@someonegg/agent-hub 0.0.0-stage → 0.7.0

package/dist/server/server/http/api-router.js

@@ -0,0 +1,54 @@
+import { join } from "node:path";
+import { resolveHomeDirectory } from "../config.js";
+import { UploadStore } from "../uploads/store.js";
+import { HttpQueryError } from "./query-params.js";
+import { RequestBodyError } from "./request-body.js";
+import { reportRequestError, requestUrl } from "./request-errors.js";
+import { sendJson } from "./router.js";
+import { createSessionInteractionRoutes } from "./session-interaction-routes.js";
+import { createSessionManagementRoutes } from "./session-management-routes.js";
+import { createSessionReadRoutes } from "./session-read-routes.js";
+import { createUploadRoutes } from "./upload-routes.js";
+export function createApiRouter(dependencies, options = {}) {
+    const handlers = [
+        createUploadRoutes(dependencies.uploads ??
+            new UploadStore(dependencies.uploadDirectory ?? join(resolveHomeDirectory(), "uploads")), dependencies.sessions),
+        createSessionManagementRoutes(dependencies.operations),
+        createSessionInteractionRoutes(dependencies.interaction),
+        createSessionReadRoutes(dependencies),
+    ];
+    const router = async (request, response) => {
+        const url = requestUrl(request);
+        if (!url.pathname.startsWith("/api/"))
+            return false;
+        const headOnly = request.method === "HEAD";
+        for (const handler of handlers.filter((candidate) => candidate.matches(url))) {
+            try {
+                if (await handler.handle(request, response, url))
+                    return true;
+            }
+            catch (error) {
+                if (response.headersSent) {
+                    reportRequestError(request, response, error, options, true);
+                    return true;
+                }
+                if (error instanceof RequestBodyError || error instanceof HttpQueryError) {
+                    sendJson(response, error instanceof RequestBodyError ? error.status : 400, {
+                        error: {
+                            code: error instanceof RequestBodyError ? error.code : "invalid_query",
+                            message: error.message,
+                        },
+                    }, headOnly);
+                    return true;
+                }
+                if (handler.mapError(error, request, response))
+                    return true;
+                reportRequestError(request, response, error, options, true);
+                return true;
+            }
+        }
+        return false;
+    };
+    return router;
+}
+//# sourceMappingURL=api-router.js.map

