@rashidee/co2 1.3.10 → 1.3.12

package/dist/index.js

@@ -6809,7 +6809,7 @@ var {
 // package.json
 var package_default = {
   name: "@rashidee/co2",
-  version: "1.3.10",
+  version: "1.3.12",
   description: "Compound Context Studio \u2014 self-hosted team context authoring for CO2 projects",
   type: "module",
   license: "MIT",
@@ -14785,6 +14785,15 @@ function resolveSession(db) {
     await next();
   };
 }
+function findSessionUser(db, rawToken) {
+  if (!rawToken) return null;
+  const session = db.select().from(sessions).where(
+    and(eq(sessions.tokenHash, hashToken(rawToken)), gt(sessions.expiresAt, (/* @__PURE__ */ new Date()).toISOString()))
+  ).limit(1).get();
+  if (!session) return null;
+  const user = db.select().from(users).where(eq(users.id, session.userId)).limit(1).get();
+  return user && user.isDeleted === 0 ? user : null;
+}
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
@@ -19151,6 +19160,14 @@ var gitResolveRequestSchema = external_exports.object({
   message: "Manual resolution requires the merged content",
   path: ["content"]
 });
+var gitPullResponseSchema = external_exports.object({
+  status: external_exports.enum(["up_to_date", "merged", "conflicts"]),
+  branch: external_exports.string(),
+  /** New short HEAD hash — present only for `merged`. */
+  commitHash: external_exports.string().optional(),
+  /** Git's own summary (e.g. the conflict list) — display verbatim. */
+  message: external_exports.string().optional()
+});
 
 // ../core/src/schemas/import.ts
 var importCandidateSchema = external_exports.object({
@@ -19905,6 +19922,64 @@ async function startMockupHub(db, workspacePath, projectId, requestHost, port) {
   }
   return toStatus({ location, running: false, activePort: targetPort }, requestHost, projectId);
 }
+var STRIP_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "host",
+  "content-length",
+  "content-encoding",
+  "accept-encoding"
+]);
+async function proxyHubRequest(db, workspacePath, projectId, prefix, subPath, req) {
+  const location = resolveHub(db, workspacePath, projectId);
+  if (!location.present) throw svcError("MOCKUP_HUB_MISSING", 404);
+  if (!location.configPort) throw svcError("MOCKUP_HUB_DOWN", 502);
+  const url = new URL(req.url);
+  const target = `http://127.0.0.1:${location.configPort}${subPath}${url.search}`;
+  const headers = new Headers();
+  req.headers.forEach((value, name) => {
+    if (!STRIP_HEADERS.has(name.toLowerCase())) headers.set(name, value);
+  });
+  headers.set("x-forwarded-prefix", prefix);
+  headers.set("x-forwarded-host", url.host);
+  headers.set("x-forwarded-proto", url.protocol.replace(/:$/, ""));
+  const hasBody = req.method !== "GET" && req.method !== "HEAD";
+  let upstream;
+  try {
+    upstream = await fetch(target, {
+      method: req.method,
+      headers,
+      body: hasBody ? await req.arrayBuffer() : void 0,
+      redirect: "manual"
+    });
+  } catch {
+    throw svcError("MOCKUP_HUB_DOWN", 502);
+  }
+  const responseHeaders = new Headers();
+  upstream.headers.forEach((value, name) => {
+    if (!STRIP_HEADERS.has(name.toLowerCase())) responseHeaders.set(name, value);
+  });
+  const redirectTo = responseHeaders.get("location");
+  if (redirectTo?.startsWith("/") && redirectTo !== prefix && !redirectTo.startsWith(`${prefix}/`)) {
+    responseHeaders.set("location", `${prefix}${redirectTo}`);
+  }
+  const prefixAware = upstream.headers.get("x-hub-prefix") !== null;
+  responseHeaders.delete("x-hub-prefix");
+  if (!prefixAware && responseHeaders.get("content-type")?.includes("text/html")) {
+    const html = (await upstream.text()).replace(
+      /(href|src|action|hx-get|hx-post|hx-put|hx-patch|hx-delete)="(\/[^"]*)"/g,
+      (match2, attr, url2) => url2 === prefix || url2.startsWith(`${prefix}/`) ? match2 : `${attr}="${prefix}${url2}"`
+    );
+    return new Response(html, { status: upstream.status, headers: responseHeaders });
+  }
+  return new Response(upstream.body, { status: upstream.status, headers: responseHeaders });
+}
 function stopMockupHub(projectId) {
   const child = spawnedHubs.get(projectId);
   if (!child) return false;
@@ -20201,6 +20276,24 @@ function artifactRoutes(db, workspacePath) {
       return errorResponse(c, e);
     }
   });
+  app.all(
+    "/mockup-proxy/:projectId",
+    (c) => (
+      // Normalize to the trailing-slash form so the prefix always maps to the hub root.
+      c.redirect(`${c.req.path}/`, 301)
+    )
+  );
+  app.all("/mockup-proxy/:projectId/*", async (c) => {
+    const projectId = Number(c.req.param("projectId"));
+    if (!Number.isInteger(projectId) || projectId <= 0) return c.json({ code: "INVALID_ID" }, 400);
+    const prefix = `/api/artifacts/mockup-proxy/${projectId}`;
+    const subPath = c.req.path.slice(prefix.length) || "/";
+    try {
+      return await proxyHubRequest(db, workspacePath, projectId, prefix, subPath, c.req.raw);
+    } catch (e) {
+      return errorResponse(c, e);
+    }
+  });
   app.get("/:id/content", (c) => {
     const id = Number(c.req.param("id"));
     if (Number.isNaN(id)) return c.json({ code: "INVALID_ID" }, 400);
@@ -21770,16 +21863,19 @@ function brainstormRoutes(db, workspacePath) {
 import { existsSync as existsSync13, readFileSync as readFileSync8 } from "fs";
 import { join as join14 } from "path";
 
