@kortix/sandbox 0.4.1

package/config/customize.sh

@@ -0,0 +1,143 @@
+#!/bin/bash
+CONFIG_DIR="/workspace"
+MARKER="$CONFIG_DIR/.heyagi-customized"
+
+# ── Always run: ensure agent-browser dirs exist, clean stale locks ──────────
+mkdir -p "$CONFIG_DIR/.agent-browser" "$CONFIG_DIR/.browser-profile"
+rm -f "$CONFIG_DIR/.browser-profile/SingletonLock" \
+      "$CONFIG_DIR/.browser-profile/SingletonCookie" \
+      "$CONFIG_DIR/.browser-profile/SingletonSocket" 2>/dev/null
+chown -R abc:abc "$CONFIG_DIR/.agent-browser" "$CONFIG_DIR/.browser-profile"
+
+if [ -f "$MARKER" ]; then
+    echo "[heyagi] Already customized, skipping."
+    exit 0
+fi
+
+echo "[heyagi] Applying desktop customization..."
+mkdir -p "$CONFIG_DIR/.config/autostart"
+mkdir -p "$CONFIG_DIR/.local/share/konsole"
+
+# ── Symlink presentations into Desktop for easy access ─────────────────────
+mkdir -p "$CONFIG_DIR/presentations"
+# Create a Desktop directory for KDE and symlink presentations into it
+mkdir -p "$CONFIG_DIR/Desktop"
+ln -sfn "$CONFIG_DIR/presentations" "$CONFIG_DIR/Desktop/presentations"
+
+# ── KDE Global: Breeze Dark ────────────────────────────────────────────────
+cat > "$CONFIG_DIR/.config/kdeglobals" << 'EOF'
+[General]
+ColorScheme=BreezeDark
+Name=Breeze Dark
+widgetStyle=Breeze
+
+[Icons]
+Theme=breeze-dark
+
+[KDE]
+LookAndFeelPackage=org.kde.breezedark.desktop
+widgetStyle=breeze
+EOF
+
+# ── KWin ────────────────────────────────────────────────────────────────────
+cat > "$CONFIG_DIR/.config/kwinrc" << 'EOF'
+[org.kde.kdecoration2]
+theme=Breeze
+library=org.kde.breeze
+
+[Windows]
+Placement=Centered
+
+[Desktops]
+Number=1
+Rows=1
+EOF
+
+# ── Plasma theme ────────────────────────────────────────────────────────────
+cat > "$CONFIG_DIR/.config/plasmarc" << 'EOF'
+[Theme]
+name=breeze-dark
+EOF
+
+# ── Konsole dark profile ───────────────────────────────────────────────────
+cat > "$CONFIG_DIR/.local/share/konsole/HeyAGI.profile" << 'EOF'
+[Appearance]
+ColorScheme=Breeze
+Font=Monospace,11,-1,5,50,0,0,0,0,0
+
+[General]
+Name=HeyAGI
+Parent=FALLBACK/
+
+[Scrolling]
+HistoryMode=2
+EOF
+
+cat > "$CONFIG_DIR/.config/konsolerc" << 'EOF'
+[Desktop Entry]
+DefaultProfile=HeyAGI.profile
+
+[MainWindow]
+MenuBar=Disabled
+ToolBarsMovable=Disabled
+EOF
+
+# ── Autostart: apply wallpaper + launcher icon after KDE session loads ──────
+cat > "$CONFIG_DIR/.config/autostart/heyagi-desktop.desktop" << 'EOF'
+[Desktop Entry]
+Type=Application
+Name=HeyAGI Desktop Setup
+Exec=/usr/share/wallpapers/heyagi/apply-desktop.sh
+X-KDE-autostart-phase=2
+EOF
+
+cat > /usr/share/wallpapers/heyagi/apply-desktop.sh << 'SCRIPT'
+#!/bin/bash
+sleep 5
+
+plasma-apply-wallpaperimage /usr/share/wallpapers/heyagi/wallpaper.png
+
+PLASMA_RC="$HOME/.config/plasma-org.kde.plasma.desktop-appletsrc"
+ICON_PATH="/usr/share/icons/heyagi/kortix-symbol-white.svg"
+
+if [ -f "$PLASMA_RC" ]; then
+    # Find the kickoff applet's [Configuration][General] section and inject icon
+    # Get the containment/applet IDs for kickoff
+    KICKOFF_SECTION=$(grep -B3 "plugin=org.kde.plasma.kickoff" "$PLASMA_RC" | grep "^\[Containments\]" | tail -1)
+    
+    if [ -n "$KICKOFF_SECTION" ]; then
+        # Build the [Configuration][General] section name
+        GENERAL_SECTION="${KICKOFF_SECTION%]}][Configuration][General]"
+        
+        if grep -q "$(echo "$GENERAL_SECTION" | sed 's/\[/\\[/g; s/\]/\\]/g')" "$PLASMA_RC"; then
+            # Section exists -- replace or add icon line
+            ESCAPED=$(echo "$GENERAL_SECTION" | sed 's/\[/\\[/g; s/\]/\\]/g')
+            if grep -A10 "$ESCAPED" "$PLASMA_RC" | grep -q "^icon="; then
+                sed -i "/$ESCAPED/,/^\[/{s|^icon=.*|icon=$ICON_PATH|}" "$PLASMA_RC"
+            else
+                sed -i "/$ESCAPED/a icon=$ICON_PATH" "$PLASMA_RC"
+            fi
+        else
+            # Section doesn't exist -- create it
+            CONF_SECTION="${KICKOFF_SECTION%]}][Configuration]"
+            ESCAPED_CONF=$(echo "$CONF_SECTION" | sed 's/\[/\\[/g; s/\]/\\]/g')
+            sed -i "/$ESCAPED_CONF/,/^\[/{/^\[.*\]/!b;i\\${GENERAL_SECTION}\nicon=$ICON_PATH
+            }" "$PLASMA_RC"
+        fi
+    fi
+    
+    # Restart plasmashell to pick up icon change
+    kquitapp5 plasmashell 2>/dev/null
+    sleep 2
+    kstart5 plasmashell 2>/dev/null &
+fi
+SCRIPT
+chmod +x /usr/share/wallpapers/heyagi/apply-desktop.sh
+
+# ── Fix ownership ──────────────────────────────────────────────────────────
+# Give abc full ownership of everything under /workspace so opencode and its
+# agents can freely create directories and files (presentations, output, etc.)
+chown -R abc:abc "$CONFIG_DIR" 2>/dev/null
+
+touch "$MARKER"
+echo "[heyagi] Customization complete."

