@resolflow/cli 0.0.0-stage → 0.1.0-beta.0

package/dist/daemon.js

@@ -0,0 +1,317 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Daemon = exports.PROTOCOL_VERSION = void 0;
+exports.backoffDelay = backoffDelay;
+const socket_io_client_1 = require("socket.io-client");
+const protocol_1 = require("./protocol");
+Object.defineProperty(exports, "PROTOCOL_VERSION", { enumerable: true, get: function () { return protocol_1.PROTOCOL_VERSION; } });
+const types_1 = require("./adapters/types");
+const openai_compatible_1 = require("./adapters/openai-compatible");
+const auth_1 = require("./agents/auth");
+const MODELS_REFRESH_MS = 5 * 60_000;
+const KEEP_ALIVE_MS = 60_000;
+/** Exponential backoff with full jitter, capped. */
+function backoffDelay(attempt, minMs = 1_000, maxMs = 60_000, rand = Math.random) {
+    const cap = Math.min(maxMs, minMs * 2 ** Math.min(attempt, 16));
+    return Math.max(minMs, Math.floor(rand() * cap));
+}
+/**
+ * The `resolflow start` daemon (RF-141bbf2a, P3.1): one OUTBOUND socket.io connection (websocket transport only;
+ * wss:// for any non-loopback API) to the Resolflow API, namespace /cli, authenticated with the device token in
+ * the handshake auth (never in a URL). It forwards `llm_request`s to the local OpenAI-compatible server and
+ * streams the answer back. It listens on no port, runs no commands, and logs no prompt or answer.
+ */
+class Daemon {
+    opts;
+    socket = null;
+    active = new Map();
+    stopped = false;
+    reconnectTimer = null;
+    heartbeatTimer = null;
+    modelsTimer = null;
+    /** Ref'd on purpose: the one handle that keeps the process alive between connection attempts (RF-780ee2a4). */
+    keepAliveTimer = null;
+    wasConnected = false;
+    attempt = 0;
+    st;
+    adapters;
+    inputHandlers = new Map();
+    policy;
+    constructor(opts) {
+        this.opts = opts;
+        this.adapters = opts.adapters ?? [new openai_compatible_1.OpenAiCompatibleAdapter(opts.endpoint, { listModels: opts.listModels, streamChat: opts.streamChat })];
+        this.policy = opts.policy ?? { current: null };
+        this.st = {
+            connected: false,
+            deviceId: null,
+            workspaceId: null,
+            paused: opts.paused,
+            maxConcurrency: clamp(opts.maxConcurrency),
+            allowBackground: opts.allowBackground,
+            active: 0,
+            served: 0,
+            failed: 0,
+            models: [],
+            lastError: null,
+            reconnectAttempt: 0,
+        };
+    }
+    /** The CLI login policy last received from the server (null: none yet — login mode is off). */
+    cliLoginPolicy() {
+        return this.policy.current ? { ...this.policy.current } : null;
+    }
+    /**
+     * A policy from the server (auth_success, hello_ack, policy event). Only the two booleans are read; anything else in
+     * the message is ignored, so it can never change how this machine authenticates.
