@oharness/server 0.1.0

package/dist/server.js

@@ -0,0 +1,2789 @@
+import { createServer } from "node:http";
+import { randomUUID, timingSafeEqual } from "node:crypto";
+import { readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { homedir } from "node:os";
+import { Harness } from "@oharness/engine/harness.ts";
+import { updateUserConfig } from "@oharness/engine/config.ts";
+import { connectorConfig, officialConnectors } from "@oharness/engine/mcp/registry.ts";
+import { missingSecrets } from "@oharness/engine/mcp/secrets.ts";
+import { connectorIcon } from "./icons.js";
+import { PERMISSION_MODES } from "@oharness/engine/agent/permissions.ts";
+import { isReadable } from "@oharness/engine/agent/workspace.ts";
+import { messageText } from "@oharness/engine/core/types.ts";
+import { errorMessage } from "@oharness/engine/core/errors.ts";
+import { officialBaseUrl } from "@oharness/engine/auth/providers/official.ts";
+import { browserSignInUrl, exchangeHandoff, siteUrl } from "@oharness/engine/auth/providers/account.ts";
+import { ChangeLedger } from "./changes.js";
+import { addProject, ensureProject, listProjects, removeProject } from "./projects.js";
+import { readPrefs, writePrefs } from "./prefs.js";
+import { listDirectories, pickDirectory, pickFiles } from "./pick.js";
+import { browseFiles, searchFiles, within } from "./files.js";
+import { analyticsState } from "./analytics.js";
+import { PAGE } from "./page.js";
+import { artifactDocument, sendArtifact } from "./artifacts.js";
+import { ArtifactStore, getArtifactStore, isCanvas, isValidArtifactId, restoreArtifacts, } from "@oharness/engine/artifacts/store.ts";
+import { accountTeams, publishArtifact, unpublishArtifact } from "@oharness/engine/artifacts/publish.ts";
+/**
+ * How many stored sessions the usage page counts.
+ *
+ * A cap rather than "everything", because the totals are read by walking the
+ * session metadata on disk and someone who has been using this for months has
+ * thousands of them. The answer says how many it looked at, so a total that
+ * stops short says so rather than reading as the whole history.
+ */
+const USAGE_SESSION_SCAN = 200;
+const DAY_MS = 24 * 60 * 60 * 1000;
+/**
+ * The windows the usage page offers.
+ *
+ * Days rather than calendar months: "the last 30 days" is a question with one
+ * answer, where "this month" changes what it means on the first of the month
+ * and makes two visits a day apart incomparable.
+ */
+const USAGE_RANGES = {
+    "7d": { id: "7d", days: 7 },
+    "30d": { id: "30d", days: 30 },
+    "90d": { id: "90d", days: 90 },
+    all: { id: "all", days: 0 },
+};
+/**
+ * What was spent over time, per model.
+ *
+ * Bucketed by day while a day is a readable width, and by week once the window
+ * is long enough that a daily column is a hair. Empty buckets are included on
+ * purpose: a week with no work is a fact about the week, and dropping it would
+ * pull the weeks on either side together and put time on an axis that does not
+ * pass evenly.
+ *
+ * A session's spend lands in the bucket it was last touched, because that is
+ * what the metadata records — a session worked on across three days counts on
+ * the third. Said out loud on the page rather than smoothed over: the
+ * alternative is reading every transcript to place each turn, which is a lot
+ * of disk for a curve nobody reads to four decimal places.
+ */
+function usageSeries(rows, since) {
+    const now = Date.now();
+    const span = Math.max(now - since, DAY_MS);
+    const step = span > 60 * DAY_MS ? "week" : "day";
+    const width = step === "week" ? 7 * DAY_MS : DAY_MS;
+    // Anchored to the end rather than to midnight of the first day: the last
+    // bucket should be the one happening now, so the newest column is never a
+    // sliver that reads as a collapse in spending.
+    const end = Math.floor(now / width) * width + width;
+    const count = Math.min(Math.ceil((end - since) / width), 400);
+    const from = end - count * width;
+    const buckets = Array.from({ length: count }, (_, i) => ({
+        at: from + i * width,
+        costUsd: 0,
+        models: {},
+    }));
+    for (const row of rows) {
+        const at = Math.floor((row.updatedAt - from) / width);
+        const bucket = buckets[at];
+        if (!bucket)
+            continue;
+        bucket.costUsd += row.costUsd;
+        bucket.models[row.model] = (bucket.models[row.model] ?? 0) + row.costUsd;
+    }
+    return { step, from, buckets };
+}
+/**
+ * The four token counts, with the optional halves filled in.
+ *
+ * Cache reads and writes are optional on the wire because a provider without
+ * a prompt cache never reports them. Undefined and zero mean the same thing to
+ * anyone reading a total, so the page is spared the distinction.
+ */
+function tokensOf(usage) {
+    return {
+        input: usage.inputTokens || 0,
+        output: usage.outputTokens || 0,
+        cacheRead: usage.cacheReadTokens || 0,
+        cacheWrite: usage.cacheWriteTokens || 0,
+    };
+}
+export async function startWebServer(opts) {
+    const token = randomUUID();
+    /**
+     * A second credential, for artifact bodies only.
+     *
+     * An artifact is loaded into an iframe by URL, and a sandboxed document can
+     * read its own URL — so whatever authorises that route is legible to the
+     * content served through it. With one shared token, an HTML artifact could
+     * read the credential that drives the agent. This one only unlocks
+     * `/artifact/view`, so the worst an artifact can learn is how to read other
+     * artifacts in the same session.
+     */
+    const artifactToken = randomUUID();
+    const host = opts.host ?? "127.0.0.1";
+    const clients = new Set();
+    const pending = new Map();
+    const runners = new Map();
+    const anyRunning = () => [...runners.values()].some((runner) => Boolean(runner.running));
+    const makeRunner = (session, harness) => {
+        const ledger = new ChangeLedger(session.cwd);
+        ledger.attach(harness.hooks);
+        return { session, agent: harness.agent(session), harness, ledger };
+    };
+    /** The runner a request names, or the most recently focused one. */
+    let focused = opts.session.id;
+    const runnerFor = (id) => runners.get(typeof id === "string" && id ? id : focused);
+    runners.set(opts.session.id, makeRunner(opts.session, opts.harness));
+    let current = { session: opts.session, agent: opts.agent, harness: opts.harness };
+    /**
+     * Sign-ins waiting for their emailed code.
+     *
+     * A login is two requests — send the code, then verify it — and the second
+     * one needs the closure the first produced. Dropped after ten minutes so a
+     * tab closed halfway through does not leave one open indefinitely.
+     */
+    const pendingSignIns = new Map();
+    const SIGNIN_TTL_MS = 10 * 60_000;
+    /**
+     * Sign-ins happening in the user's browser, keyed by the nonce they carry.
+     *
+     * The browser comes back to a callback on this server, and it comes back
+     * without the token — it is the *system* browser, opened by a click, and it
+     * never had one. The nonce is what stands in for it: 32 bytes this process
+     * generated, held only in memory, good once and only for the few minutes
+     * somebody spends signing in.
+     */
+    const pendingBrowserSignIns = new Map();
+    const BROWSER_SIGNIN_TTL_MS = 10 * 60_000;
+    /**
+     * One harness per project directory.
+     *
+     * A harness binds to its cwd at construction, so a second project needs a
+     * second harness rather than a mutated field. They are kept after a switch
+     * because rebuilding one reconnects every MCP server.
+     */
+    const harnesses = new Map([[opts.session.cwd, opts.harness]]);
+    void ensureProject(opts.session.cwd);
+    /**
+     * The model the user last picked, carried into every session started here.
+     *
+     * Read once at startup and kept in memory: the file is written when the
+     * choice changes, so re-reading it per session would only add a disk hit to
+     * answer a question this already knows.
+     */
+    let preferredModel = (await readPrefs()).model;
+    /**
+     * A new session on a harness, honouring that preference.
+     *
+     * Guarded by the harness's own catalog: a remembered model from a provider
+     * that has since been disconnected would otherwise fail at the first request
+     * rather than falling back to the configured default.
+     */
+    const freshSession = (harness) => {
+        const known = preferredModel && harness.listModels().some((model) => model.id === preferredModel);
+        return harness.createSession(known ? { model: preferredModel } : {});
+    };
+    /**
+     * Files staged for the next prompt.
+     *
+     * Held in memory and dropped once used: writing an upload into the working
+     * tree would put a file the agent never asked for into the user's repo, and
+     * it would show up in the change ledger as work the agent did.
+     *
+     * Memory is the whole cost of that choice, so nothing staged is allowed to
+     * stay indefinitely. A prompt claims what it uses; a dropped chip says so;
+     * and what neither happens to — a tab closed on a pasted screenshot — is
+     * reclaimed by `sweepAttachments`.
+     */
+    const attachments = new Map();
+    /**
+     * Carry a chosen file whose bytes are the only way it can mean anything.
+     *
+     * The dialog reaches the whole machine; the agent's readable roots are the
+     * project and little else. A path from outside them is a reference `read`
+     * will refuse, so for those the file travels with the message instead —
+     * which is what the row promising "files or photos" implied all along.
+     * Returns nothing when it cannot be carried either, and the page then says
+     * so rather than staging a turn that is already lost.
+     */
+    const stageFromDisk = async (target) => {
+        try {
+            const info = await stat(target);
+            if (!info.isFile() || info.size > MAX_UPLOAD_BYTES)
+                return undefined;
+            const data = await readFile(target);
+            const name = path.basename(target);
+            // Images by extension, and everything else left unnamed: `buildMessage`
+            // decides text from bytes rather than from a type, so guessing one for
+            // a .log would add nothing and could be wrong.
+            const mediaType = PICKED_IMAGE_TYPES[path.extname(target).toLowerCase()] ?? "application/octet-stream";
+            const id = randomUUID();
+            attachments.set(id, { name, mediaType, data, at: Date.now() });
+            sweepAttachments();
+            return {
+                id,
+                name,
+                mediaType,
+                bytes: data.byteLength,
+                kind: mediaType.startsWith("image/") ? "image" : "file",
+            };
+        }
+        catch {
+            return undefined;
+        }
+    };
+    /**
+     * Forget staged uploads nobody is going to send.
+     *
+     * Age first, since a file staged half an hour ago belongs to a composer
+     * that is gone. Then total size, oldest first, because the bound that
+     * actually protects the process is bytes rather than entries: one map of
+     * screenshots can outweigh a thousand pasted snippets.
+     */
+    const sweepAttachments = () => {
+        const cutoff = Date.now() - STAGED_TTL_MS;
+        let total = 0;
+        for (const [id, file] of attachments) {
+            if (file.at < cutoff)
+                attachments.delete(id);
+            else
+                total += file.data.byteLength;
+        }
+        // Insertion order is arrival order, so the first entries are the oldest.
+        for (const [id, file] of attachments) {
+            if (total <= MAX_STAGED_BYTES)
+                break;
+            attachments.delete(id);
+            total -= file.data.byteLength;
+        }
+    };
+    // The review pane's whole reason to exist: what the agent did to the tree.
+    const broadcast = (event) => {
+        const payload = `data: ${JSON.stringify(event)}\n\n`;
+        for (const client of clients)
+            client.write(payload);
+    };
+    const permissionPrompt = (request) => new Promise((resolve) => {
+        const id = randomUUID();
+        pending.set(id, { id, request, resolve });
+        broadcast({ type: "permission_request", id, request });
+        // No timeout here on purpose. A prompt that auto-denies after a while
+        // would silently fail long-running work while the user is away; a prompt
+        // that auto-allows would be worse. It waits.
+    });
+    const server = createServer((req, res) => {
+        void handle(req, res).catch((err) => {
+            send(res, 500, { error: errorMessage(err) });
+        });
+    });
+    async function handle(req, res) {
+        const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+        // The page itself is the only thing served without a token, and only so a
+        // bare URL with the token in the query string can bootstrap.
+        if (url.pathname === "/" && req.method === "GET") {
+            if (!authorized(url, req))
+                return send(res, 401, { error: "missing or bad token" });
+            res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+            res.end(PAGE);
+            return;
+        }
+        // The other exception, and for the same kind of reason: this one is
+        // arrived at by the system browser coming back from the site, which never
+        // held the token. The nonce it carries is the credential — unguessable,
+        // single-use, and issued by the request that opened the browser.
+        if (url.pathname === "/signin/handoff" && req.method === "GET") {
+            return browserSignInReturn(url, res);
+        }
+        // Third exception, and the reason it is one is in artifacts.ts: this route
+        // is read by a sandboxed iframe that can see its own URL, so it is gated
+        // on the artifact credential rather than the session token.
+        if (url.pathname === "/artifact/view" && req.method === "GET") {
+            const supplied = url.searchParams.get("k") ?? "";
+            if (!constantTimeEqual(supplied, artifactToken)) {
+                return send(res, 401, { error: "missing or bad artifact key" });
+            }
+            return serveArtifactBody(url, res);
+        }
+        if (!authorized(url, req))
+            return send(res, 401, { error: "missing or bad token" });
+        switch (`${req.method} ${url.pathname}`) {
+            case "GET /events":
+                return stream(res);
+            case "GET /state": {
+                const runner = runnerFor(url.searchParams.get("session"));
+                if (!runner)
+                    return send(res, 404, { error: "no such session" });
+                focused = runner.session.id;
+                return send(res, 200, state(runner));
+            }
+            /**
+             * A staged upload, before any turn has carried it.
+             *
+             * The composer's own uploads are previewed from the bytes the browser
+             * already holds; one the server read off the disk has never been near
+             * the page, and without this its chip would be the only one in the row
+             * with no picture on it.
