@lifeaitools/clauth 2.1.1 → 2.10.0

package/cli/dashboard/panels/webdav-panel.css

@@ -0,0 +1,38 @@
+/* cli/dashboard/panels/webdav-panel.css
+   The WebDAV mounts panel (<clauth-webdav-panel>) -- its own copy of the
+   subset of tunnel-panel.css's rules this panel's template actually uses
+   (.tunnel-panel base look, recolored to a column layout; .tunnel-dot;
+   .btn-tunnel-stop), since Shadow DOM cannot see another panel's external
+   stylesheet. Depends on the tokens in ../global.css, loaded before this
+   file by panel-element.js's connectedCallback(). */
+.webdav-panel{background:var(--bg-tunnel);border:1px solid var(--border-dark);border-radius:8px;padding:1rem 1.25rem;margin-bottom:1.25rem;display:flex;flex-direction:column;align-items:stretch;gap:8px}
+.webdav-header{display:flex;align-items:center;gap:10px;width:100%}
+.webdav-title{color:var(--text-bright);font-size:.88rem}
+.webdav-status{font-size:.78rem;color:var(--grey-dim)}
+.webdav-add-btn{margin-left:auto;font-size:.75rem;padding:4px 10px}
+
+.tunnel-dot{width:10px;height:10px;border-radius:50%;flex-shrink:0}
+.tunnel-dot.off{background:var(--grey-dim)}
+.tunnel-dot.starting{background:var(--orange);animation:pulse 1s infinite}
+.tunnel-dot.live{background:var(--green-bright);animation:pulse 2s infinite}
+.tunnel-dot.err{background:var(--red-bright)}
+
+.btn-tunnel-stop{background:var(--bg-card);color:var(--red);border:1px solid var(--border);padding:6px 12px;font-size:.8rem;border-radius:6px;cursor:pointer;font-weight:500}
+.btn-tunnel-stop:hover{background:var(--red-hover-bg);border-color:var(--red)}
+
+.webdav-table{width:100%;border-collapse:collapse;font-size:.82rem}
+.webdav-thead-row{color:var(--grey);text-align:left}
+.webdav-th{padding:4px 8px;border-bottom:1px solid var(--bg-card)}
+.webdav-th-actions{width:60px}
+.webdav-row{color:var(--text-bright)}
+.webdav-td{padding:4px 8px;border-bottom:1px solid var(--bg-dark)}
+.webdav-td-name{font-family:'Courier New',monospace;color:var(--mint)}
+.webdav-td-path{font-family:'Courier New',monospace;color:var(--grey)}
+.webdav-del-btn{font-size:.7rem;padding:2px 8px;color:var(--red-bright)}
+
+.webdav-add-form{padding:8px 0;border-top:1px solid var(--bg-card)}
+.webdav-add-row{display:flex;gap:6px;align-items:center;flex-wrap:wrap}
+.webdav-input{background:var(--bg-darker);border:1px solid var(--border);border-radius:4px;color:var(--text-bright);padding:5px 8px;font-size:.82rem}
+.webdav-input-name{width:120px}
+.webdav-input-path{flex:1;min-width:160px}
+.webdav-save-btn{background:var(--bg-copy)}

package/cli/dashboard/panels/webdav-panel.js

@@ -0,0 +1,166 @@
+// cli/dashboard/panels/webdav-panel.js
+// The WebDAV mounts panel, as a real Web Component: <clauth-webdav-panel>.
+// Owns its own Shadow DOM for the mount table, add/delete mounts, and the
+// live daemon-status dot -- same conversion this file's own header comment
+// used to describe as "extracted verbatim"; this pass takes it the rest of
+// the way to a genuinely isolated custom element, matching tunnel-panel.js
+// (the reference implementation) and toolbar-panel.js.
+//
+// Loaded as a plain classic <script> (not type="module") BEFORE dashboard.js
+// -- same pattern as every other panel script.
