@openagt/dashboard 0.0.0-stage → 0.8.0

package/dist/dashboard/static.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.js","sourceRoot":"","sources":["../../src/dashboard/static.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAEhD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEpD,0FAA0F;AAC1F,6DAA6D;AAC7D,wFAAwF;AACxF,iDAAiD;AACjD,sEAAsE;AAEtE,sDAAsD;AACtD,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;AAC5D,CAAC;AAED,iGAAiG;AACjG,SAAS,SAAS,CAAC,QAAgB;IACjC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAW;IAC5F,wFAAwF;IACxF,wFAAwF;IACxF,uFAAuF;IACvF,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,GAAG,CAAA;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC3B,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;IAErE,MAAM,MAAM,GAAG,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IAChG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC1D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;QACpD,GAAG,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAA;QACrC,OAAM;IACR,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACnC,0FAA0F;IAC1F,0FAA0F;IAC1F,2FAA2F;IAC3F,gFAAgF;IAChF,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,UAAU,CAAA;IACvH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC,CAAA;IAC3E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACf,CAAC"}

package/dist/dashboard/subagent-settings.d.ts

@@ -0,0 +1,26 @@
+import { runSubagentsHook } from '../project-hooks.js';
+import { type SubagentSettings } from '../subagent-settings.js';
+import type { ProjectSummary } from './projects.js';
+/** The settings in force, and how many projects have the line that writes them. */
+export interface SubagentSettingsView {
+    settings: SubagentSettings;
+    /** Projects with a `subagents` line; none means Settings can save nothing. */
+    hooked: number;
+}
+/**
+ * The settings of the first project, in registry order, that has the line and a file: Settings
+ * writes every project alike, so they differ only where a file was edited by hand.
+ */
+export declare function readSubagentSettings(projects: readonly ProjectSummary[]): Promise<SubagentSettingsView>;
+/**
+ * Save the settings whole, through the `subagents` line of each project given. Only settings of the
+ * promised shape are passed on. A project without the line is skipped; none having it, or a line
+ * that fails, is the answer's error, each failing project named.
+ */
+export declare function setSubagentSettings(projects: readonly ProjectSummary[], settings: SubagentSettings, run?: typeof runSubagentsHook): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+}>;
+//# sourceMappingURL=subagent-settings.d.ts.map

package/dist/dashboard/subagent-settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subagent-settings.d.ts","sourceRoot":"","sources":["../../src/dashboard/subagent-settings.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAA8C,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC3G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAMnD,mFAAmF;AACnF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgB7G;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,QAAQ,EAAE,gBAAgB,EAC1B,GAAG,GAAE,OAAO,gBAAmC,GAC9C,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAYtD"}

package/dist/dashboard/subagent-settings.js

@@ -0,0 +1,52 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { readProjectHooks, runSubagentsHook } from '../project-hooks.js';
+import { SUBAGENT_SETTINGS_FILE, subagentSettingsIn } from '../subagent-settings.js';
+/**
+ * The settings of the first project, in registry order, that has the line and a file: Settings
+ * writes every project alike, so they differ only where a file was edited by hand.
+ */
+export async function readSubagentSettings(projects) {
+    let settings;
+    let hooked = 0;
+    for (const project of projects) {
+        if ((await readProjectHooks(project.path)).subagents === undefined)
+            continue;
+        hooked++;
+        if (settings !== undefined)
+            continue;
+        const raw = await readFile(join(project.path, SUBAGENT_SETTINGS_FILE), 'utf8').catch(() => undefined);
+        if (raw === undefined)
+            continue;
+        try {
+            settings = subagentSettingsIn(JSON.parse(raw));
+        }
+        catch {
+            // A file that does not parse is no settings: the next project's may say.
+        }
+    }
+    return { settings: settings ?? {}, hooked };
+}
+/**
+ * Save the settings whole, through the `subagents` line of each project given. Only settings of the
+ * promised shape are passed on. A project without the line is skipped; none having it, or a line
+ * that fails, is the answer's error, each failing project named.
+ */
+export async function setSubagentSettings(projects, settings, run = runSubagentsHook) {
+    const clean = subagentSettingsIn(settings);
+    let hooked = 0;
+    const failed = [];
+    for (const project of projects) {
+        const set = await run(project.path, clean);
+        if (set.ok)
+            hooked++;
+        else if (!set.noHook)
+            failed.push(`${project.name}: ${set.error}`);
+    }
+    if (failed.length)
+        return { ok: false, error: failed.join('; ') };
+    if (!hooked)
+        return { ok: false, error: 'no project has a subagents hook in .the-framework/hooks.yml' };
+    return { ok: true };
+}
+//# sourceMappingURL=subagent-settings.js.map

