@phnx-labs/agents-cli 1.22.43 → 1.22.44

package/dist/lib/serve/control.js

@@ -1,260 +0,0 @@
-import { createServer } from 'http';
-import fs from 'fs';
-import { spawn } from 'child_process';
-import { randomUUID, randomBytes } from 'crypto';
-import { getAgentsInvocation } from '../daemon/daemon.js';
-import { handleServeGet, resolveServeContext } from './server.js';
-import { verifyControlToken } from './token.js';
-import { readNewEvents, streamDir, streamLogPath } from './stream.js';
-const MAX_BODY_BYTES = 64 * 1024;
-const DEFAULT_STREAM_POLL_MS = 300;
-/** Pull the presented bearer token from either header form. */
-function presentedToken(req) {
-    const auth = req.headers['authorization'];
-    if (typeof auth === 'string' && auth.toLowerCase().startsWith('bearer ')) {
-        return auth.slice(7).trim();
-    }
-    const x = req.headers['x-agents-token'];
-    return typeof x === 'string' ? x.trim() : undefined;
-}
-/** Read a JSON request body with a hard size cap. Rejects on overflow/parse error. */
-function readJsonBody(req) {
-    return new Promise((resolve, reject) => {
-        let size = 0;
-        const chunks = [];
-        req.on('data', (c) => {
-            size += c.length;
-            if (size > MAX_BODY_BYTES) {
-                reject(new Error('request body too large'));
-                req.destroy();
-                return;
-            }
-            chunks.push(c);
-        });
-        req.on('end', () => {
-            const raw = Buffer.concat(chunks).toString('utf-8').trim();
-            if (!raw)
-                return resolve({});
-            try {
-                resolve(JSON.parse(raw));
-            }
-            catch {
-                reject(new Error('invalid JSON body'));
-            }
-        });
-        req.on('error', reject);
-    });
-}
-function sendJson(res, code, obj) {
-    res.writeHead(code, { 'content-type': 'application/json; charset=utf-8' });
-    res.end(JSON.stringify(obj));
-}
-/**
- * SSE stream of a session's normalized NDJSON events, offset-tailed from its
- * capture file. Resumes from `?offset=<bytes>` or the `Last-Event-ID` header
- * (each event's `id:` is its exact byte offset, so resume neither loses nor
- * duplicates). Closes when a terminal (`result`/`error`) event is seen or the
- * client disconnects. A not-yet-created file simply yields nothing until the
- * run starts writing — the phone can open the stream the instant it dispatches.
- */
-export function startSessionStream(file, req, res, pollMs) {
-    res.writeHead(200, {
-        'content-type': 'text/event-stream',
-        'cache-control': 'no-cache',
-        connection: 'keep-alive',
-    });
-    const params = new URL(req.url ?? '/', 'http://anchor').searchParams;
-    const qOffset = Number.parseInt(params.get('offset') ?? '', 10);
-    const lastId = Number.parseInt(Array.isArray(req.headers['last-event-id'])
-        ? req.headers['last-event-id'][0]
-        : req.headers['last-event-id'] ?? '', 10);
-    // Clamp at the source: a negative/garbage offset (or Last-Event-ID) is
-    // meaningless and, worse, `Buffer.subarray(neg)` indexes from the END — so an
-    // unclamped negative offset would read nothing and never self-correct. A bad
-    // resume value replays from the start, the EventSource-friendly behavior.
-    const wanted = Number.isFinite(qOffset) ? qOffset : Number.isFinite(lastId) ? lastId : 0;
-    let offset = Math.max(0, wanted);
-    let closed = false;
-    let timer;
-    const stop = () => {
-        closed = true;
-        if (timer)
-            clearInterval(timer);
-    };
-    req.on('close', stop);
-    const tick = () => {
-        if (closed)
-            return;
-        const { events, newOffset, done } = readNewEvents(file, offset);
-        for (const { event, offset: at } of events) {
-            // `at` is the per-event resume point the CLIENT echoes as Last-Event-ID.
