@phnx-labs/agents-cli 1.22.43 → 1.22.45

package/dist/lib/serve/data.js

@@ -1,91 +0,0 @@
-/**
- * Read-only state assembly for `agents serve`.
- *
- * Reuses the SAME structured data the CLI already emits — no recomputation:
- *  - teams: {@link handleTasks} + {@link handleStatus} + {@link toTaskStatusSummary}
- *    (the shape behind `agents teams status --json`), plus a per-worktree
- *    `git diff` via {@link gitDiff}.
- *  - routines: {@link listJobs} (the shape behind `agents routines list --json`).
- *  - cloud: {@link listTasks} from the local SQLite store (behind `agents cloud list --json`).
- *
- * Every panel is assembled independently: if one subsystem throws (e.g. the
- * SQLite cloud store isn't provisioned on this box), that panel reports an
- * `error` string and the others still render. This is an aggregator dashboard,
- * not a fallback that hides a bug in a single code path.
- */
-import { AgentManager } from '../teams/agents.js';
-import { handleTasks, handleStatus, toTaskStatusSummary } from '../teams/api.js';
-import { gitDiff } from '../teams/worktree.js';
-import { listJobs } from '../scheduling/routines.js';
-import { listTasks as listCloudTasks } from '../cloud/store.js';
-/**
- * Build the per-worktree diffs for a set of teammates. Only teammates with a
- * `worktreePath` produce a diff; each gets a real `git diff HEAD` via
- * {@link gitDiff}. Pure over its inputs (no manager, no globals) so it can be
- * unit-tested against a real temp git worktree.
- */
-export async function buildWorktreeDiffs(agents) {
-    const withTree = agents.filter((a) => !!a.worktreePath);
-    return Promise.all(withTree.map(async (a) => ({
-        agent_id: a.agentId,
-        name: a.name,
-        agent_type: a.agentType,
-        status: a.status,
-        worktree_name: a.worktreeName,
-        worktree_path: a.worktreePath,
-        pr_url: a.prUrl,
-        diff: await gitDiff(a.worktreePath),
-    })));
-}
-/** Assemble the teams panel: overview counts, status summaries, worktree diffs. */
-async function assembleTeams(manager) {
-    const { tasks } = await handleTasks(manager, 1000);
-    const panels = [];
-    for (const t of tasks) {
-        const status = toTaskStatusSummary(await handleStatus(manager, t.task_name, 'all'));
-        const teamAgents = await manager.listByTask(t.task_name);
-        const worktrees = await buildWorktreeDiffs(teamAgents.map((a) => ({
-            agentId: a.agentId,
-            name: a.name,
-            agentType: a.agentType,
-            status: a.status,
-            worktreeName: a.worktreeName,
-            worktreePath: a.worktreePath,
-            prUrl: a.prUrl,
-        })));
-        panels.push({
-            task_name: t.task_name,
-            agent_count: t.agent_count,
-            running: t.running,
-            completed: t.completed,
-            failed: t.failed,
-            agents: status.agents,
-            worktrees,
-        });
-    }
-    return panels;
-}
-/**
- * Assemble the full read-only snapshot. Each panel degrades independently to an
- * `error` string so one unavailable subsystem never blanks the whole dashboard.
- *
- * @param cwd - Project root used for project-scoped routine discovery.
- * @param manager - Injectable for tests; defaults to a fresh {@link AgentManager}.
- */
-export async function assembleState(cwd = process.cwd(), manager = new AgentManager()) {
-    const [teams, routines, cloud] = await Promise.all([
-        assembleTeams(manager).then((data) => ({ ok: true, data }), (err) => ({ ok: false, error: String(err?.message ?? err) })),
-        Promise.resolve()
-            .then(() => listJobs(cwd))
-            .then((data) => ({ ok: true, data }), (err) => ({ ok: false, error: String(err?.message ?? err) })),
-        Promise.resolve()
-            .then(() => listCloudTasks({ limit: 50 }))
-            .then((data) => ({ ok: true, data }), (err) => ({ ok: false, error: String(err?.message ?? err) })),
-    ]);
-    return {
-        generated_at: new Date().toISOString(),
-        teams,
-        routines,
-        cloud,
-    };
-}

