@openagt/dashboard 0.0.0-stage → 0.9.0

package/dist/dashboard/server.d.ts

@@ -0,0 +1,105 @@
+import type { PreferencesStore } from '../registry.js';
+import type { QuotaSource } from './quota.js';
+import type { ModelsSource } from './models.js';
+import type { ProjectErrorsReader } from '../project-errors.js';
+import type { BridgeBrowserOwner } from '../bridge-browser.js';
+import type { AddProjectResult, RemoveProjectResult, StartAgentOptions, StartAgentResult } from './types.js';
+import type { EventsSource, RemoteAgents } from './rpc-serve.js';
+/** Options for {@link startDashboard}. */
+export interface DashboardOptions {
+    /** Port to bind. Default `4200`; pass `0` for an ephemeral port. */
+    port?: number;
+    /** Host to bind. Default `127.0.0.1` (localhost only). */
+    host?: string;
+    /**
+     * Called when the browser starts a run (#345): the `sendStart` RPC reaches this through the
+     * wired dashboard context. Wire it to the project's start hook.
+     */
+    onStart: (prompt: string, options: StartAgentOptions, projectId?: string) => StartAgentResult | Promise<StartAgentResult>;
+    /**
+     * Called when the browser adds a project (#396): the `sendAddProject` RPC reaches this through
+     * the wired dashboard context. Wire it to install the repo and register it.
+     */
+    onAddProject: (path: string, share: boolean) => Promise<AddProjectResult> | AddProjectResult;
+    /** Called when the browser removes a project: the `sendRemoveProject` RPC reaches this through the wired dashboard context. */
+    onRemoveProject: (projectId: string, files: boolean) => Promise<RemoveProjectResult> | RemoveProjectResult;
+    /**
+     * The user-preferences store (#410): the `onPreferences` / `savePreferences` RPCs read and
+     * write it through the wired dashboard context.
+     */
+    preferences: PreferencesStore;
+    /** Where the usage panel reads the quota from (#533). */
+    quota: QuotaSource;
+    /** Which models each coding agent offers, for the agent and model menu. */
+    models: ModelsSource;
+    /** What a project currently suffers from (#1500), for the project list to carry. */
+    projectErrors: ProjectErrorsReader;
+    /** The daemon's own bridge browser (#1332): its status, and the show/hide/restart the settings page asks for. */
+    bridgeBrowser: BridgeBrowserOwner;
+    /**
+     * Serve the new dashboard bundle (#405) from this directory — the built SPA
+     * (`index.html` + `assets/**`). The daemon also mounts the dashboard's RPC surface
+     * at `/_rpc` (the calls + the live-event stream). Omit only for a broken install with
+     * no built bundle, where the server reports the bundle is missing.
+     */
+    clientBundleDir?: string;
+    /**
+     * The shared token that guards a non-loopback bind (#1051): with it set, every route (static
+     * bundle, `/_rpc`, `/_relay`) needs a valid `oa_daemon` cookie or a matching
+     * `?token=`, else 401. Omit for a loopback bind, where the guard is a no-op and local UX is
+     * byte-identical. A separate concern from the CSRF origin check in rpc-serve.ts.
+     */
+    token?: string;
+    /**
+     * The live-events source for a run this daemon is relaying from a connected device (#1067):
+     * a stream for such a run, else undefined so `onEvents` tails the run's diary off disk.
+     */
+    eventsSource: EventsSource;
+    /**
+     * The relayed-agent lookup the read RPCs consult (#1067 slice 2). A run-scoped RPC uses it to
+     * forward a remote agent's read/steer/handoff to the device that owns it.
+     */
+    remote: RemoteAgents;
+    /**
+     * Serve a relay-started run's events back to the daemon that relayed it here (#1067): the
+     * `/_relay/*` endpoints (start + events, plus the slice-2 `rpc`). All are fronted by the same
+     * `token` guard above, so a device without the cookie cannot start or read a run.
+     */
+    relay?: {
+        tailEvents: (agentId: string, onEvent: (event: import('../events.js').OpenAgentEvent) => void) => () => void;
+        /** Run one whitelisted run-scoped RPC against this daemon's own checkout (#1067 slice 2). */
+        rpc?: (fn: string, args: unknown[]) => Promise<unknown>;
+    };
+    /**
+     * The browser bridge (#1237): the token a Claude web extension presents to report the question
+     * its cloud session is parked on. Absent leaves every `/_bridge/*` route 404, which is default.
+     *
+     * Deliberately not {@link token}. That one guards a non-loopback bind and is absent on a normal
+     * loopback daemon, where what keeps other origins out of `/_rpc` is the same-origin check.
+     * The bridge is the one route meant to be reached from another origin, so neither protects it
+     * and it authenticates on its own.
+     */
+    bridgeToken?: string;
+    /**
+     * The cloud sessions the browser bridge should have a tab open for (#1237). Only the daemon
+     * wires one, since it is the process that can see every project's runs.
+     */
+    bridgeSessions?: () => Promise<import('./bridge-endpoints.js').BridgeSession[]>;
+}
+/** A running localhost dashboard: the built SPA + its RPC mount. */
+export interface Dashboard {
+    /** The URL to open. */
+    readonly url: string;
+    /** Stop the server. Idempotent. */
+    close(): Promise<void>;
+}
+/**
+ * Start the localhost dashboard: a tiny `node:http` server that serves the built SPA (#405) and
+ * mounts its RPC surface at `/_rpc` — the calls and the live-event stream. The dashboard reads a
+ * run's own diary over that stream and steers the run through the files its tool reads, so there is
+ * no in-process event stream here; the server is a static-bundle + RPC host. The RPCs run in the
+ * daemon's own process, so `sendStart` / `sendAddProject` call the daemon's own closures via
+ * {@link DashboardOptions.onStart} / {@link DashboardOptions.onAddProject}.
+ */
+export declare function startDashboard(opts: DashboardOptions): Promise<Dashboard>;
+//# sourceMappingURL=server.d.ts.map

