@nowcrew/daemon 0.6.13 → 0.6.15

package/dist/remote/gateway.js

@@ -1,879 +0,0 @@
-import { createReadStream } from "node:fs";
-import { access, readFile, stat } from "node:fs/promises";
-import { createServer } from "node:http";
-import { homedir } from "node:os";
-import { extname, join, normalize } from "node:path";
-import { randomUUID, timingSafeEqual } from "node:crypto";
-import { WebSocket, WebSocketServer } from "ws";
-import { signGatewayIdentity } from "./identity.js";
-import { ChannelToGatewaySchema, GatewayToChannelSchema, MAX_REMOTE_WEBSOCKET_BUFFER_BYTES, REMOTE_PROTOCOL_VERSION, ResolveRemoteApprovalSchema, ResolveRemoteQuestionSchema, SubmitRemoteInputSchema, } from "./protocol.js";
-import { RemoteSessionDiscovery } from "./session-discovery.js";
-const MAX_BODY_BYTES = 96 * 1024;
-const MAX_DEDUP_ENTRIES = 1_000;
-const MAX_PENDING_CHANNEL_DELIVERIES = 32;
-const MAX_RECENT_TIMELINE_ITEMS = 1_000;
-const MAX_RECENT_TIMELINE_BYTES = 4 * 1024 * 1024;
-const MAX_TIMELINE_SNAPSHOT_ITEMS = 400;
-const MAX_CLAUDE_MESSAGE_MATCH_DISTANCE_MS = 24 * 60 * 60 * 1_000;
-const DEFAULT_CHANNEL_DELIVERY_TIMEOUT_MS = 2_000;
-const WS_PROTOCOL = "nowcrew.remote.v2";
-const SESSION_PATH_RE = /^\/api\/v1\/sessions\/(claude|codex)\/([0-9a-f-]+)(?:\/(timeline|input))?$/i;
-const APPROVAL_PATH_RE = /^\/api\/v1\/sessions\/(claude|codex)\/([0-9a-f-]+)\/approvals\/([A-Za-z0-9_-]+)$/;
-const QUESTION_PATH_RE = /^\/api\/v1\/sessions\/(claude|codex)\/([0-9a-f-]+)\/questions\/([0-9a-f-]+)$/i;
-function pendingInteractionKey(sessionId, requestId) {
-    return `${sessionId}:${requestId}`;
-}
-function inputDedupKey(runtime, sessionId, idempotencyKey) {
-    return `${runtime}:${sessionId}:${idempotencyKey}`;
-}
-function timelineCacheKey(runtime, sessionId, itemId) {
-    return `${runtime}:${sessionId}:${itemId}`;
-}
-function parseDeliverableChannelFrame(value) {
-    const frame = GatewayToChannelSchema.parse(value);
-    if (frame.type === "channel.registered")
-        throw new Error("Registration acknowledgements are not deliveries");
-    return frame;
-}
-function json(response, status, value) {
-    const body = JSON.stringify(value);
-    response.writeHead(status, {
-        "content-type": "application/json; charset=utf-8",
-        "content-length": Buffer.byteLength(body),
-        "cache-control": "no-store",
-        "x-content-type-options": "nosniff",
-    });
-    response.end(body);
-}
-function bearer(request) {
-    const value = request.headers.authorization;
-    return value?.startsWith("Bearer ") ? value.slice("Bearer ".length) : null;
-}
-function tokenMatches(expected, actual) {
-    if (actual === null)
-        return false;
-    const left = Buffer.from(expected);
-    const right = Buffer.from(actual);
-    return left.length === right.length && timingSafeEqual(left, right);
-}
-function websocketToken(request) {
-    const auth = bearer(request);
-    if (auth)
-        return auth;
-    const values = String(request.headers["sec-websocket-protocol"] ?? "")
-        .split(",")
-        .map((value) => value.trim());
-    const encoded = values.find((value) => value.startsWith("auth."))?.slice("auth.".length);
-    if (!encoded)
-        return null;
-    try {
-        return Buffer.from(encoded, "base64url").toString("utf8");
-    }
-    catch {
-        return null;
-    }
-}
-function allowedOrigin(request, config) {
-    const origin = request.headers.origin;
-    if (!origin)
-        return true;
-    if (config.allowedOrigins.includes(origin))
-        return true;
-    const host = request.headers.host;
-    if (!host)
-        return false;
-    return origin === `http://${host}` || origin === `https://${host}`;
-}
-async function readJsonBody(request) {
-    const chunks = [];
-    let bytes = 0;
-    for await (const chunk of request) {
-        const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        bytes += value.length;
-        if (bytes > MAX_BODY_BYTES)
-            throw new RangeError("request body too large");
-        chunks.push(value);
-    }
-    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
-}
-function mime(path) {
-    switch (extname(path)) {
-        case ".html": return "text/html; charset=utf-8";
-        case ".js": return "text/javascript; charset=utf-8";
-        case ".css": return "text/css; charset=utf-8";
-        case ".svg": return "image/svg+xml";
-        case ".png": return "image/png";
-        case ".woff2": return "font/woff2";
-        case ".json": return "application/json; charset=utf-8";
-        case ".webmanifest": return "application/manifest+json";
-        default: return "application/octet-stream";
-    }
-}
-async function serveStatic(response, uiDir, pathname) {
-    const relative = pathname === "/" ? "index.html" : pathname.slice(1);
-    const normalized = normalize(relative).replace(/^(\.\.(\/|\\|$))+/, "");
-    let path = join(uiDir, normalized);
-    try {
-        const info = await stat(path);
-        if (!info.isFile())
-            throw new Error("not a file");
