@orion-agents/orion-code 0.2.2 → 0.3.1

package/dist/web/server.js

@@ -0,0 +1,744 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startOrionWebServer = startOrionWebServer;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const http_1 = require("http");
+const path_1 = require("path");
+const version_1 = require("../product/version");
+const redaction_1 = require("../services/redaction");
+const protocol_1 = require("./protocol");
+const errors_1 = require("./errors");
+const terminal_server_1 = require("./terminal-server");
+const workbench_controller_1 = require("./workbench-controller");
+const HOST = '127.0.0.1';
+const API_PREFIX = '/api/v1';
+async function startOrionWebServer(options) {
+    const requestedPort = options.port ?? 3080;
+    if (!Number.isSafeInteger(requestedPort) || requestedPort < 0 || requestedPort > 65535) {
+        throw new Error('Web port must be an integer from 0 through 65535.');
+    }
+    const nonce = options.nonce ?? (0, crypto_1.randomBytes)(32).toString('base64url');
+    if (!/^[A-Za-z0-9_-]+$/u.test(nonce)) {
+        throw new Error('Web nonce must use unpadded base64url characters.');
+    }
+    const workbench = options.workbench ?? (await workbench_controller_1.WebWorkbenchController.create({ cwd: options.cwd }));
+    const staticRoot = options.staticRoot ?? resolveDefaultStaticRoot();
+    let origin = '';
+    let closing;
+    const server = (0, http_1.createServer)((request, response) => {
+        void handleRequest({ request, response, nonce, origin, staticRoot, workbench }).catch(error => {
+            if (response.headersSent) {
+                response.destroy();
+                return;
+            }
+            sendProblem(response, error);
+        });
+    });
+    const terminalSockets = (0, terminal_server_1.attachTerminalWebSocketServer)(server, () => origin, workbench.terminalManager);
+    server.requestTimeout = 30000;
+    server.headersTimeout = 15000;
+    server.keepAliveTimeout = 5000;
+    server.maxHeadersCount = 64;
+    await listen(server, requestedPort);
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        await workbench.shutdown();
+        throw new Error('Web server did not expose a TCP address.');
+    }
+    const port = address.port;
+    origin = `http://${HOST}:${port}`;
+    const heartbeat = setInterval(() => workbench.eventHub.heartbeat(), 15000);
+    heartbeat.unref();
+    const close = () => {
+        if (closing)
+            return closing;
+        closing = (async () => {
+            clearInterval(heartbeat);
+            await terminalSockets.close();
+            await workbench.shutdown();
+            await closeServer(server);
+        })();
+        return closing;
+    };
+    return Object.freeze({ host: HOST, port, url: origin, nonce, workbench, server, close });
+}
+async function handleRequest(context) {
+    const { request, response } = context;
+    applySecurityHeaders(response, context.nonce);
+    assertHost(request, context.origin);
+    const url = new URL(request.url ?? '/', context.origin);
+    if (!url.pathname.startsWith(API_PREFIX)) {
+        await serveStatic(request, response, url.pathname, context.staticRoot);
+        return;
+    }
+    const path = url.pathname.slice(API_PREFIX.length) || '/';
+    const method = request.method ?? 'GET';
+    if (method === 'GET' && path === '/health') {
+        sendJson(response, 200, { ok: true, version: version_1.PACKAGE_VERSION });
+        return;
+    }
+    if (method === 'GET' && path === '/bootstrap') {
+        sendJson(response, 200, context.workbench.bootstrap(context.nonce));
+        return;
+    }
+    if (method === 'GET' && path === '/events') {
+        openEventStream(request, response, url, context.workbench);
+        return;
+    }
+    if (method === 'GET' && path === '/workspaces') {
+        sendJson(response, 200, collectionPage(url, 'workspaces', context.workbench.listWorkspaces(), workspace => workspace.id));
+        return;
+    }
+    const workspaceSessionsMatch = path.match(/^\/workspaces\/([^/]+)\/sessions$/);
+    if (method === 'GET' && workspaceSessionsMatch) {
+        const workspaceId = safeDecodePathSegment(workspaceSessionsMatch[1]);
+        sendJson(response, 200, collectionPage(url, `workspace-sessions-${workspaceId}`, context.workbench.listWorkspaceSessions(workspaceId), session => session.id));
