@su-record/vibe 2.7.11 → 2.7.12

package/dist/interface/web/WebServer.js

@@ -1,999 +0,0 @@
-/**
- * WebServer - HTTP + WebSocket + SSE interface for Vibe
- * Phase 4: External Interface
- *
- * Features:
- * - REST API (existing endpoints preserved)
- * - WebSocket upgrade handler (RFC 6455)
- * - SSE streams (global + job-specific)
- * - JWT + local token auth
- * - Per-token rate limiting
- * - Event buffering for reconnection
- */
-import * as http from 'node:http';
-import * as crypto from 'node:crypto';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import * as os from 'node:os';
-import { BaseInterface } from '../BaseInterface.js';
-import { wsInboundSchema, WS_MAX_FRAME_SIZE, WS_MAX_CONNECTIONS, SSE_MAX_CONNECTIONS, WS_IDLE_TIMEOUT_MS, SSE_IDLE_TIMEOUT_MS, WS_PING_INTERVAL_MS, SSE_KEEPALIVE_INTERVAL_MS, WS_HANDSHAKE_TIMEOUT_MS, WS_BACKPRESSURE_LIMIT, SSE_BACKPRESSURE_LIMIT, SSE_EVENT_BUFFER_MAX_COUNT, SSE_EVENT_BUFFER_MAX_BYTES, SSE_EVENT_BUFFER_MAX_AGE_MS, RATE_LIMIT_WINDOW_MS, RATE_LIMIT_MAX_REQUESTS, JWT_CLOCK_SKEW_SECONDS, WS_OPCODE_TEXT, WS_OPCODE_BINARY, WS_OPCODE_CLOSE, WS_OPCODE_PING, WS_OPCODE_PONG, WS_CLOSE_NORMAL, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_UNSUPPORTED_DATA, WS_CLOSE_MESSAGE_TOO_BIG, WS_CLOSE_TRY_AGAIN_LATER, WS_MAGIC_GUID, } from './types.js';
-const TOKEN_FILE = path.join(os.homedir(), '.vibe', 'web-token');
-const DEFAULT_PORT = 7860;
-const MAX_PAYLOAD = 1024 * 1024; // 1MB
-// ============================================================================
-// Helper Functions (module-level)
-// ============================================================================
-/**
- * Generate monotonic ULID (timestamp + random)
- */
-function generateUlid() {
-    const timestamp = Date.now().toString(36).padStart(10, '0');
-    const random = crypto.randomBytes(10).toString('base64url').slice(0, 10);
-    return `${timestamp}${random}`;
-}
-/**
- * Parse base64url (RFC 7515)
- */
-function base64urlDecode(input) {
-    const padded = input.replace(/-/g, '+').replace(/_/g, '/').padEnd(input.length + ((4 - (input.length % 4)) % 4), '=');
-    return Buffer.from(padded, 'base64').toString('utf8');
-}
-/**
- * XOR unmask WebSocket payload (RFC 6455)
- */
-function unmaskPayload(payload, maskKey) {
-    const unmasked = Buffer.alloc(payload.length);
-    for (let i = 0; i < payload.length; i++) {
-        unmasked[i] = payload[i] ^ maskKey[i % 4];
-    }
-    return unmasked;
-}
-// ============================================================================
-// WebServer Class
-// ============================================================================
-export class WebServer extends BaseInterface {
-    name = 'web';
-    channel = 'web';
-    server = null;
-    config;
-    connections = new Set();
-    wsClients = new Map();
-    sseClients = new Map();
-    rateLimits = new Map();
-    eventBuffer = [];
-    eventBufferSize = 0;
-    heartbeatInterval = null;
-    cleanupInterval = null;
-    // Google OAuth state (PKCE + state → verifier mapping, 5min TTL)
-    oauthStates = new Map();
-    googleSessionSecret = crypto.randomBytes(32).toString('hex');
-    constructor(config, logger) {
-        super(logger);
-        this.config = {
-            port: config.port || DEFAULT_PORT,
-            host: config.host || '127.0.0.1',
-            authToken: config.authToken || this.generateToken(),
-            maxConnections: config.maxConnections || WS_MAX_CONNECTIONS,
-            maxSseConnections: config.maxSseConnections || SSE_MAX_CONNECTIONS,
-            idleTimeoutMs: config.idleTimeoutMs || WS_IDLE_TIMEOUT_MS,
-            maxPayloadBytes: config.maxPayloadBytes || MAX_PAYLOAD,
-            corsOrigins: config.corsOrigins || ['http://localhost:*'],
-            authMode: config.authMode || 'local',
-            jwtSecret: config.jwtSecret,
-            jwtIssuer: config.jwtIssuer,
-            jwtAudience: config.jwtAudience,
-            googleClientId: config.googleClientId,
-            googleClientSecret: config.googleClientSecret,
-        };
-    }
-    async start() {
-        this.status = 'connecting';
-        this.server = http.createServer((req, res) => this.handleRequest(req, res));
-        this.server.on('upgrade', (req, socket, head) => this.handleUpgrade(req, socket, head));
-        this.heartbeatInterval = setInterval(() => this.heartbeat(), WS_PING_INTERVAL_MS);
-        this.cleanupInterval = setInterval(() => this.cleanup(), 60_000);
-        return new Promise((resolve, reject) => {
-            this.server.listen(this.config.port, this.config.host, () => {
-                this.status = 'enabled';
-                this.connectedAt = new Date().toISOString();