package/dist/dashboard/subagent-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subagent-settings.js","sourceRoot":"","sources":["../../src/dashboard/subagent-settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACxE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAyB,MAAM,yBAAyB,CAAA;AAc3G;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAmC;IAC5E,IAAI,QAAsC,CAAA;IAC1C,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,SAAQ;QAC5E,MAAM,EAAE,CAAA;QACR,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAQ;QACpC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACrG,IAAI,GAAG,KAAK,SAAS;YAAE,SAAQ;QAC/B,IAAI,CAAC;YACH,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,CAAA;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAmC,EACnC,QAA0B,EAC1B,GAAG,GAA4B,gBAAgB;IAE/C,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC1C,IAAI,GAAG,CAAC,EAAE;YAAE,MAAM,EAAE,CAAA;aACf,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;IACjE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6DAA6D,EAAE,CAAA;IACvG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACrB,CAAC"}

package/dist/dashboard/telefunc-serve.d.ts

@@ -0,0 +1,118 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { ProjectsProvider } from './projects.js';
+import type { FrameworkEvent } from '../events.js';
+import type { PreferencesStore } from '../registry.js';
+import type { DiscordCredentialsStore } from '../discord-credentials.js';
+import type { QuotaSource } from './quota.js';
+import type { AutoPmReporter } from '../auto-pm.js';
+import type { AddProjectResult, PreviewResult, PreviewStatus, StartRunKind, StartRunOptions, StartRunResult } from './types.js';
+import type { ServeTarget } from '../preview.js';
+import type { RunMeta } from '../store/index.js';
+/** Wired by the daemon so `sendStart` can reach the daemon's own `startRun` closure. */
+export type StartRunHandler = (prompt: string, kind: StartRunKind, options: StartRunOptions, projectId?: string) => StartRunResult | Promise<StartRunResult>;
+/** Wired by the daemon so `sendAddProject` can install + register a repo (#433). */
+export type AddProjectHandler = (path: string, directory: boolean) => AddProjectResult | Promise<AddProjectResult>;
+/** Wired by the daemon so the Preview RPCs can serve/stop/report a project's app (#475). */
+export interface PreviewHandlers {
+    /** `runId` serves that session's own worktree instead of the project's checkout (#797). */
+    start: (projectId?: string, targetId?: string, runId?: string) => PreviewResult | Promise<PreviewResult>;
+    /** List the servable apps (#651) for the Serve picker in a multi-package repo. */
+    targets: (projectId?: string, runId?: string) => ServeTarget[] | Promise<ServeTarget[]>;
+    stop: (projectId?: string, runId?: string) => void | Promise<void>;
+    status: (projectId?: string, runId?: string) => PreviewStatus | Promise<PreviewStatus>;
+}
+/** Resolve a run to its live event stream: the relay feeds `onEvents` from its own in-memory stream
+ * rather than a file on disk (#426), and the daemon feeds a run it is relaying from a device (#1067).
+ * Returns undefined when there is no in-memory stream, so `onEvents` falls back to tailing the log. */
+export type EventsSource = (projectId: string, runId?: string) => AsyncIterable<FrameworkEvent> | undefined;
+/** Look up the device a relayed run (#1067) executes on, or undefined for an ordinary local run. The
+ *  daemon wires this from its live relayed-run map; a run-scoped RPC uses it to forward a remote run's
+ *  read/steer/handoff to that device instead of resolving a (nonexistent) local checkout. */
+export interface RemoteRuns {
+    target(runId: string | undefined): {
+        url: string;
+        token: string;
+    } | undefined;
+    /** A project's relayed run stubs (#1077), so `onRuns` can show a remote run in the list and re-open it after a reload. */
+    list(projectId: string): RunMeta[];
+}
+/**
+ * The Telefunc request context the mount provides. `sendStart` reads `startRun` from it;
+ * every project-keyed RPC reads `projects` (#427) — the daemon leaves it unset to use the
+ * global registry, the per-run foreground dashboard passes a single-project provider. The
+ * relay passes `eventsSource` (#426) so `onEvents` streams its in-memory run instead of a
+ * file, plus an empty `projects` so the file/registry RPCs return nothing on a public host.
+ */
+export interface DashboardContext {
+    startRun?: StartRunHandler;
+    addProject?: AddProjectHandler;
+    /** The Preview handler set (#475); the daemon wires it, other hosts leave it unset. */