package/dist/server/server/http/create-server.js

@@ -0,0 +1,218 @@
+import { createReadStream, readFileSync, realpathSync } from "node:fs";
+import { realpath, stat } from "node:fs/promises";
+import { createServer as createHttpServer, } from "node:http";
+import { createServer as createHttpsServer } from "node:https";
+import { extname, resolve, sep } from "node:path";
+import { DiffStore } from "../hosting/diff-store.js";
+import { hostingRoutes } from "../hosting/routes.js";
+import { decodePath, isMissingFile, MalformedRequestError, reportRequestError, requestUrl, } from "./request-errors.js";
+import { emptyApiRouter, sendJson } from "./router.js";
+import { applySecurityHeaders } from "./security.js";
+const CONTENT_TYPES = {
+    ".css": "text/css; charset=utf-8",
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".ico": "image/vnd.microsoft.icon",
+    ".webmanifest": "application/manifest+json; charset=utf-8",
+};
+function sendText(response, status, message, headOnly) {
+    response.statusCode = status;
+    response.setHeader("Content-Type", "text/plain; charset=utf-8");
+    response.setHeader("Content-Length", Buffer.byteLength(message));
+    response.end(headOnly ? undefined : message);
+}
+async function serveFile(response, filePath, headOnly, status = 200, onStreamError = () => { }) {
+    try {
+        const info = await stat(filePath);
+        if (!info.isFile())
+            return false;
+        response.statusCode = status;
+        response.setHeader("Content-Type", CONTENT_TYPES[extname(filePath)] ?? "application/octet-stream");
+        response.setHeader("Content-Length", info.size);
+        if (headOnly) {
+            response.end();
+        }
+        else {
+            createReadStream(filePath)
+                .on("error", (error) => {
+                response.destroy();
+                onStreamError(error);
+            })
+                .pipe(response);
+        }
+        return true;
+    }
+    catch (error) {
+        if (!isMissingFile(error))
+            throw error;
+        return false;
+    }
+}
+export function createServer(config, apiRouter = emptyApiRouter, closeServices = () => { }, upgrades, options = {}) {
+    const clientRoot = realpathSync(config.clientDirectory);
+    const hosting = hostingRoutes(config.hostingDirectory, options);
+    const diffs = config.hostingDirectory ? new DiffStore(config.hostingDirectory) : undefined;
+    const clientRootPrefix = `${clientRoot}${sep}`;
+    const requestListener = async (request, response) => {
+        applySecurityHeaders(response, request);
+        const headOnly = request.method === "HEAD";
+        try {
+            if (await hosting(request, response))
+                return;
+            if (await apiRouter(request, response))
+                return;
+            if (request.method !== "GET" && !headOnly) {
+                response.setHeader("Allow", "GET, HEAD");
+                sendJson(response, 405, {
+                    error: { code: "method_not_allowed", message: "Method is not allowed for this resource" },
+                });
+                return;
+            }
+            const url = requestUrl(request);
+            const decodedPath = decodePath(url.pathname);
+            const sessionPage = /^\/sessions\/[A-Za-z0-9_-]{20,100}(?:\/uploads)?\/?$/.test(decodedPath);
+            const diffPage = /^\/diffs\/([a-f0-9-]{36})$/.exec(decodedPath);
+            const appPage = decodedPath === "/" ||
+                sessionPage ||
+                ((decodedPath === "/artifacts" || diffPage) && config.hostingDirectory);
+            const pageStatus = diffPage && diffs && !(await diffs.exists(diffPage[1])) ? 404 : 200;
+            if (diffPage)
+                response.setHeader("Cache-Control", "private, no-store");
+            const relativePath = appPage ? "index.html" : decodedPath.slice(1);
+            const requestedPath = resolve(clientRoot, relativePath);
+            let canonicalPath;
+            try {
+                canonicalPath = await realpath(requestedPath);
+            }
+            catch (error) {
+                if (!isMissingFile(error))
+                    throw error;
+                sendText(response, 404, "Not found", headOnly);
+                return;
+            }
+            if (canonicalPath.startsWith(clientRootPrefix) &&
+                (await serveFile(response, canonicalPath, headOnly, pageStatus, (error) => reportRequestError(request, response, error, options)))) {
+                return;
+            }
+            sendText(response, 404, "Not found", headOnly);
+        }
+        catch (error) {
+            if (!(error instanceof MalformedRequestError) || response.headersSent) {
+                reportRequestError(request, response, error, options);
+                return;
+            }
+            sendJson(response, 400, { error: { code: "bad_request", message: "Malformed request" } }, headOnly);
+        }
+    };
+    if (!config.tls.enabled) {
+        const server = createHttpServer(requestListener);
+        return attachLifecycle(server, closeServices, upgrades);
+    }
+    const requireClientCertificate = config.tls.certificateAuthorityPath !== undefined;
+    const server = createHttpsServer({
+        cert: readFileSync(config.tls.certificatePath),
+        key: readFileSync(config.tls.privateKeyPath),
+        ...(config.tls.certificateAuthorityPath
+            ? { ca: readFileSync(config.tls.certificateAuthorityPath) }
+            : {}),
+        minVersion: "TLSv1.2",
+        requestCert: requireClientCertificate,
+        rejectUnauthorized: requireClientCertificate,
+    }, requestListener);
+    return attachLifecycle(server, closeServices, upgrades);
+}
+/** Own startup cleanup as well as the server's pre-drain shutdown hook. */
+export async function startServer(config, apiRouter, closeServices, upgrades) {
+    let primary;
+    let local;
+    let cleaned = false;
+    const cleanup = () => {
+        if (cleaned)
+            return;
+        cleaned = true;
+        upgrades?.close();
+        closeServices();
+    };
+    // Listener shutdown must leave shared WebSocket cleanup to the owner above.
+    const listenerUpgrades = upgrades && {
+        handle: upgrades.handle.bind(upgrades),
+        close: () => { },
+    };
+    try {
+        primary = createServer(config, apiRouter, () => { }, listenerUpgrades);
+        await listenServer(primary, config.port, config.host);
+        if (config.localPort !== undefined) {
+            local = createServer({ ...config, tls: { enabled: false } }, apiRouter, () => { }, listenerUpgrades);
+            await listenServer(local, config.localPort, "127.0.0.1");
+            const address = local.address();
+            if (address && typeof address === "object")
+                console.log(`Agent Hub local HTTP listening on http://127.0.0.1:${address.port}`);
+        }
+        const server = primary;
+        const close = server.close.bind(server);
+        server.close = ((callback) => {
+            let pending = local ? 2 : 1;
+            let failure;
+            const finished = (error) => {
+                failure ??= error;
+                if (--pending === 0)
+                    callback?.(failure);
+            };
+            cleanup();
+            close(finished);
+            local?.close(finished);
+            return server;
+        });
+        return server;
+    }
+    catch (error) {
+        cleanup();
+        for (const server of [local, primary]) {
+            if (server?.listening) {
+                server.close();
+                server.closeAllConnections();
+            }
+        }
+        throw error;
+    }
+}
+export function listenServer(server, port, host) {
+    return new Promise((resolve, reject) => {
+        const cleanup = () => {
+            server.removeListener("error", onError);
+            server.removeListener("listening", onListening);
+        };
+        const onError = (error) => {
+            cleanup();
+            reject(error);
+        };
+        const onListening = () => {
+            cleanup();
+            resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, host);
+    });
+}
+function attachLifecycle(server, closeServices, upgrades) {
+    server.on("upgrade", (request, socket, head) => {
+        if (upgrades)
+            upgrades.handle(request, socket, head);
+        else
+            socket.destroy();
+    });
+    const close = server.close.bind(server);
+    const mutable = server;
+    mutable.close = (callback) => {
+        upgrades?.close();
+        closeServices();
+        close(callback);
+        return server;
+    };
+    return server;
+}
+//# sourceMappingURL=create-server.js.map