+        return;
+    }
+    const workspaceSummaryMatch = path.match(/^\/workspaces\/([^/]+)\/summary$/);
+    if (method === 'GET' && workspaceSummaryMatch) {
+        const workspaceId = requireUuid(safeDecodePathSegment(workspaceSummaryMatch[1]), 'workspaceId');
+        sendJson(response, 200, await context.workbench.workspaceProjectSummary(workspaceId));
+        return;
+    }
+    const workspacePinMatch = path.match(/^\/workspaces\/([^/]+)\/pin$/);
+    if (method === 'POST' && workspacePinMatch) {
+        assertMutation(request, context.nonce, context.origin);
+        const body = requireRecord(await readJson(request), 'Workspace pin request');
+        assertOnlyKeys(body, ['requestId', 'pinned', 'expectedContextRevision', 'workspaceId']);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const contextGuard = requireContextGuardRecord(body);
+        if (typeof body.pinned !== 'boolean') {
+            throw new errors_1.WebWorkbenchError(400, 'pinned must be a boolean.', 'invalid_request');
+        }
+        const workspaceId = requireUuid(safeDecodePathSegment(workspacePinMatch[1]), 'workspaceId');
+        const result = await context.workbench.executeMutation(requestId, 'workspace.pin', { targetWorkspaceId: workspaceId, pinned: body.pinned, ...contextGuard }, () => ({
+            requestId,
+            workspace: context.workbench.setWorkspacePinned(workspaceId, body.pinned, contextGuard),
+        }));
+        sendJson(response, 200, result);
+        return;
+    }
+    const workspaceRemoveMatch = path.match(/^\/workspaces\/([^/]+)$/);
+    if (method === 'DELETE' && workspaceRemoveMatch) {
+        assertMutation(request, context.nonce, context.origin);
+        const body = requireRecord(await readJson(request), 'Workspace removal request');
+        assertOnlyKeys(body, ['requestId', 'expectedContextRevision', 'workspaceId']);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const contextGuard = requireContextGuardRecord(body);
+        const workspaceId = requireUuid(safeDecodePathSegment(workspaceRemoveMatch[1]), 'workspaceId');
+        const result = await context.workbench.executeMutation(requestId, 'workspace.remove', { targetWorkspaceId: workspaceId, ...contextGuard }, () => {
+            context.workbench.removeWorkspace(workspaceId, contextGuard);
+            return { requestId, removed: true };
+        });
+        sendJson(response, 200, result);
+        return;
+    }
+    if (method === 'POST' && path === '/context/activate') {
+        assertMutation(request, context.nonce, context.origin);
+        const body = (0, protocol_1.parseWebContextActivate)(await readJson(request));
+        const result = await context.workbench.executeMutation(body.requestId, 'context.activate', {
+            expectedContextRevision: body.expectedContextRevision,
+            workspaceId: body.workspaceId,
+            sessionId: body.sessionId,
+        }, async () => {
+            await context.workbench.activateContext(body);
+            return {
+                requestId: body.requestId,
+                contextRevision: context.workbench.contextRevision,
+                bootstrap: context.workbench.bootstrap(context.nonce),
+            };
+        });
+        sendJson(response, 200, result);
+        return;
+    }
+    if (method === 'POST' && path === '/workspaces/activate') {
+        assertMutation(request, context.nonce, context.origin);
+        const body = requireRecord(await readJson(request), 'Workspace request');
+        assertOnlyKeys(body, ['requestId', 'path', 'expectedContextRevision', 'workspaceId']);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const contextGuard = requireContextGuardRecord(body);
+        const workspace = requireText(body.path, 'path', 4096);
+        const result = await context.workbench.executeMutation(requestId, 'workspace.activate', { path: workspace, ...contextGuard }, async () => {
+            await context.workbench.switchWorkspace(workspace, contextGuard);
+            return {
+                requestId,
+                active: context.workbench.workspace,
+                page: (0, workbench_controller_1.pageCollectionItems)('workspaces', context.workbench.listWorkspaces(), undefined, 50, workspace => workspace.id),
+            };
+        });