+     */
+    applyPolicy(raw) {
+        const next = (0, auth_1.readPolicy)(raw);
+        const prev = this.policy.current;
+        this.policy.current = next;
+        if (prev && prev['claude-code'] === next['claude-code'] && prev.codex === next.codex)
+            return;
+        this.opts.onPolicy?.({ ...next });
+    }
+    /** Ids of the adapters this daemon offers (hello.capabilities.adapters). */
+    adapterIds() {
+        return this.adapters.map((a) => a.id);
+    }
+    status() {
+        return { ...this.st, active: this.active.size, models: [...this.st.models] };
+    }
+    /** Connect (and keep reconnecting with backoff until stop() or a fatal auth error). */
+    start() {
+        this.stopped = false;
+        if (this.keepAliveTimer)
+            clearInterval(this.keepAliveTimer);
+        this.keepAliveTimer = setInterval(() => undefined, KEEP_ALIVE_MS); // NOT unref'd: reconnecting forever must not let the process exit
+        this.connect();
+        this.modelsTimer = setInterval(() => void this.refreshModels(), MODELS_REFRESH_MS);
+        this.modelsTimer.unref?.();
+    }
+    stop() {
+        this.stopped = true;
+        if (this.reconnectTimer)
+            clearTimeout(this.reconnectTimer);
+        if (this.heartbeatTimer)
+            clearInterval(this.heartbeatTimer);
+        if (this.modelsTimer)
+            clearInterval(this.modelsTimer);
+        if (this.keepAliveTimer)
+            clearInterval(this.keepAliveTimer);
+        this.reconnectTimer = this.heartbeatTimer = this.modelsTimer = this.keepAliveTimer = null;
+        for (const ctrl of this.active.values())
+            ctrl.abort();
+        this.active.clear();
+        this.socket?.removeAllListeners();
+        this.socket?.disconnect();
+        this.socket = null;
+        this.st.connected = false;
+    }
+    /** Apply local settings (pause switch, concurrency, background consent) and tell the server. */
+    applySettings(s) {
+        if (s.paused !== undefined)
+            this.st.paused = s.paused;
+        if (s.maxConcurrency !== undefined)
+            this.st.maxConcurrency = clamp(s.maxConcurrency);
+        if (s.allowBackground !== undefined)
+            this.st.allowBackground = s.allowBackground;
+        if (this.st.paused)
+            for (const ctrl of this.active.values())
+                ctrl.abort(); // pause = stop serving now
+        this.sendHello();
+    }
+    async refreshModels() {
+        const all = [];
+        for (const a of this.adapters) {
+            try {
+                all.push(...(await a.listModels()));
+            }
+            catch (err) {
+                this.opts.logger.warn(`${a.id}: ${err.message}`);
+            }
+        }
+        this.st.models = [...new Set(all)];
+        this.sendHello();
+    }
+    connect() {
+        if (this.stopped)
+            return;
+        const io = this.opts.io ?? socket_io_client_1.io;
+        const socket = io(`${this.opts.apiUrl}/cli`, {
+            transports: ['websocket'],
+            auth: { token: this.opts.token },
+            reconnection: false, // our own backoff (below), so a revoked device does not hammer the server
+            timeout: 20_000,
+            forceNew: true,
+        });
+        this.socket = socket;
+        socket.on('auth_success', (info) => {
+            if (info?.protocol !== protocol_1.PROTOCOL_VERSION) {
+                this.fatal(`This Resolflow server speaks protocol ${info?.protocol ?? 1}; this CLI speaks ${protocol_1.PROTOCOL_VERSION}. Update the CLI or the server.`);
+                return;
+            }
+            const reconnected = this.wasConnected || this.attempt > 0;
+            this.wasConnected = true;
+            this.attempt = 0;
+            this.st.reconnectAttempt = 0;
+            this.st.connected = true;
+            this.st.deviceId = info.deviceId ?? null;
+            this.st.workspaceId = info.workspaceId ?? null;
+            this.st.lastError = null;
+            this.opts.logger.info(`${reconnected ? 'Reconnected' : 'Connected'} to Resolflow as device ${info.deviceId}${this.st.paused ? ' (paused)' : ''}`);
+            this.applyPolicy(info.policy);
+            if (this.heartbeatTimer)
+                clearInterval(this.heartbeatTimer);
+            this.heartbeatTimer = setInterval(() => socket.connected && socket.emit('heartbeat'), Math.max(5_000, info.heartbeatMs ?? 20_000));
+            this.heartbeatTimer.unref?.();
+            void this.refreshModels();