package/dist/server/server/http/query-params.js

@@ -0,0 +1,19 @@
+export class HttpQueryError extends Error {
+}
+export function optional(params, name) {
+    const values = params.getAll(name);
+    if (values.length > 1)
+        invalid(`${name} must appear once`);
+    return values[0];
+}
+export function only(params, allowed) {
+    const accepted = new Set(allowed);
+    for (const name of params.keys()) {
+        if (!accepted.has(name))
+            invalid(`${name} is not supported`);
+    }
+}
+export function invalid(message) {
+    throw new HttpQueryError(message);
+}
+//# sourceMappingURL=query-params.js.map

package/dist/server/server/http/request-body.js

@@ -0,0 +1,48 @@
+import { MAX_INTERACTION_MESSAGE_BYTES } from "../../shared/interaction.js";
+const MAX_INTERACTION_JSON_BYTES = MAX_INTERACTION_MESSAGE_BYTES * 6 + 1_024;
+export class RequestBodyError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+export async function readJsonObject(request) {
+    const contentType = request.headers["content-type"]?.split(";", 1)[0]?.trim().toLowerCase();
+    if (contentType !== "application/json") {
+        invalidBody("Content-Type must be application/json");
+    }
+    const declared = Number(request.headers["content-length"]);
+    if (Number.isFinite(declared) && declared > MAX_INTERACTION_JSON_BYTES) {
+        bodyTooLarge();
+    }
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of request) {
+        const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        bytes += value.byteLength;
+        if (bytes > MAX_INTERACTION_JSON_BYTES)
+            bodyTooLarge();
+        chunks.push(value);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    }
+    catch {
+        invalidBody("Request body must be valid JSON");
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        invalidBody("Request body must be a JSON object");
+    }
+    return parsed;
+}
+function invalidBody(message) {
+    throw new RequestBodyError(400, "invalid_json", message);
+}
+function bodyTooLarge() {
+    throw new RequestBodyError(413, "body_too_large", "Request body is too large");
+}
+//# sourceMappingURL=request-body.js.map

package/dist/server/server/http/request-errors.js

@@ -0,0 +1,59 @@
+import { randomUUID } from "node:crypto";
+import { sendJson } from "./router.js";
+export class MalformedRequestError extends Error {
+}
+export function requestUrl(request) {
+    try {
+        return new URL(request.url ?? "/", "http://localhost");
+    }
+    catch {
+        throw new MalformedRequestError("Malformed URL");
+    }
+}
+export function decodePath(path) {
+    try {
+        return decodeURIComponent(path);
+    }
+    catch {
+        throw new MalformedRequestError("Malformed path encoding");
+    }
+}
+export function isMissingFile(error) {
+    return ["ENOENT", "ENOTDIR"].includes(error?.code ?? "");
+}
+const ids = new WeakMap();
+export function requestId(request, factory = randomUUID) {
+    let id = ids.get(request);
+    if (!id) {
+        id = factory();
+        ids.set(request, id);
+    }
+    return id;
+}
+export const consoleErrorLogger = {
+    error(message, context) {
+        console.error(message, context);
+    },
+};
+export function reportRequestError(request, response, error, options = {}, sessionApi = false) {
+    const id = requestId(request, options.requestId);
+    (options.logger ?? consoleErrorLogger).error(sessionApi ? "Session API request failed" : "HTTP request failed", {
+        requestId: id,
+        ...(!sessionApi ? { method: request.method, path: request.url?.split("?")[0] ?? "/" } : {}),
+        error,
+    });
+    if (response.headersSent || response.destroyed) {
+        response.destroy();
+        return;
+    }
+    sendJson(response, 500, {
+        error: {
+            code: "internal_error",
+            message: sessionApi
+                ? "The local session reader could not complete the request"
+                : "The server could not complete the request",
+            requestId: id,
+        },
+    }, request.method === "HEAD");
+}
+//# sourceMappingURL=request-errors.js.map