+    preview?: PreviewHandlers;
+    projects?: ProjectsProvider;
+    eventsSource?: EventsSource;
+    /** The relayed-run lookup (#1067 slice 2): only the daemon wires it, so a run-scoped RPC can tell a
+     *  local run from one running on a connected device and forward the call there. */
+    remote?: RemoteRuns;
+    /** The user-preferences store (#410). The daemon/foreground wire the real registry file;
+     * a public host (the relay) leaves it unset so `onPreferences`/`savePreferences` are inert. */
+    preferences?: PreferencesStore;
+    /** The quota source behind the usage panel (#533). The daemon wires a live poller;
+     * a public host (the relay) leaves it unset, so `onQuota` reports it has no reading. */
+    quota?: QuotaSource;
+    /** The Discord credentials store (#1095). The daemon wires one that also reloads its Discord
+     * services on a save; a public host leaves it unset, so nothing there is configurable. */
+    discord?: DiscordCredentialsStore;
+    /** What auto PM last decided (#1161). Only the daemon runs the sweep, so only it wires this. */
+    autoPm?: AutoPmReporter;
+    /**
+     * Run an auto PM sweep now rather than at the next interval (#1210). Same reason `autoPm` is
+     * daemon-only: the loop lives in that process, so nowhere else has one to fire. Resolves when
+     * the sweep does (#1433), so the trigger RPC can await it and return what it decided.
+     */
+    autoPmSweep?: (opts?: {
+        drainOnly?: boolean;
+    }) => void | Promise<void>;
+}
+/**
+ * CSRF guard for the state-changing Telefunc calls. A browser attaches an `Origin`
+ * header to every cross-site request, so we reject any POST whose Origin is not this
+ * same server (or a loopback host) — otherwise a page on `evil.com` could `fetch()` the
+ * localhost dashboard and spawn/steer a run. An absent Origin means a non-browser caller
+ * (curl, the test suite) with no ambient session to abuse, so it passes. Lives here beside
+ * the mount, its only caller.
+ */
+export declare function isSameOriginRequest(req: IncomingMessage): boolean;
+/**
+ * DNS-rebinding guard, the other half of the CSRF check above. A page on `evil.com` whose DNS
+ * re-answers as `127.0.0.1` is *same-origin* with this server as far as the browser is concerned,
+ * so its `fetch()` takes the passing branch of {@link isSameOriginRequest} — and every RPC behind
+ * the mount, `sendStart` included, is reachable from a page the user merely visited.
+ *
+ * The `Host` header is what still gives the attacker away: it carries the name the browser was
+ * asked for (`evil.com`), not the address it resolved to. So when we are bound to loopback, the
+ * only `Host` a real user's browser can send is a loopback one (or the bound address itself) —
+ * anything else is a rebound name and is rejected. An absent `Host` is rejected too when we are
+ * enforcing: HTTP/1.1 requires it, and every browser sends it.
+ *
+ * A non-loopback bind (`--host`, #1051) is reached by a hostname we cannot predict, so there is
+ * no allowlist to check against; that case gates behind the shared daemon token instead. Hosts
+ * that never pass a bind host at all (the relay, which serves a public domain) are unaffected.
+ */
+export declare function isExpectedHost(req: IncomingMessage, boundHost: string | undefined): boolean;
+/**
+ * Mount the dashboard's Telefunc surface (#405) on the daemon's `node:http` server: one
+ * `serve()` handles both the RPCs and the Channel SSE stream at `/_telefunc`. Telefunc
+ * runs in the daemon process, so a `sendStart` telefunction can call the daemon's own
+ * `startRun` via the request context. The `context` is exactly what each telefunction
+ * reaches through {@link getContext} (see {@link DashboardContext}): the daemon wires the
+ * full set, the relay passes only an events source plus an empty projects provider. Cross-
+ * origin POSTs are rejected (CSRF: a page on evil.com must not steer or start a run), as are
+ * requests carrying someone else's `Host` when we are bound to loopback (DNS rebinding: the
+ * same page must not reach us by pointing its own name at `127.0.0.1`). Pass `opts.host` — the
+ * address the server is bound to — to enable that second check; a host serving a public domain
+ * (the relay) leaves it unset. Returns whether the request was Telefunc's.
+ */
+export declare function makeTelefuncMount(context?: DashboardContext, opts?: {
+    host?: string;
+}): (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+//# sourceMappingURL=telefunc-serve.d.ts.map

