@roj-ai/standalone-server 0.1.11 → 0.1.13

package/dist/server.js

@@ -18,9 +18,14 @@ import { createBunPlatform } from '@roj-ai/sdk/bun-platform';
 import { createBunWebSocketHandlers } from '@roj-ai/transport/bun';
 import { Hono } from 'hono';
 import { cors } from 'hono/cors';
+import { createFilesUploadRoute } from './files-upload-route.js';
+import { GitInstanceFs } from './git-instance-fs.js';
 import { createInstance } from './instance.js';
+import { LocalRegistry } from './local-registry.js';
 import { createPlatformApi } from './platform-api.js';
 import { proxyPreview } from './preview-proxy.js';
+import { createSessionFileRoute } from './session-file-route.js';
+import { generateTokenSecret } from './signed-token.js';
 export async function startStandaloneServer(options) {
     const envConfig = loadConfig();
     const config = options.config ? { ...envConfig, ...options.config } : envConfig;
@@ -54,13 +59,35 @@ export async function startStandaloneServer(options) {
         ...services,
         sessionRuntime: sessionManager,
     });
-    const platformApp = createPlatformApi({ instance, sessionManager, logger });
+    const tokenSecret = generateTokenSecret();
+    const publicHost = config.host === '0.0.0.0' ? 'localhost' : config.host;
+    const publicBaseUrl = `http://${publicHost}:${config.port}`;
+    const registry = new LocalRegistry(config.dataPath, logger);
+    await registry.init();
+    if (options.localResources?.length) {
+        await registry.bootstrapLocalResources(options.localResources);
+    }
+    const gitFs = new GitInstanceFs(config.dataPath, logger);
+    await gitFs.initInstance(instance.id);
+    const platformApp = createPlatformApi({
+        instance,
+        sessionManager,
+        logger,
+        presets,
+        registry,
+        gitFs,
+        tokenSecret,
+        publicBaseUrl,
+    });
     const outerApp = new Hono();
     // Reflect the request origin and allow credentials — the SPA uses
     // `credentials: 'include'` on its RPC fetches, which requires a specific
     // origin header (not `*`) plus `Access-Control-Allow-Credentials: true`.
     outerApp.use('*', cors({ origin: (origin) => origin ?? '*', credentials: true }));
     outerApp.get('/health', (c) => c.json({ status: 'ok', timestamp: Date.now() }));
+    // Multipart file upload — must be registered BEFORE the /api/v1 RPC mount
+    // so it isn't treated as JSON RPC.
+    outerApp.post('/api/v1/files/upload', createFilesUploadRoute({ registry }));
     outerApp.route('/api/v1', platformApp);
     // Path-based preview proxy (must come BEFORE the catch-all instance route)
     outerApp.all('/api/v1/instances/:id/preview/*', (c) => {
@@ -68,6 +95,9 @@ export async function startStandaloneServer(options) {
         const prefix = `/api/v1/instances/${id}/preview/`;
         return proxyPreview(c.req.raw, prefix, sessionManager, logger);
     });
+    // Token-authenticated download URL minted by `sessionFiles.createDownloadUrl`.
+    // Must come BEFORE the agent catch-all so the token gate runs.
+    outerApp.get('/api/v1/instances/:id/sessions/:sid/files/:scope{workspace|session}/*', createSessionFileRoute({ tokenSecret, agentApp, logger }));
     // Noop auth-exchange (platform has real cookies; standalone is open)
     outerApp.post('/api/v1/instances/:id/exchange', (c) => c.json({ ok: true }));
     // Instance-scoped agent routes — strip the instance prefix and delegate to createApp