+        });
+        socket.on('auth_error', (e) => {
+            this.fatal(e?.message || 'Authentication refused');
+        });
+        socket.on('job', (job) => void this.serve(job));
+        // RF-90e75d6d: the administrator changed the CLI login switch (or this hello was answered)
+        socket.on('policy', (m) => this.applyPolicy(m));
+        socket.on('hello_ack', (m) => {
+            if (m && typeof m === 'object' && 'policy' in m)
+                this.applyPolicy(m.policy);
+        });
+        socket.on('job_cancel', (m) => {
+            const ctrl = typeof m?.jobId === 'string' ? this.active.get(m.jobId) : undefined;
+            if (ctrl) {
+                ctrl.abort();
+                this.opts.logger.info(`Job ${short(m.jobId)} cancelled by Resolflow`);
+            }
+        });
+        socket.on('job_input', (m) => {
+            const h = typeof m?.jobId === 'string' ? this.inputHandlers.get(m.jobId) : undefined;
+            if (h && typeof m.questionId === 'string' && typeof m.answer === 'string')
+                h(m.questionId, m.answer);
+        });
+        socket.on('connect_error', (err) => {
+            this.st.lastError = err.message;
+            this.opts.logger.warn(`Cannot reach Resolflow (${err.message})`);
+            this.scheduleReconnect();
+        });
+        socket.on('disconnect', (reason) => {
+            this.st.connected = false;
+            if (this.heartbeatTimer)
+                clearInterval(this.heartbeatTimer);
+            // Requests in flight are failed by the server (this device went offline); stop the local work too
+            for (const ctrl of this.active.values())
+                ctrl.abort();
+            if (this.stopped)
+                return;
+            this.opts.logger.warn(`Disconnected (${reason})`);
+            this.scheduleReconnect();
+        });
+    }
+    scheduleReconnect() {
+        if (this.stopped || this.reconnectTimer)
+            return;
+        this.socket?.removeAllListeners();
+        this.socket?.disconnect();
+        this.socket = null;
+        const b = this.opts.backoff ?? { minMs: 1_000, maxMs: 60_000 };
+        const delay = backoffDelay(this.attempt++, b.minMs, b.maxMs);
+        this.st.reconnectAttempt = this.attempt;
+        this.opts.logger.info(`Reconnecting in ${Math.round(delay / 1000)}s (attempt ${this.attempt})`);
+        this.reconnectTimer = setTimeout(() => {
+            this.reconnectTimer = null;
+            this.connect();
+        }, delay); // ref'd: a pending reconnect keeps the process alive
+    }
+    fatal(message) {
+        this.st.lastError = message;
+        this.opts.logger.error(`Resolflow refused this device: ${message}`);
+        this.stop();
+        this.opts.onFatal?.(message);
+    }
+    sendHello() {
+        if (!this.socket?.connected)
+            return;
+        this.socket.emit('hello', {
+            models: this.st.models,
+            maxConcurrency: this.st.maxConcurrency,
+            paused: this.st.paused,
+            allowBackground: this.st.allowBackground,
+            capabilities: {
+                kinds: [...new Set(this.adapters.flatMap((a) => [...a.kinds]))],
+                adapters: this.adapters.map((a) => a.id),
+                // RF-90e75d6d: per coding agent, the mode NAME only (api_key | login) — never a path, a token or an env value
+                auth: Object.fromEntries(this.adapters.filter((a) => a.authMode).map((a) => [a.id, a.authMode])),
+            },
+            cliVersion: this.opts.cliVersion,
+            platform: this.opts.platform,
+        });
+    }
+    /** One job → its adapter → normalised job_event stream (exactly one terminal result | error). */
+    async serve(raw) {
+        const socket = this.socket;
+        if (!socket || !(0, protocol_1.isJob)(raw))
+            return;
+        const job = raw;
+        const jobId = job.jobId;
+        let seq = 0;
+        let terminal = null;
+        let errorKind;
+        let usage;
+        const send = (event) => {
+            if (terminal || !this.socket?.connected)
+                return;
+            if (event.type === 'result')
+                terminal = 'ok';
+            if (event.type === 'error') {
+                terminal = 'error';
+                errorKind = event.kind;
+            }
+            if (event.type === 'usage')
+                usage = event.usage;
+            socket.emit('job_event', { jobId, seq: seq++, event });
+        };