-                this.saveToken();
-                this.logger('info', `Web server started on ${this.config.host}:${this.config.port}`);
-                resolve();
-            });
-            this.server.on('error', (err) => {
-                this.status = 'error';
-                reject(err);
-            });
-        });
-    }
-    async stop() {
-        if (!this.server)
-            return;
-        if (this.heartbeatInterval)
-            clearInterval(this.heartbeatInterval);
-        if (this.cleanupInterval)
-            clearInterval(this.cleanupInterval);
-        for (const client of this.wsClients.values()) {
-            this.wsClose(client.socket, WS_CLOSE_NORMAL, 'Server shutdown');
-        }
-        this.wsClients.clear();
-        for (const client of this.sseClients.values()) {
-            client.response.end();
-        }
-        this.sseClients.clear();
-        for (const conn of this.connections) {
-            conn.end();
-        }
-        this.connections.clear();
-        await this.flushAllBuffers();
-        return new Promise((resolve) => {
-            this.server.close(() => {
-                this.server = null;
-                this.status = 'disabled';
-                this.logger('info', 'Web server stopped');
-                resolve();
-            });
-        });
-    }
-    async sendResponse(response) {
-        this.logger('debug', `Web response to ${response.chatId}: ${response.content.slice(0, 100)}`);
-    }
-    /**
-     * Broadcast progress event to SSE/WS clients
-     */
-    broadcastProgress(event) {
-        const sseEvent = {
-            id: generateUlid(),
-            type: this.mapEventType(event.type),
-            jobId: event.jobId,
-            data: event.data,
-            timestamp: event.timestamp,
-        };
-        this.bufferEvent(sseEvent);
-        // Send to SSE clients
-        for (const client of this.sseClients.values()) {
-            if (!client.jobId || client.jobId === event.jobId) {
-                this.sseSend(client, sseEvent);
-            }
-        }
-        // Send to WS clients
-        for (const client of this.wsClients.values()) {
-            if (client.authenticated && client.subscribedJobs.has(event.jobId)) {
-                const wsMsg = {
-                    type: event.type,
-                    jobId: event.jobId,
-                    data: event.data,
-                    timestamp: event.timestamp,
-                };
-                this.wsSendText(client, JSON.stringify(wsMsg));
-            }
-        }
-    }
-    getPort() {
-        if (this.server) {
-            const addr = this.server.address();
-            if (addr && typeof addr === 'object') {
-                return addr.port;
-            }
-        }
-        return this.config.port;
-    }
-    getAuthToken() {
-        return this.config.authToken;
-    }
-    // ========================================================================
-    // HTTP Request Handler
-    // ========================================================================
-    handleRequest(req, res) {
-        this.connections.add(res);
-        res.on('close', () => this.connections.delete(res));
-        const origin = req.headers.origin || '';
-        if (origin && !this.isOriginAllowed(origin)) {
-            res.writeHead(403, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'CORS: origin not allowed' }));
-            return;
-        }
-        if (origin) {
-            res.setHeader('Access-Control-Allow-Origin', origin);
-            res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-            res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type');
-        }
-        if (req.method === 'OPTIONS') {
-            res.writeHead(204);
-            res.end();
-            return;
-        }
-        if (req.url === '/health') {
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ status: 'ok' }));
-            return;
-        }
-        // Google OAuth routes (no auth required)
-        if (this.config.authMode === 'google') {
-            if (req.url === '/auth/google/login') {
-                this.handleGoogleLogin(res);
-                return;
-            }
-            if (req.url?.startsWith('/auth/google/callback')) {
-                this.handleGoogleCallback(req, res);
-                return;
-            }
-        }
-        // SSE endpoints (auth via query param or header)
-        if (req.url?.startsWith('/api/stream')) {
-            this.handleSseRequest(req, res);
-            return;
-        }
-        // Auth check for other endpoints
-        const token = this.extractToken(req);