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AAC1D,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,cAAc,EAAsB,MAAM,eAAe,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAuBjD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAA+B;IAC1E,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAW,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAEvF,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,MAAM;QAC5C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3B,GAAG,CAAC;YACJ,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,aAAc,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;SACtE,CAAC,CAAC;QACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAA;IAElB,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACpE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;IAE3B,MAAM,QAAQ,GAAG,cAAc,CAAC;QAC/B,EAAE,EAAE,OAAO,CAAC,UAAU;QACtB,IAAI,EAAE,OAAO,CAAC,YAAY;QAC1B,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjC,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAA;IACtE,MAAM,aAAa,GAAG,SAAS,YAAY,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IAE3E,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE;QACjD,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC;KACvD,CAAC,CAAA;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAA;IAE5C,MAAM,QAAQ,GAAG,SAAS,CAAC;QAC1B,GAAG,QAAQ;QACX,cAAc,EAAE,cAAc;KAC9B,CAAC,CAAA;IAEF,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAA;IAE3E,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAA;IAC3B,kEAAkE;IAClE,yEAAyE;IACzE,yEAAyE;IACzE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAEjF,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;IAC/E,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAEtC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,CAAC,iCAAiC,EAAE,CAAC,CAAC,EAAE,EAAE;QACrD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,qBAAqB,EAAE,WAAW,CAAA;QACjD,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,qEAAqE;IACrE,QAAQ,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE5E,qFAAqF;IACrF,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,qBAAqB,EAAE,EAAE,CAAA;QACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;QAC1D,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,CAAA;QACzD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;IAE9D,IAAI,CAAC;QACJ,MAAM,cAAc,CAAC,eAAe,EAAE,CAAA;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACvG,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,SAAS,CAAC,KAAK,EAAE,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC5F,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;QACxC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,GAAG,EAAE,UAAU,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;KACrF,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC3B,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;QACjD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAA;QAC3B,CAAC;QACD,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAA;QAC/B,MAAM,SAAS,CAAC,IAAI,EAAE,CAAA;QACtB,MAAM,CAAC,IAAI,EAAE,CAAA;IACd,CAAC,CAAA;IAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACzB,KAAK,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QAC1B,KAAK,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAA;AAChG,CAAC;AAQD,SAAS,cAAc,CACtB,MAAc,EACd,GAAS,EACT,aAAmC;IAEnC,MAAM,UAAU,GAAG,aAAa;QAC/B,CAAC,CAAC,0BAA0B,CAAS;YACpC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;YAC5E,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC;YAC1E,SAAS,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC;YACpE,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;YAC5D,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI;SACxB,CAAC;QACF,CAAC,CAAC,IAAI,CAAA;IAEP,OAAO,GAAG,CAAC,KAAK,CAAS;QACxB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,IAAI;QACrB,KAAK,CAAC,GAAG,EAAE,MAAM;YAChB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACvE,IAAI,OAAO,IAAI,aAAa,EAAE,CAAC;gBAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;oBACpC,IAAI,EAAE;wBACL,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;wBAC7B,SAAS;wBACT,kBAAkB,EAAE,IAAI,GAAG,EAAa;qBACvB;iBAClB,CAAC,CAAA;gBACF,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACxF,CAAC;YACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;QACD,SAAS,EAAE,UAAU,IAAI,EAAE,IAAI,KAAI,CAAC,EAAE,KAAK,KAAI,CAAC,EAAE,OAAO,KAAI,CAAC,EAAE;KAChE,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,SAAS,EAAE,wBAAwB,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AAC1D,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAsB,MAAM,eAAe,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AA6BvD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAA+B;IAC1E,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAW,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IAEvF,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,MAAM;QAC5C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3B,GAAG,CAAC;YACJ,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,aAAc,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;SACtE,CAAC,CAAC;QACH,CAAC,CAAC,OAAO,CAAC,OAAO,CAAA;IAElB,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACpE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAA;IAE3B,MAAM,QAAQ,GAAG,cAAc,CAAC;QAC/B,EAAE,EAAE,OAAO,CAAC,UAAU;QACtB,IAAI,EAAE,OAAO,CAAC,YAAY;QAC1B,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjC,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAA;IACtE,MAAM,aAAa,GAAG,SAAS,YAAY,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IAE3E,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE;QACjD,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC;KACvD,CAAC,CAAA;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAA;IAE5C,MAAM,QAAQ,GAAG,SAAS,CAAC;QAC1B,GAAG,QAAQ;QACX,cAAc,EAAE,cAAc;KAC9B,CAAC,CAAA;IAEF,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAA;IACzC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;IACxE,MAAM,aAAa,GAAG,UAAU,UAAU,IAAI,MAAM,CAAC,IAAI,EAAE,CAAA;IAE3D,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC3D,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IACrB,IAAI,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QACpC,MAAM,QAAQ,CAAC,uBAAuB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;IAC/D,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACxD,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAErC,MAAM,WAAW,GAAG,iBAAiB,CAAC;QACrC,QAAQ;QACR,cAAc;QACd,MAAM;QACN,OAAO;QACP,QAAQ;QACR,KAAK;QACL,WAAW;QACX,aAAa;KACb,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAA;IAC3B,kEAAkE;IAClE,yEAAyE;IACzE,yEAAyE;IACzE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAEjF,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;IAE/E,0EAA0E;IAC1E,mCAAmC;IACnC,QAAQ,CAAC,IAAI,CAAC,sBAAsB,EAAE,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;IAE3E,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAEtC,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,CAAC,iCAAiC,EAAE,CAAC,CAAC,EAAE,EAAE;QACrD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,qBAAqB,EAAE,WAAW,CAAA;QACjD,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,+EAA+E;IAC/E,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,CACX,uEAAuE,EACvE,sBAAsB,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CACzD,CAAA;IAED,qEAAqE;IACrE,QAAQ,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE5E,qFAAqF;IACrF,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,qBAAqB,EAAE,EAAE,CAAA;QACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAA;QAC1D,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,CAAA;QACzD,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;IAE9D,IAAI,CAAC;QACJ,MAAM,cAAc,CAAC,eAAe,EAAE,CAAA;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACvG,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,SAAS,CAAC,KAAK,EAAE,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC5F,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;QACxC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,GAAG,EAAE,UAAU,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;KACrF,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC3B,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;QACjD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,OAAO,CAAC,UAAU,EAAE,CAAA;QAC3B,CAAC;QACD,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAA;QAC/B,MAAM,SAAS,CAAC,IAAI,EAAE,CAAA;QACtB,MAAM,CAAC,IAAI,EAAE,CAAA;IACd,CAAC,CAAA;IAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACzB,KAAK,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QAC1B,KAAK,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAA;AAChG,CAAC;AAQD,SAAS,cAAc,CACtB,MAAc,EACd,GAAS,EACT,aAAmC;IAEnC,MAAM,UAAU,GAAG,aAAa;QAC/B,CAAC,CAAC,0BAA0B,CAAS;YACpC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;YAC5E,OAAO,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC;YAC1E,SAAS,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC;YACpE,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;YAC5D,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI;SACxB,CAAC;QACF,CAAC,CAAC,IAAI,CAAA;IAEP,OAAO,GAAG,CAAC,KAAK,CAAS;QACxB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,IAAI;QACrB,KAAK,CAAC,GAAG,EAAE,MAAM;YAChB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACvE,IAAI,OAAO,IAAI,aAAa,EAAE,CAAC;gBAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;gBACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;oBACpC,IAAI,EAAE;wBACL,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;wBAC7B,SAAS;wBACT,kBAAkB,EAAE,IAAI,GAAG,EAAa;qBACvB;iBAClB,CAAC,CAAA;gBACF,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACxF,CAAC;YACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACtB,CAAC;QACD,SAAS,EAAE,UAAU,IAAI,EAAE,IAAI,KAAI,CAAC,EAAE,KAAK,KAAI,CAAC,EAAE,OAAO,KAAI,CAAC,EAAE;KAChE,CAAC,CAAA;AACH,CAAC"}

