@launchsecure/launch-kit 0.0.41 → 0.0.43

package/dist/server/deck-mcp-entry.js

@@ -1462,6 +1462,24 @@ async function updateDeck(commentId, input) {
 async function deleteDeck(commentId) {
   await callTool("communication_delete", { comment_id: commentId });
 }
+function authorLabel(c) {
+  return c.author?.name || c.author?.email || "unknown";
+}
+async function readCloudDeck(commentId) {
+  const result = await callTool("communication_read", {
+    resource_type: "deck",
+    limit: 50
+  });
+  const deck = result?.comments?.find((c) => c.id === commentId);
+  if (!deck) return null;
+  return {
+    id: deck.id,
+    title: deck.title ?? "(untitled deck)",
+    author: authorLabel(deck),
+    html: typeof deck.fields?.deckHtml === "string" ? deck.fields.deckHtml : null,
+    blocks: Array.isArray(deck.fields?.deckBlocks) && deck.fields.deckBlocks.length > 0 ? deck.fields.deckBlocks : null
+  };
+}
 function currentMcpOrigin() {
   const config = _config;
   if (!config) throw new Error("MCP config not loaded \u2014 call loadMcpConfig first");
@@ -1518,6 +1536,10 @@ function sessionDir(cwd, session) {
 function sessionJsonPath(cwd, session) {
   return import_node_path5.default.join(sessionDir(cwd, session), "session.json");
 }
+function sessionIdFromCloud(title, fallbackId) {
+  const slug = title.trim().replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 80);
+  return slug || `deck-${fallbackId.slice(0, 8)}`;
+}
 function readPersistedSession(cwd, session) {
   try {
     const raw = import_node_fs5.default.readFileSync(sessionJsonPath(cwd, session), "utf-8");
@@ -1563,7 +1585,9 @@ function listPersistedSessions(cwd) {
       shared: Boolean(sync),
       stale: Boolean(sync) && persisted.version > (sync?.version ?? 0),
       shareUrl: sync?.publicShareUrl,
-      course: sync?.course
+      course: sync?.course,
+      watching: sync?.watching,
+      watchedFrom: sync?.watchedFrom
     });
   }
   sessions.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
@@ -1957,6 +1981,74 @@ async function startDeckServer(opts = {}) {
         jsonResponse(res, 200, { sessions: listPersistedSessions(cwd) });
         return;
       }
+      const pullMatch = url2.pathname.match(/^\/api\/cloud-decks\/([^/]+)\/pull$/);
+      if (pullMatch && req.method === "POST") {
+        const deckId = decodeURIComponent(pullMatch[1]);
+        let course;
+        try {
+          const raw = await readBody(req);
+          if (raw.trim()) {
+            const parsed = JSON.parse(raw);
+            course = parsed.course?.trim() || void 0;
+          }
+        } catch {
+        }
+        const cfg = resolveShareConfig(cwd, course);
+        if ("error" in cfg) {
+          jsonResponse(res, 400, { ok: false, error: cfg.error });
+          return;
+        }
+        try {
+          const deck = await runWithShareConfig(cfg.override, () => readCloudDeck(deckId));
+          if (!deck) {
+            jsonResponse(res, 404, { ok: false, error: `No shared deck "${deckId}" in this course.` });
+            return;
+          }
+          if (!deck.html && !deck.blocks) {
+            jsonResponse(res, 422, { ok: false, error: "That deck carries no viewable content (no deckHtml or deckBlocks)." });
+            return;
+          }
+          const session = sessionIdFromCloud(deck.title, deck.id);
+          const sessionEncoded = encodeURIComponent(session);
+          let blocks;
+          if (deck.html) {
+            const dir = sessionDir(cwd, session);
+            import_node_fs5.default.mkdirSync(dir, { recursive: true });
+            import_node_fs5.default.writeFileSync(import_node_path5.default.join(dir, "imported.html"), deck.html);
+            blocks = [{ type: "iframe", label: deck.title, src: `/deck-files/${sessionEncoded}/imported.html` }];
+          } else {
+            blocks = deck.blocks;
+          }
+          const persisted = writePersistedSession(cwd, session, { mode: "show", blocks });
+          writeSyncRecord(cwd, session, {