+class ClauthWebdavPanel extends window.ClauthPanelElement {
+  static tagName = "clauth-webdav-panel";
+  static cssHref = "/dashboard/panels/webdav-panel.css";
+
+  template() {
+    return `
+    <div class="webdav-panel">
+      <div class="webdav-header">
+        <div class="tunnel-dot off" id="webdav-dot"></div>
+        <strong class="webdav-title">WebDAV Mounts</strong>
+        <span id="webdav-status" class="webdav-status"></span>
+        <button class="btn-tunnel-stop webdav-add-btn" data-action="addMountPrompt">+ Add Mount</button>
+      </div>
+      <table id="webdav-table" class="webdav-table" style="display:none">
+        <thead><tr class="webdav-thead-row">
+          <th class="webdav-th">Name</th>
+          <th class="webdav-th">Path</th>
+          <th class="webdav-th webdav-th-actions"></th>
+        </tr></thead>
+        <tbody id="webdav-mounts"></tbody>
+      </table>
+      <div id="webdav-add-form" class="webdav-add-form" style="display:none">
+        <div class="webdav-add-row">
+          <input id="mount-name" class="webdav-input webdav-input-name" placeholder="name (e.g. projects)">
+          <input id="mount-path" class="webdav-input webdav-input-path" placeholder="C:\\path\\to\\folder">
+          <button class="btn-tunnel-stop webdav-save-btn" data-action="submitMount">Save</button>
+          <button class="btn-tunnel-stop" data-action="hideAddForm">Cancel</button>
+        </div>
+      </div>
+    </div>
+    `;
+  }
+
+  mount() {
+    this.loadWebdavMounts();
+  }
+
+  // ── WebDAV mount management ─────────────────
+  async loadWebdavMounts() {
+    try {
+      const r = await apiFetch("/webdav/config");
+      if (!r) return;
+      const tbody = this.$("#webdav-mounts");
+      const table = this.$("#webdav-table");
+      const dot = this.$("#webdav-dot");
+      const status = this.$("#webdav-status");
+      tbody.innerHTML = "";
+      if (r.upstreams && r.upstreams.length > 0) {
+        table.style.display = "table";
+        r.upstreams.forEach(u => {
+          const tr = document.createElement("tr");
+          tr.className = "webdav-row";
+          tr.innerHTML =
+            '<td class="webdav-td webdav-td-name">' + esc(u.name) + '</td>' +
+            '<td class="webdav-td webdav-td-path">' + esc(u.path) + '</td>' +
+            '<td class="webdav-td"><button class="btn-tunnel-stop webdav-del-btn" data-action="deleteMount" data-mount-name="' + esc(u.name) + '">✕</button></td>';
+          tbody.appendChild(tr);
+        });
+      } else {
+        table.style.display = "none";
+      }
+      // Check ping for live status
+      const ping = await apiFetch("/ping");
+      if (ping && ping.webdav) {
+        const ws = ping.webdav;
+        dot.className = "tunnel-dot " + (ws.status === "running" ? "live" : ws.status === "starting" ? "starting" : "off");
+        status.textContent = ws.status === "running" ? "running on :" + ws.port : ws.status;
+      }
+    } catch {}
+  }
+
+  addMountPrompt() {
+    this.$("#webdav-add-form").style.display = "block";
+    this.$("#mount-name").value = "";
+    this.$("#mount-path").value = "";
+    this.$("#mount-name").focus();
+  }
+
+  hideAddForm() {
+    this.$("#webdav-add-form").style.display = "none";
+  }
+
+  async submitMount() {
+    const name = this.$("#mount-name").value.trim();
+    const mountPath = this.$("#mount-path").value.trim();
+    if (!name || !mountPath) return;
+    const r = await fetch(BASE + "/webdav/mounts", {
+      method: "POST",
+      headers: writeHeaders({ "Content-Type": "application/json" }),
+      body: JSON.stringify({ name, path: mountPath })
+    }).then(r => r.json());
+    if (r.error) { alert(r.error); return; }
+    this.hideAddForm();
+    this.loadWebdavMounts();
+  }
+
+  async deleteMount(name) {
+    if (!confirm("Remove mount '" + name + "'?")) return;
+    await fetch(BASE + "/webdav/mounts/" + encodeURIComponent(name), {
+      method: "DELETE",
+      headers: writeHeaders()
+    });
+    this.loadWebdavMounts();
+  }
+
+  get actions() {
+    return {
+      addMountPrompt: () => this.addMountPrompt(),
+      hideAddForm: () => this.hideAddForm(),
+      // Both dispatch through the window bridges below (NOT this.submitMount()
+      // / this.deleteMount() directly) -- installWriteAccessGuards() wraps the
+      // GLOBAL name with the write-token acquire-and-retry gate. Calling the
+      // instance method directly would silently bypass that gate, restoring
+      // the exact write-lock defect this mechanism exists to prevent. Same
+      // pattern as tunnel-panel.js's wizSubmitCfToken bridge.
