@spotpatch/dev-server 0.1.0

package/dist/index.js

@@ -0,0 +1,2438 @@
+// src/agent/job-manager.ts
+import { createHash, randomBytes } from "crypto";
+import {
+  applyPreparedAgentChange,
+  executeAgentChange,
+  inspectAgentWorkspace,
+  probeProviderCapability,
+  resolveProviderCredential,
+  revertPreparedAgentChange
+} from "@spotpatch/agent";
+import {
+  ERROR_CODES,
+  SpotPatchError
+} from "@spotpatch/shared";
+var MAX_RETAINED_JOBS = 32;
+var MAX_RETAINED_EVENTS = 512;
+var JOB_ID_PATTERN = /^[A-Za-z0-9_-]{22,128}$/;
+var ACTIVE_JOB_STATUSES = /* @__PURE__ */ new Set([
+  "queued",
+  "preparing",
+  "running",
+  "validating",
+  "awaiting-review",
+  "applying",
+  "cancelling",
+  "reverting"
+]);
+var CANCELLABLE_JOB_STATUSES = /* @__PURE__ */ new Set([
+  "queued",
+  "preparing",
+  "running",
+  "validating",
+  "awaiting-review"
+]);
+var PRUNABLE_JOB_STATUSES = /* @__PURE__ */ new Set([
+  "completed",
+  "cancelled",
+  "reverted",
+  "failed"
+]);
+var DEFAULT_DEPENDENCIES = Object.freeze({
+  applyChange: applyPreparedAgentChange,
+  createJobId: () => randomBytes(16).toString("base64url"),
+  executeChange: executeAgentChange,
+  inspectWorkspace: inspectAgentWorkspace,
+  now: () => (/* @__PURE__ */ new Date()).toISOString(),
+  probeCapability: probeProviderCapability,
+  resolveCredential: resolveProviderCredential,
+  revertChange: revertPreparedAgentChange
+});
+function normalizeError(error) {
+  return error instanceof SpotPatchError ? error : new SpotPatchError(ERROR_CODES.INTERNAL_ERROR, void 0, { cause: error });
+}
+function isActive(status) {
+  return ACTIVE_JOB_STATUSES.has(status);
+}
+function snapshot(job) {
+  const base = {
+    jobId: job.id,
+    status: job.status,
+    providerProfileId: job.provider.id,
+    providerLabel: job.provider.label,
+    modelProfileId: job.model.id,
+    modelLabel: job.model.label,
+    phaseMessage: job.phaseMessage,
+    createdAt: job.createdAt,
+    updatedAt: job.updatedAt,
+    canCancel: CANCELLABLE_JOB_STATUSES.has(job.status),
+    canApply: job.status === "awaiting-review" && job.preparedChange?.validationPassed === true && job.result !== void 0 && job.result.diff.length > 0,
+    canRevert: job.status === "applied"
+  };
+  return Object.freeze(
+    job.errorCode === void 0 ? base : { ...base, errorCode: job.errorCode }
+  );
+}
+function capabilityCacheKey(provider, model) {
+  const configurationDigest = createHash("sha256").update(provider.baseURL).update("\0").update(provider.protocol).update("\0").update(provider.authentication).digest("hex");
+  return `${provider.id}:${model.id}:${configurationDigest}`;
+}
+function freezeEvent(event) {
+  return Object.freeze(event);
+}
+function createAgentJobManager(options) {
+  const dependencies = Object.freeze({
+    ...DEFAULT_DEPENDENCIES,
+    ...options.dependencies
+  });
+  const jobs = /* @__PURE__ */ new Map();
+  const capabilityCache = /* @__PURE__ */ new Map();
+  const providerConsents = /* @__PURE__ */ new Set();
+  let closed = false;
+  const resolveSelection = (providerProfileId, modelProfileId) => {
+    const provider = options.ai.providers[providerProfileId];
+    if (provider === void 0) {
+      throw new SpotPatchError(ERROR_CODES.PROVIDER_NOT_CONFIGURED);
+    }
+    const model = provider.models[modelProfileId];
+    if (model === void 0) {
+      throw new SpotPatchError(ERROR_CODES.MODEL_NOT_ALLOWED);
+    }
+    const credential = dependencies.resolveCredential(
+      provider.apiKeyEnv,
+      options.environment
+    );
+    return Object.freeze({ credential, model, provider });
+  };
+  const requireJob = (jobId) => {
+    if (!JOB_ID_PATTERN.test(jobId)) {
+      throw new SpotPatchError(ERROR_CODES.INVALID_REQUEST);
+    }
+    const job = jobs.get(jobId);
+    if (job === void 0) {
+      throw new SpotPatchError(ERROR_CODES.INVALID_REQUEST);
+    }
+    return job;
+  };
+  const appendEvent = (job, event) => {
+    job.events.push(event);
+    if (job.events.length > MAX_RETAINED_EVENTS) {
+      job.events.splice(0, job.events.length - MAX_RETAINED_EVENTS);
+    }
+    for (const listener of job.listeners) {
+      listener(event);
+    }
+  };
+  const eventBase = (job) => {
+    job.sequence += 1;
+    return {
+      schemaVersion: 2,
+      sequence: job.sequence,
+      jobId: job.id,
+      status: job.status,
+      timestamp: dependencies.now()
+    };
+  };
+  const emitSnapshot = (job) => {
+    appendEvent(
+      job,
+      freezeEvent({
+        ...eventBase(job),
+        type: "snapshot",
+        data: Object.freeze({ snapshot: snapshot(job) })
+      })
+    );
+  };
+  const emitPhase = (job, message) => {
+    appendEvent(
+      job,
+      freezeEvent({
+        ...eventBase(job),
+        type: "phase",
+        data: Object.freeze({ message })
+      })
+    );
+  };
+  const emitError = (job, code) => {
+    appendEvent(
+      job,
+      freezeEvent({
+        ...eventBase(job),
+        type: "error",
+        data: Object.freeze({ code, message: "The Agent job failed." })
+      })
+    );
+  };
+  const transition = (job, status, phaseMessage, errorCode) => {
+    job.status = status;
+    job.phaseMessage = phaseMessage;
+    job.errorCode = errorCode;
+    job.updatedAt = dependencies.now();
+    emitSnapshot(job);
+    emitPhase(job, phaseMessage);
+  };
+  const probeResolved = async (selection, signal) => {
+    const key = capabilityCacheKey(selection.provider, selection.model);
+    const cached = capabilityCache.get(key);
+    if (cached !== void 0) {
+      return cached;
+    }
+    const capability = await dependencies.probeCapability({
+      provider: selection.provider,
+      modelProfileId: selection.model.id,
+      limits: options.ai.execution.limits,
+      credential: selection.credential,
+      signal,
+      ...options.fetch === void 0 ? {} : { fetch: options.fetch }
+    });
+    if (capability.state !== "agent-ready") {
+      throw new SpotPatchError(ERROR_CODES.MODEL_TOOL_CALL_UNSUPPORTED);
+    }
+    capabilityCache.set(key, capability);
+    return capability;
+  };
+  const finishWithError = (job, error) => {
+    const normalized = normalizeError(error);
+    const cancelled = job.controller.signal.aborted || normalized.code === ERROR_CODES.AGENT_CANCELLED;
+    transition(
+      job,
+      cancelled ? "cancelled" : "failed",
+      cancelled ? "Agent job cancelled." : "Agent job failed.",
+      cancelled ? ERROR_CODES.AGENT_CANCELLED : normalized.code
+    );
+    if (!cancelled) {
+      emitError(job, normalized.code);
+    }
+  };
+  const applyChange = async (job, preparedChange) => {
+    transition(job, "applying", "Applying validated changes to the project.");
+    try {
+      await dependencies.applyChange(preparedChange);
+      transition(job, "applied", "Changes were applied to local project files.");
+    } catch (error) {
+      const normalized = normalizeError(error);
+      transition(job, "failed", "Agent change could not be applied.", normalized.code);
+      emitError(job, normalized.code);
+      throw normalized;
+    }
+  };
+  const runJob = async (job) => {
+    try {
+      transition(job, "preparing", "Verifying provider and model capabilities.");
+      await probeResolved(
+        Object.freeze({
+          credential: job.credential,
+          model: job.model,
+          provider: job.provider
+        }),
+        job.controller.signal
+      );
+      const callbacks = {
+        onCheck(result) {
+          appendEvent(
+            job,
+            freezeEvent({
+              ...eventBase(job),
+              type: "check",
+              data: Object.freeze({ result })
+            })
+          );
+        },
+        onPhase(event) {
+          transition(job, event.phase, event.message);
+        },
+        onTool(event) {
+          appendEvent(
+            job,
+            freezeEvent({
+              ...eventBase(job),
+              type: "tool",
+              data: Object.freeze({ ...event })
+            })
+          );
+        }
+      };
+      const preparedChange = await dependencies.executeChange({
+        annotation: job.annotation,
+        callbacks,
+        credential: job.credential,
+        execution: options.ai.execution,
+        jobId: job.id,
+        model: job.model,
+        provider: job.provider,
+        root: options.root,
+        signal: job.controller.signal,
+        workingTreeMode: job.workingTreeMode,
+        ...options.fetch === void 0 ? {} : { fetch: options.fetch }
+      });
+      job.preparedChange = preparedChange;
+      job.result = preparedChange.result;
+      appendEvent(
+        job,
+        freezeEvent({
+          ...eventBase(job),
+          type: "result-ready",
+          data: Object.freeze({ hasResult: true })
+        })
+      );
+      if (!preparedChange.validationPassed) {
+        transition(
+          job,
+          "failed",
+          "Required validation checks failed.",
+          ERROR_CODES.VALIDATION_FAILED
+        );
+        emitError(job, ERROR_CODES.VALIDATION_FAILED);
+        return;
+      }
+      if (preparedChange.result.diff.length === 0) {
+        transition(job, "completed", "No source changes were proposed.");
+        return;
+      }
+      if (options.ai.execution.applyMode === "auto" && preparedChange.autoApplyEligible) {
+        try {
+          await applyChange(job, preparedChange);
+        } catch {
+        }
+        return;
+      }
+      transition(job, "awaiting-review", "Validated changes are ready for review.");
+    } catch (error) {
+      finishWithError(job, error);
+    }
+  };
+  const hasActiveJob = (excludedJobId) => [...jobs.values()].some((job) => job.id !== excludedJobId && isActive(job.status));
+  const pruneJobs = () => {
+    if (jobs.size < MAX_RETAINED_JOBS) {
+      return;
+    }
+    for (const [jobId, job] of jobs) {
+      if (PRUNABLE_JOB_STATUSES.has(job.status)) {
+        jobs.delete(jobId);
+      }
+      if (jobs.size < MAX_RETAINED_JOBS) {
+        return;
+      }
+    }
+  };
+  return Object.freeze({
+    async apply(jobId) {
+      const job = requireJob(jobId);
+      if (job.status !== "awaiting-review" || job.preparedChange === void 0 || !job.preparedChange.validationPassed || job.result?.diff.length === 0) {
+        throw new SpotPatchError(ERROR_CODES.PATCH_REJECTED);
+      }
+      await applyChange(job, job.preparedChange);
+      return snapshot(job);
+    },
+    cancel(jobId) {
+      const job = requireJob(jobId);
+      if (!CANCELLABLE_JOB_STATUSES.has(job.status)) {
+        return snapshot(job);
+      }
+      if (job.status === "awaiting-review") {
+        job.preparedChange = void 0;
+        job.controller.abort("agent-review-cancelled");
+        transition(
+          job,
+          "cancelled",
