@qwen-code/arena-agent 0.0.1

package/dist/server.js

@@ -0,0 +1,1433 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import { cp, mkdir, readFile, readdir, realpath, rename, stat, writeFile, } from "node:fs/promises";
+import http from "node:http";
+import path from "node:path";
+import { Agent } from "./agent.js";
+import { attachmentMimeType, attachmentUserMessage, maxAttachmentBytesPerMessage, maxAttachmentsPerMessage, maxUploadBytes, mimeTypes, saveAttachment, uploadsDirectory, } from "./attachments.js";
+import { configFromEnv } from "./config.js";
+import { loadStoredHistory, saveStoredHistory, sessionStorageRoot, } from "./history.js";
+import { EventSink } from "./protocol.js";
+import { projectRoot } from "./spec.js";
+import { ToolExecutor } from "./tools.js";
+const sessionSeedExcludes = new Set([
+    ".arena",
+    ".cache",
+    ".git",
+    ".mypy_cache",
+    ".next",
+    ".nox",
+    ".npm",
+    ".nuxt",
+    ".output",
+    ".parcel-cache",
+    ".pytest_cache",
+    ".ruff_cache",
+    ".svelte-kit",
+    ".tox",
+    ".turbo",
+    ".venv",
+    ".vite",
+    "__pycache__",
+    "build",
+    "coverage",
+    "dist",
+    "node_modules",
+    "out",
+    "target",
+]);
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function corsHeaders() {
+    return {
+        "access-control-allow-origin": "*",
+        "access-control-allow-methods": "GET,POST,OPTIONS",
+        "access-control-allow-headers": "authorization,content-type,last-event-id,x-file-name,x-part-id,x-trigger-source",
+    };
+}
+function writeJson(response, statusCode, value, headers = {}) {
+    response.writeHead(statusCode, {
+        ...corsHeaders(),
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store",
+        ...headers,
+    });
+    response.end(JSON.stringify(value));
+}
+async function readRequestBytes(request, limit) {
+    const declaredLength = Number(request.headers["content-length"] || 0);
+    if (declaredLength > limit) {
+        throw new Error(`request body exceeds ${limit} bytes`);
+    }
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += bytes.length;
+        if (size > limit)
+            throw new Error(`request body exceeds ${limit} bytes`);
+        chunks.push(bytes);
+    }
+    return Buffer.concat(chunks);
+}
+async function readBody(request) {
+    return (await readRequestBytes(request, 1024 * 1024)).toString("utf8");
+}
+async function readJson(request) {
+    return JSON.parse((await readBody(request)) || "{}");
+}
+function validSessionId(sessionId) {
+    return (typeof sessionId === "string" &&
+        /^[A-Za-z0-9-]{1,128}$/.test(sessionId));
+}
+function validTenantId(tenantId) {
+    return (typeof tenantId === "string" &&
+        /^[A-Za-z0-9_-]{1,64}$/.test(tenantId));
+}
+function validClientDate(value) {
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(value))
+        return false;
+    const [year, month, day] = value.split("-").map(Number);
+    const parsed = new Date(Date.UTC(year || 0, (month || 0) - 1, day || 0));
+    return (parsed.getUTCFullYear() === year &&
+        parsed.getUTCMonth() + 1 === month &&
+        parsed.getUTCDate() === day);
+}
+function validTimezone(value) {
+    if (!value || value.length > 100)
+        return false;
+    try {
+        new Intl.DateTimeFormat("en", { timeZone: value }).format();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function dateInTimezone(timezone) {
+    const parts = new Intl.DateTimeFormat("en-CA", {
+        timeZone: validTimezone(timezone) ? timezone : "UTC",
+        year: "numeric",
+        month: "2-digit",
+        day: "2-digit",
+    }).formatToParts(new Date());
+    const value = (type) => parts.find((part) => part.type === type)?.value || "";
+    return `${value("year")}-${value("month")}-${value("day")}`;
+}
+function clientLocation(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("location must be an object");
+    }
+    const source = value;
+    const result = {};
+    for (const key of ["city", "region", "country"]) {
+        const item = source[key];
+        if (item === undefined || item === null || item === "")
+            continue;
+        if (typeof item !== "string" ||
+            item.length > 160 ||
+            /[\u0000-\u001f\u007f]/.test(item)) {
+            throw new Error(`location.${key} must be a single-line string`);
+        }
+        const normalized = item.trim();
+        if (normalized)
+            result[key] = normalized;
+    }
+    return Object.keys(result).length ? result : undefined;
+}
+function sessionRoot(context, sessionId) {
+    return sessionStorageRoot(context.workspace, context.config.tenantId, sessionId);
+}
+function sessionPaths(context, sessionId) {
+    const root = sessionRoot(context, sessionId);
+    return {
+        root,
+        workspace: path.join(root, "workspace"),
+        artifacts: path.join(root, "artifacts"),
+        history: path.join(root, "history.json"),
+        metadata: path.join(root, "session.json"),
+    };
+}
+function sessionHistoryPath(session) {
+    return path.join(session.root, "history.json");
+}
+function sessionMetadataPath(session) {
+    return path.join(session.root, "session.json");
+}
+function hashToken(token) {
+    return crypto.createHash("sha256").update(token).digest("hex");
+}
+function tokenMatches(session, token) {
+    if (!token)
+        return false;
+    const presented = Buffer.from(hashToken(token), "hex");
+    const expected = Buffer.from(session.tokenHash, "hex");
+    return (presented.length === expected.length &&
+        crypto.timingSafeEqual(presented, expected));
+}
+function sessionCookieName(sessionId) {
+    return `arena_session_${sessionId.replaceAll("-", "_")}`;
+}
+function sessionCookie(session, token) {
+    const maxAge = Math.max(0, Math.ceil((session.tokenExpiresAt - Date.now()) / 1000));
+    return `${sessionCookieName(session.id)}=${encodeURIComponent(token)}; ` +
+        `Path=/api/chat/sessions/${session.id}/; HttpOnly; SameSite=Strict; ` +
+        `Max-Age=${maxAge}`;
+}
+function cookieToken(request, sessionId) {
+    const target = sessionCookieName(sessionId);
+    for (const item of (request.headers.cookie || "").split(";")) {
+        const [name, ...parts] = item.trim().split("=");
+        if (name === target)
+            return decodeURIComponent(parts.join("="));
+    }
+    return "";
+}
+function presentedToken(request, sessionId) {
+    return bearerToken(request) || cookieToken(request, sessionId);
+}
+async function saveSessionMetadata(session) {
+    const metadata = {
+        version: 1,
+        id: session.id,
+        tenantId: session.tenantId,
+        currentDate: session.currentDate,
+        timezone: session.timezone,
+        ...(session.location ? { location: session.location } : {}),
+        tokenHash: session.tokenHash,