+             */
+            case "GET /upload/preview": {
+                const staged = attachments.get(url.searchParams.get("id") ?? "");
+                if (!staged)
+                    return send(res, 404, { error: "no such upload" });
+                // The same allowlist as the transcript's images, for the same reason:
+                // this is served same-origin to a page holding the session token.
+                if (!VIEWABLE_IMAGE_TYPES.has(staged.mediaType)) {
+                    return send(res, 415, { error: `cannot display ${staged.mediaType}` });
+                }
+                res.writeHead(200, {
+                    "content-type": staged.mediaType,
+                    "content-length": staged.data.byteLength,
+                    "x-content-type-options": "nosniff",
+                    "content-security-policy": "default-src 'none'; sandbox",
+                    // Staged bytes are replaced by a new id, never edited under this
+                    // one, but they do go away when the prompt claims them.
+                    "cache-control": "private, no-store",
+                });
+                res.end(staged.data);
+                return;
+            }
+            /**
+             * One image out of the transcript.
+             *
+             * Addressed by its position in the session rather than by an id of its
+             * own, because a message block has no identity to give it: the bytes
+             * live in the transcript, and the transcript is the only copy. Reads
+             * are bounded to what the URL names and refuse anything that is not an
+             * image, so the route cannot be turned into a way to read arbitrary
+             * message content back out as a file.
+             */
+            case "GET /attachment": {
+                const runner = runnerFor(url.searchParams.get("session"));
+                if (!runner)
+                    return send(res, 404, { error: "no such session" });
+                const index = Number(url.searchParams.get("message"));
+                const position = Number(url.searchParams.get("block"));
+                const message = Number.isInteger(index) ? runner.session.messages[index - 1] : undefined;
+                const block = Number.isInteger(position) ? message?.content[position] : undefined;
+                if (!block || block.type !== "image")
+                    return send(res, 404, { error: "no such image" });
+                // The media type on a block is whatever the upload claimed, and this
+                // response is same-origin with the page's own token. An allowlist of
+                // raster types is the whole defence: SVG is scriptable, and anything
+                // outside the list could be sniffed into markup that runs here.
+                if (!VIEWABLE_IMAGE_TYPES.has(block.mimeType)) {
+                    return send(res, 415, { error: `cannot display ${block.mimeType}` });
+                }
+                const data = Buffer.from(block.data, "base64");
+                res.writeHead(200, {
+                    "content-type": block.mimeType,
+                    "content-length": data.byteLength,
+                    "x-content-type-options": "nosniff",
+                    "content-security-policy": "default-src 'none'; sandbox",
+                    // The transcript is append-only, so this position holds the same
+                    // bytes forever: worth saying, since the page asks for every image
+                    // in a conversation again on every switch between tabs.
+                    "cache-control": "private, max-age=31536000, immutable",
+                });
+                res.end(data);
+                return;
+            }
+            case "GET /artifacts": {
+                const runner = runnerFor(url.searchParams.get("session"));
+                if (!runner)
+                    return send(res, 404, { error: "no such session" });
+                // The key travels with the list so the page never has to construct a
+                // credentialled URL from a token it holds separately — one place
+                // builds these, and it is the one that knows which key is right.
+                return send(res, 200, {
+                    artifacts: getArtifactStore(runner.session.state).list(),
+                    viewKey: artifactToken,
+                });
+            }
+            /**
+             * Every artifact on this machine, grouped by the session that made it.
+             *
+             * This used to list only what the process had loaded — the open tabs —
+             * because the store is memory and lives on the session. That made the
+             * panel's answer depend on which tabs happened to be open, which is not
+             * an answer anybody can act on: something you made yesterday was simply
+             * absent, with nothing on screen to say it existed.
+             *
+             * The revision logs are the durable record, so the listing is folded
+             * from those and a loaded session overrides its own log — it holds the
+             * revision a person just made in a canvas, and it knows about publishing,
+             * which the log does not record.
+             */
+            case "GET /artifacts/all": {
+                const catalogue = await artifactCatalogue();
+                return send(res, 200, { ...catalogue, viewKey: artifactToken });
+            }
+            // The body, for the kinds the page renders itself into DOM nodes. Gated
+            // on the session token, not the artifact key: this response is read by
+            // the page's own script, which already holds the stronger credential.
+            case "GET /artifact/raw": {
+                const runner = runnerFor(url.searchParams.get("session"));
+                if (!runner)
+                    return send(res, 404, { error: "no such session" });
+                const id = url.searchParams.get("id") ?? "";
+                const versionParam = url.searchParams.get("version");
+                const found = getArtifactStore(runner.session.state).get(id, versionParam ? Number(versionParam) : undefined);
+                if (!found)
+                    return send(res, 404, { error: "no such artifact" });
+                return send(res, 200, {
+                    id: found.artifact.id,
+                    title: found.artifact.title,
+                    mime: found.artifact.mime,
+                    kind: found.artifact.kind,
+                    language: found.artifact.language,
+                    version: found.revision.version,
+                    versions: found.artifact.versions.map((v) => v.version),
+                    content: found.revision.content,
+                });
+            }
+            /**
+             * A revision written by the person looking at it.
+             *
+             * The frontend posts this on the canvas editor's behalf; the editor
+             * itself never can. It runs in a sandbox with `connect-src 'none'` and
+             * has no session token — deliberately, since it is showing model-authored
+             * markup — so the only thing it can do is postMessage its new content to
+             * the page that framed it, and let that page, which already holds the
+             * credential, decide whether to make the call. The sandbox stays intact
+             * and the editor gains no reach it did not have.
+             *
+             * Restricted to canvases because a canvas is the only artifact with an
+             * editor. Accepting an edit for a `page` would mean any framed artifact
+             * could rewrite itself by asking the parent nicely.
+             */
+            case "POST /artifact/edit": {
+                const runner = runnerFor(url.searchParams.get("session"));
+                if (!runner)
+                    return send(res, 404, { error: "no such session" });
+                const body = await readJson(req);
+                const id = typeof body.id === "string" ? body.id : "";
+                const content = typeof body.content === "string" ? body.content : null;
+                if (!id || content === null)
+                    return send(res, 400, { error: "id and content are required" });
+                const store = getArtifactStore(runner.session.state);
+                const found = store.get(id);
+                if (!found)
+                    return send(res, 404, { error: "no such artifact" });
+                if (!isCanvas(found.artifact.mime)) {
+                    return send(res, 400, { error: "only a canvas can be edited in place" });
+                }
+                try {
+                    const descriptor = store.edit(id, content);
+                    if (!descriptor)
+                        return send(res, 404, { error: "no such artifact" });
+                    // Broadcast for the same reason publishing does: this page is not
+                    // the only one open, and the version picker everywhere else is now
+                    // one revision behind.
+                    broadcast({ type: "artifact", artifact: descriptor, session: runner.session.id });
+                    return send(res, 200, descriptor);
+                }
+                catch (err) {
+                    return send(res, 400, { error: errorMessage(err) });
+                }
+            }
+            case "POST /artifact/publish": {
+                const runner = runnerFor(url.searchParams.get("session"));
+                if (!runner)
+                    return send(res, 404, { error: "no such session" });
+                const body = await readJson(req);
+                const id = typeof body.id === "string" ? body.id : "";
+                const found = getArtifactStore(runner.session.state).get(id);
+                if (!found)
+                    return send(res, 404, { error: "no such artifact" });
+                const visibility = body.visibility === "team" ? "team" : "unlisted";
+                const teamId = typeof body.teamId === "string" ? body.teamId : undefined;
+                if (visibility === "team" && !teamId) {
+                    return send(res, 400, { error: "publishing to a team needs a team" });
+                }
+                // A canvas is stored as a fragment of artboards and only becomes a
+                // document when this server wraps it in the editor. The website has no
+                // such wrapper, so publishing the stored bytes would put a row of
+                // unstyled boxes behind the link. What travels instead is the rendered
+                // document — self-contained, and read-only on the other side because
+                // nothing there speaks the save protocol.
+                const canvas = isCanvas(found.artifact.mime);
+                const published = canvas
+                    ? artifactDocument(found.artifact, found.revision).body
+                    : found.revision.content;
+                try {
+                    const result = await publishArtifact({
+                        sourceId: found.artifact.id,
+                        title: found.artifact.title,
+                        mime: canvas ? "text/html" : found.artifact.mime,
+                        kind: found.artifact.kind,
+                        ...(found.artifact.language ? { language: found.artifact.language } : {}),
+                        content: published,
+                        version: found.revision.version,
+                        visibility,
+                        ...(teamId ? { teamId } : {}),
+                    }, { accountToken: await current.harness.accountToken() });
+                    // Recorded against the artifact, not just returned: the page that
+                    // asked is not the only one open, and a reload should not offer to
+                    // publish something that already has a link. The revision goes in
+                    // too — a link serves what was last published, so an artifact
+                    // revised since is a link showing something older.
+                    const descriptor = getArtifactStore(runner.session.state).markPublished(id, {
+                        url: result.url,
+                        visibility,
+                        ...(teamId ? { teamId } : {}),
+                        version: found.revision.version,
+                    });
+                    if (descriptor)
+                        broadcast({ type: "artifact", artifact: descriptor, session: runner.session.id });
+                    return send(res, 200, result);
+                }
+                catch (err) {
+                    // Not signed in, offline, over the limit, or the site said no — all
+                    // things the person clicking Publish can act on, so they travel as a
+                    // message rather than a 500.
+                    return send(res, 400, { error: errorMessage(err) });
+                }
+            }
+            case "POST /artifact/unpublish": {
+                const body = await readJson(req);
+                const id = typeof body.id === "string" ? body.id : "";
+                if (!id)
+                    return send(res, 400, { error: "id is required" });
+                try {
+                    await unpublishArtifact(id, { accountToken: await current.harness.accountToken() });
+                    const runner = runnerFor(url.searchParams.get("session"));
+                    if (runner) {
+                        const descriptor = getArtifactStore(runner.session.state).clearPublication(id);
+                        if (descriptor) {
+                            broadcast({ type: "artifact", artifact: descriptor, session: runner.session.id });
+                        }
+                    }
+                    return send(res, 200, { withdrawn: true });
+                }
+                catch (err) {
+                    return send(res, 400, { error: errorMessage(err) });
+                }
+            }
+            case "GET /teams": {
+                // For the Publish menu. Empty when signed out, which is the same
+                // answer the menu needs in order to offer an unlisted link only.
+                return send(res, 200, {
+                    teams: await accountTeams({ accountToken: await current.harness.accountToken() }),
+                });
+            }
+            case "GET /history":
+                {
+                    // Opening the page mid-session should show what has happened, not an
+                    // empty transcript that silently drops the context the model still has.
+                    const runner = runnerFor(url.searchParams.get("session"));
+                    if (!runner)
+                        return send(res, 404, { error: "no such session" });
+                    return send(res, 200, { entries: history(runner) });
+                }
+            case "GET /projects": {
+                const projects = await listProjects();
+                const prefs = await readPrefs();
+                const pinned = new Set(prefs.pinnedProjects ?? []);
+                return send(res, 200, {
+                    order: prefs.projectOrder ?? [],
+                    projects: projects.map((project) => ({
+                        ...project,
+                        pinned: pinned.has(project.path),
+                        current: project.path === current.session.cwd,
+                    })),
+                });
+            }
+            /**
+             * Keep one session or project at the top of its list.
+             *
+             * A preference about this sidebar, so it is written where the other ones
+             * are and never into the session record: a pin is not a fact about the
+             * work, and it has no business travelling to another machine to
+             * rearrange a list somebody there had arranged for themselves.
+             */
+            case "POST /pin": {
+                const body = await readJson(req);
+                const id = typeof body.id === "string" ? body.id : "";
+                if (!id)
+                    return send(res, 400, { error: "id is required" });
+                const key = body.kind === "project" ? "pinnedProjects" : "pinnedSessions";
+                const held = (await readPrefs())[key] ?? [];
+                const rest = held.filter((one) => one !== id);
+                // Newest pin first, so pinning something does not bury it under
+                // everything pinned before it.
+                const next = body.pinned === false ? rest : [id, ...rest];
+                await writePrefs({ [key]: next });
+                return send(res, 200, { pinned: body.pinned !== false, order: next });
+            }
+            /**
+             * Remember an order somebody made by hand.
+             *
+             * Only the list that was dragged, and only the ids it held: a session
+             * started tomorrow has no place in an order recorded today, and it
+             * should arrive where a new session belongs rather than at the end of a
+             * snapshot taken before it existed.
+             */
+            case "POST /order": {
+                const body = await readJson(req);
+                const ids = Array.isArray(body.ids)
+                    ? body.ids.filter((id) => typeof id === "string")
+                    : undefined;
+                if (!ids)
+                    return send(res, 400, { error: "ids must be an array" });
+                if (body.kind === "project") {
+                    await writePrefs({ projectOrder: ids });
+                    return send(res, 200, { order: ids });
+                }
+                const cwd = typeof body.cwd === "string" ? body.cwd : "";
+                if (!cwd)
+                    return send(res, 400, { error: "cwd is required" });
+                const order = { ...((await readPrefs()).sessionOrder ?? {}), [cwd]: ids };
+                await writePrefs({ sessionOrder: order });
+                return send(res, 200, { order: ids });
+            }
+            case "POST /pick": {
+                const body = await readJson(req);
+                // The dialog opens on this machine's desktop, which is the same
+                // machine the agent already runs on — reachable only with the token.
+                const start = typeof body.start === "string" ? body.start : current.session.cwd;
+                if (body.kind === "files") {
+                    const chosen = await pickFiles(start);
+                    if (!chosen.paths)
+                        return send(res, 200, chosen);
+                    // A path under the project comes back relative: it is shorter to
+                    // read, it survives the project moving, and it is the form the
+                    // agent's own tools take. Which of the two it is comes from the
+                    // disk rather than from the name — one dialog returns both.