-        if (!token || !this.verifyToken(token)) {
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Unauthorized' }));
-            return;
-        }
-        // Rate limiting
-        if (!this.checkRateLimit(token)) {
-            const retryAfter = Math.ceil(RATE_LIMIT_WINDOW_MS / 1000);
-            res.writeHead(429, {
-                'Content-Type': 'application/json',
-                'Retry-After': String(retryAfter),
-            });
-            res.end(JSON.stringify({ error: 'Rate limit exceeded' }));
-            return;
-        }
-        this.routeRequest(req, res);
-    }
-    routeRequest(req, res) {
-        const url = req.url || '/';
-        const method = req.method || 'GET';
-        if (method === 'POST' && url === '/api/job') {
-            this.handleCreateJob(req, res);
-        }
-        else if (method === 'GET' && url.startsWith('/api/job/')) {
-            const jobId = url.split('/api/job/')[1]?.split('?')[0] || '';
-            this.handleGetJob(res, jobId);
-        }
-        else if (method === 'GET' && url === '/api/jobs') {
-            this.handleListJobs(res);
-        }
-        else {
-            res.writeHead(404, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Not found' }));
-        }
-    }
-    async handleCreateJob(req, res) {
-        let body = '';
-        let size = 0;
-        req.on('data', (chunk) => {
-            size += chunk.length;
-            if (size > this.config.maxPayloadBytes) {
-                res.writeHead(413, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Payload too large' }));
-                req.destroy();
-                return;
-            }
-            body += chunk.toString();
-        });
-        req.on('end', async () => {
-            try {
-                const parsed = JSON.parse(body);
-                const request = String(parsed.request || '');
-                if (!request) {
-                    res.writeHead(400, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Missing request field' }));
-                    return;
-                }
-                const message = {
-                    id: crypto.randomUUID(),
-                    channel: 'web',
-                    chatId: 'web-client',
-                    userId: 'web-user',
-                    content: request,
-                    type: 'text',
-                    timestamp: new Date().toISOString(),
-                };
-                await this.dispatchMessage(message);
-                res.writeHead(201, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ messageId: message.id, status: 'created' }));
-            }
-            catch {
-                res.writeHead(400, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify({ error: 'Invalid JSON' }));
-            }
-        });
-    }
-    handleGetJob(res, jobId) {
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ jobId, status: 'pending' }));
-    }
-    handleListJobs(res) {
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ jobs: [] }));
-    }
-    // ========================================================================
-    // WebSocket Upgrade Handler
-    // ========================================================================
-    handleUpgrade(req, socket, head) {
-        if (this.wsClients.size >= this.config.maxConnections) {
-            socket.write('HTTP/1.1 503 Service Unavailable\r\n\r\n');
-            socket.destroy();
-            return;
-        }
-        const key = req.headers['sec-websocket-key'];
-        if (!key || typeof key !== 'string') {
-            socket.write('HTTP/1.1 400 Bad Request\r\n\r\n');
-            socket.destroy();
-            return;
-        }
-        const acceptKey = this.generateAcceptKey(key);
-        socket.write('HTTP/1.1 101 Switching Protocols\r\n' +
-            'Upgrade: websocket\r\n' +
-            'Connection: Upgrade\r\n' +
-            `Sec-WebSocket-Accept: ${acceptKey}\r\n` +
-            '\r\n');
-        const clientId = generateUlid();
-        const client = {
-            id: clientId,
-            socket,
-            authenticated: false,
-            subscribedJobs: new Set(),
-            lastActivity: Date.now(),
-            lastPong: Date.now(),
-            writeBufferSize: 0,
-        };
-        this.wsClients.set(clientId, client);
-        const handshakeTimeout = setTimeout(() => {
-            if (!client.authenticated) {
-                this.wsClose(socket, WS_CLOSE_PROTOCOL_ERROR, 'Auth timeout');
-                this.wsClients.delete(clientId);
-            }
-        }, WS_HANDSHAKE_TIMEOUT_MS);
-        const chunks = head.length > 0 ? [head] : [];
-        socket.on('data', (chunk) => {