+        const model = job.kind === 'llm_request' ? String(job.payload.model ?? '') : job.adapter ?? job.kind;
+        if (this.st.paused)
+            return send({ type: 'error', kind: 'device_error', message: 'Device paused' });
+        if (this.active.size >= this.st.maxConcurrency)
+            return send({ type: 'error', kind: 'device_error', message: 'Device busy' });
+        const adapter = (0, types_1.pickAdapter)(this.adapters, job);
+        if (!adapter)
+            return send({ type: 'error', kind: 'unsupported', message: `This device cannot run ${job.kind}${job.adapter ? ` with ${job.adapter}` : ''}` });
+        const ctrl = new AbortController();
+        this.active.set(jobId, ctrl);
+        const t0 = Date.now();
+        this.opts.logger.info(`Job ${short(jobId)}: ${job.kind} via ${adapter.id}${model ? ` (${model})` : ''}`);
+        try {
+            await adapter.run(job, {
+                signal: ctrl.signal,
+                emit: (e) => {
+                    if (!ctrl.signal.aborted)
+                        send(e);
+                },
+                onInput: (h) => this.inputHandlers.set(jobId, h),
+            });
+            if (!ctrl.signal.aborted && !terminal)
+                send({ type: 'result' });
+        }
+        catch {
+            if (!ctrl.signal.aborted && !terminal)
+                send({ type: 'error', kind: 'device_error', message: 'Job failed on the device' });
+        }
+        finally {
+            this.active.delete(jobId);
+            this.inputHandlers.delete(jobId);
+            const status = ctrl.signal.aborted ? 'aborted' : terminal === 'ok' ? 'ok' : 'error';
+            if (status === 'ok')
+                this.st.served++;
+            else if (status === 'error')
+                this.st.failed++;
+            const ms = Date.now() - t0;
+            this.opts.logger.info(`Job ${short(jobId)}: ${status}${errorKind && status === 'error' ? ` (${errorKind})` : ''} in ${(ms / 1000).toFixed(1)}s`);
+            this.opts.runLog?.append({ at: new Date(t0).toISOString(), requestId: jobId, model, status, errorKind: status === 'error' ? errorKind : undefined, ms, ...(usage ?? {}) });
+        }
+    }
+}
+exports.Daemon = Daemon;
+const clamp = (n) => Math.min(4, Math.max(1, Math.floor(Number(n)) || 1));
+const short = (id) => id.slice(0, 8);

package/dist/index.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const commands_1 = require("./commands");
+const config_1 = require("./config");
+const log_1 = require("./log");
+const runtime_1 = require("./runtime");
+const update_check_1 = require("./update-check");
+(0, runtime_1.guardPipes)();
+const program = new commander_1.Command();
+program
+    .name('resolflow')
+    .description('Resolflow CLI (Beta): run your Resolflow agent profiles on local models (Ollama, LM Studio, vLLM) or local coding agents (Claude Code, Codex)')
+    .version(commands_1.CLI_VERSION)
+    .option('-v, --verbose', 'more logging (never prompts, answers or secrets)');
+const ctx = () => (0, commands_1.makeCtx)({ verbose: program.opts().verbose });
+const run = (fn) => async () => {
+    try {
+        await fn();
+    }
+    catch (err) {
+        process.stderr.write(`resolflow: ${(0, log_1.redact)(err.message)}\n`);
+        process.exitCode = err instanceof commands_1.RefusedError ? err.exitCode : 1;
+    }
+};
+program
+    .command('pair [code]')
+    .description('pair this machine with Resolflow using the code from Agents › Devices')
+    .option('--api <url>', 'Resolflow API URL (default https://api.resolflow.ai)')
+    .option('--name <name>', 'device name shown in Resolflow (default: hostname)')
+    .action((code, opts) => run(() => (0, commands_1.cmdPair)(ctx(), code, opts))());
+program
+    .command('login')
+    .description('same as pair')
+    .option('--pair <code>', 'pairing code')
+    .option('--api <url>', 'Resolflow API URL')
+    .option('--name <name>', 'device name')
+    .action((opts) => run(() => (0, commands_1.cmdPair)(ctx(), opts.pair, opts))());
+program
+    .command('start')
+    .description('connect to Resolflow and serve requests with your local models (Ctrl+C to stop)')
+    .option('--endpoint <url>', 'local OpenAI-compatible server (default http://127.0.0.1:11434/v1)')
+    .option('--concurrency <n>', 'requests at the same time, 1-4')
+    .option('--allow-background', 'this machine may serve background runs (also needs the per-profile opt-in)')
+    .option('--ui', 'local status page on 127.0.0.1 (random token, this session only)')