+        sendJson(response, 200, result);
+        return;
+    }
+    if (method === 'GET' && path === '/sessions') {
+        const contextGuard = requireContextGuardQuery(url);
+        sendJson(response, 200, collectionPage(url, 'sessions', context.workbench.listSessions(contextGuard), session => session.id));
+        return;
+    }
+    if (method === 'POST' && path === '/sessions') {
+        assertMutation(request, context.nonce, context.origin);
+        const body = requireRecord(await readJson(request), 'Session request');
+        assertOnlyKeys(body, ['requestId', 'name', 'expectedContextRevision', 'workspaceId']);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const contextGuard = requireContextGuardRecord(body);
+        const name = body.name === undefined ? undefined : requireText(body.name, 'name', 120);
+        const result = await context.workbench.executeMutation(requestId, 'session.create', { name, ...contextGuard }, async () => ({
+            requestId,
+            session: await context.workbench.createSession(name, contextGuard),
+        }));
+        sendJson(response, 201, result);
+        return;
+    }
+    const activateMatch = path.match(/^\/sessions\/([^/]+)\/activate$/);
+    if (method === 'POST' && activateMatch) {
+        assertMutation(request, context.nonce, context.origin);
+        const body = requireRecord(await readJson(request), 'Session activation request');
+        assertOnlyKeys(body, ['requestId', 'expectedContextRevision', 'workspaceId']);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const contextGuard = requireContextGuardRecord(body);
+        const sessionId = safeDecodePathSegment(activateMatch[1]);
+        const result = await context.workbench.executeMutation(requestId, 'session.activate', { sessionId, ...contextGuard }, async () => ({
+            ...(await context.workbench.activateSession(sessionId, contextGuard)),
+            requestId,
+        }));
+        sendJson(response, 200, result);
+        return;
+    }
+    const snapshotMatch = path.match(/^\/sessions\/([^/]+)\/snapshot$/);
+    if (method === 'GET' && snapshotMatch) {
+        const contextGuard = requireContextGuardQuery(url);
+        sendJson(response, 200, context.workbench.sessionSnapshot(safeDecodePathSegment(snapshotMatch[1]), url.searchParams.get('cursor') ?? undefined, pageSize(url), url.searchParams.get('tail') === '1', contextGuard));
+        return;
+    }
+    const sessionMatch = path.match(/^\/sessions\/([^/]+)$/);
+    if (method === 'PATCH' && sessionMatch) {
+        assertMutation(request, context.nonce, context.origin);
+        const body = requireRecord(await readJson(request), 'Session update request');
+        assertOnlyKeys(body, ['requestId', 'name', 'expectedContextRevision', 'workspaceId']);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const contextGuard = requireContextGuardRecord(body);
+        const name = typeof body.name === 'string' ? body.name : '';
+        const sessionId = safeDecodePathSegment(sessionMatch[1]);
+        const result = await context.workbench.executeMutation(requestId, 'session.rename', { sessionId, name, ...contextGuard }, () => ({
+            requestId,
+            session: context.workbench.renameSession(sessionId, name, contextGuard),
+        }));
+        sendJson(response, 200, result);
+        return;
+    }
+    if (method === 'POST' && path === '/commands') {
+        assertMutation(request, context.nonce, context.origin);
+        sendJson(response, 202, await context.workbench.dispatch(await readJson(request)));
+        return;
+    }
+    if (method === 'GET' && path === '/settings') {
+        sendJson(response, 200, await context.workbench.settings());
+        return;
+    }
+    if (method === 'PATCH' && path === '/settings') {
+        assertMutation(request, context.nonce, context.origin, 'settings_write_forbidden');
+        const body = (0, protocol_1.parseWebSettingsUpdate)(await readJson(request));
+        const result = await context.workbench.executeMutation(body.requestId, 'settings.update', { expectedRevision: body.expectedRevision, operations: body.operations }, async () => ({ requestId: body.requestId, ...(await context.workbench.updateSettings(body)) }));
+        sendJson(response, 200, result);
+        return;
+    }