+          "Agent review was closed without applying changes.",
+          ERROR_CODES.AGENT_CANCELLED
+        );
+        return snapshot(job);
+      }
+      transition(job, "cancelling", "Cancelling Agent job.");
+      job.controller.abort("agent-job-cancelled");
+      return snapshot(job);
+    },
+    async close() {
+      if (closed) {
+        return;
+      }
+      closed = true;
+      for (const job of jobs.values()) {
+        if (CANCELLABLE_JOB_STATUSES.has(job.status)) {
+          job.controller.abort("vite-server-closed");
+        }
+      }
+      await Promise.allSettled(
+        [...jobs.values()].map((job) => job.runPromise).filter((promise) => promise !== void 0)
+      );
+      capabilityCache.clear();
+      providerConsents.clear();
+      jobs.clear();
+    },
+    create(request) {
+      if (closed) {
+        throw new SpotPatchError(ERROR_CODES.AI_DISABLED);
+      }
+      if (hasActiveJob()) {
+        throw new SpotPatchError(ERROR_CODES.AGENT_BUSY);
+      }
+      pruneJobs();
+      if (jobs.size >= MAX_RETAINED_JOBS) {
+        throw new SpotPatchError(ERROR_CODES.AGENT_BUSY);
+      }
+      const selection = resolveSelection(
+        request.providerProfileId,
+        request.modelProfileId
+      );
+      providerConsents.add(selection.provider.id);
+      const id = dependencies.createJobId();
+      if (!JOB_ID_PATTERN.test(id) || jobs.has(id)) {
+        throw new SpotPatchError(ERROR_CODES.INTERNAL_ERROR);
+      }
+      const timestamp = dependencies.now();
+      const job = {
+        annotation: request.annotation,
+        controller: new AbortController(),
+        createdAt: timestamp,
+        credential: selection.credential,
+        errorCode: void 0,
+        events: [],
+        id,
+        listeners: /* @__PURE__ */ new Set(),
+        model: selection.model,
+        phaseMessage: "Agent job queued.",
+        preparedChange: void 0,
+        provider: selection.provider,
+        result: void 0,
+        runPromise: void 0,
+        sequence: 0,
+        status: "queued",
+        updatedAt: timestamp,
+        workingTreeMode: request.workingTreeMode
+      };
+      jobs.set(id, job);
+      emitSnapshot(job);
+      emitPhase(job, job.phaseMessage);
+      job.runPromise = Promise.resolve().then(async () => runJob(job));
+      return snapshot(job);
+    },
+    events(jobId) {
+      return Object.freeze([...requireJob(jobId).events]);
+    },
+    async probe(request, signal) {
+      if (closed) {
+        throw new SpotPatchError(ERROR_CODES.AI_DISABLED);
+      }
+      return probeResolved(
+        resolveSelection(request.providerProfileId, request.modelProfileId),
+        signal
+      );
+    },
+    result(jobId) {
+      const job = requireJob(jobId);
+      const response = job.result === void 0 ? { snapshot: snapshot(job) } : { snapshot: snapshot(job), result: job.result };
+      return Object.freeze(response);
+    },
+    async revert(jobId) {
+      const job = requireJob(jobId);
+      if (job.status !== "applied" || job.preparedChange === void 0 || hasActiveJob(job.id)) {
+        throw new SpotPatchError(
+          hasActiveJob(job.id) ? ERROR_CODES.AGENT_BUSY : ERROR_CODES.APPLY_CONFLICT
+        );
+      }
+      transition(job, "reverting", "Reverting the applied Agent change.");
+      try {
+        await dependencies.revertChange(job.preparedChange);
+        transition(job, "reverted", "The Agent change was safely reverted.");
+      } catch (error) {
+        const normalized = normalizeError(error);
+        transition(
+          job,
+          "applied",
+          "Revert was rejected because project files changed.",
+          normalized.code
+        );
+        emitError(job, normalized.code);
+        throw normalized;
+      }
+      return snapshot(job);
+    },
+    subscribe(jobId, listener) {
+      const job = requireJob(jobId);
+      job.listeners.add(listener);
+      return () => {
+        job.listeners.delete(listener);
+      };
+    },
+    workspaceHealth(signal) {
+      if (closed) {
+        throw new SpotPatchError(ERROR_CODES.AI_DISABLED);
+      }
+      return dependencies.inspectWorkspace(options.root, signal);
+    }
+  });
+}
+
+// src/environment-ai.ts
+var AI_ENVIRONMENT_NAMES = Object.freeze({
+  authentication: "SPOTPATCH_AI_AUTHENTICATION",
+  baseURL: "SPOTPATCH_AI_BASE_URL",
+  credential: "SPOTPATCH_AI_API_KEY",
+  model: "SPOTPATCH_AI_MODEL",
+  protocol: "SPOTPATCH_AI_PROTOCOL"
+});
+function resolveCredentialEnvironment(options, environment) {
+  if (options.ai === false) {
+    return Object.freeze({});
+  }
+  const names = new Set(
+    Object.values(options.ai.providers).map((provider) => provider.apiKeyEnv)
+  );
+  const missing = [...names].filter((name) => {
+    const value = environment[name];
+    return value === void 0 || value.trim().length === 0;
+  });
+  if (missing.length > 0) {
+    throw new RangeError(
+      `SpotPatch AI credential environment is missing ${missing.join(", ")}.`
+    );
+  }
+  return Object.freeze(
+    Object.fromEntries(
+      [...names].map((name) => {
+        const value = environment[name];
+        if (value === void 0) {
+          throw new RangeError("SpotPatch AI credential resolution failed.");
+        }
+        return [name, value];
+      })
+    )
+  );
+}
+function normalizedValue(environment, name) {
+  const value = environment[name];
+  if (value === void 0 || value.trim().length === 0) {
+    return void 0;
+  }
+  return value.trim();
+}
+function resolveEnvironmentAiConfiguration(environment) {
+  const baseURL = normalizedValue(environment, AI_ENVIRONMENT_NAMES.baseURL);
+  const model = normalizedValue(environment, AI_ENVIRONMENT_NAMES.model);
+  const credential = normalizedValue(environment, AI_ENVIRONMENT_NAMES.credential);
+  const protocol = normalizedValue(environment, AI_ENVIRONMENT_NAMES.protocol);
+  const authentication = normalizedValue(
+    environment,
+    AI_ENVIRONMENT_NAMES.authentication
+  );
+  const configuredValues = [baseURL, model, credential, protocol, authentication];
+  if (configuredValues.every((value) => value === void 0)) {
+    return Object.freeze({ ai: false });
+  }
+  const missing = [
+    [AI_ENVIRONMENT_NAMES.baseURL, baseURL],
+    [AI_ENVIRONMENT_NAMES.model, model],
+    [AI_ENVIRONMENT_NAMES.credential, credential]
+  ].filter((entry) => entry[1] === void 0).map(([name]) => name);
+  if (missing.length > 0) {
+    throw new RangeError(
+      `SpotPatch AI environment configuration is incomplete; missing ${missing.join(", ")}.`
+    );
+  }
+  if (baseURL === void 0 || model === void 0 || credential === void 0) {
+    throw new RangeError("SpotPatch AI environment configuration is incomplete.");
+  }
+  if (protocol !== void 0 && protocol !== "responses" && protocol !== "chat-completions") {
+    throw new RangeError(
+      "SpotPatch SPOTPATCH_AI_PROTOCOL must be responses or chat-completions."
+    );
+  }
+  if (authentication !== void 0 && authentication !== "bearer" && authentication !== "x-api-key") {
+    throw new RangeError(
+      "SpotPatch SPOTPATCH_AI_AUTHENTICATION must be bearer or x-api-key."
+    );
+  }
+  return Object.freeze({
+    ai: Object.freeze({
+      baseURL,
+      model,
+      ...protocol === void 0 ? {} : { protocol },
+      ...authentication === void 0 ? {} : { authentication }
+    })
+  });
+}
+
+// src/options.ts
+import {
+  DEFAULT_AGENT_LIMITS,
+  MAX_ANNOTATION_TARGETS,
+  SPOTPATCH_EDITOR_PREFERENCES,
+  SPOTPATCH_LOCALE_PREFERENCES
+} from "@spotpatch/shared";
+import { z } from "zod";
+var DEFAULT_EXCLUDE = Object.freeze([
+  /node_modules/,
+  /\.test\.[jt]sx$/,
+  /\.spec\.[jt]sx$/,
+  /\.stories\.[jt]sx$/,
+  /(?:^|\/)dist(?:\/|$)/,
+  /(?:^|\/)coverage(?:\/|$)/
+]);
+var DEFAULT_INCLUDE = Object.freeze([/(?:^|[/\\])src[/\\].+\.(?:jsx|tsx)$/]);
+var DEFAULT_BUDGET = Object.freeze({
+  totalCharacters: 16e3,
+  domCharacters: 3e3,
+  cssCharacters: 4e3,
+  codeCharacters: 7e3,
+  maxCodeLines: 80,
+  maxComponentDepth: 8
+});
+var DEFAULT_OPTIONS = Object.freeze({
+  enabled: true,
+  include: DEFAULT_INCLUDE,
+  exclude: DEFAULT_EXCLUDE,
+  editor: "auto",
+  redact: true,
+  budget: DEFAULT_BUDGET,
+  shortcut: "Mod+Shift+S",
+  allowLan: false,
+  debug: false,
+  locale: "auto",
+  maxTargets: 8,
+  ai: false
+});
+var PROFILE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+var ENV_NAME_PATTERN = /^[A-Z][A-Z0-9_]{1,127}$/;
+var agentLimitsSchema = z.strictObject({
+  maxTurns: z.number().optional(),
+  maxToolCalls: z.number().optional(),
+  maxChangedFiles: z.number().optional(),
+  maxDiffBytes: z.number().optional(),
+  maxReadBytesPerFile: z.number().optional(),
+  maxToolOutputCharacters: z.number().optional(),
+  maxProviderResponseBytes: z.number().optional(),
+  providerConnectTimeoutMs: z.number().optional(),
+  providerFirstByteTimeoutMs: z.number().optional(),
+  providerIdleTimeoutMs: z.number().optional(),
+  checkTimeoutMs: z.number().optional(),
+  jobTimeoutMs: z.number().optional()
+}).optional();
+var agentCheckSchema = z.strictObject({
+  label: z.string(),
+  command: z.string(),
+  args: z.array(z.string()).optional(),
+  required: z.boolean().optional(),
+  timeoutMs: z.number().optional()
+});
+var aiOptionsSchema = z.strictObject({
+  providers: z.record(
+    z.string(),
+    z.strictObject({
+      type: z.literal("openai-compatible"),
+      label: z.string(),
+      protocol: z.enum(["responses", "chat-completions"]),
+      authentication: z.enum(["bearer", "x-api-key"]).optional(),
+      baseURL: z.string(),
+      apiKeyEnv: z.string(),
+      models: z.record(
+        z.string(),
+        z.strictObject({ label: z.string(), model: z.string() })
+      ),
+      defaultModel: z.string()
+    })
+  ),
+  defaultProvider: z.string(),
+  execution: z.strictObject({
+    isolation: z.literal("git-worktree").optional(),
+    applyMode: z.enum(["review", "auto"]).optional(),
+    checks: z.record(z.string(), agentCheckSchema).optional(),
+    limits: agentLimitsSchema
+  }).optional()
+});
+var simpleAiOptionsSchema = z.strictObject({
+  baseURL: z.string(),
+  model: z.string(),
+  apiKeyEnv: z.string().optional(),
+  protocol: z.enum(["responses", "chat-completions"]).optional(),
+  authentication: z.enum(["bearer", "x-api-key"]).optional(),
+  providerLabel: z.string().optional(),
+  modelLabel: z.string().optional(),
+  execution: aiOptionsSchema.shape.execution
+});
+function assertIdentifier(value, label) {
+  if (!PROFILE_ID_PATTERN.test(value)) {
+    throw new RangeError(
+      `SpotPatch ${label} must contain only letters, numbers, dot, underscore, or hyphen.`
+    );
+  }
+}
+function nonEmpty(value, label, maximum = 256) {
+  const normalized = value.trim();