package/dist/server/server/http/router.js

@@ -0,0 +1,16 @@
+export function sendJson(response, status, body, headOnly = false) {
+    const json = JSON.stringify(body);
+    response.statusCode = status;
+    response.setHeader("Content-Type", "application/json; charset=utf-8");
+    response.setHeader("Cache-Control", response.getHeader("Cache-Control") ?? "no-store");
+    response.setHeader("Content-Length", Buffer.byteLength(json));
+    response.end(headOnly ? undefined : json);
+}
+export const emptyApiRouter = (request, response) => {
+    const pathname = new URL(request.url ?? "/", "http://localhost").pathname;
+    if (!pathname.startsWith("/api/"))
+        return false;
+    sendJson(response, 404, { error: { code: "not_found", message: "API endpoint not found" } }, request.method === "HEAD");
+    return true;
+};
+//# sourceMappingURL=router.js.map

package/dist/server/server/http/security.js

@@ -0,0 +1,19 @@
+const SECURITY_HEADERS = {
+    "Content-Security-Policy": "default-src 'self'; base-uri 'none'; font-src 'self' data:; form-action 'none'; frame-ancestors 'none'; img-src 'self' data: blob:; object-src 'none'; script-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'",
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "no-referrer",
+    "X-Frame-Options": "DENY",
+};
+export function applySecurityHeaders(response, request) {
+    const secure = "encrypted" in request.socket && request.socket.encrypted;
+    const host = request.headers.host;
+    // Explicit WebSocket sources are needed by browsers that do not map 'self' to ws/wss.
+    if (host && /^[a-zA-Z0-9.:[\]-]+$/.test(host)) {
+        response.setHeader("Content-Security-Policy", `${SECURITY_HEADERS["Content-Security-Policy"]}; connect-src 'self' ${secure ? "wss" : "ws"}://${host}`);
+    }
+    for (const [name, value] of Object.entries(SECURITY_HEADERS)) {
+        if (!response.hasHeader(name))
+            response.setHeader(name, value);
+    }
+}
+//# sourceMappingURL=security.js.map

