@poncho-ai/cli 0.2.0

package/dist/chunk-VOX2Q2V2.js

@@ -0,0 +1,1933 @@
+// src/index.ts
+import { spawn } from "child_process";
+import { access, cp, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import {
+  createServer
+} from "http";
+import { dirname as dirname2, resolve as resolve2 } from "path";
+import { createRequire } from "module";
+import { fileURLToPath } from "url";
+import {
+  AgentHarness,
+  TelemetryEmitter,
+  createStateStore,
+  loadAgentlConfig
+} from "@agentl/harness";
+import { Command } from "commander";
+import dotenv from "dotenv";
+import YAML from "yaml";
+
+// src/web-ui.ts
+import { createHash, randomUUID, timingSafeEqual } from "crypto";
+import { mkdir, readFile, writeFile } from "fs/promises";
+import { basename, dirname, resolve } from "path";
+import { homedir } from "os";
+var DEFAULT_OWNER = "local-owner";
+var FileConversationStore = class {
+  filePath;
+  conversations = /* @__PURE__ */ new Map();
+  loaded = false;
+  writing = Promise.resolve();
+  constructor(workingDir) {
+    const projectName = basename(workingDir).replace(/[^a-zA-Z0-9_-]+/g, "-") || "project";
+    const projectHash = createHash("sha256").update(workingDir).digest("hex").slice(0, 12);
+    this.filePath = resolve(
+      homedir(),
+      ".agentl",
+      "state",
+      `${projectName}-${projectHash}-web-ui-state.json`
+    );
+  }
+  async ensureLoaded() {
+    if (this.loaded) {
+      return;
+    }
+    this.loaded = true;
+    try {
+      const content = await readFile(this.filePath, "utf8");
+      const parsed = JSON.parse(content);
+      for (const conversation of parsed.conversations ?? []) {
+        this.conversations.set(conversation.conversationId, conversation);
+      }
+    } catch {
+    }
+  }
+  async persist() {
+    const payload = {
+      conversations: Array.from(this.conversations.values())
+    };
+    this.writing = this.writing.then(async () => {
+      await mkdir(dirname(this.filePath), { recursive: true });
+      await writeFile(this.filePath, JSON.stringify(payload, null, 2), "utf8");
+    });
+    await this.writing;
+  }
+  async list(ownerId = DEFAULT_OWNER) {
+    await this.ensureLoaded();
+    return Array.from(this.conversations.values()).filter((conversation) => conversation.ownerId === ownerId).sort((a, b) => b.updatedAt - a.updatedAt);
+  }
+  async get(conversationId) {
+    await this.ensureLoaded();
+    return this.conversations.get(conversationId);
+  }
+  async create(ownerId = DEFAULT_OWNER, title) {
+    await this.ensureLoaded();
+    const now = Date.now();
+    const conversation = {
+      conversationId: randomUUID(),
+      title: title && title.trim().length > 0 ? title.trim() : "New conversation",
+      messages: [],
+      ownerId,
+      tenantId: null,
+      createdAt: now,
+      updatedAt: now
+    };
+    this.conversations.set(conversation.conversationId, conversation);
+    await this.persist();
+    return conversation;
+  }
+  async update(conversation) {
+    await this.ensureLoaded();
+    this.conversations.set(conversation.conversationId, {
+      ...conversation,
+      updatedAt: Date.now()
+    });
+    await this.persist();
+  }
+  async rename(conversationId, title) {
+    await this.ensureLoaded();
+    const existing = this.conversations.get(conversationId);
+    if (!existing) {
+      return void 0;
+    }
+    const updated = {
+      ...existing,
+      title: title.trim().length > 0 ? title.trim() : existing.title,
+      updatedAt: Date.now()
+    };
+    this.conversations.set(conversationId, updated);
+    await this.persist();
+    return updated;
+  }
+  async delete(conversationId) {
+    await this.ensureLoaded();
+    const removed = this.conversations.delete(conversationId);
+    if (removed) {
+      await this.persist();
+    }
+    return removed;
+  }
+};
+var SessionStore = class {
+  sessions = /* @__PURE__ */ new Map();
+  ttlMs;
+  constructor(ttlMs = 1e3 * 60 * 60 * 8) {
+    this.ttlMs = ttlMs;
+  }
+  create(ownerId = DEFAULT_OWNER) {
+    const now = Date.now();
+    const session = {
+      sessionId: randomUUID(),
+      ownerId,
+      csrfToken: randomUUID(),
+      createdAt: now,
+      expiresAt: now + this.ttlMs,
+      lastSeenAt: now
+    };
+    this.sessions.set(session.sessionId, session);
+    return session;
+  }
+  get(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) {
+      return void 0;
+    }
+    if (Date.now() > session.expiresAt) {
+      this.sessions.delete(sessionId);
+      return void 0;
+    }
+    session.lastSeenAt = Date.now();
+    return session;
+  }
+  delete(sessionId) {
+    this.sessions.delete(sessionId);
+  }
+};
+var LoginRateLimiter = class {
+  constructor(maxAttempts = 5, windowMs = 1e3 * 60 * 5, lockoutMs = 1e3 * 60 * 10) {
+    this.maxAttempts = maxAttempts;
+    this.windowMs = windowMs;
+    this.lockoutMs = lockoutMs;
+  }
+  attempts = /* @__PURE__ */ new Map();
+  canAttempt(key) {
+    const current = this.attempts.get(key);
+    if (!current) {
+      return { allowed: true };
+    }
+    if (current.lockedUntil && Date.now() < current.lockedUntil) {
+      return {
+        allowed: false,
+        retryAfterSeconds: Math.ceil((current.lockedUntil - Date.now()) / 1e3)
+      };
+    }
+    return { allowed: true };
+  }
+  registerFailure(key) {
+    const now = Date.now();
+    const current = this.attempts.get(key);
+    if (!current || now - current.firstFailureAt > this.windowMs) {
+      this.attempts.set(key, { count: 1, firstFailureAt: now });
+      return { locked: false };
+    }
+    const count = current.count + 1;
+    const next = {
+      ...current,
+      count
+    };
+    if (count >= this.maxAttempts) {
+      next.lockedUntil = now + this.lockoutMs;
+      this.attempts.set(key, next);
+      return { locked: true, retryAfterSeconds: Math.ceil(this.lockoutMs / 1e3) };
+    }
+    this.attempts.set(key, next);
+    return { locked: false };
+  }
+  registerSuccess(key) {
+    this.attempts.delete(key);
+  }
+};
+var parseCookies = (request) => {
+  const cookieHeader = request.headers.cookie ?? "";
+  const pairs = cookieHeader.split(";").map((part) => part.trim()).filter(Boolean);
+  const cookies = {};
+  for (const pair of pairs) {
+    const index = pair.indexOf("=");
+    if (index <= 0) {
+      continue;
+    }
+    const key = pair.slice(0, index);
+    const value = pair.slice(index + 1);
+    cookies[key] = decodeURIComponent(value);
+  }
+  return cookies;
+};
+var setCookie = (response, name, value, options) => {
+  const segments = [`${name}=${encodeURIComponent(value)}`];
+  segments.push(`Path=${options.path ?? "/"}`);
+  if (typeof options.maxAge === "number") {
+    segments.push(`Max-Age=${Math.max(0, Math.floor(options.maxAge))}`);
+  }
+  if (options.httpOnly) {
+    segments.push("HttpOnly");
+  }
+  if (options.secure) {
+    segments.push("Secure");
+  }
+  if (options.sameSite) {
+    segments.push(`SameSite=${options.sameSite}`);
+  }
+  const previous = response.getHeader("Set-Cookie");
+  const serialized = segments.join("; ");
+  if (!previous) {
+    response.setHeader("Set-Cookie", serialized);
+    return;
+  }
+  if (Array.isArray(previous)) {
+    response.setHeader("Set-Cookie", [...previous, serialized]);
+    return;
+  }
+  response.setHeader("Set-Cookie", [String(previous), serialized]);
+};
+var verifyPassphrase = (provided, expected) => {
+  const providedBuffer = Buffer.from(provided);
+  const expectedBuffer = Buffer.from(expected);
+  if (providedBuffer.length !== expectedBuffer.length) {
+    const zero = Buffer.alloc(expectedBuffer.length);
+    return timingSafeEqual(expectedBuffer, zero) && false;
+  }
+  return timingSafeEqual(providedBuffer, expectedBuffer);
+};
+var getRequestIp = (request) => {
+  const forwarded = request.headers["x-forwarded-for"];
+  if (typeof forwarded === "string" && forwarded.trim().length > 0) {
+    return forwarded.split(",")[0]?.trim() ?? "unknown";
+  }
+  if (Array.isArray(forwarded) && forwarded[0]) {
+    return forwarded[0];
+  }
+  return request.socket.remoteAddress ?? "unknown";
+};
+var inferConversationTitle = (text) => {
+  const normalized = text.trim().replace(/\s+/g, " ");
+  if (!normalized) {
+    return "New conversation";
+  }
+  return normalized.length <= 48 ? normalized : `${normalized.slice(0, 48)}...`;
+};
+var renderWebUiHtml = () => `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>AgentL Web UI</title>
+    <style>
+      :root { color-scheme: dark; }
+      * { box-sizing: border-box; }
+      body { margin: 0; font-family: Inter, system-ui, -apple-system, Segoe UI, Roboto, sans-serif; background: #0f1117; color: #e9edf5; }
+      .shell { display: grid; grid-template-columns: 320px 1fr; min-height: 100vh; }
+      .sidebar { border-right: 1px solid #252a38; background: #121624; padding: 12px; display: flex; flex-direction: column; gap: 12px; }
+      .conversation-list { overflow: auto; display: flex; flex-direction: column; gap: 6px; }
+      .conversation-item { border: 1px solid #2c3347; border-radius: 8px; padding: 8px 10px; cursor: pointer; background: #171d2c; }
+      .conversation-item.active { border-color: #5b7cff; background: #1f2a4a; }