package/config/kortix-env-setup.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/with-contenv bash
+# Kortix environment setup — runs once on container start (s6 cont-init.d)
+#
+# In cloud/production mode, overrides SDK base URLs to route through
+# the Kortix router proxy. In local mode, does nothing.
+
+if [ "$ENV_MODE" = "cloud" ] || [ "$ENV_MODE" = "production" ]; then
+    echo "[Kortix] Cloud mode — enabling API proxy routing"
+
+    if [ -z "$KORTIX_API_URL" ]; then
+        echo "[Kortix] WARNING: KORTIX_API_URL is empty — LLM calls will fail until it is set via /env API"
+        echo "[Kortix] Services will still start; set KORTIX_API_URL later to enable model routing"
+    else
+        # Write env overrides that s6 services will inherit via with-contenv
+        printf '%s' "${KORTIX_API_URL}/tavily"    > /var/run/s6/container_environment/TAVILY_API_URL
+        printf '%s' "${KORTIX_API_URL}/serper"    > /var/run/s6/container_environment/SERPER_API_URL
+        printf '%s' "${KORTIX_API_URL}/firecrawl" > /var/run/s6/container_environment/FIRECRAWL_API_URL
+        printf '%s' "${KORTIX_API_URL}/replicate" > /var/run/s6/container_environment/REPLICATE_API_URL
+        printf '%s' "${KORTIX_API_URL}/context7"  > /var/run/s6/container_environment/CONTEXT7_API_URL
+
+        echo "[Kortix] SDK URLs routed through ${KORTIX_API_URL}"
+    fi
+else
+    echo "[Kortix] Local mode — proxy routing disabled"
+fi