package/dist/server/server/http/session-interaction-routes.js

@@ -0,0 +1,128 @@
+import { INTERACTION_KEYS, MAX_INTERACTION_KEY_SEQUENCE_LENGTH, } from "../../shared/api-contract.js";
+import { SessionInteractionError, } from "../interaction/interaction-service.js";
+import { MessageValidationError, normalizeMessage } from "../interaction/message.js";
+import { readJsonObject, RequestBodyError } from "./request-body.js";
+import { sendJson } from "./router.js";
+import { SESSION_ID_PATTERN, SESSION_ROOT, sessionPath } from "./session-path.js";
+const INTERACTION_PATH = new RegExp(`^${SESSION_ROOT}/${SESSION_ID_PATTERN}/(?:terminal|terminal-preview|messages|keys|handoff-pane-binding)$`);
+const INTERACTION_KEY_SET = new Set(INTERACTION_KEYS);
+export function createSessionInteractionRoutes(interaction) {
+    return {
+        matches: (url) => INTERACTION_PATH.test(url.pathname),
+        async handle(request, response, url) {
+            const { id, segments: [operation = ""], } = sessionPath(url.pathname);
+            if (operation === "terminal" && request.method === "GET") {
+                if (!interaction?.captureTerminal)
+                    return interactionUnavailable(response);
+                if ([...url.searchParams].length)
+                    invalidBody("terminal does not accept query parameters");
+                response.setHeader("Cache-Control", "no-store");
+                sendJson(response, 200, await interaction.captureTerminal(id));
+                return true;
+            }
+            if (operation === "terminal-preview") {
+                response.setHeader("Upgrade", "websocket");
+                sendJson(response, 426, {
+                    error: { code: "websocket_required", message: "Terminal Preview requires WebSocket" },
+                }, request.method === "HEAD");
+                return true;
+            }
+            if (request.method !== "POST")
+                return false;
+            if (interaction === undefined)
+                return interactionUnavailable(response);
+            if (operation === "handoff-pane-binding") {
+                const body = await readJsonObject(request);
+                if (Object.keys(body).length !== 0)
+                    invalidBody("Expected an empty object");
+                await interaction.handoffPaneBinding(id);
+                return noContent(response);
+            }
+            if (operation === "messages") {
+                const body = parseMessageBody(await readJsonObject(request));
+                if (body.requireIdle === undefined)
+                    await interaction.sendMessage(id, body.message);
+                else
+                    await interaction.sendMessage(id, body.message, body.requireIdle);
+                return noContent(response);
+            }
+            if (operation === "keys") {
+                const body = parseKeysBody(await readJsonObject(request));
+                if (body.requireIdle === undefined)
+                    await interaction.sendKeys(id, body.keys);
+                else
+                    await interaction.sendKeys(id, body.keys, body.requireIdle);
+                return noContent(response);
+            }
+            return false;
+        },
+        mapError(error, request, response) {
+            const headOnly = request.method === "HEAD";
+            if (error instanceof MessageValidationError && error.code === "invalid_message") {
+                sendJson(response, 400, {
+                    error: { code: "invalid_message", message: error.message },
+                }, headOnly);
+                return true;
+            }
+            if (error instanceof SessionInteractionError) {
+                const status = error.code === "session_not_found"
+                    ? 404
+                    : error.code === "operation_result_unknown"
+                        ? 504
+                        : error.code === "interaction_failed"
+                            ? 502
+                            : 409;
+                sendJson(response, status, {
+                    error: { code: error.code, message: error.message },
+                }, headOnly);
+                return true;
+            }
+            return false;
+        },
+    };
+}
+function invalidBody(message) {
+    throw new RequestBodyError(400, "invalid_json", message);
+}
+function isInteractionKey(value) {
+    return typeof value === "string" && INTERACTION_KEY_SET.has(value);
+}
+function noContent(response) {
+    response.statusCode = 204;
+    response.end();
+    return true;
+}
+function interactionUnavailable(response) {
+    sendJson(response, 409, {
+        error: {
+            code: "interaction_not_supported",
+            message: "Interaction is not enabled",
+        },
+    });
+    return true;
+}
+export function parseMessageBody(body) {
+    if (Object.keys(body).some((key) => !["message", "requireIdle"].includes(key)) ||
+        typeof body.message !== "string" ||
+        (body.requireIdle !== undefined && typeof body.requireIdle !== "boolean")) {
+        invalidBody("body must contain only a string message field");
+    }
+    normalizeMessage(body.message);
+    return body;
+}
+export function parseKeysBody(body) {
+    if (Object.keys(body).some((key) => !["keys", "requireIdle"].includes(key)) ||
+        !Array.isArray(body.keys) ||
+        (body.requireIdle !== undefined && typeof body.requireIdle !== "boolean")) {
+        invalidBody("body must contain only a keys array");
+    }
+    if (body.keys.length === 0 ||
+        body.keys.length > MAX_INTERACTION_KEY_SEQUENCE_LENGTH ||
+        !body.keys.every(isInteractionKey)) {
+        invalidBody(`keys must contain 1-${MAX_INTERACTION_KEY_SEQUENCE_LENGTH} supported interaction keys`);
+    }
+    if (body.requireIdle === true && body.keys.includes("interrupt"))
+        invalidBody("interrupt cannot require idle");
+    return body;
+}
+//# sourceMappingURL=session-interaction-routes.js.map