+// ../server/src/features/cicd/app-proxy.ts
+import { connect as connect2 } from "net";
+
 // ../server/src/features/cicd/app-runner.ts
 import { spawn as spawn2 } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { request as httpRequest2 } from "http";
 import { join as join9 } from "path";
 function svcError6(code, status) {
   return Object.assign(new Error(code), { code, status });
 }
-var DEFAULT_CICD_APP_PORT = 4100;
+var DEFAULT_CICD_APP_PORT = 5e3;
 var spawnedApps = /* @__PURE__ */ new Map();
 var guardTokens = /* @__PURE__ */ new Map();
 function killSpawnedApps() {
@@ -21830,55 +21926,81 @@ function probeApp(port, timeoutMs = 1e3) {
     req.end();
   });
 }
-function toStatus2(location, running, requestHost) {
-  const hostname = requestHost.replace(/:\d+$/, "") || "localhost";
+function toStatus2(location, running, projectId) {
   return {
     present: location.present,
     running,
     port: location.present ? location.port : null,
-    url: location.present ? `http://${hostname}:${location.port}/` : null
+    // Same-origin proxy path (app-proxy.ts routes) — works locally AND behind HTTPS/reverse
+    // proxies; the iframe and "Open in new tab" both load through it.
+    url: location.present ? `/api/cicd/${projectId}/app-proxy/` : null
   };
 }
-async function getCicdAppStatus(db, workspacePath, projectId, requestHost) {
+async function getCicdAppStatus(db, workspacePath, projectId) {
   const location = resolveCicdApp(db, workspacePath, projectId);
   const running = location.present ? await probeApp(location.port) : false;
-  return toStatus2(location, running, requestHost);
+  return toStatus2(location, running, projectId);
 }
-async function startCicdApp(db, workspacePath, projectId, requestHost, studioPort) {
+async function startCicdApp(db, workspacePath, projectId, studioPort, port) {
   const location = resolveCicdApp(db, workspacePath, projectId);
   if (!location.present) throw svcError6("CICD_APP_MISSING", 404);
-  if (await probeApp(location.port)) return toStatus2(location, true, requestHost);
+  const targetPort = port ?? location.port;
+  if (targetPort !== location.port) {
+    const configPath = join9(location.appDir, "cicd.config.json");
+    let config = {};
+    try {
+      config = JSON.parse(readFileSync6(configPath, "utf8"));
+    } catch {
+    }
+    config.port = targetPort;
+    try {
+      writeFileSync5(configPath, `${JSON.stringify(config, null, 2)}
+`);
+    } catch {
+    }
+    location.port = targetPort;
+  }
+  if (await probeApp(targetPort)) {
+    location.port = targetPort;
+    return toStatus2(location, true, projectId);
+  }
   const existing = spawnedApps.get(projectId);
-  if (!existing || existing.exitCode !== null) {
-    const token = randomBytes2(24).toString("hex");
-    guardTokens.set(projectId, token);
-    const child = spawn2(process.execPath, ["server.js"], {
-      cwd: location.appDir,
-      stdio: "ignore",
-      env: {
-        ...process.env,
-        PORT: String(location.port),
-        CO2_STUDIO_URL: `http://127.0.0.1:${studioPort}`,
-        CO2_PROJECT_ID: String(projectId),
-        CO2_GUARD_TOKEN: token
-      }
-    });
-    child.on("error", () => {
-      spawnedApps.delete(projectId);
-      guardTokens.delete(projectId);
-    });
-    child.on("exit", () => {
-      spawnedApps.delete(projectId);
-      guardTokens.delete(projectId);
-    });
-    spawnedApps.set(projectId, child);
-    db.update(cicdSetups).set({ appPort: location.port, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq(cicdSetups.projectId, projectId)).run();
+  if (existing && existing.exitCode === null) {
+    try {
+      existing.kill();
+    } catch {
+    }
+    spawnedApps.delete(projectId);
+    guardTokens.delete(projectId);
   }
+  const token = randomBytes2(24).toString("hex");
+  guardTokens.set(projectId, token);
+  const child = spawn2(process.execPath, ["server.js"], {
+    cwd: location.appDir,
+    stdio: "ignore",
+    env: {
+      ...process.env,
+      PORT: String(location.port),
+      CO2_STUDIO_URL: `http://127.0.0.1:${studioPort}`,
+      CO2_PROJECT_ID: String(projectId),
+      CO2_GUARD_TOKEN: token
+    }
+  });
+  child.on("error", () => {
+    spawnedApps.delete(projectId);
+    guardTokens.delete(projectId);
+  });
+  child.on("exit", () => {
+    spawnedApps.delete(projectId);
+    guardTokens.delete(projectId);
+  });
+  spawnedApps.set(projectId, child);
+  db.update(cicdSetups).set({ appPort: location.port, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq(cicdSetups.projectId, projectId)).run();
   for (let attempt = 0; attempt < 20; attempt++) {
-    if (await probeApp(location.port, 500)) return toStatus2(location, true, requestHost);
+    if (await probeApp(location.port, 500)) return toStatus2(location, true, projectId);
     await new Promise((r) => setTimeout(r, 250));
   }
-  return toStatus2(location, false, requestHost);
+  return toStatus2(location, false, projectId);
 }
 function stopCicdApp(projectId) {
   const child = spawnedApps.get(projectId);
@@ -21892,13 +22014,103 @@ function stopCicdApp(projectId) {
   return true;
 }
 
