      mcpSessions
+    });
     try {
-      const transport = new StreamableHTTPServerTransport({
-        sessionIdGenerator: undefined,
-        enableJsonResponse: true
-      });
-      res.on("close", () => {
-        transport.close();
+      await server.connect(transport);
+      const session = {
+        sessionId: newSessionId,
+        transport,
+        server,
+        projectId,
+        token,
+        claimedConnections: new Set,
+        createdAt: Date.now(),
+        lastActivity: Date.now()
+      };
+      res.on("finish", () => {
+        if (newSessionId && !mcpSessions.has(newSessionId)) {
+          mcpSessions.set(newSessionId, session);
+          console.log(`MCP session stored: ${newSessionId}`);
+        }
       });
-      await mcpServer.connect(transport);
       await transport.handleRequest(req, res, req.body);
     } catch (error) {
       console.error("Error handling MCP request:", error);
       if (!res.headersSent) {
         res.status(500).json({
           jsonrpc: "2.0",
-          error: {
-            code: -32603,
-            message: "Internal server error"
-          },
+          error: { code: -32603, message: "Internal server error" },
           id: null
         });
       }
     }
   });
+  app.get("/api/mcp", auth.middleware, async (req, res) => {
+    const sessionId = req.query.sessionId || getSessionIdFromHeaders(req);
+    if (!sessionId) {
+      return res.status(400).json({
+        error: "Session ID required"
+      });
+    }
+    const session = mcpSessions.get(sessionId);
+    if (!session) {
+      return res.status(404).json({
+        error: "Session not found"
+      });
+    }
+    if (session.token !== req.token) {
+      return res.status(401).json({
+        error: "Token mismatch for session"
+      });
+    }
+    session.lastActivity = Date.now();
+    res.status(200).send("SSE endpoint stub");
+  });
+  app.delete("/api/mcp", auth.middleware, async (req, res) => {
+    const sessionId = req.query.sessionId || getSessionIdFromHeaders(req);
+    if (!sessionId) {
+      return res.status(400).json({
+        error: "Session ID required"
+      });
+    }
+    const session = mcpSessions.get(sessionId);
+    if (!session) {
+      return res.status(404).json({
+        error: "Session not found"
+      });
+    }
+    if (session.token !== req.token) {
+      return res.status(401).json({
+        error: "Token mismatch for session"
+      });
+    }
+    console.log(`Closing MCP session: ${sessionId}`);
+    if (sessionManager) {
+      sessionManager.releaseAllForMcpSession(sessionId);
+    }
+    await session.transport.close();
+    mcpSessions.delete(sessionId);
+    res.status(204).send();
+  });
   return Object.freeze({});
 };
-var McpRoutes_default = { create: create3 };
+var McpRoutes_default = { create: create4 };
 
 // src/static/StaticRoutes.js
 var import_express = __toESM(require_express2(), 1);
-var create4 = (app, options) => {
+var create5 = (app, options) => {
   const { staticPath } = options;
   const configure = () => {
     app.use(import_express.default.static(staticPath, {
@@ -56395,10 +56887,10 @@ var create4 = (app, options) => {
   configure();
   return Object.freeze({});
 };
-var StaticRoutes_default = { create: create4 };
+var StaticRoutes_default = { create: create5 };
 
 // src/test/TestRoutes.js
-var create5 = (app, { sessionManager }) => {
+var create6 = (app, { sessionManager }) => {
   if (!sessionManager) {
     console.warn("[TestRoutes] SessionManager not provided, skipping test routes");
     return;
@@ -56432,7 +56924,7 @@ var create5 = (app, { sessionManager }) => {
   });
   console.log("[TestRoutes] Test endpoints registered: GET /test/sessions, POST /test/command");
 };
-var TestRoutes_default = { create: create5 };
+var TestRoutes_default = { create: create6 };
 
 // node_modules/ws/wrapper.mjs
 var import_stream = __toESM(require_stream(), 1);
@@ -56566,7 +57058,7 @@ var MessageValidator_default = {
 };
 
 // src/wss/WebSocketServer.js
-var create6 = ({ server, sessionManager }) => {
+var create7 = ({ server, sessionManager }) => {
   if (!server) {
     throw new Error("WebSocketServer requires HTTP server instance");
   }
@@ -56637,11 +57129,11 @@ var create6 = ({ server, sessionManager }) => {
     stop
   });
 };
-var WebSocketServer_default = { create: create6 };
+var WebSocketServer_default = { create: create7 };
 
