@oratis/lisa 0.9.0 → 0.11.1

package/dist/web/server.js

@@ -1,9 +1,13 @@
 import http from "node:http";
 import path from "node:path";
 import fs from "node:fs/promises";
+import crypto from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { runAgent } from "../agent.js";
+import { fireHooks } from "../hooks/runner.js";
 import { saveConfigEnv } from "../env.js";
+import { detectPlans, selectedPlan, parsePlanRef, planMark, PLAN_IDS } from "../model/plans.js";
+import { planUsage, formatUsage } from "../model/plan-usage.js";
 import { runIdleOnce } from "../idle/runner.js";
 import { getIdleWatcher } from "../idle/watcher.js";
 import { moodBus } from "../mood-bus.js";
@@ -18,17 +22,74 @@ import { ISLAND_HTML } from "./island.js";
 import { MAIN_HTML } from "./lisa-html.js";
 import { OrchestratorHub, loadOrchestratorConfig } from "../integrations/hub.js";
 import { setCurrentHub } from "../integrations/current-hub.js";
-import { advise, formatDigest } from "../advisor/engine.js";
+import { advise, dismissSuggestion, formatDigest } from "../advisor/engine.js";
 import { recordEvent } from "../orchestrator/journal.js";
 import { buildRecap, formatRecap } from "../orchestrator/recap.js";
 import { captureScreenshot, captureSupported } from "../vision/capture.js";
 import { transcribeAudio } from "../voice/transcribe.js";
 import { polishDictation } from "../voice/dictation.js";
+import { listGrants, grant, revoke, revokeAll, isGranted, SENSE_SIGNALS, SIGNAL_DESCRIPTIONS } from "../consent/store.js";
+import { signalAgentTool } from "../tools/signal_agent.js";
+import { managedRegistry } from "../agents/managed.js";
+import { ptyRegistry, ptyEnabled } from "../agents/pty.js";
+import { liveClaudeSessionIds } from "../integrations/claude-code/liveness.js";
+import { listRecentDispatches, isAlive, toDispatchView, readDispatchOutput } from "../integrations/dispatch-ledger.js";
+import { loadControlPolicy, saveControlPolicy } from "../control/policy.js";
+import { mintDevice, verifyDeviceToken, touchDevice, listDevices, revokeDevice } from "./devices.js";
+import { PushBridge, listPush, registerPush, unregisterPush, setPushPrefs } from "./push.js";
+import { SenseService } from "../sense/service.js";
+import { ScreenSource } from "../sense/screen.js";
+import { VoiceSource } from "../sense/voice.js";
+import { appendSenseEvent, readSenseEvents } from "../sense/log.js";
 import { loadScreenAdvisorConfig, saveScreenAdvisorConfig, normalizeConfig, analyzeScreenshot, } from "../screen_advisor/engine.js";
 import os from "node:os";
 import { LISA_HOME } from "../paths.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ASSETS_DIR = path.join(__dirname, "assets");
+/** True for loopback peer/bind addresses (v4, v6, and v4-mapped-v6 forms). */
+export function isLoopbackAddress(addr) {
+    const a = addr.startsWith("::ffff:") ? addr.slice("::ffff:".length) : addr;
+    return a === "::1" || a === "localhost" || a.startsWith("127.");
+}
+function timingSafeEqualStr(a, b) {
+    // Hash both sides so the comparison is constant-time regardless of length.
+    const ha = crypto.createHash("sha256").update(a).digest();
+    const hb = crypto.createHash("sha256").update(b).digest();
+    return crypto.timingSafeEqual(ha, hb);
+}
+/**
+ * The web auth decision (the unit the red-team script + tests target): a request
+ * is authorized iff it's loopback (the local user) OR it presents the correct
+ * LISA_WEB_TOKEN. No token configured ⇒ no non-loopback request can pass. Pure.
+ */
+export function isRequestAuthorized(remoteAddr, webToken, presented) {
+    if (isLoopbackAddress(remoteAddr))
+        return true;
+    return !!webToken && !!presented && timingSafeEqualStr(presented, webToken);
+}
+/**
+ * Extract a presented web token from Authorization header, lisa_token cookie,
+ * or ?token= query param (the query form exists so a phone can bootstrap the
+ * cookie by opening http://host:5757/?token=...).
+ */
+function presentedToken(req, url) {
+    const auth = req.headers.authorization;
+    if (auth?.startsWith("Bearer "))
+        return auth.slice("Bearer ".length).trim();
+    const cookies = req.headers.cookie ?? "";
+    const m = /(?:^|;\s*)lisa_token=([^;]+)/.exec(cookies);
+    if (m)
+        return decodeURIComponent(m[1]);
+    try {
+        const q = new URL(url, "http://localhost").searchParams.get("token");
+        if (q)
+            return q;
+    }
+    catch {
+        /* fall through */
+    }
+    return null;
+}
 async function resumeOrCreateWebSession(model) {
     const lastId = await readActiveWebSession();
     if (lastId) {
@@ -62,6 +123,14 @@ async function resumeOrCreateWebSession(model) {
     return s;
 }
 export async function startWebServer(opts) {
+    const host = opts.host ?? "127.0.0.1";
+    const webToken = process.env.LISA_WEB_TOKEN?.trim() || null;
+    if (!isLoopbackAddress(host) && !webToken) {
+        throw new Error(`refusing to bind ${host} without LISA_WEB_TOKEN — every endpoint drives a ` +
+            `full-tool agent on this machine. Set LISA_WEB_TOKEN (e.g. ` +
+            `\`LISA_WEB_TOKEN=$(openssl rand -hex 24)\` in ~/.lisa/config.env), then open ` +
+            `http://<host>:${opts.port}/?token=<value> from the remote device.`);
+    }
     const snapshot = await buildSystemPromptSnapshot();
     const initialFingerprint = await getPromptFingerprint();
     // Per-process hot-reload cache for the web server: same shape as cli's
@@ -100,6 +169,13 @@ export async function startWebServer(opts) {
     const { messages: savedMessages } = await session.readMessagePage(0, 9999);
     const history = [...savedMessages];
     const abort = new AbortController();
+    const hooks = opts.hooks ?? [];
+    // Serialize chat turns. The whole process shares ONE history array and ONE
+    // session file — two tabs (or a tab + the island) POSTing /chat concurrently
+    // would run two agents against the same history reference and clobber each
+    // other's `history.length = 0; history.push(...)` at the end. Same model as
+    // the channels router's per-thread busy+queue, with a promise chain.