-            res.write(`id: ${at}\nevent: ${event.type}\ndata: ${JSON.stringify(event.raw)}\n\n`);
-        }
-        // The SERVER cursor always adopts newOffset — past every complete line,
-        // including trailing blank/non-JSON lines after the last event — so the
-        // stream always makes progress (even on an empty read) and never re-scans.
-        offset = newOffset;
-        if (done && !closed) {
-            res.write('event: end\ndata: {"ok":true}\n\n');
-            stop();
-            res.end();
-        }
-    };
-    tick(); // immediate catch-up from the resume offset
-    if (!closed)
-        timer = setInterval(tick, pollMs);
-}
-/**
- * Spawn a detached child and settle once it has either successfully spawned or
- * failed to. Attaching an `'error'` listener is mandatory: a `ChildProcess` is
- * an `EventEmitter`, so an `'error'` event (e.g. ENOENT from a stale/missing
- * `agents` binary — a real condition `validateDaemonBinary` guards against)
- * with no listener throws and would take down the whole anchor process, not
- * just the one request. Mirrors the `once('spawn') / once('error')` pattern in
- * `teams/agents.ts`. The `'error'` listener registered by `once` survives after
- * a successful spawn, so a later error is absorbed rather than crashing.
- */
-export function spawnDetached(command, args, stdio = 'ignore') {
-    return new Promise((resolve, reject) => {
-        const child = spawn(command, args, { detached: true, stdio, env: process.env });
-        child.once('spawn', () => {
-            child.unref();
-            resolve();
-        });
-        child.once('error', (err) => reject(err instanceof Error ? err : new Error(String(err))));
-    });
-}
-/**
- * Default run dispatcher: re-invoke `agents run` with a server-minted id so the
- * run is addressable, detached so it outlives this request (and the anchor
- * process). Local runs detach here; `--device` runs detach on the executor via
- * the existing dispatch path.
- */
-export const defaultRunner = async (req) => {
-    if (!req.agent?.trim())
-        throw new Error('agent is required');
-    if (!req.prompt?.trim())
-        throw new Error('prompt is required');
-    const name = `ios-${randomBytes(3).toString('hex')}`;
-    // claude accepts an explicit session UUID; other agents resolve by --name.
-    const sessionId = req.agent === 'claude' ? randomUUID() : name;
-    const argv = ['run', req.agent, req.prompt, '--json', '--headless', '--quiet', '--name', name];
-    if (req.agent === 'claude')
-        argv.push('--session-id', sessionId);
-    if (req.mode)
-        argv.push('--mode', req.mode);
-    if (req.host)
-        argv.push('--device', req.host);
-    if (req.cwd)
-        argv.push('--cwd', req.cwd);
-    const inv = getAgentsInvocation(argv);
-    // Await spawn/error so a failed launch becomes a clean 400, never an
-    // unhandled 'error' that crashes the anchor for every other session.
-    //
-    // For an anchor-local run, capture the `--json` NDJSON to a per-session file
-    // so `GET /api/session/:id/stream` can offset-tail it. A `--device` run emits
-    // its NDJSON on the remote box (streaming that reuses pullRemoteLogDelta — a
-    // follow-up), so we don't capture the local dispatcher's output.
-    if (req.host) {
-        await spawnDetached(inv.command, inv.args);
-    }
-    else {
-        fs.mkdirSync(streamDir(), { recursive: true });
-        const fd = fs.openSync(streamLogPath(sessionId), 'a');
-        try {
-            await spawnDetached(inv.command, inv.args, ['ignore', fd, fd]);
-        }
-        finally {
-            // The child inherited the fd; the parent's copy is no longer needed.