+    if (method === 'POST' && path === '/settings/open-document') {
+        assertMutation(request, context.nonce, context.origin, 'settings_write_forbidden');
+        const { requestId } = (0, protocol_1.parseWebOpenSettingsDocument)(await readJson(request));
+        const result = await context.workbench.executeMutation(requestId, 'settings.open-document', {}, async () => ({ requestId, opened: await context.workbench.openSettingsDocument() }));
+        sendJson(response, 200, result);
+        return;
+    }
+    if (method === 'GET' && path === '/skills') {
+        sendJson(response, 200, collectionPage(url, 'skills', await context.workbench.skills(), skill => skill.id));
+        return;
+    }
+    if (method === 'GET' && path === '/mcp') {
+        sendJson(response, 200, collectionPage(url, 'mcp', context.workbench.mcp(), server => server.id));
+        return;
+    }
+    if (method === 'GET' && path === '/files') {
+        const contextGuard = requireContextGuardQuery(url);
+        sendJson(response, 200, context.workbench.listFiles(contextGuard, {
+            ...(url.searchParams.get('parentId')
+                ? { parentId: url.searchParams.get('parentId') }
+                : {}),
+            ...(url.searchParams.get('cursor')
+                ? { cursor: url.searchParams.get('cursor') }
+                : {}),
+            pageSize: pageSize(url),
+        }));
+        return;
+    }
+    const fileContentMatch = path.match(/^\/files\/([^/]+)\/content$/);
+    if (method === 'GET' && fileContentMatch) {
+        const contextGuard = requireContextGuardQuery(url);
+        sendJson(response, 200, context.workbench.readFileContent(contextGuard, {
+            fileId: safeDecodePathSegment(fileContentMatch[1]),
+            ...(url.searchParams.get('cursor')
+                ? { cursor: url.searchParams.get('cursor') }
+                : {}),
+            limitBytes: boundedInteger(url.searchParams.get('limitBytes'), 64 * 1024, 1, 256 * 1024),
+        }));
+        return;
+    }
+    if (method === 'GET' && path === '/git/status') {
+        const contextGuard = requireContextGuardQuery(url);
+        sendJson(response, 200, await context.workbench.gitStatus(contextGuard, {
+            ...(url.searchParams.get('cursor')
+                ? { cursor: url.searchParams.get('cursor') }
+                : {}),
+            pageSize: boundedInteger(url.searchParams.get('pageSize'), 200, 1, 2000),
+        }));
+        return;
+    }
+    if (method === 'GET' && path === '/git/log') {
+        const contextGuard = requireContextGuardQuery(url);
+        sendJson(response, 200, await context.workbench.gitLog(contextGuard, {
+            ...(url.searchParams.get('cursor')
+                ? { cursor: url.searchParams.get('cursor') }
+                : {}),
+            pageSize: boundedInteger(url.searchParams.get('pageSize'), 30, 1, 100),
+        }));
+        return;
+    }
+    const gitDiffMatch = path.match(/^\/git\/diff\/([^/]+)$/);
+    if (method === 'GET' && gitDiffMatch) {
+        const contextGuard = requireContextGuardQuery(url);
+        sendJson(response, 200, await context.workbench.gitDiff(contextGuard, {
+            fileId: safeDecodePathSegment(gitDiffMatch[1]),
+            ...(url.searchParams.get('cursor')
+                ? { cursor: url.searchParams.get('cursor') }
+                : {}),
+            lineLimit: boundedInteger(url.searchParams.get('lineLimit'), 240, 1, 500),
+            byteLimit: boundedInteger(url.searchParams.get('byteLimit'), 256 * 1024, 1024, 1024 * 1024),
+        }));
+        return;
+    }
+    if (method === 'GET' && path === '/review') {
+        sendJson(response, 200, await context.workbench.review(requireContextGuardQuery(url)));
+        return;
+    }
+    if (method === 'GET' && path === '/terminals') {
+        const contextGuard = requireContextGuardQuery(url);
+        sendJson(response, 200, collectionPage(url, 'terminals', context.workbench.listTerminals(contextGuard), terminal => terminal.id));
+        return;
+    }
+    if (method === 'POST' && path === '/terminals') {
+        assertMutation(request, context.nonce, context.origin, 'terminal_create_forbidden');
+        assertTerminalUserGesture(request);
+        const body = requireRecord(await readJson(request), 'Terminal create request');