package/dist/session-file-route.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Token-authenticated session file download route.
+ *
+ * GET /api/v1/instances/:id/sessions/:sid/files/:scope/{path}?token=...
+ *
+ * Validates the HMAC token minted by `sessionFiles.createDownloadUrl` against
+ * the URL's (instanceId, sessionId, scope, path), then proxies to the SDK's
+ * existing `/sessions/:sid/workspace/*` or `/sessions/:sid/files/*` route on
+ * the agent app — same shape as roj-platform's `session-file-route.ts`, just
+ * served in-process.
+ */
+import type { Logger } from '@roj-ai/sdk';
+import type { Context } from 'hono';
+interface AgentAppLike {
+    fetch: (req: Request) => Response | Promise<Response>;
+}
+interface Deps {
+    tokenSecret: string;
+    agentApp: AgentAppLike;
+    logger: Logger;
+}
+export declare function createSessionFileRoute(deps: Deps): (c: Context) => Promise<Response>;
+export {};
+//# sourceMappingURL=session-file-route.d.ts.map

package/dist/session-file-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-file-route.d.ts","sourceRoot":"","sources":["../src/session-file-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAMnC,UAAU,YAAY;IACrB,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACrD;AAED,UAAU,IAAI;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,YAAY,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;CACd;AAOD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,IAAI,IAClC,GAAG,OAAO,uBA2DxB"}

