@midhunxavier/code-flow 0.0.0-stage → 0.1.0-preview.1

package/src/shared-access.js

@@ -0,0 +1,103 @@
+import { redactExport } from "./privacy.js";
+import { sensitiveContextPath } from "./context-inspection.js";
+class SharedPathError extends Error {
+  status = 400;
+}
+function canonicalSharedPath(target) {
+  const raw = target.split("?")[0];
+  if (!raw.startsWith("/") || raw.length > 4e3 || /[\\#\x00-\x20\x7f]/.test(raw) || /%(?:2f|5c|00|25)/i.test(raw)) throw new SharedPathError("Invalid request path");
+  let path;
+  try {
+    path = decodeURIComponent(raw);
+  } catch {
+    throw new SharedPathError("Invalid request path encoding");
+  }
+  if (/[\\#\x00-\x20\x7f]/.test(path)) throw new SharedPathError("Invalid request path");
+  const parts = path === "/" ? [] : path.slice(1).split("/");
+  if (parts.some((part) => !part || part === "." || part === "..")) throw new SharedPathError("Ambiguous request path");
+  if (parts[0] === "api" && parts[1] === "v1" && parts[2] !== "capabilities") parts.splice(1, 1);
+  return { pathname: `/${parts.join("/")}`, parts };
+}
+function sharedRoutePolicy(method, parts) {
+  const route = parts.join("/");
+  if (method === "GET" && route === "api/auth/self" || method === "POST" && route === "api/auth/logout") return "identity";
+  if (method === "GET" && ["api/patterns", "api/templates"].includes(route)) return "catalog";
+  if (method === "GET" && route === "api/projects") return "project-list";
+  if (method === "GET" && ["api/runs", "api/events"].includes(route)) return "run-list";
+  if (parts[0] === "api" && parts[1] === "runs" && /^[a-zA-Z0-9_-]{1,100}$/.test(parts[2] ?? "")) {
+    if (method === "GET" && (parts.length === 3 || parts.length === 4 && ["events", "export", "diff", "review-coverage", "collaboration"].includes(parts[3]))) return "run-read";
+    if (method === "POST" && parts.length === 4 && ["review-coverage", "collaboration"].includes(parts[3])) return "run-review";
+  }
+  return "owner";
+}
+function sharedProjectRole(identity, projectId) {
+  return projectId && Object.hasOwn(identity.roles, projectId) ? identity.roles[projectId] : void 0;
+}
+function sharedCanReadRun(identity, run, projects) {
+  if (run.projectTeam || run.pattern === "team-task-draft") return false;
+  const candidates = run.project ? projects.filter((project) => project.id === run.project) : projects.filter((project) => project.repos.includes(run.repo));
+  return candidates.length === 1 && candidates[0].repos.includes(run.repo) && !!sharedProjectRole(identity, candidates[0].id);
+}
+function sharedProjectProjection(project) {
+  return { id: project.id, name: project.name, createdAt: project.createdAt };
+}
+function sharedDiffProjection(files) {
+  return redactExport(files.filter((file) => !sensitiveContextPath(file.path) && (!file.oldPath || !sensitiveContextPath(file.oldPath))));
+}
+function sharedCoverageProjection(value) {
+  const files = value.files.filter((path) => !sensitiveContextPath(path));
+  const reviewed = value.reviewed.filter((path) => files.includes(path));
+  return { scope: "shared-reviewable-files", omittedCount: value.files.length - files.length, head: value.head, files, reviewed, stale: !!value.stale, coverage: { changed: files.length, reviewed: reviewed.length, percent: files.length ? Math.round(reviewed.length / files.length * 100) : 100 } };
+}
+function pick(value, keys) {
+  return Object.fromEntries(keys.filter((key) => value[key] !== void 0).map((key) => [key, value[key]]));
+}
+function boundedText(value, ceiling) {
+  if (value === void 0) return { text: void 0, truncated: false };
+  const data = Buffer.from(value);
+  if (data.length <= ceiling) return { text: value, truncated: false };
+  let end = ceiling;
+  while (end > 0 && (data[end] & 192) === 128) end--;
+  return { text: data.subarray(0, end).toString("utf8"), truncated: true };
+}
+function stepProjection(step) {
+  const finalText = boundedText(step.finalText, 8 * 1024), error = boundedText(step.error, 4 * 1024);