+        assertOnlyKeys(body, ['requestId', 'expectedContextRevision', 'workspaceId', 'cols', 'rows']);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const expectedContextRevision = requireUuid(body.expectedContextRevision, 'expectedContextRevision');
+        const workspaceId = requireUuid(body.workspaceId, 'workspaceId');
+        const cols = boundedIntegerValue(body.cols, 100, 2, 400, 'cols');
+        const rows = boundedIntegerValue(body.rows, 30, 1, 200, 'rows');
+        const result = await context.workbench.executeMutation(requestId, 'terminal.create', { expectedContextRevision, workspaceId, cols, rows }, () => ({
+            requestId,
+            ...context.workbench.terminalManager.create({
+                expectedContextRevision,
+                workspaceId,
+                cols,
+                rows,
+            }),
+        }));
+        sendJson(response, 201, result);
+        return;
+    }
+    const terminalTicketMatch = path.match(/^\/terminals\/([^/]+)\/attach-ticket$/);
+    if (method === 'POST' && terminalTicketMatch) {
+        assertMutation(request, context.nonce, context.origin, 'terminal_attach_forbidden');
+        const body = requireRecord(await readJson(request), 'Terminal ticket request');
+        assertOnlyKeys(body, ['requestId', 'expectedContextRevision', 'workspaceId']);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const expectedContextRevision = requireUuid(body.expectedContextRevision, 'expectedContextRevision');
+        const workspaceId = requireUuid(body.workspaceId, 'workspaceId');
+        const terminalId = safeDecodePathSegment(terminalTicketMatch[1]);
+        const result = await context.workbench.executeMutation(requestId, 'terminal.attach-ticket', { terminalId, expectedContextRevision, workspaceId }, () => ({
+            requestId,
+            ...context.workbench.terminalManager.issueAttachTicket({
+                terminalId,
+                expectedContextRevision,
+                workspaceId,
+            }),
+        }));
+        sendJson(response, 200, result);
+        return;
+    }
+    const terminalMatch = path.match(/^\/terminals\/([^/]+)$/);
+    if (method === 'DELETE' && terminalMatch) {
+        assertMutation(request, context.nonce, context.origin, 'terminal_close_forbidden');
+        const body = requireRecord(await readJson(request), 'Terminal close request');
+        assertOnlyKeys(body, ['requestId', 'expectedContextRevision', 'workspaceId']);
+        const requestId = requireUuid(body.requestId, 'requestId');
+        const expectedContextRevision = requireUuid(body.expectedContextRevision, 'expectedContextRevision');
+        const workspaceId = requireUuid(body.workspaceId, 'workspaceId');
+        const terminalId = safeDecodePathSegment(terminalMatch[1]);
+        const result = await context.workbench.executeMutation(requestId, 'terminal.close', { terminalId, expectedContextRevision, workspaceId }, () => ({
+            requestId,
+            terminal: context.workbench.terminalManager.closeTerminal({
+                terminalId,
+                expectedContextRevision,
+                workspaceId,
+            }),
+        }));
+        sendJson(response, 200, result);
+        return;
+    }
+    if (method === 'GET' && path === '/tool-details') {
+        sendJson(response, 200, collectionPage(url, 'tool-details', await context.workbench.listToolDetails(), detail => `${detail.sequence}:${detail.callId}`));
+        return;
+    }
+    const toolDetailMatch = path.match(/^\/tool-details\/([^/]+)$/);
+    if (method === 'GET' && toolDetailMatch) {
+        const offsetBytes = boundedInteger(url.searchParams.get('offsetBytes'), 0, 0, 2 ** 31 - 1);
+        const limitBytes = boundedInteger(url.searchParams.get('limitBytes'), 64 * 1024, 1, 1024 * 1024);
+        sendJson(response, 200, await context.workbench.readToolDetail(safeDecodePathSegment(toolDetailMatch[1]), offsetBytes, limitBytes));
+        return;
+    }
+    if (method === 'GET' && path === '/diagnostics') {
+        sendJson(response, 200, await context.workbench.diagnostics());
+        return;
+    }
+    throw new HttpProblem(404, 'Route not found.');
+}
+function openEventStream(request, response, url, workbench) {
+    const rawCursor = url.searchParams.get('cursor') ?? request.headers['last-event-id'] ?? '0';
+    const cursor = Number(rawCursor);