+  if (normalized.length === 0 || normalized.length > maximum || value.includes("\0")) {
+    throw new RangeError(`SpotPatch ${label} is invalid.`);
+  }
+  return normalized;
+}
+function normalizeProviderBaseURL(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new RangeError("SpotPatch AI provider baseURL must be a valid URL.");
+  }
+  const loopbackHosts = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+  const allowedProtocol = url.protocol === "https:" || url.protocol === "http:" && loopbackHosts.has(url.hostname);
+  if (!allowedProtocol || url.username.length > 0 || url.password.length > 0 || url.search.length > 0 || url.hash.length > 0) {
+    throw new RangeError("SpotPatch AI provider baseURL violates URL policy.");
+  }
+  url.pathname = url.pathname.replace(/\/{2,}/g, "/").replace(/\/$/, "");
+  return url.toString().replace(/\/$/, "");
+}
+function resolveLimits(limits) {
+  const resolved = Object.freeze({
+    maxTurns: limits?.maxTurns ?? DEFAULT_AGENT_LIMITS.maxTurns,
+    maxToolCalls: limits?.maxToolCalls ?? DEFAULT_AGENT_LIMITS.maxToolCalls,
+    maxChangedFiles: limits?.maxChangedFiles ?? DEFAULT_AGENT_LIMITS.maxChangedFiles,
+    maxDiffBytes: limits?.maxDiffBytes ?? DEFAULT_AGENT_LIMITS.maxDiffBytes,
+    maxReadBytesPerFile: limits?.maxReadBytesPerFile ?? DEFAULT_AGENT_LIMITS.maxReadBytesPerFile,
+    maxToolOutputCharacters: limits?.maxToolOutputCharacters ?? DEFAULT_AGENT_LIMITS.maxToolOutputCharacters,
+    maxProviderResponseBytes: limits?.maxProviderResponseBytes ?? DEFAULT_AGENT_LIMITS.maxProviderResponseBytes,
+    providerConnectTimeoutMs: limits?.providerConnectTimeoutMs ?? DEFAULT_AGENT_LIMITS.providerConnectTimeoutMs,
+    providerFirstByteTimeoutMs: limits?.providerFirstByteTimeoutMs ?? DEFAULT_AGENT_LIMITS.providerFirstByteTimeoutMs,
+    providerIdleTimeoutMs: limits?.providerIdleTimeoutMs ?? DEFAULT_AGENT_LIMITS.providerIdleTimeoutMs,
+    checkTimeoutMs: limits?.checkTimeoutMs ?? DEFAULT_AGENT_LIMITS.checkTimeoutMs,
+    jobTimeoutMs: limits?.jobTimeoutMs ?? DEFAULT_AGENT_LIMITS.jobTimeoutMs
+  });
+  for (const [name, value] of Object.entries(resolved)) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+      throw new RangeError(`SpotPatch AI limit ${name} must be a positive integer.`);
+    }
+  }
+  return resolved;
+}
+function resolveModels(models) {
+  const entries = Object.entries(models);
+  if (entries.length === 0) {
+    throw new RangeError("SpotPatch AI provider must declare at least one model.");
+  }
+  return Object.freeze(
+    Object.fromEntries(
+      entries.map(([id, model]) => {
+        assertIdentifier(id, "model profile id");
+        return [
+          id,
+          Object.freeze({
+            id,
+            label: nonEmpty(model.label, "model label", 100),
+            model: nonEmpty(model.model, "provider model name")
+          })
+        ];
+      })
+    )
+  );
+}
+function resolveProviders(providers) {
+  const entries = Object.entries(providers);
+  if (entries.length === 0) {
+    throw new RangeError("SpotPatch AI must declare at least one provider.");
+  }
+  return Object.freeze(
+    Object.fromEntries(
+      entries.map(([id, provider]) => {
+        assertIdentifier(id, "provider profile id");
+        if (!ENV_NAME_PATTERN.test(provider.apiKeyEnv) || provider.apiKeyEnv.startsWith("VITE_")) {
+          throw new RangeError(
+            "SpotPatch AI apiKeyEnv must be an uppercase non-VITE environment name."
+          );
+        }
+        const models = resolveModels(provider.models);
+        if (!(provider.defaultModel in models)) {
+          throw new RangeError(
+            "SpotPatch AI provider defaultModel must reference a configured model."
+          );
+        }
+        return [
+          id,
+          Object.freeze({
+            id,
+            type: provider.type,
+            label: nonEmpty(provider.label, "provider label", 100),
+            protocol: provider.protocol,
+            authentication: provider.authentication ?? "bearer",
+            baseURL: normalizeProviderBaseURL(provider.baseURL),
+            apiKeyEnv: provider.apiKeyEnv,
+            models,
+            defaultModel: provider.defaultModel
+          })
+        ];
+      })
+    )
+  );
+}
+function resolveChecks(checks, defaultTimeoutMs) {
+  return Object.freeze(
+    Object.fromEntries(
+      Object.entries(checks ?? {}).map(([id, check]) => {
+        assertIdentifier(id, "check id");
+        const timeoutMs = check.timeoutMs ?? defaultTimeoutMs;
+        if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) {
+          throw new RangeError("SpotPatch AI check timeout must be positive.");
+        }
+        const args = Object.freeze(
+          [...check.args ?? []].map(
+            (argument) => nonEmpty(argument, "check argument", 4096)
+          )
+        );
+        return [
+          id,
+          Object.freeze({
+            id,
+            label: nonEmpty(check.label, "check label", 100),
+            command: nonEmpty(check.command, "check command", 1024),
+            args,
+            required: check.required ?? true,
+            timeoutMs
+          })
+        ];
+      })
+    )
+  );
+}
+function resolveAiOptions(options) {
+  if (options === void 0 || options === false) {
+    return false;
+  }
+  const expanded = "providers" in options ? options : (() => {
+    const simple = simpleAiOptionsSchema.safeParse(options);
+    if (!simple.success) {
+      throw new RangeError("SpotPatch AI configuration is invalid.");
+    }
+    const providerId = "default";
+    const modelId = "default";
+    return {
+      providers: {
+        [providerId]: {
+          type: "openai-compatible",
+          label: simple.data.providerLabel ?? "AI provider",
+          protocol: simple.data.protocol ?? "chat-completions",
+          authentication: simple.data.authentication ?? "bearer",
+          baseURL: simple.data.baseURL,
+          apiKeyEnv: simple.data.apiKeyEnv ?? "SPOTPATCH_AI_API_KEY",
+          models: {
+            [modelId]: {
+              label: simple.data.modelLabel ?? "AI model",
+              model: simple.data.model
+            }
+          },
+          defaultModel: modelId
+        }
+      },
+      defaultProvider: providerId,
+      ...simple.data.execution === void 0 ? {} : { execution: simple.data.execution }
+    };
+  })();
+  const parsed = aiOptionsSchema.safeParse(expanded);
+  if (!parsed.success) {
+    throw new RangeError("SpotPatch AI configuration is invalid.");
+  }
+  const validated = parsed.data;
+  const limits = resolveLimits(validated.execution?.limits);
+  const checks = resolveChecks(validated.execution?.checks, limits.checkTimeoutMs);
+  const applyMode = validated.execution?.applyMode ?? "review";
+  if (applyMode === "auto" && !Object.values(checks).some((check) => check.required)) {
+    throw new RangeError("SpotPatch AI auto mode requires a required check.");
+  }
+  const providers = resolveProviders(validated.providers);
+  if (!(validated.defaultProvider in providers)) {
+    throw new RangeError(
+      "SpotPatch AI defaultProvider must reference a configured provider."
+    );
+  }
+  return Object.freeze({
+    providers,
+    defaultProvider: validated.defaultProvider,
+    execution: Object.freeze({
+      isolation: "git-worktree",
+      applyMode,
+      checks,
+      limits
+    })
+  });
+}
+function createRuntimeAiConfig(options) {
+  if (options === false) {
+    return Object.freeze({ enabled: false });
+  }
+  return Object.freeze({
+    enabled: true,
+    defaultProvider: options.defaultProvider,
+    applyMode: options.execution.applyMode,
+    providers: Object.freeze(
+      Object.values(options.providers).map(
+        (provider) => Object.freeze({
+          id: provider.id,
+          label: provider.label,
+          protocol: provider.protocol,
+          defaultModel: provider.defaultModel,
+          models: Object.freeze(
+            Object.values(provider.models).map(
+              (model) => Object.freeze({ id: model.id, label: model.label })
+            )
+          )
+        })
+      )
+    )
+  });
+}
+function assertPositiveBudget(budget) {
+  for (const [name, value] of Object.entries(budget)) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+      throw new RangeError(`SpotPatch budget ${name} must be a positive integer.`);
+    }
+  }
+}
+function resolveOptions(options = {}, environmentAi) {
+  const budget = Object.freeze({
+    ...DEFAULT_OPTIONS.budget,
+    ...options.budget
+  });
+  assertPositiveBudget(budget);
+  const maxTargets = options.maxTargets ?? DEFAULT_OPTIONS.maxTargets;
+  const locale = options.locale ?? DEFAULT_OPTIONS.locale;
+  const editor = options.editor ?? DEFAULT_OPTIONS.editor;
+  if (!SPOTPATCH_LOCALE_PREFERENCES.includes(locale)) {
+    throw new RangeError("SpotPatch locale must be auto, en-US, or zh-CN.");
+  }
+  if (!SPOTPATCH_EDITOR_PREFERENCES.includes(editor)) {
+    throw new RangeError("SpotPatch editor must be auto, vscode, or cursor.");
+  }
+  if (!Number.isSafeInteger(maxTargets) || maxTargets < 1 || maxTargets > MAX_ANNOTATION_TARGETS) {
+    throw new RangeError(
+      `SpotPatch maxTargets must be an integer between 1 and ${String(MAX_ANNOTATION_TARGETS)}.`
+    );
+  }
+  const resolved = {
+    enabled: options.enabled ?? DEFAULT_OPTIONS.enabled,
+    include: Object.freeze([...options.include ?? DEFAULT_OPTIONS.include]),
+    exclude: Object.freeze([...options.exclude ?? DEFAULT_OPTIONS.exclude]),
+    editor,
+    redact: options.redact ?? DEFAULT_OPTIONS.redact,
+    budget,
+    shortcut: options.shortcut ?? DEFAULT_OPTIONS.shortcut,
+    allowLan: options.allowLan ?? DEFAULT_OPTIONS.allowLan,
+    debug: options.debug ?? DEFAULT_OPTIONS.debug,
+    locale,
+    maxTargets,
+    ai: resolveAiOptions(options.ai ?? environmentAi)
+  };
+  if (resolved.shortcut.trim().length === 0 || resolved.shortcut.length > 128 || resolved.shortcut.includes("\0")) {
+    throw new RangeError("SpotPatch shortcut is invalid.");
+  }
+  return Object.freeze(resolved);
+}
+
+// src/registry/source-registry.ts
+import path from "path";
+
+// src/registry/source-id.ts
+import { randomBytes as randomBytes2 } from "crypto";
+var SOURCE_ID_BYTES = 8;
+var createRandomSourceId = () => randomBytes2(SOURCE_ID_BYTES).toString("base64url");
+
+// src/registry/source-registry.ts
+function normalizeAbsolutePath(absolutePath) {
+  return path.normalize(path.resolve(absolutePath));
+}
+function createSourceRegistry(options = {}) {
+  const createId = options.createId ?? createRandomSourceId;
+  const pathToId = /* @__PURE__ */ new Map();
+  const idToPath = /* @__PURE__ */ new Map();
+  return Object.freeze({
+    register(absolutePath) {
+      const normalizedPath = normalizeAbsolutePath(absolutePath);