+  return redactExport({ ...pick(step, ["id", "kind", "title", "role", "agent", "memberId", "taskId", "coordination", "invocations", "status", "startedAt", "endedAt", "retries"]), ...finalText.text !== void 0 ? { finalText: finalText.text } : {}, ...error.text !== void 0 ? { error: error.text } : {}, finalTextTruncated: finalText.truncated, errorTruncated: error.truncated, ...step.contextInput ? { contextInput: pick(step.contextInput, ["scope", "measuredAt", "promptBytes", "schemaBytes", "bytes", "approximateTokens", "resumed", "excluded", "policy", "exceeded", "violations"]) } : {} });
+}
+function sharedRunProjection(run, canReadRun = () => false) {
+  const verification = run.verification, task = boundedText(run.task, 24 * 1024), summary = boundedText(run.summary, 32 * 1024), error = boundedText(run.error, 4 * 1024);
+  const cold = run.cold ? { cold: true, detailAvailable: true } : {};
+  const steps = "steps" in run ? run.steps.slice(-200).map(stepProjection) : void 0;
+  return redactExport({
+    ...pick(run, ["id", "project", "pattern", "status", "createdAt", "endedAt", "baseRef", "baseLabel", "stopReason", "verdict", "facts"]),
+    ...cold,
+    task: task.text,
+    ...summary.text !== void 0 ? { summary: summary.text } : {},
+    ...error.text !== void 0 ? { error: error.text } : {},
+    truncation: { task: task.truncated, summary: summary.truncated, error: error.truncated, omittedSteps: "steps" in run ? Math.max(0, run.steps.length - 200) : 0 },
+    worktrees: run.worktrees.map((worktree) => pick(worktree, ["name", "branch"])),
+    ...steps ? { steps } : {},
+    ...run.parentRunId && canReadRun(run.parentRunId) ? { parentRunId: run.parentRunId } : {},
+    ...run.supersededBy && canReadRun(run.supersededBy) ? { supersededBy: run.supersededBy } : {},
+    ...verification ? { verification: { ...pick(verification, ["version", "profile", "state", "startedAt", "endedAt", "head", "branch"]), checks: verification.checks.map((evidence) => ({ check: pick(evidence.check, ["id", "title", "kind", "required"]), diagnosis: evidence.diagnosis })), ...verification.requirements ? { requirements: verification.requirements.map((requirement) => pick(requirement, ["id", "description", "covered", "missing"])) } : {} } } : {}
+  });
+}
+function sharedEventProjection(event, canReadRun = () => false) {
+  if (!canReadRun(event.runId)) return void 0;
+  const common = { seq: event.seq, ts: event.ts, runId: event.runId };
+  if (event.type === "run") return { ...common, type: "run", run: sharedRunProjection(event.run, canReadRun) };
+  if (event.type === "step") return { ...common, type: "step", step: stepProjection(event.step) };
+  return void 0;
+}
+export {
+  SharedPathError,
+  canonicalSharedPath,
+  sharedCanReadRun,
+  sharedCoverageProjection,
+  sharedDiffProjection,
+  sharedEventProjection,
+  sharedProjectProjection,
+  sharedProjectRole,
+  sharedRoutePolicy,
+  sharedRunProjection
+};

package/src/shared-accounts.js

@@ -0,0 +1,301 @@
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, rename, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { createHash, randomBytes, randomUUID, scrypt, timingSafeEqual } from "node:crypto";
+import { CODEFLOW_HOME } from "./config.js";
+const SHARED_ROLES = ["viewer", "reviewer", "contributor", "maintainer"];
+function roleAtLeast(role, needed) {
+  const rank = role === void 0 ? -1 : SHARED_ROLES.indexOf(role), floor = SHARED_ROLES.indexOf(needed);
+  return rank >= 0 && floor >= 0 && rank >= floor;
+}
+class SharedAccountError extends Error {
+  constructor(message, status = 400) {
+    super(message);
+    this.status = status;
+  }
+}
+const MAX_USERS = 128, MAX_SESSIONS = 1024, SESSION_MS = 12 * 60 * 6e4, IDLE_MS = 30 * 6e4;
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+const object = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+const keys = (v, allowed) => Object.keys(v).every((key) => allowed.includes(key));
+const integer = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+const hex = (v, length) => typeof v === "string" && new RegExp(`^[a-f0-9]{${length}}$`).test(v);
+const userId = (v) => typeof v === "string" && /^u-[a-f0-9-]{36}$/.test(v);
+function username(value, reserved = true) {
+  if (typeof value !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]{2,63}$/.test(value)) throw new SharedAccountError("Use 3\u201364 letters, digits, dots, underscores or dashes for the username");