+                    const entries = await Promise.all(chosen.paths.map(async (chosenPath) => {
+                        const dir = await isDirectory(chosenPath);
+                        const reachable = isReadable(current.harness.workspace, chosenPath);
+                        const carried = dir || reachable ? undefined : await stageFromDisk(chosenPath);
+                        return {
+                            path: within(current.session.cwd, chosenPath),
+                            dir,
+                            // Said even when a copy was staged, because the two chips
+                            // differ and the page has to know which one it is drawing.
+                            ...(reachable ? {} : { unreachable: true }),
+                            ...(carried ? { staged: carried } : {}),
+                        };
+                    }));
+                    return send(res, 200, { entries });
+                }
+                const result = await pickDirectory(start);
+                return send(res, 200, {
+                    ...result,
+                    ...(result.path
+                        ? {
+                            relative: within(current.session.cwd, result.path),
+                            // A folder cannot be carried, so all this can do is say so
+                            // before the turn spends itself finding out.
+                            ...(isReadable(current.harness.workspace, result.path)
+                                ? {}
+                                : { unreachable: true }),
+                        }
+                        : {}),
+                });
+            }
+            case "GET /fs":
+                return send(res, 200, await listDirectories(url.searchParams.get("path") ?? undefined));
+            // The project's own tree, for the composer's reference menu. Scoped to
+            // the session's working directory and answered in relative paths: the
+            // page has no business learning where on the disk the project sits.
+            case "GET /files": {
+                const runner = runnerFor(url.searchParams.get("session"));
+                if (!runner)
+                    return send(res, 404, { error: "no such session" });
+                const query = (url.searchParams.get("q") ?? "").trim();
+                // Searching and browsing answer in the same shape, so the menu paints
+                // one list either way and only the header changes.
+                return send(res, 200, query
+                    ? { query, ...(await searchFiles(runner.session.cwd, query)) }
+                    : {
+                        query: "",
+                        ...(await browseFiles(runner.session.cwd, url.searchParams.get("dir") ?? "")),
+                    });
+            }
+            // The other two things a message can point at: an MCP server this
+            // harness is connected to, and a plugin it loaded.
+            case "GET /context":
+                return send(res, 200, contextOffer());
+            // The connectors on offer rather than the ones already here: the list
+            // ships as data, so this is a read of a file plus what is installed.
+            case "GET /registry": {
+                const installed = new Set(contextOffer().connectors.map((one) => one.name));
+                const entries = await officialConnectors();
+                return send(res, 200, {
+                    connectors: entries.map((entry) => ({
+                        id: entry.id,
+                        label: entry.label,
+                        ...(entry.description ? { description: entry.description } : {}),
+                        ...(entry.publisher ? { publisher: entry.publisher } : {}),
+                        ...(entry.docsUrl ? { docsUrl: entry.docsUrl } : {}),
+                        installed: installed.has(entry.id),
+                        // Said before the click, not after it. An entry that needs a key
+                        // fails at connect with a perfectly clear message, but a menu that
+                        // knew and stayed quiet spent a click to deliver it.
+                        ...(missingSecrets(entry.config).length
+                            ? { missingEnv: missingSecrets(entry.config) }
+                            : {}),
+                    })),
+                });
+            }
+            /**
+             * A connector's vendor icon, fetched by this server and cached on disk.
+             *
+             * Served from here rather than linked from the page: twelve rows would
+             * otherwise be twelve third-party requests, each one telling a vendor
+             * that this user opened the menu before connecting anything.
+             */
+            case "GET /connector-icon": {
+                const id = url.searchParams.get("id") ?? "";
+                const entry = (await officialConnectors()).find((one) => one.id === id);
+                const icon = entry?.siteUrl ? await connectorIcon(entry.id, entry.siteUrl) : undefined;
+                // A row without a picture draws a monogram, so this is a normal answer
+                // rather than something worth reporting.
+                if (!icon)
+                    return send(res, 404, { error: "no icon" });
+                res.writeHead(200, {
+                    "content-type": icon.type,
+                    "content-length": icon.bytes.length,
+                    "cache-control": "private, max-age=86400",
+                });
+                res.end(icon.bytes);
+                return;
+            }
+            /**
+             * Add or remove one connector.
+             *
+             * Both halves happen: the server is connected now, so its tools are
+             * usable in the next turn without a restart, and the declaration is
+             * written to the user's config so it comes back tomorrow. Doing only the
+             * first would make an install evaporate; only the second would make it
+             * look like nothing happened.
+             */
+            case "POST /connector": {
+                const body = await readJson(req);
+                const id = typeof body.id === "string" ? body.id.trim() : "";
+                if (!id)
+                    return send(res, 400, { error: "id is required" });
+                if (body.remove === true) {
+                    await current.harness.removeMcpServer(id);
+                    await updateUserConfig((config) => {
+                        const servers = { ...config.mcpServers };
+                        delete servers[id];
+                        return { ...config, mcpServers: servers };
+                    });
+                    return send(res, 200, { removed: id, ...contextOffer() });
+                }
+                const entry = (await officialConnectors()).find((one) => one.id === id);
+                if (!entry)
+                    return send(res, 404, { error: `no connector named "${id}"` });
+                const config = connectorConfig(entry, {
+                    project: current.session.cwd,
+                    home: homedir(),
+                });
+                try {
+                    const status = await current.harness.addMcpServer(id, config);
+                    // A server that starts and then fails to speak MCP is worth
+                    // reporting as the failure it is, rather than leaving a dead entry
+                    // in the menu and a line in the config file.
+                    //
+                    // A server that asked to be logged in to is not that. It is working
+                    // exactly as intended and is one browser round trip from being
+                    // usable, so it stays — rolling it back here would delete the thing
+                    // the user is about to authorize.
+                    if (!status.connected && !status.needsAuth) {
+                        await current.harness.removeMcpServer(id);
+                        return send(res, 400, { error: status.error ?? `${id} did not start` });
+                    }
+                    await updateUserConfig((existing) => ({
+                        ...existing,
+                        mcpServers: { ...existing.mcpServers, [id]: config },
+                    }));
+                    return send(res, 200, { status, ...contextOffer() });
+                }
+                catch (err) {
+                    await current.harness.removeMcpServer(id).catch(() => { });
+                    return send(res, 400, { error: errorMessage(err) });
+                }
+            }
+            /**
+             * Log in to a connector that asked for it.
+             *
+             * The URL comes back immediately and the flow finishes on its own: the
+             * redirect lands on a loopback listener this process opened, not on this
+             * server, so there is nothing for the page to post back. It waits for
+             * the broadcast instead.
+             */
+            case "POST /connector/authorize": {
+                const body = await readJson(req);
+                const id = typeof body.id === "string" ? body.id.trim() : "";
+                if (!id)
+                    return send(res, 400, { error: "id is required" });
+                let flow;
+                try {
+                    flow = await current.harness.mcpLogin(id);
+                }
+                catch (err) {
+                    return send(res, 400, { error: errorMessage(err) });
+                }
+                if (flow.method !== "auto" || !flow.url) {
+                    return send(res, 400, { error: `${id} did not offer a browser login` });
+                }
+                send(res, 200, { url: flow.url, instructions: flow.instructions });
+                // Broadcast either way. The page has a row waiting on this, and a
+                // login that was refused has to release it just as much as one that
+                // worked — otherwise the button stays disabled until a reload.
+                void flow
+                    .callback()
+                    .then((result) => {
+                    if (result.type !== "success") {
+                        broadcast({
+                            type: "notice",
+                            message: `${id} was not authorized: ${result.error ?? "the login was refused"}`,
+                        });
+                    }
+                    broadcast({
+                        type: "connectors_changed",
+                        connector: id,
+                        authorized: result.type === "success",
+                        ...contextOffer(),
+                    });
+                })
+                    .catch((err) => {
+                    broadcast({
+                        type: "notice",
+                        message: `${id} could not be authorized: ${errorMessage(err)}`,
+                    });
+                    broadcast({
+                        type: "connectors_changed",
+                        connector: id,
+                        authorized: false,
+                        ...contextOffer(),
+                    });
+                });
+                return;
+            }
+            /** Forget a connector's credential without removing the connector. */
+            case "POST /connector/signout": {
+                const body = await readJson(req);
+                const id = typeof body.id === "string" ? body.id.trim() : "";
+                if (!id)
+                    return send(res, 400, { error: "id is required" });
+                const forgotten = await current.harness.mcpLogout(id);
+                return send(res, 200, { forgotten, ...contextOffer() });
+            }
+            case "POST /projects": {
+                const body = await readJson(req);
+                const dir = typeof body.path === "string" ? body.path.trim() : "";
+                if (!dir)
+                    return send(res, 400, { error: "path is required" });
+                try {
+                    const project = await addProject(dir);
+                    return send(res, 200, { project });
+                }
+                catch (err) {
+                    return send(res, 400, { error: errorMessage(err) });
+                }
+            }
+            case "POST /project": {
+                const body = await readJson(req);
+                const dir = typeof body.path === "string" ? body.path : "";
+                // Any tab: switching projects rebuilds the harness under every runner.
+                if (anyRunning())
+                    return send(res, 409, { error: "a turn is running" });
+                if (body.remove === true) {
+                    return send(res, 200, { removed: await removeProject(dir) });
+                }
+                /**
+                 * Throw away everything recorded about one tree.
+                 *
+                 * Separate from `remove`, and deliberately harder to reach, because
+                 * the two are not degrees of the same act: forgetting a project tidies
+                 * a list, and this destroys transcripts. The directory and its files
+                 * are untouched either way — what goes is what the harness wrote about
+                 * the work.
+                 */
+                if (body.purge === true) {
+                    const deleted = await current.harness.deleteSessionsIn(dir);
+                    for (const id of deleted)
+                        runners.delete(id);
+                    // Their artifact logs went with them, and a listing built a moment
+                    // ago still names them.
+                    cachedLogs = undefined;
+                    const here = current.session.cwd === dir;
+                    // Whether the window ended up somewhere else, which is also what
+                    // decides whether the directory is forgotten: staying and then
+                    // dropping it from the list would forget the project under the
+                    // window showing it.
+                    let left = !here;
+                    let moved;
+                    if (here) {
+                        // A listed directory that no longer exists is not a destination —
+                        // the switch throws and the window is left pointing at transcripts
+                        // that are gone — so those are skipped, each candidate is tried in
+                        // turn, and this directory is the last resort: nothing was deleted
+                        // from it but records, and it is where the window already is.
+                        const others = (await listProjects()).filter((project) => project.path !== dir && !project.missing);
+                        for (const target of [...others.map((project) => project.path), dir]) {
+                            try {
+                                moved = await switchProject(target);
+                                left = target !== dir;
+                                break;
+                            }
+                            catch {
+                                // Gone since it was listed. Try the next one.
+                            }
+                        }
+                        // Nowhere reachable at all. The harness for this tree is already
+                        // built, so it gets a fresh session rather than the window being
+                        // left on a deleted one.
+                        if (!moved)
+                            moved = await switchSession({ action: "new" });
+                    }
+                    else if (deleted.includes(focused)) {
+                        // Not the open project, but the focused tab was showing one of its
+                        // sessions. Focus has to move off it before any route that falls
+                        // back to `current` answers for a transcript that is gone.
+                        const next = runners.values().next().value;
+                        if (next) {
+                            focused = next.session.id;
+                            current = { session: next.session, agent: next.agent, harness: next.harness };
+                        }
+                        else {
+                            moved = await switchSession({ action: "new" });
+                        }
+                    }
+                    if (left)
+                        await removeProject(dir);
+                    return send(res, 200, {
+                        deleted: deleted.length,
+                        removed: left,
+                        open: [...runners.keys()],
+                        ...(moved ? { state: moved } : {}),
+                    });
+                }
+                try {
+                    const resume = typeof body.session === "string" ? body.session : undefined;
+                    return send(res, 200, await switchProject(dir, resume));
+                }
+                catch (err) {
+                    return send(res, 400, { error: errorMessage(err) });
+                }
+            }
+            case "GET /routines":
+                // The scheduler is real machinery; a panel that invented its own list
+                // would drift from what actually fires.
+                return send(res, 200, { routines: await current.harness.scheduler.status() });
+            case "POST /routine": {
+                const body = await readJson(req);
+                const name = typeof body.name === "string" ? body.name : "";
+                if (!name)
+                    return send(res, 400, { error: "name is required" });
+                if (anyRunning())
+                    return send(res, 409, { error: "a turn is running" });
+                try {
+                    const run = await current.harness.scheduler.runNow(name);
+                    broadcast({
+                        type: "notice",
+                        message: `routine ${name} ${run.ok ? "finished" : "failed"} in ${run.turns} turns`,
+                    });
+                    return send(res, 200, { run });
+                }
+                catch (err) {
+                    return send(res, 400, { error: errorMessage(err) });
+                }
+            }
+            case "GET /settings":
+                return send(res, 200, {
+                    cwd: current.session.cwd,
+                    workspace: current.harness.workspace,
+                    // Beside the full list, not instead of it: what the page needs to
+                    // show is which of those roots someone chose, because those are the
+                    // only ones a control on that page can change.
+                    configuredRoots: current.harness.configuredWritableRoots(),
+                    permissions: current.session.permissions.listRules(),
+                    // The whole status, not just the path: the page needs to know
+                    // whether the switch it draws is the user's to flip.
+                    audit: await current.harness.auditStatus(),
+                    settingsPaths: {
+                        user: current.harness.settings.pathFor("user"),
+                        project: current.harness.settings.pathFor("project"),
+                        local: current.harness.settings.pathFor("local"),
+                    },
+                });
+            /**
+             * Replace the write roots this machine allows.
+             *
+             * Only the configured ones travel here. The rest of that list is
+             * contributed by installed plugins and is rebuilt at launch, so
+             * accepting an edit to it would be accepting a change that silently
+             * reverts.