+        tokenExpiresAt: session.tokenExpiresAt,
+        createdAt: session.createdAt,
+        touchedAt: session.touchedAt,
+        pendingInterruption: session.pendingInterruption,
+        interruptionGeneration: session.interruptionGeneration,
+    };
+    const target = sessionMetadataPath(session);
+    const temporary = `${target}.${crypto.randomUUID()}.tmp`;
+    await writeFile(temporary, JSON.stringify(metadata), "utf8");
+    await rename(temporary, target);
+}
+async function seedSessionWorkspace(context, target) {
+    await mkdir(target, { recursive: true });
+    if (process.env.ARENA_SESSION_WORKSPACE_MODE === "empty") {
+        return;
+    }
+    const shouldCopy = (source) => {
+        const relative = path.relative(context.workspace, source);
+        const parts = relative.split(path.sep);
+        if (parts.some((part) => sessionSeedExcludes.has(part)))
+            return false;
+        const name = parts.at(-1) || "";
+        return name === ".env.example" || !/^\.env(?:\.|$)/.test(name);
+    };
+    const entries = await readdir(context.workspace, { withFileTypes: true });
+    await Promise.all(entries
+        .filter((entry) => shouldCopy(path.join(context.workspace, entry.name)))
+        .map((entry) => cp(path.join(context.workspace, entry.name), path.join(target, entry.name), {
+        recursive: true,
+        mode: fs.constants.COPYFILE_FICLONE,
+        filter: shouldCopy,
+        verbatimSymlinks: true,
+    })));
+}
+async function createSession(context, clientContext) {
+    const id = crypto.randomUUID();
+    const paths = sessionPaths(context, id);
+    const token = crypto.randomBytes(32).toString("base64url");
+    const now = Date.now();
+    const session = {
+        id,
+        tenantId: context.config.tenantId,
+        currentDate: clientContext.currentDate,
+        timezone: clientContext.timezone,
+        ...(clientContext.location ? { location: clientContext.location } : {}),
+        tokenHash: hashToken(token),
+        tokenExpiresAt: now + 60 * 60 * 1000,
+        createdAt: now,
+        root: paths.root,
+        workspace: paths.workspace,
+        artifacts: paths.artifacts,
+        events: [],
+        nextEventId: 1,
+        subscribers: new Set(),
+        running: null,
+        pendingInput: null,
+        pendingInterruption: false,
+        interruptionGeneration: 0,
+        turnStartEventId: "0",
+        activePrompt: null,
+        touchedAt: now,
+    };
+    await mkdir(session.root, { recursive: true });
+    await Promise.all([
+        seedSessionWorkspace(context, session.workspace),
+        mkdir(session.artifacts, { recursive: true }),
+    ]);
+    await saveSessionMetadata(session);
+    context.sessions.set(id, session);
+    return { session, token };
+}
+async function getSession(context, sessionId) {
+    const existing = context.sessions.get(sessionId);
+    if (existing)
+        return existing;
+    if (!validSessionId(sessionId))
+        return undefined;
+    const paths = sessionPaths(context, sessionId);
+    try {
+        const metadata = JSON.parse(await readFile(paths.metadata, "utf8"));
+        if (metadata.version !== 1 ||
+            metadata.id !== sessionId ||
+            metadata.tenantId !== context.config.tenantId ||
+            typeof metadata.timezone !== "string" ||
+            typeof metadata.tokenHash !== "string" ||
+            !/^[a-f0-9]{64}$/.test(metadata.tokenHash) ||
+            typeof metadata.tokenExpiresAt !== "number") {
+            throw new Error("invalid persisted session metadata");
+        }
+        const storedLocation = metadata.location === undefined
+            ? undefined
+            : clientLocation(metadata.location);
+        const loaded = {
+            id: sessionId,
+            tenantId: metadata.tenantId,
+            currentDate: typeof metadata.currentDate === "string" &&
+                validClientDate(metadata.currentDate)
+                ? metadata.currentDate
+                : dateInTimezone(metadata.timezone),
+            timezone: metadata.timezone,
+            ...(storedLocation ? { location: storedLocation } : {}),
+            tokenHash: metadata.tokenHash,
+            tokenExpiresAt: metadata.tokenExpiresAt,
+            createdAt: typeof metadata.createdAt === "number"
+                ? metadata.createdAt
+                : Date.now(),
+            root: paths.root,
+            workspace: paths.workspace,
+            artifacts: paths.artifacts,
+            events: [],
+            nextEventId: 1,
+            subscribers: new Set(),
+            running: null,
+            pendingInput: null,
+            pendingInterruption: metadata.pendingInterruption === true,
+            interruptionGeneration: typeof metadata.interruptionGeneration === "number" &&
+                Number.isSafeInteger(metadata.interruptionGeneration) &&
+                metadata.interruptionGeneration >= 0
+                ? metadata.interruptionGeneration
+                : metadata.pendingInterruption === true
+                    ? 1
+                    : 0,
+            turnStartEventId: "0",
+            activePrompt: null,
+            touchedAt: typeof metadata.touchedAt === "number"
+                ? metadata.touchedAt
+                : Date.now(),
+        };
+        await Promise.all([
+            mkdir(loaded.workspace, { recursive: true }),
+            mkdir(loaded.artifacts, { recursive: true }),
+        ]);
+        const raced = context.sessions.get(sessionId);
+        if (raced)
+            return raced;
+        context.sessions.set(sessionId, loaded);
+        return loaded;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+function bearerToken(request) {
+    const authorization = request.headers.authorization || "";
+    return authorization.startsWith("Bearer ") ? authorization.slice(7) : "";
+}
+function authorize(request, response, session) {
+    if (!session) {
+        writeJson(response, 404, { error: "realtime session not found" });
+        return false;
+    }
+    if (!tokenMatches(session, presentedToken(request, session.id)) ||
+        session.tokenExpiresAt < Date.now()) {
+        writeJson(response, 401, { error: "invalid or expired realtime token" });
+        return false;
+    }
+    session.touchedAt = Date.now();
+    return true;
+}
+function emit(session, data) {
+    const event = { id: String(session.nextEventId++), data };
+    session.events.push(event);
+    if (session.events.length > 1000)
+        session.events.shift();
+    const frame = `id: ${event.id}\ndata: ${JSON.stringify(data)}\n\n`;
+    for (const response of session.subscribers)
+        response.write(frame);
+    return event;
+}
+function openEventStream(request, response, session) {
+    response.writeHead(200, {
+        ...corsHeaders(),