+// ../server/src/features/cicd/app-proxy.ts
+async function proxyCicdAppRequest(db, workspacePath, projectId, prefix, subPath, req) {
+  const location = resolveCicdApp(db, workspacePath, projectId);
+  if (!location.present) throw svcError6("CICD_APP_MISSING", 404);
+  const url = new URL(req.url);
+  const target = `http://127.0.0.1:${location.port}${subPath}${url.search}`;
+  const headers = new Headers();
+  req.headers.forEach((value, name) => {
+    if (!STRIP_HEADERS.has(name.toLowerCase())) headers.set(name, value);
+  });
+  headers.set("x-forwarded-prefix", prefix);
+  headers.set("x-forwarded-host", url.host);
+  headers.set("x-forwarded-proto", url.protocol.replace(/:$/, ""));
+  const hasBody = req.method !== "GET" && req.method !== "HEAD";
+  let upstream;
+  try {
+    upstream = await fetch(target, {
+      method: req.method,
+      headers,
+      body: hasBody ? await req.arrayBuffer() : void 0,
+      redirect: "manual"
+    });
+  } catch {
+    throw svcError6("CICD_APP_DOWN", 502);
+  }
+  const responseHeaders = new Headers();
+  upstream.headers.forEach((value, name) => {
+    if (!STRIP_HEADERS.has(name.toLowerCase())) responseHeaders.set(name, value);
+  });
+  const redirectTo = responseHeaders.get("location");
+  if (redirectTo?.startsWith("/") && redirectTo !== prefix && !redirectTo.startsWith(`${prefix}/`)) {
+    responseHeaders.set("location", `${prefix}${redirectTo}`);
+  }
+  return new Response(upstream.body, { status: upstream.status, headers: responseHeaders });
+}
+var CICD_PROXY_UPGRADE_RE = /^\/api\/cicd\/(\d+)\/app-proxy(\/.*)$/;
+function sessionTokenFromCookieHeader(cookieHeader) {
+  if (!cookieHeader) return void 0;
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === SESSION_COOKIE) return rest.join("=");
+  }
+  return void 0;
+}
+function handleCicdProxyUpgrade(db, workspacePath, req, socket, head) {
+  const url = new URL(req.url ?? "", "http://localhost");
+  const match2 = url.pathname.match(CICD_PROXY_UPGRADE_RE);
+  if (!match2) {
+    socket.destroy();
+    return;
+  }
+  const user = findSessionUser(db, sessionTokenFromCookieHeader(req.headers.cookie));
+  if (!user || user.mustChangePassword) {
+    socket.write("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
+    socket.destroy();
+    return;
+  }
+  let port;
+  try {
+    const location = resolveCicdApp(db, workspacePath, Number(match2[1]));
+    if (!location.present) {
+      socket.destroy();
+      return;
+    }
+    port = location.port;
+  } catch {
+    socket.destroy();
+    return;
+  }
+  const upstream = connect2(port, "127.0.0.1", () => {
+    let raw2 = `${req.method} ${match2[2]}${url.search} HTTP/1.1\r
+`;
+    for (let i = 0; i < req.rawHeaders.length; i += 2) {
+      const name = req.rawHeaders[i];
+      const value = name.toLowerCase() === "host" ? `127.0.0.1:${port}` : req.rawHeaders[i + 1];
+      raw2 += `${name}: ${value}\r
+`;
+    }
+    upstream.write(`${raw2}\r
+`);
+    if (head.length > 0) upstream.write(head);
+    socket.pipe(upstream);
+    upstream.pipe(socket);
+  });
+  upstream.on("error", () => socket.destroy());
+  socket.on("error", () => upstream.destroy());
+  upstream.on("close", () => socket.destroy());
+  socket.on("close", () => upstream.destroy());
+}
+
 // ../server/src/features/cicd/guard.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { existsSync as existsSync10 } from "fs";
 import { join as join11 } from "path";
 