package/dist/lib/serve/page.d.ts

@@ -1,7 +0,0 @@
-/**
- * Self-contained HTML page for `agents serve`. No framework, no external assets
- * — a single inline <style> + <script> that subscribes to /events (SSE) and
- * re-renders the panels on each snapshot. Terminal-coded per the agents-cli
- * brand: #0a0a0a bg, #a3e635 lime accent, JetBrains Mono.
- */
-export declare function renderPage(): string;

package/dist/lib/serve/page.js

@@ -1,140 +0,0 @@
-/**
- * Self-contained HTML page for `agents serve`. No framework, no external assets
- * — a single inline <style> + <script> that subscribes to /events (SSE) and
- * re-renders the panels on each snapshot. Terminal-coded per the agents-cli
- * brand: #0a0a0a bg, #a3e635 lime accent, JetBrains Mono.
- */
-export function renderPage() {
-    return `<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1" />
-<title>agents serve</title>
-<style>
-  :root {
-    --bg: #0a0a0a; --panel: #121212; --border: #262626; --fg: #e5e5e5;
-    --dim: #737373; --accent: #a3e635; --add: #4ade80; --del: #f87171; --hunk: #60a5fa;
-  }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0; background: var(--bg); color: var(--fg);
-    font-family: ui-monospace, "JetBrains Mono", "SF Mono", Menlo, monospace;
-    font-size: 13px; line-height: 1.5;
-  }
-  header {
-    position: sticky; top: 0; z-index: 10; background: var(--bg);
-    border-bottom: 1px solid var(--border); padding: 12px 20px;
-    display: flex; align-items: center; gap: 12px;
-  }
-  header .mark { color: var(--accent); font-weight: 700; letter-spacing: .5px; }
-  header .status { color: var(--dim); }
-  header .dot { display: inline-block; width: 8px; height: 8px; border-radius: 50%; background: var(--del); margin-right: 6px; vertical-align: middle; }
-  header .dot.live { background: var(--accent); }
-  main { padding: 20px; max-width: 1100px; margin: 0 auto; display: grid; gap: 24px; }
-  h2 { font-size: 14px; color: var(--accent); border-bottom: 1px solid var(--border); padding-bottom: 6px; margin: 0 0 12px; text-transform: uppercase; letter-spacing: 1px; }
-  .card { background: var(--panel); border: 1px solid var(--border); border-radius: 6px; padding: 14px; margin-bottom: 12px; }
-  .row { display: flex; justify-content: space-between; gap: 12px; flex-wrap: wrap; }
-  .muted { color: var(--dim); }
-  .badge { font-size: 11px; padding: 1px 7px; border-radius: 10px; border: 1px solid var(--border); }
-  .badge.running { color: var(--accent); border-color: var(--accent); }
-  .badge.completed { color: var(--add); border-color: var(--add); }
-  .badge.failed { color: var(--del); border-color: var(--del); }
-  a { color: var(--hunk); text-decoration: none; }
-  a:hover { text-decoration: underline; }
-  details { margin-top: 8px; }
-  summary { cursor: pointer; color: var(--dim); }
-  pre.diff { overflow-x: auto; background: #0d0d0d; border: 1px solid var(--border); border-radius: 4px; padding: 10px; margin: 8px 0 0; white-space: pre; }
-  pre.diff .a { color: var(--add); } pre.diff .d { color: var(--del); } pre.diff .h { color: var(--hunk); } pre.diff .m { color: var(--dim); }
-  .err { color: var(--del); }
-  .empty { color: var(--dim); font-style: italic; }
-  table { width: 100%; border-collapse: collapse; }
-  td, th { text-align: left; padding: 4px 8px; border-bottom: 1px solid var(--border); vertical-align: top; }
-  th { color: var(--dim); font-weight: 500; }
-</style>
-</head>
-<body>
-<header>
-  <span class="mark">agents serve</span>
-  <span class="status"><span class="dot" id="dot"></span><span id="conn">connecting…</span></span>
-  <span class="status" id="ts"></span>
-</header>
-<main>
-  <section><h2>Teams &amp; Diffs</h2><div id="teams"></div></section>
-  <section><h2>Routines</h2><div id="routines"></div></section>
-  <section><h2>Cloud</h2><div id="cloud"></div></section>
-</main>
-<script>
-const $ = (id) => document.getElementById(id);
-const esc = (s) => String(s == null ? '' : s).replace(/[&<>"]/g, (c) => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c]));