package/dist/dashboard/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/dashboard/server.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAK9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC5G,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAOhE,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,OAAO,EAAE,CACP,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,iBAAiB,EAC1B,SAAS,CAAC,EAAE,MAAM,KACf,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACjD;;;OAGG;IACH,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAA;IAC5F,+HAA+H;IAC/H,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAA;IAC1G;;;OAGG;IACH,WAAW,EAAE,gBAAgB,CAAA;IAC7B,yDAAyD;IACzD,KAAK,EAAE,WAAW,CAAA;IAClB,2EAA2E;IAC3E,MAAM,EAAE,YAAY,CAAA;IACpB,oFAAoF;IACpF,aAAa,EAAE,mBAAmB,CAAA;IAClC,iHAAiH;IACjH,aAAa,EAAE,kBAAkB,CAAA;IACjC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,YAAY,EAAE,YAAY,CAAA;IAC1B;;;OAGG;IACH,MAAM,EAAE,YAAY,CAAA;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,cAAc,EAAE,cAAc,KAAK,IAAI,KAAK,MAAM,IAAI,CAAA;QAC5G,6FAA6F;QAC7F,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;KACxD,CAAA;IACD;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,uBAAuB,EAAE,aAAa,EAAE,CAAC,CAAA;CAChF;AAED,oEAAoE;AACpE,MAAM,WAAW,SAAS;IACxB,uBAAuB;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,mCAAmC;IACnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CAwIzE"}