-            fs.closeSync(fd);
-        }
-    }
-    return { sessionId, name };
-};
-/** Default messenger: re-invoke `agents message <id> <text>` and await its exit. */
-export const defaultMessenger = async (id, text, from) => {
-    const argv = ['message', id, text];
-    if (from)
-        argv.push('--from', from);
-    const inv = getAgentsInvocation(argv);
-    const code = await new Promise((resolve) => {
-        const child = spawn(inv.command, inv.args, { stdio: 'ignore', env: process.env });
-        child.on('exit', (c) => resolve(c ?? 1));
-        child.on('error', () => resolve(1));
-    });
-    if (code !== 0)
-        throw new Error(`agents message exited with code ${code}`);
-};
-/**
- * Create (but do not start) the authenticated control server. Caller invokes
- * `.listen(port, bind)`.
- */
-export function createControlServer(opts = {}) {
-    const ctx = resolveServeContext(opts);
-    const verify = opts.verifyToken ?? verifyControlToken;
-    const runner = opts.runner ?? defaultRunner;
-    const messenger = opts.messenger ?? defaultMessenger;
-    const streamPollMs = opts.streamPollMs ?? DEFAULT_STREAM_POLL_MS;
-    const streamLogPathFor = opts.streamLogPathFor ?? streamLogPath;
-    return createServer(async (req, res) => {
-        // Auth gates EVERY request — this server may be reachable off-box.
-        if (!verify(presentedToken(req))) {
-            res.writeHead(401, { 'content-type': 'application/json', 'www-authenticate': 'Bearer' });
-            res.end(JSON.stringify({ error: 'unauthorized' }));
-            return;
-        }
-        const method = req.method ?? 'GET';
-        const url = (req.url || '/').split('?')[0];
-        if (method === 'GET') {
-            const streamMatch = /^\/api\/session\/([^/]+)\/stream$/.exec(url);
-            if (streamMatch) {
-                const id = decodeURIComponent(streamMatch[1]);
-                startSessionStream(streamLogPathFor(id), req, res, streamPollMs);
-                return;
-            }
-            const handled = await handleServeGet(url, req, res, ctx);
-            if (!handled)
-                sendJson(res, 404, { error: 'not found' });
-            return;
-        }
-        if (method === 'POST' && url === '/api/run') {
-            try {
-                const body = (await readJsonBody(req));
-                const result = await runner(body);
-                sendJson(res, 200, result);
-            }
-            catch (err) {
-                sendJson(res, 400, { error: String(err?.message ?? err) });
-            }
-            return;
-        }
-        const msgMatch = method === 'POST' && /^\/api\/session\/([^/]+)\/message$/.exec(url);
-        if (msgMatch) {
-            const id = decodeURIComponent(msgMatch[1]);
-            try {
-                const body = (await readJsonBody(req));
-                if (!body.text?.trim())
-                    throw new Error('text is required');
-                await messenger(id, body.text, body.from);
-                sendJson(res, 200, { ok: true, id });
-            }
-            catch (err) {
-                sendJson(res, 400, { error: String(err?.message ?? err) });
-            }
-            return;
-        }
-        sendJson(res, 404, { error: 'not found' });
-    });
-}
-/** Start the control server on `port`, bound to `bind`. Resolves the bound port. */
-export function startControlServer(port, bind, opts = {}) {
-    const server = createControlServer(opts);
-    return new Promise((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(port, bind, () => {
-            const addr = server.address();
-            const boundPort = typeof addr === 'object' && addr ? addr.port : port;
-            resolve({ server, port: boundPort });
-        });
-    });
-}

package/dist/lib/serve/data.d.ts

@@ -1,81 +0,0 @@
-/**
- * Read-only state assembly for `agents serve`.
- *
- * Reuses the SAME structured data the CLI already emits — no recomputation:
- *  - teams: {@link handleTasks} + {@link handleStatus} + {@link toTaskStatusSummary}
- *    (the shape behind `agents teams status --json`), plus a per-worktree
- *    `git diff` via {@link gitDiff}.
- *  - routines: {@link listJobs} (the shape behind `agents routines list --json`).
- *  - cloud: {@link listTasks} from the local SQLite store (behind `agents cloud list --json`).
- *
- * Every panel is assembled independently: if one subsystem throws (e.g. the
- * SQLite cloud store isn't provisioned on this box), that panel reports an
- * `error` string and the others still render. This is an aggregator dashboard,
- * not a fallback that hides a bug in a single code path.