+             */
+            case "POST /settings/writable-roots": {
+                const body = await readJson(req);
+                if (!Array.isArray(body.roots) || body.roots.some((r) => typeof r !== "string")) {
+                    return send(res, 400, { error: "roots must be an array of paths" });
+                }
+                const saved = await current.harness.setWritableRoots(body.roots);
+                return send(res, 200, { roots: saved });
+            }
+            /**
+             * Who is signed in, if anyone.
+             *
+             * The same entry `accountToken` reads, so this answers for the
+             * credential the rest of the app would actually use — an account row
+             * reporting a different one from the thing doing the work would be
+             * worse than none.
+             */
+            case "GET /account": {
+                const credential = await current.harness.auth.store.get("official").catch(() => undefined);
+                if (credential?.type === "oauth") {
+                    // The site as well as the account: the row's menu leads to the
+                    // dashboard, and where that lives is this process's setting rather
+                    // than something a page should carry a copy of.
+                    return send(res, 200, {
+                        signedIn: true,
+                        provider: "official",
+                        site: siteUrl(),
+                        ...accountIdentity(credential.access),
+                    });
+                }
+                // Named even when signed out, so the button knows which sign-in to
+                // start without the page hard-coding a provider id of its own.
+                return send(res, 200, { signedIn: false, provider: "official" });
+            }
+            /**
+             * What the account has left, and what it could buy.
+             *
+             * Proxied rather than called from the page. The gateway wants the
+             * account's bearer token, and that token is the one thing that must not
+             * reach a browser tab: anything able to read the page could then spend
+             * money as well as read a transcript.
+             *
+             * Every failure answers 200 with a reason rather than a status. The
+             * caller is a paywall that has to render something either way, and "the
+             * shop cannot be reached" is a sentence someone can act on where a 502
+             * is not.
+             */
+            case "GET /billing": {
+                const token = await current.harness.accountToken();
+                if (!token)
+                    return send(res, 200, { signedIn: false, provider: "official" });
+                const [state, catalogue] = await Promise.all([
+                    gatewayJson("/api/v1/billing/balance", { token }),
+                    gatewayJson("/api/v1/billing/plans"),
+                ]);
+                if (!state.ok) {
+                    // 501 is a deployment that sells nothing — self-hosted, or a gateway
+                    // with no Stripe key. Not an error to report: it is the reason the
+                    // buttons should not be on screen at all.
+                    return send(res, 200, {
+                        signedIn: true,
+                        unavailable: state.status === 501 ? "not_for_sale" : "unreachable",
+                        error: state.error,
+                        site: siteUrl(),
+                    });
+                }
+                return send(res, 200, {
+                    signedIn: true,
+                    balanceMicro: state.value["balanceMicro"] ?? 0,
+                    credits: state.value["credits"] ?? 0,
+                    ...(state.value["subscription"] ? { subscription: state.value["subscription"] } : {}),
+                    // An empty list is the honest answer when the price list cannot be
+                    // read; the paywall falls back to sending people to the site, which
+                    // is where buying works without this app at all.
+                    plans: catalogue.ok ? (catalogue.value["plans"] ?? []) : [],
+                    site: siteUrl(),
+                });
+            }
+            /**
+             * A Stripe checkout, as a URL for the browser to open.
+             *
+             * No card field is ever rendered here and none is ever seen: what comes
+             * back is a link to Stripe's own page, opened the way the sign-in is —
+             * in the real browser, where 3-D Secure and a bank's own app can do what
+             * they need to and a local window cannot.
+             */
+            case "POST /billing/checkout": {
+                const body = await readJson(req);
+                const plan = typeof body.plan === "string" ? body.plan : "";
+                if (!plan)
+                    return send(res, 400, { error: "which plan?" });
+                const token = await current.harness.accountToken();
+                if (!token)
+                    return send(res, 400, { error: "sign in first" });
+                const locale = typeof body.locale === "string" ? body.locale : undefined;
+                const result = await gatewayJson("/api/v1/billing/checkout", {
+                    token,
+                    body: { plan, ...(locale ? { locale } : {}) },
+                });
+                if (!result.ok)
+                    return send(res, 400, { error: result.error });
+                return send(res, 200, { url: result.value["url"] });
+            }
+            /**
+             * Whether transcripts and artifacts are leaving this machine.
+             *
+             * `signedIn` travels beside the decision because the two off-states need
+             * opposite advice and look identical otherwise: "you turned this off" is
+             * fixed by the switch, "you are not signed in" is not, and a toggle that
+             * silently does nothing in the second case is the worst of both.
+             */
+            case "GET /sync": {
+                const status = current.harness.syncStatus();
+                return send(res, 200, {
+                    ...status,
+                    signedIn: Boolean(await current.harness.accountToken()),
+                });
+            }
+            case "POST /sync": {
+                const body = await readJson(req);
+                if (typeof body.enabled !== "boolean") {
+                    return send(res, 400, { error: "enabled must be a boolean" });
+                }
+                await current.harness.setSyncEnabled(body.enabled);
+                const status = current.harness.syncStatus();
+                return send(res, 200, {
+                    ...status,
+                    signedIn: Boolean(await current.harness.accountToken()),
+                });
+            }
+            /**
+             * Push what is waiting, now.
+             *
+             * The mirror already pushes on its own, so this is not how sync works —
+             * it is how someone finds out that it has, before closing a laptop. That
+             * is not a question a background timer can answer.
+             */
+            case "POST /sync/now": {
+                const pushed = await current.harness.syncNow();
+                if (!pushed) {
+                    const status = current.harness.syncStatus();
+                    return send(res, 400, {
+                        error: status.reason === "no-credential"
+                            ? "not signed in, so there is nowhere to push to"
+                            : status.reason === "excluded"
+                                ? "this project is excluded from sync"
+                                : "sync is off",
+                    });
+                }
+                return send(res, 200, { pushed: true });
+            }
+            /**
+             * Start or stop recording permission decisions.
+             *
+             * Its own route rather than a field on a settings PUT, because that is
+             * the shape every other switch on that page already has, and because
+             * the refusal — a project that decided this for you — needs somewhere to
+             * be said.
+             */
+            case "POST /audit": {
+                const body = await readJson(req);
+                if (typeof body.enabled !== "boolean") {
+                    return send(res, 400, { error: "enabled must be a boolean" });
+                }
+                try {
+                    return send(res, 200, await current.harness.setAudit(body.enabled));
+                }
+                catch (err) {
+                    return send(res, 400, { error: errorMessage(err) });
+                }
+            }
+            /**
+             * The trail, as a file.
+             *
+             * The same JSON lines that are on disk, with the session id on every one
+             * — not a report generated for the occasion. An export whose shape
+             * differs from the record it came from is a second format to keep
+             * honest, and the first question anybody asks of an audit file is
+             * whether it is the audit.
+             *
+             * `session=all` walks every session on this machine. That is a file read
+             * per session and nobody does it twice a minute; it is the answer to
+             * "give me the record", which is what an export is for.
+             */
+            case "GET /audit/export": {
+                const asked = url.searchParams.get("session") ?? current.session.id;
+                const ids = asked === "all"
+                    ? (await current.harness.listSessions(Number.MAX_SAFE_INTEGER))
+                        .sort((a, b) => a.updatedAt - b.updatedAt)
+                        .map((meta) => meta.id)
+                    : [asked];
+                let body = "";
+                for (const id of ids) {
+                    for (const entry of await current.harness.decisions(id)) {
+                        body += `${JSON.stringify({ ...entry, session: id })}\n`;
+                    }
+                }
+                // Named for what it holds and when it was taken: an audit file called
+                // audit.jsonl in a downloads folder full of them is one nobody can
+                // place afterwards.
+                const stamp = new Date().toISOString().slice(0, 10);
+                const name = `oharness-audit-${asked === "all" ? "all" : asked}-${stamp}.jsonl`;
+                res.writeHead(200, {
+                    "content-type": "application/x-ndjson; charset=utf-8",
+                    "content-length": Buffer.byteLength(body),
+                    "content-disposition": `attachment; filename="${name}"`,
+                    "cache-control": "private, no-store",
+                });
+                return void res.end(body);
+            }
+            /**
+             * One session's permission trail.
+             *
+             * Scoped to a session because that is where it is written and how it is
+             * meant to be read — beside the conversation it describes. Defaults to
+             * the focused one so the panel does not have to know an id to open.
+             */
+            case "GET /audit": {
+                const id = url.searchParams.get("session") ?? current.session.id;
+                return send(res, 200, {
+                    session: id,
+                    entries: await current.harness.decisions(id),
+                });
+            }
+            // The key lives behind this rather than in the HTML: a build that has one
+            // still hands it to nobody until they have opted in.
+            case "GET /analytics":
+                return send(res, 200, await analyticsState());
+            case "POST /analytics": {
+                const body = await readJson(req);
+                if (typeof body.enabled !== "boolean") {
+                    return send(res, 400, { error: "enabled must be a boolean" });
+                }
+                await writePrefs({ analytics: body.enabled });
+                return send(res, 200, await analyticsState());
+            }
+            case "GET /changes": {
+                const runner = runnerFor(url.searchParams.get("session"));
+                return send(res, 200, { changes: runner ? runner.ledger.list() : [] });
+            }
+            case "GET /sessions": {
+                const prefs = await readPrefs();
+                const pinned = new Set(prefs.pinnedSessions ?? []);
+                return send(res, 200, {
+                    // What somebody arranged by hand travels beside the list rather than
+                    // being applied to it here: the sidebar groups by project and hides
+                    // the tail of each group, so it is the only side that knows which
+                    // rows an order has to survive.
+                    order: prefs.sessionOrder ?? {},
+                    sessions: (await current.harness.listSessions(50)).map((meta) => ({
+                        id: meta.id,
+                        pinned: pinned.has(meta.id),
+                        title: meta.title,
+                        updatedAt: meta.updatedAt,
+                        turns: meta.turns,
+                        costUsd: meta.costUsd,
+                        current: meta.id === current.session.id,
+                        forkedFrom: meta.forkedFrom,
+                        // Sessions are stored per home, not per project, so this list spans
+                        // every tree opened here. The page groups by it rather than showing
+                        // one project's transcripts as another's history.
+                        cwd: meta.cwd,
+                    })),
+                });
+            }
+            /**
+             * What has been spent on this machine, and on what.
+             *
+             * Read back from the session metadata on disk rather than kept as a
+             * running total. A counter of its own would have to survive restarts,
+             * deleted sessions and runs started from the terminal, and it would be
+             * wrong in a different way after each of those — the transcripts are the
+             * only record that cannot drift from what actually happened.
+             *
+             * Sessions open in this process are laid over their stored copy: one
+             * mid-turn has already spent money its metadata will not know about
+             * until the turn lands, and the page asking is the page that spent it.
+             */
+            case "GET /usage": {
+                // How far back the page is asking about. Everything below — the
+                // totals, the models, the sessions and the curve — is that window and
+                // nothing else, because a figure that answers a different question
+                // from the chart under it is worse than no figure.
+                const range = USAGE_RANGES[url.searchParams.get("range") ?? ""] ?? USAGE_RANGES["30d"];
+                const since = range.days ? Date.now() - range.days * DAY_MS : 0;
+                const stored = await current.harness.listSessions(USAGE_SESSION_SCAN);
+                const rows = new Map();
+                for (const meta of stored) {
+                    rows.set(meta.id, {
+                        id: meta.id,
+                        title: meta.title,
+                        model: meta.model,
+                        updatedAt: meta.updatedAt,
+                        turns: meta.turns,
+                        costUsd: meta.costUsd || 0,
+                        ...tokensOf(meta.usage),
+                    });
+                }
+                for (const runner of runners.values()) {
+                    const sess = runner.session;
+                    rows.set(sess.id, {
+                        id: sess.id,
+                        title: sess.title,
+                        model: sess.model.id,
+                        // A session opened but not yet spoken to has no stored copy and no
+                        // last-updated time of its own; it is here, so it is now.
+                        updatedAt: rows.get(sess.id)?.updatedAt ?? Date.now(),
+                        turns: sess.turns,
+                        costUsd: sess.costUsd,
+                        ...tokensOf(sess.usage),
+                    });
+                }
+                // Sessions that never sent anything are dropped: they contribute zero
+                // to every total here, and a page about what was spent that opens with
+                // a screen of "$0.0000 · 0 tokens" buries the ones that cost money.
+                // They are still counted in `scanned`, which is what says how far back
+                // the numbers above them reach.
+                const list = [...rows.values()]
+                    .filter((row) => row.updatedAt >= since)
+                    .filter((row) => row.costUsd > 0 || row.input || row.output || row.cacheRead || row.cacheWrite)
+                    .sort((a, b) => b.updatedAt - a.updatedAt);
+                const zero = { costUsd: 0, input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+                const add = (into, row) => {
+                    into.costUsd += row.costUsd;
+                    into.input += row.input;
+                    into.output += row.output;
+                    into.cacheRead += row.cacheRead;
+                    into.cacheWrite += row.cacheWrite;
+                    return into;
+                };
+                const totals = list.reduce(add, { ...zero });
+                // Per model, because that is the axis a bill is read along: the same
+                // work costs an order of magnitude more on one model than another, and
+                // the only way to see that is to have them side by side.
+                const byModel = new Map();
+                for (const row of list) {
+                    const bucket = byModel.get(row.model)
+                        ?? { model: row.model, sessions: 0, lastUsedAt: 0, ...zero };
+                    bucket.sessions += 1;
+                    bucket.lastUsedAt = Math.max(bucket.lastUsedAt, row.updatedAt);
+                    byModel.set(row.model, add(bucket, row));
+                }
+                return send(res, 200, {
+                    range: range.id,
+                    series: usageSeries(list, since || (list.length ? list[list.length - 1].updatedAt : Date.now())),
+                    totals: { ...totals, sessions: list.length },
+                    // Sorted by what was spent, not by name: the row worth seeing first
+                    // is the expensive one.