package/dist/dashboard/server.js

@@ -0,0 +1,231 @@
+import { createServer } from 'node:http';
+import { timingSafeEqual } from 'node:crypto';
+import { serveClientBundle } from './static.js';
+import { makeRpcMount, RPC_PREFIX, isSameOriginRequest, isExpectedHost } from './rpc-serve.js';
+import { requestPathname } from '../request-path.js';
+import { MODULES_PREFIX, serveModuleFile } from './module-serve.js';
+import { handleRelayRequest, RELAY_PREFIX } from './relay-endpoints.js';
+import { BRIDGE_PREFIX, EXPECTED_EXTENSION_VERSION, handleBridgeRequest } from './bridge-endpoints.js';
+import { bridgeQuestions } from './bridge-store.js';
+import { bridgeStarts } from './bridge-starts.js';
+import { WEB_START_PREFIX, handleWebStartRequest } from './web-start-endpoints.js';
+/**
+ * Start the localhost dashboard: a tiny `node:http` server that serves the built SPA (#405) and
+ * mounts its RPC surface at `/_rpc` — the calls and the live-event stream. The dashboard reads a
+ * run's own diary over that stream and steers the run through the files its tool reads, so there is
+ * no in-process event stream here; the server is a static-bundle + RPC host. The RPCs run in the
+ * daemon's own process, so `sendStart` / `sendAddProject` call the daemon's own closures via
+ * {@link DashboardOptions.onStart} / {@link DashboardOptions.onAddProject}.
+ */
+export function startDashboard(opts) {
+    const host = opts.host ?? '127.0.0.1';
+    const port = opts.port ?? 4200;
+    const clientBundleDir = opts.clientBundleDir;
+    // A broken install ships no built bundle (the published package always does), so serve
+    // 503 for everything rather than stand up a half-wired mount. Returning here lets the
+    // main path below treat the bundle, mount, and quota as present with no re-checks.
+    if (!clientBundleDir) {
+        const server = createServer((_req, res) => {
+            res.writeHead(503, { 'content-type': 'text/plain' });
+            res.end('the dashboard bundle is not installed');
+        });
+        return listenDashboard(server, host, port, () => closeServer(server));
+    }
+    // The usage panel polls for the dashboard's whole life, not just during an agent:
+    // it has to show where the account stands while nothing is running (#533).
+    const quota = opts.quota;
+    const rpcMount = makeRpcMount({
+        startAgent: opts.onStart,
+        addProject: opts.onAddProject,
+        removeProject: opts.onRemoveProject,
+        eventsSource: opts.eventsSource,
+        remote: opts.remote,
+        preferences: opts.preferences,
+        projectErrors: opts.projectErrors,
+        bridgeBrowser: opts.bridgeBrowser,
+        quota,
+        models: opts.models,
+    }, 
+    // The bound host, so the mount can reject a rebound `Host`: a page on evil.com whose DNS
+    // answers 127.0.0.1 is same-origin to the browser, so the Origin check alone lets it in.
+    { host });
+    // The device-to-daemon relay endpoints (#1067): wired only when an events tail is supplied.
+    // Fronted by the same token guard as every other route below.
+    const relayHandlers = opts.relay
+        ? { start: opts.onStart, tailEvents: opts.relay.tailEvents, ...(opts.relay.rpc ? { rpc: opts.relay.rpc } : {}) }
+        : undefined;
+    // The browser bridge (#1237). Off unless a token was supplied, and it carries that token itself
+    // rather than riding the shared-token guard (#1051), which a loopback daemon does not have.
+    const bridgeHandlers = opts.bridgeToken
+        ? {
+            token: opts.bridgeToken,
+            // The version gate (#1519): a stale extension is refused loudly rather than half-working.
+            expectedExtensionVersion: EXPECTED_EXTENSION_VERSION,
+            extensionVersion: (got, blocked) => bridgeQuestions().recordVersion(got, EXPECTED_EXTENSION_VERSION, blocked),
+            record: question => bridgeQuestions().record(question),
+            contact: (route, status) => bridgeQuestions().recordContact(route, status),
+            recordEvent: event => bridgeQuestions().recordEvent(event),
+            hello: hello => bridgeQuestions().recordHello(hello),
+            statuses: statuses => {
+                for (const status of statuses)
+                    bridgeQuestions().recordStatus(status);
+            },
+            // Claimed on read (#1332), like a start: two Drivers asking must not both type it.
+            answer: sessionId => {
+                const pending = bridgeQuestions().claimAnswer(sessionId);
+                return pending ? { id: pending.id, text: pending.text } : undefined;
+            },
+            answered: (sessionId, id, ok, note) => bridgeQuestions().resolveAnswer(sessionId, id, ok, note),
+            // The session start-queue (#1328). The claim happens inside claimNext, not in the route:
+            // two polling tabs handed the same request would create two cloud sessions.
+            start: () => {
+                const next = bridgeStarts().claimNext();
+                return next ? { id: next.id, repo: next.repo, branch: next.branch, prompt: next.prompt, ...(next.model ? { model: next.model } : {}) } : undefined;
+            },
+            started: (id, ok, sessionId, note) => bridgeStarts().resolve(id, ok, sessionId, note),
+            ...(opts.bridgeSessions ? { sessions: opts.bridgeSessions } : {}),
+        }
+        : undefined;
+    // The run-facing side of the same queue (#1328): a spawned web run asks here, on the same token.
+    const webStartHandlers = opts.bridgeToken
+        ? {
+            token: opts.bridgeToken,
+            extensionAlive: () => bridgeQuestions().extensionAlive(),
+            request: input => bridgeStarts().request(input),
+            get: id => bridgeStarts().get(id),
+        }
+        : undefined;
+    const token = opts.token;
+    const server = createServer((req, res) => {
+        const pathname = requestPathname(req);
+        if (pathname === undefined) {
+            res.writeHead(400, { 'content-type': 'text/plain' }).end('bad request');
+            return;
+        }
+        // The browser bridge (#1237) is checked BEFORE the shared-token guard (#1051), and is the only route that is.
+        // That guard's browser affordance is a `?token=` redirect meant for a human following a link,
+        // which is meaningless to an extension posting JSON; the bridge presents its own bearer token