-    }
-    catch {
-        path = join(uiDir, "index.html");
-        try {
-            await access(path);
-        }
-        catch {
-            return false;
-        }
-    }
-    const info = await stat(path);
-    const revalidate = path.endsWith("index.html")
-        || path.endsWith("sw.js")
-        || path.endsWith("manifest.webmanifest");
-    response.writeHead(200, {
-        "content-type": mime(path),
-        "content-length": info.size,
-        "cache-control": revalidate ? "no-cache" : "public, max-age=31536000, immutable",
-        "x-content-type-options": "nosniff",
-        "content-security-policy": "default-src 'self'; connect-src 'self' ws: wss:; font-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self'; base-uri 'none'; frame-ancestors 'none'",
-    });
-    createReadStream(path).pipe(response);
-    return true;
-}
-function websocketSend(socket, value) {
-    if (socket.readyState !== WebSocket.OPEN)
-        return Promise.resolve(false);
-    const serialized = JSON.stringify(value);
-    if (socket.bufferedAmount + Buffer.byteLength(serialized, "utf8") > MAX_REMOTE_WEBSOCKET_BUFFER_BYTES) {
-        socket.close(1013, "outbound buffer limit");
-        return Promise.resolve(false);
-    }
-    return new Promise((resolve) => {
-        try {
-            socket.send(serialized, (error) => resolve(error === undefined || error === null));
-        }
-        catch {
-            resolve(false);
-        }
-    });
-}
-export async function startRemoteGateway(options) {
-    const { config } = options;
-    const gatewayId = options.gatewayId ?? randomUUID();
-    const activeClaudeConnections = new Map();
-    const activeClaudeView = new Map();
-    const pendingApprovals = new Map();
-    const pendingQuestions = new Map();
-    const acceptedInputs = new Map();
-    const inputsInFlight = new Set();
-    const interactionsInFlight = new Set();
-    const pendingChannelDeliveries = new Map();
-    const recentTimelineItems = new Map();
-    let recentTimelineBytes = 0;
-    const clientSockets = new Set();
-    const discovery = options.discovery ?? new RemoteSessionDiscovery({
-        claudeProjectsRoot: options.claudeProjectsRoot ?? join(homedir(), ".claude", "projects"),
-        codexSessionsRoot: options.codexSessionsRoot ?? join(homedir(), ".codex", "sessions"),
-        activeClaude: activeClaudeView,
-        ...(options.runtimeStates === undefined ? {} : { runtimeStates: options.runtimeStates }),
-    });
-    const removeCachedTimelineItem = (key) => {
-        const cached = recentTimelineItems.get(key);
-        if (!cached)
-            return;
-        recentTimelineItems.delete(key);
-        recentTimelineBytes -= cached.bytes;
-    };
-    const cacheTimelineItem = (runtime, sessionId, item) => {
-        const key = timelineCacheKey(runtime, sessionId, item.id);
-        removeCachedTimelineItem(key);
-        const bytes = Buffer.byteLength(JSON.stringify(item), "utf8");
-        recentTimelineItems.set(key, { runtime, sessionId, item, bytes });
-        recentTimelineBytes += bytes;
-        while (recentTimelineItems.size > MAX_RECENT_TIMELINE_ITEMS
-            || recentTimelineBytes > MAX_RECENT_TIMELINE_BYTES) {
-            const oldest = recentTimelineItems.keys().next().value;
-            if (!oldest)
-                break;
-            removeCachedTimelineItem(oldest);
-        }
-    };
-    const removeCachedInteraction = (runtime, sessionId, requestId) => {
-        for (const [key, cached] of recentTimelineItems) {
-            if (cached.runtime !== runtime || cached.sessionId !== sessionId)
-                continue;
-            if ((cached.item.kind === "approval" || cached.item.kind === "question")
-                && cached.item.requestId === requestId)
-                removeCachedTimelineItem(key);
-        }
-    };
-    const timelineSnapshot = (runtime, sessionId, durable) => {
-        const merged = new Map(durable.map((item) => [item.id, item]));
-        const matchedDurableMessages = new Set();
-        for (const cached of recentTimelineItems.values()) {
-            if (cached.runtime !== runtime || cached.sessionId !== sessionId)
-                continue;
-            if (runtime === "claude" && cached.item.kind === "message" && cached.item.role === "assistant") {
-                const cachedAt = Date.parse(cached.item.createdAt);
-                let nearest = null;
-                for (const item of durable) {
-                    if (item.kind !== "message" || matchedDurableMessages.has(item.id))
-                        continue;
-                    if (item.role !== cached.item.role || item.text !== cached.item.text)
-                        continue;
-                    const distance = Math.abs(Date.parse(item.createdAt) - cachedAt);
-                    if (!Number.isFinite(distance) || distance > MAX_CLAUDE_MESSAGE_MATCH_DISTANCE_MS)
-                        continue;
-                    if (!nearest || distance < nearest.distance)