+    let chatChain = Promise.resolve();
     // ── Persistent /events SSE subscribers (mood + idle broadcasts) ─────
     const eventClients = new Set();
     const broadcast = (event) => {
@@ -127,11 +203,15 @@ export async function startWebServer(opts) {
     const hub = new OrchestratorHub(orchestratorCfg, {
         log: (msg) => console.error(msg),
     });
+    // Operational push: notify subscribed phones on agent done/error/permission +
+    // Reve idle messages. Opt-in, ntfy by default (apns is a stub). See push.ts.
+    const pushBridge = new PushBridge({ log: (m) => console.error(m) });
     hub.on("update", (session) => {
         // L6 — record the transition in the orchestrator journal so the
         // cross-agent recap can answer "what happened while I was away?" even for
         // sessions that have since ended. (Dedups consecutive same-state events.)
         recordEvent(session);
+        pushBridge.onAgentUpdate(session);
         // New generalized event for the multi-agent UI.
         broadcast({ type: "agent_session_update", ...session });
         // Back-compat: the island still listens for claude_session_update as a
@@ -159,6 +239,7 @@ export async function startWebServer(opts) {
     // card — pull-friendly, not an interrupt. lastIdleMessage is assigned
     // inside the async callback (runs after all locals init; no TDZ issue).
     const ADVISE_INTERVAL_MS = 5 * 60_000;
+    let lastAdvisorSuggestions = null;
     const adviseTimer = setInterval(() => {
         void (async () => {
             try {
@@ -172,6 +253,19 @@ export async function startWebServer(opts) {
                 const at = new Date().toISOString();
                 lastIdleMessage = { text, at };
                 broadcast({ type: "idle_message", text, at, source: "advisor" });
+                pushBridge.onIdleMessage(text);
+                // Structured twin of the digest: same suggestions with id / urgency /
+                // action attached so the island can render per-suggestion buttons
+                // (act → prefill chat, ✕ → dismiss feeds the learning loop).
+                const suggestions = surface.map((s) => ({
+                    id: s.id,
+                    category: s.category,
+                    urgency: s.urgency,
+                    text: s.text,
+                    action: s.action ?? null,
+                }));
+                lastAdvisorSuggestions = { suggestions, at };
+                broadcast({ type: "advisor_suggestions", suggestions, at });
                 console.error(`[advisor] surfaced ${surface.length} suggestion(s)`);
             }
             catch (err) {
@@ -193,7 +287,11 @@ export async function startWebServer(opts) {
     let screenTimer = null;
     let screenTickRunning = false;
     const screenTick = async () => {
-        if (screenTickRunning || !screenCfg.enabled || !captureSupported())
+        // S2: a screenshot → model IS screen capture, so it requires the `screen`
+        // consent grant (re-checked each tick so revoke-all stops it within one
+        // interval) IN ADDITION to the advisor's own enabled flag. This unifies all
+        // screen capture under the consent framework (FOUNDATIONS §1).
+        if (screenTickRunning || !screenCfg.enabled || !captureSupported() || !isGranted("screen"))
             return;
         screenTickRunning = true;
         try {
@@ -237,7 +335,25 @@ export async function startWebServer(opts) {
     restartScreenTimer();
     if (screenCfg.enabled) {
         console.error(`[screen-advisor] enabled — every ${screenCfg.intervalMinutes}m`);
+        if (!isGranted("screen")) {
+            console.error("[screen-advisor] waiting on `screen` consent — grant it (`lisa consent grant screen`) to start capturing.");
+        }
     }
+    // ── Sense ambient sources (S2) ──────────────────────────────────────
+    // The resident loop owns consent-gated ambient sources. ScreenSource ticks
+    // continuously but captures NOTHING until `screen` is granted (it re-checks
+    // each tick), so this is a no-op by default. On-change foreground-app events
+    // are distilled to the bounded sense log; nothing raw is persisted.
+    const senseService = new SenseService();
+    // VoiceSource is event-driven (fed by the transcribe endpoint when `voice` is
+    // granted); ScreenSource polls. Both no-op until their signal is granted.
+    const voiceSource = new VoiceSource();
+    senseService.register(new ScreenSource());
+    senseService.register(voiceSource);
+    void senseService.start((e) => {
+        appendSenseEvent(e);
+        broadcast({ type: "sense_event", ...e });
+    });
     // ── Island unread tracking (Phase 1 of MAC_ISLAND_PLAN) ─────────────
     // The island widget caches "last idle_message" so a fresh tab opening
     // mid-conversation knows there's something to read. Cleared via
@@ -280,6 +396,7 @@ export async function startWebServer(opts) {
                     });
                     lastIdleMessage = { text: result.text, at: startedAt };
                     broadcast({ type: "idle_message", text: result.text, at: startedAt });
+                    pushBridge.onIdleMessage(result.text);
                 }
             }
             catch (err) {
@@ -296,14 +413,65 @@ export async function startWebServer(opts) {
     }
     const server = http.createServer(async (req, res) => {
         const url = req.url ?? "/";
-        if (req.method === "GET" && url === "/") {
+        // ── Auth gate ────────────────────────────────────────────────────────
+        // Loopback callers are the local user — no token needed (the default
+        // 127.0.0.1 bind means this is the only case unless the user opted in
+        // via --host). Anything else must present LISA_WEB_TOKEN; /chat drives a
+        // full-tool agent and /api/vision/capture grabs the screen, so an
+        // unauthenticated non-loopback request is a remote-code-execution hole.