+        // instead, so letting it past here costs nothing and skips a 302 it could not follow.
+        if (pathname === BRIDGE_PREFIX || pathname.startsWith(`${BRIDGE_PREFIX}/`)) {
+            void handleBridgeRequest(req, res, pathname, bridgeHandlers);
+            return;
+        }
+        if (pathname === WEB_START_PREFIX || pathname.startsWith(`${WEB_START_PREFIX}/`)) {
+            void handleWebStartRequest(req, res, pathname, webStartHandlers);
+            return;
+        }
+        // #1051: one guard fronting every route on a non-loopback bind; a no-op when no token is set.
+        if (token !== undefined && !authorizeDaemonRequest(req, res, token))
+            return;
+        // The device relay (#1067): another daemon posts a start here and streams the run's events back.
+        // The token guard above is a no-op on a loopback bind, so — exactly like the RPC mount below —
+        // the relay carries its own CSRF + DNS-rebinding guard, or a page the user merely visited could
+        // POST /_relay/start to start a run (the real device caller sends no Origin and a loopback
+        // Host, so both checks pass it; only a browser's cross-origin/rebound request is turned away).
+        if (pathname === RELAY_PREFIX || pathname.startsWith(`${RELAY_PREFIX}/`)) {
+            if (!guardBrowserOrigin(req, res, host))
+                return;
+            void handleRelayRequest(req, res, pathname, relayHandlers);
+            return;
+        }
+        if (pathname === RPC_PREFIX || pathname.startsWith(`${RPC_PREFIX}/`)) {
+            void rpcMount(req, res);
+            return;
+        }
+        // A project's dashboard modules (#1774): only the files of a package the project brings as a module.
+        if (pathname.startsWith(`${MODULES_PREFIX}/`)) {
+            // Void-dispatched like the bundle: a throw here must answer, not take the daemon down (#938).
+            void serveModuleFile(req, res, pathname).catch(() => {
+                if (!res.headersSent)
+                    res.writeHead(500, { 'content-type': 'text/plain' }).end('module file unreadable');
+            });
+            return;
+        }
+        void serveClientBundle(req, res, clientBundleDir);
+    });
+    return listenDashboard(server, host, port, async () => {
+        // Stop polling with the server: the poller outlives every agent by design,
+        // so nothing else would ever end it.
+        quota.stop();
+        await closeServer(server);
+    });
+}
+/** Bind the server and resolve a {@link Dashboard} handle; rejects if the port is already taken. */
+function listenDashboard(server, host, port, close) {
+    return new Promise((resolvePromise, rejectPromise) => {
+        server.once('error', rejectPromise);
+        server.listen(port, host, () => {
+            server.removeListener('error', rejectPromise);
+            const address = server.address();
+            resolvePromise({ url: `http://${host}:${address.port}`, close });
+        });
+    });
+}
+function closeServer(server) {
+    // Force-close keep-alive + streaming sockets (e.g. an open /_relay/events body, #1067) so close() resolves instead of waiting on them.
+    server.closeAllConnections();
+    return new Promise(resolvePromise => server.close(() => resolvePromise()));
+}
+/**
+ * The CSRF + DNS-rebinding guard the RPC mount applies, lifted to the device relay, which
+ * dispatches outside it. The relay is state-changing (it starts a run on this machine) and is
+ * wired unconditionally on a loopback bind, where the shared-token guard is a no-op, so without
+ * this a page the user merely visited reaches it. Returns true to admit the request; on rejection
+ * it has already answered 403.
+ */
+function guardBrowserOrigin(req, res, host) {
+    if (isSameOriginRequest(req) && isExpectedHost(req, host))
+        return true;
+    res.writeHead(403, { 'content-type': 'text/plain' }).end('forbidden');
+    return false;
+}
+/** The cookie a bootstrapped browser carries on every same-origin request (#1051). */
+const DAEMON_COOKIE = 'oa_daemon';
+/**
+ * The non-loopback bind guard (#1051): a request needs a valid `oa_daemon` cookie or a matching
+ * `?token=`, else 401. A valid `?token=` sets the cookie and 302s to the clean path so the token
+ * leaves the URL bar, history, and Referer after one hop; the cookie then rides RPC, the events
+ * Channel, and the MJPEG `<img>` screencast alike (all same-origin), which a bearer header cannot
+ * reach. Returns true to admit the request, false once it has answered (401 or the redirect).
+ */
+function authorizeDaemonRequest(req, res, token) {
+    // Safe to re-parse: requestPathname already parsed this same url without throwing (#938).
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    const queryToken = url.searchParams.get('token');
+    if (queryToken !== null && tokensMatch(queryToken, token)) {
+        url.searchParams.delete('token');
+        const query = url.searchParams.toString();
+        res.writeHead(302, {
+            // Lax, not Strict: the device-hop (#1052) is a cross-origin top-level nav, and a Strict cookie set on it is withheld from the redirect right after, so the clean path 401s. Lax still rides top-level GET navs; CSRF stays covered by the same-origin check on /_rpc.
+            'set-cookie': `${DAEMON_COOKIE}=${token}; HttpOnly; SameSite=Lax; Path=/`,
+            location: url.pathname + (query ? `?${query}` : ''),
+        });
+        res.end();
+        return false;
+    }
+    const cookieToken = readCookie(req.headers.cookie, DAEMON_COOKIE);
+    if (cookieToken !== undefined && tokensMatch(cookieToken, token))
+        return true;
+    res.writeHead(401, { 'content-type': 'text/plain' });
+    res.end('unauthorized');
+    return false;
+}
+/** Constant-time token compare (#1051). The length check first, since `timingSafeEqual` throws on
+ * unequal-length buffers and a length mismatch cannot be a match anyway. */
+function tokensMatch(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    return ab.length === bb.length && timingSafeEqual(ab, bb);
+}
+/** One cookie's value out of a `Cookie` header, or `undefined`. */
+function readCookie(header, name) {
+    if (!header)
+        return undefined;
+    for (const part of header.split(';')) {
+        const eq = part.indexOf('=');
+        if (eq !== -1 && part.slice(0, eq).trim() === name)
+            return part.slice(eq + 1).trim();
+    }
+    return undefined;
+}
+//# sourceMappingURL=server.js.map