+    if (!Number.isSafeInteger(cursor) || cursor < 0) {
+        throw new HttpProblem(400, 'Event cursor must be a non-negative integer.');
+    }
+    response.writeHead(200, {
+        'Content-Type': 'text/event-stream; charset=utf-8',
+        'Cache-Control': 'no-cache, no-store, must-revalidate',
+        Connection: 'keep-alive',
+        'X-Accel-Buffering': 'no',
+    });
+    response.flushHeaders();
+    response.write('retry: 1000\n\n');
+    const detach = workbench.eventHub.attach(response, cursor);
+    request.once('aborted', detach);
+    response.once('close', detach);
+}
+function assertMutation(request, nonce, origin, forbiddenCode = 'request_forbidden') {
+    if (request.headers.origin !== origin) {
+        throw new HttpProblem(403, 'Mutation requires the exact loopback Origin.', forbiddenCode);
+    }
+    const fetchSite = request.headers['sec-fetch-site'];
+    if (fetchSite && fetchSite !== 'same-origin' && fetchSite !== 'none') {
+        throw new HttpProblem(403, 'Cross-site mutation is not allowed.', forbiddenCode);
+    }
+    if (request.headers[protocol_1.WEB_NONCE_HEADER] !== nonce) {
+        throw new HttpProblem(403, 'Invalid Web Workbench nonce.', forbiddenCode);
+    }
+    const contentType = request.headers['content-type']?.split(';', 1)[0]?.trim().toLowerCase();
+    if (contentType !== 'application/json') {
+        throw new HttpProblem(415, 'Mutations require application/json.');
+    }
+}
+function assertTerminalUserGesture(request) {
+    if (request.headers[protocol_1.WEB_USER_GESTURE_HEADER] !== 'terminal-create-v1') {
+        throw new HttpProblem(403, 'Terminal creation requires an explicit browser user gesture.', 'terminal_user_gesture_required');
+    }
+}
+function assertHost(request, origin) {
+    if (!origin)
+        return;
+    const expected = new URL(origin).host;
+    if (request.headers.host !== expected) {
+        throw new HttpProblem(421, 'Request Host does not match the loopback listener.');
+    }
+}
+async function readJson(request) {
+    const declared = Number(request.headers['content-length'] ?? 0);
+    if (Number.isFinite(declared) && declared > protocol_1.WEB_MAX_BODY_BYTES) {
+        throw new HttpProblem(413, 'Request body is too large.');
+    }
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of request) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += buffer.length;
+        if (bytes > protocol_1.WEB_MAX_BODY_BYTES)
+            throw new HttpProblem(413, 'Request body is too large.');
+        chunks.push(buffer);
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch {
+        throw new HttpProblem(400, 'Request body is not valid JSON.');
+    }
+}
+async function serveStatic(request, response, pathname, staticRoot) {
+    if (request.method !== 'GET' && request.method !== 'HEAD') {
+        throw new HttpProblem(405, 'Static assets support only GET and HEAD.');
+    }
+    if (!(0, fs_1.existsSync)(staticRoot) || !(0, fs_1.statSync)(staticRoot).isDirectory()) {
+        throw new HttpProblem(503, 'Web client assets are missing; run npm run build:web.');
+    }
+    const decoded = safeDecode(pathname);
+    const relative = (0, path_1.normalize)(decoded.replace(/^[/\\]+/, ''));
+    if (relative === '..' || relative.startsWith(`..${path_1.sep}`)) {
+        throw new HttpProblem(403, 'Static asset path escapes the Web root.');
+    }
+    const resolvedRoot = (0, path_1.resolve)(staticRoot);
+    const candidate = (0, path_1.resolve)(resolvedRoot, relative || 'index.html');
+    const lexicalBoundary = `${resolvedRoot}${path_1.sep}`;
+    if (candidate !== resolvedRoot && !candidate.startsWith(lexicalBoundary)) {
+        throw new HttpProblem(403, 'Static asset path escapes the Web root.');
+    }
+    const selected = (0, fs_1.existsSync)(candidate) && (0, fs_1.statSync)(candidate).isFile()
+        ? candidate
+        : (0, path_1.join)(resolvedRoot, 'index.html');
+    if (!(0, fs_1.existsSync)(selected) || !(0, fs_1.statSync)(selected).isFile()) {
+        throw new HttpProblem(404, 'Asset not found.');
+    }
+    const canonicalRoot = (0, fs_1.realpathSync)(resolvedRoot);
+    const file = (0, fs_1.realpathSync)(selected);
+    const canonicalBoundary = `${canonicalRoot}${path_1.sep}`;
+    if (file !== canonicalRoot && !file.startsWith(canonicalBoundary)) {