package/kortix-master/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@kortix/sandbox-master",
+  "version": "1.0.0",
+  "type": "module",
+  "scripts": {
+    "dev": "bun run --watch src/index.ts",
+    "start": "bun run src/index.ts",
+    "test": "bun test",
+    "test:unit": "bun test tests/unit/",
+    "test:integration": "bun test tests/integration/",
+    "test:e2e": "bun test tests/e2e/",
+    "test:coverage": "bun test --coverage"
+  },
+  "dependencies": {
+    "hono": "^4.0.0"
+  },
+  "devDependencies": {
+    "bun-types": "^1.0.0",
+    "typescript": "^5.0.0",
+    "@types/node": "^20.0.0"
+  }
+}

package/kortix-master/src/config.ts

@@ -0,0 +1,22 @@
+export const config = {
+  // Kortix Master port (main entry point)
+  PORT: parseInt(process.env.KORTIX_MASTER_PORT || '8000'),
+
+  // OpenCode server (proxied)
+  OPENCODE_HOST: process.env.OPENCODE_HOST || 'localhost',
+  OPENCODE_PORT: parseInt(process.env.OPENCODE_PORT || '4096'),
+  OPENCODE_USERNAME: process.env.OPENCODE_SERVER_USERNAME || '',
+  OPENCODE_PASSWORD: process.env.OPENCODE_SERVER_PASSWORD || '',
+
+  // Kortix backend
+  KORTIX_API_URL: process.env.KORTIX_API_URL || 'https://api.kortix.ai',
+  KORTIX_TOKEN: process.env.KORTIX_TOKEN || '',
+
+  // Secret storage
+  SECRET_FILE_PATH: process.env.SECRET_FILE_PATH || '/app/secrets/.secrets.json',
+  SALT_FILE_PATH: process.env.SALT_FILE_PATH || '/app/secrets/.salt',
+
+  // Sandbox metadata
+  SANDBOX_ID: process.env.SANDBOX_ID || '',
+  PROJECT_ID: process.env.PROJECT_ID || '',
+}

package/kortix-master/src/index.ts

@@ -0,0 +1,44 @@
+import { Hono } from 'hono'
+import { cors } from 'hono/cors'
+import { logger } from 'hono/logger'
+import { proxyToOpenCode } from './services/proxy'
+import { SecretStore } from './services/secret-store'
+import envRouter from './routes/env'
+import proxyRouter from './routes/proxy'
+import updateRouter from './routes/update'
+import { config } from './config'
+
+const app = new Hono()
+
+// Initialize secret store and load ENV variables
+const secretStore = new SecretStore()
+await secretStore.loadIntoProcessEnv()
+
+// Global middleware
+app.use('*', logger())
+app.use('*', cors())
+
+// Health check
+app.get('/kortix/health', (c) => c.json({ status: 'ok' }))
+
+// Update check — /kortix/update and /kortix/update/status
+app.route('/kortix/update', updateRouter)
+
+// ENV management routes
+app.route('/env', envRouter)
+
+// Dynamic port proxy — /proxy/:port/* forwards to localhost:{port} inside the sandbox
+app.route('/proxy', proxyRouter)
+
+// Proxy all other requests to OpenCode
+app.all('*', async (c) => {
+  return proxyToOpenCode(c)
+})
+
+console.log(`[Kortix Master] Starting on port ${config.PORT}`)
+console.log(`[Kortix Master] Proxying to OpenCode at ${config.OPENCODE_HOST}:${config.OPENCODE_PORT}`)
+
+export default {
+  port: config.PORT,
+  fetch: app.fetch,
+}