-// href allowlist: only http(s) URLs are linkable. esc() blocks attribute
-// breakout, but a javascript:/data: URL would still execute on click — so a
-// non-http(s) pr_url renders as an inert '#' rather than a live link.
-const safeUrl = (u) => { const s = String(u == null ? '' : u); return /^https?:\\/\\//i.test(s) ? s : '#'; };
-function colorDiff(text) {
-  return esc(text).split('\\n').map((line) => {
-    if (line.startsWith('+')) return '<span class="a">' + line + '</span>';
-    if (line.startsWith('-')) return '<span class="d">' + line + '</span>';
-    if (line.startsWith('@@')) return '<span class="h">' + line + '</span>';
-    if (line.startsWith('diff ') || line.startsWith('index ')) return '<span class="m">' + line + '</span>';
-    return line;
-  }).join('\\n');
-}
-function panelError(el, error) { el.innerHTML = '<div class="card err">error: ' + esc(error) + '</div>'; }
-
-function renderTeams(res) {
-  const el = $('teams');
-  if (!res.ok) return panelError(el, res.error);
-  if (!res.data.length) { el.innerHTML = '<div class="empty">no teams</div>'; return; }
-  el.innerHTML = res.data.map((t) => {
-    const agents = t.agents.map((a) =>
-      '<div class="row"><span>' + esc(a.name || a.agent_id.slice(0,8)) +
-      ' <span class="muted">' + esc(a.agent_type) + '</span>' +
-      (a.pr_url ? ' <a href="' + esc(safeUrl(a.pr_url)) + '" target="_blank">PR</a>' : '') +
-      '</span><span class="badge ' + esc(a.status) + '">' + esc(a.status) + '</span></div>'
-    ).join('');
-    const worktrees = t.worktrees.map((w) => {
-      const body = w.diff
-        ? '<details><summary>diff · ' + esc(w.worktree_name || w.worktree_path) + '</summary><pre class="diff">' + colorDiff(w.diff) + '</pre></details>'
-        : '<div class="muted">' + esc(w.worktree_name || w.worktree_path) + ' — no uncommitted changes</div>';
-      return body;
-    }).join('');
-    return '<div class="card"><div class="row"><strong>' + esc(t.task_name) + '</strong>' +
-      '<span class="muted">' + t.running + ' running · ' + t.completed + ' done · ' + t.failed + ' failed</span></div>' +
-      agents + worktrees + '</div>';
-  }).join('');
-}
-function renderRoutines(res) {
-  const el = $('routines');
-  if (!res.ok) return panelError(el, res.error);
-  if (!res.data.length) { el.innerHTML = '<div class="empty">no routines</div>'; return; }
-  el.innerHTML = '<div class="card"><table><tr><th>name</th><th>schedule</th><th>agent</th><th>enabled</th></tr>' +
-    res.data.map((j) => '<tr><td>' + esc(j.name) + '</td><td class="muted">' + esc(j.schedule) + '</td><td>' +
-      esc(j.workflow ? 'wf:' + j.workflow : j.agent) + '</td><td>' + (j.enabled ? 'yes' : '<span class="muted">no</span>') + '</td></tr>').join('') +
-    '</table></div>';
-}
-function renderCloud(res) {
-  const el = $('cloud');
-  if (!res.ok) return panelError(el, res.error);
-  if (!res.data.length) { el.innerHTML = '<div class="empty">no cloud tasks</div>'; return; }
-  el.innerHTML = '<div class="card"><table><tr><th>id</th><th>provider</th><th>status</th><th>repo</th><th></th></tr>' +
-    res.data.map((c) => '<tr><td>' + esc(c.id.slice(0,10)) + '</td><td>' + esc(c.provider) + '</td><td><span class="badge ' + esc(c.status) + '">' +
-      esc(c.status) + '</span></td><td class="muted">' + esc(c.repo || '') + '</td><td>' +
-      (c.prUrl ? '<a href="' + esc(safeUrl(c.prUrl)) + '" target="_blank">PR</a>' : '') + '</td></tr>').join('') +
-    '</table></div>';
-}
-function render(state) {
-  renderTeams(state.teams); renderRoutines(state.routines); renderCloud(state.cloud);
-  $('ts').textContent = 'updated ' + new Date(state.generated_at).toLocaleTimeString();
-}
-function setConn(live) {
-  $('dot').className = 'dot' + (live ? ' live' : '');
-  $('conn').textContent = live ? 'live' : 'reconnecting…';
-}
-const src = new EventSource('/events');
-src.addEventListener('state', (e) => { setConn(true); render(JSON.parse(e.data)); });
-src.onerror = () => setConn(false);
-</script>
-</body>
-</html>`;
-}