- */
-import { AgentManager } from '../teams/agents.js';
-import type { AgentStatusSummary } from '../teams/api.js';
-import type { JobConfig } from '../scheduling/routines.js';
-import type { CloudTask } from '../cloud/types.js';
-/** One teammate's worktree and its current uncommitted diff. */
-export interface WorktreeDiff {
-    agent_id: string;
-    name: string | null;
-    agent_type: string;
-    status: string;
-    worktree_name: string | null;
-    worktree_path: string | null;
-    pr_url: string | null;
-    /** Uncommitted `git diff HEAD` for the worktree, capped. '' when clean/absent. */
-    diff: string;
-}
-/** One team: its per-teammate status summary plus per-worktree diffs. */
-export interface TeamPanel {
-    task_name: string;
-    agent_count: number;
-    running: number;
-    completed: number;
-    failed: number;
-    agents: AgentStatusSummary[];
-    worktrees: WorktreeDiff[];
-}
-/** A panel that either carries data or an error string (never both). */
-export type PanelResult<T> = {
-    ok: true;
-    data: T;
-} | {
-    ok: false;
-    error: string;
-};
-/** The full read-only snapshot streamed to the browser. */
-export interface ServeState {
-    generated_at: string;
-    teams: PanelResult<TeamPanel[]>;
-    routines: PanelResult<JobConfig[]>;
-    cloud: PanelResult<CloudTask[]>;
-}
-/** Shape of the teammate fields needed to build a worktree diff. */
-export interface WorktreeAgentLike {
-    agentId: string;
-    name: string | null;
-    agentType: string;
-    status: string;
-    worktreeName: string | null;
-    worktreePath: string | null;
-    prUrl: string | null;
-}
-/**
- * Build the per-worktree diffs for a set of teammates. Only teammates with a
- * `worktreePath` produce a diff; each gets a real `git diff HEAD` via
- * {@link gitDiff}. Pure over its inputs (no manager, no globals) so it can be
- * unit-tested against a real temp git worktree.
- */
-export declare function buildWorktreeDiffs(agents: WorktreeAgentLike[]): Promise<WorktreeDiff[]>;
-/**
- * Assemble the full read-only snapshot. Each panel degrades independently to an
- * `error` string so one unavailable subsystem never blanks the whole dashboard.
- *
- * @param cwd - Project root used for project-scoped routine discovery.
- * @param manager - Injectable for tests; defaults to a fresh {@link AgentManager}.
- */
-export declare function assembleState(cwd?: string, manager?: AgentManager): Promise<ServeState>;

package/dist/lib/serve/data.js

@@ -1,91 +0,0 @@
-/**
- * Read-only state assembly for `agents serve`.
- *
- * Reuses the SAME structured data the CLI already emits — no recomputation:
- *  - teams: {@link handleTasks} + {@link handleStatus} + {@link toTaskStatusSummary}
- *    (the shape behind `agents teams status --json`), plus a per-worktree
- *    `git diff` via {@link gitDiff}.
- *  - routines: {@link listJobs} (the shape behind `agents routines list --json`).
- *  - cloud: {@link listTasks} from the local SQLite store (behind `agents cloud list --json`).
- *
- * Every panel is assembled independently: if one subsystem throws (e.g. the
- * SQLite cloud store isn't provisioned on this box), that panel reports an
- * `error` string and the others still render. This is an aggregator dashboard,
- * not a fallback that hides a bug in a single code path.
- */
-import { AgentManager } from '../teams/agents.js';
-import { handleTasks, handleStatus, toTaskStatusSummary } from '../teams/api.js';
-import { gitDiff } from '../teams/worktree.js';
-import { listJobs } from '../scheduling/routines.js';
-import { listTasks as listCloudTasks } from '../cloud/store.js';
-/**
- * Build the per-worktree diffs for a set of teammates. Only teammates with a
- * `worktreePath` produce a diff; each gets a real `git diff HEAD` via
- * {@link gitDiff}. Pure over its inputs (no manager, no globals) so it can be
- * unit-tested against a real temp git worktree.