-                        nearest = { id: item.id, distance };
-                }
-                if (nearest) {
-                    matchedDurableMessages.add(nearest.id);
-                    continue;
-                }
-            }
-            merged.delete(cached.item.id);
-            merged.set(cached.item.id, cached.item);
-        }
-        return [...merged.values()]
-            .sort((left, right) => left.createdAt.localeCompare(right.createdAt))
-            .slice(-MAX_TIMELINE_SNAPSHOT_ITEMS);
-    };
-    const broadcast = (event) => {
-        if (event.type === "timeline.appended")
-            cacheTimelineItem(event.runtime, event.sessionId, event.item);
-        for (const socket of clientSockets)
-            void websocketSend(socket, event);
-    };
-    const sessionsChanged = () => broadcast({
-        type: "sessions.changed",
-        protocolVersion: REMOTE_PROTOCOL_VERSION,
-    });
-    const interactionResolved = (runtime, sessionId, requestId) => {
-        removeCachedInteraction(runtime, sessionId, requestId);
-        broadcast({
-            type: "interaction.resolved",
-            protocolVersion: REMOTE_PROTOCOL_VERSION,
-            runtime,
-            sessionId,
-            requestId,
-        });
-    };
-    const clearClaudeInteractions = (sessionId) => {
-        for (const [key, pending] of pendingApprovals) {
-            if (pending.sessionId !== sessionId)
-                continue;
-            pendingApprovals.delete(key);
-            interactionResolved("claude", sessionId, pending.item.requestId);
-        }
-        for (const [key, pending] of pendingQuestions) {
-            if (pending.sessionId !== sessionId)
-                continue;
-            pendingQuestions.delete(key);
-            interactionResolved("claude", sessionId, pending.item.requestId);
-        }
-    };
-    const settleChannelDelivery = (deliveryId, status) => {
-        const pending = pendingChannelDeliveries.get(deliveryId);
-        if (!pending)
-            return;
-        pendingChannelDeliveries.delete(deliveryId);
-        clearTimeout(pending.timer);
-        pending.resolve(status);
-    };
-    const failChannelDeliveries = (sessionId, generation) => {
-        for (const [deliveryId, pending] of pendingChannelDeliveries) {
-            if (pending.sessionId === sessionId && pending.generation === generation) {
-                settleChannelDelivery(deliveryId, "disconnected");
-            }
-        }
-    };
-    const deliverToClaude = (connection, frame) => {
-        const current = activeClaudeConnections.get(connection.sessionId);
-        if (!current || current.socket !== connection.socket || current.generation !== connection.generation) {
-            return Promise.resolve("disconnected");
-        }
-        const pendingCount = [...pendingChannelDeliveries.values()]
-            .filter((pending) => pending.sessionId === connection.sessionId
-            && pending.generation === connection.generation).length;
-        if (pendingCount >= MAX_PENDING_CHANNEL_DELIVERIES)
-            return Promise.resolve("queue_full");
-        return new Promise((resolve) => {
-            const timer = setTimeout(() => settleChannelDelivery(frame.deliveryId, "unconfirmed"), options.channelDeliveryTimeoutMs ?? DEFAULT_CHANNEL_DELIVERY_TIMEOUT_MS);
-            pendingChannelDeliveries.set(frame.deliveryId, {
-                sessionId: connection.sessionId,
-                generation: connection.generation,
-                timer,
-                resolve,
-            });
-            void websocketSend(connection.socket, frame).then((sent) => {
-                if (!sent)
-                    settleChannelDelivery(frame.deliveryId, "disconnected");
-            });
-        });
-    };
-    const respondForDeliveryFailure = (response, status) => {
-        if (status === "accepted")
-            return false;
-        if (status === "queue_full")
-            json(response, 429, { error: "queue_full" });
-        else if (status === "unconfirmed")
-            json(response, 504, { error: "delivery_unconfirmed" });
-        else if (status === "not_pending")
-            json(response, 409, { error: "interaction_not_pending" });
-        else
-            json(response, 409, { error: "session_not_live" });
-        return true;
-    };
-    const listSessions = async () => {
-        const history = await discovery.list();
-        if (!options.codex || options.runtimeStates?.codex)
-            return history;
-        let live;
-        try {
-            live = await options.codex.listSessions();
-        }
-        catch {
-            return history;
-        }
-        const merged = new Map(history.map((session) => [`${session.runtime}:${session.id}`, session]));
-        for (const session of live)
-            merged.set(`codex:${session.id}`, session);
-        return [...merged.values()].sort((a, b) => b.updatedAt.localeCompare(a.updatedAt)).slice(0, 200);
-    };
-    const unsubscribeCodex = options.codex?.onEvent((event) => {