+      submitMount: () => window.submitMount(),
+      deleteMount: (e, el) => window.deleteMount(el.dataset.mountName),
+    };
+  }
+}
+
+// Pure string-escape helper -- no shadow-DOM/instance state needed, so it
+// stays a plain function rather than an instance method.
+function esc(s) { const d = document.createElement("div"); d.textContent = s; return d.innerHTML; }
+
+customElements.define(ClauthWebdavPanel.tagName, ClauthWebdavPanel);
+
+// Write-guard bridges: installWriteAccessGuards() (dashboard.js) wraps every
+// name in WRITE_ACTIONS by reassigning window[name] to a guarded version --
+// it can only do that for a real global function, not a class instance
+// method. These thin globals delegate to the real implementation on the live
+// panel instance; installWriteAccessGuards wraps THESE names, and the
+// component's own action dispatcher calls window.submitMount()/
+// window.deleteMount() (see the `actions` getter above), never
+// this.submitMount()/this.deleteMount() directly, so the guard is never
+// bypassed.
+window.submitMount = () => {
+  const el = document.querySelector(ClauthWebdavPanel.tagName);
+  return el?.submitMount();
+};
+window.deleteMount = (name) => {
+  const el = document.querySelector(ClauthWebdavPanel.tagName);
+  return el?.deleteMount(name);
+};
+
+// Panel interface registration — see ./panel-registry.js. mount() is called
+// explicitly by ClauthPanelRegistry.mountAll(), after every script has
+// loaded -- connectedCallback() (panel-element.js) only builds the shadow
+// DOM during HTML parsing, before dashboard.js (and apiFetch) exists.
+window.ClauthPanelRegistry.register({
+  id: "webdav",
+  mount: () => {
+    const el = document.querySelector(ClauthWebdavPanel.tagName);
+    if (el) el.mount();
+  },
+});

package/cli/fingerprint.test.js

@@ -0,0 +1,95 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import { getMachineHash, deriveToken, deriveSeedHash } from "./fingerprint.js";
+
+// getMachineId() normally shells out to WMI/registry/ioreg, which this harness
+// must never do (slow, platform-dependent, pollutes nothing but still real
+// process spawns). CLAUTH_MACHINE_ID takes the container fast-path — no
+// execSync, no cache file — which is exactly the path this suite needs.
+function withMachineId(id, fn) {
+  const old = process.env.CLAUTH_MACHINE_ID;
+  process.env.CLAUTH_MACHINE_ID = id;
+  try { return fn(); } finally {
+    if (old === undefined) delete process.env.CLAUTH_MACHINE_ID;
+    else process.env.CLAUTH_MACHINE_ID = old;
+  }
+}
+
+test("getMachineHash is deterministic for the same machine id", () => {
+  const a = withMachineId("machine-a", () => getMachineHash());
+  const b = withMachineId("machine-a", () => getMachineHash());
+  assert.equal(a, b);
+  assert.match(a, /^[0-9a-f]{64}$/, "must be a sha256 hex digest");
+});
+
+test("getMachineHash differs for a different machine id — the whole point of a fingerprint", () => {
+  const a = withMachineId("machine-a", () => getMachineHash());
+  const b = withMachineId("machine-b", () => getMachineHash());
+  assert.notEqual(a, b);
+});
+
+test("CLAUTH_MACHINE_ID must not be empty", () => {
+  assert.throws(() => withMachineId("   ", () => getMachineHash()), /must not be empty/);
+});
+
+test("deriveToken is deterministic within the same 5-minute window", () => {
+  const hash = withMachineId("machine-a", () => getMachineHash());
+  const first = deriveToken("hunter2", hash);
+  const second = deriveToken("hunter2", hash);
+  assert.equal(first.token, second.token, "same password + hash + window must produce the same token");
+  assert.equal(first.timestamp, second.timestamp);
+  assert.equal(first.machineHash, hash);
+  assert.match(first.token, /^[0-9a-f]{64}$/);
+});
+
+test("deriveToken changes with the password — it is what authenticates, not the machine hash alone", () => {
+  const hash = withMachineId("machine-a", () => getMachineHash());
+  const a = deriveToken("password-one", hash);
+  const b = deriveToken("password-two", hash);
+  assert.notEqual(a.token, b.token);
+});
+