 // src/Server.js
-var create7 = (options = {}) => {
-  const { port = 3000, staticPath, sessionManager } = options;
+var create8 = (options = {}) => {
+  const { port = 3000, staticPath, sessionManager, store } = options;
   const app = import_express2.default();
   const httpServer = createServer(app);
   app.use(import_cors.default());
@@ -56652,8 +57144,11 @@ var create7 = (options = {}) => {
       timestamp: new Date().toISOString()
     });
   });
-  ApiRoutes_default.create(app);
-  McpRoutes_default.create(app, { sessionManager });
+  ApiRoutes_default.create(app, { store });
+  if (store) {
+    ProjectRoutes_default.create(app, { store });
+  }
+  McpRoutes_default.create(app, { sessionManager, store });
   StaticRoutes_default.create(app, { staticPath });
   if (sessionManager) {
     TestRoutes_default.create(app, { sessionManager });
@@ -56692,7 +57187,7 @@ var create7 = (options = {}) => {
     sessionManager
   });
 };
-var Server_default = { create: create7 };
+var Server_default = { create: create8 };
 
 // src/wss/SessionManager.js
 var { SessionState: SessionState2 } = MessageValidator_default;
@@ -56700,12 +57195,13 @@ var DEFAULT_HEARTBEAT_INTERVAL_MS = 30000;
 var DEFAULT_PONG_TIMEOUT_MS = 5000;
 var DEFAULT_MAX_MISSED_PONGS = 3;
 var DEFAULT_COMMAND_TIMEOUT_MS = 30000;
-var create8 = (options = {}) => {
+var create9 = (options = {}) => {
   const {
     heartbeatIntervalMs = DEFAULT_HEARTBEAT_INTERVAL_MS,
     pongTimeoutMs = DEFAULT_PONG_TIMEOUT_MS,
     maxMissedPongs = DEFAULT_MAX_MISSED_PONGS,
-    commandTimeoutMs = DEFAULT_COMMAND_TIMEOUT_MS
+    commandTimeoutMs = DEFAULT_COMMAND_TIMEOUT_MS,
+    onSessionEnded = null
   } = options;
   const sessions = new Map;
   const connectionToPageId = new Map;
@@ -56737,6 +57233,9 @@ var create8 = (options = {}) => {
     if (session.wsConnection) {
       connectionToPageId.delete(session.wsConnection);
     }
+    if (onSessionEnded && session.claimedBy) {
+      onSessionEnded(pageId, session.claimedBy);
+    }
     session.state = SessionState2.REMOVED;
     sessions.delete(pageId);
   };
@@ -56813,7 +57312,8 @@ var create8 = (options = {}) => {
       pongTimeout: null,
       missedPongs: 0,
       pendingCommands: new Map,
-      seq: 0
+      seq: 0,
+      claimedBy: null
     };
     sessions.set(pageId, session);
     connectionToPageId.set(ws, pageId);
@@ -56930,9 +57430,55 @@ var create8 = (options = {}) => {
       pageId: session.pageId,
       state: session.state,
       capabilities: session.capabilities,
-      version: session.version
+      version: session.version,
+      claimedBy: session.claimedBy
     }));
   };
+  const claimSession = (pageId, mcpSessionId) => {
+    const session = sessions.get(pageId);
+    if (!session) {
+      return { success: false, error: "NOT_FOUND" };
+    }
+    if (session.claimedBy === mcpSessionId) {
+      return { success: true };
+    }
+    if (session.claimedBy !== null) {
+      return { success: false, error: "ALREADY_CLAIMED" };
+    }
+    session.claimedBy = mcpSessionId;
+    console.info(`[SessionManager] Session ${pageId} claimed by MCP session ${mcpSessionId}`);
+    return { success: true };
+  };
+  const releaseSession = (pageId, mcpSessionId) => {
+    const session = sessions.get(pageId);
+    if (!session) {
+      return { success: false, error: "NOT_FOUND" };
+    }
+    if (session.claimedBy === null) {
+      return { success: true };
+    }
+    if (session.claimedBy !== mcpSessionId) {
+      return { success: false, error: "NOT_CLAIMED_BY_YOU" };
+    }
+    session.claimedBy = null;
+    console.info(`[SessionManager] Session ${pageId} released by MCP session ${mcpSessionId}`);
+    return { success: true };
+  };
+  const isClaimedBy = (pageId, mcpSessionId) => {
+    const session = sessions.get(pageId);
+    if (!session) {
+      return false;
+    }
+    return session.claimedBy === mcpSessionId;
+  };
+  const releaseAllForMcpSession = (mcpSessionId) => {
+    for (const session of sessions.values()) {
+      if (session.claimedBy === mcpSessionId) {
+        session.claimedBy = null;
+        console.info(`[SessionManager] Session ${session.pageId} released (MCP session ${mcpSessionId} ended)`);
+      }
+    }
+  };
   return Object.freeze({
     getSession,
     getPageIdForConnection,
@@ -56943,20 +57489,102 @@ var create8 = (options = {}) => {
     handleDisconnect,
     sendCommand,
     endSession,
-    shutdown
+    shutdown,
+    claimSession,
+    releaseSession,
+    isClaimedBy,
+    releaseAllForMcpSession
   });
 };
-var SessionManager_default = { create: create8 };
+var SessionManager_default = { create: create9 };
 