package/kortix-master/src/routes/env.ts

@@ -0,0 +1,65 @@
+import { Hono } from 'hono'
+import { SecretStore } from '../services/secret-store'
+
+const envRouter = new Hono()
+const secretStore = new SecretStore()
+
+// GET /env - list all ENV vars
+envRouter.get('/', async (c) => {
+  try {
+    const envVars = await secretStore.getAll()
+    return c.json(envVars)
+  } catch (error) {
+    console.error('[ENV API] Error listing environment variables:', error)
+    return c.json({ error: 'Failed to list environment variables' }, 500)
+  }
+})
+
+// GET /env/:key - get specific ENV var
+envRouter.get('/:key', async (c) => {
+  try {
+    const key = c.req.param('key')
+    const value = await secretStore.get(key)
+    if (value === null) {
+      return c.json({ error: 'Environment variable not found' }, 404)
+    }
+    return c.json({ [key]: value })
+  } catch (error) {
+    console.error('[ENV API] Error getting environment variable:', error)
+    return c.json({ error: 'Failed to get environment variable' }, 500)
+  }
+})
+
+// POST /env/:key - set ENV var
+envRouter.post('/:key', async (c) => {
+  try {
+    const key = c.req.param('key')
+    const body = await c.req.json()
+    
+    if (!body || typeof body.value !== 'string') {
+      return c.json({ error: 'Request body must contain a "value" field with string value' }, 400)
+    }
+
+    await secretStore.setEnv(key, body.value)
+    console.log(`[ENV API] Set environment variable: ${key}`)
+    return c.json({ message: 'Environment variable set', key, value: body.value })
+  } catch (error) {
+    console.error('[ENV API] Error setting environment variable:', error)
+    return c.json({ error: 'Failed to set environment variable' }, 500)
+  }
+})
+
+// DELETE /env/:key - delete ENV var
+envRouter.delete('/:key', async (c) => {
+  try {
+    const key = c.req.param('key')
+    await secretStore.deleteEnv(key)
+    console.log(`[ENV API] Deleted environment variable: ${key}`)
+    return c.json({ message: 'Environment variable deleted', key })
+  } catch (error) {
+    console.error('[ENV API] Error deleting environment variable:', error)
+    return c.json({ error: 'Failed to delete environment variable' }, 500)
+  }
+})
+
+export default envRouter

package/kortix-master/src/routes/proxy.ts

@@ -0,0 +1,108 @@
+import { Hono } from 'hono'
+import { config } from '../config'
+
+const proxyRouter = new Hono()
+
+// Blocked ports — prevent proxying to kortix-master itself or other sensitive services
+const BLOCKED_PORTS = new Set([
+  config.PORT,  // kortix-master itself (default 8000)
+])
+
+/**
+ * Dynamic port proxy: /proxy/:port/*
+ *
+ * Proxies HTTP requests to any localhost port inside the sandbox container.
+ * This enables the frontend to access any service the agent starts
+ * (e.g. dev servers on port 3000, 8080, 5173, etc.) without needing
+ * those ports individually exposed in docker-compose.
+ *
+ * In cloud mode, the frontend accesses this via:
+ *   https://kortix.cloud/{sandboxId}/8000/proxy/{port}/{path}
+ *
+ * In local mode:
+ *   http://localhost:8000/proxy/{port}/{path}
+ */
+proxyRouter.all('/:port{[0-9]+}/*', async (c) => {
+  const portStr = c.req.param('port')
+  const port = parseInt(portStr, 10)
+
+  // Validate port
+  if (isNaN(port) || port < 1 || port > 65535) {
+    return c.json({ error: 'Invalid port number', port: portStr }, 400)
+  }
+
+  if (BLOCKED_PORTS.has(port)) {
+    return c.json({ error: 'Port is blocked', port }, 403)
+  }
+
+  // Extract the path after /proxy/:port/
+  const url = new URL(c.req.url)
+  const prefix = `/proxy/${portStr}`
+  const remainingPath = url.pathname.slice(prefix.length) || '/'
+  const targetUrl = `http://localhost:${port}${remainingPath}${url.search}`
+
+  // Build headers, stripping Host (it would be wrong for the upstream)
+  const headers = new Headers()
+  for (const [key, value] of c.req.raw.headers.entries()) {
+    const lower = key.toLowerCase()
+    if (lower === 'host' || lower === 'authorization') continue
+    headers.set(key, value)
+  }
+
+  // Set correct Host for the upstream service
+  headers.set('Host', `localhost:${port}`)
+
+  try {
+    const response = await fetch(targetUrl, {
+      method: c.req.method,
+      headers,
+      body: c.req.method !== 'GET' && c.req.method !== 'HEAD'
+        ? await c.req.raw.clone().arrayBuffer()
+        : undefined,
+      // @ts-ignore - Bun supports duplex
+      duplex: 'half',
+      redirect: 'manual',
+    })
+
+    // Rewrite Location headers so redirects go through the proxy too
+    const responseHeaders = new Headers(response.headers)
+    const location = responseHeaders.get('location')
+    if (location) {
+      try {
+        const locUrl = new URL(location, `http://localhost:${port}`)
+        // Only rewrite if the redirect target is the same localhost port
+        if (locUrl.hostname === 'localhost' && parseInt(locUrl.port || '80') === port) {
+          responseHeaders.set('location', `${prefix}${locUrl.pathname}${locUrl.search}`)
+        }
+      } catch {
+        // Leave location as-is if we can't parse it
+      }
+    }
+
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: responseHeaders,
+    })
+  } catch (error) {
+    console.error(`[Kortix Master] Port proxy error (port ${port}):`, error)
+    return c.json(
+      {
+        error: 'Failed to connect to service',
+        port,
+        details: String(error),
+        hint: `No service appears to be running on port ${port} inside the sandbox.`,
+      },
+      502
+    )
+  }
+})
+
+// Handle bare /proxy/:port (no trailing path) — redirect to /proxy/:port/
+proxyRouter.all('/:port{[0-9]+}', async (c) => {
+  const portStr = c.req.param('port')
+  const url = new URL(c.req.url)
+  return c.redirect(`/proxy/${portStr}/${url.search}`, 301)
+})
+
+export default proxyRouter