 // ../server/src/features/prd-wizard/service.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3, statSync as statSync2, writeFileSync as writeFileSync6 } from "fs";
 import { join as join10 } from "path";
 function svcError7(code, status) {
   return Object.assign(new Error(code), { code, status });
@@ -21976,7 +22188,7 @@ function generatePrdWizardMarkdown(db, workspacePath, requestId, targetModule) {
     `execution/${filename}`,
     targetModule
   );
-  writeFileSync5(filePath, markdown, "utf8");
+  writeFileSync6(filePath, markdown, "utf8");
   db.update(prdWizardRequests).set({
     generatedMarkdownPath: filePath,
     status: "generated",
@@ -22213,7 +22425,7 @@ function evaluateBuildGuard(db, workspacePath, projectId, versionId) {
 }
 
 // ../server/src/features/cicd/service.ts
-import { appendFileSync, existsSync as existsSync12, mkdirSync as mkdirSync4, statSync as statSync4, writeFileSync as writeFileSync6 } from "fs";
+import { appendFileSync, existsSync as existsSync12, mkdirSync as mkdirSync4, statSync as statSync4, writeFileSync as writeFileSync7 } from "fs";
 import { join as join13 } from "path";
 
 // ../server/src/features/batch-job/constants.ts
@@ -22356,7 +22568,7 @@ function requestPlan(db, workspacePath, projectId, userId) {
   const filename = `cicd-plan-${setup.id}-${Date.now()}.md`;
   const filePath = join13(executionDir, filename);
   const relative3 = `execution/${filename}`;
-  writeFileSync6(
+  writeFileSync7(
     filePath,
     buildPlanRequestMarkdown(
       project.name,
@@ -22516,9 +22728,12 @@ function parseProjectId(c) {
   const id = Number(c.req.param("projectId"));
   return Number.isNaN(id) ? null : id;
 }
+var startBodySchema = external_exports.object({
+  port: external_exports.coerce.number().int().min(1024).max(65535).optional()
+});
 function cicdRoutes(db, workspacePath, studioPort) {
   const app = new Hono2();
-  const toDto8 = async (c, setup) => {
+  const toDto8 = async (setup) => {
     const planFile = setup.planRequestPath?.split(/[\\/]/).pop();
     return {
       id: setup.id,
@@ -22530,7 +22745,7 @@ function cicdRoutes(db, workspacePath, studioPort) {
       approvedAt: setup.approvedAt,
       generatedAt: setup.generatedAt,
       stale: isStale(db, setup),
-      app: await getCicdAppStatus(db, workspacePath, setup.projectId, c.req.header("host") ?? ""),
+      app: await getCicdAppStatus(db, workspacePath, setup.projectId),
       createdAt: setup.createdAt,
       updatedAt: setup.updatedAt
     };
@@ -22548,7 +22763,7 @@ function cicdRoutes(db, workspacePath, studioPort) {
         startCicdWatcher(db, workspacePath, setup.id, "generation", user.id);
       }
       const fresh = getOrCreateSetup(db, projectId, user.id);