+                    models: [...byModel.values()].sort((a, b) => b.costUsd - a.costUsd),
+                    // A page of them is a page nobody reads. The rest are counted in the
+                    // totals above, which is where a number that large belongs.
+                    sessions: list.slice(0, 20).map((row) => ({
+                        ...row,
+                        current: row.id === current.session.id,
+                    })),
+                    scanned: rows.size,
+                    // Said out loud so a total that stops short is not read as final.
+                    truncated: stored.length >= USAGE_SESSION_SCAN,
+                });
+            }
+            case "GET /models": {
+                // Which providers actually have credentials, so the picker can say
+                // "sign in" instead of offering a model whose first request 401s.
+                const configured = await current.harness.configuredProviders();
+                // Where each credential came from. The engine already distinguishes an
+                // environment variable from a stored key; the panel could not, so a
+                // provider connected purely by env looked the same as an unconnected
+                // one with a stale entry.
+                const sources = new Map((await current.harness.authStatus()).map((entry) => [entry.providerId, entry.source]));
+                // Who is signed in, where anyone is. "Connected" answers whether a
+                // credential exists; on an account-backed plan the useful question is
+                // *whose* account, which is the one thing a stale login gets wrong.
+                const accounts = new Map();
+                for (const provider of current.harness.auth.list()) {
+                    const credential = await current.harness.auth.store.get(provider.id);
+                    const email = credential?.type === "oauth" ? accountEmail(credential.access) : undefined;
+                    if (email)
+                        accounts.set(provider.id, email);
+                }
+                return send(res, 200, {
+                    models: current.harness.listModels().map((model) => ({
+                        id: model.id,
+                        provider: model.provider,
+                        contextWindow: model.contextWindow,
+                        configured: configured.has(model.provider),
+                        current: model.id === current.session.model.id,
+                    })),
+                    providers: current.harness.listCatalogProviders().map((entry) => ({
+                        id: entry.id,
+                        label: entry.label,
+                        envVars: entry.envVars,
+                        docsUrl: entry.docsUrl,
+                        // Where it would be reached. The only useful thing to say when a
+                        // local server discovers nothing is which address was tried.
+                        baseUrl: entry.baseUrl,
+                        popular: Boolean(entry.popular),
+                        recommended: Boolean(entry.recommended),
+                        description: entry.description,
+                        source: sources.get(entry.id),
+                        account: accounts.get(entry.id),
+                        configured: configured.has(entry.id),
+                        // Which vendors can be signed into from here rather than pasted a
+                        // key into. The panel has no other way to tell, and offering a key
+                        // field for an account-backed plan is a dead end.
+                        signIn: signInMethod(entry.id),
+                    })),
+                });
+            }
+            case "POST /auth": {
+                const body = await readJson(req);
+                const providerId = typeof body.provider === "string" ? body.provider : "";
+                const key = typeof body.key === "string" ? body.key.trim() : "";
+                if (!providerId || !key)
+                    return send(res, 400, { error: "provider and key are required" });
+                const provider = current.harness.auth.get(providerId);
+                if (!provider)
+                    return send(res, 404, { error: `unknown provider: ${providerId}` });
+                const index = provider.methods.findIndex((method) => method.type === "api");
+                if (index === -1) {
+                    return send(res, 400, {
+                        error: `${provider.label} does not take an API key — sign in from the terminal with \`oharness auth login ${providerId}\``,
+                    });
+                }
+                // Same path the CLI uses, so the credential lands in auth.json with
+                // the same shape and the same 0600 permissions.
+                await current.harness.auth.submit(providerId, index, { key });
+                // Answer as soon as the credential is stored. Discovery reaches out to
+                // the vendor, and holding the response until it finishes made the save
+                // button depend on a third party being reachable.
+                send(res, 200, { ok: true });
+                void current.harness
+                    .refreshModels(providerId)
+                    .then((found) => {
+                    broadcast({
+                        type: "models_changed",
+                        provider: providerId,
+                        discovered: found.length,
+                    });
+                })
+                    .catch((err) => {
+                    broadcast({
+                        type: "notice",
+                        message: `signed in to ${providerId}, but discovering its models failed: ${errorMessage(err)}`,
+                    });
+                });
+                return;
+            }
+            case "POST /signin": {
+                const body = await readJson(req);
+                const providerId = typeof body.provider === "string" ? body.provider : "";
+                const method = providerId ? signInMethod(providerId) : undefined;
+                if (!method)
+                    return send(res, 400, { error: "that provider has no sign-in" });
+                // Whatever the method asked for — an email for the account plans. Sent
+                // through verbatim so a provider can add a field without this endpoint
+                // learning about it.
+                const answers = {};
+                for (const [key, value] of Object.entries(body.answers ?? {})) {
+                    if (typeof value === "string")
+                        answers[key] = value;
+                }
+                try {
+                    const flow = await current.harness.auth.authorize(providerId, method.index, answers);
+                    if (flow.method !== "code") {
+                        return send(res, 400, {
+                            error: `${providerId} signs in a way this page cannot drive — use \`oharness auth login ${providerId}\``,
+                        });
+                    }
+                    // The callback is a closure over the flow's state, so it has to
+                    // outlive this request. Kept in memory only: it is worthless after
+                    // the code is used, and writing a half-finished login to disk would
+                    // leave one there whenever the tab is closed mid-flow.
+                    const id = randomUUID();
+                    pendingSignIns.set(id, { provider: providerId, callback: flow.callback });
+                    setTimeout(() => pendingSignIns.delete(id), SIGNIN_TTL_MS).unref?.();
+                    return send(res, 200, { flow: id, instructions: flow.instructions });
+                }
+                catch (err) {
+                    return send(res, 400, { error: errorMessage(err) });
+                }
+            }
+            case "POST /signin/browser": {
+                const body = await readJson(req);
+                const providerId = typeof body.provider === "string" ? body.provider : "";
+                // The same providers the emailed code serves: this is the OHarness
+                // account, and a vendor with no account here has no site to go to.
+                if (!providerId || !signInMethod(providerId)) {
+                    return send(res, 400, { error: "that provider has no sign-in" });
+                }
+                // Built from the host the request came in on, so the browser is sent
+                // back to the address this server is actually reachable at. It
+                // defaults to 4310 but falls back to whatever was free when 4310 was
+                // taken, so the running process is still the only thing that knows.
+                const host = req.headers.host ?? "127.0.0.1";
+                // Asked before a tab is opened, not after. The site redirects a
+                // session only to loopback — anything else would make it an open
+                // redirect that hands out sessions — so a UI reached over a LAN
+                // address or a tunnel cannot use this route at all. Left to the site,
+                // the refusal arrives as a 400 in a tab the user has already switched
+                // to, with the emailed code that would have worked nowhere in sight.
+                if (!isLoopbackHost(host)) {
+                    return send(res, 400, {
+                        error: `this window is open at ${host}, and the sign-in can only come back to a copy reached at localhost — use the emailed code instead`,
+                        fallback: "code",
+                    });
+                }
+                const state = randomUUID() + randomUUID();
+                pendingBrowserSignIns.set(state, { provider: providerId, started: Date.now() });
+                setTimeout(() => pendingBrowserSignIns.delete(state), BROWSER_SIGNIN_TTL_MS).unref?.();
+                const origin = `http://${host}`;
+                const locale = typeof body.locale === "string" ? body.locale : undefined;
+                return send(res, 200, {
+                    url: browserSignInUrl({
+                        state,
+                        redirectUri: `${origin}/signin/handoff`,
+                        ...(locale ? { locale } : {}),
+                    }),
+                    site: siteUrl(),
+                });
+            }
+            case "POST /signin/code": {
+                const body = await readJson(req);
+                const id = typeof body.flow === "string" ? body.flow : "";
+                const code = typeof body.code === "string" ? body.code.trim() : "";
+                const pending = pendingSignIns.get(id);
+                if (!pending)
+                    return send(res, 400, { error: "that sign-in expired — start it again" });
+                if (!code)
+                    return send(res, 400, { error: "code is required" });
+                try {
+                    const result = await pending.callback(code);
+                    if (result.type !== "success") {
+                        // The flow stays open: a mistyped code should cost a retry, not
+                        // another email.
+                        return send(res, 400, { error: result.error ?? "that code was not accepted" });
+                    }
+                    await current.harness.auth.complete(pending.provider, result);
+                }
+                catch (err) {
+                    return send(res, 400, { error: errorMessage(err) });
+                }
+                pendingSignIns.delete(id);
+                send(res, 200, { ok: true });
+                // Same as a saved key: answer first, then go ask the gateway what the
+                // account can actually call.
+                void current.harness
+                    .refreshModels(pending.provider)
+                    .then((found) => {
+                    broadcast({
+                        type: "models_changed",
+                        provider: pending.provider,
+                        discovered: found.length,
+                    });
+                })
+                    .catch((err) => {
+                    broadcast({
+                        type: "notice",
+                        message: `signed in to ${pending.provider}, but discovering its models failed: ${errorMessage(err)}`,
+                    });
+                });
+                return;
+            }
+            case "POST /logout": {
+                const body = await readJson(req);
+                const providerId = typeof body.provider === "string" ? body.provider : "";
+                if (!providerId)
+                    return send(res, 400, { error: "provider is required" });
+                const removed = await current.harness.auth.logout(providerId);
+                return send(res, 200, { removed });
+            }
+            case "POST /models/refresh": {
+                const body = await readJson(req);
+                const providerId = typeof body.provider === "string" ? body.provider : undefined;
+                try {
+                    // Asks each vendor's own /models endpoint. Model ids change faster
+                    // than this package ships, so discovery is the only list that can be
+                    // right — the built-in catalog carries providers, not model names.
+                    const found = await current.harness.refreshModels(providerId);
+                    return send(res, 200, { discovered: found.length });
+                }
+                catch (err) {
+                    return send(res, 400, { error: errorMessage(err) });
+                }
+            }
+            case "POST /model": {
+                const body = await readJson(req);
+                const runner = runnerFor(body.session);
+                if (!runner)
+                    return send(res, 404, { error: "no such session" });
+                if (runner.running)
+                    return send(res, 409, { error: "a turn is running" });
+                if (typeof body.id !== "string")
+                    return send(res, 400, { error: "id is required" });
+                try {
+                    const change = runner.session.setModel(body.id);
+                    // Remembered for the sessions started after this one, here and in the
+                    // next run: picking a model is a decision, not a per-session detail.
+                    preferredModel = change.to.id;
+                    void writePrefs({ model: preferredModel });
+                    broadcast({
+                        type: "model_changed",
+                        session: runner.session.id,
+                        from: change.from.id,
+                        to: change.to.id,
+                    });
+                    return send(res, 200, state(runner));
+                }
+                catch (err) {
+                    return send(res, 400, { error: errorMessage(err) });
+                }
+            }
+            case "POST /mode": {
+                const body = await readJson(req);
+                const runner = runnerFor(body.session);
+                if (!runner)
+                    return send(res, 404, { error: "no such session" });
+                const mode = String(body.mode ?? "");
+                if (!PERMISSION_MODES.includes(mode)) {
+                    return send(res, 400, { error: `unknown mode: ${mode}` });
+                }
+                runner.session.permissions.setMode(mode);
+                broadcast({ type: "state", session: runner.session.id, state: state(runner) });
+                return send(res, 200, state(runner));
+            }
+            case "POST /session": {
+                const body = await readJson(req);
+                // Closing frees the runner but leaves the transcript on disk, so the
+                // session reopens from the sidebar exactly as it was.
+                if (body.action === "close") {
+                    const id = String(body.id ?? "");
+                    const runner = runners.get(id);
+                    runner?.running?.abort();
+                    runners.delete(id);
+                    // Its artifacts move from memory to the log half of the catalogue,
+                    // and a fold taken before this session existed does not have them.
+                    cachedLogs = undefined;
+                    if (focused === id)
+                        focused = [...runners.keys()][0] ?? focused;
+                    return send(res, 200, { closed: Boolean(runner), open: [...runners.keys()] });
+                }
+                // Deleting throws the transcript away for good, so unlike `close` it
+                // refuses to touch a session that is mid-turn: aborting only asks the
+                // loop to stop, and a turn still writing would recreate the log we
+                // just removed.
+                if (body.action === "delete") {
+                    const id = String(body.id ?? "");
+                    if (!id)
+                        return send(res, 400, { error: "id is required" });
+                    if (runners.get(id)?.running)
+                        return send(res, 409, { error: "session is busy" });
+                    // Reported rather than blocked: a fork records its parent, so the
+                    // page can say what the lineage loses instead of the branches
+                    // quietly pointing at nothing.
+                    const forks = (await current.harness.store.children(id)).length;
+                    const deleted = await current.harness.deleteSession(id);
+                    // A session nobody has spoken to has nothing on disk yet — the store
+                    // writes on the first message — but it is still a session someone
+                    // opened, and it is exactly the kind that gets thrown away when the
+                    // workspace under it changes. What makes this a 404 is nothing
+                    // knowing about it at all, not the absence of a transcript.
+                    if (!deleted && !runners.has(id))
+                        return send(res, 404, { error: "no such session" });
+                    runners.delete(id);
+                    // Its artifact log went with it, and a fold taken a moment ago
+                    // still names it.
+                    cachedLogs = undefined;
+                    if (focused === id)
+                        focused = [...runners.keys()][0] ?? focused;
+                    // `current` is what routes that name no session fall back to. Left
+                    // pointing at a deleted one it would answer for a transcript that is
+                    // no longer on disk, so it moves to whatever is still open.