+        "content-type": "text/event-stream; charset=utf-8",
+        "cache-control": "no-cache, no-transform",
+        connection: "keep-alive",
+        "x-accel-buffering": "no",
+    });
+    response.flushHeaders();
+    response.write(": connected\n\n");
+    const lastEventId = Number(request.headers["last-event-id"] || 0);
+    for (const event of session.events) {
+        if (Number(event.id) > lastEventId) {
+            response.write(`id: ${event.id}\ndata: ${JSON.stringify(event.data)}\n\n`);
+        }
+    }
+    session.subscribers.add(response);
+    const heartbeat = setInterval(() => response.write(": heartbeat\n\n"), 15_000);
+    const close = () => {
+        clearInterval(heartbeat);
+        session.subscribers.delete(response);
+    };
+    request.on("close", close);
+    response.on("close", close);
+}
+function parseJson(value) {
+    if (typeof value !== "string")
+        return value;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return value;
+    }
+}
+function normalizedWorkspacePath(candidate) {
+    const workspacePath = candidate
+        .replace(/^\/home\/user\/?/, "")
+        .replace(/^~\/?/, "")
+        .replaceAll("\\", "/")
+        .replace(/^\.\/+/, "");
+    const normalized = path.posix.normalize(workspacePath);
+    if (!normalized ||
+        normalized === "." ||
+        normalized.startsWith("/") ||
+        normalized.startsWith("../") ||
+        normalized
+            .split("/")
+            .some((part) => !part || part === ".." || part.startsWith("."))) {
+        return null;
+    }
+    return normalized;
+}
+function headerText(value) {
+    return Array.isArray(value) ? value[0] || "" : value || "";
+}
+function decodedUploadName(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        throw new Error("x-file-name must be URI encoded");
+    }
+}
+async function resolveSessionAttachment(session, part) {
+    const nested = part.attachment && typeof part.attachment === "object"
+        ? part.attachment
+        : part;
+    const requestedPath = typeof nested.path === "string" ? normalizedWorkspacePath(nested.path) : null;
+    if (!requestedPath ||
+        path.posix.dirname(requestedPath) !== "uploads") {
+        throw new Error("attachment path must reference a file in /home/user/uploads/");
+    }
+    const uploads = await uploadsDirectory(session.workspace, false);
+    const candidate = path.join(session.workspace, ...requestedPath.split("/"));
+    const fileReal = await realpath(candidate);
+    const relative = path.relative(uploads, fileReal);
+    if (!relative ||
+        relative.startsWith("..") ||
+        path.isAbsolute(relative) ||
+        relative.includes(path.sep)) {
+        throw new Error("attachment path is outside /home/user/uploads/");
+    }
+    const info = await stat(fileReal);
+    if (!info.isFile())
+        throw new Error("attachment is not a regular file");
+    if (info.size > maxUploadBytes) {
+        throw new Error(`attachment exceeds ${maxUploadBytes} bytes`);
+    }
+    const bytes = await readFile(fileReal);
+    const type = attachmentMimeType(relative, bytes);
+    return {
+        name: relative,
+        path: `uploads/${relative}`,
+        size: info.size,
+        bytes,
+        ...type,
+    };
+}
+function workspaceEvents(session, output, sourceTool = "", input = {}) {
+    if (!output || typeof output !== "object")
+        return [];
+    const value = output;
+    if (value.status && value.status !== "success")
+        return [];
+    const candidates = [value];
+    if (Array.isArray(value.images))
+        candidates.push(...value.images);
+    if (["edit_file", "present_file", "write_file"].includes(sourceTool) &&
+        input &&
+        typeof input === "object") {
+        const inputPath = input.path;
+        if (typeof inputPath === "string")
+            candidates.push({ path: inputPath });
+    }
+    const seen = new Set();
+    const events = [];
+    for (const candidateValue of candidates) {
+        if (!candidateValue || typeof candidateValue !== "object")
+            continue;
+        const candidateRecord = candidateValue;
+        const candidate = candidateRecord.path || candidateRecord.file_path;
+        if (typeof candidate !== "string")
+            continue;
+        const normalized = normalizedWorkspacePath(candidate);
+        if (!normalized || seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        events.push({
+            type: "data-workspace",
+            data: {
+                path: normalized,
+                url: `/api/chat/sessions/${session.id}/workspace/${normalized
+                    .split("/")
+                    .map(encodeURIComponent)
+                    .join("/")}`,
+                sourceTool,
+            },
+        });
+    }
+    return events;
+}
+function createUiStream(session, messageId) {
+    const state = {
+        messageId,
+        textId: `text-${messageId}`,
+        reasoningId: `reasoning-${messageId}`,
+        textStarted: false,
+        reasoningStarted: false,
+        toolCalls: new Map(),
+        toolParts: new Map(),
+        completed: false,
+    };
+    const closeOpenParts = () => {
+        if (state.reasoningStarted) {
+            emit(session, { type: "reasoning-end", id: state.reasoningId });
+            state.reasoningStarted = false;
+        }
+        if (state.textStarted) {
+            emit(session, { type: "text-end", id: state.textId });
+            state.textStarted = false;
+        }
+    };
+    const rememberToolId = (part) => {
+        if (part.id)
+            state.toolCalls.set(part.id, part);
+    };
+    const ensureToolStarted = (part) => {
+        if (part.started)
+            return;
+        part.uiId = part.id || `tool-${messageId}-${part.index}`;
+        part.started = true;
+        emit(session, {
+            type: "tool-input-start",
+            toolCallId: part.uiId,
+            toolName: part.name || "tool",
+        });
+    };
+    emit(session, { type: "start", messageId });
+    return {
+        consume(event) {
+            if (event.type === "model.start") {
+                state.toolParts = new Map();
+                emit(session, {
+                    type: "data-agent-status",
+                    data: {
+                        phase: "model",
+                        step: event.step,
+                        label: event.step === 1 ? "Thinking…" : "Generating response…",
+                    },
+                });
+                return;
+            }
+            if (event.type === "model.complete") {
+                emit(session, {
+                    type: "data-agent-status",
+                    data: {
+                        phase: "model-complete",
+                        step: event.step,
+                        label: event.finish_reason === "tool_calls"