+test("deriveToken changes with the machine hash — a token from one machine must not verify on another", () => {
+  const hashA = withMachineId("machine-a", () => getMachineHash());
+  const hashB = withMachineId("machine-b", () => getMachineHash());
+  const a = deriveToken("hunter2", hashA);
+  const b = deriveToken("hunter2", hashB);
+  assert.notEqual(a.token, b.token);
+});
+
+test("deriveToken timestamp is a 5-minute window boundary, not the raw clock", () => {
+  const hash = withMachineId("machine-a", () => getMachineHash());
+  const { timestamp } = deriveToken("hunter2", hash);
+  const windowMs = 5 * 60 * 1000;
+  assert.equal(timestamp % windowMs, 0, "timestamp must be an exact window boundary, not Date.now()");
+  assert.ok(timestamp <= Date.now(), "the window boundary must not be in the future");
+});
+
+test("deriveSeedHash is deterministic and distinct from deriveToken's output", () => {
+  const hash = withMachineId("machine-a", () => getMachineHash());
+  const seed1 = deriveSeedHash(hash, "hunter2");
+  const seed2 = deriveSeedHash(hash, "hunter2");
+  assert.equal(seed1, seed2);
+  assert.match(seed1, /^[0-9a-f]{64}$/);
+  const { token } = deriveToken("hunter2", hash);
+  assert.notEqual(seed1, token, "seed hash and auth token must not collide — they protect different things");
+});
+
+test("deriveSeedHash changes with the password", () => {
+  const hash = withMachineId("machine-a", () => getMachineHash());
+  assert.notEqual(deriveSeedHash(hash, "one"), deriveSeedHash(hash, "two"));
+});
+
+test("machine id cache: a fresh CLAUTH_MACHINE_ID call never touches the WMI cache file", () => {
+  // Positive control that the cache mechanism exists and this test can see it,
+  // so "the cache file was untouched" below actually means something.
+  const cacheFile = path.join(os.tmpdir(), "clauth-machine.cache");
+  const before = fs.existsSync(cacheFile) ? fs.statSync(cacheFile).mtimeMs : null;
+  withMachineId("container-fast-path", () => getMachineHash());
+  const after = fs.existsSync(cacheFile) ? fs.statSync(cacheFile).mtimeMs : null;
+  assert.equal(before, after, "the container-id fast path must not read or write the WMI cache file");
+});

package/cli/http/components/callagent-terminal-component.js

@@ -0,0 +1,310 @@
+// cli/http/components/callagent-terminal-component.js
+// The CallAgent + Terminal + Channel component: POST/GET /call-agent
+// (lean one-shot dispatch through the warm agent pool, plus job
+// polling/show/hide), the 5 terminal-session routes (start/send/show/
+// stop/recv), and POST /channel (Coolify/GitHub webhook receiver).
+//
+// call_agent routes share one CSRF/bearer guard (evaluateCallAgentGuard) --
+// it's a pure, exported function, but test/call-agent-guard.test.mjs
+// imports it directly FROM serve.js, so it must stay defined and
+// exported there (a stable, tested public surface); passed here via
+// ctx as a plain reference instead of re-imported, avoiding a real
+// circular import (serve.js imports THIS file's register function).
+// noAuthHost/requestHost were computed ONCE per-request in the original shared
+// handler; each call_agent route here recomputes them locally from
+// req.headers.host -- identical values, just no longer shared across
+// routes in one dispatch function.
+//
+// runCallAgent/getCallAgentJob/resolveCallAgentToken stay defined in
+// serve.js (core daemon infrastructure: Supabase job persistence, the
+// AgentCron scheduler, getAgentPool()) and are passed via ctx as plain
+// function references -- same avoid-circular-import DI pattern as
+// call-agent-provider.js's registerCallAgentTool(runCallAgent).
+//
+// getAgentPool/getDelegationLane/startTerminalSession/
+// stopTerminalSession/sendTerminalMessage/recvTerminalResponse/
+// showTerminalSession/channelEvents/MAX_CHANNEL_EVENTS are all already
+// separately-modularized service imports in serve.js (not closure
+// state) -- imported directly here too, zero circularity, matching
+// how cli/mcp/providers/terminal-provider.js already imports the same
+// modules for the MCP-tool side of these same operations.