-        if (event.type === "sessions.changed")
-            sessionsChanged();
-        else
-            broadcast({ ...event, runtime: "codex", protocolVersion: REMOTE_PROTOCOL_VERSION });
-    });
-    const server = createServer((request, response) => {
-        void (async () => {
-            const url = new URL(request.url ?? "/", `http://${request.headers.host ?? "localhost"}`);
-            if (request.method === "GET" && url.pathname === "/api/v1/health") {
-                json(response, 200, { ok: true, protocolVersion: REMOTE_PROTOCOL_VERSION });
-                return;
-            }
-            if (request.method === "GET" && url.pathname === "/api/v1/identity") {
-                const nonce = url.searchParams.get("nonce");
-                if (!nonce) {
-                    json(response, 400, { error: "identity_nonce_required" });
-                    return;
-                }
-                if (!options.identityKey) {
-                    json(response, 503, { error: "identity_unavailable" });
-                    return;
-                }
-                const identity = { gatewayId, pid: process.pid, protocolVersion: REMOTE_PROTOCOL_VERSION };
-                try {
-                    json(response, 200, {
-                        ...identity,
-                        proof: signGatewayIdentity(options.identityKey, nonce, identity),
-                    });
-                }
-                catch {
-                    json(response, 400, { error: "invalid_identity_nonce" });
-                }
-                return;
-            }
-            if (url.pathname.startsWith("/api/")) {
-                if (!tokenMatches(config.token, bearer(request))) {
-                    json(response, 401, { error: "unauthorized" });
-                    return;
-                }
-                if (!["GET", "HEAD"].includes(request.method ?? "") && !allowedOrigin(request, config)) {
-                    json(response, 403, { error: "origin_not_allowed" });
-                    return;
-                }
-            }
-            if (request.method === "GET" && url.pathname === "/api/v1/sessions") {
-                json(response, 200, { sessions: await listSessions() });
-                return;
-            }
-            const approvalMatch = APPROVAL_PATH_RE.exec(url.pathname);
-            if (request.method === "POST" && approvalMatch) {
-                const runtime = approvalMatch[1].toLowerCase();
-                const sessionId = approvalMatch[2];
-                const requestId = approvalMatch[3];
-                const body = ResolveRemoteApprovalSchema.parse(await readJsonBody(request));
-                if (runtime === "codex") {
-                    if (!options.codex?.resolveApproval(sessionId, requestId, body.decision)) {
-                        json(response, 409, { error: "approval_not_pending" });
-                        return;
-                    }
-                    interactionResolved("codex", sessionId, requestId);
-                    json(response, 202, { accepted: true });
-                    return;
-                }
-                const pendingKey = pendingInteractionKey(sessionId, requestId);
-                const pending = pendingApprovals.get(pendingKey);
-                if (!pending || pending.sessionId !== sessionId) {
-                    json(response, 409, { error: "approval_not_pending" });
-                    return;
-                }
-                const interactionKey = `approval:${sessionId}:${requestId}`;
-                if (interactionsInFlight.has(interactionKey)) {
-                    json(response, 409, { error: "approval_in_progress" });
-                    return;
-                }
-                const connection = activeClaudeConnections.get(sessionId);
-                if (!connection) {
-                    json(response, 409, { error: "session_not_live" });
-                    return;
-                }
-                interactionsInFlight.add(interactionKey);
-                try {
-                    const deliveryId = randomUUID();
-                    const delivery = await deliverToClaude(connection, parseDeliverableChannelFrame(pending.bridge ? {
-                        type: "bridge.approval_response",
-                        protocolVersion: REMOTE_PROTOCOL_VERSION,
-                        deliveryId,
-                        requestId,
-                        decision: body.decision,
-                    } : {
-                        type: "channel.permission_response",
-                        protocolVersion: REMOTE_PROTOCOL_VERSION,
-                        deliveryId,
-                        requestId,
-                        decision: body.decision,
-                    }));
-                    if (delivery === "not_pending") {
-                        pendingApprovals.delete(pendingKey);
-                        interactionResolved("claude", sessionId, requestId);
-                    }