-      return c.json(await toDto8(c, fresh));
+      return c.json(await toDto8(fresh));
     } catch (e) {
       return errorResponse3(c, e);
     }
@@ -22571,7 +22786,7 @@ function cicdRoutes(db, workspacePath, studioPort) {
       if (fresh.status === "generating" && !hasCicdWatcher(fresh.id, "generation")) {
         startCicdWatcher(db, workspacePath, fresh.id, "generation", user.id);
       }
-      return c.json(await toDto8(c, fresh));
+      return c.json(await toDto8(fresh));
     } catch (e) {
       return errorResponse3(c, e);
     }
@@ -22625,10 +22840,11 @@ function cicdRoutes(db, workspacePath, studioPort) {
   app.post("/:projectId/app/start", async (c) => {
     const projectId = parseProjectId(c);
     if (projectId === null) return c.json({ code: "INVALID_ID" }, 400);
+    const parsed = startBodySchema.safeParse(await c.req.json().catch(() => ({})));
+    if (!parsed.success) return c.json({ code: "INVALID_PORT" }, 400);
+    if (parsed.data.port === studioPort) return c.json({ code: "CICD_PORT_CONFLICT" }, 400);
     try {
-      return c.json(
-        await startCicdApp(db, workspacePath, projectId, c.req.header("host") ?? "", studioPort)
-      );
+      return c.json(await startCicdApp(db, workspacePath, projectId, studioPort, parsed.data.port));
     } catch (e) {
       return errorResponse3(c, e);
     }
@@ -22638,9 +22854,25 @@ function cicdRoutes(db, workspacePath, studioPort) {
     if (projectId === null) return c.json({ code: "INVALID_ID" }, 400);
     try {
       stopCicdApp(projectId);
-      return c.json(
-        await getCicdAppStatus(db, workspacePath, projectId, c.req.header("host") ?? "")
-      );
+      return c.json(await getCicdAppStatus(db, workspacePath, projectId));
+    } catch (e) {
+      return errorResponse3(c, e);
+    }
+  });
+  app.all(
+    "/:projectId/app-proxy",
+    (c) => (
+      // Normalize to the trailing-slash form so relative URLs in the page resolve under the prefix.
+      c.redirect(`${c.req.path}/`, 301)
+    )
+  );
+  app.all("/:projectId/app-proxy/*", async (c) => {
+    const projectId = parseProjectId(c);
+    if (projectId === null) return c.json({ code: "INVALID_ID" }, 400);
+    const prefix = `/api/cicd/${projectId}/app-proxy`;
+    const subPath = c.req.path.slice(prefix.length) || "/";
+    try {
+      return await proxyCicdAppRequest(db, workspacePath, projectId, prefix, subPath, c.req.raw);
     } catch (e) {
       return errorResponse3(c, e);
     }
@@ -22666,11 +22898,11 @@ function cicdGuardRoutes(db, workspacePath) {
 }
 
 // ../server/src/features/project/service.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "fs";
 import { join as join16 } from "path";
 