+    .option('--ui-port <port>', 'port for --ui (default random)')
+    .action((opts) => run(async () => {
+    const stop = await (0, commands_1.cmdStart)(ctx(), opts);
+    const shutdown = () => void stop().then(() => process.exit(process.exitCode ?? 0));
+    process.once('SIGINT', shutdown);
+    process.once('SIGTERM', shutdown);
+})());
+program.command('status').description('pairing, connection and local models').action(() => run(() => (0, commands_1.cmdStatus)(ctx()))());
+program
+    .command('models')
+    .description('list the models of the local server')
+    .option('--endpoint <url>', 'local OpenAI-compatible server')
+    .action((opts) => run(() => (0, commands_1.cmdModels)(ctx(), opts))());
+program.command('unpair').description('revoke this device and remove its token').action(() => run(() => (0, commands_1.cmdUnpair)(ctx()))());
+program.command('pause').description('stop serving requests (kill switch)').action(() => run(() => (0, commands_1.cmdPause)(ctx(), true))());
+program.command('resume').description('serve requests again').action(() => run(() => (0, commands_1.cmdPause)(ctx(), false))());
+program
+    .command('agents')
+    .description('local coding agents (Claude Code, Codex, Antigravity): installed, version, auth (API key or CLI login), offered')
+    .action(() => run(() => (0, commands_1.cmdAgents)(ctx()))());
+program
+    .command('config [key] [value]')
+    .description('show settings, or set endpoint | concurrency (1-4) | background (on|off) | api | agent-turns (1-20) | agent-budget (USD) | agent-timeout (min) | agent-daily-budget (USD per day, 0 = no limit); ' +
+    'agent-key <claude|codex> stores a coding agent API key in the keychain (prompted, never printed); ' +
+    'agent-auth <claude|codex> <api_key|login> chooses an API key or your existing CLI login for that tool on this machine')
+    .argument('[mode]', 'with agent-auth: api_key | login')
+    .option('--delete', 'with agent-key: remove the stored key')
+    .action((key, value, mode, opts) => run(() => key === 'agent-key'
+    ? (0, commands_1.cmdAgentKey)(ctx(), value, opts)
+    : key === 'agent-auth'
+        ? (0, commands_1.cmdAgentAuth)(ctx(), value, mode)
+        : key === 'set' // `resolflow config set <key> <value>` = `resolflow config <key> <value>`
+            ? (0, commands_1.cmdConfig)(ctx(), value, mode)
+            : (0, commands_1.cmdConfig)(ctx(), key, value))());
+// Non-blocking update hint (at most one registry request a day, cached; RESOLFLOW_NO_UPDATE_CHECK=1 turns it off)
+// (not for --version / --help: commander exits right away, the check could neither finish nor be cached)
+const updateCheck = (0, runtime_1.skipUpdateCheck)() ? null : (0, update_check_1.startUpdateCheck)({ current: commands_1.CLI_VERSION, dir: (0, config_1.configDir)() });
+void program.parseAsync(process.argv).then(async () => {
+    const hint = await updateCheck?.finish();
+    if (hint)
+        process.stderr.write(`\n${hint}\n`);
+});

package/dist/local-model.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalModelError = void 0;
+exports.buildChatBody = buildChatBody;
+exports.listModels = listModels;
+exports.parseChatSse = parseChatSse;
+exports.streamChat = streamChat;
+const urls_1 = require("./urls");
+class LocalModelError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.kind = kind;
+    }
+}
+exports.LocalModelError = LocalModelError;
+const ROLES = new Set(['system', 'user', 'assistant']);
+function buildChatBody(req) {
+    const messages = [];
+    if (req.systemPrompt)
+        messages.push({ role: 'system', content: req.systemPrompt });
+    for (const m of req.messages ?? []) {
+        messages.push({ role: ROLES.has(m.role) ? m.role : 'user', content: String(m.content ?? '') });
+    }
+    return {
+        model: req.model,
+        messages,
+        stream: true,
+        stream_options: { include_usage: true },
+        ...(typeof req.temperature === 'number' ? { temperature: req.temperature } : {}),
+        ...(typeof req.maxTokens === 'number' && req.maxTokens > 0 ? { max_tokens: Math.floor(req.maxTokens) } : {}),
+        ...(req.responseFormat === 'json' ? { response_format: { type: 'json_object' } } : {}),
+    };
+}
+function connectionError(err) {
+    const e = err;
+    if (e?.name === 'AbortError')
+        return new LocalModelError('aborted', 'Cancelled');
+    const code = e?.cause?.code;
+    return new LocalModelError('endpoint_unreachable', `Local model server not reachable${code ? ` (${code})` : ''}`);