+        throw new HttpProblem(403, 'Static asset path escapes the Web root.');
+    }
+    const headers = {
+        'Content-Type': contentType(file),
+        'Content-Length': (0, fs_1.statSync)(file).size,
+        'Cache-Control': file.endsWith('index.html')
+            ? 'no-store'
+            : 'public, max-age=31536000, immutable',
+    };
+    response.writeHead(200, headers);
+    if (request.method === 'HEAD') {
+        response.end();
+        return;
+    }
+    await new Promise((resolveStream, reject) => {
+        const stream = (0, fs_1.createReadStream)(file);
+        stream.once('error', reject);
+        stream.once('end', resolveStream);
+        stream.pipe(response);
+    });
+}
+function applySecurityHeaders(response, styleNonce) {
+    response.setHeader('Content-Security-Policy', `default-src 'self'; base-uri 'none'; connect-src 'self'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; img-src 'self' data:; object-src 'none'; script-src 'self'; style-src 'self'; style-src-elem 'self' 'nonce-${styleNonce}'; style-src-attr 'unsafe-inline'`);
+    response.setHeader('X-Content-Type-Options', 'nosniff');
+    response.setHeader('X-Frame-Options', 'DENY');
+    response.setHeader('Referrer-Policy', 'no-referrer');
+    response.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
+    response.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+    response.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
+}
+function sendJson(response, status, value) {
+    const body = JSON.stringify(value);
+    response.writeHead(status, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Content-Length': Buffer.byteLength(body),
+        'Cache-Control': 'no-store',
+    });
+    response.end(body);
+}
+function sendProblem(response, error) {
+    const status = error instanceof HttpProblem || error instanceof errors_1.WebWorkbenchError
+        ? error.status
+        : error instanceof protocol_1.WebProtocolError
+            ? error.status
+            : 500;
+    const detail = status >= 500
+        ? 'The local Web Workbench request failed.'
+        : (0, redaction_1.redactTraceText)(error instanceof Error ? error.message : String(error));
+    const code = error instanceof HttpProblem ||
+        error instanceof errors_1.WebWorkbenchError ||
+        error instanceof protocol_1.WebProtocolError
+        ? error.code
+        : 'web_internal_error';
+    const body = JSON.stringify({
+        type: `https://orioncode.dev/problems/${code}`,
+        title: statusTitle(status),
+        status,
+        code,
+        detail,
+    });
+    response.writeHead(status, {
+        'Content-Type': 'application/problem+json; charset=utf-8',
+        'Content-Length': Buffer.byteLength(body),
+        'Cache-Control': 'no-store',
+    });
+    response.end(body);
+}
+class HttpProblem extends Error {
+    constructor(status, message, code = defaultProblemCode(status)) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'HttpProblem';
+    }
+}
+function defaultProblemCode(status) {
+    switch (status) {
+        case 400:
+            return 'invalid_request';
+        case 403:
+            return 'request_forbidden';
+        case 409:
+            return 'request_conflict';
+        case 413:
+            return 'request_too_large';
+        case 415:
+            return 'unsupported_media_type';
+        case 421:
+            return 'misdirected_request';
+        case 503:
+            return 'service_unavailable';
+        default:
+            return `web_${status}`;
+    }
+}
+function requireRecord(value, name) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new HttpProblem(400, `${name} must be an object.`);
+    }
+    return value;
+}
+function requireText(value, name, maxLength) {
+    if (typeof value !== 'string' || !value.trim()) {
+        throw new HttpProblem(400, `${name} must be a non-empty string.`);
+    }
+    if (value.length > maxLength)
+        throw new HttpProblem(400, `${name} is too long.`);
+    return value.trim();
+}
+function requireUuid(value, name) {
+    const text = requireText(value, name, 128);
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(text)) {
+        throw new HttpProblem(400, `${name} must be a UUID.`);
+    }
+    return text;
+}
+function requireContextGuardRecord(value) {
+    return Object.freeze({