 // ../server/src/features/project-config/service.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
 import { join as join15 } from "path";
 function svcError9(code, status) {
   return Object.assign(new Error(code), { code, status });
@@ -22694,7 +22926,7 @@ function resolveImportedByName(db, importedBy) {
 function writeProjectFile(workspacePath, folder, fileName, content) {
   const dir = join15(workspacePath, folder);
   mkdirSync5(dir, { recursive: true });
-  writeFileSync7(join15(dir, fileName), content, "utf8");
+  writeFileSync8(join15(dir, fileName), content, "utf8");
 }
 function toDto5(db, row, field) {
   return {
@@ -22861,8 +23093,8 @@ function scaffoldProjectFolder(workspacePath, folderName, name, baseIdea) {
     "# Feedback",
     "<!-- Human answers appear here -->"
   ].join("\n");
-  writeFileSync8(join16(projectDir2, `${folderName}.brainstorm.md`), template, "utf8");
-  writeFileSync8(
+  writeFileSync9(join16(projectDir2, `${folderName}.brainstorm.md`), template, "utf8");
+  writeFileSync9(
     join16(projectDir2, "context", "references", "brainstorm-protocol.md"),
     "# Brainstorm Protocol\n\n[Installed by the co2 plugin]\n",
     "utf8"
@@ -22900,7 +23132,7 @@ function updateBrainstormMd(db, workspacePath, projectId, content) {
     project.workspaceFolderName,
     `${project.workspaceFolderName}.brainstorm.md`
   );
-  writeFileSync8(filePath, content, "utf8");
+  writeFileSync9(filePath, content, "utf8");
 }
 function listProjects(db, archived) {
   return db.select({
@@ -23023,7 +23255,7 @@ function regenerateCO2Files(db, workspacePath, projectId) {
   const projectDir2 = join16(workspacePath, project.workspaceFolderName);
   mkdirSync6(projectDir2, { recursive: true });
   const apps = db.select().from(applications).where(and(eq(applications.projectId, projectId), eq(applications.isDeleted, 0))).all();
-  writeFileSync8(
+  writeFileSync9(
     join16(projectDir2, "CLAUDE.md"),
     project.rawClaudeMd ?? buildClaudeMd(project.name, apps),
     "utf8"
@@ -23040,7 +23272,7 @@ function regenerateCO2Files(db, workspacePath, projectId) {
     const appRel = resolveAppFolderName(projectDir2, app.name);
     const appDir = join16(projectDir2, appRel, "context");
     mkdirSync6(appDir, { recursive: true });
-    writeFileSync8(
+    writeFileSync9(
       join16(appDir, "PRD.md"),
       prdSnapshot[String(app.id)] ?? buildPrdMd(app.name, mods, loadPrdSections(db, app.id)),
       "utf8"
@@ -23433,7 +23665,7 @@ function dashboardRoutes(db) {
 }
 
 // ../server/src/features/defect/service.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync10 } from "fs";
 import { join as join17 } from "path";
 
 // ../server/src/features/project-import/bug-md.ts
@@ -23865,7 +24097,7 @@ function writeBugMdFile(db, workspacePath, app, projectFolderName) {
   const appRel = resolveAppFolderName(projectDir2, app.name);
   const appContextDir = join17(projectDir2, appRel, "context");
   mkdirSync7(appContextDir, { recursive: true });
-  writeFileSync9(join17(appContextDir, "BUG.md"), content, "utf8");
+  writeFileSync10(join17(appContextDir, "BUG.md"), content, "utf8");
   return { content, bugCount: bugs.length };
 }
 function syncBugStatusesFromMaster(db, trackingFilePath, applicationId) {
@@ -23909,7 +24141,7 @@ function syncBugMdToDisk(db, workspacePath, applicationId, bugId, mode = "replac
           ).all().find((m) => m.name.toLowerCase() === bug.module?.toLowerCase())?.category : void 0) ?? null;
           const merged = mergeBugIntoBugMd(readFileSync11(file, "utf8"), bug, semver, category, mode);
           if (merged !== null) {
-            writeFileSync9(file, merged, "utf8");
+            writeFileSync10(file, merged, "utf8");
             return;
           }
         }
@@ -24043,7 +24275,7 @@ function defectRoutes(db, workspacePath) {
 }
 
 // ../server/src/features/document/service.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync12, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync12, writeFileSync as writeFileSync11 } from "fs";
 import { join as join18 } from "path";
 function svcError12(code, status) {
   return Object.assign(new Error(code), { code, status });
@@ -24056,7 +24288,7 @@ function uploadDocument(db, dataDir, projectId, file) {
   mkdirSync8(dir, { recursive: true });
   const safeName = file.name.replace(/[^a-zA-Z0-9._-]/g, "_");
   const stamped = `${Date.now()}_${safeName}`;
-  writeFileSync10(join18(dir, stamped), file.bytes);
+  writeFileSync11(join18(dir, stamped), file.bytes);
   const relativePath = `${projectId}/${stamped}`;
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const inserted = db.insert(documents).values({
@@ -24143,7 +24375,7 @@ function documentRoutes(db, dataDir) {
 