package/dist/dashboard/telefunc-serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telefunc-serve.d.ts","sourceRoot":"","sources":["../../src/dashboard/telefunc-serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAKhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAA;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC/H,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAEhD,wFAAwF;AACxF,MAAM,MAAM,eAAe,GAAG,CAC5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,eAAe,EACxB,SAAS,CAAC,EAAE,MAAM,KACf,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;AAE7C,oFAAoF;AACpF,MAAM,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,KAAK,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAElH,4FAA4F;AAC5F,MAAM,WAAW,eAAe;IAC9B,2FAA2F;IAC3F,KAAK,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IACxG,kFAAkF;IAClF,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;IACvF,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;CACvF;AAED;;uGAEuG;AACvG,MAAM,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,aAAa,CAAC,cAAc,CAAC,GAAG,SAAS,CAAA;AAE3G;;6FAE6F;AAC7F,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAA;IAC7E,0HAA0H;IAC1H,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,EAAE,CAAA;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,uFAAuF;IACvF,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B;uFACmF;IACnF,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB;mGAC+F;IAC/F,WAAW,CAAC,EAAE,gBAAgB,CAAA;IAC9B;4FACwF;IACxF,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB;8FAC0F;IAC1F,OAAO,CAAC,EAAE,uBAAuB,CAAA;IACjC,gGAAgG;IAChG,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvE;AAiBD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAYjE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAM3F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,GAAE,gBAAqB,EAC9B,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3B,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CA4BjE"}