+                            ? "Preparing tool…"
+                            : "Finalizing…",
+                    },
+                });
+                return;
+            }
+            if (event.type === "assistant.delta") {
+                const delta = event.delta || {};
+                if (delta.reasoning_content) {
+                    if (!state.reasoningStarted) {
+                        emit(session, { type: "reasoning-start", id: state.reasoningId });
+                        state.reasoningStarted = true;
+                    }
+                    emit(session, {
+                        type: "reasoning-delta",
+                        id: state.reasoningId,
+                        delta: delta.reasoning_content,
+                    });
+                }
+                if (delta.content) {
+                    if (!state.textStarted) {
+                        emit(session, { type: "text-start", id: state.textId });
+                        state.textStarted = true;
+                    }
+                    emit(session, {
+                        type: "text-delta",
+                        id: state.textId,
+                        delta: delta.content,
+                    });
+                }
+                const fragments = delta.tool_calls || [];
+                if (fragments.length)
+                    closeOpenParts();
+                for (const [position, fragment] of fragments.entries()) {
+                    const index = Number(fragment.index ?? position);
+                    const part = state.toolParts.get(index) ||
+                        {
+                            index,
+                            id: "",
+                            name: "",
+                            arguments: "",
+                            uiId: "",
+                            started: false,
+                        };
+                    part.id += fragment.id || "";
+                    part.name += fragment.function?.name || "";
+                    part.arguments += fragment.function?.arguments || "";
+                    state.toolParts.set(index, part);
+                    rememberToolId(part);
+                    ensureToolStarted(part);
+                    emit(session, {
+                        type: "tool-input-delta",
+                        toolCallId: part.uiId,
+                        toolName: part.name || "tool",
+                        inputTextDelta: fragment.function?.arguments || "",
+                    });
+                }
+                return;
+            }
+            if (event.type === "message" && event.message?.role === "assistant") {
+                const calls = event.message.tool_calls || [];
+                if (calls.length)
+                    closeOpenParts();
+                for (const [index, call] of calls.entries()) {
+                    const part = state.toolParts.get(index) ||
+                        {
+                            index,
+                            id: call.id,
+                            name: call.function?.name || "tool",
+                            arguments: call.function?.arguments || "",
+                            uiId: "",
+                            started: false,
+                        };
+                    part.id = call.id;
+                    part.name = call.function?.name || "tool";
+                    part.arguments = call.function?.arguments || "";
+                    state.toolParts.set(index, part);
+                    rememberToolId(part);
+                    ensureToolStarted(part);
+                    emit(session, {
+                        type: "tool-input-available",
+                        toolCallId: part.uiId,
+                        toolName: part.name,
+                        input: parseJson(part.arguments || "{}"),
+                    });
+                }
+                return;
+            }
+            if (event.type === "tool.start") {
+                const part = state.toolCalls.get(event.tool_call_id || "");
+                emit(session, {
+                    type: "data-agent-status",
+                    data: {
+                        phase: "tool-running",
+                        label: `Running ${event.tool_name}…`,
+                        toolCallId: part?.uiId || event.tool_call_id,
+                        toolName: event.tool_name,
+                    },
+                });
+                return;
+            }
+            if (event.type === "input.required") {
+                const part = state.toolCalls.get(event.tool_call_id || "");
+                emit(session, {
+                    type: "data-user-input-request",
+                    data: {
+                        requestId: event.request_id || event.tool_call_id,
+                        toolCallId: part?.uiId || event.tool_call_id,
+                        questions: event.questions || [],
+                    },
+                });
+                emit(session, {
+                    type: "data-agent-status",
+                    data: {
+                        phase: "waiting-for-input",
+                        label: "Waiting for your answer…",
+                        toolCallId: part?.uiId || event.tool_call_id,
+                        toolName: "ask_user",
+                    },
+                });
+                return;
+            }
+            if (event.type === "message" && event.message?.role === "tool") {
+                const part = state.toolCalls.get(event.message.tool_call_id);
+                const toolCallId = part?.uiId || event.message.tool_call_id;
+                const output = parseJson(event.message.content);
+                emit(session, {
+                    type: "tool-output-available",
+                    toolCallId,
+                    output,
+                });
+                const files = workspaceEvents(session, output, part?.name, parseJson(part?.arguments || "{}"));
+                for (const file of files) {
+                    emit(session, file);
+                }
+                const presented = files[0];
+                if (part?.name === "present_file" && presented) {
+                    emit(session, {
+                        type: "data-present-file",
+                        data: presented.data,
+                    });
+                }
+                return;
+            }
+            if (event.type === "tool.complete") {
+                const part = state.toolCalls.get(event.tool_call_id || "");
+                emit(session, {
+                    type: "data-agent-status",
+                    data: {
+                        phase: "tool-complete",
+                        label: `${event.tool_name} complete`,
+                        toolCallId: part?.uiId || event.tool_call_id,