 // ../server/src/features/git/service.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync18, readFileSync as readFileSync13, rmSync, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync13, rmSync, writeFileSync as writeFileSync12 } from "fs";
 import { join as join19 } from "path";
 var GitServiceError = class extends Error {
   code;
@@ -24394,7 +24626,7 @@ function resolveConflict(db, workspacePath, projectId, input) {
       if (input.content === void 0) {
         throw new GitServiceError("CONTENT_REQUIRED", 400, "Manual resolution requires content");
       }
-      writeFileSync11(join19(dir, input.path), input.content, "utf8");
+      writeFileSync12(join19(dir, input.path), input.content, "utf8");
     } else {
       git3(dir, ["checkout", `--${input.resolution}`, "--", input.path]);
     }
@@ -24404,6 +24636,67 @@ function resolveConflict(db, workspacePath, projectId, input) {
     throw new GitServiceError("GIT_RESOLVE_FAILED", 409, detail(e));
   }
 }
+function pullChanges(db, workspacePath, projectId, userId) {
+  const dir = projectDir(db, workspacePath, projectId);
+  if (!existsSync18(dir) || !isGitRepo(dir)) {
+    throw new GitServiceError("NO_GIT_REPO", 404, "No git repository for this project");
+  }
+  const status = getGitStatus(db, workspacePath, projectId);
+  if (!status.clean) {
+    throw new GitServiceError(
+      "UNCOMMITTED_CHANGES",
+      409,
+      "Commit or discard your local changes before pulling"
+    );
+  }
+  const branch = safe(() => git3(dir, ["branch", "--show-current"])) ?? "";
+  if (branch === "") {
+    throw new GitServiceError(
+      "DETACHED_HEAD",
+      409,
+      "The repository is in detached HEAD state \u2014 check out a branch before pulling"
+    );
+  }
+  const ctx = resolveGitPushContext(db, projectId, userId);
+  if (ctx.remoteUrl) ensureOrigin(dir, ctx.remoteUrl);
+  const remotes = safe(() => git3(dir, ["remote"])) ?? "";
+  if (!remotes.split("\n").includes("origin")) {
+    throw new GitServiceError("NO_REMOTE", 400, "No git remote configured for this project");
+  }
+  const headBefore = safe(() => git3(dir, ["rev-parse", "--short", "HEAD"])) ?? "";
+  const authB64 = ctx.auth ? Buffer.from(`${ctx.auth.username}:${ctx.auth.token}`).toString("base64") : null;
+  try {
+    execFileSync3(
+      "git",
+      [
+        ...buildPushAuthArgs(ctx.auth),
+        ...identityArgs(db, userId),
+        "pull",
+        "--no-rebase",
+        "--no-edit",
+        "origin",
+        branch
+      ],
+      {
+        cwd: dir,
+        stdio: "pipe",
+        timeout: 12e4,
+        maxBuffer: 64 * 1024 * 1024,
+        env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+      }
+    );
+  } catch (e) {
+    if (authB64) redactAuthHeaderFromError(e, authB64);
+    const after = getGitStatus(db, workspacePath, projectId);
+    if (after.hasConflicts) {
+      return { status: "conflicts", branch, message: gitErrorDetail(e) };
+    }
+    throw new GitServiceError("GIT_PULL_FAILED", 409, withIdentityHint(gitErrorDetail(e)));
+  }
+  const headAfter = safe(() => git3(dir, ["rev-parse", "--short", "HEAD"])) ?? "";
+  if (headAfter === headBefore) return { status: "up_to_date", branch };
+  return { status: "merged", branch, commitHash: headAfter };
+}
 function detail(e) {
   const stderr = e.stderr?.toString().trim();
   return stderr || e.message || String(e);
@@ -24475,6 +24768,15 @@ function gitRoutes(db, workspacePath) {
       return errorResponse7(c, e);
     }
   });
+  app.post("/pull/:projectId", (c) => {
+    const projectId = Number(c.req.param("projectId"));
+    if (Number.isNaN(projectId)) return c.json({ code: "INVALID_ID" }, 400);
+    try {
+      return c.json(pullChanges(db, workspacePath, projectId, c.get("user")?.id));
+    } catch (e) {
+      return errorResponse7(c, e);
+    }
+  });
   return app;
 }
 
@@ -25096,7 +25398,7 @@ function scanProject(db, workspacePath, folderName) {
 import { join as join22, relative as relative2 } from "path";
 
 // ../server/src/features/workflow/service.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync13 } from "fs";
 import { join as join21, relative, resolve as resolve2, sep } from "path";
 var ACTIVE_RUN_STATUSES = ["pending", "in_progress"];
 function svcError14(code, status) {
@@ -25323,7 +25625,7 @@ function generateWorkflowMarkdown(db, workspacePath, input, creatingUser, watche
     relPath
   );
   mkdirSync9(join21(projectDir2, "workflow", creatingUser.username), { recursive: true });
-  writeFileSync12(join21(projectDir2, relPath), content, "utf8");
+  writeFileSync13(join21(projectDir2, relPath), content, "utf8");
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const wfm = db.insert(workflowMarkdowns).values({
     projectId: input.projectId,
@@ -26167,7 +26469,7 @@ function projectRoutes(db, workspacePath) {
 }
 