package/dist/dashboard/telefunc-serve.js

@@ -0,0 +1,108 @@
+import { config } from 'telefunc';
+import { Telefunc } from 'telefunc/node';
+import { hostnameFromHostHeader, isLoopbackHost } from '../loopback-host.js';
+import { registerDashboardTelefunctions } from '../dashboard-rpc/register.js';
+let instance;
+function setup() {
+    if (instance)
+        return instance;
+    config.shield = { dev: false, prod: false };
+    config.disableNamingConvention = true;
+    registerDashboardTelefunctions();
+    instance = new Telefunc();
+    return instance;
+}
+/**
+ * CSRF guard for the state-changing Telefunc calls. A browser attaches an `Origin`
+ * header to every cross-site request, so we reject any POST whose Origin is not this
+ * same server (or a loopback host) — otherwise a page on `evil.com` could `fetch()` the
+ * localhost dashboard and spawn/steer a run. An absent Origin means a non-browser caller
+ * (curl, the test suite) with no ambient session to abuse, so it passes. Lives here beside
+ * the mount, its only caller.
+ */
+export function isSameOriginRequest(req) {
+    const origin = req.headers.origin;
+    if (!origin)
+        return true;
+    const host = req.headers.host;
+    if (host && (origin === `http://${host}` || origin === `https://${host}`))
+        return true;
+    let hostname;
+    try {
+        hostname = new URL(origin).hostname;
+    }
+    catch {
+        return false; // malformed Origin: treat as cross-origin
+    }
+    return isLoopbackHost(hostname);
+}
+/**
+ * DNS-rebinding guard, the other half of the CSRF check above. A page on `evil.com` whose DNS
+ * re-answers as `127.0.0.1` is *same-origin* with this server as far as the browser is concerned,
+ * so its `fetch()` takes the passing branch of {@link isSameOriginRequest} — and every RPC behind
+ * the mount, `sendStart` included, is reachable from a page the user merely visited.
+ *
+ * The `Host` header is what still gives the attacker away: it carries the name the browser was
+ * asked for (`evil.com`), not the address it resolved to. So when we are bound to loopback, the
+ * only `Host` a real user's browser can send is a loopback one (or the bound address itself) —
+ * anything else is a rebound name and is rejected. An absent `Host` is rejected too when we are
+ * enforcing: HTTP/1.1 requires it, and every browser sends it.
+ *
+ * A non-loopback bind (`--host`, #1051) is reached by a hostname we cannot predict, so there is
+ * no allowlist to check against; that case gates behind the shared daemon token instead. Hosts
+ * that never pass a bind host at all (the relay, which serves a public domain) are unaffected.
+ */
+export function isExpectedHost(req, boundHost) {
+    if (boundHost === undefined || !isLoopbackHost(boundHost))
+        return true;
+    const header = req.headers.host;
+    if (!header)
+        return false;
+    const hostname = hostnameFromHostHeader(header);
+    return isLoopbackHost(hostname) || hostname === boundHost;
+}
+/**
+ * Mount the dashboard's Telefunc surface (#405) on the daemon's `node:http` server: one
+ * `serve()` handles both the RPCs and the Channel SSE stream at `/_telefunc`. Telefunc
+ * runs in the daemon process, so a `sendStart` telefunction can call the daemon's own
+ * `startRun` via the request context. The `context` is exactly what each telefunction
+ * reaches through {@link getContext} (see {@link DashboardContext}): the daemon wires the
+ * full set, the relay passes only an events source plus an empty projects provider. Cross-
+ * origin POSTs are rejected (CSRF: a page on evil.com must not steer or start a run), as are
+ * requests carrying someone else's `Host` when we are bound to loopback (DNS rebinding: the
+ * same page must not reach us by pointing its own name at `127.0.0.1`). Pass `opts.host` — the
+ * address the server is bound to — to enable that second check; a host serving a public domain
+ * (the relay) leaves it unset. Returns whether the request was Telefunc's.
+ */
+export function makeTelefuncMount(context = {}, opts = {}) {
+    return async (req, res) => {
+        if (!isSameOriginRequest(req)) {
+            res.writeHead(403, { 'content-type': 'text/plain' });
+            res.end('cross-origin request forbidden');
+            return true;
+        }
+        if (!isExpectedHost(req, opts.host)) {
+            res.writeHead(403, { 'content-type': 'text/plain' });
+            res.end('unexpected Host header');
+            return true;
+        }
+        const tf = setup();
+        // Never let a telefunc failure become an unhandled rejection that kills the daemon:
+        // telefunc 0.2.22 throws on a bare `GET /_telefunc` (it passes the request as a body,
+        // which `new Request()` rejects for GET), and a browser tab hits that on reconnect.
+        try {
+            return await tf.serve({ req, res, context: context });
+        }
+        catch {
+            if (!res.headersSent) {
+                res.writeHead(400, { 'content-type': 'text/plain' });
+                res.end('bad telefunc request');
+            }
+            else {
+                res.end();
+            }
+            return true;
+        }
+    };
+}
+//# sourceMappingURL=telefunc-serve.js.map

package/dist/dashboard/telefunc-serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telefunc-serve.js","sourceRoot":"","sources":["../../src/dashboard/telefunc-serve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAA;AAkF7E,IAAI,QAA8B,CAAA;AAElC,SAAS,KAAK;IACZ,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAK5B;IAAC,MAA+B,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CACrE;IAAC,MAAgD,CAAC,uBAAuB,GAAG,IAAI,CAAA;IACjF,8BAA8B,EAAE,CAAA;IAChC,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAA;IACzB,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAoB;IACtD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAA;IACjC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAA;IAC7B,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,EAAE,IAAI,MAAM,KAAK,WAAW,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAA;IACtF,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA,CAAC,0CAA0C;IACzD,CAAC;IACD,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAAC,GAAoB,EAAE,SAA6B;IAChF,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAA;IACtE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAA;IAC/B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAC/C,OAAO,cAAc,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,SAAS,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAA4B,EAAE,EAC9B,OAA0B,EAAE;IAE5B,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;YACzC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;YACjC,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;QAClB,oFAAoF;QACpF,sFAAsF;QACtF,oFAAoF;QACpF,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAgB,EAAE,CAAC,CAAA;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;gBACpD,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,EAAE,CAAA;YACX,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/dashboard/tickets.d.ts