+                        toolName: event.tool_name,
+                    },
+                });
+                return;
+            }
+            if (event.type === "result") {
+                closeOpenParts();
+                emit(session, {
+                    type: "data-messages",
+                    data: { messages: event.messages || [] },
+                });
+                emit(session, {
+                    type: "finish",
+                    finishReason: event.status === "success" ? "stop" : "error",
+                });
+                emit(session, {
+                    type: "trigger:turn-complete",
+                    status: event.status,
+                    error: event.error,
+                });
+                state.completed = true;
+            }
+        },
+        fail(error) {
+            if (state.completed)
+                return;
+            closeOpenParts();
+            emit(session, { type: "error", errorText: errorMessage(error) });
+            emit(session, { type: "finish", finishReason: "error" });
+            emit(session, {
+                type: "trigger:turn-complete",
+                status: "error",
+                error: errorMessage(error),
+            });
+            state.completed = true;
+        },
+    };
+}
+async function readHistory(session) {
+    return loadStoredHistory(sessionHistoryPath(session));
+}
+async function saveHistory(session, messages) {
+    await saveStoredHistory(sessionHistoryPath(session), messages);
+}
+async function runAgent(context, session, prompt, messageId, interruptionGeneration, userMessage) {
+    const ui = createUiStream(session, messageId);
+    const controller = new AbortController();
+    session.running = { controller };
+    let pendingResult = null;
+    let sink;
+    const askUserHandler = (toolCallId, questions) => new Promise((resolve, reject) => {
+        if (controller.signal.aborted) {
+            reject(controller.signal.reason || new Error("operation cancelled"));
+            return;
+        }
+        session.pendingInput = {
+            requestId: toolCallId,
+            toolCallId,
+            questions,
+            resolve,
+            reject,
+        };
+        sink.inputRequired(session.id, toolCallId, questions);
+    });
+    sink = new EventSink({
+        format: "silent",
+        onEvent: (event) => {
+            if (event.type === "result") {
+                pendingResult = event;
+            }
+            else {
+                ui.consume(event);
+            }
+        },
+    });
+    const sessionConfig = {
+        ...context.config,
+        workspace: session.workspace,
+    };
+    const tools = new ToolExecutor(sessionConfig, {
+        askUserHandler,
+        signal: controller.signal,
+    });
+    try {
+        const history = await readHistory(session);
+        const result = await new Agent(sessionConfig, sink, {
+            tools,
+            sessionId: session.id,
+            signal: controller.signal,
+            onCheckpoint: (messages) => saveHistory(session, messages),
+            clientContext: {
+                currentDate: session.currentDate,
+                timezone: session.timezone,
+                ...(session.location ? { location: session.location } : {}),
+            },
+        }).run(prompt, history, {
+            interrupted: interruptionGeneration !== undefined,
+            userMessage,
+        });
+        const shouldPersistHistory = result.status === "success" || controller.signal.aborted;
+        if (shouldPersistHistory) {
+            await saveHistory(session, result.messages);
+            if (interruptionGeneration !== undefined &&
+                session.interruptionGeneration === interruptionGeneration) {
+                session.pendingInterruption = false;
+            }
+        }
+        session.touchedAt = Date.now();
+        await saveSessionMetadata(session);
+        ui.consume(pendingResult || result);
+    }
+    catch (error) {
+        session.touchedAt = Date.now();
+        try {
+            await saveSessionMetadata(session);
+        }
+        catch {
+            // Preserve the original failure in the UI.
+        }
+        ui.fail(error);
+    }
+    finally {
+        session.running = null;
+        session.pendingInput = null;
+        session.activePrompt = null;
+        session.touchedAt = Date.now();
+    }
+}
+async function triggerSession(context, request, response) {
+    const body = await readJson(request);
+    if (body.sessionId !== undefined) {
+        writeJson(response, 400, {
+            error: "sessionId is generated by the server",
+        });
+        return;
+    }
+    const currentDate = typeof body.currentDate === "string" ? body.currentDate.trim() : "";
+    const timezone = typeof body.timezone === "string" ? body.timezone.trim() : "";
+    if (!validClientDate(currentDate)) {
+        writeJson(response, 400, {
+            error: "currentDate must be a valid date in YYYY-MM-DD format",
+        });
+        return;
+    }
+    if (!validTimezone(timezone)) {
+        writeJson(response, 400, {
+            error: "timezone must be a valid IANA time zone",
+        });
+        return;
+    }
+    let location;
+    if (body.location !== undefined) {
+        try {
+            location = clientLocation(body.location);
+        }
+        catch (error) {
+            writeJson(response, 400, { error: errorMessage(error) });
+            return;
+        }
+    }
+    const { session, token } = await createSession(context, {
+        currentDate,
+        timezone,
+        ...(location ? { location } : {}),
+    });
+    writeJson(response, 200, {
+        sessionId: session.id,
+        publicAccessToken: token,
+        expiresAt: new Date(session.tokenExpiresAt).toISOString(),
+        tenantId: session.tenantId,
+    }, {
+        "set-cookie": sessionCookie(session, token),
+    });
+}
+async function triggerToken(context, request, response) {
+    const body = await readJson(request);
+    const session = typeof body.sessionId === "string"
+        ? await getSession(context, body.sessionId)
+        : undefined;
+    if (!session) {
+        writeJson(response, 404, { error: "realtime session not found" });
+        return;
+    }
+    if (!tokenMatches(session, presentedToken(request, session.id))) {
+        writeJson(response, 401, { error: "invalid session credential" });
+        return;
+    }
+    const token = crypto.randomBytes(32).toString("base64url");
+    session.tokenHash = hashToken(token);
+    session.tokenExpiresAt = Date.now() + 60 * 60 * 1000;
+    session.touchedAt = Date.now();
+    await saveSessionMetadata(session);
+    writeJson(response, 200, {
+        token,
+        expiresAt: new Date(session.tokenExpiresAt).toISOString(),
+    }, {