+import { operation } from "../../supervisor-registry.js";
+import { getAgentPool } from "../../services/agent-pool-instance.js";
+import { getDelegationLane } from "../../services/delegation-lane-instance.js";
+import { startTerminalSession, stopTerminalSession } from "../../services/terminal-sessions.js";
+import { sendTerminalMessage, recvTerminalResponse } from "../../services/terminal-dispatch.js";
+import { showTerminalSession } from "../../services/terminal-window.js";
+import { channelEvents, MAX_CHANNEL_EVENTS } from "../../services/terminal-registry.js";
+import crypto from "node:crypto";
+
+const NOAUTH_HOSTS = ["fs.regendevcorp.com", "clauth.regendevcorp.com", "chitchat.regendevcorp.com"];
+
+export function registerCallAgentTerminalRoutes(ctx) {
+  // ── call_agent (Gate B) ───────────────────────────────────────────────────
+  // POST /call-agent — lean one-shot Haiku dispatch through the warm pool.
+  // sync (default): blocks, returns { ok, package, jobId, model, ms }.
+  // async: returns { ok, jobId } immediately; poll GET /call-agent/:jobId.
+  ctx.registerWriteRoute("POST", "/call-agent", async (req, res, url) => {
+      const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
+      const noAuthHost = NOAUTH_HOSTS.includes(requestHost);
+      // call_agent spawns real `claude` workers. Like legacy /dispatch, it is a
+      // local-tool-only path: reject any browser Origin (CSRF) and, on a noauth
+      // tunnel host (clauth.regendevcorp.com etc.), require a valid
+      // `Authorization: Bearer <CALL_AGENT_TOKEN>`. Local (127.0.0.1) stays
+      // token-free. A noauth host without a valid bearer is still rejected.
+      {
+        const expectedToken = await ctx.resolveCallAgentToken();
+        const verdict = ctx.evaluateCallAgentGuard({
+          origin: req.headers.origin,
+          noAuthHost,
+          authHeader: req.headers.authorization,
+          expectedToken,
+        });
+        if (!verdict.allow) {
+          res.writeHead(verdict.status, { "Content-Type": "application/json", ...ctx.CORS });
+          return res.end(JSON.stringify({ ok: false, error: verdict.error, host: requestHost, ...(verdict.origin ? { origin: verdict.origin } : {}) }));
+        }
+      }
+      let body = "";
+      req.on("data", (d) => (body += d));
+      req.on("end", async () => {
+        let parsed;
+        try {
+          parsed = JSON.parse(body || "{}");
+        } catch {
+          res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+          return res.end(JSON.stringify({ ok: false, error: "invalid JSON" }));
+        }
+        const result = await ctx.runCallAgent(parsed);
+        const status = result.ok ? 200 : (result.error === "binary_not_found" ? 503 : 400);
+        res.writeHead(status, { "Content-Type": "application/json", ...ctx.CORS });
+        res.end(JSON.stringify(result));
+      });
+      return;
+  });
+  // GET /call-agent/:jobId — poll an async (or completed) call_agent job.
+  ctx.registerPatternRoute("GET", /^\/call-agent\/([^/]+)$/, async (req, res, match, url) => {
+    const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
+    const noAuthHost = NOAUTH_HOSTS.includes(requestHost);
+    {
+      const expectedToken = await ctx.resolveCallAgentToken();
+      const verdict = ctx.evaluateCallAgentGuard({
+        origin: req.headers.origin,
+        noAuthHost,
+        authHeader: req.headers.authorization,
+        expectedToken,
+      });
+      if (!verdict.allow) {
+        res.writeHead(verdict.status, { "Content-Type": "application/json", ...ctx.CORS });
+        return res.end(JSON.stringify({ ok: false, error: verdict.error, host: requestHost, ...(verdict.origin ? { origin: verdict.origin } : {}) }));
+      }
+    }
+    const jobId = decodeURIComponent(match[1]);
+    const job = await ctx.getCallAgentJob(jobId);
+    if (!job) {
+      res.writeHead(404, { "Content-Type": "application/json", ...ctx.CORS });
+      return res.end(JSON.stringify({ ok: false, error: "not_found", jobId }));
+    }
+    res.writeHead(200, { "Content-Type": "application/json", ...ctx.CORS });
+    return res.end(JSON.stringify({ ok: job.status === "completed", ...job }));
+  });
+  // POST /call-agent/:jobId/show — bring a running job's console window to the
+  // foreground. POST /call-agent/:jobId/hide — re-hide it. Local-only (127.0.0.1),
+  // same guard as the poll route above.