@@ -0,0 +1,29 @@
+import { type Ticket, type TicketDetail, type TicketsMeta } from '@gemstack/skill-tickets';
+export type { TicketsMeta, TicketGithubLink } from '@gemstack/skill-tickets';
+/**
+ * A ticket as the dashboard shows it: the `tickets` skill's row, with the holder of its claim
+ * resolved against this project's own agents (#1748). A lock names an agent id — the same id
+ * the agent's checkout is named with — so a claim the daemon minted, or an agent on this machine
+ * made with the `tickets` command, resolves to the agent's page and its session name; a holder
+ * this project has no record of (another machine's agent, a cloud session's branch name) is
+ * shown as written.
+ */
+export interface WorkspaceTicket extends Ticket {
+    /** The agent whose id the lock names, when it is one of this project's: its id and, once named, its session name. */
+    lockedByAgent?: {
+        id: string;
+        name?: string;
+    };
+}
+/** One ticket with its entire markdown, for its own page. */
+export interface WorkspaceTicketDetail extends WorkspaceTicket, TicketDetail {
+}
+/** The project's tickets, off the skill's checkout under `.branches/agent-data`, holders resolved. */
+export declare function readTickets(cwd: string): Promise<WorkspaceTicket[]>;
+/** One ticket by filename, full text included; `null` when there is no such ticket. */
+export declare function readTicket(cwd: string, file: string): Promise<WorkspaceTicketDetail | null>;
+/** Whether the project has any ticket at all (#958): a listing, for the onboarding checklist's poll. */
+export declare function hasTickets(cwd: string): Promise<boolean>;
+/** When the tickets last caught up with GitHub (#1208), or `{}` when nothing has recorded it. */
+export declare function readTicketsMeta(cwd: string): Promise<TicketsMeta>;
+//# sourceMappingURL=tickets.d.ts.map

package/dist/dashboard/tickets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tickets.d.ts","sourceRoot":"","sources":["../../src/dashboard/tickets.ts"],"names":[],"mappings":"AACA,OAAO,EAAsH,KAAK,MAAM,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAG9M,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE5E;;;;;;;GAOG;AACH,MAAM,WAAW,eAAgB,SAAQ,MAAM;IAC7C,qHAAqH;IACrH,aAAa,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC9C;AAED,6DAA6D;AAC7D,MAAM,WAAW,qBAAsB,SAAQ,eAAe,EAAE,YAAY;CAAG;AAE/E,sGAAsG;AACtG,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAGzE;AAED,uFAAuF;AACvF,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAKjG;AAED,wGAAwG;AACxG,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE9D;AAED,iGAAiG;AACjG,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAEvE"}

package/dist/dashboard/tickets.js

@@ -0,0 +1,38 @@
+import { sessionNameOf } from '@gemstack/skill-branches/branch-names';
+import { hasTickets as ticketsExist, readTicket as readOne, readTickets as readAll, readTicketsMeta as readMeta, ticketsDir } from '@gemstack/skill-tickets';
+import { readAllAgents } from '../store/index.js';
+/** The project's tickets, off the skill's checkout under `.branches/agent-data`, holders resolved. */
+export async function readTickets(cwd) {
+    const tickets = await readAll(ticketsDir(cwd));
+    return resolveHolders(cwd, tickets);
+}
+/** One ticket by filename, full text included; `null` when there is no such ticket. */
+export async function readTicket(cwd, file) {
+    const ticket = await readOne(ticketsDir(cwd), file);
+    if (!ticket)
+        return null;
+    const [resolved] = await resolveHolders(cwd, [ticket]);
+    return resolved;
+}
+/** Whether the project has any ticket at all (#958): a listing, for the onboarding checklist's poll. */
+export async function hasTickets(cwd) {
+    return ticketsExist(ticketsDir(cwd));
+}
+/** When the tickets last caught up with GitHub (#1208), or `{}` when nothing has recorded it. */
+export async function readTicketsMeta(cwd) {
+    return readMeta(ticketsDir(cwd));
+}
+/** The holder of every locked ticket looked up once against the project's records. */
+async function resolveHolders(cwd, tickets) {
+    if (!tickets.some(ticket => ticket.lockedBy !== undefined))
+        return tickets;
+    const agents = await readAllAgents(cwd).catch(() => []);
+    return tickets.map(ticket => {
+        const agent = ticket.lockedBy === undefined ? undefined : agents.find(a => a.id === ticket.lockedBy);
+        if (!agent)
+            return ticket;
+        const name = sessionNameOf(agent.branch, agent.id);
+        return { ...ticket, lockedByAgent: { id: agent.id, ...(name ? { name } : {}) } };
+    });
+}
+//# sourceMappingURL=tickets.js.map