+        const remoteAddr = req.socket.remoteAddress ?? "";
+        if (!isLoopbackAddress(remoteAddr)) {
+            const presented = webToken ? presentedToken(req, url) : null;
+            // Authorized by the global LISA_WEB_TOKEN OR a non-revoked per-device token.
+            let authed = isRequestAuthorized(remoteAddr, webToken, presented);
+            if (!authed && presented) {
+                const device = verifyDeviceToken(presented);
+                if (device) {
+                    authed = true;
+                    touchDevice(device.id);
+                }
+            }
+            if (!authed) {
+                res.writeHead(401, { "content-type": "text/plain" });
+                res.end("unauthorized");
+                return;
+            }
+            // Token arrived via query param (first open from a phone): pin it as a
+            // cookie so subsequent same-origin fetch/EventSource calls authenticate.
+            // presented is non-null here — isRequestAuthorized returned true for a
+            // non-loopback caller, which requires a matching token.
+            if (presented && !req.headers.cookie?.includes("lisa_token=")) {
+                res.setHeader("set-cookie", `lisa_token=${encodeURIComponent(presented)}; HttpOnly; SameSite=Strict; Path=/`);
+            }
+        }
+        // Per-request gate for high-risk control actions from REMOTE callers. The Mac
+        // owner (loopback) is never gated; a remote (token) device may take only what
+        // the Mac-side policy permits. denyRemote() writes the 403 and returns true
+        // when blocked, so call sites read `if (denyRemote(...)) return;`. See
+        // src/control/policy.ts (default: control own agents yes, adopt external no).
+        const remoteControlAllowed = (need) => {
+            if (isLoopbackAddress(remoteAddr))
+                return true;
+            const pol = loadControlPolicy();
+            return need === "adoptExternal" ? pol.remoteAdoptExternal : pol.remoteControl;
+        };
+        const denyRemote = (need) => {
+            if (remoteControlAllowed(need))
+                return false;
+            res.writeHead(403, { "content-type": "text/plain" });
+            res.end(need === "adoptExternal"
+                ? "adopting external sessions from a remote device is disabled — enable remoteAdoptExternal on the Mac (POST /api/control/policy from localhost)"
+                : "remote control is disabled — enable remoteControl on the Mac (POST /api/control/policy from localhost)");
+            return true;
+        };
+        if (req.method === "GET" && (url === "/" || url.startsWith("/?"))) {
             res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
             res.end(MAIN_HTML);
             return;
         }
         // Island widget — designed to be opened in a tiny browser window
         // (Arc, Vivaldi PWA, Safari split). See docs/MAC_ISLAND_PLAN.md.
-        if (req.method === "GET" && url === "/island") {
+        if (req.method === "GET" && (url === "/island" || url.startsWith("/island?"))) {
             res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
             res.end(ISLAND_HTML);
             return;
@@ -454,6 +622,10 @@ export async function startWebServer(opts) {
                 await fs.writeFile(tmp, Buffer.from(payload.data, "base64"));
                 console.error(`[voice] transcribing ${Buffer.from(payload.data, "base64").length} bytes (${ext})`);
                 const transcript = await transcribeAudio({ audioPath: tmp });
+                // S2-voice: when `voice` is granted, distill this push-to-talk transcript
+                // into the ambient sense log (PII-redacted, no audio). No-op otherwise,
+                // so dictation works unchanged when voice consent is off.
+                voiceSource.ingest(transcript);
                 // Dictation mode (Typeless-equivalent): polish the raw transcript into
                 // the clean text the speaker intended (filler/repetition removed,
                 // self-corrections applied, punctuation + formatting), to drop into the
@@ -490,13 +662,549 @@ export async function startWebServer(opts) {
             res.end(JSON.stringify({ ok: true }));
             return;
         }
+        // Latest advisor suggestions, for a freshly opened island.
+        if (req.method === "GET" && url === "/api/advisor/latest") {
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify(lastAdvisorSuggestions ?? { suggestions: [], at: null }));
+            return;
+        }
+        // ✕ on an advisor suggestion: persist the dismissal so the category
+        // down-weights over time ("learns to shut up"), and drop it from the
+        // cached card so a refreshed island doesn't resurrect it.
+        if (req.method === "POST" && url === "/api/advisor/dismiss") {
+            let dBody = "";
+            for await (const chunk of req)
+                dBody += chunk.toString("utf8");
+            let payload;
+            try {
+                payload = JSON.parse(dBody || "{}");
+            }
+            catch {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("bad json");
+                return;
+            }
+            if (typeof payload.id !== "string" || typeof payload.category !== "string") {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("id and category required");
+                return;
+            }
+            try {
+                await dismissSuggestion(payload.id, payload.category);
+            }
+            catch (err) {
+                res.writeHead(500, { "content-type": "text/plain" });
+                res.end(err.message);
+                return;
+            }
+            if (lastAdvisorSuggestions) {
+                lastAdvisorSuggestions = {
+                    ...lastAdvisorSuggestions,
+                    suggestions: lastAdvisorSuggestions.suggestions.filter((s) => s.id !== payload.id),
+                };
+            }
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ ok: true }));
+            return;
+        }
+        // ── Consent (FOUNDATIONS §1) ────────────────────────────────────────
+        // The island's "always visible + one-tap stop" surface. GET lists every
+        // sense signal + status; the POSTs grant/revoke/stop-all. Sources gate on
+        // isGranted() server-side regardless — this is control, not the gate.