package/dist/lib/serve/server.d.ts

@@ -1,80 +0,0 @@
-/**
- * Read-only localhost HTTP + Server-Sent-Events server for `agents serve`.
- *
- * There is deliberately NO framework and NO mutation surface:
- *  - binds 127.0.0.1 only (loopback) — never reachable off the machine;
- *  - answers GET only (every other method → 405);
- *  - routes: `GET /` → HTML page, `GET /api/state` → JSON snapshot,
- *    `GET /events` → SSE stream that re-pushes the snapshot on an interval.
- *
- * The whole thing is a viewer over data other commands already own
- * ({@link assembleState}); it writes nothing.
- *
- * The GET routing is exported as {@link handleServeGet} so the authenticated
- * `--control` variant (see control.ts) can reuse it verbatim rather than
- * duplicate the state/SSE surface.
- */
-import type http from 'http';
-import type { ServeState } from './data.js';
-/** Loopback address — the server binds here and nowhere else. */
-export declare const SERVE_HOST = "127.0.0.1";
-/**
- * DNS-rebinding guard. The socket binds loopback, but binding alone does not
- * stop a remote page: an attacker can point a hostname's DNS at 127.0.0.1 and
- * drive the victim's browser to `GET /api/state`, which exposes uncommitted
- * `git diff HEAD` of every worktree plus routine + cloud config. A browser
- * always sends a `Host` header naming the site it *thinks* it reached, so we
- * trust only a Host that is itself loopback. A missing Host (HTTP/1.0 or a raw
- * non-browser client like curl-without-Host) is not a rebind vector and is
- * allowed; any explicit non-loopback Host is rejected.
- */
-export declare function isAllowedServeHost(hostHeader: string | undefined): boolean;
-/** Default port for `agents serve`. */
-export declare const DEFAULT_SERVE_PORT = 4477;
-/** Default SSE push cadence. */
-export declare const DEFAULT_INTERVAL_MS = 3000;
-export interface ServeOptions {
-    /** Project root for project-scoped routine discovery. Defaults to process.cwd(). */
-    cwd?: string;
-    /** SSE push cadence in ms. Defaults to {@link DEFAULT_INTERVAL_MS}. */
-    intervalMs?: number;
-    /**
-     * Snapshot data source. Defaults to {@link assembleState}. Read-only DI seam
-     * so tests can drive SSE lifecycle timing deterministically (e.g. gate the
-     * first snapshot to reproduce a mid-snapshot disconnect); production never
-     * sets it.
-     */
-    snapshot?: () => Promise<ServeState>;
-}
-/**
- * Resolved GET-route context: the snapshot source and SSE cadence, with all
- * defaults applied. Built once by {@link resolveServeContext}.
- */
-export interface ServeContext {
-    snapshot: () => Promise<ServeState>;
-    intervalMs: number;
-}
-/** Apply defaults to {@link ServeOptions}, producing a {@link ServeContext}. */
-export declare function resolveServeContext(opts?: ServeOptions): ServeContext;
-/**
- * Handle the shared read-only GET surface (`/`, `/api/state`, `/events`).
- * Returns `true` when the route was recognized and a response was written (or
- * begun, for SSE); `false` when the path is unknown so the caller can 404 or
- * try its own routes first. Extracted so the `--control` server reuses the
- * exact same state/SSE behavior — including the load-bearing SSE close/timer
- * ordering below — without duplicating it.
- */
-export declare function handleServeGet(url: string, req: http.IncomingMessage, res: http.ServerResponse, ctx: ServeContext): Promise<boolean>;
-/**
- * Create (but do not start) the read-only serve server. Caller invokes
- * `.listen(port, SERVE_HOST)`. Returned so tests can bind an ephemeral port.
- */
-export declare function createServeServer(opts?: ServeOptions): http.Server;
-/**
- * Start the serve server on `port`, bound to loopback. Resolves with the
- * actual bound port (useful when `port === 0` for tests).
- */
-export declare function startServeServer(port?: number, opts?: ServeOptions): Promise<{
-    server: http.Server;
-    port: number;
-}>;