package/dist/dashboard/tickets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tickets.js","sourceRoot":"","sources":["../../src/dashboard/tickets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAA;AACrE,OAAO,EAAE,UAAU,IAAI,YAAY,EAAE,UAAU,IAAI,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,eAAe,IAAI,QAAQ,EAAE,UAAU,EAAoD,MAAM,yBAAyB,CAAA;AAC9M,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAoBjD,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC9C,OAAO,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AACrC,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,IAAY;IACxD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAA;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IACtD,OAAO,QAAiC,CAAA;AAC1C,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,OAAO,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AACtC,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW;IAC/C,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AAClC,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,cAAc,CAAmB,GAAW,EAAE,OAAY;IACvE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC;QAAE,OAAO,OAAO,CAAA;IAC1E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAA;QACpG,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAA;QACzB,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;QAClD,OAAO,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAA;IAClF,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/dashboard/types.d.ts

@@ -0,0 +1,109 @@
+import type { LinkedPr } from './pull-requests.js';
+import type { PublishPick } from '../publish-levels.js';
+/** The outcome of removing a retained worktree (#737). */
+export type RemoveWorktreeResult = {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};
+/** The outcome of deleting a session — its records and worktree (#1032). */
+export type DeleteAgentResult = {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};
+/** The outcome of an add-project attempt (#396): registered, or was already, or why not. */
+export type AddProjectResult = {
+    ok: true;
+    alreadyActivated: boolean;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * What the Onboarding checklist (#958) needs and no other read carries: the server's own
+ * working directory, offered as the one-click first project.
+ *
+ * Both fields are null where adding projects is not wired (the relay), so a public host
+ * never discloses its filesystem layout.
+ */
+export interface OnboardingSuggestion {
+    /** The server's working directory, or null when it cannot be offered. */
+    cwd: string | null;
+    /** The project id for {@link cwd} when it is already registered, else null. */
+    cwdProjectId: string | null;
+}
+/**
+ * What a Start carries besides its prompt (#1774): the person's picks, handed to the project's
+ * `start` hook line as `DRIVER`, `MODEL`, `PUBLISH` and `BASE`. Absent leaves each to the tool the line names.
+ */
+export interface StartAgentOptions {
+    /** The model to run on. */
+    model?: string;
+    /** Which coding agent the run is on: `claude-code` or `codex`. */
+    driver?: string;
+    /** The person's saved pick of how far the run takes its work when the agent finishes. Absent, none is saved: the daemon starts the run as far as the project goes with no pull request. A pick the project is not offered is held to that too. */
+    publish?: PublishPick;
+    /**
+     * The branch the agent's own branch starts from, as this machine has it, commits that are not
+     * pushed included: the launcher's "My local branch" pick. Absent, origin's default branch. A
+     * word that is no branch name refuses the Start. Not sent to a device: its branches are its own.
+     */
+    base?: string;
+    /**
+     * The follow-up's prompt: once the run ends done with a pull request, a fresh agent works its
+     * branch from it before the request merges. The launcher's "Post-merge cleanup" box.
+     */
+    then?: string;
+    /**
+     * Run this session on a connected device (#1067): the local daemon relays the start to the remote
+     * daemon at `url` (authenticating with `token` as the `fw_daemon` cookie) and streams its events
+     * back into the local agent view. The device `label` rides along (memory-only, like `url`/`token`) so
+     * the local session list + notice can show which device the agent is on after a reload (#1077).
+     * Memory-only relay config the dashboard sets at submit time from a saved device. NEVER persisted to
+     * Preferences or the registry: a device token is a per-browser secret. Absent = run locally.
+     * Stripped before the start is forwarded, so the remote starts an ordinary local run and does not
+     * relay onward.
+     */
+    remote?: {
+        url: string;
+        token: string;
+        label?: string;
+    };
+}
+/** The outcome of a Start attempt (#345): the id of the run the project's start hook began, or why there is none. */
+export type StartAgentResult = {
+    ok: true;
+    agentId: string;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Where a session is working (#798): its checkout, its branch, and what it is holding. Read by
+ * the dashboard so a session's action bar can say which worktree it has, rather than leaving the
+ * user to infer it from an agent id.
+ *
+ * Only what is true of the run: once its checkout is gone there is no tree to be clean or dirty,
+ * so {@link checkout} is absent and the branch is the one the run recorded.
+ */
+export interface AgentWorktree {
+    /** The run's own checkout while it exists. */
+    checkout?: {
+        /** Absolute path of the checkout. */
+        path: string;
+        /** Uncommitted changes present in it. */
+        dirty: boolean;
+        /** Size on disk, bytes. Only read once nothing is writing to it, and best-effort even then. */
+        sizeBytes?: number;
+    };
+    /** The branch the run's work is on: its checkout's while it has one, else the one it recorded. */
+    branch?: string;
+    /** The PR opened for this run's branch (#809), when there is one. */
+    pr?: LinkedPr;
+    /** The PR is not known yet, rather than absent (#1028): the lookup is still running. */
+    prPending?: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/dashboard/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/dashboard/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAMvD,0DAA0D;AAC1D,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9E,4EAA4E;AAC5E,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3E,4FAA4F;AAC5F,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEhC;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,kPAAkP;IAClP,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACxD;AAED,qHAAqH;AACrH,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3F;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,QAAQ,CAAC,EAAE;QACT,qCAAqC;QACrC,IAAI,EAAE,MAAM,CAAA;QACZ,yCAAyC;QACzC,KAAK,EAAE,OAAO,CAAA;QACd,+FAA+F;QAC/F,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD,kGAAkG;IAClG,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,EAAE,CAAC,EAAE,QAAQ,CAAA;IACb,wFAAwF;IACxF,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB"}