+        if (req.method === "GET" && url === "/api/consent") {
+            const grants = listGrants().map((g) => ({
+                ...g,
+                description: SIGNAL_DESCRIPTIONS[g.signal] ?? "",
+            }));
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ grants }));
+            return;
+        }
+        // D4b — list/cancel LISA's OWN dispatched agents over HTTP. Behind the auth
+        // gate like every endpoint (loopback or token). Reuses signal_agent, so it
+        // can ONLY touch dispatch-ledger pids — never an arbitrary process.
+        if (req.method === "POST" && url === "/api/agent/signal") {
+            let sigBody = "";
+            for await (const chunk of req)
+                sigBody += chunk.toString("utf8");
+            let payload;
+            try {
+                payload = JSON.parse(sigBody || "{}");
+            }
+            catch {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("bad json");
+                return;
+            }
+            const action = payload.action === "list" ? "list" : payload.action === "cancel" ? "cancel" : null;
+            if (!action) {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("action must be 'list' or 'cancel'");
+                return;
+            }
+            if (action === "cancel" && denyRemote("control"))
+                return;
+            const result = await signalAgentTool.execute({
+                action,
+                target: typeof payload.target === "string" ? payload.target : undefined,
+                force: payload.force === true,
+            }, { cwd: process.cwd(), signal: new AbortController().signal, log: () => { } });
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ ok: true, result }));
+            return;
+        }
+        // ── Managed agents (control plane) ──────────────────────────────────
+        // LISA's own controllable agents: start a task, send follow-ups, cancel,
+        // and approve/deny each mutating tool. Behind the auth gate like every
+        // endpoint. They appear in the roster via the "managed" hub observer.
+        // Device pairing: mint a per-device token (loopback-only — the Mac owner
+        // pairs a phone by showing the returned token as a QR). The raw token is
+        // returned ONCE; only its hash is stored. The phone then authenticates with
+        // it like the global token (Bearer / ?token= / cookie).
+        if (req.method === "POST" && url === "/api/pair/start") {
+            if (!isLoopbackAddress(remoteAddr)) {
+                res.writeHead(403, { "content-type": "text/plain" });
+                res.end("pairing can only be started from the Mac (localhost)");
+                return;
+            }
+            let prBody = "";
+            for await (const chunk of req)
+                prBody += chunk.toString("utf8");
+            let payload = {};
+            try {
+                payload = prBody ? JSON.parse(prBody) : {};
+            }
+            catch { /* tolerate */ }
+            const name = typeof payload.name === "string" ? payload.name : "device";
+            const platform = typeof payload.platform === "string" ? payload.platform : "ios";
+            const { id, token, device } = mintDevice(name, platform);
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ ok: true, id, token, port: opts.port, device }));
+            return;
+        }
+        if (req.method === "GET" && url === "/api/devices") {
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ devices: listDevices() }));
+            return;
+        }
+        if (req.method === "POST" && url === "/api/devices/revoke") {
+            if (!isLoopbackAddress(remoteAddr)) {
+                res.writeHead(403, { "content-type": "text/plain" });
+                res.end("device revocation is a Mac-owner action (localhost only)");
+                return;
+            }
+            let rvBody = "";
+            for await (const chunk of req)
+                rvBody += chunk.toString("utf8");
+            let payload = {};
+            try {
+                payload = rvBody ? JSON.parse(rvBody) : {};
+            }
+            catch { /* tolerate */ }
+            const removed = revokeDevice(typeof payload.id === "string" ? payload.id : "");
+            res.writeHead(removed ? 200 : 404, { "content-type": "application/json" });
+            res.end(JSON.stringify({ ok: removed }));
+            return;
+        }
+        // Push registration: a phone registers its own delivery target (ntfy topic or
+        // APNs token) + prefs — authed (the device does this remotely). Low-sensitivity
+        // metadata only; see push.ts.
+        if (req.method === "POST" && url === "/api/push/register") {
+            let puBody = "";
+            for await (const chunk of req)
+                puBody += chunk.toString("utf8");
+            let payload = {};
+            try {
+                payload = puBody ? JSON.parse(puBody) : {};
+            }
+            catch { /* tolerate */ }
+            if (typeof payload.target !== "string" || !payload.target.trim()) {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("target required (ntfy topic or apns token)");
+                return;
+            }
+            const sub = registerPush({
+                kind: typeof payload.kind === "string" ? payload.kind : "ntfy",
+                target: payload.target,
+                server: typeof payload.server === "string" ? payload.server : undefined,
+                prefs: payload.prefs,
+            });
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ ok: true, subscription: sub }));
+            return;
+        }
+        if (req.method === "POST" && url === "/api/push/unregister") {
+            let puBody = "";
+            for await (const chunk of req)
+                puBody += chunk.toString("utf8");
+            let payload = {};
+            try {
+                payload = puBody ? JSON.parse(puBody) : {};
+            }
+            catch { /* tolerate */ }
+            const key = typeof payload.id === "string" ? payload.id : typeof payload.target === "string" ? payload.target : "";
+            const removed = unregisterPush(key);
+            res.writeHead(removed ? 200 : 404, { "content-type": "application/json" });
+            res.end(JSON.stringify({ ok: removed }));
+            return;
+        }
+        if (req.method === "GET" && url === "/api/push/list") {
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ subscriptions: listPush() }));
+            return;
+        }
+        if (req.method === "POST" && url === "/api/push/prefs") {
+            let puBody = "";
+            for await (const chunk of req)
+                puBody += chunk.toString("utf8");
+            let payload = {};
+            try {
+                payload = puBody ? JSON.parse(puBody) : {};
+            }
+            catch { /* tolerate */ }
+            const sub = typeof payload.id === "string" ? setPushPrefs(payload.id, payload.prefs ?? {}) : null;
+            res.writeHead(sub ? 200 : 404, { "content-type": "application/json" });
+            res.end(JSON.stringify(sub ? { ok: true, subscription: sub } : { ok: false }));
+            return;
+        }
+        // Remote-control policy: GET (any authed caller) reports it; POST sets it,
+        // but only from localhost (the Mac owner) — like the API-key save.