package/dist/session-file-route.js

@@ -0,0 +1,72 @@
+/**
+ * Token-authenticated session file download route.
+ *
+ * GET /api/v1/instances/:id/sessions/:sid/files/:scope/{path}?token=...
+ *
+ * Validates the HMAC token minted by `sessionFiles.createDownloadUrl` against
+ * the URL's (instanceId, sessionId, scope, path), then proxies to the SDK's
+ * existing `/sessions/:sid/workspace/*` or `/sessions/:sid/files/*` route on
+ * the agent app — same shape as roj-platform's `session-file-route.ts`, just
+ * served in-process.
+ */
+import { verifyFileToken } from './signed-token.js';
+const SCOPE_TO_SDK_PREFIX = {
+    workspace: 'workspace',
+    session: 'files',
+};
+export function createSessionFileRoute(deps) {
+    return async (c) => {
+        const instanceId = c.req.param('id');
+        const sessionId = c.req.param('sid');
+        const scope = c.req.param('scope');
+        const url = new URL(c.req.url);
+        const tokenStr = url.searchParams.get('token');
+        if (!tokenStr) {
+            return c.json({ error: { type: 'unauthorized', message: 'Missing token' } }, 401);
+        }
+        const verified = verifyFileToken(deps.tokenSecret, tokenStr);
+        if (!verified.ok) {
+            return c.json({ error: { type: 'unauthorized', message: `Invalid token (${verified.error})` } }, 401);
+        }
+        // Recover the file path the token was signed for. Hono `*` capture is
+        // available via the URL pathname; decode each segment back to its
+        // original form so the comparison against the signed payload is exact.
+        const pathPrefix = `/api/v1/instances/${instanceId}/sessions/${sessionId}/files/${scope}/`;
+        if (!url.pathname.startsWith(pathPrefix)) {
+            return c.json({ error: { type: 'invalid_request', message: 'Path mismatch' } }, 400);
+        }
+        const requestedPath = url.pathname
+            .slice(pathPrefix.length)
+            .split('/')
+            .map(seg => decodeURIComponent(seg))
+            .join('/');
+        const p = verified.payload;
+        if (p.instanceId !== instanceId ||
+            p.sessionId !== sessionId ||
+            p.scope !== scope ||
+            p.path !== requestedPath) {
+            return c.json({ error: { type: 'unauthorized', message: 'Token does not match requested file' } }, 401);
+        }
+        // Proxy to the SDK's underlying file route. Note the path/scope mapping:
+        // public `workspace` → SDK `/sessions/:sid/workspace/*`,
+        // public `session`   → SDK `/sessions/:sid/files/*`.
+        const sdkPrefix = SCOPE_TO_SDK_PREFIX[scope];
+        const innerUrl = `${url.origin}/sessions/${sessionId}/${sdkPrefix}/${encodePathSegments(requestedPath)}`;
+        try {
+            return await deps.agentApp.fetch(new Request(innerUrl, { method: 'GET' }));
+        }
+        catch (err) {
+            deps.logger.error('Session file proxy failed', err instanceof Error ? err : new Error(String(err)), {
+                instanceId,
+                sessionId,
+                scope,
+                path: requestedPath,
+            });
+            return c.json({ error: { type: 'proxy_error', message: 'File proxy failed' } }, 502);
+        }
+    };
+}
+function encodePathSegments(path) {
+    return path.split('/').map(seg => encodeURIComponent(seg)).join('/');
+}
+//# sourceMappingURL=session-file-route.js.map

package/dist/session-file-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-file-route.js","sourceRoot":"","sources":["../src/session-file-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAenD,MAAM,mBAAmB,GAA4C;IACpE,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,OAAO;CAChB,CAAA;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAU;IAChD,OAAO,KAAK,EAAE,CAAU,EAAE,EAAE;QAC3B,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAA;QAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAE9B,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAClF,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,QAAQ,CAAC,KAAK,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACtG,CAAC;QAED,sEAAsE;QACtE,kEAAkE;QAClE,uEAAuE;QACvE,MAAM,UAAU,GAAG,qBAAqB,UAAU,aAAa,SAAS,UAAU,KAAK,GAAG,CAAA;QAC1F,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACrF,CAAC;QACD,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ;aAChC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;aACxB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;aACnC,IAAI,CAAC,GAAG,CAAC,CAAA;QAEX,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAA;QAC1B,IACC,CAAC,CAAC,UAAU,KAAK,UAAU;YAC3B,CAAC,CAAC,SAAS,KAAK,SAAS;YACzB,CAAC,CAAC,KAAK,KAAK,KAAK;YACjB,CAAC,CAAC,IAAI,KAAK,aAAa,EACvB,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,qCAAqC,EAAE,EAAE,EACnF,GAAG,CACH,CAAA;QACF,CAAC;QAED,yEAAyE;QACzE,yDAAyD;QACzD,qDAAqD;QACrD,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,MAAM,aAAa,SAAS,IAAI,SAAS,IAAI,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAA;QACxG,IAAI,CAAC;YACJ,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;gBACnG,UAAU;gBACV,SAAS;gBACT,KAAK;gBACL,IAAI,EAAE,aAAa;aACnB,CAAC,CAAA;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACrF,CAAC;IACF,CAAC,CAAA;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACrE,CAAC"}

package/dist/signed-token.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Tiny HMAC-signed download token used by `sessionFiles.createDownloadUrl`.
+ *
+ * The token binds (instanceId, sessionId, scope, path, expiresAt) so a leaked
+ * URL can only fetch the exact file it was minted for, and only briefly. Same
+ * shape as roj-platform's `session-file-token.ts`, just pruned for local use.
+ */
+export interface SignedFilePayload {
+    instanceId: string;
+    sessionId: string;
+    scope: 'workspace' | 'session';
+    path: string;
+    expiresAt: number;
+}
+export declare function generateTokenSecret(): string;
+export declare function signFileToken(secret: string, payload: SignedFilePayload): string;
+export type VerifyResult = {
+    ok: true;
+    payload: SignedFilePayload;
+} | {
+    ok: false;
+    error: 'malformed' | 'bad_signature' | 'expired';
+};
+export declare function verifyFileToken(secret: string, token: string): VerifyResult;
+//# sourceMappingURL=signed-token.d.ts.map