-            chunks.push(chunk);
-            let buffer = Buffer.concat(chunks);
-            chunks.length = 0;
-            while (buffer.length > 0) {
-                const result = this.wsParseFrame(buffer);
-                if (!result)
-                    break;
-                const { frame, consumed } = result;
-                buffer = buffer.subarray(consumed);
-                this.wsHandleFrame(client, frame);
-            }
-            if (buffer.length > 0) {
-                chunks.push(buffer);
-            }
-        });
-        socket.on('close', () => {
-            clearTimeout(handshakeTimeout);
-            this.wsClients.delete(clientId);
-        });
-        socket.on('error', (err) => {
-            this.logger('debug', `WS socket error: ${err.message}`);
-            this.wsClients.delete(clientId);
-        });
-    }
-    generateAcceptKey(key) {
-        const hash = crypto.createHash('sha1');
-        hash.update(key + WS_MAGIC_GUID);
-        return hash.digest('base64');
-    }
-    // ========================================================================
-    // WebSocket Frame Parser
-    // ========================================================================
-    wsParseFrame(buffer) {
-        if (buffer.length < 2)
-            return null;
-        const fin = (buffer[0] & 0x80) !== 0;
-        const rsv = buffer[0] & 0x70;
-        const opcode = buffer[0] & 0x0f;
-        // RFC 6455 §5.2: RSV1-3 must be 0 unless extension negotiated
-        if (rsv !== 0) {
-            return {
-                frame: { opcode: WS_OPCODE_CLOSE, payload: Buffer.from([]), masked: false },
-                consumed: buffer.length,
-            };
-        }
-        const masked = (buffer[1] & 0x80) !== 0;
-        let payloadLen = buffer[1] & 0x7f;
-        let offset = 2;
-        if (payloadLen === 126) {
-            if (buffer.length < 4)
-                return null;
-            payloadLen = buffer.readUInt16BE(2);
-            offset = 4;
-        }
-        else if (payloadLen === 127) {
-            if (buffer.length < 10)
-                return null;
-            const high = buffer.readUInt32BE(2);
-            const low = buffer.readUInt32BE(6);
-            payloadLen = high * 0x100000000 + low;
-            offset = 10;
-        }
-        if (payloadLen > WS_MAX_FRAME_SIZE) {
-            return {
-                frame: { opcode: WS_OPCODE_CLOSE, payload: Buffer.from([]), masked: false },
-                consumed: buffer.length,
-            };
-        }
-        let maskKey;
-        if (masked) {
-            if (buffer.length < offset + 4)
-                return null;
-            maskKey = buffer.slice(offset, offset + 4);
-            offset += 4;
-        }
-        if (buffer.length < offset + payloadLen)
-            return null;
-        const rawPayload = buffer.subarray(offset, offset + payloadLen);
-        const payload = (masked && maskKey)
-            ? unmaskPayload(rawPayload, maskKey)
-            : Buffer.from(rawPayload);
-        return {
-            frame: { opcode, payload, masked },
-            consumed: offset + payloadLen,
-        };
-    }
-    wsHandleFrame(client, frame) {
-        client.lastActivity = Date.now();
-        if (frame.opcode === WS_OPCODE_CLOSE) {
-            this.wsClose(client.socket, WS_CLOSE_NORMAL, 'Client close');
-            this.wsClients.delete(client.id);
-            return;
-        }
-        if (frame.opcode === WS_OPCODE_PING) {
-            this.wsSendFrame(client.socket, WS_OPCODE_PONG, frame.payload);
-            return;
-        }
-        if (frame.opcode === WS_OPCODE_PONG) {
-            client.lastPong = Date.now();
-            return;
-        }
-        if (frame.opcode === WS_OPCODE_BINARY) {
-            this.wsClose(client.socket, WS_CLOSE_UNSUPPORTED_DATA, 'Binary not supported');
-            this.wsClients.delete(client.id);
-            return;
-        }
-        if (frame.opcode === WS_OPCODE_TEXT) {
-            const text = frame.payload.toString('utf8');
-            this.wsHandleMessage(client, text);
-        }
-    }
-    wsHandleMessage(client, text) {
-        let parsed;
-        try {
-            parsed = JSON.parse(text);
-        }
-        catch {
-            this.wsSendText(client, JSON.stringify({ error: 'Invalid JSON' }));
-            return;
-        }
-        const result = wsInboundSchema.safeParse(parsed);
-        if (!result.success) {
-            this.wsSendText(client, JSON.stringify({ error: 'Invalid message schema' }));
-            return;
-        }
-        const msg = result.data;
-        if (msg.type === 'auth') {
-            if (!this.verifyToken(msg.token)) {