+  const name = value.toLowerCase();
+  if (reserved && name === "owner") throw new SharedAccountError("The username owner is reserved for the server owner");
+  return name;
+}
+function displayName(value) {
+  if (typeof value !== "string" || !value.trim() || value.length > 120 || /[\x00-\x1f\x7f]/.test(value)) throw new SharedAccountError("Enter a display name of up to 120 characters");
+  return value.trim();
+}
+function passwordText(value, creating = true) {
+  if (typeof value !== "string" || Buffer.byteLength(value) > 1024 || creating && [...value].length < 15) throw new SharedAccountError("Passwords need at least 15 characters and at most 1024 UTF-8 bytes");
+  return value;
+}
+function validateSharedRoles(value) {
+  if (!object(value) || Object.keys(value).length > 200) throw new SharedAccountError("Project roles must be a map with at most 200 assigned projects");
+  const roles = {};
+  for (const [id, role] of Object.entries(value)) {
+    if (!/^[a-zA-Z0-9_-]{1,100}$/.test(id) || ["__proto__", "constructor", "prototype"].includes(id) || !SHARED_ROLES.includes(role)) throw new SharedAccountError("Only project viewer, reviewer, contributor and maintainer roles may be assigned");
+    roles[id] = role;
+  }
+  return roles;
+}
+let activeDerivations = 0;
+async function derive(value, salt) {
+  if (activeDerivations >= 2) throw new SharedAccountError("Sign-in is busy; try again shortly", 429);
+  activeDerivations++;
+  try {
+    return await new Promise((resolve, reject) => scrypt(value, Buffer.from(salt, "hex"), 32, { N: 131072, r: 8, p: 1, maxmem: 256 * 1024 * 1024 }, (error, result) => error ? reject(error) : resolve(result)));
+  } finally {
+    activeDerivations--;
+  }
+}
+async function makePassword(value) {
+  const text = passwordText(value);
+  const salt = randomBytes(16).toString("hex");
+  return { algorithm: "scrypt", N: 131072, r: 8, p: 1, salt, hash: (await derive(text, salt)).toString("hex") };
+}
+const dummySalt = randomBytes(16).toString("hex"), dummyHash = randomBytes(32);
+function publicUser(user) {
+  return { id: user.id, username: user.username, displayName: user.displayName, enabled: user.enabled, revision: user.revision, roles: { ...user.roles }, createdAt: user.createdAt, updatedAt: user.updatedAt };
+}
+function principal(user) {
+  return { kind: "shared", userId: user.id, username: user.username, displayName: user.displayName, revision: user.revision, roles: { ...user.roles } };
+}
+function validateState(raw) {
+  if (!object(raw) || !keys(raw, ["version", "revision", "users", "sessions"]) || raw.version !== 1 || !integer(raw.revision) || !Array.isArray(raw.users) || raw.users.length > MAX_USERS || !Array.isArray(raw.sessions) || raw.sessions.length > MAX_SESSIONS) throw new Error("Invalid shared account storage");
+  for (const u of raw.users) {
+    if (!object(u) || !keys(u, ["id", "username", "displayName", "enabled", "revision", "roles", "createdAt", "updatedAt", "password"]) || !userId(u.id) || username(u.username, false) !== u.username || displayName(u.displayName) !== u.displayName || typeof u.enabled !== "boolean" || !integer(u.revision) || u.revision < 1 || !integer(u.createdAt) || !integer(u.updatedAt) || u.updatedAt < u.createdAt || !object(u.password) || !keys(u.password, ["algorithm", "N", "r", "p", "salt", "hash"]) || u.password.algorithm !== "scrypt" || u.password.N !== 131072 || u.password.r !== 8 || u.password.p !== 1 || !hex(u.password.salt, 32) || !hex(u.password.hash, 64)) throw new Error("Invalid shared account record");
+    validateSharedRoles(u.roles);
+  }
+  if (new Set(raw.users.map((u) => u.id)).size !== raw.users.length || new Set(raw.users.map((u) => u.username)).size !== raw.users.length) throw new Error("Duplicate shared account identity");
+  for (const s of raw.sessions) if (!object(s) || !keys(s, ["hash", "userId", "revision", "createdAt", "lastSeenAt", "expiresAt"]) || !hex(s.hash, 64) || !userId(s.userId) || !integer(s.revision) || !integer(s.createdAt) || !integer(s.lastSeenAt) || !integer(s.expiresAt) || s.lastSeenAt < s.createdAt || s.expiresAt !== s.createdAt + SESSION_MS || s.lastSeenAt > s.expiresAt || !raw.users.some((u) => u.id === s.userId)) throw new Error("Invalid shared account session");