package/dist/signed-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-token.d.ts","sourceRoot":"","sources":["../src/signed-token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,WAAW,GAAG,SAAS,CAAA;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CACjB;AAED,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAIhF;AAED,MAAM,MAAM,YAAY,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,WAAW,GAAG,eAAe,GAAG,SAAS,CAAA;CAAE,CAAA;AAElE,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,CAsB3E"}

package/dist/signed-token.js

@@ -0,0 +1,50 @@
+/**
+ * Tiny HMAC-signed download token used by `sessionFiles.createDownloadUrl`.
+ *
+ * The token binds (instanceId, sessionId, scope, path, expiresAt) so a leaked
+ * URL can only fetch the exact file it was minted for, and only briefly. Same
+ * shape as roj-platform's `session-file-token.ts`, just pruned for local use.
+ */
+import { randomBytes, createHmac, timingSafeEqual } from 'node:crypto';
+export function generateTokenSecret() {
+    return randomBytes(32).toString('hex');
+}
+export function signFileToken(secret, payload) {
+    const body = base64UrlEncode(Buffer.from(JSON.stringify(payload), 'utf8'));
+    const sig = base64UrlEncode(hmac(secret, body));
+    return `${body}.${sig}`;
+}
+export function verifyFileToken(secret, token) {
+    const dot = token.indexOf('.');
+    if (dot < 0)
+        return { ok: false, error: 'malformed' };
+    const body = token.slice(0, dot);
+    const sigEncoded = token.slice(dot + 1);
+    const expectedSig = hmac(secret, body);
+    const givenSig = base64UrlDecode(sigEncoded);
+    if (givenSig.length !== expectedSig.length || !timingSafeEqual(givenSig, expectedSig)) {
+        return { ok: false, error: 'bad_signature' };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(base64UrlDecode(body).toString('utf8'));
+    }
+    catch {
+        return { ok: false, error: 'malformed' };
+    }
+    if (typeof payload.expiresAt !== 'number' || payload.expiresAt < Date.now()) {
+        return { ok: false, error: 'expired' };
+    }
+    return { ok: true, payload };
+}
+function hmac(secret, body) {
+    return createHmac('sha256', secret).update(body).digest();
+}
+function base64UrlEncode(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function base64UrlDecode(s) {
+    const pad = '='.repeat((4 - (s.length % 4)) % 4);
+    return Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/') + pad, 'base64');
+}
+//# sourceMappingURL=signed-token.js.map

package/dist/signed-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-token.js","sourceRoot":"","sources":["../src/signed-token.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAUtE,MAAM,UAAU,mBAAmB;IAClC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAA0B;IACvE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;IAC1E,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IAC/C,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAA;AACxB,CAAC;AAMD,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,KAAa;IAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAEvC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QACvF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;IAC7C,CAAC;IAED,IAAI,OAA0B,CAAA;IAC9B,IAAI,CAAC;QACJ,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;IACzC,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IACvC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC7B,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAY;IACzC,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACzF,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IACjC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,QAAQ,CAAC,CAAA;AAC5E,CAAC"}

package/dist/user-config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-config-loader.d.ts","sourceRoot":"","sources":["../src/user-config-loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAU,SAAS,EAAE,MAAM,aAAa,CAAA;AAKpD,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CA0D3E"}
+{"version":3,"file":"user-config-loader.d.ts","sourceRoot":"","sources":["../src/user-config-loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAyB,SAAS,EAAE,MAAM,aAAa,CAAA;AAKnE,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CA8D3E"}

package/dist/user-config-loader.js

@@ -6,7 +6,7 @@
  */
 import { validatePreset } from '@roj-ai/sdk';
 import { existsSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { dirname, isAbsolute, resolve } from 'node:path';
 export async function loadUserConfig(configPath) {
     const absolutePath = resolve(process.cwd(), configPath);
     if (!existsSync(absolutePath)) {
@@ -50,10 +50,46 @@ export async function loadUserConfig(configPath) {
     if (duplicates.length > 0) {
         throw new Error(`Duplicate preset IDs: ${[...new Set(duplicates)].join(', ')}`);
     }
+    const configDir = dirname(absolutePath);
+    const localResources = parseLocalResources(typedConfig.localResources, configDir, absolutePath);
     return {
         presets,
         sandboxed: typedConfig.sandboxed,
         snapshotter: typedConfig.snapshotter,
+        localResources,
     };
 }
+function parseLocalResources(raw, configDir, configPath) {
+    if (raw === undefined)
+        return undefined;
+    if (!Array.isArray(raw)) {
+        throw new Error(`'localResources' must be an array: ${configPath}`);
+    }
+    const seen = new Set();
+    return raw.map((entry, i) => {
+        if (typeof entry !== 'object' || entry === null) {
+            throw new Error(`localResources[${i}] must be an object: ${configPath}`);
+        }
+        const r = entry;
+        if (typeof r.slug !== 'string' || !r.slug) {
+            throw new Error(`localResources[${i}] missing required 'slug': ${configPath}`);
+        }
+        if (typeof r.path !== 'string' || !r.path) {
+            throw new Error(`localResources[${i}] missing required 'path': ${configPath}`);
+        }
+        if (seen.has(r.slug)) {
+            throw new Error(`Duplicate localResources slug '${r.slug}': ${configPath}`);
+        }
+        seen.add(r.slug);
+        const resolvedPath = isAbsolute(r.path) ? r.path : resolve(configDir, r.path);
+        if (!existsSync(resolvedPath)) {
+            throw new Error(`localResources[${i}] file not found: ${resolvedPath} (config: ${configPath})`);
+        }
+        return {
+            slug: r.slug,
+            path: resolvedPath,
+            name: typeof r.name === 'string' ? r.name : undefined,
+        };
+    });
+}
 //# sourceMappingURL=user-config-loader.js.map