+        if (req.method === "GET" && url === "/api/control/policy") {
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify(loadControlPolicy()));
+            return;
+        }
+        if (req.method === "POST" && url === "/api/control/policy") {
+            if (!isLoopbackAddress(remoteAddr)) {
+                res.writeHead(403, { "content-type": "text/plain" });
+                res.end("control policy can only be changed from the Mac (localhost)");
+                return;
+            }
+            let cpBody = "";
+            for await (const chunk of req)
+                cpBody += chunk.toString("utf8");
+            let payload;
+            try {
+                payload = JSON.parse(cpBody || "{}");
+            }
+            catch {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("bad json");
+                return;
+            }
+            try {
+                const saved = saveControlPolicy({ ...loadControlPolicy(), ...payload });
+                res.writeHead(200, { "content-type": "application/json" });
+                res.end(JSON.stringify({ ok: true, ...saved }));
+            }
+            catch (err) {
+                res.writeHead(500, { "content-type": "text/plain" });
+                res.end(err.message);
+            }
+            return;
+        }
+        // Structured view of the agents LISA dispatched fire-and-forget (the ledger).
+        // Complements /api/agent/signal's action:"list" (which returns prose): this is
+        // JSON for clients (the iOS roster). Structural only — never the captured log.
+        if (req.method === "GET" && url === "/api/dispatch/list") {
+            const dispatches = listRecentDispatches().map((e) => toDispatchView(e, isAlive(e.pid)));
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ dispatches }));
+            return;
+        }
+        // Status + captured-output tail of ONE dispatched agent. The tail is raw
+        // stdout (potentially sensitive), so it's behind the remote-control gate
+        // (loopback always; remote per policy). ?id=<dispatch id>.
+        if (req.method === "GET" && url.startsWith("/api/dispatch/status")) {
+            if (denyRemote("control"))
+                return;
+            const id = new URL(url, "http://localhost").searchParams.get("id") ?? "";
+            const entry = id ? listRecentDispatches().find((e) => e.id === id) : undefined;
+            if (!entry) {
+                res.writeHead(id ? 404 : 400, { "content-type": "application/json" });
+                res.end(JSON.stringify({ ok: false, error: id ? "no such dispatch" : "id required" }));
+                return;
+            }
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({
+                ok: true,
+                ...toDispatchView(entry, isAlive(entry.pid)),
+                tail: readDispatchOutput(entry, 4000),
+            }));
+            return;
+        }
+        if (req.method === "POST" && url === "/api/agents/managed/start") {
+            if (denyRemote("control"))
+                return;
+            let mBody = "";
+            for await (const chunk of req)
+                mBody += chunk.toString("utf8");
+            let payload;
+            try {
+                payload = JSON.parse(mBody || "{}");
+            }
+            catch {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("bad json");
+                return;
+            }
+            if (typeof payload.task !== "string" || !payload.task.trim()) {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("task required");
+                return;
+            }
+            const cwd = typeof payload.cwd === "string" && payload.cwd.startsWith("/") ? payload.cwd : process.cwd();
+            // A managed agent doesn't control other agents — drop dispatch/signal.
+            const tools = opts.tools.filter((t) => t.name !== "dispatch_agent" && t.name !== "signal_agent");
+            const systemPrompt = `You are a delegated agent working in ${cwd}, launched by the user through Lisa. ` +
+                `Complete the user's task using the available tools, then report what you did concisely. ` +
+                `Mutating actions (writes, shell, etc.) pause for the user's approval — keep going after each decision.`;
+            const view = managedRegistry.start({
+                task: payload.task,
+                cwd,
+                systemPrompt,
+                tools,
+                model: typeof payload.model === "string" ? payload.model : opts.model,
+            });
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ ok: true, agent: view }));
+            return;
+        }
+        if (req.method === "POST" && url.startsWith("/api/agents/managed/")) {
+            if (denyRemote("control"))
+                return;
+            const rest = url.slice("/api/agents/managed/".length);
+            const slash = rest.indexOf("/");
+            const id = slash >= 0 ? rest.slice(0, slash) : rest;
+            const action = slash >= 0 ? rest.slice(slash + 1) : "";
+            let mBody = "";
+            for await (const chunk of req)
+                mBody += chunk.toString("utf8");
+            let payload = {};
+            try {
+                payload = mBody ? JSON.parse(mBody) : {};
+            }
+            catch { /* tolerate empty/none */ }
+            let ok = false;
+            if (action === "send" && typeof payload.text === "string")
+                ok = managedRegistry.send(id, payload.text);
+            else if (action === "cancel")
+                ok = managedRegistry.cancel(id);
+            else if (action === "approve")
+                ok = managedRegistry.decide(id, payload.allow !== false);
+            else {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("action must be send|cancel|approve");
+                return;
+            }
+            res.writeHead(ok ? 200 : 404, { "content-type": "application/json" });
+            res.end(JSON.stringify({ ok }));
+            return;
+        }
+        // ── PTY agents (Stage C spike, off unless LISA_PTY_AGENTS=1) ─────────
+        // Real `claude`/`codex` CLIs LISA spawns under a pseudo-terminal: it types
+        // your task + follow-ups and can read the terminal tail. Behind the same
+        // auth gate; 503 when the spike flag is off / node-pty is absent.