+  if (new Set(raw.sessions.map((s) => s.hash)).size !== raw.sessions.length) throw new Error("Duplicate shared session");
+  return raw;
+}
+class LoginLimiter {
+  buckets = /* @__PURE__ */ new Map();
+  check(address, name, now) {
+    for (const [key, value] of this.buckets) if (value.expires <= now) this.buckets.delete(key);
+    const keys2 = [["global", 100], [`ip:${address.slice(0, 128)}`, 20], [`user:${digest(name)}`, 8]];
+    if (keys2.some(([key, max]) => (this.buckets.get(key)?.count ?? 0) >= max)) throw new SharedAccountError("Too many sign-in attempts; try again later", 429);
+    for (const [key] of keys2) {
+      const bucket = this.buckets.get(key) ?? { count: 0, expires: now + 15 * 6e4 };
+      bucket.count++;
+      this.buckets.delete(key);
+      this.buckets.set(key, bucket);
+    }
+    while (this.buckets.size > 2048) this.buckets.delete(this.buckets.keys().next().value);
+  }
+}
+class SharedAccounts {
+  constructor(file = join(CODEFLOW_HOME, "shared-accounts.json")) {
+    this.file = file;
+  }
+  state = { version: 1, revision: 0, users: [], sessions: [] };
+  loaded = false;
+  loading;
+  readable = true;
+  writes = Promise.resolve();
+  listeners = /* @__PURE__ */ new Set();
+  limiter = new LoginLimiter();
+  get available() {
+    return this.loaded && this.readable;
+  }
+  get hasUsers() {
+    return this.available && this.state.users.length > 0;
+  }
+  load() {
+    return this.loading ??= (async () => {
+      try {
+        const handle = await open(this.file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+        try {
+          const stat = await handle.stat();
+          if (!stat.isFile() || stat.size > 4 * 1024 * 1024) throw new Error("Shared account storage is not a bounded regular file");
+          this.state = validateState(JSON.parse(await handle.readFile("utf8")));
+        } finally {
+          await handle.close();
+        }
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          this.readable = false;
+          throw new SharedAccountError("Shared accounts cannot be read; owner recovery remains available and the account file was left untouched", 503);
+        }
+      } finally {
+        this.loaded = true;
+      }
+    })();
+  }
+  snapshot() {
+    this.require();
+    return { revision: this.state.revision, users: this.state.users.map(publicUser) };
+  }
+  onChange(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  create(input) {
+    return this.change(async (state) => {
+      this.cas(state, input.revision);
+      if (state.users.length >= MAX_USERS) throw new SharedAccountError("At most 128 shared accounts may be created");
+      const name = username(input.username), label = displayName(input.displayName), roles = validateSharedRoles(input.roles);
+      if (state.users.some((user) => user.username === name)) throw new SharedAccountError("That username is already in use", 409);
+      const password = await makePassword(input.password);
+      const now = Date.now();
+      state.users.push({ id: `u-${randomUUID()}`, username: name, displayName: label, enabled: true, revision: 1, roles, password, createdAt: now, updatedAt: now });
+    });
+  }
+  update(id, input) {
+    return this.change(async (state) => {
+      this.cas(state, input.revision);
+      const user = this.find(state, id);
+      if (input.displayName !== void 0) user.displayName = displayName(input.displayName);
+      if (input.enabled !== void 0) {
+        if (typeof input.enabled !== "boolean") throw new SharedAccountError("Enabled must be true or false");
+        user.enabled = input.enabled;
+      }
+      if (input.roles !== void 0) user.roles = validateSharedRoles(input.roles);
+      if (input.password !== void 0) user.password = await makePassword(input.password);
+      user.revision++;
+      user.updatedAt = Date.now();
+      state.sessions = state.sessions.filter((session) => session.userId !== id);
+    });
+  }
+  revokeSessions(id, input) {
+    return this.change((state) => {
+      this.cas(state, input.revision);