package/dist/server/server/http/session-management-routes.js

@@ -0,0 +1,105 @@
+import { TASK_NAME_ERROR, validTaskName } from "../../shared/task-name.js";
+import { ManagementError } from "../management/operation-service.js";
+import { readJsonObject, RequestBodyError } from "./request-body.js";
+import { sendJson } from "./router.js";
+import { SESSION_ID_PATTERN, SESSION_ROOT, sessionPath } from "./session-path.js";
+const OPERATION_PATH = /^\/api\/v1\/operations\/[^/]+$/;
+const SESSION_PATH = new RegExp(`^${SESSION_ROOT}/${SESSION_ID_PATTERN}(?:/(?:archive|exit))?$`);
+export function createSessionManagementRoutes(operations) {
+    return {
+        matches: (url) => OPERATION_PATH.test(url.pathname) ||
+            url.pathname === SESSION_ROOT ||
+            SESSION_PATH.test(url.pathname),
+        async handle(request, response, url) {
+            if (!operations)
+                return false;
+            if (OPERATION_PATH.test(url.pathname)) {
+                if (request.method !== "GET")
+                    return false;
+                const operationId = url.pathname.slice("/api/v1/operations/".length);
+                const operation = await operations.get(operationId);
+                if (!operation) {
+                    throw new ManagementError(404, "Operation not found; the server may have restarted or the record expired");
+                }
+                sendJson(response, 200, operation);
+                return true;
+            }
+            const create = url.pathname === SESSION_ROOT;
+            const archive = url.pathname.endsWith("/archive");
+            const exit = url.pathname.endsWith("/exit");
+            const method = create || archive || exit ? "POST" : "DELETE";
+            if (request.method !== method)
+                return false;
+            const protocol = "encrypted" in request.socket && request.socket.encrypted ? "https" : "http";
+            if (request.headers.origin &&
+                request.headers.origin !== `${protocol}://${request.headers.host}`) {
+                throw new ManagementError(403, "Cross-origin management requests are not allowed");
+            }
+            const body = await readJsonObject(request);
+            if (create) {
+                if (typeof body.requestId !== "string")
+                    throw new RequestBodyError(400, "invalid_json", "requestId is required");
+                if (body.resumeSessionId !== undefined) {
+                    if (typeof body.resumeSessionId !== "string" ||
+                        !body.resumeSessionId.trim() ||
+                        Object.keys(body).some((key) => !["resumeSessionId", "yolo", "requestId"].includes(key)) ||
+                        (body.yolo !== undefined && typeof body.yolo !== "boolean"))
+                        throw new RequestBodyError(400, "invalid_json", "Resume accepts only resumeSessionId, yolo and requestId");
+                    sendJson(response, 202, operations.create({
+                        resumeSessionId: body.resumeSessionId,
+                        yolo: body.yolo,
+                        requestId: body.requestId,
+                    }));
+                    return true;
+                }
+                if (Object.keys(body).some((key) => ![
+                    "projectDirectory",
+                    "workingDirectory",
+                    "taskName",
+                    "worktree",
+                    "yolo",
+                    "requestId",
+                    "agent",
+                ].includes(key)) ||
+                    (body.agent !== undefined && typeof body.agent !== "string") ||
+                    typeof body.projectDirectory !== "string" ||
+                    (body.workingDirectory !== undefined && typeof body.workingDirectory !== "string") ||
+                    typeof body.worktree !== "boolean" ||
+                    (body.yolo !== undefined && typeof body.yolo !== "boolean")) {
+                    throw new RequestBodyError(400, "invalid_json", "projectDirectory and worktree are required; yolo must be a boolean if provided");
+                }
+                if (body.taskName !== undefined && !validTaskName(body.taskName))
+                    throw new RequestBodyError(400, "invalid_json", TASK_NAME_ERROR);
+                sendJson(response, 202, operations.create({
+                    ...(typeof body.agent === "string" ? { agent: body.agent } : {}),
+                    projectDirectory: body.projectDirectory,
+                    ...(typeof body.taskName === "string" ? { taskName: body.taskName.trim() } : {}),
+                    ...(typeof body.workingDirectory === "string"
+                        ? { workingDirectory: body.workingDirectory }
+                        : {}),
+                    worktree: body.worktree,
+                    yolo: body.yolo ?? false,
+                    requestId: body.requestId,
+                }));
+            }
+            else {
+                if (Object.keys(body).length !== 0)
+                    throw new RequestBodyError(400, "invalid_json", "Expected an empty object");
+                const { id: sessionId } = sessionPath(url.pathname);
+                await operations.assertSupported(exit ? "exit" : archive ? "archive" : "delete", sessionId);
+                sendJson(response, 202, operations.manage(exit ? "exit" : archive ? "archive" : "delete", sessionId));
+            }
+            return true;
+        },
+        mapError(error, request, response) {
+            if (error instanceof ManagementError) {
+                sendJson(response, error.status, {
+                    error: { code: error.code, message: error.message },
+                }, request.method === "HEAD");
+                return true;
+            }
+            return false;
+        },
+    };
+}
+//# sourceMappingURL=session-management-routes.js.map