+      .conversation-title { font-size: 13px; font-weight: 600; margin-bottom: 2px; }
+      .conversation-meta { font-size: 11px; color: #9ca6bf; }
+      .conversation-actions { margin-top: 6px; display: flex; gap: 6px; }
+      .main { display: grid; grid-template-rows: auto 1fr auto; min-height: 100vh; }
+      .topbar { border-bottom: 1px solid #252a38; padding: 12px 16px; display: flex; justify-content: space-between; align-items: center; }
+      .status { color: #9ca6bf; font-size: 12px; }
+      .messages { padding: 20px; overflow: auto; display: flex; flex-direction: column; gap: 12px; }
+      .message { max-width: 760px; border-radius: 10px; padding: 10px 12px; white-space: pre-wrap; line-height: 1.35; }
+      .message.user { align-self: flex-end; background: #27417f; }
+      .message.assistant { align-self: flex-start; background: #1b2233; border: 1px solid #2c3347; }
+      .composer { border-top: 1px solid #252a38; padding: 12px 16px; display: grid; gap: 8px; }
+      textarea { width: 100%; min-height: 78px; border-radius: 10px; border: 1px solid #2c3347; background: #121624; color: #e9edf5; padding: 10px; resize: vertical; }
+      button { border: 1px solid #2c3347; background: #1a2133; color: #e9edf5; padding: 7px 10px; border-radius: 8px; cursor: pointer; }
+      button.primary { border-color: #4b6bff; background: #3656dd; }
+      button.danger { border-color: #6d2b3a; background: #3a1b24; }
+      button:disabled { opacity: 0.6; cursor: default; }
+      .row { display: flex; gap: 8px; align-items: center; }
+      .hidden { display: none !important; }
+      .auth { min-height: 100vh; display: grid; place-items: center; }
+      .auth-card { width: min(420px, 90vw); border: 1px solid #2c3347; background: #121624; border-radius: 12px; padding: 20px; display: grid; gap: 10px; }
+      input { width: 100%; border-radius: 10px; border: 1px solid #2c3347; background: #0f1117; color: #e9edf5; padding: 10px; }
+      .error { color: #ff9aa9; font-size: 12px; min-height: 16px; }
+      .empty { color: #9ca6bf; font-size: 13px; }
+      @media (max-width: 860px) {
+        .shell { grid-template-columns: 1fr; }
+        .sidebar { min-height: 220px; border-right: none; border-bottom: 1px solid #252a38; }
+        .main { min-height: calc(100vh - 220px); }
+      }
+    </style>
+  </head>
+  <body>
+    <div id="auth" class="auth hidden">
+      <form id="login-form" class="auth-card">
+        <h2 style="margin: 0">AgentL login</h2>
+        <p style="margin: 0; color: #9ca6bf; font-size: 13px">Enter the configured passphrase to use this UI.</p>
+        <input id="passphrase" type="password" autocomplete="current-password" placeholder="Passphrase" required />
+        <button class="primary" type="submit">Sign in</button>
+        <div id="login-error" class="error"></div>
+      </form>
+    </div>
+
+    <div id="app" class="shell hidden">
+      <aside class="sidebar">
+        <div class="row">
+          <button id="new-chat" class="primary">New chat</button>
+          <button id="refresh-list">Refresh</button>
+        </div>
+        <div id="conversation-list" class="conversation-list"></div>
+      </aside>
+
+      <section class="main">
+        <div class="topbar">
+          <div id="chat-title">AgentL</div>
+          <div class="row">
+            <span id="connection-status" class="status">idle</span>
+            <button id="rename-chat">Rename</button>
+            <button id="delete-chat" class="danger">Delete</button>
+            <button id="logout">Logout</button>
+          </div>
+        </div>
+        <div id="messages" class="messages">
+          <div class="empty">Select or create a conversation to start chatting.</div>
+        </div>
+        <form id="composer" class="composer">
+          <textarea id="prompt" placeholder="Send a message..."></textarea>
+          <div class="row">
+            <button id="send" class="primary" type="submit">Send</button>
+          </div>
+        </form>
+      </section>
+    </div>
+
+    <script>
+      const state = {
+        csrfToken: "",
+        conversations: [],
+        activeConversationId: null,
+        isStreaming: false
+      };
+
+      const elements = {
+        auth: document.getElementById("auth"),
+        app: document.getElementById("app"),
+        loginForm: document.getElementById("login-form"),
+        passphrase: document.getElementById("passphrase"),
+        loginError: document.getElementById("login-error"),
+        list: document.getElementById("conversation-list"),
+        newChat: document.getElementById("new-chat"),
+        refreshList: document.getElementById("refresh-list"),
+        messages: document.getElementById("messages"),
+        chatTitle: document.getElementById("chat-title"),
+        renameChat: document.getElementById("rename-chat"),
+        deleteChat: document.getElementById("delete-chat"),
+        logout: document.getElementById("logout"),
+        composer: document.getElementById("composer"),
+        prompt: document.getElementById("prompt"),
+        send: document.getElementById("send"),
+        connectionStatus: document.getElementById("connection-status")
+      };
+
+      const mutatingMethods = new Set(["POST", "PATCH", "PUT", "DELETE"]);
+
+      const api = async (path, options = {}) => {
+        const method = (options.method || "GET").toUpperCase();
+        const headers = { ...(options.headers || {}) };
+        if (mutatingMethods.has(method) && state.csrfToken) {
+          headers["x-csrf-token"] = state.csrfToken;
+        }
+        if (options.body && !headers["Content-Type"]) {
+          headers["Content-Type"] = "application/json";
+        }
+        const response = await fetch(path, { credentials: "include", ...options, method, headers });
+        if (!response.ok) {
+          let payload = {};
+          try { payload = await response.json(); } catch {}
+          const error = new Error(payload.message || ("Request failed: " + response.status));
+          error.status = response.status;
+          error.payload = payload;
+          throw error;
+        }
+        const contentType = response.headers.get("content-type") || "";
+        if (contentType.includes("application/json")) {
+          return await response.json();
+        }
+        return await response.text();
+      };
+
+      const formatDate = (epoch) => {
+        try { return new Date(epoch).toLocaleString(); } catch { return ""; }
+      };
+
+      const renderConversationList = () => {
+        elements.list.innerHTML = "";
+        if (state.conversations.length === 0) {
+          const empty = document.createElement("div");
+          empty.className = "empty";
+          empty.textContent = "No conversations yet.";
+          elements.list.appendChild(empty);
+          return;
+        }
+        for (const conversation of state.conversations) {
+          const item = document.createElement("div");
+          item.className = "conversation-item" + (conversation.conversationId === state.activeConversationId ? " active" : "");
+          item.innerHTML = '<div class="conversation-title"></div><div class="conversation-meta"></div>';
+          item.querySelector(".conversation-title").textContent = conversation.title;
+          item.querySelector(".conversation-meta").textContent = formatDate(conversation.updatedAt);
+          item.addEventListener("click", async () => {
+            state.activeConversationId = conversation.conversationId;
+            renderConversationList();
+            await loadConversation(conversation.conversationId);
+          });
+          elements.list.appendChild(item);
+        }
+      };
+
+      const renderMessages = (messages) => {
+        elements.messages.innerHTML = "";
+        if (!messages || messages.length === 0) {
+          const empty = document.createElement("div");
+          empty.className = "empty";
+          empty.textContent = "Start the conversation by sending a message.";
+          elements.messages.appendChild(empty);
+          return;
+        }
+        for (const message of messages) {
+          const node = document.createElement("div");
+          node.className = "message " + (message.role === "assistant" ? "assistant" : "user");
+          node.textContent = String(message.content || "");
+          elements.messages.appendChild(node);
+        }
+        elements.messages.scrollTop = elements.messages.scrollHeight;
+      };
+
+      const loadConversations = async () => {
+        const payload = await api("/api/conversations");
+        state.conversations = payload.conversations || [];
+        renderConversationList();
+      };
+
+      const loadConversation = async (conversationId) => {
+        const payload = await api("/api/conversations/" + encodeURIComponent(conversationId));
+        elements.chatTitle.textContent = payload.conversation.title;
+        renderMessages(payload.conversation.messages);
+      };
+
+      const createConversation = async (title) => {
+        const payload = await api("/api/conversations", {
+          method: "POST",
+          body: JSON.stringify(title ? { title } : {})
+        });
+        state.activeConversationId = payload.conversation.conversationId;