-                    if (respondForDeliveryFailure(response, delivery))
-                        return;
-                    pendingApprovals.delete(pendingKey);
-                    interactionResolved("claude", sessionId, requestId);
-                    json(response, 202, { accepted: true });
-                }
-                finally {
-                    interactionsInFlight.delete(interactionKey);
-                }
-                return;
-            }
-            const questionMatch = QUESTION_PATH_RE.exec(url.pathname);
-            if (request.method === "POST" && questionMatch) {
-                const runtime = questionMatch[1].toLowerCase();
-                const sessionId = questionMatch[2];
-                const requestId = questionMatch[3];
-                const body = ResolveRemoteQuestionSchema.parse(await readJsonBody(request));
-                if (runtime === "codex") {
-                    if (!options.codex?.resolveQuestion(sessionId, requestId, body)) {
-                        json(response, 409, { error: "question_not_pending" });
-                        return;
-                    }
-                    interactionResolved("codex", sessionId, requestId);
-                    json(response, 202, { accepted: true });
-                    return;
-                }
-                const pendingKey = pendingInteractionKey(sessionId, requestId);
-                const pending = pendingQuestions.get(pendingKey);
-                const connection = activeClaudeConnections.get(sessionId);
-                if (!pending || pending.sessionId !== sessionId || !connection) {
-                    json(response, 409, { error: "question_not_pending" });
-                    return;
-                }
-                const interactionKey = `question:${sessionId}:${requestId}`;
-                if (interactionsInFlight.has(interactionKey)) {
-                    json(response, 409, { error: "question_in_progress" });
-                    return;
-                }
-                interactionsInFlight.add(interactionKey);
-                try {
-                    const delivery = await deliverToClaude(connection, parseDeliverableChannelFrame({
-                        type: "bridge.question_response",
-                        protocolVersion: REMOTE_PROTOCOL_VERSION,
-                        deliveryId: randomUUID(),
-                        requestId,
-                        answers: body.answers,
-                    }));
-                    if (delivery === "not_pending") {
-                        pendingQuestions.delete(pendingKey);
-                        interactionResolved("claude", sessionId, requestId);
-                    }
-                    if (respondForDeliveryFailure(response, delivery))
-                        return;
-                    pendingQuestions.delete(pendingKey);
-                    interactionResolved("claude", sessionId, requestId);
-                    json(response, 202, { accepted: true });
-                }
-                finally {
-                    interactionsInFlight.delete(interactionKey);
-                }
-                return;
-            }
-            const match = SESSION_PATH_RE.exec(url.pathname);
-            if (request.method === "GET" && match?.[3] === "timeline") {
-                const runtime = match[1].toLowerCase();
-                const discovered = runtime === "codex" && options.codex
-                    ? await options.codex.timeline(match[2])
-                    : await discovery.timeline(runtime, match[2]);
-                if (discovered === null) {
-                    json(response, 404, { error: "session_not_found" });
-                    return;
-                }
-                const items = runtime === "claude"
-                    ? [
-                        ...discovered,
-                        ...[...pendingApprovals.values()].filter((pending) => pending.sessionId === match[2]).map((pending) => pending.item),
-                        ...[...pendingQuestions.values()].filter((pending) => pending.sessionId === match[2]).map((pending) => pending.item),
-                    ]
-                    : discovered;
-                json(response, 200, { items: timelineSnapshot(runtime, match[2], items) });
-                return;
-            }
-            if (request.method === "POST" && match?.[3] === "input") {
-                const runtime = match[1].toLowerCase();
-                const sessionId = match[2];
-                const degradedState = options.runtimeStates?.[runtime];
-                if (degradedState) {
-                    json(response, 501, { error: `runtime_${degradedState}` });
-                    return;
-                }
-                if (runtime !== "claude" && !options.codex) {
-                    json(response, 501, { error: "runtime_not_connected" });
-                    return;
-                }
-                const input = SubmitRemoteInputSchema.parse(await readJsonBody(request));
-                const dedupKey = inputDedupKey(runtime, sessionId, input.idempotencyKey);