package/dist/dashboard/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/dashboard/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAA;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAO7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAsB,MAAM,sBAAsB,CAAA;AAC3F,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,mBAAmB,EAAuB,MAAM,uBAAuB,CAAA;AAC3H,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAyB,MAAM,0BAA0B,CAAA;AAgGzG;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAsB;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAA;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAA;IAC9B,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAA;IAE5C,uFAAuF;IACvF,sFAAsF;IACtF,mFAAmF;IACnF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACxC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QACF,OAAO,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;IACvE,CAAC;IAED,kFAAkF;IAClF,2EAA2E;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;IACxB,MAAM,QAAQ,GAAG,YAAY,CAC3B;QACE,UAAU,EAAE,IAAI,CAAC,OAAO;QACxB,UAAU,EAAE,IAAI,CAAC,YAAY;QAC7B,aAAa,EAAE,IAAI,CAAC,eAAe;QACnC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,KAAK;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB;IACD,yFAAyF;IACzF,yFAAyF;IACzF,EAAE,IAAI,EAAE,CACT,CAAA;IAED,4FAA4F;IAC5F,8DAA8D;IAC9D,MAAM,aAAa,GAA8B,IAAI,CAAC,KAAK;QACzD,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAChH,CAAC,CAAC,SAAS,CAAA;IAEb,gGAAgG;IAChG,4FAA4F;IAC5F,MAAM,cAAc,GAA+B,IAAI,CAAC,WAAW;QACjE,CAAC,CAAC;YACE,KAAK,EAAE,IAAI,CAAC,WAAW;YACvB,0FAA0F;YAC1F,wBAAwB,EAAE,0BAA0B;YACpD,gBAAgB,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,eAAe,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,0BAA0B,EAAE,OAAO,CAAC;YAC7G,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;YACtD,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,eAAe,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC;YAC1E,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC;YAC1D,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC;YACpD,QAAQ,EAAE,QAAQ,CAAC,EAAE;gBACnB,KAAK,MAAM,MAAM,IAAI,QAAQ;oBAAE,eAAe,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YACvE,CAAC;YACD,mFAAmF;YACnF,MAAM,EAAE,SAAS,CAAC,EAAE;gBAClB,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;gBACxD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;YACrE,CAAC;YACD,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,eAAe,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC;YAC/F,yFAAyF;YACzF,4EAA4E;YAC5E,KAAK,EAAE,GAAG,EAAE;gBACV,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC,SAAS,EAAE,CAAA;gBACvC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;YACpJ,CAAC;YACD,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC;YACrF,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE;QACH,CAAC,CAAC,SAAS,CAAA;IAEb,iGAAiG;IACjG,MAAM,gBAAgB,GAAiC,IAAI,CAAC,WAAW;QACrE,CAAC,CAAC;YACE,KAAK,EAAE,IAAI,CAAC,WAAW;YACvB,cAAc,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,cAAc,EAAE;YACxD,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;YAC/C,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;SAClC;QACH,CAAC,CAAC,SAAS,CAAA;IAEb,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;IACxB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;YACvE,OAAM;QACR,CAAC;QACD,8GAA8G;QAC9G,8FAA8F;QAC9F,8FAA8F;QAC9F,sFAAsF;QACtF,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC3E,KAAK,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAA;YAC5D,OAAM;QACR,CAAC;QACD,IAAI,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC,EAAE,CAAC;YACjF,KAAK,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAA;YAChE,OAAM;QACR,CAAC;QACD,8FAA8F;QAC9F,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC;YAAE,OAAM;QAC3E,iGAAiG;QACjG,+FAA+F;QAC/F,gGAAgG;QAChG,2FAA2F;QAC3F,+FAA+F;QAC/F,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;gBAAE,OAAM;YAC/C,KAAK,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;YAC1D,OAAM;QACR,CAAC;QACD,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;YACrE,KAAK,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACvB,OAAM;QACR,CAAC;QACD,qGAAqG;QACrG,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC;YAC9C,8FAA8F;YAC9F,KAAK,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAClD,IAAI,CAAC,GAAG,CAAC,WAAW;oBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;YAC1G,CAAC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QACD,KAAK,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IACF,OAAO,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;QACpD,2EAA2E;QAC3E,qCAAqC;QACrC,KAAK,CAAC,IAAI,EAAE,CAAA;QACZ,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,oGAAoG;AACpG,SAAS,eAAe,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY,EAAE,KAA0B;IAC7F,OAAO,IAAI,OAAO,CAAY,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QAC9D,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;QACnC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC7B,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAA;YAC/C,cAAc,CAAC,EAAE,GAAG,EAAE,UAAU,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAClE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,uIAAuI;IACvI,MAAM,CAAC,mBAAmB,EAAE,CAAA;IAC5B,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC,CAAA;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAAY;IACjF,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACtE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACrE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,sFAAsF;AACtF,MAAM,aAAa,GAAG,WAAW,CAAA;AAEjC;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,GAAoB,EAAE,GAAmB,EAAE,KAAa;IACtF,0FAA0F;IAC1F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;IACvD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChD,IAAI,UAAU,KAAK,IAAI,IAAI,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAChC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAA;QACzC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,sQAAsQ;YACtQ,YAAY,EAAE,GAAG,aAAa,IAAI,KAAK,kCAAkC;YACzE,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC,CAAA;QACF,GAAG,CAAC,GAAG,EAAE,CAAA;QACT,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;IACjE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;IACpD,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IACvB,OAAO,KAAK,CAAA;AACd,CAAC;AAED;4EAC4E;AAC5E,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzB,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;AAC3D,CAAC;AAED,mEAAmE;AACnE,SAAS,UAAU,CAAC,MAA0B,EAAE,IAAY;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACtF,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/dashboard/static.d.ts