+                    if (current.session.id === id) {
+                        const next = runners.get(focused);
+                        if (next)
+                            current = { session: next.session, agent: next.agent, harness: next.harness };
+                    }
+                    return send(res, 200, { deleted: true, forks, open: [...runners.keys()] });
+                }
+                if (body.action === "focus") {
+                    const runner = runnerFor(body.id);
+                    if (!runner)
+                        return send(res, 404, { error: "no such session" });
+                    focused = runner.session.id;
+                    // Tabs can sit in different trees, so focus moves the fallback every
+                    // route without a session name uses — which project is current, and
+                    // which tree the folder dialog and the file search start from.
+                    current = { session: runner.session, agent: runner.agent, harness: runner.harness };
+                    return send(res, 200, state(runner));
+                }
+                return send(res, 200, await switchSession(body));
+            }
+            case "GET /open":
+                // What the page should draw tabs for after a reload.
+                return send(res, 200, {
+                    open: [...runners.values()].map((runner) => ({
+                        id: runner.session.id,
+                        title: runner.session.title,
+                        cwd: runner.session.cwd,
+                        busy: Boolean(runner.running),
+                        current: runner.session.id === focused,
+                    })),
+                });
+            /**
+             * Rename a session. The focused one, or any other by id.
+             *
+             * The id arrived with the sidebar's row menu: renaming from a list means
+             * renaming something other than what is on screen, and a route that
+             * always renamed `current` would have quietly retitled the open session
+             * instead of the row that was clicked.
+             */
+            case "POST /rename": {
+                const body = await readJson(req);
+                const title = typeof body.title === "string" ? body.title.trim() : "";
+                if (!title)
+                    return send(res, 400, { error: "title is required" });
+                const id = typeof body.id === "string" && body.id ? body.id : current.session.id;
+                const renamed = await current.harness.renameSession(id, title);
+                if (!renamed)
+                    return send(res, 404, { error: "no such session" });
+                // The one on screen carries its title in memory too, or the tab keeps
+                // the old one until something else reloads it.
+                const runner = runnerFor(id);
+                if (runner)
+                    runner.session.title = title;
+                return send(res, 200, { ok: true, id, title });
+            }
+            case "POST /upload": {
+                const name = String(req.headers["x-filename"] ?? "file");
+                const mediaType = String(req.headers["content-type"] ?? "application/octet-stream");
+                const runner = runnerFor(url.searchParams.get("session"));
+                // Refused here rather than at send time, while the person is still
+                // looking at the file they chose: a model that cannot read an image
+                // answers a screenshot with a guess about its filename, which reads
+                // like a bad answer rather than a wrong model. Only a model the
+                // catalog documents as text-only is refused — a discovered endpoint
+                // that published no capabilities at all has said nothing, and
+                // refusing on a guess would break the common case.
+                const spec = runner?.session.model;
+                if (mediaType.startsWith("image/") &&
+                    spec &&
+                    !spec.supportsImages &&
+                    !spec.capabilitiesAssumed) {
+                    return send(res, 400, {
+                        error: `${spec.displayName ?? spec.id} cannot read images — switch models to attach one`,
+                    });
+                }
+                const data = await readBody(req, MAX_UPLOAD_BYTES);
+                const id = randomUUID();
+                attachments.set(id, { name, mediaType, data, at: Date.now() });
+                sweepAttachments();
+                return send(res, 200, {
+                    id,
+                    name,
+                    mediaType,
+                    bytes: data.byteLength,
+                    kind: mediaType.startsWith("image/") ? "image" : "file",
+                });
+            }
+            /**
+             * A staged file the composer no longer points at.
+             *
+             * Best effort, and deliberately quiet about a miss: the page has already
+             * dropped the chip, so nothing here can fail in a way the person could
+             * act on. Without it the bytes would sit in memory until the sweep, and
+             * removing a 12MB screenshot would free nothing for half an hour.
+             */
+            case "POST /upload/drop": {
+                const body = await readJson(req);
+                if (typeof body.id === "string")
+                    attachments.delete(body.id);
+                return send(res, 200, { ok: true });
+            }
+            case "POST /prompt": {
+                const body = await readJson(req);
+                const runner = runnerFor(body.session);
+                if (!runner)
+                    return send(res, 404, { error: "no such session" });
+                const prompt = typeof body.prompt === "string" ? body.prompt.trim() : "";
+                const ids = Array.isArray(body.attachments) ? body.attachments : [];
+                const references = readReferences(body.references);
+                if (!prompt && !ids.length && !references.length) {
+                    return send(res, 400, { error: "prompt is required" });
+                }
+                // Per runner, not global: a turn in one tab must not block another.
+                if (runner.running)
+                    return send(res, 409, { error: "a turn is already running" });
+                const staged = ids
+                    .map((id) => (typeof id === "string" ? attachments.get(id) : undefined))
+                    .filter((entry) => Boolean(entry));
+                for (const id of ids)
+                    if (typeof id === "string")
+                        attachments.delete(id);
+                // The other end of the staging map's lifecycle: sending is the moment
+                // a composer is known to have moved on, so it is a good moment to ask
+                // what else has been abandoned.
+                sweepAttachments();
+                void runTurn(runner, prompt, staged, references);
+                return send(res, 202, { ok: true, attached: staged.length, referenced: references.length });
+            }
+            case "POST /permission": {
+                const body = await readJson(req);
+                const entry = typeof body.id === "string" ? pending.get(body.id) : undefined;
+                if (!entry)
+                    return send(res, 404, { error: "no such pending request" });
+                pending.delete(entry.id);
+                entry.resolve({
+                    allow: body.allow === true,
+                    ...(typeof body.remember === "string"
+                        ? { remember: body.remember }
+                        : {}),
+                });
+                return send(res, 200, { ok: true });
+            }
+            case "POST /interrupt":
+                {
+                    const body = await readJson(req);
+                    runnerFor(body.session)?.running?.abort();
+                }
+                return send(res, 200, { ok: true });
+            default:
+                return send(res, 404, { error: "not found" });
+        }
+    }
+    /**
+     * The browser coming back from the site, session in hand.
+     *
+     * Answers with a page rather than JSON: a human is looking at this tab, and
+     * what they need to be told is that they can close it. The app itself hears
+     * about the sign-in over the event stream, which is where it was waiting.
+     */
+    async function browserSignInReturn(url, res) {
+        const state = url.searchParams.get("state") ?? "";
+        const pending = pendingBrowserSignIns.get(state);
+        // Consumed on sight, whatever happens next. A nonce that survived a failed
+        // attempt could be replayed by anything that saw it in the address bar.
+        pendingBrowserSignIns.delete(state);
+        if (!pending) {
+            return closeTab(res, 400, "That sign-in has expired. Start it again from the app.");
+        }
+        const failure = url.searchParams.get("error");
+        if (failure)
+            return closeTab(res, 400, failure);
+        const code = url.searchParams.get("code") ?? "";
+        if (!code)
+            return closeTab(res, 400, "The site sent no sign-in back.");
+        const result = await exchangeHandoff(code, state);
+        if (result.type !== "success") {
+            const message = result.error ?? "that sign-in was not accepted";
+            broadcast({ type: "notice", message: `sign-in failed: ${message}` });
+            return closeTab(res, 400, message);
+        }
+        try {
+            await current.harness.auth.complete(pending.provider, result);
+        }
+        catch (err) {
+            return closeTab(res, 500, errorMessage(err));
+        }
+        closeTab(res, 200, `Signed in to ${pending.provider}.`);
+        // Same as a saved key: the credential is stored, now go ask the gateway
+        // what the account can actually call.
+        void current.harness
+            .refreshModels(pending.provider)
+            .then((found) => {
+            broadcast({ type: "models_changed", provider: pending.provider, discovered: found.length });
+        })
+            .catch((err) => {
+            broadcast({
+                type: "notice",
+                message: `signed in to ${pending.provider}, but discovering its models failed: ${errorMessage(err)}`,
+            });
+        });
+    }
+    /**
+     * The provider's sign-in method, if it has one.
+     *
+     * Reported by index because that is what `authorize` takes, and a provider
+     * may declare several methods — the official plan takes either an account
+     * sign-in or a key.
+     */
+    function signInMethod(providerId) {
+        const provider = current.harness.auth.get(providerId);
+        if (!provider)
+            return undefined;
+        const index = provider.methods.findIndex((method) => method.type === "oauth");
+        if (index === -1)
+            return undefined;
+        return { index, label: provider.methods[index].label };
+    }
+    /**
+     * The connectors and plugins this harness actually has.
+     *
+     * Read from the live harness rather than from configuration: a server that
+     * is declared but failed to start is worth showing as exactly that, and a
+     * menu built from the config file would claim it was there.
+     */
+    function contextOffer() {
+        const harness = current.harness;
+        const connectors = (harness.mcpStatus?.() ?? []).map((status) => ({
+            name: status.name,
+            connected: status.connected,
+            transport: status.transport,
+            tools: status.toolCount,
+            ...(status.error ? { error: status.error } : {}),
+            ...(status.needsAuth ? { needsAuth: true } : {}),
+        }));
+        const plugins = (harness.plugins ?? []).map((plugin) => ({
+            name: plugin.name,
+            ...(plugin.description ? { description: plugin.description } : {}),
+            source: plugin.source,
+            servers: Object.keys(plugin.mcpServers ?? {}),
+            subagents: plugin.subagents?.length ?? 0,
+        }));
+        return { connectors, plugins };
+    }
+    /**
+     * What the composer attached to one message, as a block above the prompt.
+     *
+     * Paths are named, not inlined: the agent has tools for reading a file and a
+     * folder, the user can watch it use them, and a folder someone picked out of
+     * curiosity should not spend a hundred thousand tokens before the first
+     * word of the answer. Connectors and plugins are described from live state
+     * for the same reason the menu is.
+     */
+    function referenceNote(references) {
+        if (!references.length)
+            return "";
+        const offer = contextOffer();
+        const lines = references.map((ref) => {
+            if (ref.kind === "file")
+                return `- file: ${ref.value}`;
+            if (ref.kind === "folder")
+                return `- folder: ${ref.value}`;
+            if (ref.kind === "connector") {
+                const found = offer.connectors.find((connector) => connector.name === ref.value);
+                const detail = !found
+                    ? "not connected"
+                    : found.connected
+                        ? `${found.tools} tools, named mcp__${found.name}__*`
+                        : `not connected${found.error ? ` — ${found.error}` : ""}`;
+                return `- MCP connector: ${ref.value} (${detail})`;
+            }
+            const plugin = offer.plugins.find((entry) => entry.name === ref.value);
+            const detail = plugin?.description ? ` — ${plugin.description}` : "";
+            return `- plugin: ${ref.value}${detail}`;
+        });
+        return [
+            "<referenced>",
+            "The user attached these to this message. Read what you need before answering.",
+            ...lines,
+            "</referenced>",
+        ].join("\n");
+    }
+    function state(runner = runners.get(focused)) {
+        const { session: sess } = runner;
+        const model = sess.model;
+        const used = sess.usage.inputTokens + sess.usage.outputTokens;
+        return {
+            sessionId: sess.id,
+            // The page labels its tabs from this. Without it every tab read
+            // "Untitled", including sessions the store had a title for all along.
+            title: sess.title,
+            cwd: sess.cwd,
+            model: model.id,
+            provider: model.provider,
+            mode: sess.permissions.getMode(),
+            costUsd: sess.costUsd,
+            // Beside the cost, because the line under the composer says three things
+            // about one turn: what it cost, how many tokens that took, and how much
+            // of the prompt was served from cache — and the last is the only one of
+            // the three that says whether the first could have been lower.
+            usage: tokensOf(sess.usage),
+            turns: sess.turns,
+            contextWindow: model.contextWindow,
+            contextUsed: model.contextWindow ? Math.min(1, used / model.contextWindow) : undefined,
+            busy: Boolean(runner.running),
+        };
+    }
+    /**
+     * The transcript, flattened into what the page draws.
+     *
+     * Tool results are attached to the assistant turn that called them rather
+     * than left as the user messages they are on the wire, because the page
+     * shows a call and its result as one card.
+     */
+    function history(runner = runners.get(focused)) {
+        const entries = [];
+        let index = 0;
+        for (const message of runner.session.messages) {
+            index++;
+            const tools = message.content.filter((block) => block.type === "tool_call");
+            const results = message.content.filter((block) => block.type === "tool_result");
+            const text = messageText(message).trim();
+            // The bytes stay where they are; what travels is where to find them.
+            // Without this a reloaded conversation showed "[image: shot.png]" where
+            // the screenshot had been — the model still saw it, the person did not.
+            const images = message.content
+                .map((block, position) => ({ block, position }))
+                .filter((entry) => entry.block.type === "image")
+                .map((entry) => ({
+                src: `/attachment?session=${encodeURIComponent(runner.session.id)}` +
+                    `&message=${index}&block=${entry.position}`,
+            }));
+            // messageText drops thinking blocks by design, so they are read directly.
+            const thinking = message.content
+                .filter((block) => block.type === "thinking")
+                .map((block) => block.thinking)
+                .join("")
+                .trim();
+            if (results.length) {
+                const target = entries.at(-1);
+                if (target) {
+                    // The results arrived in a later message, so a fork "after this
+                    // reply" has to include it or the branch reopens with tool calls
+                    // that have no answers — a request every provider rejects.
+                    target.keepMessages = index;
+                    target.results = results.map((block) => ({
+                        id: block.toolCallId,
+                        text: block.content
+                            .map((part) => (part.type === "text" ? part.text : ""))
+                            .join("")
+                            .slice(0, 4000),
+                        ...(block.isError ? { isError: true } : {}),
+                    }));
+                }
+                if (!text && !thinking && !images.length)
+                    continue;
+            }
+            if (!text && !tools.length && !thinking && !images.length)
+                continue;
+            entries.push({
+                role: message.role === "assistant" ? "assistant" : "user",
+                keepMessages: index,
+                ...(images.length ? { images } : {}),
+                ...(thinking ? { thinking } : {}),
+                ...(text ? { text } : {}),
+                ...(tools.length
+                    ? { tools: tools.map((block) => ({ id: block.id, name: block.name, input: block.input })) }
+                    : {}),
+            });
+        }
+        return entries;
+    }
+    /**
+     * The harness a directory's sessions run on, built the first time one asks.