+      const user = this.find(state, id);
+      user.revision++;
+      user.updatedAt = Date.now();
+      state.sessions = state.sessions.filter((session) => session.userId !== id);
+    });
+  }
+  /** Runner enrolment (POST /api/team/runners/connect) proves a password exactly like sign-in, with the same transport rule, limiter and constant-time compare, but must not mint a cookie session. */
+  async verifyCredentials(input) {
+    return publicUser(await this.verify(input));
+  }
+  async login(input) {
+    const user = await this.verify(input);
+    const token = randomBytes(32).toString("base64url"), now = Date.now();
+    const revision = user.revision;
+    await this.mutate((state) => {
+      const current = this.find(state, user.id);
+      if (!current.enabled || current.revision !== revision) throw new SharedAccountError("Account changed during sign-in; try again", 401);
+      state.sessions = state.sessions.filter((session) => session.expiresAt > now && session.lastSeenAt + IDLE_MS > now && session.userId !== user.id);
+      const own = this.state.sessions.filter((session) => session.userId === user.id && session.expiresAt > now && session.lastSeenAt + IDLE_MS > now).sort((a, b) => b.createdAt - a.createdAt).slice(0, 7);
+      state.sessions.push(...own, { hash: digest(token), userId: user.id, revision, createdAt: now, lastSeenAt: now, expiresAt: now + SESSION_MS });
+      state.sessions.sort((a, b) => b.createdAt - a.createdAt);
+      state.sessions = state.sessions.slice(0, MAX_SESSIONS);
+    }, false);
+    return { token, user: publicUser(user), expiresAt: now + SESSION_MS };
+  }
+  authenticate(token, options = Date.now()) {
+    const now = typeof options === "number" ? options : options.now ?? Date.now();
+    if (!this.available || !/^[a-zA-Z0-9_-]{43}$/.test(token)) return void 0;
+    const hash = digest(token);
+    const session = this.state.sessions.find((session2) => session2.hash === hash);
+    if (!session || session.expiresAt <= now || session.lastSeenAt + IDLE_MS <= now) return void 0;
+    const user = this.state.users.find((user2) => user2.id === session.userId);
+    if (!user?.enabled || user.revision !== session.revision) return void 0;
+    if (typeof options === "number" || options.touch !== false) session.lastSeenAt = Math.max(session.lastSeenAt, now);
+    return principal(user);
+  }
+  async logout(token) {
+    await this.load();
+    await this.mutate((state) => {
+      state.sessions = state.sessions.filter((session) => session.hash !== digest(token));
+    }, true);
+  }
+  /** The single password check: an unknown account still derives against a dummy salt, so timing never reveals which usernames exist. */
+  async verify(input) {
+    await this.load();
+    this.require();
+    if (!input.secure && !input.loopback) throw new SharedAccountError("Shared sign-in requires HTTPS outside this computer", 403);
+    const name = typeof input.username === "string" ? input.username.toLowerCase() : "";
+    this.limiter.check(input.address, name.slice(0, 128), Date.now());
+    const supplied = passwordText(input.password, false), user = this.state.users.find((entry) => entry.username === name);
+    const expected = user ? Buffer.from(user.password.hash, "hex") : dummyHash;
+    const result = await derive(supplied, user?.password.salt ?? dummySalt);
+    if (!timingSafeEqual(result, expected) || !user?.enabled) throw new SharedAccountError("Invalid username or password", 401);
+    return user;
+  }
+  require() {
+    if (!this.available) throw new SharedAccountError("Shared account storage is unavailable; use the owner recovery link", 503);
+  }
+  find(state, id) {
+    const user = state.users.find((user2) => user2.id === id);
+    if (!user) throw new SharedAccountError("Shared account not found", 404);
+    return user;
+  }
+  cas(state, revision) {
+    if (!integer(revision) || revision !== state.revision) throw new SharedAccountError("Accounts changed; reload before saving", 409);
+  }
+  async change(update) {
+    await this.load();
+    await this.mutate(async (state) => {
+      await update(state);
+      state.revision++;
+    }, true);
+    return this.snapshot();