@@ -0,0 +1,9 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/**
+ * Serve `dir`'s static bundle for this request: the requested file when it exists,
+ * otherwise `index.html` (the SPA fallback, so client routes and unknown paths still
+ * boot the app). Path-traversal is guarded — a request that escapes `dir` falls back to
+ * `index.html` rather than reading outside the bundle.
+ */
+export declare function serveClientBundle(req: IncomingMessage, res: ServerResponse, dir: string): Promise<void>;
+//# sourceMappingURL=static.d.ts.map

package/dist/dashboard/static.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../src/dashboard/static.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAwBhE;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB7G"}

package/dist/dashboard/static.js

@@ -0,0 +1,54 @@
+import { readFile, stat } from 'node:fs/promises';
+import { join, normalize, sep } from 'node:path';
+import { contentTypeFor } from './content-type.js';
+import { requestPathname } from '../request-path.js';
+// Serve the built dashboard bundle (#405). The dashboard is a plain Vite SPA — one static
+// `index.html` plus `assets/**` — so the daemon serves it as
+// plain files with an SPA fallback (any non-asset path yields `index.html`, which boots
+// the client router). Assets are copied into the
+// OpenAgent package at build time (see scripts/bundle-dashboard.mjs).
+/** Whether a real, readable file exists at `path`. */
+async function isFile(path) {
+    return stat(path).then(s => s.isFile()).catch(() => false);
+}
+/** Decode a percent-encoded path; a malformed escape names no file, so it decodes to nothing. */
+function tryDecode(pathname) {
+    try {
+        return decodeURIComponent(pathname);
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Serve `dir`'s static bundle for this request: the requested file when it exists,
+ * otherwise `index.html` (the SPA fallback, so client routes and unknown paths still
+ * boot the app). Path-traversal is guarded — a request that escapes `dir` falls back to
+ * `index.html` rather than reading outside the bundle.
+ */
+export async function serveClientBundle(req, res, dir) {
+    // Neither an unparseable request target nor a malformed escape (`/%zz`) may throw: this
+    // runs void-dispatched, so an exception here would be an unhandled rejection that takes
+    // the daemon down (#938). Both fall back to the SPA shell like any other unknown path.
+    const pathname = requestPathname(req) ?? '/';
+    const rel = tryDecode(pathname).replace(/^\/+/, '');
+    const root = normalize(dir);
+    const candidate = normalize(join(root, rel));
+    const within = candidate === root || candidate.startsWith(root + sep);
+    const target = within && rel && (await isFile(candidate)) ? candidate : join(root, 'index.html');
+    const body = await readFile(target).catch(() => undefined);
+    if (body === undefined) {
+        res.writeHead(404, { 'content-type': 'text/plain' });
+        res.end('dashboard bundle not built');
+        return;
+    }
+    const type = contentTypeFor(target);
+    // Only the fingerprinted files under `assets/` are immutable. Everything at a stable path
+    // (index.html, the host files a module imports as `/host/*.js`) must always revalidate: a
+    // browser that kept `/host/module.js` from the last version would hand every module a host
+    // missing whatever the new version added, until its cache expired a year later.
+    const cacheControl = target.startsWith(join(root, 'assets') + sep) ? 'public, max-age=31536000, immutable' : 'no-cache';
+    res.writeHead(200, { 'content-type': type, 'cache-control': cacheControl });
+    res.end(body);
+}
+//# sourceMappingURL=static.js.map