- */
-export async function buildWorktreeDiffs(agents) {
-    const withTree = agents.filter((a) => !!a.worktreePath);
-    return Promise.all(withTree.map(async (a) => ({
-        agent_id: a.agentId,
-        name: a.name,
-        agent_type: a.agentType,
-        status: a.status,
-        worktree_name: a.worktreeName,
-        worktree_path: a.worktreePath,
-        pr_url: a.prUrl,
-        diff: await gitDiff(a.worktreePath),
-    })));
-}
-/** Assemble the teams panel: overview counts, status summaries, worktree diffs. */
-async function assembleTeams(manager) {
-    const { tasks } = await handleTasks(manager, 1000);
-    const panels = [];
-    for (const t of tasks) {
-        const status = toTaskStatusSummary(await handleStatus(manager, t.task_name, 'all'));
-        const teamAgents = await manager.listByTask(t.task_name);
-        const worktrees = await buildWorktreeDiffs(teamAgents.map((a) => ({
-            agentId: a.agentId,
-            name: a.name,
-            agentType: a.agentType,
-            status: a.status,
-            worktreeName: a.worktreeName,
-            worktreePath: a.worktreePath,
-            prUrl: a.prUrl,
-        })));
-        panels.push({
-            task_name: t.task_name,
-            agent_count: t.agent_count,
-            running: t.running,
-            completed: t.completed,
-            failed: t.failed,
-            agents: status.agents,
-            worktrees,
-        });
-    }
-    return panels;
-}
-/**
- * Assemble the full read-only snapshot. Each panel degrades independently to an
- * `error` string so one unavailable subsystem never blanks the whole dashboard.
- *
- * @param cwd - Project root used for project-scoped routine discovery.
- * @param manager - Injectable for tests; defaults to a fresh {@link AgentManager}.
- */
-export async function assembleState(cwd = process.cwd(), manager = new AgentManager()) {
-    const [teams, routines, cloud] = await Promise.all([
-        assembleTeams(manager).then((data) => ({ ok: true, data }), (err) => ({ ok: false, error: String(err?.message ?? err) })),
-        Promise.resolve()
-            .then(() => listJobs(cwd))
-            .then((data) => ({ ok: true, data }), (err) => ({ ok: false, error: String(err?.message ?? err) })),
-        Promise.resolve()
-            .then(() => listCloudTasks({ limit: 50 }))
-            .then((data) => ({ ok: true, data }), (err) => ({ ok: false, error: String(err?.message ?? err) })),
-    ]);
-    return {
-        generated_at: new Date().toISOString(),
-        teams,
-        routines,
-        cloud,
-    };
-}

package/dist/lib/serve/page.d.ts

@@ -1,7 +0,0 @@
-/**
- * Self-contained HTML page for `agents serve`. No framework, no external assets
- * — a single inline <style> + <script> that subscribes to /events (SSE) and
- * re-renders the panels on each snapshot. Terminal-coded per the agents-cli
- * brand: #0a0a0a bg, #a3e635 lime accent, JetBrains Mono.
- */
-export declare function renderPage(): string;

package/dist/lib/serve/page.js

@@ -1,140 +0,0 @@
-/**
- * Self-contained HTML page for `agents serve`. No framework, no external assets
- * — a single inline <style> + <script> that subscribes to /events (SSE) and
- * re-renders the panels on each snapshot. Terminal-coded per the agents-cli
- * brand: #0a0a0a bg, #a3e635 lime accent, JetBrains Mono.