+  }
+  mutate(update, notify) {
+    const write = this.writes.catch(() => void 0).then(async () => {
+      this.require();
+      const next = structuredClone(this.state);
+      await update(next);
+      await this.write(next);
+      this.state = next;
+      if (notify) for (const listener of this.listeners) {
+        try {
+          listener();
+        } catch {
+        }
+      }
+    });
+    this.writes = write;
+    return write;
+  }
+  async write(state) {
+    await mkdir(dirname(this.file), { recursive: true, mode: 448 });
+    try {
+      const info = await lstat(this.file);
+      if (!info.isFile() || info.isSymbolicLink()) throw new SharedAccountError("Refusing to replace non-regular account storage", 503);
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    const temp = `${this.file}.${randomUUID()}.tmp`;
+    try {
+      const handle = await open(temp, "wx", 384);
+      try {
+        await handle.writeFile(JSON.stringify(state));
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await rename(temp, this.file);
+      await chmod(this.file, 384);
+      if (process.platform !== "win32") {
+        const dir = await open(dirname(this.file), "r");
+        try {
+          await dir.sync();
+        } finally {
+          await dir.close();
+        }
+      }
+    } finally {
+      await rm(temp, { force: true }).catch(() => {
+      });
+    }
+  }
+}
+export {
+  SHARED_ROLES,
+  SharedAccountError,
+  SharedAccounts,
+  roleAtLeast,
+  validateSharedRoles
+};

package/src/shared-api.js

@@ -0,0 +1,239 @@
+import { randomUUID } from "node:crypto";
+import { HttpError, readJson, send } from "./http.js";
+import { roleAtLeast } from "./shared-accounts.js";
+import { sharedCanReadRun, sharedCoverageProjection, sharedDiffProjection, sharedEventProjection, sharedProjectProjection, sharedProjectRole, sharedRoutePolicy, sharedRunProjection } from "./shared-access.js";
+import { afterRunCursor, compareRuns, decodeRunCursor, encodeRunCursor } from "./run-history.js";
+import { sensitiveContextPath } from "./context-inspection.js";
+import { redactExport } from "./privacy.js";
+const sharedStreams = /* @__PURE__ */ new Map();
+let totalSharedStreams = 0;
+const STREAM_BYTES = 2 * 1024 * 1024;
+function sharedStream(res, userId) {
+  const count = sharedStreams.get(userId) ?? 0;
+  if (count >= 4 || totalSharedStreams >= 128) throw new HttpError(429, "Too many shared event streams; close another tab and retry");
+  sharedStreams.set(userId, count + 1);
+  totalSharedStreams++;
+  let closed = false, blocked = false;
+  const disposers = [];
+  const close = () => {
+    if (closed) return;
+    closed = true;
+    const remaining = (sharedStreams.get(userId) ?? 1) - 1;
+    if (remaining) sharedStreams.set(userId, remaining);
+    else sharedStreams.delete(userId);
+    totalSharedStreams--;
+    for (const dispose of disposers.splice(0)) dispose();
+    res.destroy();
+  };
+  const write = (frame) => {
+    if (closed) return;
+    if (blocked || Buffer.byteLength(frame) > STREAM_BYTES || res.writableLength + Buffer.byteLength(frame) > STREAM_BYTES) return close();
+    blocked = !res.write(frame);
+  };
+  res.on("drain", () => {
+    blocked = false;
+  });
+  res.on("close", close);
+  res.writeHead(200, { "content-type": "text/event-stream; charset=utf-8", "cache-control": "no-store", connection: "keep-alive", "x-accel-buffering": "no" });
+  return { close, add: (dispose) => disposers.push(dispose), emit: (value) => write(`data: ${JSON.stringify(value)}
+
+`), ping: () => write(": connected\n\n") };
+}
+async function handleSharedApi(req, res, url, parts, host) {
+  const policy = sharedRoutePolicy(req.method ?? "GET", parts);
+  if (policy === "owner" || policy === "identity") throw new HttpError(403, "This operation requires the Code Flow owner");
+  const current = () => {
+    const identity = host.accounts.authenticate(host.token, { touch: false });
+    if (!identity || identity.userId !== host.identity.userId || identity.revision !== host.identity.revision) throw new HttpError(401, "Shared session expired or was revoked");
+    return identity;
+  };