package/dist/user-config-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-config-loader.js","sourceRoot":"","sources":["../src/user-config-loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB;IACtD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAA;IAEvD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACd,sCAAsC,YAAY,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/G,CAAA;IACF,CAAC;IAED,MAAM,MAAM,GAAI,GAA6B,CAAC,OAAO,CAAA;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kDAAkD,YAAY,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,oCAAoC,YAAY,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,MAAM,WAAW,GAAG,MAAiC,CAAA;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,8CAA8C,YAAY,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAmB,CAAA;IAC/C,MAAM,SAAS,GAAa,EAAE,CAAA;IAE9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;YACpD,SAAQ;QACT,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAClC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,CAAA;IACvE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,OAAO;QACN,OAAO;QACP,SAAS,EAAE,WAAW,CAAC,SAAgC;QACvD,WAAW,EAAE,WAAW,CAAC,WAAuC;KAChE,CAAA;AACF,CAAC"}
+{"version":3,"file":"user-config-loader.js","sourceRoot":"","sources":["../src/user-config-loader.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAExD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB;IACtD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAA;IAEvD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACd,sCAAsC,YAAY,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/G,CAAA;IACF,CAAC;IAED,MAAM,MAAM,GAAI,GAA6B,CAAC,OAAO,CAAA;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kDAAkD,YAAY,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,oCAAoC,YAAY,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,MAAM,WAAW,GAAG,MAAiC,CAAA;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,8CAA8C,YAAY,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAmB,CAAA;IAC/C,MAAM,SAAS,GAAa,EAAE,CAAA;IAE9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;YACpD,SAAQ;QACT,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC9D,CAAC;IACF,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC3F,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAClC,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,CAAA;IACvE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChF,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACvC,MAAM,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;IAE/F,OAAO;QACN,OAAO;QACP,SAAS,EAAE,WAAW,CAAC,SAAgC;QACvD,WAAW,EAAE,WAAW,CAAC,WAAuC;QAChE,cAAc;KACd,CAAA;AACF,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY,EAAE,SAAiB,EAAE,UAAkB;IAC/E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAA;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,CAAC,GAAG,KAAgC,CAAA;QAC1C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,IAAI,MAAM,UAAU,EAAE,CAAC,CAAA;QAC5E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAEhB,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;QAC7E,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,qBAAqB,YAAY,aAAa,UAAU,GAAG,CAAC,CAAA;QAChG,CAAC;QACD,OAAO;YACN,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SACrD,CAAA;IACF,CAAC,CAAC,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@roj-ai/standalone-server",
-	"version": "0.1.11",
+	"version": "0.1.13",
 	"type": "module",
 	"main": "./dist/index.js",
 	"bin": {
@@ -33,10 +33,10 @@
 		"type-check": "tsc --noEmit"
 	},
 	"dependencies": {
-		"@roj-ai/client": "^0.1.11",
-		"@roj-ai/sdk": "^0.1.11",
-		"@roj-ai/shared": "^0.1.11",
-		"@roj-ai/transport": "^0.1.11",
+		"@roj-ai/client": "^0.1.13",
+		"@roj-ai/sdk": "^0.1.13",
+		"@roj-ai/shared": "^0.1.13",
+		"@roj-ai/transport": "^0.1.13",
 		"hono": "^4.10.7"
 	},
 	"devDependencies": {