+        await loadConversations();
+        await loadConversation(state.activeConversationId);
+        return state.activeConversationId;
+      };
+
+      const parseSseChunk = (buffer, onEvent) => {
+        let rest = buffer;
+        while (true) {
+          const index = rest.indexOf("\\n\\n");
+          if (index < 0) {
+            return rest;
+          }
+          const raw = rest.slice(0, index);
+          rest = rest.slice(index + 2);
+          const lines = raw.split("\\n");
+          let eventName = "message";
+          let data = "";
+          for (const line of lines) {
+            if (line.startsWith("event:")) {
+              eventName = line.slice(6).trim();
+            } else if (line.startsWith("data:")) {
+              data += line.slice(5).trim();
+            }
+          }
+          if (data) {
+            try {
+              onEvent(eventName, JSON.parse(data));
+            } catch {}
+          }
+        }
+      };
+
+      const setStreaming = (value) => {
+        state.isStreaming = value;
+        elements.send.disabled = value;
+        elements.prompt.disabled = value;
+        elements.connectionStatus.textContent = value ? "streaming..." : "idle";
+      };
+
+      const sendMessage = async (text) => {
+        const messageText = (text || "").trim();
+        if (!messageText || state.isStreaming) {
+          return;
+        }
+        let conversationId = state.activeConversationId;
+        if (!conversationId) {
+          conversationId = await createConversation(messageText);
+        }
+        const existingPayload = await api("/api/conversations/" + encodeURIComponent(conversationId));
+        const localMessages = [...(existingPayload.conversation.messages || []), { role: "user", content: messageText }];
+        let assistantMessage = { role: "assistant", content: "" };
+        localMessages.push(assistantMessage);
+        renderMessages(localMessages);
+        setStreaming(true);
+        try {
+          const response = await fetch("/api/conversations/" + encodeURIComponent(conversationId) + "/messages", {
+            method: "POST",
+            credentials: "include",
+            headers: { "Content-Type": "application/json", "x-csrf-token": state.csrfToken },
+            body: JSON.stringify({ message: messageText })
+          });
+          if (!response.ok || !response.body) {
+            throw new Error("Failed to stream response");
+          }
+          const reader = response.body.getReader();
+          const decoder = new TextDecoder();
+          let buffer = "";
+          while (true) {
+            const { value, done } = await reader.read();
+            if (done) {
+              break;
+            }
+            buffer += decoder.decode(value, { stream: true });
+            buffer = parseSseChunk(buffer, (eventName, payload) => {
+              if (eventName === "model:chunk") {
+                assistantMessage.content += String(payload.content || "");
+                renderMessages(localMessages);
+              }
+              if (eventName === "run:completed" && (!assistantMessage.content || assistantMessage.content.length === 0)) {
+                assistantMessage.content = String(payload.result?.response || "");
+                renderMessages(localMessages);
+              }
+            });
+          }
+          await loadConversations();
+          await loadConversation(conversationId);
+        } finally {
+          setStreaming(false);
+        }
+      };
+
+      const requireAuth = async () => {
+        try {
+          const session = await api("/api/auth/session");
+          if (!session.authenticated) {
+            elements.auth.classList.remove("hidden");
+            elements.app.classList.add("hidden");
+            return false;
+          }
+          state.csrfToken = session.csrfToken || "";
+          elements.auth.classList.add("hidden");
+          elements.app.classList.remove("hidden");
+          return true;
+        } catch {
+          elements.auth.classList.remove("hidden");
+          elements.app.classList.add("hidden");
+          return false;
+        }
+      };
+
+      elements.loginForm.addEventListener("submit", async (event) => {
+        event.preventDefault();
+        elements.loginError.textContent = "";
+        try {
+          const result = await api("/api/auth/login", {
+            method: "POST",
+            body: JSON.stringify({ passphrase: elements.passphrase.value || "" })
+          });
+          state.csrfToken = result.csrfToken || "";
+          elements.passphrase.value = "";
+          elements.auth.classList.add("hidden");
+          elements.app.classList.remove("hidden");
+          await loadConversations();
+          if (state.conversations[0]) {
+            state.activeConversationId = state.conversations[0].conversationId;
+            await loadConversation(state.activeConversationId);
+          }
+        } catch (error) {
+          elements.loginError.textContent = error.message || "Login failed";
+        }
+      });
+
+      elements.newChat.addEventListener("click", async () => {
+        await createConversation();
+      });
+
+      elements.refreshList.addEventListener("click", async () => {
+        await loadConversations();
+      });
+
+      elements.renameChat.addEventListener("click", async () => {
+        if (!state.activeConversationId) {
+          return;
+        }
+        const nextTitle = window.prompt("Rename conversation");
+        if (!nextTitle) {
+          return;
+        }
+        await api("/api/conversations/" + encodeURIComponent(state.activeConversationId), {
+          method: "PATCH",
+          body: JSON.stringify({ title: nextTitle })
+        });
+        await loadConversations();
+        await loadConversation(state.activeConversationId);
+      });
+
+      elements.deleteChat.addEventListener("click", async () => {
+        if (!state.activeConversationId) {
+          return;
+        }
+        if (!window.confirm("Delete this conversation?")) {
+          return;
+        }
+        await api("/api/conversations/" + encodeURIComponent(state.activeConversationId), { method: "DELETE" });
+        state.activeConversationId = null;
+        elements.chatTitle.textContent = "AgentL";
+        renderMessages([]);
+        await loadConversations();
+      });
+
+      elements.logout.addEventListener("click", async () => {
+        await api("/api/auth/logout", { method: "POST" });
+        state.activeConversationId = null;
+        state.conversations = [];
+        state.csrfToken = "";
+        await requireAuth();
+      });
+
+      elements.composer.addEventListener("submit", async (event) => {
+        event.preventDefault();
+        const value = elements.prompt.value;
+        elements.prompt.value = "";
+        await sendMessage(value);
+      });
+
+      (async () => {
+        const authenticated = await requireAuth();
+        if (!authenticated) {
+          return;
+        }
+        await loadConversations();
+        if (state.conversations[0]) {
+          state.activeConversationId = state.conversations[0].conversationId;
+          await loadConversation(state.activeConversationId);
+          renderConversationList();
+        }
+      })();
+    </script>
+  </body>
+</html>`;
+
+// src/index.ts
+var __dirname = dirname2(fileURLToPath(import.meta.url));
+var require2 = createRequire(import.meta.url);
+var writeJson = (response, statusCode, payload) => {
+  response.writeHead(statusCode, { "Content-Type": "application/json" });
+  response.end(JSON.stringify(payload));
+};
+var writeHtml = (response, statusCode, payload) => {
+  response.writeHead(statusCode, { "Content-Type": "text/html; charset=utf-8" });
+  response.end(payload);
+};
+var readRequestBody = async (request) => {
+  const chunks = [];
+  for await (const chunk of request) {
+    chunks.push(Buffer.from(chunk));
+  }
+  const body = Buffer.concat(chunks).toString("utf8");
+  return body.length > 0 ? JSON.parse(body) : {};
+};
+var resolveHarnessEnvironment = () => {
+  const value = (process.env.AGENTL_ENV ?? process.env.NODE_ENV ?? "development").toLowerCase();
+  if (value === "production" || value === "staging") {
+    return value;
+  }
+  return "development";
+};
+var listenOnAvailablePort = async (server, preferredPort) => await new Promise((resolveListen, rejectListen) => {
+  let currentPort = preferredPort;
+  const tryListen = () => {
+    const onListening = () => {
+      server.off("error", onError);
+      const address = server.address();
+      if (address && typeof address === "object" && typeof address.port === "number") {
+        resolveListen(address.port);
+        return;
+      }
+      resolveListen(currentPort);
+    };
+    const onError = (error) => {
+      server.off("listening", onListening);
+      if (typeof error === "object" && error !== null && "code" in error && error.code === "EADDRINUSE") {
+        currentPort += 1;
+        if (currentPort > 65535) {
+          rejectListen(
+            new Error(
+              "No available ports found from the requested port up to 65535."