+        "set-cookie": sessionCookie(session, token),
+    });
+}
+async function uploadAttachment(request, response, session) {
+    if (!authorize(request, response, session))
+        return;
+    if (session.running) {
+        writeJson(response, 409, {
+            error: "attachments cannot be uploaded while a turn is running",
+        });
+        return;
+    }
+    const requestedName = headerText(request.headers["x-file-name"]);
+    if (!requestedName) {
+        writeJson(response, 400, {
+            error: "x-file-name is required and must be URI encoded",
+        });
+        return;
+    }
+    const bytes = await readRequestBytes(request, maxUploadBytes);
+    const attachment = await saveAttachment(session.workspace, decodedUploadName(requestedName), bytes, headerText(request.headers["content-type"]));
+    session.touchedAt = Date.now();
+    writeJson(response, 201, {
+        attachment: {
+            name: attachment.name,
+            path: attachment.path,
+            mimeType: attachment.mimeType,
+            size: attachment.size,
+            url: `/api/chat/sessions/${session.id}/workspace/` +
+                attachment.path
+                    .split("/")
+                    .map(encodeURIComponent)
+                    .join("/"),
+        },
+    });
+}
+async function appendMessage(context, request, response, session) {
+    if (!authorize(request, response, session))
+        return;
+    if (session.running) {
+        writeJson(response, 409, { error: "a turn is already running" });
+        return;
+    }
+    const body = await readJson(request);
+    const payload = body.payload;
+    const message = payload?.message;
+    if (body.kind !== "message" || !payload || !message) {
+        writeJson(response, 400, {
+            error: "expected kind=message with payload.message",
+        });
+        return;
+    }
+    if (payload.chatId && payload.chatId !== session.id) {
+        writeJson(response, 400, { error: "payload.chatId does not match session" });
+        return;
+    }
+    const parts = Array.isArray(message.parts) ? message.parts : [];
+    const attachmentParts = parts.filter((part) => Boolean(part) &&
+        typeof part === "object" &&
+        ["file", "attachment"].includes(String(part.type || "")));
+    if (attachmentParts.length > maxAttachmentsPerMessage) {
+        writeJson(response, 400, {
+            error: `a message may include at most ${maxAttachmentsPerMessage} attachments`,
+        });
+        return;
+    }
+    const attachments = await Promise.all(attachmentParts.map((part) => resolveSessionAttachment(session, part)));
+    const totalAttachmentBytes = attachments.reduce((total, attachment) => total + attachment.size, 0);
+    if (totalAttachmentBytes > maxAttachmentBytesPerMessage) {
+        writeJson(response, 400, {
+            error: `message attachments exceed ${maxAttachmentBytesPerMessage} bytes`,
+        });
+        return;
+    }
+    const prompt = parts
+        .filter((part) => Boolean(part) &&
+        typeof part === "object" &&
+        part.type === "text")
+        .map((part) => part.text || "")
+        .join("\n")
+        .trim();
+    if (!prompt && !attachments.length) {
+        writeJson(response, 400, {
+            error: "message must contain text or at least one attachment",
+        });
+        return;
+    }
+    const userMessage = attachments.length
+        ? attachmentUserMessage(prompt, attachments)
+        : undefined;
+    const messageId = String(payload.messageId || message.id || crypto.randomUUID());
+    const interruptionGeneration = session.pendingInterruption
+        ? session.interruptionGeneration
+        : undefined;
+    session.turnStartEventId = session.events.at(-1)?.id || "0";
+    session.activePrompt = prompt;
+    writeJson(response, 202, {
+        accepted: true,
+        sessionId: session.id,
+        messageId,
+        attachments: attachments.map((attachment) => ({
+            name: attachment.name,
+            path: attachment.path,
+            mimeType: attachment.mimeType,
+            size: attachment.size,
+        })),
+        partId: request.headers["x-part-id"] || null,
+    });
+    queueMicrotask(() => {
+        void runAgent(context, session, prompt, messageId, interruptionGeneration, userMessage);
+    });
+}
+async function sessionMessages(context, request, response, session) {
+    if (!authorize(request, response, session))
+        return;
+    const messages = (await readHistory(session)) || [];
+    writeJson(response, 200, {
+        messages,
+        lastEventId: session.running
+            ? session.turnStartEventId
+            : session.events.at(-1)?.id || "0",
+        activePrompt: session.activePrompt,
+    });
+}
+function normalizeInputAnswers(pending, submitted) {
+    if (!Array.isArray(submitted))
+        throw new Error("answers must be an array");
+    const byQuestion = new Map();
+    for (const value of submitted) {
+        if (!value ||
+            typeof value !== "object" ||
+            typeof value.questionId !== "string") {
+            throw new Error("each answer requires a questionId");
+        }
+        const answer = value;
+        const questionId = answer.questionId;
+        if (byQuestion.has(questionId)) {
+            throw new Error(`duplicate answer for ${questionId}`);
+        }
+        byQuestion.set(questionId, answer);
+    }
+    if (byQuestion.size !== pending.questions.length) {
+        throw new Error("every pending question must be answered exactly once");
+    }
+    return pending.questions.map((question) => {
+        const answer = byQuestion.get(question.id);
+        if (!answer)
+            throw new Error(`missing answer for ${question.id}`);
+        if (typeof answer.optionId === "string" && answer.optionId) {
+            const option = question.options.find((candidate) => candidate.id === answer.optionId);
+            if (!option)
+                throw new Error(`invalid option for ${question.id}`);
+            return {
+                question_id: question.id,
+                question: question.question,
+                option_id: option.id,
+                answer: option.label,
+            };
+        }
+        const customResponse = typeof answer.customResponse === "string"
+            ? answer.customResponse.trim()
+            : "";
+        if (!customResponse || question.allowCustomResponse === false) {
+            throw new Error(`a valid option or custom response is required for ${question.id}`);
+        }
+        return {
+            question_id: question.id,
+            question: question.question,
+            custom_response: customResponse,
+            answer: customResponse,
+        };
+    });
+}
+async function respondToInput(request, response, session) {