-                const prior = acceptedInputs.get(dedupKey);
-                if (prior) {
-                    json(response, 202, { accepted: true, requestId: prior.requestId, duplicate: true });
-                    return;
-                }
-                if (inputsInFlight.has(dedupKey)) {
-                    json(response, 409, { error: "input_in_progress" });
-                    return;
-                }
-                const connection = runtime === "claude" ? activeClaudeConnections.get(sessionId) : undefined;
-                if (runtime === "claude" && !connection) {
-                    json(response, 409, { error: "session_not_live" });
-                    return;
-                }
-                const accepted = {
-                    requestId: input.idempotencyKey,
-                    sessionId,
-                    acceptedAt: new Date().toISOString(),
-                };
-                inputsInFlight.add(dedupKey);
-                try {
-                    if (runtime === "claude") {
-                        const delivery = await deliverToClaude(connection, parseDeliverableChannelFrame({
-                            type: "channel.prompt",
-                            protocolVersion: REMOTE_PROTOCOL_VERSION,
-                            deliveryId: randomUUID(),
-                            requestId: accepted.requestId,
-                            text: input.text,
-                        }));
-                        if (respondForDeliveryFailure(response, delivery))
-                            return;
-                    }
-                    else {
-                        await options.codex.submit(sessionId, input);
-                    }
-                }
-                finally {
-                    inputsInFlight.delete(dedupKey);
-                }
-                acceptedInputs.set(dedupKey, accepted);
-                while (acceptedInputs.size > MAX_DEDUP_ENTRIES) {
-                    const oldest = acceptedInputs.keys().next().value;
-                    if (!oldest)
-                        break;
-                    acceptedInputs.delete(oldest);
-                }
-                if (runtime === "claude") {
-                    broadcast({
-                        type: "timeline.appended",
-                        protocolVersion: REMOTE_PROTOCOL_VERSION,
-                        runtime,
-                        sessionId,
-                        item: {
-                            id: accepted.requestId,
-                            kind: "message",
-                            role: "user",
-                            text: input.text,
-                            createdAt: accepted.acceptedAt,
-                        },
-                    });
-                }
-                json(response, 202, { accepted: true, requestId: accepted.requestId, duplicate: false });
-                return;
-            }
-            if (url.pathname.startsWith("/api/")) {
-                json(response, 404, { error: "not_found" });
-                return;
-            }
-            if (request.method === "GET" && options.uiDir && await serveStatic(response, options.uiDir, url.pathname))
-                return;
-            json(response, 404, { error: "not_found" });
-        })().catch((error) => {
-            if (response.headersSent) {
-                response.destroy(error instanceof Error ? error : new Error(String(error)));
-                return;
-            }
-            const message = error instanceof SyntaxError ? "invalid_json"
-                : error instanceof RangeError ? "request_too_large"
-                    : "invalid_request";
-            json(response, message === "request_too_large" ? 413 : 400, { error: message });
-        });
-    });
-    const selectProtocol = (protocols) => protocols.has(WS_PROTOCOL) ? WS_PROTOCOL : false;
-    const clientWss = new WebSocketServer({
-        noServer: true,
-        maxPayload: MAX_BODY_BYTES,
-        handleProtocols: selectProtocol,
-    });
-    const channelWss = new WebSocketServer({
-        noServer: true,
-        maxPayload: MAX_BODY_BYTES,
-        handleProtocols: selectProtocol,
-    });
-    server.on("upgrade", (request, socket, head) => {
-        const url = new URL(request.url ?? "/", `http://${request.headers.host ?? "localhost"}`);
-        if (!tokenMatches(config.token, websocketToken(request)) || !allowedOrigin(request, config)) {
-            socket.write("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
-            socket.destroy();
-            return;
-        }
-        const wss = url.pathname === "/ws/client" ? clientWss
-            : url.pathname === "/ws/channel" ? channelWss
-                : null;
-        if (!wss) {
-            socket.write("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
-            socket.destroy();
-            return;
-        }
-        wss.handleUpgrade(request, socket, head, (ws) => {
-            wss.emit("connection", ws, request);