+            )
+          );
+          return;
+        }
+        setImmediate(tryListen);
+        return;
+      }
+      rejectListen(error);
+    };
+    server.once("listening", onListening);
+    server.once("error", onError);
+    server.listen(currentPort);
+  };
+  tryListen();
+});
+var parseParams = (values) => {
+  const params = {};
+  for (const value of values) {
+    const [key, ...rest] = value.split("=");
+    if (!key) {
+      continue;
+    }
+    params[key] = rest.join("=");
+  }
+  return params;
+};
+var AGENT_SKILL_GUIDANCE = `## Skill Authoring Guidance
+
+When asked to create or update a skill:
+
+1. Inspect current skills under \`skills/\` first (\`list_directory\`, \`read_file\`).
+2. Decide skill type before writing files:
+   - **Instruction skill (no tool code)** for summarization, rewriting, classification, translation, planning, and other pure language tasks.
+   - **Tool-backed skill** only when external I/O, deterministic transforms, side effects, or integrations are required.
+3. If creating a tool-backed skill, create/update:
+   - \`skills/<skill-name>/SKILL.md\`
+   - \`skills/<skill-name>/tools/<tool-name>.ts\`
+4. Keep tool names and schemas explicit and stable.
+5. Never create placeholder tool handlers for tasks the model can already do directly.
+6. After writing files, verify by listing/reading the created paths.
+7. Ask the user to run \`agentl tools\` to confirm the new tool is discovered (when tools were added).
+
+Skill file conventions:
+- \`SKILL.md\` frontmatter should include \`name\`, \`description\`, and \`tools\`.
+- Tool modules should export a default tool definition object with:
+  - \`name\`
+  - \`description\`
+  - \`inputSchema\`
+  - \`handler\``;
+var AGENT_TEMPLATE = `---
+name: my-agent
+description: A helpful AgentL assistant
+model:
+  provider: anthropic
+  name: claude-opus-4-5
+  temperature: 0.2
+limits:
+  maxSteps: 50
+  timeout: 300
+---
+
+# My Agent
+
+You are a helpful assistant built with AgentL.
+
+Working directory: {{runtime.workingDir}}
+Environment: {{runtime.environment}}
+
+## Task Guidance
+
+- Use tools when needed
+- Explain your reasoning clearly
+- Ask clarifying questions when requirements are ambiguous
+- Never claim a file/tool change unless the corresponding tool call actually succeeded
+
+## Default Capabilities in a Fresh Project
+
+- Built-in tools: \`list_directory\` and \`read_file\`
+- \`write_file\` is available in development, and disabled by default in production
+- A starter local skill is included (\`starter-echo\`)
+- Bash/shell commands are **not** available unless you install and enable a shell tool/skill
+- Git operations are only available if a git-capable tool/skill is configured
+
+${AGENT_SKILL_GUIDANCE}
+`;
+var CONFIG_TEMPLATE = `export default {
+  mcp: [],
+  auth: { required: false },
+  state: { provider: 'memory', ttl: 3600 },
+  telemetry: { enabled: true }
+}
+`;
+var PACKAGE_TEMPLATE = (name) => JSON.stringify(
+  {
+    name,
+    private: true,
+    type: "module",
+    dependencies: {
+      "@agentl/harness": "^0.1.0",
+      "@agentl/sdk": "^0.1.0"
+    }
+  },
+  null,
+  2
+);
+var ENV_TEMPLATE = "ANTHROPIC_API_KEY=sk-ant-...\n";
+var GITIGNORE_TEMPLATE = ".env\nnode_modules\ndist\n";
+var VERCEL_RUNTIME_DEPENDENCIES = {
+  "@anthropic-ai/sdk": "^0.74.0",
+  "@aws-sdk/client-dynamodb": "^3.988.0",
+  "@latitude-data/telemetry": "^2.0.2",
+  "@vercel/kv": "^3.0.0",
+  commander: "^12.0.0",
+  dotenv: "^16.4.0",
+  jiti: "^2.6.1",
+  mustache: "^4.2.0",
+  openai: "^6.3.0",
+  redis: "^5.10.0",
+  ws: "^8.18.0",
+  yaml: "^2.8.1"
+};
+var TEST_TEMPLATE = `tests:
+  - name: "Basic sanity"
+    task: "What is 2 + 2?"
+    expect:
+      contains: "4"
+`;
+var SKILL_TEMPLATE = `---
+name: starter-skill
+version: 1.0.0
+description: Starter local skill template
+tools:
+  - starter-echo
+---
+
+# Starter Skill
+
+This is a starter local skill created by \`agentl init\`.
+
+## Authoring Notes
+
+- Keep the \`tools\` frontmatter list in sync with actual tool module names.
+- Prefer narrow, explicit schemas for predictable tool calling.
+- After edits, run \`agentl tools\` to confirm discovery.
+`;
+var SKILL_TOOL_TEMPLATE = `export default {
+  name: "starter-echo",
+  description: "Echoes a message for testing local skill wiring",
+  inputSchema: {
+    type: "object",
+    properties: {
+      message: { type: "string", description: "Message to echo" }
+    },
+    required: ["message"]
+  },
+  async handler(input) {
+    return { echoed: input.message };
+  }
+};
+`;
+var ensureFile = async (path, content) => {
+  await mkdir2(dirname2(path), { recursive: true });
+  await writeFile2(path, content, { encoding: "utf8", flag: "wx" });
+};
+var copyIfExists = async (sourcePath, destinationPath) => {
+  try {
+    await access(sourcePath);
+  } catch {
+    return;
+  }
+  await mkdir2(dirname2(destinationPath), { recursive: true });
+  await cp(sourcePath, destinationPath, { recursive: true });
+};
+var resolveCliEntrypoint = async () => {
+  const sourceEntrypoint = resolve2(packageRoot, "src", "index.ts");
+  try {
+    await access(sourceEntrypoint);
+    return sourceEntrypoint;
+  } catch {
+    return resolve2(packageRoot, "dist", "index.js");
+  }
+};
+var buildVercelHandlerBundle = async (outDir) => {
+  const { build: esbuild } = await import("esbuild");
+  const cliEntrypoint = await resolveCliEntrypoint();
+  const tempEntry = resolve2(outDir, "api", "_entry.js");
+  await writeFile2(
+    tempEntry,
+    `import { startDevServer } from ${JSON.stringify(cliEntrypoint)};
+let serverPromise;
+export default async function handler(req, res) {
+  if (!serverPromise) {
+    serverPromise = startDevServer(0, { workingDir: process.cwd() });
+  }
+  const server = await serverPromise;
+  server.emit("request", req, res);
+}
+`,
+    "utf8"
+  );
+  await esbuild({
+    entryPoints: [tempEntry],
+    bundle: true,
+    platform: "node",
+    format: "esm",
+    target: "node20",
+    outfile: resolve2(outDir, "api", "index.js"),
+    sourcemap: false,
+    legalComments: "none",
+    external: [
+      ...Object.keys(VERCEL_RUNTIME_DEPENDENCIES),
+      "@anthropic-ai/sdk/*",
+      "child_process",
+      "fs",
+      "fs/promises",
+      "http",
+      "https",
+      "path",
+      "module",
+      "url",
+      "readline",
+      "readline/promises",
+      "crypto",
+      "stream",
+      "events",
+      "util",
+      "os",
+      "zlib",
+      "net",
+      "tls",
+      "dns",
+      "assert",
+      "buffer",
+      "timers",
+      "timers/promises",
+      "node:child_process",
+      "node:fs",
+      "node:fs/promises",
+      "node:http",
+      "node:https",
+      "node:path",
+      "node:module",
+      "node:url",
+      "node:readline",
+      "node:readline/promises",
+      "node:crypto",
+      "node:stream",
+      "node:events",
+      "node:util",
+      "node:os",
+      "node:zlib",
+      "node:net",
+      "node:tls",
+      "node:dns",
+      "node:assert",
+      "node:buffer",
+      "node:timers",
+      "node:timers/promises"
+    ]
+  });
+};
+var writeConfigFile = async (workingDir, config) => {
+  const serialized = `export default ${JSON.stringify(config, null, 2)}
+`;
+  await writeFile2(resolve2(workingDir, "agentl.config.js"), serialized, "utf8");
+};
+var extractToken = (request, authConfig) => {
+  if (authConfig.type === "header") {
+    const headerName = (authConfig.headerName ?? "x-agent-api-key").toLowerCase();
+    const raw = request.headers[headerName];
+    return Array.isArray(raw) ? raw[0] ?? "" : raw ?? "";
+  }
+  const authHeader = request.headers.authorization ?? "";
+  if (authHeader.toLowerCase().startsWith("bearer ")) {
+    return authHeader.slice(7).trim();
+  }
+  return "";
+};
+var authorizeRequest = async (request, config) => {
+  const authConfig = config?.auth;
+  if (!authConfig?.required) {
+    return true;
+  }