+    if (!authorize(request, response, session))
+        return;
+    if (!session.running || !session.pendingInput) {
+        writeJson(response, 409, { error: "there is no pending user input" });
+        return;
+    }
+    const body = await readJson(request);
+    if (body.requestId !== session.pendingInput.requestId) {
+        writeJson(response, 409, {
+            error: "input request is no longer pending",
+        });
+        return;
+    }
+    const pending = session.pendingInput;
+    const answers = normalizeInputAnswers(pending, body.answers);
+    session.pendingInput = null;
+    pending.resolve({ status: "success", answers });
+    emit(session, {
+        type: "data-user-input-submitted",
+        data: {
+            requestId: pending.requestId,
+            toolCallId: pending.toolCallId,
+            answers,
+        },
+    });
+    writeJson(response, 202, {
+        accepted: true,
+        requestId: pending.requestId,
+    });
+}
+async function cancelTurn(request, response, session) {
+    if (!authorize(request, response, session))
+        return;
+    if (!session.running) {
+        writeJson(response, 200, { cancelled: false });
+        return;
+    }
+    session.pendingInterruption = true;
+    session.interruptionGeneration += 1;
+    session.pendingInput?.resolve({ answers: [], skipped: true });
+    session.pendingInput = null;
+    session.running.controller.abort(new Error("operation cancelled"));
+    session.touchedAt = Date.now();
+    await saveSessionMetadata(session);
+    writeJson(response, 202, { cancelled: true });
+}
+async function query(context, request, response, url) {
+    let prompt = url.searchParams.get("q") || url.searchParams.get("prompt") || "";
+    if (request.method === "POST") {
+        const body = await readBody(request);
+        if ((request.headers["content-type"] || "").includes("application/json")) {
+            const parsed = JSON.parse(body || "{}");
+            prompt = parsed.prompt || parsed.query || "";
+        }
+        else {
+            prompt = body;
+        }
+    }
+    if (!prompt.trim()) {
+        writeJson(response, 400, {
+            error: "Provide a prompt as POST text/JSON or GET /query?q=...",
+        });
+        return;
+    }
+    response.writeHead(200, {
+        ...corsHeaders(),
+        "content-type": "application/x-ndjson; charset=utf-8",
+        "cache-control": "no-cache, no-transform",
+        "x-accel-buffering": "no",
+    });
+    response.flushHeaders();
+    const controller = new AbortController();
+    request.on("aborted", () => {
+        controller.abort(new Error("client disconnected"));
+    });
+    const sink = new EventSink({
+        format: "stream-json",
+        write: (value) => response.write(value),
+    });
+    const result = await new Agent(context.config, sink, {
+        sessionId: crypto.randomUUID().replaceAll("-", ""),
+        signal: controller.signal,
+    }).run(prompt);
+    if (!response.writableEnded) {
+        if (result.status === "error" && controller.signal.aborted) {
+            response.destroy();
+        }
+        else {
+            response.end();
+        }
+    }
+}
+async function safeWorkspaceFile(session, encodedPath) {
+    let decoded;
+    try {
+        decoded = encodedPath
+            .split("/")
+            .map((part) => decodeURIComponent(part))
+            .join("/");
+    }
+    catch {
+        return null;
+    }
+    const relative = normalizedWorkspacePath(decoded);
+    if (!relative)
+        return null;
+    const resolved = path.resolve(session.workspace, relative);
+    const confined = path.relative(session.workspace, resolved);
+    if (confined.startsWith("..") || path.isAbsolute(confined))
+        return null;
+    try {
+        const [workspaceReal, fileReal] = await Promise.all([
+            realpath(session.workspace),
+            realpath(resolved),
+        ]);
+        const realRelative = path.relative(workspaceReal, fileReal);
+        return realRelative.startsWith("..") || path.isAbsolute(realRelative)
+            ? null
+            : fileReal;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return resolved;
+        throw error;
+    }
+}
+async function serveFile(response, filePath, cache = false, isolated = false) {
+    const info = await stat(filePath);
+    if (!info.isFile()) {
+        const error = new Error("not found");
+        error.code = "ENOENT";
+        throw error;
+    }
+    response.writeHead(200, {
+        ...corsHeaders(),
+        "content-type": mimeTypes[path.extname(filePath).toLowerCase()] ||
+            "application/octet-stream",
+        "content-length": info.size,
+        "cache-control": cache ? "public, max-age=300" : "no-cache",
+        "x-content-type-options": "nosniff",
+        ...(isolated
+            ? {
+                "content-security-policy": "default-src 'none'; img-src data: blob:; media-src data: blob:; " +
+                    "font-src data:; style-src 'unsafe-inline'; script-src 'unsafe-inline'",
+            }
+            : {}),
+    });
+    fs.createReadStream(filePath).pipe(response);
+}
+function sessionRoute(pathname, suffix) {
+    return pathname.match(new RegExp(`^/ai-proxy/realtime/v1/sessions/([A-Za-z0-9-]{1,128})/${suffix}$`));
+}
+function apiSessionRoute(pathname, suffix) {
+    return pathname.match(new RegExp(`^/api/chat/sessions/([A-Za-z0-9-]{1,128})/${suffix}$`));
+}
+function workspaceRoute(pathname) {
+    return pathname.match(/^\/api\/chat\/sessions\/([A-Za-z0-9-]{1,128})\/workspace\/(.+)$/);
+}
+function createRequestHandler(context) {
+    return async (request, response) => {
+        if (request.method === "OPTIONS") {
+            response.writeHead(204, corsHeaders());
+            response.end();
+            return;
+        }
+        const url = new URL(request.url || "/", `http://${request.headers.host || context.host}`);
+        const outputMatch = sessionRoute(url.pathname, "out");
+        const appendMatch = sessionRoute(url.pathname, "in/append");
+        const messagesMatch = apiSessionRoute(url.pathname, "messages");
+        const cancelMatch = apiSessionRoute(url.pathname, "cancel");
+        const inputMatch = apiSessionRoute(url.pathname, "input-response");
+        const uploadMatch = apiSessionRoute(url.pathname, "uploads");
+        const workspaceMatch = workspaceRoute(url.pathname);
+        try {
+            if (url.pathname === "/health" && request.method === "GET") {
+                writeJson(response, 200, {
+                    status: "ok",
+                    sessions: context.sessions.size,
+                    protocol: "arena-trigger-realtime-v1",
+                });
+            }
+            else if (url.pathname === "/api/config" && request.method === "GET") {
+                writeJson(response, 200, {