+}
+async function errorFromResponse(res) {
+    let detail = '';
+    try {
+        const text = (await res.text()).slice(0, 2000);
+        const j = JSON.parse(text);
+        detail = String(j?.error?.message ?? j?.error ?? j?.message ?? '').slice(0, 200);
+    }
+    catch {
+        /* not JSON */
+    }
+    if (res.status === 404 || /model .*not found|not found.*model|no such model/i.test(detail)) {
+        return new LocalModelError('model_not_found', detail || 'Model not found on the local server');
+    }
+    return new LocalModelError('device_error', `Local model server answered ${res.status}${detail ? `: ${detail}` : ''}`);
+}
+async function listModels(endpoint, timeoutMs = 5000) {
+    const base = (0, urls_1.normaliseLocalEndpoint)(endpoint);
+    let res;
+    try {
+        res = await fetch(`${base}/models`, { redirect: 'error', signal: AbortSignal.timeout(timeoutMs) });
+    }
+    catch (err) {
+        throw connectionError(err);
+    }
+    if (!res.ok)
+        throw await errorFromResponse(res);
+    const body = (await res.json());
+    return (body.data ?? [])
+        .map((m) => m.id)
+        .filter((id) => typeof id === 'string' && id.length > 0 && id.length <= 200)
+        .slice(0, 200);
+}
+/** Parse an SSE stream of Chat Completions chunks into deltas. */
+async function* parseChatSse(body) {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let buf = '';
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            buf += decoder.decode(value, { stream: true });
+            let nl;
+            while ((nl = buf.indexOf('\n')) >= 0) {
+                const line = buf.slice(0, nl).replace(/\r$/, '');
+                buf = buf.slice(nl + 1);
+                if (!line.startsWith('data:'))
+                    continue;
+                const data = line.slice(5).trim();
+                if (!data || data === '[DONE]')
+                    continue;
+                let j;
+                try {
+                    j = JSON.parse(data);
+                }
+                catch {
+                    continue;
+                }
+                if (j?.error)
+                    throw new LocalModelError('device_error', String(j.error?.message ?? j.error).slice(0, 200));
+                const delta = j?.choices?.[0]?.delta ?? {};
+                const out = {};
+                if (typeof delta.content === 'string' && delta.content)
+                    out.content = delta.content;
+                if ((typeof delta.reasoning === 'string' && delta.reasoning) || (typeof delta.reasoning_content === 'string' && delta.reasoning_content))
+                    out.reasoning = true;
+                if (j?.usage && (j.usage.prompt_tokens != null || j.usage.completion_tokens != null)) {
+                    out.usage = { promptTokens: Number(j.usage.prompt_tokens) || 0, completionTokens: Number(j.usage.completion_tokens) || 0 };
+                }
+                if (out.content || out.reasoning || out.usage)
+                    yield out;
+            }
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+/** Stream one chat request from the local server. The signal cancels the HTTP request (the model stops). */
+async function* streamChat(endpoint, req, signal) {
+    const base = (0, urls_1.normaliseLocalEndpoint)(endpoint);
+    let res;
+    try {
+        res = await fetch(`${base}/chat/completions`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(buildChatBody(req)),
+            redirect: 'error',
+            signal,
+        });
+    }
+    catch (err) {
+        throw connectionError(err);
+    }
+    if (!res.ok || !res.body)
+        throw await errorFromResponse(res);
+    try {
+        yield* parseChatSse(res.body);
+    }
+    catch (err) {
+        if (err instanceof LocalModelError)
+            throw err;
+        throw signal.aborted ? new LocalModelError('aborted', 'Cancelled') : connectionError(err);
+    }
+}

package/dist/local-ui.js

@@ -0,0 +1,120 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startLocalUi = startLocalUi;
+const crypto = __importStar(require("crypto"));
+const http = __importStar(require("http"));
+const SECURITY_HEADERS = {
+    'cache-control': 'no-store',
+    'x-content-type-options': 'nosniff',
+    'x-frame-options': 'DENY',
+    'referrer-policy': 'no-referrer',
+    'content-security-policy': "default-src 'none'; script-src 'self'; connect-src 'self'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+};