+      const existingId = pathToId.get(normalizedPath);
+      if (existingId !== void 0) {
+        return existingId;
+      }
+      let fileId = createId();
+      while (idToPath.has(fileId)) {
+        fileId = createId();
+      }
+      pathToId.set(normalizedPath, fileId);
+      idToPath.set(fileId, normalizedPath);
+      return fileId;
+    },
+    resolve(fileId) {
+      return idToPath.get(fileId);
+    },
+    clear() {
+      pathToId.clear();
+      idToPath.clear();
+    }
+  });
+}
+
+// src/server/middleware.ts
+import {
+  ERROR_CODES as ERROR_CODES9,
+  SPOTPATCH_API_BASE,
+  SPOTPATCH_ENDPOINTS as SPOTPATCH_ENDPOINTS2,
+  SpotPatchError as SpotPatchError9,
+  openEditorRequestSchema,
+  sourceContextRequestSchema
+} from "@spotpatch/shared";
+
+// src/server/agent-http.ts
+import {
+  ERROR_CODES as ERROR_CODES6,
+  SPOTPATCH_ENDPOINTS,
+  SpotPatchError as SpotPatchError6,
+  agentCapabilityRequestSchema,
+  agentJobActionRequestSchema,
+  agentJobCreateRequestSchema,
+  agentWorkspaceHealthRequestSchema
+} from "@spotpatch/shared";
+
+// src/server/agent-request.ts
+import { realpath as realpath3 } from "fs/promises";
+import path4 from "path";
+import {
+  ERROR_CODES as ERROR_CODES4,
+  SpotPatchError as SpotPatchError4
+} from "@spotpatch/shared";
+
+// src/server/source-context.ts
+import { readFile, realpath as realpath2 } from "fs/promises";
+import path3 from "path";
+import {
+  ERROR_CODES as ERROR_CODES3,
+  SpotPatchError as SpotPatchError3
+} from "@spotpatch/shared";
+
+// src/server/extract-code-context.ts
+import {
+  parseSync,
+  Visitor
+} from "oxc-parser";
+function isComponentName(name) {
+  return /^[A-Z]/u.test(name);
+}
+function unwrapTypeExpression(expression) {
+  switch (expression.type) {
+    case "TSAsExpression":
+    case "TSSatisfiesExpression":
+    case "TSTypeAssertion":
+    case "TSNonNullExpression":
+    case "TSInstantiationExpression":
+      return unwrapTypeExpression(expression.expression);
+    default:
+      return expression;
+  }
+}
+function calleeName(expression) {
+  const unwrapped = unwrapTypeExpression(expression);
+  if (unwrapped.type === "Identifier") {
+    return unwrapped.name;
+  }
+  if (unwrapped.type === "MemberExpression" && !unwrapped.computed) {
+    return unwrapped.property.type === "Identifier" ? unwrapped.property.name : void 0;
+  }
+  return void 0;
+}
+function isFunctionExpression(expression) {
+  const unwrapped = unwrapTypeExpression(expression);
+  return unwrapped.type === "ArrowFunctionExpression" || unwrapped.type === "FunctionExpression";
+}
+function isSupportedComponentInitializer(expression) {
+  const unwrapped = unwrapTypeExpression(expression);
+  if (isFunctionExpression(unwrapped)) {
+    return true;
+  }
+  if (unwrapped.type !== "CallExpression") {
+    return false;
+  }
+  const name = calleeName(unwrapped.callee);
+  if (name !== "memo" && name !== "forwardRef") {
+    return false;
+  }
+  const firstArgument = unwrapped.arguments[0];
+  return firstArgument !== void 0 && firstArgument.type !== "SpreadElement" && (isFunctionExpression(firstArgument) || isSupportedComponentInitializer(firstArgument));
+}
+function variableComponent(node) {
+  if (node.id.type !== "Identifier" || !isComponentName(node.id.name) || node.init === null || !isSupportedComponentInitializer(node.init)) {
+    return void 0;
+  }
+  return Object.freeze({ start: node.start, end: node.end, name: node.id.name });
+}
+function functionComponent(node) {
+  return node.id !== null && isComponentName(node.id.name) && node.body !== null ? Object.freeze({ start: node.start, end: node.end, name: node.id.name }) : void 0;
+}
+function isReactComponentSuperclass(expression) {
+  if (expression === null) {
+    return false;
+  }
+  const unwrapped = unwrapTypeExpression(expression);
+  if (unwrapped.type === "Identifier") {
+    return unwrapped.name === "Component" || unwrapped.name === "PureComponent";
+  }
+  return unwrapped.type === "MemberExpression" && !unwrapped.computed && unwrapped.object.type === "Identifier" && unwrapped.object.name === "React" && (unwrapped.property.name === "Component" || unwrapped.property.name === "PureComponent");
+}
+function classComponent(node) {
+  return node.id !== null && isComponentName(node.id.name) && isReactComponentSuperclass(node.superClass) ? Object.freeze({ start: node.start, end: node.end, name: node.id.name }) : void 0;
+}
+function selectedOffset(source, line, column) {
+  const lines = source.split(/\r?\n/u);
+  if (line < 1 || line > lines.length) {
+    return void 0;
+  }
+  const lineStart = lines.slice(0, line - 1).reduce((total, value) => total + value.length + 1, 0);
+  const lineLength = lines[line - 1]?.length ?? 0;
+  return lineStart + Math.min(Math.max(0, column - 1), lineLength);
+}
+function findComponentSpan(options) {
+  const offset = selectedOffset(options.source, options.line, options.column);
+  if (offset === void 0) {
+    return void 0;
+  }
+  let parseResult;
+  try {
+    parseResult = parseSync(options.sourcePath, options.source, {
+      sourceType: "module"
+    });
+  } catch {
+    return void 0;
+  }
+  if (parseResult.errors.length > 0) {
+    return void 0;
+  }
+  const jsxNodes = [];
+  const components = [];
+  const visitor = new Visitor({
+    JSXElement(node) {
+      jsxNodes.push(node);
+    },
+    JSXFragment(node) {
+      jsxNodes.push(node);
+    },
+    FunctionDeclaration(node) {
+      const candidate = functionComponent(node);
+      if (candidate !== void 0) {
+        components.push(candidate);
+      }
+    },
+    VariableDeclarator(node) {
+      const candidate = variableComponent(node);
+      if (candidate !== void 0) {
+        components.push(candidate);
+      }
+    },
+    ClassDeclaration(node) {
+      const candidate = classComponent(node);
+      if (candidate !== void 0) {
+        components.push(candidate);
+      }
+    }
+  });
+  visitor.visit(parseResult.program);
+  const selectedJsx = jsxNodes.filter((node) => node.start <= offset && node.end >= offset).sort((left, right) => left.end - left.start - (right.end - right.start))[0];
+  if (selectedJsx === void 0) {
+    return void 0;
+  }
+  return components.filter(
+    (component) => component.start <= selectedJsx.start && component.end >= selectedJsx.end
+  ).sort((left, right) => left.end - left.start - (right.end - right.start))[0];
+}
+function lineAtOffset(source, offset) {
+  let line = 1;
+  for (let index = 0; index < offset; index += 1) {
+    if (source[index] === "\n") {
+      line += 1;
+    }
+  }
+  return line;
+}
+function componentRange(source, component) {
+  return Object.freeze({
+    startLine: lineAtOffset(source, component.start),
+    endLine: lineAtOffset(source, Math.max(component.start, component.end - 1))
+  });
+}
+function truncateSelectedLine(line, column, maxCharacters) {
+  if (line.length <= maxCharacters) {
+    return line;
+  }
+  if (maxCharacters === 1) {
+    return "\u2026";
+  }
+  const contentCharacters = maxCharacters - 2;
+  const desiredStart = Math.max(0, column - 1 - Math.floor(contentCharacters / 2));
+  const start = Math.min(desiredStart, line.length - contentCharacters);
+  const end = start + contentCharacters;
+  return `${start > 0 ? "\u2026" : ""}${line.slice(start, end)}${end < line.length ? "\u2026" : ""}`.slice(
+    0,
+    maxCharacters
+  );
+}
+function boundedRange(lines, selectedLine, column, initialStart, initialEnd, maxCharacters) {
+  let startLine = initialStart;
+  let endLine = initialEnd;
+  let excerpt = lines.slice(startLine - 1, endLine).join("\n");
+  while (excerpt.length > maxCharacters && startLine < endLine) {
+    if (endLine - selectedLine >= selectedLine - startLine) {
+      endLine -= 1;
+    } else {
+      startLine += 1;
+    }
+    excerpt = lines.slice(startLine - 1, endLine).join("\n");
+  }
+  if (excerpt.length > maxCharacters) {
+    startLine = selectedLine;
+    endLine = selectedLine;
+    excerpt = truncateSelectedLine(
+      lines[selectedLine - 1] ?? "",
+      column,
+      maxCharacters
+    );
+  }
+  return Object.freeze({ startLine, endLine, excerpt });
+}
+function nearbyContext(options) {
+  const lines = options.source.split(/\r?\n/u);
+  const initialStart = Math.max(1, options.line - Math.floor(options.maxLines / 2));
+  const initialEnd = Math.min(lines.length, initialStart + options.maxLines - 1);
+  const startLine = Math.max(1, initialEnd - options.maxLines + 1);
+  const bounded = boundedRange(
+    lines,
+    options.line,
+    options.column,
+    startLine,
+    initialEnd,
+    options.maxCharacters
+  );
+  return Object.freeze({
+    relativePath: options.relativePath,
+    language: options.language,
+    startLine: bounded.startLine,
+    endLine: bounded.endLine,
+    excerpt: bounded.excerpt,
+    boundary: "nearby-lines"
+  });
+}
+function extractCodeContext(options) {
+  const component = findComponentSpan(options);
+  if (component !== void 0) {
+    const range = componentRange(options.source, component);
+    const lineCount = range.endLine - range.startLine + 1;
+    const excerpt = options.source.split(/\r?\n/u).slice(range.startLine - 1, range.endLine).join("\n");
+    if (lineCount <= options.maxLines && excerpt.length <= options.maxCharacters) {
+      return Object.freeze({
+        relativePath: options.relativePath,
+        language: options.language,
+        startLine: range.startLine,
+        endLine: range.endLine,
+        excerpt,
+        boundary: "component"
+      });
+    }
+  }
+  return nearbyContext(options);
+}
+
+// src/server/source-file.ts
+import { realpath, stat } from "fs/promises";
+import path2 from "path";
+import { ERROR_CODES as ERROR_CODES2, SpotPatchError as SpotPatchError2 } from "@spotpatch/shared";
+
+// src/server/constants.ts
+var MAX_REQUEST_BODY_BYTES = 32 * 1024;
+var MAX_AGENT_REQUEST_BODY_BYTES = 256 * 1024;
+var MAX_SOURCE_FILE_BYTES = 1024 * 1024;
+
+// src/server/source-file.ts
+var ALLOWED_EXTENSIONS = /* @__PURE__ */ new Set([".jsx", ".tsx"]);
+function isMissingFileError(error) {
+  return error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
+}
+async function assertInsideRoot(root, candidate) {
+  let realRoot;
+  let realCandidate;
+  try {
+    [realRoot, realCandidate] = await Promise.all([
+      realpath(root),
+      realpath(candidate)
+    ]);
+  } catch (error) {
+    if (isMissingFileError(error)) {
+      throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND, void 0, {
+        cause: error
+      });
+    }
+    throw error;
+  }
+  const relative = path2.relative(realRoot, realCandidate);
+  const outside = relative.startsWith(`..${path2.sep}`) || relative === ".." || path2.isAbsolute(relative);
+  if (outside) {
+    throw new SpotPatchError2(ERROR_CODES2.SOURCE_OUTSIDE_ROOT);
+  }