+     *
+     * A session names the tree it works in, so starting or resuming one
+     * elsewhere reaches for that project's harness rather than moving the
+     * current one onto a new cwd: every runner already carries its own, and
+     * rebuilding the open ones to follow would reconnect their MCP servers for
+     * a change that is none of their business.
+     *
+     * Choosing a directory here is also a statement about what the user is
+     * working on, so it is what the next launch opens.
+     */
+    async function harnessFor(dir) {
+        const project = await addProject(dir);
+        void writePrefs({ project: project.path });
+        const existing = harnesses.get(project.path);
+        if (existing)
+            return existing;
+        const harness = await (opts.openProject
+            ? opts.openProject(project.path)
+            : Harness.create({
+                cwd: project.path,
+                permissionPrompt: (request) => permissionPrompt(request),
+            }));
+        harnesses.set(project.path, harness);
+        return harness;
+    }
+    /**
+     * Open a different project.
+     *
+     * Everything scoped to a directory is rebuilt: the harness, its session, and
+     * the change ledger. Carrying the ledger across would attribute one
+     * project's edits to another.
+     */
+    async function switchProject(dir, resume) {
+        const harness = await harnessFor(dir);
+        // Opening one of that project's own sessions is the common reason to
+        // switch, and doing it in one step avoids stranding an empty session in
+        // the list for every switch made on the way to an existing transcript.
+        const resumed = resume ? await harness.resumeSession(resume) : undefined;
+        const session = resumed ?? freshSession(harness);
+        if (!resumed)
+            await session.init();
+        const runner = makeRunner(session, harness);
+        runners.set(session.id, runner);
+        focused = session.id;
+        current = { session, agent: runner.agent, harness };
+        const snapshot = state(runner);
+        broadcast({
+            type: "session_changed",
+            session: session.id,
+            state: snapshot,
+            entries: history(runner),
+        });
+        return snapshot;
+    }
+    async function switchSession(body) {
+        const action = String(body.action ?? "");
+        let next;
+        /**
+         * The tree this session works in.
+         *
+         * Named by the caller, or the project already on screen. A session belongs
+         * to one directory — the page asks which before starting one, and resuming
+         * a transcript recorded elsewhere has to reach for the tree it mentions
+         * rather than point its tools at whatever project is open now.
+         */
+        const where = typeof body.cwd === "string" ? body.cwd.trim() : "";
+        let harness = where && where !== current.session.cwd ? await harnessFor(where) : current.harness;
+        if (action === "new") {
+            next = freshSession(harness);
+            await next.init();
+        }
+        else if (action === "resume" && typeof body.id === "string") {
+            next = await harness.resumeSession(body.id);
+        }
+        else if (action === "fork") {
+            harness = current.harness;
+            const forked = await harness.forkSession(current.session.id, {
+                ...(typeof body.keepMessages === "number" ? { keepMessages: body.keepMessages } : {}),
+            });
+            next = forked;
+        }
+        else {
+            return { error: `unknown action: ${action}` };
+        }
+        if (!next)
+            return { error: "could not open that session" };
+        // A tab per session, with its own agent and ledger. Reusing the previous
+        // agent would append this session's turns to the old transcript, and
+        // sharing a ledger would attribute one session's edits to another.
+        let runner = runners.get(next.id);
+        if (!runner) {
+            runner = makeRunner(next, harness);
+            runners.set(next.id, runner);
+        }
+        focused = next.id;
+        // A reopened tab keeps the harness it was built on, which is the one its
+        // own cwd belongs to.
+        current = { session: next, agent: runner.agent, harness: runner.harness };
+        const snapshot = state(runner);
+        broadcast({
+            type: "session_changed",
+            session: next.id,
+            state: snapshot,
+            entries: history(runner),
+        });
+        return snapshot;
+    }
+    async function runTurn(runner, prompt, staged = [], references = []) {
+        const controller = new AbortController();
+        runner.running = controller;
+        const id = runner.session.id;
+        // Every event carries its session so the page can route it to the tab it
+        // belongs to; without it a reply from a background tab would stream into
+        // whichever one happens to be on screen.
+        broadcast({
+            type: "prompt",
+            session: id,
+            text: prompt,
+            ...(staged.length ? { attachments: staged.map((file) => file.name) } : {}),
+            // The transcript shows what was referenced, not just what was typed:
+            // otherwise a turn that reads three files looks like it went and found
+            // them on its own.
+            ...(references.length ? { references } : {}),
+        });
+        // The note goes above the prompt rather than after it, so the model has
+        // the context before it reads the request that depends on it.
+        const note = referenceNote(references);
+        const text = note ? `${note}\n\n${prompt}` : prompt;
+        const input = staged.length ? buildMessage(text, staged) : text;
+        try {
+            for await (const event of runner.agent.run(input, { signal: controller.signal })) {
+                broadcast({ ...event, session: id });
+            }
+        }
+        catch (err) {
+            broadcast({
+                type: "error",
+                session: id,
+                error: errorMessage(err),
+                // Carried as a number rather than left for the page to read out of the
+                // sentence. A 402 is not an error to print — it is a screen to open —
+                // and a frontend that finds that out by matching "HTTP 402" in a
+                // string is a frontend that breaks the day the string is reworded.
+                ...(typeof err?.status === "number"
+                    ? { status: err.status }
+                    : {}),
+                // Which vendor refused, for the same reason the status travels: a 401
+                // is the one failure the user can fix, and fixing it means opening
+                // that provider's dialog. The page knows the session's model but not
+                // which provider a mid-turn fallback had ended up on.
+                ...(typeof err?.provider === "string"
+                    ? { provider: err.provider }
+                    : {}),
+                fatal: true,
+            });
+        }
+        finally {
+            runner.running = undefined;
+            broadcast({
+                type: "idle",
+                session: id,
+                state: state(runner),
+                changes: runner.ledger.list(),
+            });
+        }
+    }
+    function stream(res) {
+        res.writeHead(200, {
+            "content-type": "text/event-stream",
+            "cache-control": "no-cache",
+            connection: "keep-alive",
+            // Proxies that buffer would hold the whole reply until the turn ends,
+            // which defeats streaming entirely.
+            "x-accel-buffering": "no",
+        });
+        res.write(": connected\n\n");
+        clients.add(res);
+        // A heartbeat keeps intermediaries from closing an idle stream while the
+        // model is thinking.
+        const beat = setInterval(() => res.write(": ping\n\n"), 15_000);
+        beat.unref?.();
+        res.on("close", () => {
+            clearInterval(beat);
+            clients.delete(res);
+        });
+    }
+    /**
+     * How many sessions one listing folds from disk.
+     *
+     * Bounded because the panel is opened casually and each session past this is
+     * a file read. The newest are kept, and the response says how many were left
+     * out rather than presenting a cut list as the whole set.
+     */
+    const CATALOGUE_SESSIONS = 200;
+    /**
+     * How much of one artifact log a listing reads.
+     *
+     * The tail, because the newest revisions are the ones a listing shows. A
+     * session that rewrote a page fifty times has fifty full copies in its log
+     * and exactly one of them on screen.
+     */
+    const CATALOGUE_TAIL_BYTES = 4 * 1024 * 1024;
+    /**
+     * How long a fold of the logs is reused.
+     *
+     * The catalogue is rebuilt on every artifact event — a model rewriting a
+     * page does that a dozen times a turn — and the loaded half is recomputed
+     * each time regardless, because it is a map lookup. The disk half is the
+     * expensive one and it can only change under this process when *another*
+     * process writes a session this one does not have open, so a few seconds of
+     * staleness costs nothing anybody can see.
+     */
+    const CATALOGUE_TTL_MS = 15_000;
+    let cachedLogs;
+    /**
+     * Every artifact this machine holds, newest session first.
+     *
+     * Two sources, and the order between them matters. A loaded session's store
+     * is authoritative for its own artifacts: it holds the canvas revision a
+     * person made a second ago and the publication link, neither of which the
+     * log carries. Everything else is folded from the revision logs, which is
+     * what makes the panel's answer independent of which tabs are open.
+     */
+    async function artifactCatalogue() {
+        const groups = [];
+        for (const runner of runners.values()) {
+            const artifacts = describeArtifacts(getArtifactStore(runner.session.state));
+            if (!artifacts.length)
+                continue;
+            groups.push({
+                session: runner.session.id,
+                title: runner.session.title,
+                current: runner.session.id === focused,
+                updatedAt: Math.max(...artifacts.map((artifact) => artifact.at), 0),
+                artifacts,
+            });
+        }
+        const fromLogs = await foldedLogs();
+        // A loaded session overrides its own log, so a session that appears in
+        // both is only listed once — from memory, which is the newer of the two.
+        for (const group of fromLogs.groups) {
+            if (!runners.has(group.session))
+                groups.push(group);
+        }
+        // The session in front of you first, whatever its dates say: its artifacts
+        // are the ones this turn just made. The rest by when they were last
+        // touched, which is the order the sidebar puts sessions in.
+        groups.sort((a, b) => Number(b.current) - Number(a.current) || b.updatedAt - a.updatedAt);
+        return { sessions: groups, ...(fromLogs.more ? { more: fromLogs.more } : {}) };
+    }
+    /** The durable half of the catalogue, folded from the logs and reused briefly. */
+    async function foldedLogs() {
+        if (cachedLogs && Date.now() - cachedLogs.at < CATALOGUE_TTL_MS)
+            return cachedLogs;
+        const store = current.harness.store;
+        const logs = await store.artifactSessions();
+        // Read for their titles and their dates, and to put the newest first — a
+        // cap that kept an arbitrary two hundred would be worse than no cap. The
+        // limit is on the listing, not on the read: it bounds the title backfill,
+        // which is a transcript read for every session that never got one.
+        const metas = new Map((await current.harness.listSessions(500)).map((meta) => [meta.id, meta]));
+        const ordered = logs
+            .map((id) => ({ id, updatedAt: metas.get(id)?.updatedAt ?? 0 }))
+            .sort((a, b) => b.updatedAt - a.updatedAt);
+        const groups = [];
+        for (const { id, updatedAt } of ordered.slice(0, CATALOGUE_SESSIONS)) {
+            const revisions = await store.artifactRevisions(id, CATALOGUE_TAIL_BYTES);
+            if (!revisions.length)
+                continue;
+            const folded = new ArtifactStore();
+            restoreArtifacts(folded, revisions);
+            const artifacts = describeArtifacts(folded);
+            if (!artifacts.length)
+                continue;
+            const meta = metas.get(id);
+            groups.push({
+                session: id,
+                ...(meta?.title ? { title: meta.title } : {}),
+                current: false,
+                updatedAt: updatedAt || Math.max(...artifacts.map((artifact) => artifact.at), 0),
+                artifacts,
+            });
+        }
+        cachedLogs = {
+            at: Date.now(),
+            groups,
+            more: Math.max(0, ordered.length - CATALOGUE_SESSIONS),
+        };
+        return cachedLogs;
+    }
+    /**
+     * A store's artifacts, each with the date of the revision on show.
+     *
+     * The timestamp is not on the descriptor — it belongs to a revision, not to
+     * the artifact — but a list that spans weeks is unreadable without it.
+     */
+    function describeArtifacts(store) {
+        return store.list().map((artifact) => ({
+            ...artifact,
+            at: store.get(artifact.id)?.revision.createdAt ?? 0,
+        }));
+    }
+    /**
+     * The body of one artifact, isolated. Resolves against whichever session the
+     * caller names, so an artifact stays viewable after the page switches tabs.
+     */
+    function serveArtifactBody(url, res) {
+        const runner = runnerFor(url.searchParams.get("session"));
+        if (!runner)
+            return send(res, 404, { error: "no such session" });
+        const id = url.searchParams.get("id") ?? "";
+        if (!isValidArtifactId(id))
+            return send(res, 400, { error: "bad artifact id" });
+        const versionParam = url.searchParams.get("version");
+        const found = getArtifactStore(runner.session.state).get(id, versionParam ? Number(versionParam) : undefined);
+        if (!found)
+            return send(res, 404, { error: "no such artifact" });
+        sendArtifact(res, found.artifact, found.revision);
+    }
+    function constantTimeEqual(supplied, expected) {
+        if (!supplied)
+            return false;
+        const a = Buffer.from(supplied);
+        const b = Buffer.from(expected);
+        return a.length === b.length && timingSafeEqual(a, b);
+    }
+    function authorized(url, req) {
+        const supplied = url.searchParams.get("token") ??
+            (req.headers.authorization ?? "").replace(/^Bearer\s+/i, "");
+        if (!supplied)
+            return false;
+        // Constant-time comparison: a plain !== leaks the token a character at a
+        // time to anything that can measure the response.
+        const a = Buffer.from(supplied);
+        const b = Buffer.from(token);
+        return a.length === b.length && timingSafeEqual(a, b);
+    }
+    await listenPreferring(server, opts.port, host);
+    const address = server.address();
+    const port = typeof address === "object" && address ? address.port : opts.port;
+    return {
+        url: `http://${host}:${port}/?token=${token}`,
+        token,
+        permissionPrompt,
+        async close() {
+            for (const client of clients)
+                client.end();
+            clients.clear();
+            // Any prompt still waiting has to be answered, or the agent's turn hangs
+            // forever holding the process open. Shutting down denies.
+            for (const entry of pending.values())
+                entry.resolve({ allow: false });
+            pending.clear();
+            for (const runner of runners.values())
+                runner.running?.abort();
+            await new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+}
+/**
+ * The port used when nobody names one.