+const PAGE = `<!doctype html><html><head><meta charset="utf-8"><title>Resolflow CLI</title>
+<style>body{font:14px system-ui,sans-serif;margin:2rem;max-width:44rem;color:#222}pre{background:#f4f4f5;padding:1rem;border-radius:6px;overflow:auto}
+button{padding:.4rem .9rem;margin-right:.5rem}</style></head><body>
+<h1>Resolflow CLI</h1><p id="msg">Loading…</p>
+<p><button id="pause">Pause serving</button><button id="resume">Resume</button></p>
+<pre id="out"></pre><script src="/app.js"></script></body></html>`;
+const APP_JS = `(function(){
+var m=location.hash.match(/token=([0-9a-f]+)/);var t=m?m[1]:'';history.replaceState(null,'',location.pathname);
+function call(method,path){return fetch(path,{method:method,headers:{'X-Resolflow-Token':t,'Content-Type':'application/json'},body:method==='POST'?'{}':undefined}).then(function(r){if(!r.ok)throw new Error('HTTP '+r.status);return r.json();});}
+function load(){call('GET','/api/status').then(function(s){document.getElementById('msg').textContent=s.connected?(s.paused?'Connected, paused':'Connected, serving'):'Not connected';document.getElementById('out').textContent=JSON.stringify(s,null,2);}).catch(function(e){document.getElementById('msg').textContent='Not authorised ('+e.message+'). Open the URL printed by resolflow start.';});}
+document.getElementById('pause').onclick=function(){call('POST','/api/pause').then(load);};
+document.getElementById('resume').onclick=function(){call('POST','/api/resume').then(load);};
+load();setInterval(load,3000);})();`;
+function safeEqual(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && crypto.timingSafeEqual(x, y);
+}
+function startLocalUi(state, opts = {}) {
+    const token = opts.token ?? crypto.randomBytes(32).toString('hex');
+    let port = 0;
+    const allowedHosts = () => new Set([`127.0.0.1:${port}`, `localhost:${port}`]);
+    const allowedOrigins = () => new Set([`http://127.0.0.1:${port}`, `http://localhost:${port}`]);
+    const send = (res, status, body, type = 'application/json') => {
+        res.writeHead(status, { ...SECURITY_HEADERS, 'content-type': `${type}; charset=utf-8` });
+        res.end(body);
+    };
+    const server = http.createServer((req, res) => {
+        const host = String(req.headers.host ?? '').toLowerCase();
+        if (!allowedHosts().has(host))
+            return send(res, 421, '{"error":"wrong host"}');
+        const origin = req.headers.origin;
+        if (origin !== undefined && !allowedOrigins().has(String(origin)))
+            return send(res, 403, '{"error":"origin not allowed"}');
+        if (req.method === 'OPTIONS')
+            return send(res, 405, '{"error":"no CORS"}');
+        const url = (req.url ?? '/').split('?')[0];
+        if (req.method === 'GET' && url === '/')
+            return send(res, 200, PAGE, 'text/html');
+        if (req.method === 'GET' && url === '/app.js')
+            return send(res, 200, APP_JS, 'text/javascript');
+        if (!url.startsWith('/api/'))
+            return send(res, 404, '{"error":"not found"}');
+        const given = String(req.headers['x-resolflow-token'] ?? '');
+        if (!given || !safeEqual(given, token))
+            return send(res, 401, '{"error":"token required"}');
+        if (req.method === 'GET' && url === '/api/status')
+            return send(res, 200, JSON.stringify(state.status()));
+        if (req.method === 'POST' && (url === '/api/pause' || url === '/api/resume')) {
+            // State changes: same-origin page only (browsers always send Origin on POST) and a JSON body type
+            if (origin === undefined)
+                return send(res, 403, '{"error":"origin required"}');
+            if (!String(req.headers['content-type'] ?? '').startsWith('application/json'))
+                return send(res, 415, '{"error":"json only"}');
+            req.resume();
+            state.setPaused(url === '/api/pause');
+            return send(res, 200, JSON.stringify({ paused: url === '/api/pause' }));
+        }
+        return send(res, 405, '{"error":"method not allowed"}');
+    });
+    server.headersTimeout = 10_000;
+    server.requestTimeout = 10_000;
+    return new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(opts.port ?? 0, '127.0.0.1', () => {
+            port = server.address().port;
+            resolve({
+                url: `http://127.0.0.1:${port}/#token=${token}`,
+                port,
+                token,
+                close: () => new Promise((r) => server.close(() => r())),
+            });
+        });
+    });
+}