+  return realCandidate;
+}
+async function resolveSourceFile(options) {
+  const registeredPath = options.registry.resolve(options.fileId);
+  if (registeredPath === void 0) {
+    throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND);
+  }
+  const sourcePath = await assertInsideRoot(options.root, registeredPath);
+  if (!ALLOWED_EXTENSIONS.has(path2.extname(sourcePath).toLowerCase())) {
+    throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND);
+  }
+  let sourceStat;
+  try {
+    sourceStat = await stat(sourcePath);
+  } catch (error) {
+    if (isMissingFileError(error)) {
+      throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND, void 0, {
+        cause: error
+      });
+    }
+    throw error;
+  }
+  if (!sourceStat.isFile()) {
+    throw new SpotPatchError2(ERROR_CODES2.SOURCE_NOT_FOUND);
+  }
+  if (sourceStat.size > MAX_SOURCE_FILE_BYTES) {
+    throw new SpotPatchError2(ERROR_CODES2.SOURCE_TOO_LARGE);
+  }
+  return sourcePath;
+}
+
+// src/server/source-context.ts
+function toDisplayPath(root, sourcePath) {
+  return path3.relative(root, sourcePath).split(path3.sep).join("/");
+}
+async function readSourceContext(options) {
+  const sourcePath = await resolveSourceFile({
+    fileId: options.request.fileId,
+    registry: options.registry,
+    root: options.root
+  });
+  let source;
+  try {
+    source = await readFile(sourcePath, "utf8");
+  } catch (error) {
+    if (error instanceof Error && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR")) {
+      throw new SpotPatchError3(ERROR_CODES3.SOURCE_NOT_FOUND, void 0, {
+        cause: error
+      });
+    }
+    throw error;
+  }
+  const lines = source.split(/\r?\n/);
+  if (options.request.line > lines.length) {
+    throw new SpotPatchError3(ERROR_CODES3.INVALID_REQUEST);
+  }
+  const extension = path3.extname(sourcePath).toLowerCase();
+  return extractCodeContext({
+    source,
+    sourcePath,
+    relativePath: toDisplayPath(await realpath2(options.root), sourcePath),
+    language: extension === ".tsx" ? "tsx" : "jsx",
+    line: options.request.line,
+    column: options.request.column,
+    maxLines: Math.min(options.request.maxLines, options.maxLines),
+    maxCharacters: options.maxCharacters
+  });
+}
+
+// src/server/agent-request.ts
+function compactSourceRef(source) {
+  return Object.freeze({
+    origin: source.origin,
+    confidence: source.confidence,
+    ...source.fileId === void 0 ? {} : { fileId: source.fileId },
+    ...source.relativePath === void 0 ? {} : { relativePath: source.relativePath },
+    ...source.line === void 0 ? {} : { line: source.line },
+    ...source.column === void 0 ? {} : { column: source.column }
+  });
+}
+async function authorizeSourceRef(source, registry, root) {
+  const markerOrigin = source.origin === "jsx-host" || source.origin === "dom-ancestor";
+  if (markerOrigin && (source.fileId === void 0 || source.line === void 0 || source.column === void 0)) {
+    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
+  }
+  if (source.fileId === void 0) {
+    if (source.origin === "none" && source.relativePath !== void 0) {
+      throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
+    }
+    return compactSourceRef(source);
+  }
+  const sourcePath = await resolveSourceFile({
+    fileId: source.fileId,
+    registry,
+    root
+  });
+  const relativePath = path4.relative(await realpath3(root), sourcePath).split(path4.sep).join("/");
+  if (source.relativePath !== void 0 && source.relativePath !== relativePath) {
+    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
+  }
+  return Object.freeze({
+    ...compactSourceRef(source),
+    relativePath
+  });
+}
+function freezeMatchedRule(rule) {
+  return Object.freeze({
+    selector: rule.selector,
+    declarations: rule.declarations,
+    ...rule.source === void 0 ? {} : { source: rule.source },
+    ...rule.media === void 0 ? {} : { media: rule.media }
+  });
+}
+function targetIdentity(target) {
+  const source = target.source;
+  if (source.fileId !== void 0 && source.line !== void 0 && source.column !== void 0) {
+    return `source:${source.fileId}:${String(source.line)}:${String(source.column)}`;
+  }
+  return [
+    "element",
+    source.origin,
+    source.relativePath ?? "",
+    target.element.selector,
+    target.element.sanitizedHtml
+  ].join("\0");
+}
+async function authorizeTarget(target, input) {
+  const source = await authorizeSourceRef(target.source, input.registry, input.root);
+  const reactSourceInput = target.react.source;
+  const reactSource = reactSourceInput === void 0 ? void 0 : await authorizeSourceRef(reactSourceInput, input.registry, input.root);
+  const marker = source.fileId === void 0 || source.line === void 0 || source.column === void 0 ? void 0 : Object.freeze({
+    fileId: source.fileId,
+    line: source.line,
+    column: source.column,
+    maxLines: input.options.budget.maxCodeLines
+  });
+  if (marker === void 0 && target.code !== void 0) {
+    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
+  }
+  const code = marker === void 0 ? void 0 : await readSourceContext({
+    request: marker,
+    registry: input.registry,
+    root: input.root,
+    maxCharacters: input.options.budget.codeCharacters,
+    maxLines: input.options.budget.maxCodeLines
+  });
+  if (target.code !== void 0 && target.code.relativePath !== code?.relativePath) {
+    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
+  }
+  return Object.freeze({
+    instruction: target.instruction,
+    source,
+    react: Object.freeze({
+      supported: target.react.supported,
+      ...target.react.version === void 0 ? {} : { version: target.react.version },
+      ...target.react.componentName === void 0 ? {} : { componentName: target.react.componentName },
+      componentStack: Object.freeze([...target.react.componentStack]),
+      ...reactSource === void 0 ? {} : { source: reactSource }
+    }),
+    element: Object.freeze({
+      tagName: target.element.tagName,
+      selector: target.element.selector,
+      sanitizedHtml: target.element.sanitizedHtml,
+      ...target.element.textPreview === void 0 ? {} : { textPreview: target.element.textPreview },
+      ...target.element.role === void 0 ? {} : { role: target.element.role },
+      rect: Object.freeze({ ...target.element.rect })
+    }),
+    styles: Object.freeze({
+      classNames: Object.freeze([...target.styles.classNames]),
+      ...target.styles.inlineStyle === void 0 ? {} : { inlineStyle: target.styles.inlineStyle },
+      matchedRules: Object.freeze(target.styles.matchedRules.map(freezeMatchedRule)),
+      computed: Object.freeze({ ...target.styles.computed }),
+      warnings: Object.freeze([...target.styles.warnings])
+    }),
+    ...code === void 0 ? {} : { code: Object.freeze({ ...code }) },
+    warnings: Object.freeze([...target.warnings])
+  });
+}
+async function authorizeAgentJobRequest(input) {
+  const requestedTargets = input.request.annotation.targets;
+  if (requestedTargets.length > input.options.maxTargets) {
+    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
+  }
+  const identities = requestedTargets.map(targetIdentity);
+  if (new Set(identities).size !== identities.length) {
+    throw new SpotPatchError4(ERROR_CODES4.INVALID_REQUEST);
+  }
+  const targets = Object.freeze(
+    await Promise.all(requestedTargets.map((target) => authorizeTarget(target, input)))
+  );
+  const annotation = Object.freeze({
+    schemaVersion: 3,
+    id: input.request.annotation.id,
+    locale: input.request.annotation.locale,
+    page: Object.freeze({ ...input.request.annotation.page }),
+    targets,
+    createdAt: input.request.annotation.createdAt
+  });
+  return Object.freeze({
+    annotation,
+    providerProfileId: input.request.providerProfileId,
+    modelProfileId: input.request.modelProfileId,
+    providerDataConsent: true,
+    workingTreeMode: input.request.workingTreeMode
+  });
+}
+
+// src/server/request-body.ts
+import { ERROR_CODES as ERROR_CODES5, SpotPatchError as SpotPatchError5 } from "@spotpatch/shared";
+function isJsonContentType(value) {
+  return value?.split(";", 1)[0]?.trim().toLowerCase() === "application/json";
+}
+async function readJsonRequestBody(request, maximumBytes = MAX_REQUEST_BODY_BYTES) {
+  if (!isJsonContentType(request.headers["content-type"])) {
+    throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST);
+  }
+  const declaredLength = Number(request.headers["content-length"]);
+  if (Number.isFinite(declaredLength) && declaredLength > maximumBytes) {
+    throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST);
+  }
+  const chunks = [];
+  let byteLength = 0;
+  let exceededLimit = false;
+  for await (const rawChunk of request) {
+    const chunk = rawChunk;
+    if (typeof chunk !== "string" && !(chunk instanceof Uint8Array)) {
+      throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST);
+    }
+    const buffer = Buffer.from(chunk);
+    byteLength += buffer.byteLength;
+    if (byteLength > maximumBytes) {
+      exceededLimit = true;
+      continue;
+    }
+    chunks.push(buffer);
+  }
+  if (exceededLimit || byteLength === 0) {
+    throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST);
+  }
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch (error) {
+    throw new SpotPatchError5(ERROR_CODES5.INVALID_REQUEST, void 0, {
+      cause: error
+    });
+  }
+}
+
+// src/server/agent-http.ts
+var AGENT_JOB_ID_PATTERN = /^[A-Za-z0-9_-]{22,128}$/;
+var AGENT_JOB_ACTIONS = /* @__PURE__ */ new Set([
+  "events",
+  "result",
+  "cancel",
+  "apply",
+  "revert"
+]);
+var EVENT_STREAM_END_STATUSES = /* @__PURE__ */ new Set([
+  "awaiting-review",
+  "applied",
+  "completed",
+  "cancelled",
+  "reverted",
+  "failed"
+]);
+function matchAgentRequestPath(path6) {
+  if (path6 === SPOTPATCH_ENDPOINTS.agentCapability) {
+    return Object.freeze({ kind: "capability" });
+  }
+  if (path6 === SPOTPATCH_ENDPOINTS.agentWorkspaceHealth) {
+    return Object.freeze({ kind: "workspace-health" });
+  }
+  if (path6 === SPOTPATCH_ENDPOINTS.agentJobs) {
+    return Object.freeze({ kind: "create-job" });
+  }
+  const prefix = `${SPOTPATCH_ENDPOINTS.agentJobs}/`;
+  if (!path6.startsWith(prefix)) {
+    return void 0;
+  }
+  const segments = path6.slice(prefix.length).split("/");
+  const jobId = segments[0];
+  const action = segments[1];
+  if (segments.length !== 2 || jobId === void 0 || !AGENT_JOB_ID_PATTERN.test(jobId) || action === void 0 || !AGENT_JOB_ACTIONS.has(action)) {
+    return void 0;
+  }
+  return Object.freeze({
+    kind: "job-action",
+    action,
+    jobId
+  });
+}
+function requireAgentManager(options) {
+  if (options.agentManager === void 0 || options.options.ai === false) {
+    throw new SpotPatchError6(ERROR_CODES6.AI_DISABLED);
+  }