package/src/files-upload-route.ts

@@ -0,0 +1,64 @@
+/**
+ * POST /api/v1/files/upload — multipart endpoint matching the `@roj-ai/client/platform.files.upload`
+ * two-phase contract:
+ *
+ *   1. Preflight with `contentHash`, `filename`, `mimeType` only. If we already have
+ *      the bytes (sha-256 match), respond `{ ok, fileId, ..., deduped: true }`.
+ *      Otherwise respond 409 `{ error: 'file-required' }`.
+ *   2. Retry with the same fields plus a `file` blob. We persist the bytes,
+ *      record the file, and respond `{ ok, fileId, ..., deduped: false }`.
+ *
+ * No bearer auth (standalone is open) — but we accept and ignore an
+ * `Authorization: Bearer …` header so client code copy-pasted from the platform
+ * keeps working.
+ */
+
+import type { Context } from 'hono'
+import type { LocalRegistry } from './local-registry.js'
+
+interface Deps {
+	registry: LocalRegistry
+}
+
+export function createFilesUploadRoute(deps: Deps) {
+	return async (c: Context) => {
+		let form: FormData
+		try {
+			form = await c.req.formData()
+		} catch {
+			return c.json({ ok: false, error: 'invalid_multipart' }, 400)
+		}
+
+		const contentHash = form.get('contentHash')
+		const filename = form.get('filename')
+		const mimeType = form.get('mimeType')
+		if (typeof contentHash !== 'string' || typeof filename !== 'string' || typeof mimeType !== 'string') {
+			return c.json(
+				{ ok: false, error: 'invalid_form' },
+				400,
+			)
+		}
+
+		const file = form.get('file')
+		const buffer = file && typeof file !== 'string' && 'arrayBuffer' in file
+			? Buffer.from(await file.arrayBuffer())
+			: undefined
+
+		const result = await deps.registry.uploadFile({ buffer, filename, mimeType, contentHash })
+
+		if ('error' in result) {
+			// Preflight miss — client retries with body.
+			return c.json({ ok: false, error: result.error }, 409)
+		}
+
+		return c.json({
+			ok: true,
+			fileId: result.fileId,
+			filename: result.filename,
+			mimeType: result.mimeType,
+			size: result.size,
+			r2Key: '',
+			deduped: result.deduped,
+		})
+	}
+}