+        if (req.method === "POST" && url === "/api/agents/pty/start") {
+            let pBody = "";
+            for await (const chunk of req)
+                pBody += chunk.toString("utf8");
+            let payload;
+            try {
+                payload = JSON.parse(pBody || "{}");
+            }
+            catch {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("bad json");
+                return;
+            }
+            if (!ptyEnabled()) {
+                res.writeHead(503, { "content-type": "text/plain" });
+                res.end("PTY agents are disabled — set LISA_PTY_AGENTS=1 to enable this spike");
+                return;
+            }
+            const agent = typeof payload.agent === "string" && payload.agent.trim() ? payload.agent : "claude";
+            const resumeSessionId = typeof payload.resumeSessionId === "string" && payload.resumeSessionId ? payload.resumeSessionId : undefined;
+            // Adopting an external session is the highest-risk control action — gate it
+            // behind remoteAdoptExternal; starting a fresh agent is ordinary control.
+            if (denyRemote(resumeSessionId ? "adoptExternal" : "control"))
+                return;
+            // Adopting an existing session needs no task (it continues the convo); a
+            // fresh agent does. Guard: never resume a session that's currently live.
+            if (!resumeSessionId && (typeof payload.task !== "string" || !payload.task.trim())) {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("task required");
+                return;
+            }
+            if (resumeSessionId && liveClaudeSessionIds().has(resumeSessionId)) {
+                res.writeHead(409, { "content-type": "text/plain" });
+                res.end("that session is currently live (open in the app/terminal) — close it first; resuming a live session would corrupt its transcript");
+                return;
+            }
+            const cwd = typeof payload.cwd === "string" && payload.cwd.startsWith("/") ? payload.cwd : process.cwd();
+            try {
+                const view = await ptyRegistry.start({
+                    agent,
+                    task: typeof payload.task === "string" ? payload.task : "",
+                    cwd,
+                    resumeSessionId,
+                });
+                res.writeHead(200, { "content-type": "application/json" });
+                res.end(JSON.stringify({ ok: true, agent: view }));
+            }
+            catch (err) {
+                res.writeHead(503, { "content-type": "text/plain" });
+                res.end(err.message);
+            }
+            return;
+        }
+        if (req.method === "GET" && url.startsWith("/api/agents/pty/") && url.endsWith("/output")) {
+            if (denyRemote("control"))
+                return;
+            const id = url.slice("/api/agents/pty/".length, -"/output".length);
+            const out = ptyRegistry.output(decodeURIComponent(id));
+            if (out === null) {
+                res.writeHead(404, { "content-type": "application/json" });
+                res.end(JSON.stringify({ ok: false }));
+                return;
+            }
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ ok: true, output: out }));
+            return;
+        }
+        // Live attach stream for a PTY agent: the current output tail (snapshot), then
+        // each new ANSI-stripped chunk as it arrives. Drives `lisa agents pty`
+        // (adopt-at-launch) and a remote live-output view. Same auth gate; 404 if unknown.
+        if (req.method === "GET" && url.startsWith("/api/agents/pty/") && url.endsWith("/stream")) {
+            if (denyRemote("control"))
+                return;
+            const id = decodeURIComponent(url.slice("/api/agents/pty/".length, -"/stream".length));
+            const initial = ptyRegistry.output(id);
+            if (initial === null) {
+                res.writeHead(404, { "content-type": "application/json" });
+                res.end(JSON.stringify({ ok: false }));
+                return;
+            }
+            res.writeHead(200, {
+                "content-type": "text/event-stream",
+                "cache-control": "no-cache",
+                connection: "keep-alive",
+            });
+            res.write(`data: ${JSON.stringify({ type: "snapshot", text: initial })}\n\n`);
+            const onOut = (e) => {
+                if (e.id !== id)
+                    return;
+                try {
+                    res.write(`data: ${JSON.stringify({ type: "chunk", text: e.chunk })}\n\n`);
+                }
+                catch {
+                    /* dead connection — cleaned up on close */
+                }
+            };
+            // End the stream when the agent finishes, so an attach client exits cleanly.
+            const onUpdate = (v) => {
+                if (v.id !== id || v.state !== "done")
+                    return;
+                try {
+                    res.write(`data: ${JSON.stringify({ type: "end", state: v.state })}\n\n`);
+                    res.end();
+                }
+                catch {
+                    /* already closed */
+                }
+            };
+            ptyRegistry.on("output", onOut);
+            ptyRegistry.on("update", onUpdate);
+            req.on("close", () => {
+                ptyRegistry.off("output", onOut);
+                ptyRegistry.off("update", onUpdate);
+            });
+            return;
+        }
+        if (req.method === "POST" && url.startsWith("/api/agents/pty/")) {
+            if (denyRemote("control"))
+                return;
+            const rest = url.slice("/api/agents/pty/".length);
+            const slash = rest.indexOf("/");
+            const id = decodeURIComponent(slash >= 0 ? rest.slice(0, slash) : rest);
+            const action = slash >= 0 ? rest.slice(slash + 1) : "";
+            let pBody = "";
+            for await (const chunk of req)
+                pBody += chunk.toString("utf8");
+            let payload = {};
+            try {
+                payload = pBody ? JSON.parse(pBody) : {};
+            }
+            catch { /* tolerate */ }
+            let ok = false;
+            if (action === "send" && typeof payload.text === "string")
+                ok = ptyRegistry.send(id, payload.text);
+            else if (action === "cancel")
+                ok = ptyRegistry.cancel(id);
+            else {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("action must be send|cancel");
+                return;
+            }
+            res.writeHead(ok ? 200 : 404, { "content-type": "application/json" });
+            res.end(JSON.stringify({ ok }));
+            return;
+        }
+        // Recent ambient sense events, for the island's "recently sensed" list.