+  const projectId = (run2) => run2.project ?? (() => {
+    const matches = host.projects.list().filter((project) => project.repos.includes(run2.repo));
+    return matches.length === 1 ? matches[0].id : void 0;
+  })();
+  const canRead = (run2) => (!host.canReadFilePolicy || host.canReadFilePolicy(run2)) && sharedCanReadRun(current(), run2, host.projects.list());
+  const canReadId = (id) => {
+    const run2 = host.manager.get(id);
+    return !!run2 && canRead(run2);
+  };
+  const projection = (run2) => sharedRunProjection({ ...run2, project: projectId(run2) }, canReadId);
+  const authorized = () => host.manager.list().filter(canRead).sort(compareRuns);
+  const requestedRun = () => {
+    const run2 = host.manager.get(parts[2] ?? "");
+    if (!run2 || !canRead(run2)) throw new HttpError(404, "Run not found");
+    return run2;
+  };
+  const assertBranch = (run2, branch) => {
+    if (typeof branch !== "string" || !run2.worktrees.some((tree) => tree.branch === branch)) throw new HttpError(404, "Result branch not found");
+    return branch;
+  };
+  const coverage = sharedCoverageProjection;
+  current();
+  if (policy === "catalog") return send(res, 200, redactExport(parts[1] === "patterns" ? host.patterns : host.templates));
+  if (policy === "project-list") return send(res, 200, host.projects.list().filter((project) => sharedProjectRole(current(), project.id)).map(sharedProjectProjection));
+  if (policy === "run-list" && parts[1] === "runs") {
+    const limit = url.searchParams.has("limit") ? Number(url.searchParams.get("limit")) : 50;
+    const query = url.searchParams.get("q") ?? "", selectedProject = url.searchParams.get("project");
+    if (!Number.isInteger(limit) || limit < 1 || limit > 100 || query.length > 300) throw new HttpError(400, "Choose a history limit of 1\u2013100 and a bounded search");
+    if (selectedProject && !sharedProjectRole(current(), selectedProject)) throw new HttpError(404, "Project not found");
+    const words = query.trim().toLowerCase().split(/\s+/).filter(Boolean);
+    const filtered = authorized().filter((run2) => {
+      if (selectedProject && projectId(run2) !== selectedProject) return false;
+      if (!words.length) return true;
+      const full = run2.cold ? host.manager.get(run2.id) : run2;
+      if (!full || !canRead(full) || selectedProject && projectId(full) !== selectedProject) return false;
+      const text = [full.id, full.task, full.pattern].join("\n").toLowerCase();
+      return words.every((word) => text.includes(word));
+    });
+    const cursor = url.searchParams.get("cursor");
+    let after;
+    try {
+      after = cursor ? decodeRunCursor(cursor) : void 0;
+    } catch {
+      throw new HttpError(400, "Invalid shared history cursor");
+    }
+    const remaining = after ? filtered.filter((run2) => afterRunCursor(run2, after)) : filtered;
+    const page = remaining.slice(0, limit);
+    return send(res, 200, { runs: page.map(projection), total: filtered.length, ...remaining.length > limit ? { nextCursor: encodeRunCursor(page.at(-1)) } : {} });
+  }
+  if (policy === "run-list") {
+    const { emit, close, add, ping } = sharedStream(res, host.identity.userId);
+    let visible = /* @__PURE__ */ new Set();
+    const notification = (run2) => ({ id: run2.id, project: projectId(run2), status: run2.status, createdAt: run2.createdAt, endedAt: run2.endedAt });
+    const reset = () => {
+      const list = authorized();
+      visible = new Set(list.map((run2) => run2.id));
+      emit({ type: "hello", epoch: randomUUID(), runs: list.slice(0, 100).map(notification), total: list.length });
+    };
+    add(host.manager.subscribeAll((run2) => {
+      if (run2.deleted) {
+        if (visible.delete(run2.id)) reset();
+        return;
+      }
+      try {
+        if (canRead(run2)) {
+          visible.add(run2.id);
+          emit({ type: "run", run: notification(run2) });
+        } else if (visible.delete(run2.id)) reset();
+      } catch {
+        close();
+      }
+    }));
+    if (host.onFilePolicyChange) add(host.onFilePolicyChange(() => close()));
+    add(host.accounts.onChange(() => {
+      try {
+        current();
+      } catch {
+        close();
+      }