-// src/main.js
+// src/core/LocalStore.js
+import { createHash, randomUUID as randomUUID3 } from "crypto";
+import fs from "fs/promises";
+import os from "os";
 import path from "path";
+var DATA_DIR = path.join(os.homedir(), ".caw");
+var PROJECTS_FILE = path.join(DATA_DIR, "projects.json");
+var generateToken = (id, name) => {
+  const input = `${id}${name}`;
+  return createHash("sha256").update(input).digest("hex");
+};
+var create10 = () => {
+  const readProjects = async () => {
+    try {
+      const data = await fs.readFile(PROJECTS_FILE, "utf8");
+      return JSON.parse(data);
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return [];
+      }
+      throw error;
+    }
+  };
+  const writeProjects = async (projects) => {
+    await fs.mkdir(DATA_DIR, { recursive: true });
+    const tempFile = `${PROJECTS_FILE}.${randomUUID3()}.tmp`;
+    await fs.writeFile(tempFile, JSON.stringify(projects, null, 2), "utf8");
+    await fs.rename(tempFile, PROJECTS_FILE);
+  };
+  const getNextId = (projects) => {
+    if (projects.length === 0) {
+      return 1;
+    }
+    return Math.max(...projects.map((p) => p.id)) + 1;
+  };
+  const getProjects = async () => {
+    return readProjects();
+  };
+  const getProject = async (id) => {
+    const projects = await readProjects();
+    return projects.find((p) => p.id === id);
+  };
+  const getProjectByToken2 = async (token) => {
+    const projects = await readProjects();
+    return projects.find((p) => p.token === token);
+  };
+  const createProject = async ({ name, path: projectPath }) => {
+    const projects = await readProjects();
+    const id = getNextId(projects);
+    const token = generateToken(id, name);
+    const now = new Date().toISOString();
+    const project = {
+      id,
+      name,
+      path: projectPath,
+      token,
+      createdAt: now,
+      updatedAt: now
+    };
+    projects.push(project);
+    await writeProjects(projects);
+    return project;
+  };
+  return Object.freeze({
+    getProjects,
+    getProject,
+    getProjectByToken: getProjectByToken2,
+    createProject
+  });
+};
+var LocalStore_default = { create: create10, generateToken };
+
+// src/main.js
+import path2 from "path";
 import { fileURLToPath } from "url";
 var __filename2 = fileURLToPath(import.meta.url);
-var __dirname2 = path.dirname(__filename2);
-var port = parseInt(process.env.PORT || "3000", 10);
-var staticPath = process.env.STATIC_PATH || path.join(__dirname2, "public_html");
+var __dirname2 = path2.dirname(__filename2);
+var port = process.env.CAW_PORT;
+if (!port) {
+  console.error("ERROR: CAW_PORT environment variable is required");
+  console.error("Run via pm2 or set CAW_PORT manually: CAW_PORT=3131 node dist/main.js");
+  process.exit(1);
+}
+var staticPath = process.env.STATIC_PATH || path2.join(__dirname2, "public_html");
+var store = LocalStore_default.create();
 var sessionManager = SessionManager_default.create();
-var server = Server_default.create({ port, staticPath, sessionManager });
+var server = Server_default.create({ port, staticPath, sessionManager, store });
 server.start();
 var shutdown = async (signal) => {
   console.log(`
@@ -56974,4 +57602,4 @@ ${signal} received, shutting down gracefully...`);
 process.on("SIGINT", () => shutdown("SIGINT"));
 process.on("SIGTERM", () => shutdown("SIGTERM"));
 
-//# debugId=BE2433F55DA5A3FF64756E2164756E21
+//# debugId=36327466799C28A164756E2164756E21