+        if (req.method === "GET" && url === "/api/sense/recent") {
+            const events = readSenseEvents().slice(-30).reverse(); // newest first
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ events }));
+            return;
+        }
+        if (req.method === "POST" && url === "/api/consent/revoke-all") {
+            revokeAll();
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ ok: true, grants: listGrants() }));
+            return;
+        }
+        if (req.method === "POST" &&
+            (url === "/api/consent/grant" || url === "/api/consent/revoke")) {
+            let cBody = "";
+            for await (const chunk of req)
+                cBody += chunk.toString("utf8");
+            let payload;
+            try {
+                payload = JSON.parse(cBody || "{}");
+            }
+            catch {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("bad json");
+                return;
+            }
+            const signal = payload.signal;
+            // Only the canonical sense signals are togglable from the UI.
+            if (typeof signal !== "string" || !SENSE_SIGNALS.includes(signal)) {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end(`signal must be one of: ${SENSE_SIGNALS.join(", ")}`);
+                return;
+            }
+            if (url === "/api/consent/grant")
+                grant(signal);
+            else
+                revoke(signal);
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ ok: true, grants: listGrants() }));
+            return;
+        }
         // Cross-agent session snapshot (O1). Returns every active session
         // across all integrations, normalized. activity (Tier 2) is present
         // when the integration runs at visibility ≥ "activity".
         if (req.method === "GET" && url === "/api/agents/sessions") {
+            // Mark idle claude sessions as adoptable: not currently live (no running
+            // owner ⇒ `claude --resume` is safe) and not already a LISA-controlled row.
+            const live = liveClaudeSessionIds();
             const sessions = hub.list().map((s) => ({
                 ...s,
                 lastMtime: new Date(s.lastMtime).toISOString(),
+                ...(s.agent === "claude-code" && !s.controllable && !live.has(s.sessionId)
+                    ? { resumable: true }
+                    : {}),
             }));
             res.writeHead(200, { "content-type": "application/json" });
             res.end(JSON.stringify({ sessions }));
@@ -696,6 +1404,68 @@ self.addEventListener('fetch', (event) => {
             }));
             return;
         }
+        // ── Coding plans (CODING_PLANS Phase 5b): detect, show usage, pick a
+        //    delegation target. Detection is presence-only (no secrets read); the
+        //    POST writes LISA_CODING_PLAN, not the model — her own loop is unchanged.
+        if (req.method === "GET" && url === "/api/plans") {
+            const nowMs = Date.now();
+            const sel = selectedPlan();
+            const plans = detectPlans().map((p) => {
+                const row = {
+                    id: p.id,
+                    label: p.label,
+                    cli: p.cli,
+                    detail: p.detail,
+                    available: p.available,
+                    loggedIn: p.loggedIn,
+                    mark: planMark(p),
+                    selected: p.id === sel,
+                };
+                if (p.available) {
+                    const u = planUsage(p.id, nowMs);
+                    if (u && (u.windowTokens || u.todayTokens))
+                        row.usage = formatUsage(u);
+                }
+                return row;
+            });
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ plans, selected: sel }));
+            return;
+        }
+        if (req.method === "POST" && url === "/api/plans/select") {
+            let body = "";
+            for await (const chunk of req)
+                body += chunk.toString("utf8");
+            let payload;
+            try {
+                payload = JSON.parse(body || "{}");
+            }
+            catch {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("bad json");
+                return;
+            }
+            const raw = typeof payload.plan === "string" ? payload.plan.trim().toLowerCase() : "";
+            const planId = raw === "" || raw === "none"
+                ? ""
+                : (parsePlanRef(raw) ?? (PLAN_IDS.includes(raw) ? raw : null));
+            if (planId === null) {
+                res.writeHead(400, { "content-type": "text/plain" });
+                res.end("unknown plan — use claude | codex | copilot | none");
+                return;
+            }
+            try {
+                await saveConfigEnv({ LISA_CODING_PLAN: planId });
+            }
+            catch (err) {
+                res.writeHead(500, { "content-type": "text/plain" });
+                res.end(err.message);
+                return;
+            }
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ ok: true, selected: planId || null }));
+            return;
+        }
         if (req.method === "GET" && url === "/api/config/status") {
             res.writeHead(200, { "content-type": "application/json" });
             res.end(JSON.stringify({
@@ -847,7 +1617,23 @@ self.addEventListener('fetch', (event) => {
             let body = "";
             for await (const chunk of req)
                 body += chunk.toString("utf8");
-            const { message, files } = JSON.parse(body);
+            let message;
+            let files;
+            try {
+                // Every other endpoint guards its JSON.parse — this one used to be the
+                // only one that didn't, and a malformed body left the socket hanging.
+                const parsed = JSON.parse(body);
+                if (typeof parsed.message !== "string" || !parsed.message.trim()) {
+                    throw new Error("missing message");
+                }
+                message = parsed.message;
+                files = parsed.files;
+            }
+            catch (err) {
+                res.writeHead(400, { "content-type": "application/json" });
+                res.end(JSON.stringify({ error: `bad request: ${err.message}` }));
+                return;
+            }
             // User just talked — reset the idle watcher.
             try {
                 getIdleWatcher(60 * 60_000).tick();
@@ -863,64 +1649,92 @@ self.addEventListener('fetch', (event) => {
             moodBus.on("mood", onMood);
             // Send the current mood immediately so a fresh tab knows where to start.
             send({ type: "mood", slug: moodBus.current() });
-            try {
-                // Use the freshest cached prompt for this chat. If soul / skills /
-                // memory changed since the previous chat, rebuildPrompt() picks it up.