package/src/git-instance-fs.ts

@@ -0,0 +1,187 @@
+/**
+ * Per-instance git layout for the standalone server.
+ *
+ * Mirrors what `roj-platform` does inside an E2B sandbox: each instance owns
+ * a bare repo, each session owns a worktree branched from `main`. The SDK
+ * receives the worktree path as `workspaceDir` on `sessions.create` and treats
+ * it as an opaque directory — it doesn't know about git.
+ *
+ *   {dataPath}/instances/{instanceId}/repo.git/        ← bare, branch `main`
+ *   {dataPath}/instances/{instanceId}/sessions/{sid}/  ← worktree, branch `session/{sid}`
+ *
+ * Why a bare repo + worktrees instead of a plain dir per session:
+ *  - Parallel sessions on one instance need independent commit history.
+ *  - `git worktree` shares object storage, so the cost is mostly metadata.
+ *  - Mental model matches platform — agent `git status` / `git log` behave
+ *    identically against standalone and against E2B.
+ *
+ * Idempotent: `initInstance` skips if `repo.git` already exists,
+ * `addSessionWorktree` skips if the target worktree is already registered.
+ * That keeps `roj-standalone` restart-safe — bare repos and worktrees on disk
+ * persist across process restarts the same way `LocalRegistry` does.
+ *
+ * No auto-commit. Resources extracted via `resources.inject` land in the
+ * worktree as untracked files; whether to commit them is the agent's call,
+ * matching platform behavior.
+ */
+
+import type { Logger } from '@roj-ai/sdk'
+import { execFile } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { mkdir, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { promisify } from 'node:util'
+
+const execFileAsync = promisify(execFile)
+
+// Used for the empty initial commit on `main`. Real commits the agent makes
+// will pick up the host's git config; this just keeps `commit-tree` from
+// failing on machines without `user.name`/`user.email` set.
+const BOOTSTRAP_GIT_ENV = {
+	GIT_AUTHOR_NAME: 'roj-standalone',
+	GIT_AUTHOR_EMAIL: 'standalone@roj.local',
+	GIT_COMMITTER_NAME: 'roj-standalone',
+	GIT_COMMITTER_EMAIL: 'standalone@roj.local',
+}
+
+export class GitInstanceFs {
+	constructor(
+		private readonly dataPath: string,
+		private readonly logger: Logger,
+	) {}
+
+	instanceDir(instanceId: string): string {
+		return join(this.dataPath, 'instances', instanceId)
+	}
+
+	repoDir(instanceId: string): string {
+		return join(this.instanceDir(instanceId), 'repo.git')
+	}
+
+	worktreeDir(instanceId: string, sessionId: string): string {
+		return join(this.instanceDir(instanceId), 'sessions', sessionId)
+	}
+
+	/**
+	 * Idempotently initialize the bare repo for an instance with an empty
+	 * initial commit on `main`. The commit exists so subsequent
+	 * `git worktree add -b session/{sid}` calls have something to branch from.
+	 */
+	async initInstance(instanceId: string): Promise<void> {
+		const repoDir = this.repoDir(instanceId)
+		if (existsSync(repoDir)) {
+			this.logger.debug('Instance bare repo already exists, skipping init', { instanceId })
+			return
+		}
+
+		await mkdir(this.instanceDir(instanceId), { recursive: true })
+		await this.git(['init', '--bare', repoDir])
+		// `git init --bare` may default to `master` on older git; normalize so
+		// the worktree branch starts from a known parent ref.
+		await this.git(['symbolic-ref', 'HEAD', 'refs/heads/main'], { cwd: repoDir })
+
+		const tree = (await this.git(['mktree'], { cwd: repoDir, input: '' })).trim()
+		const commit = (await this.git(
+			['commit-tree', tree, '-m', 'Initial commit'],
+			{ cwd: repoDir, env: BOOTSTRAP_GIT_ENV },
+		)).trim()
+		await this.git(['update-ref', 'refs/heads/main', commit], { cwd: repoDir })
+
+		this.logger.info('Initialized instance bare repo', { instanceId, repoDir })
+	}
+
+	/**
+	 * Idempotently add a worktree for `sessionId` on branch `session/{sid}`,
+	 * branching from `main`. Throws if the target dir exists but is not a valid
+	 * worktree of this instance's bare repo (unrecoverable conflict).
+	 */
+	async addSessionWorktree(instanceId: string, sessionId: string): Promise<string> {
+		const repoDir = this.repoDir(instanceId)
+		const worktreePath = this.worktreeDir(instanceId, sessionId)
+
+		if (!existsSync(repoDir)) {
+			throw new Error(`Cannot add session worktree: instance bare repo missing at ${repoDir}`)
+		}
+
+		if (existsSync(worktreePath)) {
+			if (await this.isLinkedWorktree(repoDir, worktreePath)) {
+				this.logger.debug('Session worktree already exists, skipping add', { instanceId, sessionId })
+				return worktreePath
+			}
+			throw new Error(`Path exists but is not a registered worktree of ${repoDir}: ${worktreePath}`)
+		}
+
+		await mkdir(join(this.instanceDir(instanceId), 'sessions'), { recursive: true })
+		await this.git(
+			['worktree', 'add', '-b', `session/${sessionId}`, worktreePath, 'main'],
+			{ cwd: repoDir },
+		)
+		this.logger.info('Added session worktree', { instanceId, sessionId, worktreePath })
+		return worktreePath
+	}
+
+	/**
+	 * Remove a session's worktree (filesystem + bookkeeping). Silently no-ops
+	 * if the worktree was never registered.
+	 */
+	async removeSessionWorktree(instanceId: string, sessionId: string): Promise<void> {
+		const repoDir = this.repoDir(instanceId)
+		const worktreePath = this.worktreeDir(instanceId, sessionId)
+
+		if (!existsSync(repoDir) || !existsSync(worktreePath)) return
+
+		try {
+			await this.git(['worktree', 'remove', '--force', worktreePath], { cwd: repoDir })
+		} catch (err) {
+			// worktree may already be detached; fall back to filesystem rm + prune.
+			this.logger.warn('git worktree remove failed, falling back to rm + prune', {
+				instanceId,
+				sessionId,
+				error: err instanceof Error ? err.message : String(err),
+			})
+			await rm(worktreePath, { recursive: true, force: true })
+			await this.git(['worktree', 'prune'], { cwd: repoDir }).catch(() => {})
+		}
+	}
+
+	/**
+	 * Tear down everything for an instance: every worktree, then the
+	 * bare repo + on-disk dir. Safe to call when nothing exists.
+	 */
+	async removeInstance(instanceId: string): Promise<void> {
+		const dir = this.instanceDir(instanceId)
+		if (!existsSync(dir)) return
+		await rm(dir, { recursive: true, force: true })
+		this.logger.info('Removed instance directory', { instanceId, dir })
+	}
+
+	private async isLinkedWorktree(repoDir: string, worktreePath: string): Promise<boolean> {
+		try {
+			const stdout = await this.git(['worktree', 'list', '--porcelain'], { cwd: repoDir })
+			// `worktree` lines look like: `worktree /abs/path` (one per registration).
+			return stdout
+				.split('\n')
+				.some((line) => line.startsWith('worktree ') && line.slice('worktree '.length) === worktreePath)
+		} catch {
+			return false
+		}
+	}
+
+	private async git(
+		args: string[],
+		opts: { cwd?: string; input?: string; env?: Record<string, string> } = {},
+	): Promise<string> {
+		const env = opts.env ? { ...process.env, ...opts.env } : process.env
+		const child = execFileAsync('git', args, { cwd: opts.cwd, env })
+		if (opts.input !== undefined) {
+			child.child.stdin?.end(opts.input)
+		}
+		try {
+			const { stdout } = await child
+			return stdout
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err)
+			throw new Error(`git ${args.join(' ')} failed: ${message}`)
+		}
+	}
+}