 // ../server/src/features/shared-context/service.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync16, readdirSync as readdirSync4, statSync as statSync6, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync16, readdirSync as readdirSync4, statSync as statSync6, writeFileSync as writeFileSync14 } from "fs";
 import { join as join23, resolve as resolve3, sep as sep2 } from "path";
 function svcError16(code, status) {
   return Object.assign(new Error(code), { code, status });
@@ -26258,7 +26560,7 @@ function uploadFile(db, workspacePath, projectId, folder, file) {
   const dir = folder ? safeResolve(root, folder) : root;
   if (folder && !existsSync21(dir)) throw svcError16("FOLDER_NOT_FOUND", 404);
   const safeName = sanitizeSegment(file.name);
-  writeFileSync13(join23(dir, safeName), file.bytes);
+  writeFileSync14(join23(dir, safeName), file.bytes);
   return { path: folder ? `${folder}/${safeName}` : safeName };
 }
 function getFileContent(db, workspacePath, projectId, relPath) {
@@ -26273,7 +26575,7 @@ function saveMarkdown(db, workspacePath, projectId, relPath, content) {
   const root = resolveSharedRoot(db, workspacePath, projectId);
   const full = safeResolve(root, relPath);
   if (!existsSync21(full) || !statSync6(full).isFile()) throw svcError16("NOT_FOUND", 404);
-  writeFileSync13(full, content, "utf8");
+  writeFileSync14(full, content, "utf8");
 }
 
 // ../server/src/features/shared-context/routes.ts
@@ -26987,6 +27289,26 @@ function appendScrollback(session, data) {
     session.bufferBytes -= session.buffer.shift().length;
   }
 }
+var HEARTBEAT_INTERVAL_MS = 3e4;
+function attachHeartbeat(ws, intervalMs = HEARTBEAT_INTERVAL_MS) {
+  let alive = true;
+  ws.on("pong", () => {
+    alive = true;
+  });
+  const timer = setInterval(() => {
+    if (!alive) {
+      clearInterval(timer);
+      ws.terminate();
+      return;
+    }
+    alive = false;
+    try {
+      ws.ping();
+    } catch {
+    }
+  }, intervalMs);
+  ws.on("close", () => clearInterval(timer));
+}
 var sessions2 = /* @__PURE__ */ new Map();
 function closeTerminalSessions(projectId, reason) {
   const session = sessions2.get(projectId);
@@ -27018,8 +27340,21 @@ function resolveProjectFolder(db, projectId) {
   return row?.folder ?? null;
 }
 function createWsServer(httpServer, db, workspacePath) {
-  const wss = new import_websocket_server.default({ server: httpServer, path: "/ws/terminal" });
+  const wss = new import_websocket_server.default({ noServer: true });
+  httpServer.on("upgrade", (req, socket, head) => {
+    const pathname = new URL(req.url ?? "", "http://localhost").pathname;
+    if (pathname === "/ws/terminal") {
+      wss.handleUpgrade(req, socket, head, (ws) => wss.emit("connection", ws, req));
+      return;
+    }
+    if (pathname.startsWith("/api/cicd/")) {
+      handleCicdProxyUpgrade(db, workspacePath, req, socket, head);
+      return;
+    }
+    socket.destroy();
+  });
   wss.on("connection", async (ws, req) => {
+    attachHeartbeat(ws);
     const url = new URL(req.url ?? "", "http://localhost");
     const projectId = Number(url.searchParams.get("projectId"));
     const userId = Number(url.searchParams.get("userId"));
@@ -27263,7 +27598,7 @@ function workspaceRoutes(_db, config, port, host, workspacePath) {
 }
 
 // ../server/src/lib/config.ts
-import { existsSync as existsSync23, readFileSync as readFileSync18, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync18, writeFileSync as writeFileSync15 } from "fs";
 import { join as join25 } from "path";
 var configSchema = external_exports.object({
   port: external_exports.number().int().min(1).max(65535).optional(),
@@ -27281,7 +27616,7 @@ function loadConfig(dataDir) {
   }
 }
 function saveConfig(dataDir, config) {
-  writeFileSync14(join25(dataDir, "config.json"), JSON.stringify(config, null, 2));
+  writeFileSync15(join25(dataDir, "config.json"), JSON.stringify(config, null, 2));
 }
 
 // ../server/src/lib/logger.ts