+  const token = extractToken(request, authConfig);
+  if (!token) {
+    return false;
+  }
+  if (authConfig.validate) {
+    return await authConfig.validate(token, request);
+  }
+  return token === (process.env.AGENT_API_KEY ?? "");
+};
+var initProject = async (projectName, options) => {
+  const baseDir = options?.workingDir ?? process.cwd();
+  const projectDir = resolve2(baseDir, projectName);
+  await mkdir2(projectDir, { recursive: true });
+  await ensureFile(resolve2(projectDir, "AGENT.md"), AGENT_TEMPLATE);
+  await ensureFile(resolve2(projectDir, "agentl.config.js"), CONFIG_TEMPLATE);
+  await ensureFile(resolve2(projectDir, "package.json"), PACKAGE_TEMPLATE(projectName));
+  await ensureFile(resolve2(projectDir, ".env.example"), ENV_TEMPLATE);
+  await ensureFile(resolve2(projectDir, ".gitignore"), GITIGNORE_TEMPLATE);
+  await ensureFile(resolve2(projectDir, "tests", "basic.yaml"), TEST_TEMPLATE);
+  await ensureFile(resolve2(projectDir, "skills", "starter", "SKILL.md"), SKILL_TEMPLATE);
+  await ensureFile(
+    resolve2(projectDir, "skills", "starter", "tools", "starter-echo.ts"),
+    SKILL_TOOL_TEMPLATE
+  );
+  process.stdout.write(`Initialized AgentL project at ${projectDir}
+`);
+};
+var updateAgentGuidance = async (workingDir) => {
+  const agentPath = resolve2(workingDir, "AGENT.md");
+  const content = await readFile2(agentPath, "utf8");
+  const guidanceSectionPattern = /## Skill Authoring Guidance[\s\S]*?(?=\n## |\n# |$)/;
+  const normalized = content.replace(/\s+$/g, "");
+  const hasGuidance = guidanceSectionPattern.test(normalized);
+  const updated = hasGuidance ? normalized.replace(guidanceSectionPattern, AGENT_SKILL_GUIDANCE) : `${normalized}
+
+${AGENT_SKILL_GUIDANCE}
+`;
+  if (updated === normalized) {
+    process.stdout.write("AGENT.md guidance is already up to date.\n");
+    return false;
+  }
+  await writeFile2(agentPath, updated, "utf8");
+  process.stdout.write("Updated AGENT.md with latest skill authoring guidance.\n");
+  return true;
+};
+var formatSseEvent = (event) => `event: ${event.type}
+data: ${JSON.stringify(event)}
+
+`;
+var startDevServer = async (port, options) => {
+  const workingDir = options?.workingDir ?? process.cwd();
+  dotenv.config({ path: resolve2(workingDir, ".env") });
+  const config = await loadAgentlConfig(workingDir);
+  const harness = new AgentHarness({ workingDir });
+  await harness.initialize();
+  const telemetry = new TelemetryEmitter(config?.telemetry);
+  const stateStore = createStateStore(config?.state);
+  const conversationStore = new FileConversationStore(workingDir);
+  const sessionStore = new SessionStore();
+  const loginRateLimiter = new LoginRateLimiter();
+  const passphrase = process.env.AGENT_UI_PASSPHRASE ?? "";
+  const isProduction = resolveHarnessEnvironment() === "production";
+  if (isProduction && passphrase.length === 0) {
+    throw new Error("AGENT_UI_PASSPHRASE is required when AGENTL_ENV/NODE_ENV is production.");
+  }
+  const requireUiAuth = passphrase.length > 0;
+  const secureCookies = isProduction;
+  const server = createServer(async (request, response) => {
+    if (!request.url || !request.method) {
+      writeJson(response, 404, { error: "Not found" });
+      return;
+    }
+    const [pathname] = request.url.split("?");
+    if (pathname === "/" && request.method === "GET") {
+      writeHtml(response, 200, renderWebUiHtml());
+      return;
+    }
+    if (pathname === "/health" && request.method === "GET") {
+      writeJson(response, 200, { status: "ok" });
+      return;
+    }
+    const cookies = parseCookies(request);
+    const sessionId = cookies.agentl_session;
+    const session = sessionId ? sessionStore.get(sessionId) : void 0;
+    const ownerId = session?.ownerId ?? "local-owner";
+    const requiresCsrfValidation = request.method !== "GET" && request.method !== "HEAD" && request.method !== "OPTIONS";
+    if (pathname === "/api/auth/session" && request.method === "GET") {
+      if (!requireUiAuth) {
+        writeJson(response, 200, { authenticated: true, csrfToken: "" });
+        return;
+      }
+      if (!session) {
+        writeJson(response, 200, { authenticated: false });
+        return;
+      }
+      writeJson(response, 200, {
+        authenticated: true,
+        sessionId: session.sessionId,
+        ownerId: session.ownerId,
+        csrfToken: session.csrfToken
+      });
+      return;
+    }
+    if (pathname === "/api/auth/login" && request.method === "POST") {
+      if (!requireUiAuth) {
+        writeJson(response, 200, { authenticated: true, csrfToken: "" });
+        return;
+      }
+      const ip = getRequestIp(request);
+      const canAttempt = loginRateLimiter.canAttempt(ip);
+      if (!canAttempt.allowed) {
+        writeJson(response, 429, {
+          code: "AUTH_RATE_LIMIT",
+          message: "Too many failed login attempts. Try again later.",
+          retryAfterSeconds: canAttempt.retryAfterSeconds
+        });
+        return;
+      }
+      const body = await readRequestBody(request);
+      const provided = body.passphrase ?? "";
+      if (!verifyPassphrase(provided, passphrase)) {
+        const failure = loginRateLimiter.registerFailure(ip);
+        writeJson(response, 401, {
+          code: "AUTH_ERROR",
+          message: "Invalid passphrase",
+          retryAfterSeconds: failure.retryAfterSeconds
+        });
+        return;
+      }
+      loginRateLimiter.registerSuccess(ip);
+      const createdSession = sessionStore.create(ownerId);
+      setCookie(response, "agentl_session", createdSession.sessionId, {
+        httpOnly: true,
+        secure: secureCookies,
+        sameSite: "Lax",
+        path: "/",
+        maxAge: 60 * 60 * 8
+      });
+      writeJson(response, 200, {
+        authenticated: true,
+        csrfToken: createdSession.csrfToken
+      });
+      return;
+    }
+    if (pathname === "/api/auth/logout" && request.method === "POST") {
+      if (session?.sessionId) {
+        sessionStore.delete(session.sessionId);
+      }
+      setCookie(response, "agentl_session", "", {
+        httpOnly: true,
+        secure: secureCookies,
+        sameSite: "Lax",
+        path: "/",
+        maxAge: 0
+      });
+      writeJson(response, 200, { ok: true });
+      return;
+    }
+    if (pathname.startsWith("/api/")) {
+      if (requireUiAuth && !session) {
+        writeJson(response, 401, {
+          code: "AUTH_ERROR",
+          message: "Authentication required"
+        });
+        return;
+      }
+      if (requireUiAuth && requiresCsrfValidation && pathname !== "/api/auth/login" && request.headers["x-csrf-token"] !== session?.csrfToken) {
+        writeJson(response, 403, {
+          code: "CSRF_ERROR",
+          message: "Invalid CSRF token"
+        });
+        return;
+      }
+    }
+    if (pathname === "/api/conversations" && request.method === "GET") {
+      const conversations = await conversationStore.list(ownerId);
+      writeJson(response, 200, {
+        conversations: conversations.map((conversation) => ({
+          conversationId: conversation.conversationId,
+          title: conversation.title,
+          runtimeRunId: conversation.runtimeRunId,
+          ownerId: conversation.ownerId,
+          tenantId: conversation.tenantId,
+          createdAt: conversation.createdAt,
+          updatedAt: conversation.updatedAt,
+          messageCount: conversation.messages.length
+        }))
+      });
+      return;
+    }
+    if (pathname === "/api/conversations" && request.method === "POST") {
+      const body = await readRequestBody(request);
+      const conversation = await conversationStore.create(ownerId, body.title);
+      writeJson(response, 201, { conversation });
+      return;
+    }
+    const conversationPathMatch = pathname.match(/^\/api\/conversations\/([^/]+)$/);
+    if (conversationPathMatch) {
+      const conversationId = decodeURIComponent(conversationPathMatch[1] ?? "");