package/dist/lib/serve/server.js

@@ -1,145 +0,0 @@
-import { createServer } from 'http';
-import { assembleState } from './data.js';
-import { renderPage } from './page.js';
-/** Loopback address — the server binds here and nowhere else. */
-export const SERVE_HOST = '127.0.0.1';
-/**
- * DNS-rebinding guard. The socket binds loopback, but binding alone does not
- * stop a remote page: an attacker can point a hostname's DNS at 127.0.0.1 and
- * drive the victim's browser to `GET /api/state`, which exposes uncommitted
- * `git diff HEAD` of every worktree plus routine + cloud config. A browser
- * always sends a `Host` header naming the site it *thinks* it reached, so we
- * trust only a Host that is itself loopback. A missing Host (HTTP/1.0 or a raw
- * non-browser client like curl-without-Host) is not a rebind vector and is
- * allowed; any explicit non-loopback Host is rejected.
- */
-export function isAllowedServeHost(hostHeader) {
-    if (!hostHeader)
-        return true;
-    const host = hostHeader.replace(/:\d+$/, '').toLowerCase().replace(/^\[|\]$/g, '');
-    return host === 'localhost' || host === '127.0.0.1' || host === '::1';
-}
-/** Default port for `agents serve`. */
-export const DEFAULT_SERVE_PORT = 4477;
-/** Default SSE push cadence. */
-export const DEFAULT_INTERVAL_MS = 3000;
-/** Apply defaults to {@link ServeOptions}, producing a {@link ServeContext}. */
-export function resolveServeContext(opts = {}) {
-    const cwd = opts.cwd ?? process.cwd();
-    return {
-        snapshot: opts.snapshot ?? (() => assembleState(cwd)),
-        intervalMs: opts.intervalMs ?? DEFAULT_INTERVAL_MS,
-    };
-}
-/**
- * Handle the shared read-only GET surface (`/`, `/api/state`, `/events`).
- * Returns `true` when the route was recognized and a response was written (or
- * begun, for SSE); `false` when the path is unknown so the caller can 404 or
- * try its own routes first. Extracted so the `--control` server reuses the
- * exact same state/SSE behavior — including the load-bearing SSE close/timer
- * ordering below — without duplicating it.
- */
-export async function handleServeGet(url, req, res, ctx) {
-    if (url === '/' || url === '/index.html') {
-        const html = renderPage();
-        res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
-        res.end(html);
-        return true;
-    }
-    if (url === '/api/state') {
-        try {
-            const state = await ctx.snapshot();
-            res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' });
-            res.end(JSON.stringify(state));
-        }
-        catch (err) {
-            res.writeHead(500, { 'content-type': 'application/json' });
-            res.end(JSON.stringify({ error: String(err?.message ?? err) }));
-        }
-        return true;
-    }
-    if (url === '/events') {
-        res.writeHead(200, {
-            'content-type': 'text/event-stream',
-            'cache-control': 'no-cache',
-            connection: 'keep-alive',
-        });
-        let closed = false;
-        // Declare the timer first and register the disconnect cleanup BEFORE the
-        // first `await push()`. `assembleState()` (team scan + git diffs) can be
-        // slow; if the client disconnects during it, the one-shot 'close' must
-        // already have a listener — otherwise it fires into the void, the interval
-        // starts anyway, and we leak a timer writing to a destroyed socket forever.
-        let timer;
-        req.on('close', () => {
-            closed = true;
-            if (timer)
-                clearInterval(timer);
-        });
-        const push = async () => {
-            if (closed)
-                return;
-            try {
-                const state = await ctx.snapshot();
-                if (closed)
-                    return;
-                res.write(`event: state\ndata: ${JSON.stringify(state)}\n\n`);
-            }
-            catch (err) {
-                if (!closed)
-                    res.write(`event: error\ndata: ${JSON.stringify({ error: String(err) })}\n\n`);
-            }
-        };
-        await push(); // immediate first frame
-        // Only arm the interval if the client is still connected. If 'close' fired
-        // during the first push, `closed` is already true (and the handler ran
-        // while `timer` was undefined), so starting an interval here would leak.
-        if (!closed)
-            timer = setInterval(push, ctx.intervalMs);
-        return true;
-    }
-    return false;
-}
-/**
- * Create (but do not start) the read-only serve server. Caller invokes
- * `.listen(port, SERVE_HOST)`. Returned so tests can bind an ephemeral port.
- */
-export function createServeServer(opts = {}) {
-    const ctx = resolveServeContext(opts);
-    const server = createServer(async (req, res) => {
-        // DNS-rebind guard: reject any explicit non-loopback Host before doing work.
-        if (!isAllowedServeHost(req.headers.host)) {
-            res.writeHead(403, { 'content-type': 'text/plain' });
-            res.end('forbidden: non-local Host');
-            return;
-        }
-        // Read-only: reject anything that could mutate. Only GET is served.
-        if (req.method !== 'GET') {
-            res.writeHead(405, { 'content-type': 'text/plain', allow: 'GET' });
-            res.end('method not allowed');
-            return;
-        }
-        const url = (req.url || '/').split('?')[0];
-        const handled = await handleServeGet(url, req, res, ctx);
-        if (!handled) {
-            res.writeHead(404, { 'content-type': 'text/plain' });
-            res.end('not found');
-        }
-    });
-    return server;
-}
-/**
- * Start the serve server on `port`, bound to loopback. Resolves with the
- * actual bound port (useful when `port === 0` for tests).
- */
-export function startServeServer(port = DEFAULT_SERVE_PORT, opts = {}) {
-    const server = createServeServer(opts);
-    return new Promise((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(port, SERVE_HOST, () => {
-            const addr = server.address();
-            const boundPort = typeof addr === 'object' && addr ? addr.port : port;
-            resolve({ server, port: boundPort });
-        });
-    });
-}