package/dist/dashboard/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/dashboard/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/dashboard/types.ts"],"names":[],"mappings":""}

package/dist/dashboard/web-start-endpoints.d.ts

@@ -0,0 +1,32 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { BridgeStartInput, BridgeStartRequest } from './bridge-starts.js';
+/**
+ * The run-facing side of the session start-queue (#1328): how a web run asks the daemon for a
+ * cloud session created by the browser extension, and learns what it became.
+ *
+ * A run is a separate process the daemon never started, so it cannot touch the daemon's queue
+ * directly; it reaches these routes at the URL it finds in its environment
+ * ({@link DAEMON_URL_ENV}), presenting the daemon token it reads from the registry. The
+ * extension's own side of the same queue lives on `/_bridge/start` and `/_bridge/started`.
+ *
+ * Nothing sets {@link DAEMON_URL_ENV} today (#1774): web runs left the launcher when the daemon
+ * stopped running agents, so the only caller of these routes is gone until web runs return, and
+ * then whatever line a project's start hook names will have to carry the URL. The extension's
+ * side of the queue is live either way, which is why these routes stay.
+ */
+export declare const WEB_START_PREFIX = "/_web-start";
+/** The environment variable a run finds its daemon's URL in. */
+export declare const DAEMON_URL_ENV = "TF_DAEMON_URL";
+/** What the daemon wires behind the routes. Absent when the bridge is off, which 404s them. */
+export interface WebStartHandlers {
+    /** The daemon token every call must present — the same one the extension holds. */
+    token: string;
+    /** Whether an extension has spoken to this daemon recently enough to be trusted with a request. */
+    extensionAlive: () => boolean;
+    /** Queue a request, or say what is wrong with it. */
+    request: (input: BridgeStartInput) => BridgeStartRequest | string;
+    get: (id: string) => BridgeStartRequest | undefined;
+}
+/** Route a `/_web-start*` request. */
+export declare function handleWebStartRequest(req: IncomingMessage, res: ServerResponse, pathname: string, handlers: WebStartHandlers | undefined): Promise<void>;
+//# sourceMappingURL=web-start-endpoints.d.ts.map

package/dist/dashboard/web-start-endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-start-endpoints.d.ts","sourceRoot":"","sources":["../../src/dashboard/web-start-endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAGhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE9E;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAE7C,gEAAgE;AAChE,eAAO,MAAM,cAAc,kBAAkB,CAAA;AAE7C,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAA;IACb,mGAAmG;IACnG,cAAc,EAAE,MAAM,OAAO,CAAA;IAC7B,qDAAqD;IACrD,OAAO,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,kBAAkB,GAAG,MAAM,CAAA;IACjE,GAAG,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS,CAAA;CACpD;AAKD,sCAAsC;AACtC,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC,OAAO,CAAC,IAAI,CAAC,CAOf"}