- */
-export function renderPage() {
-    return `<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<title>agents serve</title>
-<style>
-  :root {
-    --bg: #0a0a0a; --panel: #121212; --border: #262626; --fg: #e5e5e5;
-    --dim: #737373; --accent: #a3e635; --add: #4ade80; --del: #f87171; --hunk: #60a5fa;
-  }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0; background: var(--bg); color: var(--fg);
-    font-family: ui-monospace, "JetBrains Mono", "SF Mono", Menlo, monospace;
-    font-size: 13px; line-height: 1.5;
-  }
-  header {
-    position: sticky; top: 0; z-index: 10; background: var(--bg);
-    border-bottom: 1px solid var(--border); padding: 12px 20px;
-    display: flex; align-items: center; gap: 12px;
-  }
-  header .mark { color: var(--accent); font-weight: 700; letter-spacing: .5px; }
-  header .status { color: var(--dim); }
-  header .dot { display: inline-block; width: 8px; height: 8px; border-radius: 50%; background: var(--del); margin-right: 6px; vertical-align: middle; }
-  header .dot.live { background: var(--accent); }
-  main { padding: 20px; max-width: 1100px; margin: 0 auto; display: grid; gap: 24px; }
-  h2 { font-size: 14px; color: var(--accent); border-bottom: 1px solid var(--border); padding-bottom: 6px; margin: 0 0 12px; text-transform: uppercase; letter-spacing: 1px; }
-  .card { background: var(--panel); border: 1px solid var(--border); border-radius: 6px; padding: 14px; margin-bottom: 12px; }
-  .row { display: flex; justify-content: space-between; gap: 12px; flex-wrap: wrap; }
-  .muted { color: var(--dim); }
-  .badge { font-size: 11px; padding: 1px 7px; border-radius: 10px; border: 1px solid var(--border); }
-  .badge.running { color: var(--accent); border-color: var(--accent); }
-  .badge.completed { color: var(--add); border-color: var(--add); }
-  .badge.failed { color: var(--del); border-color: var(--del); }
-  a { color: var(--hunk); text-decoration: none; }
-  a:hover { text-decoration: underline; }
-  details { margin-top: 8px; }
-  summary { cursor: pointer; color: var(--dim); }
-  pre.diff { overflow-x: auto; background: #0d0d0d; border: 1px solid var(--border); border-radius: 4px; padding: 10px; margin: 8px 0 0; white-space: pre; }
-  pre.diff .a { color: var(--add); } pre.diff .d { color: var(--del); } pre.diff .h { color: var(--hunk); } pre.diff .m { color: var(--dim); }
-  .err { color: var(--del); }
-  .empty { color: var(--dim); font-style: italic; }
-  table { width: 100%; border-collapse: collapse; }
-  td, th { text-align: left; padding: 4px 8px; border-bottom: 1px solid var(--border); vertical-align: top; }
-  th { color: var(--dim); font-weight: 500; }
-</style>
-</head>
-<body>
-<header>
-  <span class="mark">agents serve</span>
-  <span class="status"><span class="dot" id="dot"></span><span id="conn">connecting…</span></span>
-  <span class="status" id="ts"></span>
-</header>
-<main>
-  <section><h2>Teams &amp; Diffs</h2><div id="teams"></div></section>
-  <section><h2>Routines</h2><div id="routines"></div></section>
-  <section><h2>Cloud</h2><div id="cloud"></div></section>
-</main>
-<script>
-const $ = (id) => document.getElementById(id);
-const esc = (s) => String(s == null ? '' : s).replace(/[&<>"]/g, (c) => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c]));
-// href allowlist: only http(s) URLs are linkable. esc() blocks attribute
-// breakout, but a javascript:/data: URL would still execute on click — so a
-// non-http(s) pr_url renders as an inert '#' rather than a live link.