+            resourceId: deck.id,
+            sharedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            version: persisted.version,
+            course,
+            watching: true,
+            watchedFrom: deck.author
+          });
+          broadcastToClients({
+            type: "session",
+            session,
+            mode: "show",
+            blocks,
+            version: persisted.version
+          });
+          jsonResponse(res, 200, {
+            ok: true,
+            session,
+            deckId: deck.id,
+            title: deck.title,
+            author: deck.author,
+            blockCount: blocks.length,
+            course
+          });
+        } catch (err) {
+          jsonResponse(res, 500, { ok: false, error: String(err) });
+        }
+        return;
+      }
       const shareMatch = url2.pathname.match(/^\/api\/sessions\/([^/]+)\/share$/);
       if (shareMatch && req.method === "POST") {
         const id = decodeURIComponent(shareMatch[1]);
@@ -2436,7 +2528,7 @@ function httpGet(url) {
   return new Promise((resolve, reject) => {
     const parsed = new URL(url);
     const req = import_node_http2.default.request(
-      { hostname: parsed.hostname, port: parsed.port, path: parsed.pathname, method: "GET" },
+      { hostname: parsed.hostname, port: parsed.port, path: parsed.pathname + parsed.search, method: "GET" },
       (res) => {
         let buf = "";
         res.on("data", (chunk) => {
@@ -2728,6 +2820,31 @@ async function handleTool(name, args) {
         return text(JSON.stringify({ error: `Failed to generate contract: ${err}` }));
       }
     }
+    case "deck_pull": {
+      const lock = getLiveLock(projectRoot);
+      if (!lock) {
+        return text(JSON.stringify({ error: "LaunchDeck server is not running. Call start_server first." }));
+      }
+      const deckId = args.deck?.trim();
+      if (!deckId) {
+        return text(JSON.stringify({ error: "Provide the deck's comment id (from launch-secure deck_list / watched_decks)." }));
+      }
+      const course = args.course?.trim();
+      try {
+        const resp = await httpPost(`${lock.url}/api/cloud-decks/${encodeURIComponent(deckId)}/pull`, course ? { course } : {});
+        const parsed = JSON.parse(resp);
+        if (parsed.ok === false) {
+          return text(JSON.stringify({ error: parsed.error ?? "Failed to pull the deck." }));
+        }
+        return text(JSON.stringify({
+          ...parsed,
+          url: lock.url,
+          action: "Deck pulled into a local tab. Open the LaunchDeck browser to view it; it can now be \u{1F441}-watched like any local deck."
+        }));
+      } catch (err) {
+        return text(JSON.stringify({ error: `Failed to pull deck: ${err}` }));
+      }
+    }
     default:
       return text(`Unknown tool: ${name}`);
   }
@@ -2964,6 +3081,24 @@ var init_deck_mcp = __esm({
           },
           required: ["session"]
         }
+      },
+      {
+        name: "deck_pull",
+        description: "Pull a cloud-shared deck DOWN into a local LaunchDeck session tab \u2014 the inverse of publishing a deck up. After this, the deck is an ordinary local tab the user can view, \u{1F441}-watch, download, or re-pull. Takes the deck's comment id \u2014 get it from launch-secure's deck_list or watched_decks. The deck is reconstructed from its shared HTML snapshot as one self-contained block (view-faithful; not re-editable block-by-block). Requires the LaunchDeck server to be running (start_server first). Note: listing shared decks and reading watch state live on the launch-secure MCP (deck_list / watched_decks), not here.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            deck: {
+              type: "string",
+              description: "Deck comment id (from launch-secure deck_list / watched_decks)."
+            },
+            course: {
+              type: "string",
+              description: "Optional course (cred profile) to read from. Omit for the active course."