+      const conversation = await conversationStore.get(conversationId);
+      if (!conversation || conversation.ownerId !== ownerId) {
+        writeJson(response, 404, {
+          code: "CONVERSATION_NOT_FOUND",
+          message: "Conversation not found"
+        });
+        return;
+      }
+      if (request.method === "GET") {
+        writeJson(response, 200, { conversation });
+        return;
+      }
+      if (request.method === "PATCH") {
+        const body = await readRequestBody(request);
+        if (!body.title || body.title.trim().length === 0) {
+          writeJson(response, 400, {
+            code: "VALIDATION_ERROR",
+            message: "title is required"
+          });
+          return;
+        }
+        const updated = await conversationStore.rename(conversationId, body.title);
+        writeJson(response, 200, { conversation: updated });
+        return;
+      }
+      if (request.method === "DELETE") {
+        await conversationStore.delete(conversationId);
+        writeJson(response, 200, { ok: true });
+        return;
+      }
+    }
+    const conversationMessageMatch = pathname.match(/^\/api\/conversations\/([^/]+)\/messages$/);
+    if (conversationMessageMatch && request.method === "POST") {
+      const conversationId = decodeURIComponent(conversationMessageMatch[1] ?? "");
+      const conversation = await conversationStore.get(conversationId);
+      if (!conversation || conversation.ownerId !== ownerId) {
+        writeJson(response, 404, {
+          code: "CONVERSATION_NOT_FOUND",
+          message: "Conversation not found"
+        });
+        return;
+      }
+      const body = await readRequestBody(request);
+      const messageText = body.message?.trim() ?? "";
+      if (!messageText) {
+        writeJson(response, 400, {
+          code: "VALIDATION_ERROR",
+          message: "message is required"
+        });
+        return;
+      }
+      if (conversation.messages.length === 0 && (conversation.title === "New conversation" || conversation.title.trim().length === 0)) {
+        conversation.title = inferConversationTitle(messageText);
+      }
+      response.writeHead(200, {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        Connection: "keep-alive"
+      });
+      let latestRunId = conversation.runtimeRunId ?? "";
+      let assistantResponse = "";
+      try {
+        for await (const event of harness.run({
+          task: messageText,
+          parameters: body.parameters,
+          messages: conversation.messages
+        })) {
+          if (event.type === "run:started") {
+            latestRunId = event.runId;
+          }
+          if (event.type === "model:chunk") {
+            assistantResponse += event.content;
+          }
+          if (event.type === "run:completed" && assistantResponse.length === 0 && event.result.response) {
+            assistantResponse = event.result.response;
+          }
+          await telemetry.emit(event);
+          response.write(formatSseEvent(event));
+        }
+        conversation.messages = [
+          ...conversation.messages,
+          { role: "user", content: messageText },
+          { role: "assistant", content: assistantResponse }
+        ];
+        conversation.runtimeRunId = latestRunId || conversation.runtimeRunId;
+        conversation.updatedAt = Date.now();
+        await conversationStore.update(conversation);
+      } catch (error) {
+        response.write(
+          formatSseEvent({
+            type: "run:error",
+            runId: latestRunId || "run_unknown",
+            error: {
+              code: "RUN_ERROR",
+              message: error instanceof Error ? error.message : "Unknown error"
+            }
+          })
+        );
+      } finally {
+        response.end();
+      }
+      return;
+    }
+    if (!await authorizeRequest(request, config)) {
+      writeJson(response, 401, {
+        code: "AUTH_ERROR",
+        message: "Authentication failed"
+      });
+      return;
+    }
+    if (pathname === "/run/sync" && request.method === "POST") {
+      try {
+        const input = await readRequestBody(request);
+        const output = await harness.runToCompletion(input);
+        await stateStore.set({
+          runId: output.runId,
+          messages: output.messages,
+          updatedAt: Date.now()
+        });
+        for (const event of output.events) {
+          await telemetry.emit(event);
+        }
+        writeJson(response, 200, {
+          runId: output.runId,
+          status: output.result.status,
+          result: output.result
+        });
+      } catch (error) {
+        writeJson(response, 500, {
+          code: "RUN_ERROR",
+          message: error instanceof Error ? error.message : "Unknown error"
+        });
+      }
+      return;
+    }
+    if (pathname === "/run" && request.method === "POST") {
+      response.writeHead(200, {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-cache",
+        Connection: "keep-alive"
+      });
+      try {
+        const input = await readRequestBody(request);
+        let runId = "";
+        let finalResponse = "";
+        const baseMessages = [
+          ...input.messages ?? [],
+          { role: "user", content: input.task }
+        ];
+        for await (const event of harness.run(input)) {
+          if (event.type === "run:started") {
+            runId = event.runId;
+          }
+          if (event.type === "run:completed") {
+            finalResponse = event.result.response ?? "";
+          }
+          await telemetry.emit(event);
+          response.write(formatSseEvent(event));
+        }
+        if (runId) {
+          await stateStore.set({
+            runId,
+            messages: [...baseMessages, { role: "assistant", content: finalResponse }],
+            updatedAt: Date.now()
+          });
+        }
+      } catch (error) {
+        response.write(
+          formatSseEvent({
+            type: "run:error",
+            runId: "run_unknown",
+            error: {
+              code: "RUN_ERROR",
+              message: error instanceof Error ? error.message : "Unknown error"
+            }
+          })
+        );
+      } finally {
+        response.end();
+      }
+      return;
+    }
+    if (pathname === "/continue" && request.method === "POST") {
+      try {
+        const body = await readRequestBody(request);
+        if (!body.runId || !body.message) {
+          writeJson(response, 400, {
+            code: "VALIDATION_ERROR",
+            message: "Both runId and message are required"
+          });
+          return;
+        }
+        const state = await stateStore.get(body.runId);
+        if (!state) {
+          writeJson(response, 404, {
+            code: "RUN_NOT_FOUND",
+            message: `No conversation found for runId ${body.runId}`
+          });
+          return;
+        }
+        const output = await harness.runToCompletion({
+          task: body.message,
+          parameters: body.parameters,
+          messages: state.messages
+        });
+        await stateStore.set({
+          runId: output.runId,
+          messages: output.messages,
+          updatedAt: Date.now()
+        });
+        for (const event of output.events) {
+          await telemetry.emit(event);
+        }
+        writeJson(response, 200, {
+          runId: output.runId,
+          status: output.result.status,
+          result: output.result
+        });
+      } catch (error) {
+        writeJson(response, 500, {
+          code: "CONTINUE_ERROR",
+          message: error instanceof Error ? error.message : "Unknown error"
+        });
+      }
+      return;
+    }
+    writeJson(response, 404, { error: "Not found" });
+  });
+  const actualPort = await listenOnAvailablePort(server, port);
+  if (actualPort !== port) {
+    process.stdout.write(
+      `Port ${port} is in use, switched to ${actualPort}.