package/kortix-master/src/routes/update.ts

@@ -0,0 +1,185 @@
+import { Hono } from 'hono';
+import { config } from '../config';
+
+// ─── Types ──────────────────────────────────────────────────────────────────
+
+interface LocalVersion {
+  version: string;
+  updatedAt: string;
+}
+
+// ─── Constants ──────────────────────────────────────────────────────────────
+
+const VERSION_FILE = '/opt/kortix/.version';
+
+/**
+ * Services to restart after update. Order matters:
+ * - opencode first (depends on /opt/opencode/)
+ * - then other services
+ * - kortix-master LAST (deferred — it's us)
+ */
+const SERVICES_TO_RESTART = [
+  'opencode-serve',
+  'opencode-web',
+  'lss-sync',
+  'agent-browser-viewer',
+  'KORTIX-presentation-viewer',
+];
+
+// ─── State ──────────────────────────────────────────────────────────────────
+
+let updateInProgress = false;
+
+// ─── Helpers ────────────────────────────────────────────────────────────────
+
+async function readLocalVersion(): Promise<LocalVersion> {
+  try {
+    const file = Bun.file(VERSION_FILE);
+    if (await file.exists()) {
+      return await file.json();
+    }
+  } catch (e) {
+    console.error('[Update] Failed to read version file:', e);
+  }
+  return { version: '0.0.0', updatedAt: '' };
+}
+
+async function fetchLatestVersion(): Promise<string | null> {
+  const url = `${config.KORTIX_API_URL}/v1/sandbox/version`;
+  try {
+    const res = await fetch(url, {
+      headers: { 'Accept': 'application/json' },
+      signal: AbortSignal.timeout(10_000),
+    });
+    if (!res.ok) {
+      console.error(`[Update] Version fetch failed: ${res.status}`);
+      return null;
+    }
+    const data = await res.json() as { version: string };
+    return data.version;
+  } catch (e) {
+    console.error('[Update] Failed to fetch version:', e);
+    return null;
+  }
+}
+
+async function run(cmd: string): Promise<{ ok: boolean; output: string }> {
+  try {
+    const proc = Bun.spawn(['bash', '-c', cmd], {
+      stdout: 'pipe',
+      stderr: 'pipe',
+      env: { ...process.env, HOME: '/workspace' },
+    });
+    const [stdout, stderr] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+    ]);
+    const exitCode = await proc.exited;
+    return { ok: exitCode === 0, output: (stdout + '\n' + stderr).trim() };
+  } catch (e) {
+    return { ok: false, output: String(e) };
+  }
+}
+
+async function restartService(name: string): Promise<void> {
+  await run(`s6-svc -r /var/run/s6/services/${name} 2>/dev/null || s6-svc -r /etc/services.d/${name} 2>/dev/null || true`);
+}
+
+async function performUpdate(targetVersion: string): Promise<{
+  success: boolean;
+  output: string;
+}> {
+  console.log(`[Update] Installing @kortix/sandbox@${targetVersion}...`);
+
+  const result = await run(`npm install -g @kortix/sandbox@${targetVersion} 2>&1`);
+
+  if (!result.ok) {
+    console.error('[Update] npm install failed:', result.output);
+    return { success: false, output: result.output.slice(0, 1000) };
+  }
+
+  console.log('[Update] Install complete, restarting services...');
+
+  for (const svc of SERVICES_TO_RESTART) {
+    console.log(`[Update] Restarting: ${svc}`);
+    await restartService(svc);
+  }
+
+  // Self-restart deferred so the HTTP response completes
+  console.log('[Update] Scheduling kortix-master restart in 2s...');
+  setTimeout(() => restartService('kortix-master'), 2000);
+
+  return { success: true, output: result.output.slice(0, 1000) };
+}
+
+// ─── Routes ─────────────────────────────────────────────────────────────────
+
+const updateRouter = new Hono();
+
+/**
+ * GET /kortix/update/status
+ *
+ * Returns current sandbox version + latest available version.
+ * Frontend uses this to decide whether to show "Update available".
+ * Read-only — does NOT trigger any update.
+ */
+updateRouter.get('/status', async (c) => {
+  const local = await readLocalVersion();
+  const latest = await fetchLatestVersion();
+
+  return c.json({
+    currentVersion: local.version,
+    latestVersion: latest || 'unknown',
+    updateAvailable: latest ? local.version !== latest : false,
+    updatedAt: local.updatedAt,
+    updateInProgress,
+  });
+});
+
+/**
+ * POST /kortix/update
+ *
+ * User-triggered update. Fetches latest version, installs the package,
+ * restarts services. Only runs when explicitly called.
+ */
+updateRouter.post('/', async (c) => {
+  if (updateInProgress) {
+    return c.json({ error: 'Update already in progress' }, 409);
+  }
+
+  updateInProgress = true;
+  try {
+    const local = await readLocalVersion();
+    const latestVersion = await fetchLatestVersion();
+
+    if (!latestVersion) {
+      return c.json({ error: 'Could not reach version service' }, 502);
+    }
+
+    if (local.version === latestVersion) {
+      return c.json({
+        upToDate: true,
+        currentVersion: local.version,
+        latestVersion,
+      });
+    }
+
+    console.log(`[Update] User triggered: ${local.version} -> ${latestVersion}`);
+    const update = await performUpdate(latestVersion);
+
+    return c.json({
+      success: update.success,
+      previousVersion: local.version,
+      currentVersion: update.success ? latestVersion : local.version,
+      latestVersion,
+      output: update.output,
+    });
+  } catch (e) {
+    console.error('[Update] Error:', e);
+    return c.json({ error: 'Update failed', details: String(e) }, 500);
+  } finally {
+    updateInProgress = false;
+  }
+});
+
+export default updateRouter;