-        });
-    });
-    clientWss.on("connection", (socket) => {
-        clientSockets.add(socket);
-        socket.on("close", () => clientSockets.delete(socket));
-    });
-    channelWss.on("connection", (socket) => {
-        let registration = null;
-        socket.on("message", (raw) => {
-            let decoded;
-            try {
-                decoded = JSON.parse(raw.toString());
-            }
-            catch {
-                socket.close(1008, "invalid JSON");
-                return;
-            }
-            const parsed = ChannelToGatewaySchema.safeParse(decoded);
-            if (!parsed.success) {
-                socket.close(1008, "invalid channel frame");
-                return;
-            }
-            const frame = parsed.data;
-            if (frame.type === "channel.register") {
-                if (options.runtimeStates?.claude) {
-                    socket.close(1008, `runtime ${options.runtimeStates.claude}`);
-                    return;
-                }
-                if (registration) {
-                    socket.close(1008, "already registered");
-                    return;
-                }
-                const previous = activeClaudeConnections.get(frame.sessionId);
-                if (previous && previous.socket !== socket) {
-                    failChannelDeliveries(frame.sessionId, previous.generation);
-                    previous.socket.close(4001, "superseded");
-                }
-                clearClaudeInteractions(frame.sessionId);
-                registration = { sessionId: frame.sessionId, generation: frame.generation };
-                const active = {
-                    sessionId: frame.sessionId,
-                    socket,
-                    generation: frame.generation,
-                    pid: frame.pid,
-                    cwd: frame.cwd,
-                    ...(frame.title === undefined ? {} : { title: frame.title }),
-                    busy: false,
-                    updatedAt: new Date().toISOString(),
-                };
-                activeClaudeConnections.set(frame.sessionId, active);
-                activeClaudeView.set(frame.sessionId, {
-                    cwd: active.cwd,
-                    ...(active.title === undefined ? {} : { title: active.title }),
-                    busy: active.busy,
-                    ...(active.updatedAt === undefined ? {} : { updatedAt: active.updatedAt }),
-                });
-                sessionsChanged();
-                void websocketSend(socket, GatewayToChannelSchema.parse({
-                    type: "channel.registered",
-                    protocolVersion: REMOTE_PROTOCOL_VERSION,
-                    sessionId: frame.sessionId,
-                    generation: frame.generation,
-                })).then((sent) => {
-                    if (!sent)
-                        socket.close(1011, "registration acknowledgement failed");
-                });
-                return;
-            }
-            if (!registration || registration.sessionId !== frame.sessionId) {
-                socket.close(1008, "register first");
-                return;
-            }
-            const current = activeClaudeConnections.get(frame.sessionId);
-            if (!current || current.socket !== socket || current.generation !== registration.generation) {
-                socket.close(4001, "stale generation");
-                return;
-            }
-            if (frame.type === "channel.delivery_ack") {
-                if (frame.generation !== registration.generation) {
-                    socket.close(4001, "stale generation");
-                    return;
-                }
-                const pending = pendingChannelDeliveries.get(frame.deliveryId);
-                if (!pending || pending.sessionId !== frame.sessionId || pending.generation !== frame.generation)
-                    return;
-                settleChannelDelivery(frame.deliveryId, frame.status);
-                return;
-            }
-            if (frame.type === "channel.reply") {
-                if (!frame.text)
-                    return;
-                const item = {
-                    id: `channel-reply:${frame.requestId}`,
-                    kind: "message",
-                    role: "assistant",
-                    text: frame.text,
-                    createdAt: new Date().toISOString(),
-                };
-                broadcast({
-                    type: "timeline.appended",
-                    protocolVersion: REMOTE_PROTOCOL_VERSION,
-                    runtime: "claude",
-                    sessionId: frame.sessionId,
-                    item,
-                });
-                return;
-            }
-            if (frame.type === "bridge.user_message") {
-                broadcast({
-                    type: "timeline.appended",
-                    protocolVersion: REMOTE_PROTOCOL_VERSION,
-                    runtime: "claude",
-                    sessionId: frame.sessionId,