+`
+    );
+  }
+  process.stdout.write(`AgentL dev server running at http://localhost:${actualPort}
+`);
+  return server;
+};
+var runOnce = async (task, options) => {
+  const workingDir = options.workingDir ?? process.cwd();
+  dotenv.config({ path: resolve2(workingDir, ".env") });
+  const config = await loadAgentlConfig(workingDir);
+  const harness = new AgentHarness({ workingDir });
+  const telemetry = new TelemetryEmitter(config?.telemetry);
+  await harness.initialize();
+  const fileBlobs = await Promise.all(
+    options.filePaths.map(async (path) => {
+      const content = await readFile2(resolve2(workingDir, path), "utf8");
+      return `# File: ${path}
+${content}`;
+    })
+  );
+  const input = {
+    task: fileBlobs.length > 0 ? `${task}
+
+${fileBlobs.join("\n\n")}` : task,
+    parameters: options.params
+  };
+  if (options.json) {
+    const output = await harness.runToCompletion(input);
+    for (const event of output.events) {
+      await telemetry.emit(event);
+    }
+    process.stdout.write(`${JSON.stringify(output, null, 2)}
+`);
+    return;
+  }
+  for await (const event of harness.run(input)) {
+    await telemetry.emit(event);
+    if (event.type === "model:chunk") {
+      process.stdout.write(event.content);
+    }
+    if (event.type === "run:error") {
+      process.stderr.write(`
+Error: ${event.error.message}
+`);
+    }
+    if (event.type === "run:completed") {
+      process.stdout.write("\n");
+    }
+  }
+};
+var runInteractive = async (workingDir, params) => {
+  dotenv.config({ path: resolve2(workingDir, ".env") });
+  let pendingApproval = null;
+  let onApprovalRequest = null;
+  const approvalHandler = async (request) => {
+    return new Promise((resolveApproval) => {
+      const req = {
+        tool: request.tool,
+        input: request.input,
+        approvalId: request.approvalId,
+        resolve: resolveApproval
+      };
+      pendingApproval = req;
+      if (onApprovalRequest) {
+        onApprovalRequest(req);
+      }
+    });
+  };
+  const harness = new AgentHarness({
+    workingDir,
+    environment: resolveHarnessEnvironment(),
+    approvalHandler
+  });
+  await harness.initialize();
+  try {
+    const { runInteractiveInk } = await import("./run-interactive-ink-LQXS5GMO.js");
+    await runInteractiveInk({
+      harness,
+      params,
+      workingDir,
+      onSetApprovalCallback: (cb) => {
+        onApprovalRequest = cb;
+        if (pendingApproval) {
+          cb(pendingApproval);
+        }
+      }
+    });
+  } finally {
+    await harness.shutdown();
+  }
+};
+var listTools = async (workingDir) => {
+  dotenv.config({ path: resolve2(workingDir, ".env") });
+  const harness = new AgentHarness({ workingDir });
+  await harness.initialize();
+  const tools = harness.listTools();
+  if (tools.length === 0) {
+    process.stdout.write("No tools registered.\n");
+    return;
+  }
+  process.stdout.write("Available tools:\n");
+  for (const tool of tools) {
+    process.stdout.write(`- ${tool.name}: ${tool.description}
+`);
+  }
+};
+var runInstallCommand = async (workingDir, packageNameOrPath) => await new Promise((resolveInstall, rejectInstall) => {
+  const child = spawn("pnpm", ["add", packageNameOrPath], {
+    cwd: workingDir,
+    stdio: "inherit",
+    env: process.env
+  });
+  child.on("exit", (code) => {
+    if (code === 0) {
+      resolveInstall();
+      return;
+    }
+    rejectInstall(new Error(`pnpm add failed with exit code ${code ?? -1}`));
+  });
+});
+var validateSkillPackage = async (workingDir, packageNameOrPath) => {
+  const packageJsonPath = packageNameOrPath.startsWith(".") || packageNameOrPath.startsWith("/") ? resolve2(workingDir, packageNameOrPath, "package.json") : require2.resolve(`${packageNameOrPath}/package.json`, {
+    paths: [workingDir]
+  });
+  const skillRoot = resolve2(packageJsonPath, "..");
+  const skillManifest = resolve2(skillRoot, "SKILL.md");
+  try {
+    await access(skillManifest);
+  } catch {
+    throw new Error(`Skill validation failed: missing SKILL.md in ${skillRoot}`);
+  }
+};
+var addSkill = async (workingDir, packageNameOrPath) => {
+  await runInstallCommand(workingDir, packageNameOrPath);
+  await validateSkillPackage(workingDir, packageNameOrPath);
+  process.stdout.write(`Added skill: ${packageNameOrPath}
+`);
+};
+var runTests = async (workingDir, filePath) => {
+  dotenv.config({ path: resolve2(workingDir, ".env") });
+  const testFilePath = filePath ?? resolve2(workingDir, "tests", "basic.yaml");
+  const content = await readFile2(testFilePath, "utf8");
+  const parsed = YAML.parse(content);
+  const tests = parsed.tests ?? [];
+  const harness = new AgentHarness({ workingDir });
+  await harness.initialize();
+  let passed = 0;
+  let failed = 0;
+  for (const testCase of tests) {
+    try {
+      const output = await harness.runToCompletion({ task: testCase.task });
+      const response = output.result.response ?? "";
+      const events = output.events;
+      const expectation = testCase.expect ?? {};
+      const checks = [];
+      if (expectation.contains) {
+        checks.push(response.includes(expectation.contains));
+      }
+      if (typeof expectation.maxSteps === "number") {
+        checks.push(output.result.steps <= expectation.maxSteps);
+      }
+      if (typeof expectation.maxTokens === "number") {
+        checks.push(
+          output.result.tokens.input + output.result.tokens.output <= expectation.maxTokens
+        );
+      }
+      if (expectation.refusal) {
+        checks.push(
+          response.toLowerCase().includes("can't") || response.toLowerCase().includes("cannot")
+        );
+      }
+      if (expectation.toolCalled) {
+        checks.push(
+          events.some(
+            (event) => event.type === "tool:started" && event.tool === expectation.toolCalled
+          )
+        );
+      }
+      const ok = checks.length === 0 ? output.result.status === "completed" : checks.every(Boolean);
+      if (ok) {
+        passed += 1;
+        process.stdout.write(`PASS ${testCase.name}
+`);
+      } else {
+        failed += 1;
+        process.stdout.write(`FAIL ${testCase.name}
+`);
+      }
+    } catch (error) {
+      failed += 1;
+      process.stdout.write(
+        `FAIL ${testCase.name} (${error instanceof Error ? error.message : "Unknown test error"})
+`
+      );
+    }
+  }
+  process.stdout.write(`
+Test summary: ${passed} passed, ${failed} failed
+`);
+  return { passed, failed };
+};
+var buildTarget = async (workingDir, target) => {
+  const outDir = resolve2(workingDir, ".agentl-build", target);
+  await mkdir2(outDir, { recursive: true });
+  const serverEntrypoint = `import { startDevServer } from "agentl";
+
+const port = Number.parseInt(process.env.PORT ?? "3000", 10);
+await startDevServer(Number.isNaN(port) ? 3000 : port, { workingDir: process.cwd() });
+`;
+  const runtimePackageJson = JSON.stringify(
+    {
+      name: "agentl-runtime-bundle",
+      private: true,
+      type: "module",
+      scripts: {
+        start: "node server.js"
+      },
+      dependencies: {
+        agentl: "^0.1.0"
+      }
+    },
+    null,
+    2
+  );
+  if (target === "vercel") {
+    await mkdir2(resolve2(outDir, "api"), { recursive: true });
+    await copyIfExists(resolve2(workingDir, "AGENT.md"), resolve2(outDir, "AGENT.md"));
+    await copyIfExists(
+      resolve2(workingDir, "agentl.config.js"),
+      resolve2(outDir, "agentl.config.js")
+    );
+    await copyIfExists(resolve2(workingDir, "skills"), resolve2(outDir, "skills"));
+    await copyIfExists(resolve2(workingDir, "tests"), resolve2(outDir, "tests"));
+    await writeFile2(
+      resolve2(outDir, "vercel.json"),
+      JSON.stringify(
+        {
+          version: 2,
+          builds: [
+            {
+              src: "api/index.js",
+              use: "@vercel/node@3.2.24",
+              config: {
+                includeFiles: [
+                  "AGENT.md",
+                  "agentl.config.js",
+                  "skills/**",
+                  "tests/**"
+                ]
+              }
+            }
+          ],
+          routes: [{ src: "/(.*)", dest: "/api/index.js" }]
+        },
+        null,
+        2