package/dist/lib/serve/stream.d.ts

@@ -1,43 +0,0 @@
-/** Directory holding per-session NDJSON capture files. */
-export declare function streamDir(): string;
-/** Capture-file path for a session id (id is sanitized to a safe filename). */
-export declare function streamLogPath(sessionId: string): string;
-/** A normalized event handed to the phone. `raw` is the untouched harness line. */
-export interface StreamEvent {
-    /** UI-facing discriminator: message | tool_use | tool_result | result | error | system | unknown. */
-    type: string;
-    raw: unknown;
-}
-/**
- * Normalize one harness JSON line to a {@link StreamEvent}. Schemas differ per
- * agent (there is no unified enum in the CLI), so we key off the common `type`
- * field (Claude stream-json: `assistant` | `user` | `result` | `system`; a
- * tool-use lives inside an `assistant` message's content) and carry `raw`
- * through untouched so the client can render richer detail without the anchor
- * having to model every agent.
- */
-export declare function normalizeEvent(obj: unknown): StreamEvent;
-/** A parsed event paired with the byte offset immediately AFTER its line. */
-export interface OffsetEvent {
-    event: StreamEvent;
-    /** Resume point: absolute byte offset just past this event's newline. */
-    offset: number;
-}
-/** Result of one offset-tail read of a capture file. */
-export interface ReadResult {
-    events: OffsetEvent[];
-    /** Byte offset advanced ONLY past complete newline-terminated lines. */
-    newOffset: number;
-    /** True once a terminal event (result/error) has been parsed. */
-    done: boolean;
-}
-/**
- * Read complete NDJSON lines from `fromOffset`, byte-accurately. Each event
- * carries the exact byte offset past its own newline so an SSE client can set
- * `Last-Event-ID` per event and resume with neither loss nor duplication even
- * if the connection drops mid-batch. A trailing partial line (no newline yet)
- * is left unconsumed so the offset never splits a multi-byte event — the next
- * read picks it up once the harness flushes the newline. Non-JSON preamble
- * lines are skipped, not fatal.
- */
-export declare function readNewEvents(file: string, fromOffset: number): ReadResult;