-const safeUrl = (u) => { const s = String(u == null ? '' : u); return /^https?:\\/\\//i.test(s) ? s : '#'; };
-function colorDiff(text) {
-  return esc(text).split('\\n').map((line) => {
-    if (line.startsWith('+')) return '<span class="a">' + line + '</span>';
-    if (line.startsWith('-')) return '<span class="d">' + line + '</span>';
-    if (line.startsWith('@@')) return '<span class="h">' + line + '</span>';
-    if (line.startsWith('diff ') || line.startsWith('index ')) return '<span class="m">' + line + '</span>';
-    return line;
-  }).join('\\n');
-}
-function panelError(el, error) { el.innerHTML = '<div class="card err">error: ' + esc(error) + '</div>'; }
-
-function renderTeams(res) {
-  const el = $('teams');
-  if (!res.ok) return panelError(el, res.error);
-  if (!res.data.length) { el.innerHTML = '<div class="empty">no teams</div>'; return; }
-  el.innerHTML = res.data.map((t) => {
-    const agents = t.agents.map((a) =>
-      '<div class="row"><span>' + esc(a.name || a.agent_id.slice(0,8)) +
-      ' <span class="muted">' + esc(a.agent_type) + '</span>' +
-      (a.pr_url ? ' <a href="' + esc(safeUrl(a.pr_url)) + '" target="_blank">PR</a>' : '') +
-      '</span><span class="badge ' + esc(a.status) + '">' + esc(a.status) + '</span></div>'
-    ).join('');
-    const worktrees = t.worktrees.map((w) => {
-      const body = w.diff
-        ? '<details><summary>diff · ' + esc(w.worktree_name || w.worktree_path) + '</summary><pre class="diff">' + colorDiff(w.diff) + '</pre></details>'
-        : '<div class="muted">' + esc(w.worktree_name || w.worktree_path) + ' — no uncommitted changes</div>';
-      return body;
-    }).join('');
-    return '<div class="card"><div class="row"><strong>' + esc(t.task_name) + '</strong>' +
-      '<span class="muted">' + t.running + ' running · ' + t.completed + ' done · ' + t.failed + ' failed</span></div>' +
-      agents + worktrees + '</div>';
-  }).join('');
-}
-function renderRoutines(res) {
-  const el = $('routines');
-  if (!res.ok) return panelError(el, res.error);
-  if (!res.data.length) { el.innerHTML = '<div class="empty">no routines</div>'; return; }
-  el.innerHTML = '<div class="card"><table><tr><th>name</th><th>schedule</th><th>agent</th><th>enabled</th></tr>' +
-    res.data.map((j) => '<tr><td>' + esc(j.name) + '</td><td class="muted">' + esc(j.schedule) + '</td><td>' +
-      esc(j.workflow ? 'wf:' + j.workflow : j.agent) + '</td><td>' + (j.enabled ? 'yes' : '<span class="muted">no</span>') + '</td></tr>').join('') +
-    '</table></div>';
-}
-function renderCloud(res) {
-  const el = $('cloud');
-  if (!res.ok) return panelError(el, res.error);
-  if (!res.data.length) { el.innerHTML = '<div class="empty">no cloud tasks</div>'; return; }
-  el.innerHTML = '<div class="card"><table><tr><th>id</th><th>provider</th><th>status</th><th>repo</th><th></th></tr>' +
-    res.data.map((c) => '<tr><td>' + esc(c.id.slice(0,10)) + '</td><td>' + esc(c.provider) + '</td><td><span class="badge ' + esc(c.status) + '">' +
-      esc(c.status) + '</span></td><td class="muted">' + esc(c.repo || '') + '</td><td>' +
-      (c.prUrl ? '<a href="' + esc(safeUrl(c.prUrl)) + '" target="_blank">PR</a>' : '') + '</td></tr>').join('') +
-    '</table></div>';
-}
-function render(state) {
-  renderTeams(state.teams); renderRoutines(state.routines); renderCloud(state.cloud);
-  $('ts').textContent = 'updated ' + new Date(state.generated_at).toLocaleTimeString();
-}
-function setConn(live) {
-  $('dot').className = 'dot' + (live ? ' live' : '');
-  $('conn').textContent = live ? 'live' : 'reconnecting…';
-}
-const src = new EventSource('/events');
-src.addEventListener('state', (e) => { setConn(true); render(JSON.parse(e.data)); });
-src.onerror = () => setConn(false);
-</script>
-</body>
-</html>`;
-}

package/dist/lib/serve/server.d.ts

@@ -1,80 +0,0 @@
-/**
- * Read-only localhost HTTP + Server-Sent-Events server for `agents serve`.