+  return options.agentManager;
+}
+function writeNdjsonEvent(response, event) {
+  response.write(`${JSON.stringify(event)}
+`);
+}
+function streamAgentJobEvents(response, manager, jobId) {
+  const events = manager.events(jobId);
+  const current = manager.result(jobId).snapshot;
+  response.statusCode = 200;
+  response.setHeader("Cache-Control", "no-store");
+  response.setHeader("Content-Type", "application/x-ndjson; charset=utf-8");
+  response.setHeader("X-Content-Type-Options", "nosniff");
+  for (const event of events) {
+    writeNdjsonEvent(response, event);
+  }
+  if (EVENT_STREAM_END_STATUSES.has(current.status)) {
+    response.end();
+    return;
+  }
+  let settled = false;
+  let unsubscribe = () => void 0;
+  const heartbeat = setInterval(() => {
+    if (!settled) {
+      response.write("\n");
+    }
+  }, 15e3);
+  heartbeat.unref();
+  const cleanup = () => {
+    if (settled) {
+      return;
+    }
+    settled = true;
+    clearInterval(heartbeat);
+    unsubscribe();
+  };
+  unsubscribe = manager.subscribe(jobId, (event) => {
+    if (settled) {
+      return;
+    }
+    writeNdjsonEvent(response, event);
+    if (event.type === "snapshot" && EVENT_STREAM_END_STATUSES.has(event.data.snapshot.status)) {
+      cleanup();
+      response.end();
+    }
+  });
+  response.once("close", cleanup);
+  response.once("error", cleanup);
+}
+async function handleCapability(request, response, options, writeSuccess) {
+  if (request.method !== "POST") {
+    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
+  }
+  const parsed = agentCapabilityRequestSchema.safeParse(
+    await readJsonRequestBody(request)
+  );
+  if (!parsed.success) {
+    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
+  }
+  const controller = new AbortController();
+  const abort = () => {
+    controller.abort("agent-capability-client-disconnected");
+  };
+  response.once("close", abort);
+  try {
+    const data = await requireAgentManager(options).probe(
+      parsed.data,
+      controller.signal
+    );
+    writeSuccess(response, 200, data);
+  } finally {
+    response.removeListener("close", abort);
+  }
+}
+async function handleCreateJob(request, response, options, writeSuccess) {
+  if (request.method !== "POST") {
+    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
+  }
+  const parsed = agentJobCreateRequestSchema.safeParse(
+    await readJsonRequestBody(request, MAX_AGENT_REQUEST_BODY_BYTES)
+  );
+  if (!parsed.success) {
+    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
+  }
+  const authorizedRequest = await authorizeAgentJobRequest({
+    request: parsed.data,
+    options: options.options,
+    registry: options.registry,
+    root: options.root
+  });
+  const data = requireAgentManager(options).create(authorizedRequest);
+  writeSuccess(response, 202, data);
+}
+async function handleWorkspaceHealth(request, response, options, writeSuccess) {
+  if (request.method !== "POST") {
+    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
+  }
+  const parsed = agentWorkspaceHealthRequestSchema.safeParse(
+    await readJsonRequestBody(request)
+  );
+  if (!parsed.success) {
+    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
+  }
+  const controller = new AbortController();
+  const abort = () => {
+    controller.abort("agent-workspace-health-client-disconnected");
+  };
+  response.once("close", abort);
+  try {
+    const data = await requireAgentManager(options).workspaceHealth(controller.signal);
+    writeSuccess(response, 200, data);
+  } finally {
+    response.removeListener("close", abort);
+  }
+}
+async function handleJobAction(request, response, options, route, writeSuccess) {
+  const manager = requireAgentManager(options);
+  if (request.method !== "POST") {
+    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
+  }
+  const parsed = agentJobActionRequestSchema.safeParse(
+    await readJsonRequestBody(request)
+  );
+  if (!parsed.success) {
+    throw new SpotPatchError6(ERROR_CODES6.INVALID_REQUEST);
+  }
+  if (route.action === "events") {
+    streamAgentJobEvents(response, manager, route.jobId);
+    return;
+  }
+  if (route.action === "result") {
+    writeSuccess(response, 200, manager.result(route.jobId));
+    return;
+  }
+  const data = route.action === "cancel" ? manager.cancel(route.jobId) : route.action === "apply" ? await manager.apply(route.jobId) : await manager.revert(route.jobId);
+  writeSuccess(response, 200, data);
+}
+async function handleAgentRequest(request, response, options, route, writeSuccess) {
+  if (route.kind === "capability") {
+    await handleCapability(request, response, options, writeSuccess);
+    return;
+  }
+  if (route.kind === "create-job") {
+    await handleCreateJob(request, response, options, writeSuccess);
+    return;
+  }
+  if (route.kind === "workspace-health") {
+    await handleWorkspaceHealth(request, response, options, writeSuccess);
+    return;
+  }
+  await handleJobAction(request, response, options, route, writeSuccess);
+}
+
+// src/server/editor.ts
+import { spawn } from "child_process";
+import launchEditor from "launch-editor";
+var EDITOR_STARTUP_GRACE_MS = 300;
+function normalizedEditorEnvironment(environment) {
+  return [
+    environment.TERM_PROGRAM,
+    environment.VSCODE_GIT_ASKPASS_NODE,
+    environment.VSCODE_GIT_ASKPASS_MAIN,
+    environment.GIT_ASKPASS
+  ].filter((value) => typeof value === "string").join("\n").replaceAll("\\", "/").toLowerCase();
+}
+function detectIntegratedEditor(environment) {
+  const signature = normalizedEditorEnvironment(environment);
+  if (signature === "cursor" || signature.includes("/cursor")) {
+    return "cursor";
+  }
+  if (signature === "vscode" || signature.includes("visual studio code") || /(^|\/)(code|code-insiders)(\.exe)?($|\/)/u.test(signature)) {
+    return "vscode";
+  }
+  return void 0;
+}
+function editorCommand(editor) {
+  return editor === "cursor" ? "cursor" : "code";
+}
+var DEFAULT_DEPENDENCIES2 = Object.freeze({
+  environment: process.env,
+  fallbackLauncher: launchEditor,
+  processSpawner: (command, arguments_, options) => spawn(command, [...arguments_], options),
+  startupGraceMs: EDITOR_STARTUP_GRACE_MS
+});
+function createEditorLauncher(dependencies = DEFAULT_DEPENDENCIES2) {
+  return (target, configuredEditor) => {
+    const integratedEditor = detectIntegratedEditor(dependencies.environment);
+    const resolvedEditor = configuredEditor === "auto" ? integratedEditor : configuredEditor;
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const settle = (error, editor = resolvedEditor ?? "auto") => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        clearTimeout(startupTimer);
+        if (error === void 0) {
+          resolve(editor);
+        } else {
+          reject(error);
+        }
+      };
+      const startupTimer = setTimeout(settle, dependencies.startupGraceMs);
+      const rejectStartup = () => {
+        settle(new Error("The configured editor could not be started."));
+      };
+      try {
+        if (resolvedEditor === void 0) {
+          dependencies.fallbackLauncher(target, void 0, rejectStartup);
+          return;
+        }
+        const child = dependencies.processSpawner(
+          editorCommand(resolvedEditor),
+          ["--goto", target],
+          {
+            env: dependencies.environment,
+            stdio: "ignore",
+            windowsHide: true
+          }
+        );
+        child.once("error", rejectStartup);
+        child.once("exit", (code, signal) => {
+          if (code === 0) {
+            settle(void 0, resolvedEditor);
+            return;
+          }
+          if (code !== null || signal !== null) {
+            rejectStartup();
+          }
+        });
+      } catch {
+        rejectStartup();
+      }
+    });
+  };
+}
+var launchConfiguredEditor = createEditorLauncher();
+
+// src/server/request-security.ts
+import { timingSafeEqual } from "crypto";
+import { isIP } from "net";
+import { ERROR_CODES as ERROR_CODES7, SPOTPATCH_TOKEN_HEADER, SpotPatchError as SpotPatchError7 } from "@spotpatch/shared";
+function getSingleHeader(request, name) {
+  const value = request.headers[name.toLowerCase()];
+  return Array.isArray(value) ? value[0] : value;
+}
+function tokensMatch(actual, expected) {
+  if (actual === void 0) {
+    return false;
+  }
+  const actualBytes = Buffer.from(actual);
+  const expectedBytes = Buffer.from(expected);
+  return actualBytes.byteLength === expectedBytes.byteLength && timingSafeEqual(actualBytes, expectedBytes);
+}
+function isLoopbackHostname(hostname) {
+  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (normalized === "localhost" || normalized.endsWith(".localhost")) {
+    return true;
+  }
+  if (normalized === "::1") {
+    return true;
+  }
+  if (isIP(normalized) === 4) {
+    return normalized.split(".")[0] === "127";
+  }
+  return normalized.startsWith("::ffff:127.");
+}
+function parseHost(value) {
+  try {
+    return new URL(`http://${value}`);
+  } catch {
+    return void 0;
+  }
+}
+function parseOrigin(value) {
+  try {
+    const origin = new URL(value);
+    if (origin.protocol !== "http:" && origin.protocol !== "https:" || origin.username.length > 0 || origin.password.length > 0 || origin.origin === "null") {
+      return void 0;
+    }
+    return origin;
+  } catch {
+    return void 0;
+  }
+}
+function assertRequestAuthorized(request, options) {
+  const actualToken = getSingleHeader(request, SPOTPATCH_TOKEN_HEADER);
+  if (!tokensMatch(actualToken, options.sessionToken)) {
+    throw new SpotPatchError7(ERROR_CODES7.INVALID_TOKEN);
+  }
+  const hostHeader = getSingleHeader(request, "host");
+  const originHeader = getSingleHeader(request, "origin");
+  const host = hostHeader === void 0 ? void 0 : parseHost(hostHeader);
+  const origin = originHeader === void 0 ? void 0 : parseOrigin(originHeader);
+  if (host === void 0 || origin === void 0) {
+    throw new SpotPatchError7(ERROR_CODES7.ORIGIN_NOT_ALLOWED);
+  }
+  const hostIsLoopback = isLoopbackHostname(host.hostname);
+  const originIsLoopback = isLoopbackHostname(origin.hostname);
+  if (!options.allowLan) {
+    if (!hostIsLoopback || !originIsLoopback) {
+      throw new SpotPatchError7(ERROR_CODES7.ORIGIN_NOT_ALLOWED);
+    }
+    return;
+  }
+  if (!originIsLoopback && origin.host.toLowerCase() !== host.host.toLowerCase()) {
+    throw new SpotPatchError7(ERROR_CODES7.ORIGIN_NOT_ALLOWED);
+  }
+}
+
+// src/server/runtime-bootstrap.ts
+import {
+  ERROR_CODES as ERROR_CODES8,
+  SpotPatchError as SpotPatchError8,
+  runtimeBootstrapRequestSchema,
+  runtimeConfigSchema
+} from "@spotpatch/shared";
+function getSingleHeader2(request, name) {
+  const value = request.headers[name.toLowerCase()];
+  return Array.isArray(value) ? value[0] : value;
+}