+        expectedContextRevision: requireUuid(value.expectedContextRevision, 'expectedContextRevision'),
+        workspaceId: requireUuid(value.workspaceId, 'workspaceId'),
+    });
+}
+function requireContextGuardQuery(url) {
+    return Object.freeze({
+        expectedContextRevision: requireUuid(url.searchParams.get('expectedContextRevision'), 'expectedContextRevision'),
+        workspaceId: requireUuid(url.searchParams.get('workspaceId'), 'workspaceId'),
+    });
+}
+function boundedIntegerValue(value, fallback, minimum, maximum, name) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isSafeInteger(value) || Number(value) < minimum || Number(value) > maximum) {
+        throw new HttpProblem(400, `${name} must be between ${minimum} and ${maximum}.`);
+    }
+    return Number(value);
+}
+function assertOnlyKeys(value, allowedKeys) {
+    const allowed = new Set(allowedKeys);
+    const unknown = Object.keys(value).find(key => !allowed.has(key));
+    if (unknown)
+        throw new HttpProblem(400, `Unknown request field: ${unknown}.`);
+}
+function statusTitle(status) {
+    if (status === 400)
+        return 'Invalid request';
+    if (status === 403)
+        return 'Request rejected';
+    if (status === 404)
+        return 'Not found';
+    if (status === 409)
+        return 'State conflict';
+    if (status === 413)
+        return 'Payload too large';
+    if (status === 415)
+        return 'Unsupported media type';
+    if (status === 421)
+        return 'Misdirected request';
+    if (status === 503)
+        return 'Service unavailable';
+    return 'Internal server error';
+}
+function safeDecode(pathname) {
+    try {
+        return decodeURIComponent(pathname);
+    }
+    catch {
+        throw new HttpProblem(400, 'Malformed asset path.');
+    }
+}
+function safeDecodePathSegment(value) {
+    const decoded = safeDecode(value);
+    if (!decoded || decoded.includes('/') || decoded.includes('\\')) {
+        throw new HttpProblem(400, 'Malformed path identifier.');
+    }
+    return decoded;
+}
+function boundedInteger(raw, fallback, minimum, maximum) {
+    if (raw === null)
+        return fallback;
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+        throw new HttpProblem(400, `Integer query value must be between ${minimum} and ${maximum}.`);
+    }
+    return value;
+}
+function pageSize(url) {
+    return boundedInteger(url.searchParams.get('pageSize'), 50, 1, 100);
+}
+function collectionPage(url, scope, items, keyOf) {
+    return (0, workbench_controller_1.pageCollectionItems)(scope, items, url.searchParams.get('cursor') ?? undefined, pageSize(url), keyOf);
+}
+function contentType(path) {
+    switch ((0, path_1.extname)(path).toLowerCase()) {
+        case '.html':
+            return 'text/html; charset=utf-8';
+        case '.js':
+        case '.mjs':
+            return 'text/javascript; charset=utf-8';
+        case '.css':
+            return 'text/css; charset=utf-8';
+        case '.json':
+            return 'application/json; charset=utf-8';
+        case '.svg':
+            return 'image/svg+xml';
+        case '.png':
+            return 'image/png';
+        case '.woff2':
+            return 'font/woff2';
+        default:
+            return 'application/octet-stream';
+    }
+}
+function resolveDefaultStaticRoot() {
+    const candidates = [
+        (0, path_1.resolve)(__dirname, '../../dist/web-client'),
+        (0, path_1.resolve)(__dirname, '../../web/dist'),
+        (0, path_1.resolve)(process.cwd(), 'dist/web-client'),
+    ];
+    return candidates.find(candidate => (0, fs_1.existsSync)(candidate)) ?? candidates[0];
+}
+function listen(server, port) {
+    return new Promise((resolveListen, reject) => {
+        const onError = (error) => {
+            server.off('listening', onListening);
+            reject(error);
+        };
+        const onListening = () => {
+            server.off('error', onError);
+            resolveListen();
+        };
+        server.once('error', onError);
+        server.once('listening', onListening);
+        server.listen(port, HOST);
+    });
+}
+function closeServer(server) {
+    if (!server.listening)
+        return Promise.resolve();
+    server.closeAllConnections?.();
+    return new Promise(resolveClose => server.close(() => resolveClose()));
+}
+//# sourceMappingURL=server.js.map