-                const fresh = await rebuildPrompt();
-                const result = await runAgent({
-                    provider: getProvider(),
-                    systemPrompt: fresh.text,
-                    tools: opts.tools,
-                    toolCtx: {
-                        cwd: process.cwd(),
-                        signal: abort.signal,
-                        log: () => { },
-                    },
-                    history,
-                    userMessage: message,
-                    userFiles: files,
-                    model: opts.model,
-                    thinking: opts.thinking,
-                    onEvent: (ev) => {
-                        if (ev.type === "text_delta" && ev.text)
-                            send({ type: "text", text: ev.text });
-                        if (ev.type === "tool_call_start")
-                            send({
-                                type: "tool_start",
-                                name: ev.toolName,
-                                input: ev.toolInput,
-                            });
-                        if (ev.type === "tool_call_end")
-                            send({
-                                type: "tool_end",
-                                name: ev.toolName,
-                                isError: ev.isError === true,
-                                resultPreview: typeof ev.toolResult === "string"
-                                    ? ev.toolResult.slice(0, 200)
-                                    : "",
-                            });
-                        if (ev.type === "system_prompt_rebuilt")
-                            send({ type: "soul_reload", message: ev.message ?? "" });
-                        if (ev.type === "error")
-                            send({ type: "error", message: ev.message ?? "" });
-                    },
-                    onMessagePersist: (m) => session.appendMessage(m),
-                    hotReload: {
-                        initialFingerprint: fresh.fingerprint,
-                        rebuild: rebuildPrompt,
-                    },
-                });
-                history.length = 0;
-                history.push(...result.history);
-                send({ type: "done" });
-            }
-            catch (err) {
-                send({ type: "error", message: err.message });
-            }
-            finally {
-                moodBus.off("mood", onMood);
-                res.end();
-            }
+            const runTurn = async () => {
+                try {
+                    // Use the freshest cached prompt for this chat. If soul / skills /
+                    // memory changed since the previous chat, rebuildPrompt() picks it up.
+                    const fresh = await rebuildPrompt();
+                    const result = await runAgent({
+                        provider: getProvider(),
+                        systemPrompt: fresh.text,
+                        tools: opts.tools,
+                        toolCtx: {
+                            cwd: process.cwd(),
+                            signal: abort.signal,
+                            log: () => { },
+                        },
+                        history,
+                        userMessage: message,
+                        userFiles: files,
+                        model: opts.model,
+                        thinking: opts.thinking,
+                        onEvent: (ev) => {
+                            if (ev.type === "text_delta" && ev.text)
+                                send({ type: "text", text: ev.text });
+                            if (ev.type === "tool_call_start")
+                                send({
+                                    type: "tool_start",
+                                    name: ev.toolName,
+                                    input: ev.toolInput,
+                                });
+                            if (ev.type === "tool_call_end")
+                                send({
+                                    type: "tool_end",
+                                    name: ev.toolName,
+                                    isError: ev.isError === true,
+                                    resultPreview: typeof ev.toolResult === "string"
+                                        ? ev.toolResult.slice(0, 200)
+                                        : "",
+                                });
+                            if (ev.type === "system_prompt_rebuilt")
+                                send({ type: "soul_reload", message: ev.message ?? "" });
+                            if (ev.type === "error")
+                                send({ type: "error", message: ev.message ?? "" });
+                        },
+                        // Same plugin hook wiring as the CLI turn — PreToolUse can block,
+                        // PostToolUse can rewrite. (Was CLI-only; web tool calls bypassed
+                        // every configured hook.)
+                        preToolHook: hooks.length === 0 ? undefined : async (name, input) => {
+                            const r = await fireHooks("PreToolUse", hooks, { TOOL_NAME: name, TOOL_INPUT: JSON.stringify(input), SESSION_ID: session.id, LISA_HOME, CLAUDE_PROJECT_DIR: process.cwd() }, process.cwd());
+                            if (r.blocked.length > 0)
+                                return { block: r.blocked.join("; ") };
+                        },
+                        postToolHook: hooks.length === 0 ? undefined : async (name, input, result, isError) => {
+                            const r = await fireHooks("PostToolUse", hooks, {
+                                TOOL_NAME: name,
+                                TOOL_INPUT: JSON.stringify(input),
+                                TOOL_RESULT: result,
+                                TOOL_ERROR: isError ? "1" : "",
+                                SESSION_ID: session.id,
+                                LISA_HOME,
+                                CLAUDE_PROJECT_DIR: process.cwd(),
+                            }, process.cwd());
+                            if (r.rewriteResult != null)
+                                return { rewriteResult: r.rewriteResult };
+                        },
+                        onMessagePersist: (m) => session.appendMessage(m),
+                        hotReload: {
+                            initialFingerprint: fresh.fingerprint,
+                            rebuild: rebuildPrompt,
+                        },
+                    });
+                    history.length = 0;
+                    history.push(...result.history);
+                    send({ type: "done" });
+                }
+                catch (err) {
+                    send({ type: "error", message: err.message });
+                }
+                finally {
+                    moodBus.off("mood", onMood);
+                    res.end();
+                }
+            };
+            // Queue behind any in-flight turn; the SSE stream stays open while we
+            // wait, so the second tab just sees its reply start a little later.
+            const job = chatChain.then(runTurn, runTurn);
+            chatChain = job.then(() => { }, () => { });
+            await job;
             return;
         }
         if (req.method === "POST" && url === "/reflect") {
@@ -942,7 +1756,7 @@ self.addEventListener('fetch', (event) => {
         res.writeHead(404);
         res.end();
     });
-    server.listen(opts.port);
+    server.listen(opts.port, host);
     return server;
 }
 //# sourceMappingURL=server.js.map