package/dist/dashboard/static.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static.js","sourceRoot":"","sources":["../../src/dashboard/static.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAEhD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEpD,0FAA0F;AAC1F,6DAA6D;AAC7D,wFAAwF;AACxF,iDAAiD;AACjD,sEAAsE;AAEtE,sDAAsD;AACtD,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;AAC5D,CAAC;AAED,iGAAiG;AACjG,SAAS,SAAS,CAAC,QAAgB;IACjC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAW;IAC5F,wFAAwF;IACxF,wFAAwF;IACxF,uFAAuF;IACvF,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,GAAG,CAAA;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC3B,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAA;IAErE,MAAM,MAAM,GAAG,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IAChG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC1D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;QACpD,GAAG,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAA;QACrC,OAAM;IACR,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACnC,0FAA0F;IAC1F,0FAA0F;IAC1F,2FAA2F;IAC3F,gFAAgF;IAChF,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,UAAU,CAAA;IACvH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC,CAAA;IAC3E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACf,CAAC"}

package/dist/dashboard/types.d.ts

@@ -0,0 +1,135 @@
+import type { LinkedPr } from './pull-requests.js';
+import type { PublishPick } from '../publish-levels.js';
+/** The outcome of removing a retained worktree (#737). */
+export type RemoveWorktreeResult = {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};
+/** The outcome of deleting a session — its records and worktree (#1032). */
+export type DeleteAgentResult = {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * The outcome of an add-project attempt (#396): registered, or was already, or why not.
+ * `noRemote` says the person asked to share the agents' records and the repository has no remote
+ * to share with: they are kept on this machine.
+ */
+export type AddProjectResult = {
+    ok: true;
+    alreadyActivated: boolean;
+    noRemote?: true;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * What removing OpenAgent's files from a project's folder did: what went, what stayed with the
+ * reason, and what could not be done, each line in words for a person. Paths are from the
+ * project's root.
+ */
+export interface CleanupReport {
+    removed: string[];
+    kept: {
+        path: string;
+        reason: string;
+    }[];
+    failed: string[];
+}
+/** The outcome of removing a project from the list: gone from it, with what the clean-up did when one was asked for, or why not. */
+export type RemoveProjectResult = {
+    ok: true;
+    cleanup?: CleanupReport;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * What the Onboarding checklist (#958) needs and no other read carries: the server's own
+ * working directory, offered as the one-click first project.
+ *
+ * Both fields are null where adding projects is not wired (the relay), so a public host
+ * never discloses its filesystem layout.
+ */
+export interface OnboardingSuggestion {
+    /** The server's working directory, or null when it cannot be offered. */
+    cwd: string | null;
+    /** The project id for {@link cwd} when it is already registered, else null. */
+    cwdProjectId: string | null;
+}
+/**
+ * What a Start carries besides its prompt (#1774): the person's picks, handed to the project's
+ * `start` hook line as `DRIVER`, `MODEL`, `PUBLISH` and `BASE`. Absent leaves each to the tool the line names.
+ */
+export interface StartAgentOptions {
+    /** The model to run on. */
+    model?: string;
+    /** Which coding agent the run is on: `claude-code` or `codex`. */
+    driver?: string;
+    /** The person's saved pick of how far the run takes its work when the agent finishes. Absent, none is saved: the daemon starts the run at `commit`. A saved pick the project is not offered is held to the furthest the project goes with no pull request. */
+    publish?: PublishPick;
+    /**
+     * The branch the agent's own branch starts from, as this machine has it, commits that are not
+     * pushed included: the launcher's "My local branch" pick. Absent, origin's default branch. A
+     * word that is no branch name refuses the Start. Not sent to a device: its branches are its own.
+     */
+    base?: string;
+    /**
+     * The follow-up's prompt: once the run ends done with a pull request, a fresh agent works its
+     * branch from it before the request merges. The launcher's "Post-merge cleanup" box.
+     */
+    then?: string;
+    /**
+     * Run this session on a connected device (#1067): the local daemon relays the start to the remote
+     * daemon at `url` (authenticating with `token` as the `oa_daemon` cookie) and streams its events
+     * back into the local agent view. The device `label` rides along (memory-only, like `url`/`token`) so
+     * the local session list + notice can show which device the agent is on after a reload (#1077).
+     * Memory-only relay config the dashboard sets at submit time from a saved device. NEVER persisted to
+     * Preferences or the registry: a device token is a per-browser secret. Absent = run locally.
+     * Stripped before the start is forwarded, so the remote starts an ordinary local run and does not
+     * relay onward.
+     */
+    remote?: {
+        url: string;
+        token: string;
+        label?: string;
+    };
+}
+/** The outcome of a Start attempt (#345): the id of the run the project's start hook began, or why there is none. */
+export type StartAgentResult = {
+    ok: true;
+    agentId: string;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Where a session is working (#798): its checkout, its branch, and what it is holding. Read by
+ * the dashboard so a session's action bar can say which worktree it has, rather than leaving the
+ * user to infer it from an agent id.
+ *
+ * Only what is true of the run: once its checkout is gone there is no tree to be clean or dirty,
+ * so {@link checkout} is absent and the branch is the one the run recorded.
+ */
+export interface AgentWorktree {
+    /** The run's own checkout while it exists. */
+    checkout?: {
+        /** Absolute path of the checkout. */
+        path: string;
+        /** Uncommitted changes present in it. */
+        dirty: boolean;
+        /** Size on disk, bytes. Only read once nothing is writing to it, and best-effort even then. */
+        sizeBytes?: number;
+    };
+    /** The branch the run's work is on: its checkout's while it has one, else the one it recorded. */
+    branch?: string;
+    /** The PR opened for this run's branch (#809), when there is one. */
+    pr?: LinkedPr;
+    /** The PR is not known yet, rather than absent (#1028): the lookup is still running. */
+    prPending?: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/dashboard/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/dashboard/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAMvD,0DAA0D;AAC1D,MAAM,MAAM,oBAAoB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9E,4EAA4E;AAC5E,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3E;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,IAAI,CAAA;CAAE,GACxD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEhC;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACxC,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,oIAAoI;AACpI,MAAM,MAAM,mBAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtG;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8PAA8P;IAC9P,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CACxD;AAED,qHAAqH;AACrH,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3F;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,QAAQ,CAAC,EAAE;QACT,qCAAqC;QACrC,IAAI,EAAE,MAAM,CAAA;QACZ,yCAAyC;QACzC,KAAK,EAAE,OAAO,CAAA;QACd,+FAA+F;QAC/F,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD,kGAAkG;IAClG,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,EAAE,CAAC,EAAE,QAAQ,CAAA;IACb,wFAAwF;IACxF,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB"}