+      ),
+      "utf8"
+    );
+    await buildVercelHandlerBundle(outDir);
+    await writeFile2(
+      resolve2(outDir, "package.json"),
+      JSON.stringify(
+        {
+          private: true,
+          type: "module",
+          engines: {
+            node: "20.x"
+          },
+          dependencies: VERCEL_RUNTIME_DEPENDENCIES
+        },
+        null,
+        2
+      ),
+      "utf8"
+    );
+  } else if (target === "docker") {
+    await writeFile2(
+      resolve2(outDir, "Dockerfile"),
+      `FROM node:20-slim
+WORKDIR /app
+COPY package.json package.json
+COPY AGENT.md AGENT.md
+COPY agentl.config.js agentl.config.js
+COPY skills skills
+COPY tests tests
+COPY .env.example .env.example
+RUN corepack enable && npm install -g agentl
+COPY server.js server.js
+EXPOSE 3000
+CMD ["node","server.js"]
+`,
+      "utf8"
+    );
+    await writeFile2(resolve2(outDir, "server.js"), serverEntrypoint, "utf8");
+    await writeFile2(resolve2(outDir, "package.json"), runtimePackageJson, "utf8");
+  } else if (target === "lambda") {
+    await writeFile2(
+      resolve2(outDir, "lambda-handler.js"),
+      `import { startDevServer } from "agentl";
+let serverPromise;
+export const handler = async (event = {}) => {
+  if (!serverPromise) {
+    serverPromise = startDevServer(0, { workingDir: process.cwd() });
+  }
+  const body = JSON.stringify({
+    status: "ready",
+    route: event.rawPath ?? event.path ?? "/",
+  });
+  return { statusCode: 200, headers: { "content-type": "application/json" }, body };
+};
+`,
+      "utf8"
+    );
+    await writeFile2(resolve2(outDir, "package.json"), runtimePackageJson, "utf8");
+  } else if (target === "fly") {
+    await writeFile2(
+      resolve2(outDir, "fly.toml"),
+      `app = "agentl-app"
+[env]
+  PORT = "3000"
+[http_service]
+  internal_port = 3000
+  force_https = true
+  auto_start_machines = true
+  auto_stop_machines = "stop"
+  min_machines_running = 0
+`,
+      "utf8"
+    );
+    await writeFile2(
+      resolve2(outDir, "Dockerfile"),
+      `FROM node:20-slim
+WORKDIR /app
+COPY package.json package.json
+COPY AGENT.md AGENT.md
+COPY agentl.config.js agentl.config.js
+COPY skills skills
+COPY tests tests
+RUN npm install -g agentl
+COPY server.js server.js
+EXPOSE 3000
+CMD ["node","server.js"]
+`,
+      "utf8"
+    );
+    await writeFile2(resolve2(outDir, "server.js"), serverEntrypoint, "utf8");
+    await writeFile2(resolve2(outDir, "package.json"), runtimePackageJson, "utf8");
+  } else {
+    throw new Error(`Unsupported build target: ${target}`);
+  }
+  process.stdout.write(`Build artifacts generated at ${outDir}
+`);
+};
+var normalizeMcpName = (entry) => entry.name ?? entry.url ?? `mcp_${Date.now()}`;
+var mcpAdd = async (workingDir, options) => {
+  const config = await loadAgentlConfig(workingDir) ?? { mcp: [] };
+  const mcp = [...config.mcp ?? []];
+  if (!options.url) {
+    throw new Error("Remote MCP only: provide --url for a remote MCP server.");
+  }
+  mcp.push({
+    name: options.name ?? normalizeMcpName({ url: options.url }),
+    url: options.url,
+    env: options.envVars ?? []
+  });
+  await writeConfigFile(workingDir, { ...config, mcp });
+  process.stdout.write("MCP server added.\n");
+};
+var mcpList = async (workingDir) => {
+  const config = await loadAgentlConfig(workingDir);
+  const mcp = config?.mcp ?? [];
+  if (mcp.length === 0) {
+    process.stdout.write("No MCP servers configured.\n");
+    return;
+  }
+  process.stdout.write("Configured MCP servers:\n");
+  for (const entry of mcp) {
+    process.stdout.write(`- ${entry.name ?? entry.url} (remote: ${entry.url})
+`);
+  }
+};
+var mcpRemove = async (workingDir, name) => {
+  const config = await loadAgentlConfig(workingDir) ?? { mcp: [] };
+  const before = config.mcp ?? [];
+  const filtered = before.filter((entry) => normalizeMcpName(entry) !== name);
+  await writeConfigFile(workingDir, { ...config, mcp: filtered });
+  process.stdout.write(`Removed MCP server: ${name}
+`);
+};
+var buildCli = () => {
+  const program = new Command();
+  program.name("agentl").description("CLI for building and running AgentL agents").version("0.1.0");
+  program.command("init").argument("<name>", "project name").description("Scaffold a new AgentL project").action(async (name) => {
+    await initProject(name);
+  });
+  program.command("dev").description("Run local development server").option("--port <port>", "server port", "3000").action(async (options) => {
+    const port = Number.parseInt(options.port, 10);
+    await startDevServer(Number.isNaN(port) ? 3e3 : port);
+  });
+  program.command("run").argument("[task]", "task to run").description("Execute the agent once").option("--param <keyValue>", "parameter key=value", (value, all) => {
+    all.push(value);
+    return all;
+  }, []).option("--file <path>", "include file contents", (value, all) => {
+    all.push(value);
+    return all;
+  }, []).option("--json", "output json", false).option("--interactive", "run in interactive mode", false).action(
+    async (task, options) => {
+      const params = parseParams(options.param);
+      if (options.interactive) {
+        await runInteractive(process.cwd(), params);
+        return;
+      }
+      if (!task) {
+        throw new Error("Task is required unless --interactive is used.");
+      }
+      await runOnce(task, {
+        params,
+        json: options.json,
+        filePaths: options.file
+      });
+    }
+  );
+  program.command("tools").description("List all tools available to the agent").action(async () => {
+    await listTools(process.cwd());
+  });
+  program.command("add").argument("<packageOrPath>", "skill package name/path").description("Add a skill package and validate SKILL.md").action(async (packageOrPath) => {
+    await addSkill(process.cwd(), packageOrPath);
+  });
+  program.command("update-agent").description("Backfill latest default guidance into AGENT.md").action(async () => {
+    await updateAgentGuidance(process.cwd());
+  });
+  program.command("test").argument("[file]", "test file path (yaml)").description("Run yaml-defined agent tests").action(async (file) => {
+    const testFile = file ? resolve2(process.cwd(), file) : void 0;
+    const result = await runTests(process.cwd(), testFile);
+    if (result.failed > 0) {
+      process.exitCode = 1;
+    }
+  });
+  program.command("build").argument("<target>", "vercel|docker|lambda|fly").description("Generate build artifacts for deployment target").action(async (target) => {
+    await buildTarget(process.cwd(), target);
+  });
+  const mcpCommand = program.command("mcp").description("Manage MCP servers");
+  mcpCommand.command("add").requiredOption("--url <url>", "remote MCP url").option("--name <name>", "server name").option("--env <name>", "env variable (repeatable)", (value, all) => {
+    all.push(value);
+    return all;
+  }, []).action(
+    async (options) => {
+      await mcpAdd(process.cwd(), {
+        url: options.url,
+        name: options.name,
+        envVars: options.env
+      });
+    }
+  );
+  mcpCommand.command("list").description("List configured MCP servers").action(async () => {
+    await mcpList(process.cwd());
+  });
+  mcpCommand.command("remove").argument("<name>", "server name").description("Remove an MCP server by name").action(async (name) => {
+    await mcpRemove(process.cwd(), name);
+  });
+  return program;
+};
+var main = async (argv = process.argv) => {
+  try {
+    await buildCli().parseAsync(argv);
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "code" in error && error.code === "EADDRINUSE") {
+      const message = "Port is already in use. Try `agentl dev --port 3001` or stop the process using port 3000.";
+      process.stderr.write(`${message}
+`);
+      process.exitCode = 1;
+      return;
+    }
+    process.stderr.write(`${error instanceof Error ? error.message : "Unknown CLI error"}
+`);
+    process.exitCode = 1;
+  }
+};
+var packageRoot = resolve2(__dirname, "..");
+
+export {
+  initProject,
+  updateAgentGuidance,
+  startDevServer,
+  runOnce,
+  runInteractive,
+  listTools,
+  addSkill,
+  runTests,
+  buildTarget,
+  mcpAdd,
+  mcpList,
+  mcpRemove,
+  buildCli,
+  main,
+  packageRoot
+};