+    }));
+    add(host.projects.onChange(() => {
+      try {
+        current();
+        reset();
+      } catch {
+        close();
+      }
+    }));
+    const timer = setInterval(() => {
+      try {
+        current();
+        ping();
+      } catch {
+        close();
+      }
+    }, 15e3);
+    timer.unref();
+    add(() => clearInterval(timer));
+    reset();
+    return;
+  }
+  const run = requestedRun();
+  if (policy === "run-review") {
+    const reviewer = (identity2) => roleAtLeast(sharedProjectRole(identity2, projectId(run)), "reviewer");
+    if (!reviewer(current())) throw new HttpError(403, "A project reviewer role is required");
+    const body = await readJson(req, 16 * 1024, { timeoutMs: 1e4 });
+    const branch = assertBranch(run, body.branch);
+    const identity = current();
+    if (!canRead(run) || !reviewer(identity)) throw new HttpError(404, "Run not found");
+    if (parts[3] === "review-coverage") {
+      if (typeof body.path !== "string" || sensitiveContextPath(body.path)) throw new HttpError(403, "This path requires owner review");
+      const result2 = await host.manager.recordFileReview(run.id, { branch, expectedHead: body.expectedHead, path: body.path, reviewed: body.reviewed }, `shared:${identity.userId}:${identity.username}`, () => {
+        if (!canRead(run) || !reviewer(current())) throw new HttpError(403, "Project reviewer access changed");
+      });
+      current();
+      if (!canRead(run)) throw new HttpError(404, "Run not found");
+      return send(res, 200, coverage(result2));
+    }
+    const result = await host.comments.add(run.id, { branch, expectedHead: body.expectedHead, text: body.text }, { id: `shared:${identity.userId}`, name: identity.displayName }, async () => {
+      current();
+      const latest = requestedRun();
+      assertBranch(latest, branch);
+      return (await host.manager.reviewCoverage(run.id, branch)).head;
+    }, () => {
+      if (!canRead(run) || !reviewer(current())) throw new HttpError(403, "Project reviewer access changed");
+    });
+    current();
+    if (!canRead(run)) throw new HttpError(404, "Run not found");
+    return send(res, 201, result);
+  }
+  if (parts.length === 3) return send(res, 200, projection(run));
+  if (parts[3] === "export") return send(res, 200, { version: 1, exportedAt: Date.now(), run: projection(run) });
+  if (parts[3] === "collaboration") {
+    const result = await host.comments.list(run.id);
+    current();
+    if (!canRead(run)) throw new HttpError(404, "Run not found");
+    return send(res, 200, result);
+  }
+  if (parts[3] === "diff" || parts[3] === "review-coverage") {
+    const branch = assertBranch(run, url.searchParams.get("branch"));
+    const result = parts[3] === "diff" ? sharedDiffProjection(await host.manager.diff(run.id, branch, false)) : coverage(await host.manager.reviewCoverage(run.id, branch));
+    current();
+    if (!canRead(run)) throw new HttpError(404, "Run not found");
+    return send(res, 200, result);
+  }
+  if (parts[3] === "events") {
+    const { emit, close, add, ping } = sharedStream(res, host.identity.userId);
+    add(host.manager.subscribe(run.id, (event) => {
+      try {
+        requestedRun();
+        const value = sharedEventProjection(event, canReadId);
+        if (value) emit(value);
+      } catch {
+        close();
+      }
+    }));
+    if (host.onFilePolicyChange) add(host.onFilePolicyChange(() => close()));
+    add(host.accounts.onChange(() => {
+      try {
+        requestedRun();
+      } catch {
+        close();
+      }
+    }));
+    add(host.projects.onChange(() => {
+      try {
+        requestedRun();
+      } catch {
+        close();
+      }
+    }));
+    const timer = setInterval(() => {
+      try {
+        requestedRun();
+        ping();
+      } catch {
+        close();
+      }
+    }, 15e3);
+    timer.unref();
+    add(() => clearInterval(timer));
+    const snapshot = projection(run);
+    emit({ type: "hello", snapshot: { run: { ...snapshot, steps: void 0 }, steps: snapshot.steps ?? [] } });
+    return;
+  }
+  throw new HttpError(403, "This operation requires the Code Flow owner");
+}
+export {
+  handleSharedApi
+};