package/dist/lib/serve/stream.js

@@ -1,116 +0,0 @@
-/**
- * Live NDJSON event bridge for the iOS cockpit (RUSH-1732).
- *
- * A control-mode run (`defaultRunner`) is launched with `--json`, so the agent
- * harness emits one JSON event per line. We capture that stream to a per-session
- * logfile and replay it to the phone over SSE at `GET /api/session/:id/stream`,
- * normalized to the small event set the UI needs. The read is **offset-tailed**
- * — the same resumable pattern `hosts/progress.ts` uses for remote logs — so a
- * phone that drops mid-run reconnects with `?offset=<bytes>` (or the standard
- * `Last-Event-ID` header) and never loses or double-counts an event.
- *
- * Scope: this streams runs whose executor is the anchor itself (no `--device`).
- * Streaming a run offloaded to another box reuses `pullRemoteLogDelta` and is a
- * follow-up; see the changelog fragment.
- */
-import fs from 'fs';
-import path from 'path';
-import { getCacheDir } from '../state.js';
-/** Directory holding per-session NDJSON capture files. */
-export function streamDir() {
-    return path.join(getCacheDir(), 'serve', 'streams');
-}
-/** Capture-file path for a session id (id is sanitized to a safe filename). */
-export function streamLogPath(sessionId) {
-    const safe = sessionId.replace(/[^a-zA-Z0-9._-]/g, '_');
-    return path.join(streamDir(), `${safe}.ndjson`);
-}
-/** Event types that terminate a run's stream (close the SSE). */
-const TERMINAL = new Set(['result', 'error']);
-/**
- * Whether the run has ended — i.e. the file's LAST complete (newline-terminated)
- * line is a terminal event. This is independent of any read offset, so a client
- * that resumes from an offset already at/past the terminal event still learns
- * the run is done and the SSE closes (instead of hanging on a `done:false` read
- * that finds no new lines). Cheap: `readNewEvents` already has the full buffer.
- */
-function fileIsDone(buf) {
-    const lastNl = buf.lastIndexOf(0x0a);
-    if (lastNl < 0)
-        return false;
-    const lines = buf.subarray(0, lastNl + 1).toString('utf-8').split('\n');
-    for (let i = lines.length - 1; i >= 0; i--) {
-        const s = lines[i].trim();
-        if (!s)
-            continue; // skip trailing blank lines
-        try {
-            return TERMINAL.has(normalizeEvent(JSON.parse(s)).type);
-        }
-        catch {
-            return false; // last complete line is a partial/non-JSON write — not done
-        }
-    }
-    return false;
-}
-/**
- * Normalize one harness JSON line to a {@link StreamEvent}. Schemas differ per
- * agent (there is no unified enum in the CLI), so we key off the common `type`
- * field (Claude stream-json: `assistant` | `user` | `result` | `system`; a
- * tool-use lives inside an `assistant` message's content) and carry `raw`
- * through untouched so the client can render richer detail without the anchor
- * having to model every agent.
- */
-export function normalizeEvent(obj) {
-    const rec = obj;
-    const t = rec && typeof rec.type === 'string' ? rec.type : 'unknown';
-    return { type: t, raw: obj };
-}
-/**
- * Read complete NDJSON lines from `fromOffset`, byte-accurately. Each event
- * carries the exact byte offset past its own newline so an SSE client can set