+function resolveRuntimeBootstrapOptions(options) {
+  let expectedOrigin;
+  try {
+    expectedOrigin = new URL(options.expectedOrigin);
+  } catch {
+    throw new TypeError("The SpotPatch bootstrap origin is invalid.");
+  }
+  if (expectedOrigin.origin !== options.expectedOrigin || expectedOrigin.protocol !== "http:" || !isLoopbackHostname(expectedOrigin.hostname)) {
+    throw new TypeError("The SpotPatch bootstrap origin must be a loopback origin.");
+  }
+  const parsedConfig = runtimeConfigSchema.safeParse(options.runtimeConfig);
+  if (!parsedConfig.success) {
+    throw new TypeError("The SpotPatch Runtime configuration is invalid.");
+  }
+  return Object.freeze({
+    expectedOrigin: expectedOrigin.origin,
+    runtimeConfig: parsedConfig.data
+  });
+}
+function assertRuntimeBootstrapRequest(request, expectedOrigin) {
+  const contentType = getSingleHeader2(request, "content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+  if (request.method !== "POST" || contentType !== "application/json") {
+    throw new SpotPatchError8(ERROR_CODES8.INVALID_REQUEST);
+  }
+  const host = getSingleHeader2(request, "host");
+  let hostIsLoopback = false;
+  if (host !== void 0) {
+    try {
+      hostIsLoopback = isLoopbackHostname(new URL(`http://${host}`).hostname);
+    } catch {
+      hostIsLoopback = false;
+    }
+  }
+  if (!hostIsLoopback || getSingleHeader2(request, "origin") !== expectedOrigin || getSingleHeader2(request, "sec-fetch-site") !== "same-origin") {
+    throw new SpotPatchError8(ERROR_CODES8.ORIGIN_NOT_ALLOWED);
+  }
+}
+async function readRuntimeBootstrap(request, options) {
+  assertRuntimeBootstrapRequest(request, options.expectedOrigin);
+  const parsedBody = runtimeBootstrapRequestSchema.safeParse(
+    await readJsonRequestBody(request)
+  );
+  if (!parsedBody.success) {
+    throw new SpotPatchError8(ERROR_CODES8.INVALID_REQUEST);
+  }
+  return options.runtimeConfig;
+}
+
+// src/server/middleware.ts
+var STATUS_BY_ERROR = Object.freeze({
+  [ERROR_CODES9.INVALID_REQUEST]: 400,
+  [ERROR_CODES9.INVALID_TOKEN]: 401,
+  [ERROR_CODES9.ORIGIN_NOT_ALLOWED]: 403,
+  [ERROR_CODES9.SOURCE_NOT_FOUND]: 404,
+  [ERROR_CODES9.SOURCE_OUTSIDE_ROOT]: 403,
+  [ERROR_CODES9.SOURCE_TOO_LARGE]: 413,
+  [ERROR_CODES9.EDITOR_OPEN_FAILED]: 500,
+  [ERROR_CODES9.AI_DISABLED]: 404,
+  [ERROR_CODES9.PROVIDER_NOT_CONFIGURED]: 503,
+  [ERROR_CODES9.PROVIDER_AUTH_FAILED]: 502,
+  [ERROR_CODES9.PROVIDER_PROTOCOL_UNSUPPORTED]: 502,
+  [ERROR_CODES9.MODEL_NOT_ALLOWED]: 400,
+  [ERROR_CODES9.MODEL_TOOL_CALL_UNSUPPORTED]: 422,
+  [ERROR_CODES9.PROVIDER_RATE_LIMITED]: 429,
+  [ERROR_CODES9.AGENT_BUSY]: 409,
+  [ERROR_CODES9.AGENT_LIMIT_EXCEEDED]: 413,
+  [ERROR_CODES9.AGENT_CANCELLED]: 409,
+  [ERROR_CODES9.WORKTREE_DIRTY]: 409,
+  [ERROR_CODES9.WORKTREE_NOT_REPOSITORY]: 409,
+  [ERROR_CODES9.WORKTREE_OPERATION_IN_PROGRESS]: 409,
+  [ERROR_CODES9.WORKTREE_CONFLICTED]: 409,
+  [ERROR_CODES9.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: 413,
+  [ERROR_CODES9.WORKTREE_UNTRACKED_UNSUPPORTED]: 409,
+  [ERROR_CODES9.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: 409,
+  [ERROR_CODES9.TOOL_DENIED]: 403,
+  [ERROR_CODES9.TOOL_INPUT_INVALID]: 422,
+  [ERROR_CODES9.TOOL_ARGUMENTS_INVALID]: 422,
+  [ERROR_CODES9.TOOL_CALL_ID_CONFLICT]: 422,
+  [ERROR_CODES9.TOOL_PATH_DENIED]: 403,
+  [ERROR_CODES9.PATCH_REJECTED]: 422,
+  [ERROR_CODES9.VALIDATION_FAILED]: 422,
+  [ERROR_CODES9.APPLY_CONFLICT]: 409,
+  [ERROR_CODES9.INTERNAL_ERROR]: 500
+});
+var PUBLIC_MESSAGES = Object.freeze({
+  [ERROR_CODES9.INVALID_REQUEST]: "The request is invalid.",
+  [ERROR_CODES9.INVALID_TOKEN]: "The session token is invalid.",
+  [ERROR_CODES9.ORIGIN_NOT_ALLOWED]: "The request origin is not allowed.",
+  [ERROR_CODES9.SOURCE_NOT_FOUND]: "The source file is unavailable.",
+  [ERROR_CODES9.SOURCE_OUTSIDE_ROOT]: "The source file is outside the project root.",
+  [ERROR_CODES9.SOURCE_TOO_LARGE]: "The source file exceeds the size limit.",
+  [ERROR_CODES9.EDITOR_OPEN_FAILED]: "The editor request could not be started.",
+  [ERROR_CODES9.AI_DISABLED]: "AI execution is not enabled.",
+  [ERROR_CODES9.PROVIDER_NOT_CONFIGURED]: "The AI provider is unavailable.",
+  [ERROR_CODES9.PROVIDER_AUTH_FAILED]: "The AI provider rejected authentication.",
+  [ERROR_CODES9.PROVIDER_PROTOCOL_UNSUPPORTED]: "The AI provider protocol is unsupported.",
+  [ERROR_CODES9.MODEL_NOT_ALLOWED]: "The selected model is not allowed.",
+  [ERROR_CODES9.MODEL_TOOL_CALL_UNSUPPORTED]: "The selected model cannot run SpotPatch tools.",
+  [ERROR_CODES9.PROVIDER_RATE_LIMITED]: "The AI provider is rate limited.",
+  [ERROR_CODES9.AGENT_BUSY]: "Another Agent job is already running.",
+  [ERROR_CODES9.AGENT_LIMIT_EXCEEDED]: "The Agent job exceeded a safety limit.",
+  [ERROR_CODES9.AGENT_CANCELLED]: "The Agent job was cancelled.",
+  [ERROR_CODES9.WORKTREE_DIRTY]: "Local changes require explicit inclusion consent.",
+  [ERROR_CODES9.WORKTREE_NOT_REPOSITORY]: "The project root is not a Git repository.",
+  [ERROR_CODES9.WORKTREE_OPERATION_IN_PROGRESS]: "A Git operation is currently in progress.",
+  [ERROR_CODES9.WORKTREE_CONFLICTED]: "The local workspace contains unresolved merge conflicts.",
+  [ERROR_CODES9.WORKTREE_LOCAL_CHANGES_TOO_LARGE]: "The local workspace exceeds the safe isolation size limit.",
+  [ERROR_CODES9.WORKTREE_UNTRACKED_UNSUPPORTED]: "An untracked path cannot be isolated safely.",
+  [ERROR_CODES9.WORKTREE_LOCAL_CHANGES_UNSUPPORTED]: "The local workspace state cannot be isolated safely.",
+  [ERROR_CODES9.TOOL_DENIED]: "The Agent tool request was denied.",
+  [ERROR_CODES9.TOOL_INPUT_INVALID]: "The Agent tool input was invalid.",
+  [ERROR_CODES9.TOOL_ARGUMENTS_INVALID]: "The Agent tool arguments are invalid.",
+  [ERROR_CODES9.TOOL_CALL_ID_CONFLICT]: "A tool call ID conflicts within one Agent turn.",
+  [ERROR_CODES9.TOOL_PATH_DENIED]: "The Agent tool path was denied.",
+  [ERROR_CODES9.PATCH_REJECTED]: "The proposed patch was rejected.",
+  [ERROR_CODES9.VALIDATION_FAILED]: "The proposed change failed validation.",
+  [ERROR_CODES9.APPLY_CONFLICT]: "The change conflicts with the current worktree.",
+  [ERROR_CODES9.INTERNAL_ERROR]: "The request could not be completed."
+});
+function writeJson(response, status, payload) {
+  response.statusCode = status;
+  response.setHeader("Cache-Control", "no-store");
+  response.setHeader("Content-Type", "application/json; charset=utf-8");
+  response.end(JSON.stringify(payload));
+}
+function asSpotPatchError(error) {
+  return error instanceof SpotPatchError9 ? error : new SpotPatchError9(ERROR_CODES9.INTERNAL_ERROR, void 0, { cause: error });
+}
+function writeError(response, error, logger) {
+  const normalized = asSpotPatchError(error);
+  if (normalized.code === ERROR_CODES9.INTERNAL_ERROR) {
+    logger?.warn("[spotpatch:server] Internal request failure.");
+  }
+  writeJson(response, STATUS_BY_ERROR[normalized.code], {
+    ok: false,
+    error: {
+      code: normalized.code,
+      message: PUBLIC_MESSAGES[normalized.code]
+    }
+  });
+}
+function requestPath(request) {
+  try {
+    return new URL(request.url ?? "/", "http://spotpatch.invalid").pathname;
+  } catch {
+    return "";
+  }
+}
+async function handleSourceContext(request, options) {
+  const parsed = sourceContextRequestSchema.safeParse(
+    await readJsonRequestBody(request)
+  );
+  if (!parsed.success) {
+    throw new SpotPatchError9(ERROR_CODES9.INVALID_REQUEST);
+  }
+  return readSourceContext({
+    request: parsed.data,
+    registry: options.registry,
+    root: options.root,
+    maxCharacters: options.options.budget.codeCharacters,
+    maxLines: options.options.budget.maxCodeLines
+  });
+}
+async function handleOpenEditor(request, options) {
+  const parsed = openEditorRequestSchema.safeParse(await readJsonRequestBody(request));
+  if (!parsed.success) {
+    throw new SpotPatchError9(ERROR_CODES9.INVALID_REQUEST);
+  }
+  const body = parsed.data;
+  const sourcePath = await resolveSourceFile({
+    fileId: body.fileId,
+    registry: options.registry,
+    root: options.root
+  });
+  const target = `${sourcePath}:${String(body.line)}:${String(body.column)}`;
+  const editorLauncher = options.editorLauncher ?? launchConfiguredEditor;
+  try {
+    const editor = await editorLauncher(target, options.options.editor);
+    return Object.freeze({ editor });
+  } catch (error) {
+    options.logger?.warn(
+      `[spotpatch:server] ${options.options.editor === "auto" ? "The detected editor" : options.options.editor} rejected an editor request.`
+    );
+    throw new SpotPatchError9(ERROR_CODES9.EDITOR_OPEN_FAILED, void 0, {
+      cause: error
+    });
+  }
+}
+function createSpotPatchMiddleware(options) {
+  const bootstrap = options.bootstrap === void 0 ? void 0 : resolveRuntimeBootstrapOptions(options.bootstrap);
+  return (request, response, next) => {
+    const path6 = requestPath(request);
+    const agentRoute = matchAgentRequestPath(path6);
+    if (path6 !== SPOTPATCH_ENDPOINTS2.sourceContext && path6 !== SPOTPATCH_ENDPOINTS2.openEditor && agentRoute === void 0 && !path6.startsWith(`${SPOTPATCH_API_BASE}/`)) {
+      next();
+      return;
+    }
+    const handle = async () => {
+      if (path6 === SPOTPATCH_ENDPOINTS2.bootstrap && bootstrap !== void 0) {
+        const data = await readRuntimeBootstrap(
+          request,
+          bootstrap
+        );
+        writeJson(response, 200, { ok: true, data });
+        return;
+      }
+      assertRequestAuthorized(request, {
+        allowLan: options.options.allowLan,
+        sessionToken: options.session.token
+      });
+      if (path6 === SPOTPATCH_ENDPOINTS2.sourceContext) {
+        if (request.method !== "POST") {
+          throw new SpotPatchError9(ERROR_CODES9.INVALID_REQUEST);
+        }
+        const data = await handleSourceContext(request, options);
+        writeJson(response, 200, { ok: true, data });
+        return;
+      }
+      if (path6 === SPOTPATCH_ENDPOINTS2.openEditor) {
+        if (request.method !== "POST") {
+          throw new SpotPatchError9(ERROR_CODES9.INVALID_REQUEST);
+        }
+        const data = await handleOpenEditor(request, options);
+        writeJson(response, 200, { ok: true, data });
+        return;
+      }
+      if (agentRoute === void 0) {
+        throw new SpotPatchError9(ERROR_CODES9.INVALID_REQUEST);
+      }
+      await handleAgentRequest(
+        request,
+        response,
+        options,
+        agentRoute,
+        (target, status, data) => {
+          writeJson(target, status, { ok: true, data });
+        }
+      );
+    };
+    void handle().catch((error) => {
+      writeError(response, error, options.logger);
+    });
+  };
+}
+
+// src/server/source-registration.ts