+                    model: context.config.model.replace(/^[^/]+\//, ""),
+                    protocol: "arena-trigger-realtime-v1",
+                });
+            }
+            else if (url.pathname === "/api/chat/trigger-session" &&
+                request.method === "POST") {
+                await triggerSession(context, request, response);
+            }
+            else if (url.pathname === "/api/chat/trigger-token" &&
+                request.method === "POST") {
+                await triggerToken(context, request, response);
+            }
+            else if (appendMatch && request.method === "POST") {
+                await appendMessage(context, request, response, await getSession(context, appendMatch[1] || ""));
+            }
+            else if (outputMatch && request.method === "GET") {
+                const session = await getSession(context, outputMatch[1] || "");
+                if (authorize(request, response, session)) {
+                    openEventStream(request, response, session);
+                }
+            }
+            else if (messagesMatch && request.method === "GET") {
+                await sessionMessages(context, request, response, await getSession(context, messagesMatch[1] || ""));
+            }
+            else if (cancelMatch && request.method === "POST") {
+                await cancelTurn(request, response, await getSession(context, cancelMatch[1] || ""));
+            }
+            else if (inputMatch && request.method === "POST") {
+                await respondToInput(request, response, await getSession(context, inputMatch[1] || ""));
+            }
+            else if (uploadMatch && request.method === "POST") {
+                await uploadAttachment(request, response, await getSession(context, uploadMatch[1] || ""));
+            }
+            else if (url.pathname === "/query" &&
+                ["GET", "POST"].includes(request.method || "")) {
+                await query(context, request, response, url);
+            }
+            else if (workspaceMatch && request.method === "GET") {
+                const session = await getSession(context, workspaceMatch[1] || "");
+                if (!authorize(request, response, session))
+                    return;
+                const file = await safeWorkspaceFile(session, workspaceMatch[2] || "");
+                if (!file) {
+                    writeJson(response, 403, {
+                        error: "workspace path is not allowed",
+                    });
+                }
+                else {
+                    await serveFile(response, file, false, true);
+                }
+            }
+            else if (["/", "/index.html"].includes(url.pathname) ||
+                /^\/agent\/[A-Za-z0-9-]{1,128}$/.test(url.pathname)) {
+                await serveFile(response, path.join(context.webRoot, "index.html"));
+            }
+            else if (url.pathname === "/app.js") {
+                await serveFile(response, context.appScript, true);
+            }
+            else if (url.pathname === "/sdk.js") {
+                await serveFile(response, path.join(projectRoot(), "dist", "sdk.js"), true);
+            }
+            else if (["/styles.css", "/fonts.css", "/arena-logo.svg"].includes(url.pathname)) {
+                await serveFile(response, path.join(context.webRoot, url.pathname.slice(1)), true);
+            }
+            else {
+                writeJson(response, 404, { error: "not found" });
+            }
+        }
+        catch (error) {
+            if (response.headersSent) {
+                response.end();
+            }
+            else if (error.code === "ENOENT") {
+                writeJson(response, 404, { error: "not found" });
+            }
+            else {
+                writeJson(response, 400, { error: errorMessage(error) });
+            }
+        }
+    };
+}
+export async function startServer(options = {}) {
+    const host = options.host || "127.0.0.1";
+    const workspace = path.resolve(options.workspace || process.cwd());
+    const root = projectRoot();
+    const config = configFromEnv(workspace);
+    if (!validTenantId(config.tenantId)) {
+        throw new Error("ARENA_TENANT_ID must contain only letters, numbers, underscores, or hyphens");
+    }
+    const context = {
+        host,
+        port: options.port ?? 3000,
+        workspace,
+        config,
+        webRoot: path.join(root, "web"),
+        appScript: path.join(root, "dist", "web", "app.js"),
+        sessions: new Map(),
+    };
+    await mkdir(workspace, { recursive: true });
+    const server = http.createServer(createRequestHandler(context));
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(context.port, host, () => {
+            server.off("error", reject);
+            const address = server.address();
+            if (address && typeof address === "object")
+                context.port = address.port;
+            resolve();
+        });
+    });
+    const cleanup = setInterval(() => {
+        const cutoff = Date.now() - 6 * 60 * 60 * 1000;
+        for (const [sessionId, session] of context.sessions) {
+            if (!session.running &&
+                !session.subscribers.size &&
+                session.touchedAt < cutoff) {
+                context.sessions.delete(sessionId);
+            }
+        }
+    }, 60 * 60 * 1000);
+    cleanup.unref();
+    let closing = null;
+    const close = () => {
+        closing ??= new Promise((resolve) => {
+            clearInterval(cleanup);
+            for (const session of context.sessions.values()) {
+                session.pendingInput?.reject(new Error("server shutting down"));
+                session.running?.controller.abort(new Error("server shutting down"));
+                for (const subscriber of session.subscribers)
+                    subscriber.end();
+                session.subscribers.clear();
+            }
+            server.close(() => resolve());
+            server.closeAllConnections?.();
+        });
+        return closing;
+    };
+    if (options.registerSignalHandlers !== false) {
+        let shuttingDown = false;
+        const shutdown = () => {
+            if (shuttingDown) {
+                process.exitCode = 1;
+                return;
+            }
+            shuttingDown = true;
+            const forceExit = setTimeout(() => process.exit(1), 3000);
+            forceExit.unref();
+            void close().then(() => {
+                clearTimeout(forceExit);
+                process.exit(0);
+            });
+        };
+        process.once("SIGINT", shutdown);
+        process.once("SIGTERM", shutdown);
+    }
+    console.log(`arena serve listening on http://${host}:${context.port}`);
+    return { server, host, port: context.port, close };
+}
+//# sourceMappingURL=server.js.map