+  ctx.registerPatternRoute("POST", /^\/call-agent\/([^/]+)\/(show|hide)$/, async (req, res, match, url) => {
+    const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
+    const noAuthHost = NOAUTH_HOSTS.includes(requestHost);
+    {
+      const expectedToken = await ctx.resolveCallAgentToken();
+      const verdict = ctx.evaluateCallAgentGuard({
+        origin: req.headers.origin,
+        noAuthHost,
+        authHeader: req.headers.authorization,
+        expectedToken,
+      });
+      if (!verdict.allow) {
+        res.writeHead(verdict.status, { "Content-Type": "application/json", ...ctx.CORS });
+        return res.end(JSON.stringify({ ok: false, error: verdict.error, host: requestHost, ...(verdict.origin ? { origin: verdict.origin } : {}) }));
+      }
+    }
+    const jobId = decodeURIComponent(match[1]);
+    const action = match[2];
+    const result = action === "show" ? await getAgentPool().showJob(jobId) : await getAgentPool().hideJob(jobId);
+    const status = result.reason === "job_not_found" ? 404 : 200;
+    res.writeHead(status, { "Content-Type": "application/json", ...ctx.CORS });
+    return res.end(JSON.stringify({ ok: !!result.shown, ...result, jobId, action }));
+  });
+  // GET /call-agent — pool stats (health/debug, no credentials).
+  ctx.registerWriteRoute("GET", "/call-agent", async (req, res, url) => {
+      const requestHost = (req.headers.host || "").split(":")[0].toLowerCase();
+      const noAuthHost = NOAUTH_HOSTS.includes(requestHost);
+      {
+        const expectedToken = await ctx.resolveCallAgentToken();
+        const verdict = ctx.evaluateCallAgentGuard({
+          origin: req.headers.origin,
+          noAuthHost,
+          authHeader: req.headers.authorization,
+          expectedToken,
+        });
+        if (!verdict.allow) {
+          res.writeHead(verdict.status, { "Content-Type": "application/json", ...ctx.CORS });
+          return res.end(JSON.stringify({ ok: false, error: verdict.error, host: requestHost, ...(verdict.origin ? { origin: verdict.origin } : {}) }));
+        }
+      }
+      const poolStats = getAgentPool().stats();
+      // WP-P7: only attach delegation-lane stats when the gate is on, so the
+      // stats payload is byte-identical to today when delegation is OFF.
+      const lane = getDelegationLane();
+      const extra = lane ? { delegation: lane.stats() } : {};
+      res.writeHead(200, { "Content-Type": "application/json", ...ctx.CORS });
+      return res.end(JSON.stringify({ ok: true, ...poolStats, ...extra }));
+  });
+  // POST /terminal/start — start a named terminal session
+  ctx.registerWriteRoute("POST", "/terminal/start", async (req, res, url) => {
+      let body = "";
+      req.on("data", d => body += d);
+      req.on("end", () => {
+        try {
+          const { name, knowledge_tier, context_md } = JSON.parse(body);
+          if (!name) {
+            res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+            return res.end(JSON.stringify({ error: "name required" }));
+          }
+          const tier = knowledge_tier || 'db_only';
+          const result = startTerminalSession(name, tier, context_md || null);
+          operation("terminal.start", { name, tier }, null, { ok: !result.error, error: result.error });
+          const status = result.error ? 503 : 200;
+          res.writeHead(status, { "Content-Type": "application/json", ...ctx.CORS });
+          res.end(JSON.stringify(result));
+        } catch {
+          res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+          res.end(JSON.stringify({ error: "invalid JSON" }));
+        }
+      });
+      return;
+  });
+  // POST /terminal/send — send a message to a running terminal session
+  ctx.registerWriteRoute("POST", "/terminal/send", async (req, res, url) => {
+      let body = "";
+      req.on("data", d => body += d);
+      req.on("end", () => {
+        try {
+          const { session_id, message } = JSON.parse(body);
+          if (!session_id || !message) {
+            res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+            return res.end(JSON.stringify({ error: "session_id and message required" }));
+          }
+          const result = sendTerminalMessage(session_id, message);
+          operation("terminal.send", { session_id }, null, { ok: !result.error, error: result.error });
+          const status = result.error === 'session_busy' ? 409 : result.error ? 404 : 200;
+          res.writeHead(status, { "Content-Type": "application/json", ...ctx.CORS });
+          res.end(JSON.stringify(result));
+        } catch {