+import { timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { lstat, realpath as realpath4 } from "fs/promises";
+import path5 from "path";
+import { createSourceFilter } from "@spotpatch/compiler";
+import { z as z2 } from "zod";
+var REGISTRATION_BODY_LIMIT_BYTES = 4096;
+var REGISTRATION_IDENTITY_PATTERN = /^[A-Za-z0-9_-]{16,128}$/u;
+var INTERNAL_SECRET_HEADER = "x-spotpatch-internal";
+var FORBIDDEN_SOURCE_SEGMENTS = /* @__PURE__ */ new Set([".next", "node_modules"]);
+var registrationRequestSchema = z2.strictObject({
+  epoch: z2.string().regex(REGISTRATION_IDENTITY_PATTERN),
+  resourcePath: z2.string().min(1).max(3072)
+});
+function getSingleHeader3(request, name) {
+  const value = request.headers[name.toLowerCase()];
+  return Array.isArray(value) ? value[0] : value;
+}
+function identitiesMatch(actual, expected) {
+  if (actual === void 0) {
+    return false;
+  }
+  const actualBytes = Buffer.from(actual);
+  const expectedBytes = Buffer.from(expected);
+  return actualBytes.byteLength === expectedBytes.byteLength && timingSafeEqual2(actualBytes, expectedBytes);
+}
+function isWithinRoot(root, candidate) {
+  const relative = path5.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path5.sep}`) && relative !== ".." && !path5.isAbsolute(relative);
+}
+function hasForbiddenSegment(root, candidate) {
+  return path5.relative(root, candidate).split(path5.sep).some((segment) => FORBIDDEN_SOURCE_SEGMENTS.has(segment));
+}
+function writeJson2(response, statusCode, payload) {
+  const body = JSON.stringify(payload);
+  response.statusCode = statusCode;
+  response.setHeader("Cache-Control", "no-store");
+  response.setHeader("Content-Type", "application/json; charset=utf-8");
+  response.setHeader("Content-Length", Buffer.byteLength(body));
+  response.end(body);
+}
+function requestComesFromLoopbackWorker(request) {
+  const host = getSingleHeader3(request, "host");
+  if (host === void 0 || getSingleHeader3(request, "origin") !== void 0) {
+    return false;
+  }
+  try {
+    return isLoopbackHostname(new URL(`http://${host}`).hostname);
+  } catch {
+    return false;
+  }
+}
+async function resolveAuthorizedSource(root, requestedPath, shouldTransform) {
+  if (!path5.isAbsolute(requestedPath) || requestedPath.includes("\0")) {
+    return void 0;
+  }
+  try {
+    const sourceStat = await lstat(requestedPath);
+    if (!sourceStat.isFile() || sourceStat.isSymbolicLink()) {
+      return void 0;
+    }
+    const resolvedPath = await realpath4(requestedPath);
+    if (!isWithinRoot(root, resolvedPath) || hasForbiddenSegment(root, resolvedPath) || !shouldTransform(resolvedPath)) {
+      return void 0;
+    }
+    return resolvedPath;
+  } catch {
+    return void 0;
+  }
+}
+async function createSourceRegistrationService(input) {
+  if (!REGISTRATION_IDENTITY_PATTERN.test(input.internalSecret) || !REGISTRATION_IDENTITY_PATTERN.test(input.registryEpoch)) {
+    throw new TypeError("The source registration identity is invalid.");
+  }
+  const root = await realpath4(input.root);
+  const sourceFilter = createSourceFilter(root, input.options);
+  const handler = (request, response) => {
+    const handle = async () => {
+      const contentType = getSingleHeader3(request, "content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+      if (request.method !== "POST" || contentType !== "application/json" || !requestComesFromLoopbackWorker(request) || !identitiesMatch(
+        getSingleHeader3(request, INTERNAL_SECRET_HEADER),
+        input.internalSecret
+      )) {
+        writeJson2(response, 403, { ok: false });
+        return;
+      }
+      const parsed = registrationRequestSchema.safeParse(
+        await readJsonRequestBody(request, REGISTRATION_BODY_LIMIT_BYTES)
+      );
+      if (!parsed.success || parsed.data.epoch !== input.registryEpoch) {
+        writeJson2(response, 400, { ok: false });
+        return;
+      }
+      const sourcePath = await resolveAuthorizedSource(
+        root,
+        parsed.data.resourcePath,
+        (absolutePath) => sourceFilter.shouldTransform(absolutePath, "<")
+      );
+      if (sourcePath === void 0) {
+        writeJson2(response, 403, { ok: false });
+        return;
+      }
+      writeJson2(response, 200, {
+        epoch: input.registryEpoch,
+        fileId: input.registry.register(sourcePath)
+      });
+    };
+    void handle().catch(() => {
+      if (!response.headersSent) {
+        writeJson2(response, 400, { ok: false });
+      } else {
+        response.destroy();
+      }
+    });
+  };
+  return Object.freeze({ handler, root });
+}
+
+// src/session/session.ts
+import { randomBytes as randomBytes3 } from "crypto";
+function createSession() {
+  return Object.freeze({
+    token: randomBytes3(16).toString("base64url")
+  });
+}
+
+// src/transport-options.ts
+var OPTION_KEYS = Object.freeze([
+  "ai",
+  "allowLan",
+  "budget",
+  "debug",
+  "editor",
+  "enabled",
+  "exclude",
+  "include",
+  "locale",
+  "maxTargets",
+  "redact",
+  "shortcut"
+]);
+var BUDGET_KEYS = Object.freeze([
+  "totalCharacters",
+  "domCharacters",
+  "cssCharacters",
+  "codeCharacters",
+  "maxCodeLines",
+  "maxComponentDepth"
+]);
+var REGEXP_FLAGS_PATTERN = /^(?!.*(.).*\1)[dgimsuvy]*$/u;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, keys) {
+  const actual = Object.keys(value).sort();
+  const expected = [...keys].sort();
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function serializeFilter(entry) {
+  return typeof entry === "string" ? Object.freeze({ kind: "string", value: entry }) : Object.freeze({
+    flags: entry.flags,
+    kind: "regexp",
+    source: entry.source
+  });
+}
+function serializeAiOptions(options) {
+  return Object.freeze({
+    providers: Object.freeze(
+      Object.fromEntries(
+        Object.entries(options.providers).map(([id, provider]) => [
+          id,
+          Object.freeze({
+            type: provider.type,
+            label: provider.label,
+            protocol: provider.protocol,
+            authentication: provider.authentication,
+            baseURL: provider.baseURL,
+            apiKeyEnv: provider.apiKeyEnv,
+            models: Object.freeze(
+              Object.fromEntries(
+                Object.entries(provider.models).map(([modelId, model]) => [
+                  modelId,
+                  Object.freeze({ label: model.label, model: model.model })
+                ])
+              )
+            ),
+            defaultModel: provider.defaultModel
+          })
+        ])
+      )
+    ),
+    defaultProvider: options.defaultProvider,
+    execution: Object.freeze({
+      isolation: options.execution.isolation,
+      applyMode: options.execution.applyMode,
+      checks: Object.freeze(
+        Object.fromEntries(
+          Object.entries(options.execution.checks).map(([id, check]) => [
+            id,
+            Object.freeze({
+              label: check.label,
+              command: check.command,
+              args: check.args,
+              required: check.required,
+              timeoutMs: check.timeoutMs
+            })
+          ])
+        )
+      ),
+      limits: options.execution.limits
+    })
+  });
+}
+function serializeResolvedSpotPatchOptions(options) {
+  return Object.freeze({
+    ai: options.ai === false ? false : serializeAiOptions(options.ai),
+    allowLan: options.allowLan,
+    budget: options.budget,
+    debug: options.debug,
+    editor: options.editor,
+    enabled: options.enabled,
+    exclude: Object.freeze(options.exclude.map(serializeFilter)),
+    include: Object.freeze(options.include.map(serializeFilter)),
+    locale: options.locale,
+    maxTargets: options.maxTargets,
+    redact: options.redact,
+    shortcut: options.shortcut
+  });
+}
+function parseFilterList(value) {
+  if (!Array.isArray(value) || value.length > 256) {
+    throw new TypeError("The SpotPatch filter transport is invalid.");
+  }
+  return Object.freeze(
+    value.map((entry) => {
+      if (!isRecord(entry)) {
+        throw new TypeError("The SpotPatch filter transport is invalid.");
+      }
+      if (entry.kind === "string" && hasExactKeys(entry, ["kind", "value"]) && typeof entry.value === "string" && entry.value.length > 0 && entry.value.length <= 1024 && !entry.value.includes("\0")) {
+        return entry.value;
+      }
+      if (entry.kind === "regexp" && hasExactKeys(entry, ["flags", "kind", "source"]) && typeof entry.source === "string" && entry.source.length <= 1024 && typeof entry.flags === "string" && REGEXP_FLAGS_PATTERN.test(entry.flags)) {
+        try {
+          return new RegExp(entry.source, entry.flags);
+        } catch {
+          throw new TypeError("The SpotPatch filter transport is invalid.");
+        }
+      }
+      throw new TypeError("The SpotPatch filter transport is invalid.");
+    })
+  );
+}
+function parseBudget(value) {
+  if (!isRecord(value) || !hasExactKeys(value, BUDGET_KEYS)) {
+    throw new TypeError("The SpotPatch budget transport is invalid.");
+  }
+  const budget = Object.fromEntries(
+    BUDGET_KEYS.map((key) => [key, value[key]])
+  );
+  return Object.freeze(budget);
+}
+function parseSerializedSpotPatchOptions(value) {
+  if (!isRecord(value) || !hasExactKeys(value, OPTION_KEYS)) {
+    throw new TypeError("The SpotPatch options transport is invalid.");
+  }
+  if (typeof value.enabled !== "boolean" || typeof value.redact !== "boolean" || typeof value.allowLan !== "boolean" || typeof value.debug !== "boolean" || typeof value.shortcut !== "string" || typeof value.maxTargets !== "number" || typeof value.editor !== "string" || typeof value.locale !== "string" || value.ai !== false && !isRecord(value.ai)) {
+    throw new TypeError("The SpotPatch options transport is invalid.");
+  }
+  try {
+    return resolveOptions({
+      ai: value.ai,
+      allowLan: value.allowLan,
+      budget: parseBudget(value.budget),
+      debug: value.debug,
+      editor: value.editor,
+      enabled: value.enabled,
+      exclude: parseFilterList(value.exclude),
+      include: parseFilterList(value.include),
+      locale: value.locale,
+      maxTargets: value.maxTargets,
+      redact: value.redact,
+      shortcut: value.shortcut
+    });
+  } catch (error) {
+    throw new TypeError("The SpotPatch options transport is invalid.", {
+      cause: error
+    });
+  }
+}
+export {
+  DEFAULT_EXCLUDE,
+  DEFAULT_OPTIONS,
+  createAgentJobManager,
+  createRuntimeAiConfig,
+  createSession,
+  createSourceRegistrationService,
+  createSourceRegistry,
+  createSpotPatchMiddleware,
+  isLoopbackHostname,
+  parseSerializedSpotPatchOptions,
+  readJsonRequestBody,
+  readRuntimeBootstrap,
+  resolveCredentialEnvironment,
+  resolveEnvironmentAiConfiguration,
+  resolveOptions,
+  resolveRuntimeBootstrapOptions,
+  serializeResolvedSpotPatchOptions
+};
+//# sourceMappingURL=index.js.map