package/kortix-master/src/services/proxy.ts

@@ -0,0 +1,43 @@
+import type { Context } from 'hono'
+import { config } from '../config'
+
+export async function proxyToOpenCode(c: Context): Promise<Response> {
+  const url = new URL(c.req.url)
+  const targetUrl = `http://${config.OPENCODE_HOST}:${config.OPENCODE_PORT}${url.pathname}${url.search}`
+
+  // Build headers, forwarding most but not Host
+  const headers = new Headers()
+  for (const [key, value] of c.req.raw.headers.entries()) {
+    if (key.toLowerCase() !== 'host') {
+      headers.set(key, value)
+    }
+  }
+
+  // Add OpenCode basic auth if configured
+  if (config.OPENCODE_USERNAME && config.OPENCODE_PASSWORD) {
+    const auth = Buffer.from(`${config.OPENCODE_USERNAME}:${config.OPENCODE_PASSWORD}`).toString('base64')
+    headers.set('Authorization', `Basic ${auth}`)
+  }
+
+  try {
+    const response = await fetch(targetUrl, {
+      method: c.req.method,
+      headers,
+      body: c.req.method !== 'GET' && c.req.method !== 'HEAD'
+        ? await c.req.raw.clone().arrayBuffer()
+        : undefined,
+      // @ts-ignore - Bun supports duplex
+      duplex: 'half',
+    })
+
+    // Return proxied response with all headers
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers,
+    })
+  } catch (error) {
+    console.error('[Kortix Master] Proxy error:', error)
+    return c.json({ error: 'Failed to proxy to OpenCode', details: String(error) }, 502)
+  }
+}