+          res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+          res.end(JSON.stringify({ error: "invalid JSON" }));
+        }
+      });
+      return;
+  });
+  // POST /terminal/show — reveal/focus an active terminal session or open a visible inspector
+  ctx.registerWriteRoute("POST", "/terminal/show", async (req, res, url) => {
+      let body = "";
+      req.on("data", d => body += d);
+      req.on("end", () => {
+        try {
+          const { session_id } = JSON.parse(body);
+          if (!session_id) {
+            res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+            return res.end(JSON.stringify({ error: "session_id required" }));
+          }
+          const result = showTerminalSession(session_id);
+          const status = result.error === 'not_found' ? 404 : result.error ? 500 : 200;
+          res.writeHead(status, { "Content-Type": "application/json", ...ctx.CORS });
+          res.end(JSON.stringify(result));
+        } catch {
+          res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+          res.end(JSON.stringify({ error: "invalid JSON" }));
+        }
+      });
+      return;
+  });
+  // POST /terminal/stop — stop a terminal session
+  ctx.registerWriteRoute("POST", "/terminal/stop", async (req, res, url) => {
+      let body = "";
+      req.on("data", d => body += d);
+      req.on("end", () => {
+        try {
+          const { session_id } = JSON.parse(body);
+          if (!session_id) {
+            res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+            return res.end(JSON.stringify({ error: "session_id required" }));
+          }
+          const result = stopTerminalSession(session_id);
+          operation("terminal.stop", { session_id }, null, { ok: !result.error, error: result.error });
+          const status = result.error ? 404 : 200;
+          res.writeHead(status, { "Content-Type": "application/json", ...ctx.CORS });
+          res.end(JSON.stringify(result));
+        } catch {
+          res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+          res.end(JSON.stringify({ error: "invalid JSON" }));
+        }
+      });
+      return;
+  });
+  // POST /terminal/recv — read last response from a terminal session
+  ctx.registerWriteRoute("POST", "/terminal/recv", async (req, res, url) => {
+      let body = "";
+      req.on("data", d => body += d);
+      req.on("end", () => {
+        try {
+          const { session_id } = JSON.parse(body);
+          if (!session_id) {
+            res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+            return res.end(JSON.stringify({ error: "session_id required" }));
+          }
+          const result = recvTerminalResponse(session_id);
+          const status = result.error ? 404 : 200;
+          res.writeHead(status, { "Content-Type": "application/json", ...ctx.CORS });
+          res.end(JSON.stringify(result));
+        } catch {
+          res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+          res.end(JSON.stringify({ error: "invalid JSON" }));
+        }
+      });
+      return;
+  });
+  // POST /channel — receive Coolify/GitHub webhook events
+  ctx.registerWriteRoute("POST", "/channel", async (req, res, url) => {
+      let body = "";
+      req.on("data", d => (body += d));
+      req.on("end", () => {
+        try {
+          const payload = JSON.parse(body || "{}");
+          const { event, resource, status: evtStatus, url, repository } = payload;
+          if (!event) {
+            res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+            return res.end(JSON.stringify({ error: "event field required" }));
+          }
+          const eventId = crypto.randomUUID();
+          const entry = {
+            id: eventId,
+            event,
+            resource: resource || null,
+            status: evtStatus || null,
+            url: url || null,
+            repository: repository || null,
+            created_at: new Date().toISOString(),
+          };
+          channelEvents.push(entry);
+          if (channelEvents.length > MAX_CHANNEL_EVENTS) channelEvents.shift();
+          console.log(`[channel] queued event ${eventId} type=${event}`);
+          operation("channel.event", { event, resource, repository }, null, { ok: true, event_id: eventId });
+          return ctx.ok(res, { received: true, event_id: eventId });
+        } catch {
+          res.writeHead(400, { "Content-Type": "application/json", ...ctx.CORS });
+          return res.end(JSON.stringify({ error: "invalid JSON body" }));
+        }
+      });
+      return;
+  });
+}