+            }
+          },
+          required: ["deck"]
+        }
       }
     ];
   }

package/dist/server/deck-serve.js

@@ -1441,6 +1441,24 @@ async function updateDeck(commentId, input) {
 async function deleteDeck(commentId) {
   await callTool("communication_delete", { comment_id: commentId });
 }
+function authorLabel(c) {
+  return c.author?.name || c.author?.email || "unknown";
+}
+async function readCloudDeck(commentId) {
+  const result = await callTool("communication_read", {
+    resource_type: "deck",
+    limit: 50
+  });
+  const deck = result?.comments?.find((c) => c.id === commentId);
+  if (!deck) return null;
+  return {
+    id: deck.id,
+    title: deck.title ?? "(untitled deck)",
+    author: authorLabel(deck),
+    html: typeof deck.fields?.deckHtml === "string" ? deck.fields.deckHtml : null,
+    blocks: Array.isArray(deck.fields?.deckBlocks) && deck.fields.deckBlocks.length > 0 ? deck.fields.deckBlocks : null
+  };
+}
 function currentMcpOrigin() {
   const config = _config;
   if (!config) throw new Error("MCP config not loaded \u2014 call loadMcpConfig first");
@@ -1487,6 +1505,10 @@ function sessionDir(cwd, session) {
 function sessionJsonPath(cwd, session) {
   return import_node_path4.default.join(sessionDir(cwd, session), "session.json");
 }
+function sessionIdFromCloud(title, fallbackId) {
+  const slug = title.trim().replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "").slice(0, 80);
+  return slug || `deck-${fallbackId.slice(0, 8)}`;
+}
 function readPersistedSession(cwd, session) {
   try {
     const raw = import_node_fs4.default.readFileSync(sessionJsonPath(cwd, session), "utf-8");
@@ -1532,7 +1554,9 @@ function listPersistedSessions(cwd) {
       shared: Boolean(sync),
       stale: Boolean(sync) && persisted.version > (sync?.version ?? 0),
       shareUrl: sync?.publicShareUrl,
-      course: sync?.course
+      course: sync?.course,
+      watching: sync?.watching,
+      watchedFrom: sync?.watchedFrom
     });
   }
   sessions.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
@@ -1931,6 +1955,74 @@ async function startDeckServer(opts = {}) {
         jsonResponse(res, 200, { sessions: listPersistedSessions(cwd) });
         return;
       }
+      const pullMatch = url2.pathname.match(/^\/api\/cloud-decks\/([^/]+)\/pull$/);
+      if (pullMatch && req.method === "POST") {
+        const deckId = decodeURIComponent(pullMatch[1]);
+        let course;
+        try {
+          const raw = await readBody(req);
+          if (raw.trim()) {
+            const parsed = JSON.parse(raw);
+            course = parsed.course?.trim() || void 0;
+          }
+        } catch {
+        }
+        const cfg = resolveShareConfig(cwd, course);
+        if ("error" in cfg) {
+          jsonResponse(res, 400, { ok: false, error: cfg.error });
+          return;
+        }
+        try {
+          const deck = await runWithShareConfig(cfg.override, () => readCloudDeck(deckId));
+          if (!deck) {
+            jsonResponse(res, 404, { ok: false, error: `No shared deck "${deckId}" in this course.` });
+            return;
+          }
+          if (!deck.html && !deck.blocks) {
+            jsonResponse(res, 422, { ok: false, error: "That deck carries no viewable content (no deckHtml or deckBlocks)." });
+            return;
+          }
+          const session = sessionIdFromCloud(deck.title, deck.id);
+          const sessionEncoded = encodeURIComponent(session);
+          let blocks;
+          if (deck.html) {
+            const dir = sessionDir(cwd, session);
+            import_node_fs4.default.mkdirSync(dir, { recursive: true });
+            import_node_fs4.default.writeFileSync(import_node_path4.default.join(dir, "imported.html"), deck.html);
+            blocks = [{ type: "iframe", label: deck.title, src: `/deck-files/${sessionEncoded}/imported.html` }];
+          } else {
+            blocks = deck.blocks;
+          }
+          const persisted = writePersistedSession(cwd, session, { mode: "show", blocks });
+          writeSyncRecord(cwd, session, {
+            resourceId: deck.id,