- *
- * There is deliberately NO framework and NO mutation surface:
- *  - binds 127.0.0.1 only (loopback) — never reachable off the machine;
- *  - answers GET only (every other method → 405);
- *  - routes: `GET /` → HTML page, `GET /api/state` → JSON snapshot,
- *    `GET /events` → SSE stream that re-pushes the snapshot on an interval.
- *
- * The whole thing is a viewer over data other commands already own
- * ({@link assembleState}); it writes nothing.
- *
- * The GET routing is exported as {@link handleServeGet} so the authenticated
- * `--control` variant (see control.ts) can reuse it verbatim rather than
- * duplicate the state/SSE surface.
- */
-import type http from 'http';
-import type { ServeState } from './data.js';
-/** Loopback address — the server binds here and nowhere else. */
-export declare const SERVE_HOST = "127.0.0.1";
-/**
- * DNS-rebinding guard. The socket binds loopback, but binding alone does not
- * stop a remote page: an attacker can point a hostname's DNS at 127.0.0.1 and
- * drive the victim's browser to `GET /api/state`, which exposes uncommitted
- * `git diff HEAD` of every worktree plus routine + cloud config. A browser
- * always sends a `Host` header naming the site it *thinks* it reached, so we
- * trust only a Host that is itself loopback. A missing Host (HTTP/1.0 or a raw
- * non-browser client like curl-without-Host) is not a rebind vector and is
- * allowed; any explicit non-loopback Host is rejected.
- */
-export declare function isAllowedServeHost(hostHeader: string | undefined): boolean;
-/** Default port for `agents serve`. */
-export declare const DEFAULT_SERVE_PORT = 4477;
-/** Default SSE push cadence. */
-export declare const DEFAULT_INTERVAL_MS = 3000;
-export interface ServeOptions {
-    /** Project root for project-scoped routine discovery. Defaults to process.cwd(). */
-    cwd?: string;
-    /** SSE push cadence in ms. Defaults to {@link DEFAULT_INTERVAL_MS}. */
-    intervalMs?: number;
-    /**
-     * Snapshot data source. Defaults to {@link assembleState}. Read-only DI seam
-     * so tests can drive SSE lifecycle timing deterministically (e.g. gate the
-     * first snapshot to reproduce a mid-snapshot disconnect); production never
-     * sets it.
-     */
-    snapshot?: () => Promise<ServeState>;
-}
-/**
- * Resolved GET-route context: the snapshot source and SSE cadence, with all
- * defaults applied. Built once by {@link resolveServeContext}.
- */
-export interface ServeContext {
-    snapshot: () => Promise<ServeState>;
-    intervalMs: number;
-}
-/** Apply defaults to {@link ServeOptions}, producing a {@link ServeContext}. */
-export declare function resolveServeContext(opts?: ServeOptions): ServeContext;
-/**
- * Handle the shared read-only GET surface (`/`, `/api/state`, `/events`).
- * Returns `true` when the route was recognized and a response was written (or
- * begun, for SSE); `false` when the path is unknown so the caller can 404 or
- * try its own routes first. Extracted so the `--control` server reuses the
- * exact same state/SSE behavior — including the load-bearing SSE close/timer
- * ordering below — without duplicating it.
- */
-export declare function handleServeGet(url: string, req: http.IncomingMessage, res: http.ServerResponse, ctx: ServeContext): Promise<boolean>;
-/**
- * Create (but do not start) the read-only serve server. Caller invokes
- * `.listen(port, SERVE_HOST)`. Returned so tests can bind an ephemeral port.
- */
-export declare function createServeServer(opts?: ServeOptions): http.Server;
-/**
- * Start the serve server on `port`, bound to loopback. Resolves with the
- * actual bound port (useful when `port === 0` for tests).
- */
-export declare function startServeServer(port?: number, opts?: ServeOptions): Promise<{
-    server: http.Server;
-    port: number;
-}>;