+ *
+ * A stable number so the URL is the same every run — bookmarkable, and the
+ * same one a second terminal can be told about. It is not a secret and is not
+ * asked to be: what protects this server is the loopback bind and the
+ * per-run token, and the comment at the top of this file is careful to credit
+ * those rather than an unguessable port.
+ */
+const DEFAULT_PORT = 4310;
+/**
+ * Listen on the preferred port, or anywhere if it is taken.
+ *
+ * Two rules, because the two cases mean different things:
+ *
+ *   - No `--port`: try DEFAULT_PORT, and on EADDRINUSE fall back to an
+ *     OS-assigned one. Running a second instance is ordinary — a second
+ *     project, a second terminal — and refusing to start would be a worse
+ *     answer than a different port. The URL is printed either way.
+ *   - An explicit `--port`: that number or nothing. Someone who names a port
+ *     has something pointed at it, and quietly listening somewhere else would
+ *     leave them staring at a dead bookmark with the server apparently up.
+ */
+async function listenPreferring(server, port, host) {
+    if (port !== undefined)
+        return listen(server, port, host);
+    try {
+        await listen(server, DEFAULT_PORT, host);
+    }
+    catch (err) {
+        if (err.code !== "EADDRINUSE")
+            throw err;
+        await listen(server, 0, host);
+    }
+}
+function listen(server, port, host) {
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(port, host, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+}
+function send(res, status, body) {
+    const payload = JSON.stringify(body);
+    res.writeHead(status, {
+        "content-type": "application/json; charset=utf-8",
+        "content-length": Buffer.byteLength(payload),
+    });
+    res.end(payload);
+}
+/**
+ * Who an access token says it belongs to, as far as it is worth displaying.
+ *
+ * Read out of the JWT's own payload rather than asked of the auth server: this
+ * is display text beside a menu, and a panel repaint should not depend on a
+ * third party being reachable. Nothing is trusted on the strength of it — the
+ * signature is checked by whoever the token is sent to.
+ *
+ * The name and the picture live in `user_metadata`, which is where the site's
+ * auth provider puts whatever the sign-in method knew: a Google sign-in fills
+ * both, an email and password fills neither. Every field is optional here
+ * because every one of them genuinely can be missing.
+ */
+function accountIdentity(token) {
+    const payload = token.split(".")[1];
+    if (!payload)
+        return {};
+    try {
+        const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        const meta = claims.user_metadata ?? {};
+        const text = (value) => typeof value === "string" && value.trim() ? value.trim() : undefined;
+        return {
+            ...(text(claims.email) ? { email: text(claims.email) } : {}),
+            ...(text(meta["full_name"]) ?? text(meta["name"])
+                ? { name: (text(meta["full_name"]) ?? text(meta["name"])) }
+                : {}),
+            // Only over https: this address is handed to an <img> in a page that
+            // holds the session token, and a plaintext one would be a request any
+            // network between here and there could answer.
+            ...(avatarUrl(text(meta["avatar_url"]) ?? text(meta["picture"]))
+                ? { avatar: avatarUrl(text(meta["avatar_url"]) ?? text(meta["picture"])) }
+                : {}),
+        };
+    }
+    catch {
+        // Not a JWT, or not one with a readable payload — an API key stored as an
+        // OAuth credential by some other provider, most likely.
+        return {};
+    }
+}
+/** The address of a picture, if it is one the page may safely be given. */
+function avatarUrl(value) {
+    if (!value)
+        return undefined;
+    try {
+        return new URL(value).protocol === "https:" ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The address on an access token, if it says one. */
+function accountEmail(token) {
+    return accountIdentity(token).email;
+}
+/**
+ * The last page of a sign-in that happened in a browser tab.
+ *
+ * Self-contained: one inline stylesheet, no script, no font and no image
+ * fetched from anywhere. The tab has done its job and the only useful thing it
+ * can say is whether that job worked — but it is also the last thing a new
+ * account sees of us, and a line of unstyled 16px text in the corner of a
+ * white page reads as something that crashed rather than something that
+ * finished. The mark is drawn in SVG for the same reason the icons in the app
+ * are: it is the one asset that cannot fail to load.
+ *
+ * Both outcomes use this. Success is stated plainly and failure keeps the
+ * sentence it was given, in the colour that says which one happened — the tab
+ * is not where anything can be fixed, so it explains rather than offers.
+ */
+/**
+ * One call to the metering gateway, in the shape the caller needs back.
+ *
+ * A failure is a value rather than a throw: everything that calls this is
+ * rendering a screen about money, and "the shop is closed" and "the shop did
+ * not answer" are two different sentences to show a person who cannot pay.
+ */
+async function gatewayJson(path, opts = {}) {
+    const base = officialBaseUrl();
+    let response;
+    try {
+        response = await fetch(`${base}${path}`, {
+            method: opts.body === undefined ? "GET" : "POST",
+            headers: {
+                accept: "application/json",
+                ...(opts.token ? { authorization: `Bearer ${opts.token}` } : {}),
+                ...(opts.body === undefined ? {} : { "content-type": "application/json" }),
+            },
+            ...(opts.body === undefined ? {} : { body: JSON.stringify(opts.body) }),
+        });
+    }
+    catch (err) {
+        return { ok: false, status: 0, error: `could not reach ${base}: ${errorMessage(err)}` };
+    }
+    const text = await response.text();
+    let parsed = {};
+    try {
+        parsed = text ? JSON.parse(text) : {};
+    }
+    catch {
+        // A gateway answering HTML is a gateway behind something that is not the
+        // gateway. The status is still worth reporting; the body is not.
+    }
+    if (!response.ok) {
+        // The gateway nests its failures as { error: { code, message } }; other
+        // things in front of it may not, so both shapes are read.
+        const detail = parsed["error"];
+        const message = detail && typeof detail === "object" && "message" in detail
+            ? String(detail.message)
+            : typeof detail === "string"
+                ? detail
+                : `HTTP ${response.status}`;
+        return { ok: false, status: response.status, error: message };
+    }
+    return { ok: true, value: parsed };
+}
+/**
+ * Whether the browser could be sent back to this address with a session.
+ *
+ * The same question `loopbackTarget` asks on the website, kept deliberately as
+ * strict: the two lists have to agree, and the one that matters is the site's.
+ * A hostname that resolves to loopback but is not spelled as one — a tunnel, a
+ * LAN name pointed here — is refused for exactly the reason the site refuses
+ * it, and the emailed code is what serves that case.
+ */
+function isLoopbackHost(host) {
+    let hostname;
+    try {
+        // The IPv6 literal keeps its brackets in `hostname`, which is what the URL
+        // parser hands back and not what anyone writing this list expects.
+        hostname = new URL(`http://${host}`).hostname;
+    }
+    catch {
+        return false;
+    }
+    return hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "localhost";
+}
+function closeTab(res, status, message) {
+    const escaped = message.replace(/[&<>]/g, (char) => char === "&" ? "&amp;" : char === "<" ? "&lt;" : "&gt;");
+    const ok = status < 400;
+    const page = `<!doctype html><meta charset="utf-8"><title>OHarness</title>` +
+        `<meta name="viewport" content="width=device-width,initial-scale=1">` +
+        `<style>` +
+        `:root{color-scheme:light dark;` +
+        `--bg:#fff;--card:#fff;--fg:#1a1a1a;--dim:#6b7280;--line:#00000012;--mark:#111827;--bad:#b91c1c}` +
+        `@media(prefers-color-scheme:dark){:root{` +
+        `--bg:#0e1013;--card:#15171c;--fg:#e6e6e6;--dim:#8b93a1;--line:#ffffff14;--mark:#e5e7eb;--bad:#f87171}}` +
+        `*{box-sizing:border-box}` +
+        `body{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px;` +
+        `background:var(--bg);color:var(--fg);` +
+        `font:15px/1.6 ui-sans-serif,system-ui,-apple-system,"Segoe UI",Inter,sans-serif;` +
+        `-webkit-font-smoothing:antialiased}` +
+        `main{width:100%;max-width:26rem;padding:28px;border-radius:16px;background:var(--card);` +
+        `border:1px solid var(--line);box-shadow:0 1px 2px #0000000f,0 20px 60px #00000014;text-align:center}` +
+        `svg{width:34px;height:34px;color:var(--mark)}` +
+        `h1{margin:14px 0 0;font-size:16px;font-weight:600;letter-spacing:-.01em}` +
+        `h1.bad{color:var(--bad)}` +
+        `p{margin:8px 0 0;font-size:13px;color:var(--dim)}` +
+        `</style>` +
+        `<body><main>` +
+        `<svg viewBox="0 0 32 32" fill="none" stroke="currentColor" stroke-width="2.2" ` +
+        `stroke-linecap="round" aria-hidden="true">` +
+        `<path d="M20 6h-8a6 6 0 0 0-6 6v8"/><path d="M12 26h8a6 6 0 0 0 6-6v-8"/>` +
+        `<circle cx="16" cy="16" r="3.5" fill="currentColor" stroke="none"/></svg>` +
+        `<h1${ok ? "" : ' class="bad"'}>${escaped}</h1>` +
+        (ok ? `<p>You can close this tab and go back to OHarness.</p>` : "") +
+        `</main>`;
+    res.writeHead(status, {
+        "content-type": "text/html; charset=utf-8",
+        "content-length": Buffer.byteLength(page),
+    });
+    res.end(page);
+}
+/** The extensions a picked file is carried as an image under. */
+const PICKED_IMAGE_TYPES = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+};
+/**
+ * What `/attachment` will hand back to the page.
+ *
+ * Raster only: an `image/svg+xml` block would be a script running on the
+ * frontend's own origin, and the frontend holds the session token.
+ */
+const VIEWABLE_IMAGE_TYPES = new Set([
+    "image/png",
+    "image/jpeg",
+    "image/gif",
+    "image/webp",
+]);
+/** Images are worth a few megabytes; anything larger is a mistake. */
+const MAX_UPLOAD_BYTES = 12 * 1024 * 1024;
+/** How long an unsent upload is kept before the sweep reclaims it. */
+const STAGED_TTL_MS = 30 * 60 * 1000;
+/** The ceiling on everything staged at once, across every tab. */
+const MAX_STAGED_BYTES = 64 * 1024 * 1024;
+/** How much of a text attachment is inlined into the prompt. */
+const MAX_INLINE_CHARS = 200_000;
+async function readBody(req, limit) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        // Checked while reading, not after: buffering the whole body first is
+        // exactly the thing the limit exists to prevent.
+        if (size > limit)
+            throw new Error("request body too large");
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks);
+}
+/**
+ * A prompt carrying attachments.
+ *
+ * Images become image blocks, which every adapter renders into its vendor's
+ * shape. Anything else is inlined as text under its filename — a base64 blob
+ * of a zip would burn context and tell the model nothing.
+ */
+/** Whether a chosen path is a folder; anything unreadable is treated as a file. */
+async function isDirectory(target) {
+    try {
+        return (await stat(target)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+const REFERENCE_KINDS = new Set(["file", "folder", "connector", "plugin"]);
+/** Enough to reference a directory of files, far short of a whole tree. */
+const MAX_REFERENCES = 32;
+/**
+ * References as they arrive from the page.
+ *
+ * A reference ends up as a line inside a block the model reads, so a value
+ * carrying a newline or a closing tag could forge the rest of that block — and
+ * a file name is allowed to contain both. Flattening whitespace and dropping
+ * angle brackets closes that; neither costs anything a real path needs, and
+ * Windows forbids the brackets in a name outright.
+ */
+function readReferences(value) {
+    if (!Array.isArray(value))
+        return [];
+    const seen = new Set();
+    const out = [];
+    for (const item of value) {
+        if (!item || typeof item !== "object")
+            continue;
+        const kind = item["kind"];
+        const raw = item["value"];
+        if (typeof kind !== "string" || !REFERENCE_KINDS.has(kind))
+            continue;
+        if (typeof raw !== "string")
+            continue;
+        const cleaned = raw.replace(/[<>]/g, "").replace(/\s+/g, " ").trim().slice(0, 300);
+        if (!cleaned)
+            continue;
+        const key = `${kind}:${cleaned}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({ kind: kind, value: cleaned });
+        if (out.length >= MAX_REFERENCES)
+            break;
+    }
+    return out;
+}
+function buildMessage(prompt, staged) {
+    const content = [];
+    const notes = [];
+    for (const file of staged) {
+        if (file.mediaType.startsWith("image/")) {
+            content.push({
+                type: "image",
+                mimeType: file.mediaType,
+                data: file.data.toString("base64"),
+            });
+            notes.push(`[image: ${file.name}]`);
+            continue;
+        }
+        const text = file.data.toString("utf8");
+        // A NUL early on means binary, and pasting its bytes into the prompt
+        // wastes context without conveying anything.
+        if (file.data.subarray(0, 8000).includes(0)) {
+            notes.push(`[skipped ${file.name}: binary, ${file.data.byteLength} bytes]`);
+            continue;
+        }
+        const clipped = text.length > MAX_INLINE_CHARS
+            ? `${text.slice(0, MAX_INLINE_CHARS)}\n… truncated`
+            : text;
+        notes.push(`--- ${file.name} ---\n${clipped}`);
+    }
+    const body = [prompt, ...notes].filter(Boolean).join("\n\n");
+    content.unshift({ type: "text", text: body });
+    return [{ role: "user", content }];
+}
+async function readJson(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        // A prompt is text; anything this large is a mistake or an attempt to
+        // exhaust memory, and reading it all first would be the vulnerability.
+        if (size > 1_000_000)
+            throw new Error("request body too large");
+        chunks.push(chunk);
+    }
+    if (!chunks.length)
+        return {};
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    }
+    catch {
+        throw new Error("invalid JSON body");
+    }
+}
+//# sourceMappingURL=server.js.map