+            sharedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            version: persisted.version,
+            course,
+            watching: true,
+            watchedFrom: deck.author
+          });
+          broadcastToClients({
+            type: "session",
+            session,
+            mode: "show",
+            blocks,
+            version: persisted.version
+          });
+          jsonResponse(res, 200, {
+            ok: true,
+            session,
+            deckId: deck.id,
+            title: deck.title,
+            author: deck.author,
+            blockCount: blocks.length,
+            course
+          });
+        } catch (err) {
+          jsonResponse(res, 500, { ok: false, error: String(err) });
+        }
+        return;
+      }
       const shareMatch = url2.pathname.match(/^\/api\/sessions\/([^/]+)\/share$/);
       if (shareMatch && req.method === "POST") {
         const id = decodeURIComponent(shareMatch[1]);

package/dist/server/init-entry.js

@@ -1076,14 +1076,30 @@ async function setupFromCloud() {
   console.log(`[entrypoint] bundle from cloud: org=${orgSlug} project=${projectSlug} git=${process.env.GIT_USER_NAME} <${process.env.GIT_USER_EMAIL}> github=${bundle.githubTokenStatus.toLowerCase()} ${cfNote}`);
   return bundle;
 }
+function hasUsableCredentials(credsPath) {
+  if (!(0, import_node_fs4.existsSync)(credsPath)) return false;
+  try {
+    const raw = (0, import_node_fs4.readFileSync)(credsPath, "utf8").trim();
+    if (raw.length === 0) return false;
+    const parsed = JSON.parse(raw);
+    return parsed != null && typeof parsed === "object" && "claudeAiOauth" in parsed;
+  } catch {
+    return false;
+  }
+}
 function setupClaudeCredentials() {
   const home = process.env.HOME ?? "/home/launchpod";
   const claudeDir = (0, import_node_path4.join)(home, ".claude");
   (0, import_node_fs4.mkdirSync)(claudeDir, { recursive: true });
-  const decoded = Buffer.from(requireEnv("CLAUDE_CREDENTIALS_B64"), "base64").toString("utf8");
   const credsPath = (0, import_node_path4.join)(claudeDir, ".credentials.json");
-  (0, import_node_fs4.writeFileSync)(credsPath, decoded);
-  (0, import_node_fs4.chmodSync)(credsPath, 384);
+  if (hasUsableCredentials(credsPath)) {
+    console.log("[entrypoint] ~/.claude/.credentials.json already present \u2014 leaving Claude Code's own (refreshed) credentials intact");
+  } else {
+    const decoded = Buffer.from(requireEnv("CLAUDE_CREDENTIALS_B64"), "base64").toString("utf8");
+    (0, import_node_fs4.writeFileSync)(credsPath, decoded);
+    (0, import_node_fs4.chmodSync)(credsPath, 384);
+    console.log("[entrypoint] seeded ~/.claude/.credentials.json from CLAUDE_CREDENTIALS_B64");
+  }
   const configPath = (0, import_node_path4.join)(home, ".claude.json");
   let cfg = {};
   if ((0, import_node_fs4.existsSync)(configPath)) {
@@ -1107,7 +1123,7 @@ function setupClaudeCredentials() {
     "launch-sequencer"
   ];
   const projects = cfg.projects ?? {};
-  const wsKey = "/workspace";
+  const wsKey = POD_WS;
   const wsProject = projects[wsKey] ?? {};
   const existingEnabled = Array.isArray(wsProject.enabledMcpjsonServers) ? wsProject.enabledMcpjsonServers : [];
   const mergedEnabled = Array.from(/* @__PURE__ */ new Set([...existingEnabled, ...PREAPPROVED_MCPS]));
@@ -1126,7 +1142,7 @@ function setupGitAndGh() {
 function detectAndSetPreviewPort() {
   if (process.env.PREVIEW_PORT) return;
   try {
-    const pkgPath = "/workspace/package.json";
+    const pkgPath = (0, import_node_path4.join)(POD_WS, "package.json");
     if (!(0, import_node_fs4.existsSync)(pkgPath)) return;
     const pkg = JSON.parse((0, import_node_fs4.readFileSync)(pkgPath, "utf-8"));
     const scripts = pkg.scripts ?? {};
@@ -1145,23 +1161,27 @@ function detectAndSetPreviewPort() {
   }
 }
 function initWorkspaceIfEmpty() {
-  process.chdir("/workspace");
+  process.chdir(POD_WS);
   if ((0, import_node_fs4.existsSync)(".git")) {
-    console.log("[entrypoint] /workspace already initialized \u2014 skipping init");
+    console.log(`[entrypoint] ${POD_WS} already initialized \u2014 skipping init`);
     return;
   }