- * `Last-Event-ID` per event and resume with neither loss nor duplication even
- * if the connection drops mid-batch. A trailing partial line (no newline yet)
- * is left unconsumed so the offset never splits a multi-byte event — the next
- * read picks it up once the harness flushes the newline. Non-JSON preamble
- * lines are skipped, not fatal.
- */
-export function readNewEvents(file, fromOffset) {
-    let buf;
-    try {
-        buf = fs.readFileSync(file);
-    }
-    catch {
-        // File not created yet (run still starting) — nothing to read, hold offset.
-        return { events: [], newOffset: fromOffset, done: false };
-    }
-    // `done` reflects the whole file's terminal state, so a resume at/past the
-    // terminal event still closes the stream rather than hanging forever.
-    const done = fileIsDone(buf);
-    if (fromOffset >= buf.length)
-        return { events: [], newOffset: fromOffset, done };
-    const slice = buf.subarray(fromOffset);
-    const lastNl = slice.lastIndexOf(0x0a);
-    if (lastNl < 0)
-        return { events: [], newOffset: fromOffset, done }; // no complete line yet
-    const events = [];
-    let lineStart = 0; // byte index within slice
-    for (let i = 0; i <= lastNl; i++) {
-        if (slice[i] !== 0x0a)
-            continue;
-        const lineBuf = slice.subarray(lineStart, i); // excludes the newline
-        const endOffset = fromOffset + i + 1; // absolute byte offset just past '\n'
-        lineStart = i + 1;
-        const s = lineBuf.toString('utf-8').trim();
-        if (!s)
-            continue;
-        let obj;
-        try {
-            obj = JSON.parse(s);
-        }
-        catch {
-            continue; // skip non-JSON (banner/preamble) lines
-        }
-        events.push({ event: normalizeEvent(obj), offset: endOffset });
-    }
-    return { events, newOffset: fromOffset + lastNl + 1, done };
-}

package/dist/lib/serve/token.d.ts

@@ -1,35 +0,0 @@
-/** One issued token, stored by hash only. */
-export interface ControlTokenRecord {
-    /** Short public id for display / revocation (not secret). */
-    id: string;
-    /** SHA-256 hex of the raw token. */
-    hash: string;
-    /** Human label, e.g. "muqsit-iphone". */
-    label: string;
-    createdAt: string;
-}
-/**
- * Mint a new control token, persist its hash, and return the raw token ONCE.
- * The caller must surface it to the operator immediately — it cannot be
- * recovered later.
- */
-export declare function addControlToken(label: string): {
-    id: string;
-    token: string;
-};
-/**
- * Ensure at least one token exists. Returns the raw token only when it had to
- * mint one (first `--control` boot); otherwise `{ created: false }` and the
- * existing tokens stand.
- */
-export declare function ensureControlToken(label?: string): {
-    created: true;
-    id: string;
-    token: string;
-} | {
-    created: false;
-};
-/** True when `presented` matches a stored token hash (constant-time compare). */
-export declare function verifyControlToken(presented: string | undefined): boolean;
-/** List issued tokens (hashes only — safe to display). */
-export declare function listControlTokens(): ControlTokenRecord[];