package/dist/dashboard/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/dashboard/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/dashboard/types.ts"],"names":[],"mappings":""}

package/dist/dashboard/web-start-endpoints.d.ts

@@ -0,0 +1,32 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { BridgeStartInput, BridgeStartRequest } from './bridge-starts.js';
+/**
+ * The run-facing side of the session start-queue (#1328): how a web run asks the daemon for a
+ * cloud session created by the browser extension, and learns what it became.
+ *
+ * A run is a separate process the daemon never started, so it cannot touch the daemon's queue
+ * directly; it reaches these routes at the URL it finds in its environment
+ * ({@link DAEMON_URL_ENV}), presenting the daemon token it reads from the registry. The
+ * extension's own side of the same queue lives on `/_bridge/start` and `/_bridge/started`.
+ *
+ * Nothing sets {@link DAEMON_URL_ENV} today (#1774): web runs left the launcher when the daemon
+ * stopped running agents, so the only caller of these routes is gone until web runs return, and
+ * then whatever line a project's start hook names will have to carry the URL. The extension's
+ * side of the queue is live either way, which is why these routes stay.
+ */
+export declare const WEB_START_PREFIX = "/_web-start";
+/** The environment variable a run finds its daemon's URL in. */
+export declare const DAEMON_URL_ENV = "OPENAGENT_DAEMON_URL";
+/** What the daemon wires behind the routes. Absent when the bridge is off, which 404s them. */
+export interface WebStartHandlers {
+    /** The daemon token every call must present — the same one the extension holds. */
+    token: string;
+    /** Whether an extension has spoken to this daemon recently enough to be trusted with a request. */
+    extensionAlive: () => boolean;
+    /** Queue a request, or say what is wrong with it. */
+    request: (input: BridgeStartInput) => BridgeStartRequest | string;
+    get: (id: string) => BridgeStartRequest | undefined;
+}
+/** Route a `/_web-start*` request. */
+export declare function handleWebStartRequest(req: IncomingMessage, res: ServerResponse, pathname: string, handlers: WebStartHandlers | undefined): Promise<void>;
+//# sourceMappingURL=web-start-endpoints.d.ts.map

package/dist/dashboard/web-start-endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-start-endpoints.d.ts","sourceRoot":"","sources":["../../src/dashboard/web-start-endpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAGhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE9E;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAE7C,gEAAgE;AAChE,eAAO,MAAM,cAAc,yBAAyB,CAAA;AAEpD,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAA;IACb,mGAAmG;IACnG,cAAc,EAAE,MAAM,OAAO,CAAA;IAC7B,qDAAqD;IACrD,OAAO,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,kBAAkB,GAAG,MAAM,CAAA;IACjE,GAAG,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,kBAAkB,GAAG,SAAS,CAAA;CACpD;AAKD,sCAAsC;AACtC,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC,OAAO,CAAC,IAAI,CAAC,CAOf"}