-  console.log("[entrypoint] /workspace is empty \u2014 running launch-kit init");
+  console.log(`[entrypoint] ${POD_WS} is empty \u2014 running launch-kit init`);
   const status = run2("launch-kit", [
     "init",
     `--token=${requireEnv("LS_PAT")}`,
     `--org=${requireEnv("LS_ORG_SLUG")}`,
     `--project=${requireEnv("LS_PROJECT_SLUG")}`,
     `--url=${process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app"}`,
-    `--dir=/workspace`
+    `--dir=${POD_WS}`
   ]);
   if (status !== 0) fail2(`[entrypoint] launch-kit init failed (status ${status})`);
 }
 async function maybeProvisionIngress(bundle, services, projectSlug) {
+  if (LOCAL_ONLY) {
+    console.log("[entrypoint] LAUNCHKIT_LOCAL_ONLY=1 \u2014 skipping CF ingress; services run on localhost only");
+    return null;
+  }
   const token = bundle.cloudflareToken ?? null;
   const accountId = bundle.cloudflareAccountId ?? null;
   const zones = bundle.cloudflareZones ?? [];
@@ -1181,7 +1201,7 @@ async function maybeProvisionIngress(bundle, services, projectSlug) {
   } else {
     fail2(`[entrypoint] cloudflare token covers ${zones.length} zones (${zones.map((z) => z.name).join(", ")}) \u2014 set LAUNCHKIT_CF_BASE_DOMAIN to pick one.`);
   }
-  const stateFile = "/workspace/.launchpod/launch-kit-tunnel.json";
+  const stateFile = (0, import_node_path4.join)(POD_WS, ".launchpod", "launch-kit-tunnel.json");
   const slugLabel = projectSlug.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
   const DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
   for (const s of services) {
@@ -1247,7 +1267,7 @@ async function maybeProvisionAccess(bundle, ingress) {
   }
   const serverUrl = process.env.LS_SERVER_URL ?? "https://launchsecure-v2.vercel.app";
   const pat = requireEnv("LS_PAT");
-  const stateFile = "/workspace/.launchpod/launch-kit-access.json";
+  const stateFile = (0, import_node_path4.join)(POD_WS, ".launchpod", "launch-kit-access.json");
   const gatedHosts = services.filter((s) => !s.bypass).map((s) => s.hostname);
   const bypassed = services.filter((s) => s.bypass).map((s) => `${s.hostname}${s.path ?? ""}`);
   console.log(`[entrypoint] gating ${gatedHosts.join(", ")} behind CF Access (IdP: ${serverUrl})`);
@@ -1346,11 +1366,13 @@ function spawnServiceGroup(services) {
   }).finally(removeSignals);
 }
 async function main() {
-  const priorCrashes = readCrashState()?.count ?? 0;
-  if (priorCrashes >= MAX_BOOT_CRASHES) await parkAfterCrashLoop(priorCrashes);
-  const bootAttempt = bumpCrashCount();
-  if (bootAttempt > 1) {
-    console.warn(`[entrypoint] boot attempt ${bootAttempt}/${MAX_BOOT_CRASHES} \u2014 prior boot(s) crashed before becoming stable`);
+  if (!NO_PARK) {
+    const priorCrashes = readCrashState()?.count ?? 0;
+    if (priorCrashes >= MAX_BOOT_CRASHES) await parkAfterCrashLoop(priorCrashes);
+    const bootAttempt = bumpCrashCount();
+    if (bootAttempt > 1) {
+      console.warn(`[entrypoint] boot attempt ${bootAttempt}/${MAX_BOOT_CRASHES} \u2014 prior boot(s) crashed before becoming stable`);
+    }
   }
   for (const k of REQUIRED_ENV) requireEnv(k);
   const bundle = await setupFromCloud();
@@ -1384,8 +1406,10 @@ async function main() {
     }
   }
   const stableTimer = setTimeout(() => {
-    clearCrashCount();
-    console.log(`[entrypoint] services stable for ${Math.round(STABLE_AFTER_MS / 1e3)}s \u2014 boot-crash counter cleared`);
+    if (!NO_PARK) {
+      clearCrashCount();
+      console.log(`[entrypoint] services stable for ${Math.round(STABLE_AFTER_MS / 1e3)}s \u2014 boot-crash counter cleared`);
+    }
   }, STABLE_AFTER_MS);
   stableTimer.unref?.();
   try {
@@ -1398,7 +1422,7 @@ async function main() {
     process.exit(1);
   }
 }
-var import_node_child_process2, import_node_fs4, import_node_path4, REQUIRED_ENV, LAUNCHPOD_DIR, CRASH_STATE_FILE, MAX_BOOT_CRASHES, STABLE_AFTER_MS, GATED_SERVICES;
+var import_node_child_process2, import_node_fs4, import_node_path4, REQUIRED_ENV, POD_WS, NO_PARK, LOCAL_ONLY, LAUNCHPOD_DIR, CRASH_STATE_FILE, MAX_BOOT_CRASHES, STABLE_AFTER_MS, GATED_SERVICES;
 var init_radar_docker_init_entry = __esm({
   "src/server/radar-docker-init-entry.ts"() {
     "use strict";