-                    item: {
-                        id: frame.messageId,
-                        kind: "message",
-                        role: "user",
-                        text: frame.text,
-                        createdAt: frame.createdAt,
-                    },
-                });
-                return;
-            }
-            if (frame.type === "bridge.status") {
-                const updated = { ...current, busy: frame.busy };
-                activeClaudeConnections.set(frame.sessionId, updated);
-                activeClaudeView.set(frame.sessionId, {
-                    cwd: updated.cwd,
-                    ...(updated.title === undefined ? {} : { title: updated.title }),
-                    busy: updated.busy,
-                    ...(updated.updatedAt === undefined ? {} : { updatedAt: updated.updatedAt }),
-                });
-                sessionsChanged();
-                return;
-            }
-            if (frame.type === "bridge.resolved") {
-                const key = pendingInteractionKey(frame.sessionId, frame.requestId);
-                pendingApprovals.delete(key);
-                pendingQuestions.delete(key);
-                interactionResolved("claude", frame.sessionId, frame.requestId);
-                return;
-            }
-            if (frame.type === "bridge.question") {
-                const item = {
-                    id: `claude-question:${frame.requestId}`,
-                    kind: "question",
-                    requestId: frame.requestId,
-                    questions: frame.questions,
-                    createdAt: new Date().toISOString(),
-                };
-                pendingQuestions.set(pendingInteractionKey(frame.sessionId, frame.requestId), { sessionId: frame.sessionId, item });
-                broadcast({
-                    type: "timeline.appended",
-                    protocolVersion: REMOTE_PROTOCOL_VERSION,
-                    runtime: "claude",
-                    sessionId: frame.sessionId,
-                    item,
-                });
-                return;
-            }
-            const item = {
-                id: `claude-approval:${frame.requestId}`,
-                kind: "approval",
-                requestId: frame.requestId,
-                tool: frame.tool,
-                preview: frame.preview || ("description" in frame ? frame.description : frame.tool),
-                createdAt: new Date().toISOString(),
-            };
-            pendingApprovals.set(pendingInteractionKey(frame.sessionId, frame.requestId), {
-                sessionId: frame.sessionId,
-                item,
-                bridge: frame.type === "bridge.approval",
-            });
-            broadcast({
-                type: "timeline.appended",
-                protocolVersion: REMOTE_PROTOCOL_VERSION,
-                runtime: "claude",
-                sessionId: frame.sessionId,
-                item,
-            });
-        });
-        socket.on("close", () => {
-            if (!registration)
-                return;
-            const current = activeClaudeConnections.get(registration.sessionId);
-            if (current?.generation !== registration.generation || current.socket !== socket)
-                return;
-            failChannelDeliveries(registration.sessionId, registration.generation);
-            activeClaudeConnections.delete(registration.sessionId);
-            activeClaudeView.delete(registration.sessionId);
-            clearClaudeInteractions(registration.sessionId);
-            sessionsChanged();
-        });
-    });
-    await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(options.listenPort ?? config.port, config.host, () => {
-            server.off("error", reject);
-            resolve();
-        });
-    });
-    const address = server.address();
-    if (!address || typeof address === "string")
-        throw new Error("remote gateway did not bind a TCP address");
-    return {
-        host: config.host,
-        port: address.port,
-        gatewayId,
-        activeClaude: activeClaudeView,
-        async close() {
-            unsubscribeCodex?.();
-            for (const deliveryId of [...pendingChannelDeliveries.keys()]) {
-                settleChannelDelivery(deliveryId, "disconnected");
-            }
-            for (const socket of [...clientSockets, ...activeClaudeConnections.values()].map((value) => value instanceof WebSocket ? value : value.socket)) {
-                socket.close(1001, "gateway stopping");
-            }
-            await Promise.all([
-                new Promise((resolve) => clientWss.close(() => resolve())),
-                new Promise((resolve) => channelWss.close(() => resolve())),
-                new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve())),
-            ]);
-        },
-    };
-}
-export function encodeWebSocketToken(token) {
-    return `auth.${Buffer.from(token, "utf8").toString("base64url")}`;
-}
-export const REMOTE_WEBSOCKET_PROTOCOL = WS_PROTOCOL;