@@ -1411,12 +1435,14 @@ var init_radar_docker_init_entry = __esm({
     init_cf_access();
     init_registration();
     REQUIRED_ENV = [
-      "CLAUDE_CREDENTIALS_B64",
       "LS_PAT",
       "LS_ORG_SLUG",
       "LS_PROJECT_SLUG"
     ];
-    LAUNCHPOD_DIR = "/workspace/.launchpod";
+    POD_WS = process.env.LAUNCHPOD_WORKSPACE ?? "/workspace";
+    NO_PARK = process.env.LAUNCHPOD_NO_PARK === "1";
+    LOCAL_ONLY = process.env.LAUNCHKIT_LOCAL_ONLY === "1";
+    LAUNCHPOD_DIR = (0, import_node_path4.join)(POD_WS, ".launchpod");
     CRASH_STATE_FILE = (0, import_node_path4.join)(LAUNCHPOD_DIR, ".boot-crash.json");
     MAX_BOOT_CRASHES = 5;
     STABLE_AFTER_MS = 3e4;

package/dist/server/launch-bot-entry.js

@@ -611,6 +611,14 @@ var require_claude_bridge = __commonJS({
           },
           onError = () => {
           },
+          // Fired (at most once per session) when Claude Code prints its
+          // authentication-failure banner — i.e. the credential it resolved was
+          // rejected by the Anthropic API. In a headless pod nobody is watching the
+          // pty, so this is the only signal the credential died; callers surface it
+          // (radar card + status banner) instead of failing silently. Detail is a
+          // short human string.
+          onAuthFailure = () => {
+          },
           cols = 80,
           rows = 24,
           // When true, spawn `claude --resume <sessionId>` instead of starting a
@@ -671,6 +679,7 @@ var require_claude_bridge = __commonJS({
           this.sessions.set(sessionId, session);
           let trustPromptHandled = false;
           let autoStartSent = !!initialPrompt;
+          let authFailureReported = false;
           let dataBuffer = "";
           claudeProcess.onData((data) => {
             if (process.env.DEBUG) {
@@ -685,6 +694,15 @@ var require_claude_bridge = __commonJS({
                 console.log(`Sent Enter to accept trust prompt for session ${sessionId}`);
               }, 500);
             }
+            if (!authFailureReported && /Please run \/login|Invalid authentication credentials/i.test(dataBuffer)) {
+              authFailureReported = true;
+              console.error(`Claude session ${sessionId}: authentication failed (credential rejected by Anthropic API)`);
+              try {
+                onAuthFailure("Claude credential rejected (401) \u2014 pod could not authenticate to the Anthropic API.");
+              } catch (e) {
+                console.error(`onAuthFailure handler threw for session ${sessionId}:`, e);
+              }
+            }
             if (!autoStartSent && appendSystemPrompt && dataBuffer.includes("\u276F")) {
               autoStartSent = true;
               console.log(`Auto-starting agent in session ${sessionId}`);
@@ -3246,6 +3264,13 @@ var require_src = __commonJS({
                 message: error.message
               });
             },
+            onAuthFailure: (detail) => {
+              this.broadcastToSession(sessionId, {
+                type: "auth_failed",
+                sessionId,
+                message: detail
+              });
+            },
             ...options
           });
           session.active = true;
@@ -3717,13 +3742,22 @@ var require_src = __commonJS({
       return new TerminalHandler(options);
     }
     function createWebSocketHandler2(httpServer, handler2, wsPath = "/terminal/ws") {
-      const wss2 = new WebSocket.Server({
-        server: httpServer,
-        path: wsPath
-      });
+      const wss2 = new WebSocket.Server({ noServer: true });
       wss2.on("connection", (ws, req) => {
         handler2.handleWebSocketConnection(ws, req);
       });
+      httpServer.on("upgrade", (req, socket, head) => {
+        let pathname;
+        try {
+          pathname = new URL(req.url || "/", "http://localhost").pathname;
+        } catch {
+          return;
+        }
+        if (pathname !== wsPath) return;
+        wss2.handleUpgrade(req, socket, head, (ws) => {
+          wss2.emit("connection", ws, req);
+        });
+      });
       return wss2;
     }
     function detectClaudeCli2() {