-                this.wsClose(client.socket, WS_CLOSE_PROTOCOL_ERROR, 'Auth failed');
-                this.wsClients.delete(client.id);
-                return;
-            }
-            if (!this.checkRateLimit(msg.token)) {
-                this.wsClose(client.socket, WS_CLOSE_TRY_AGAIN_LATER, 'Rate limit');
-                this.wsClients.delete(client.id);
-                return;
-            }
-            client.authenticated = true;
-            this.wsSendText(client, JSON.stringify({ type: 'connected', clientId: client.id }));
-            return;
-        }
-        if (!client.authenticated) {
-            this.wsClose(client.socket, WS_CLOSE_PROTOCOL_ERROR, 'Not authenticated');
-            this.wsClients.delete(client.id);
-            return;
-        }
-        if (msg.type === 'message') {
-            const extMsg = {
-                id: crypto.randomUUID(),
-                channel: 'web',
-                chatId: client.id,
-                userId: client.id,
-                content: msg.content,
-                type: 'text',
-                timestamp: new Date().toISOString(),
-                metadata: { jobId: msg.jobId },
-            };
-            this.dispatchMessage(extMsg).catch((err) => {
-                this.logger('error', 'Failed to dispatch WS message', err);
-            });
-        }
-        else if (msg.type === 'subscribe') {
-            client.subscribedJobs.add(msg.jobId);
-        }
-        else if (msg.type === 'unsubscribe') {
-            client.subscribedJobs.delete(msg.jobId);
-        }
-        else if (msg.type === 'ping') {
-            this.wsSendText(client, JSON.stringify({ type: 'pong' }));
-        }
-    }
-    // ========================================================================
-    // WebSocket Frame Writer
-    // ========================================================================
-    wsSendFrame(socket, opcode, payload) {
-        if (socket.writableLength > WS_BACKPRESSURE_LIMIT) {
-            socket.destroy();
-            return;
-        }
-        const len = payload.length;
-        let header;
-        if (len < 126) {
-            header = Buffer.allocUnsafe(2);
-            header[0] = 0x80 | opcode;
-            header[1] = len;
-        }
-        else if (len < 65536) {
-            header = Buffer.allocUnsafe(4);
-            header[0] = 0x80 | opcode;
-            header[1] = 126;
-            header.writeUInt16BE(len, 2);
-        }
-        else {
-            header = Buffer.allocUnsafe(10);
-            header[0] = 0x80 | opcode;
-            header[1] = 127;
-            header.writeUInt32BE(0, 2);
-            header.writeUInt32BE(len, 6);
-        }
-        socket.write(Buffer.concat([header, payload]));
-    }
-    wsSendText(client, text) {
-        const payload = Buffer.from(text, 'utf8');
-        if (payload.length > WS_MAX_FRAME_SIZE) {
-            this.wsClose(client.socket, WS_CLOSE_MESSAGE_TOO_BIG, 'Message too big');
-            this.wsClients.delete(client.id);
-            return;
-        }
-        this.wsSendFrame(client.socket, WS_OPCODE_TEXT, payload);
-    }
-    wsClose(socket, code, reason) {
-        const payload = Buffer.allocUnsafe(2 + Buffer.byteLength(reason));
-        payload.writeUInt16BE(code, 0);
-        payload.write(reason, 2, 'utf8');
-        this.wsSendFrame(socket, WS_OPCODE_CLOSE, payload);
-        socket.end();
-    }
-    // ========================================================================
-    // SSE Handler
-    // ========================================================================
-    handleSseRequest(req, res) {
-        const url = req.url || '';
-        const token = this.extractToken(req);
-        if (!token || !this.verifyToken(token)) {
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Unauthorized' }));
-            return;
-        }
-        if (!this.checkRateLimit(token)) {
-            const retryAfter = Math.ceil(RATE_LIMIT_WINDOW_MS / 1000);
-            res.writeHead(429, {
-                'Content-Type': 'application/json',
-                'Retry-After': String(retryAfter),
-            });
-            res.end(JSON.stringify({ error: 'Rate limit exceeded' }));
-            return;
-        }
-        if (this.sseClients.size >= this.config.maxSseConnections) {
-            res.writeHead(503, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Too many SSE connections' }));
-            return;
-        }
-        const jobIdMatch = url.match(/^\/api\/stream\/([^/?]+)/);
-        const jobId = jobIdMatch ? jobIdMatch[1] : undefined;
-        res.writeHead(200, {
-            'Content-Type': 'text/event-stream',
-            'Cache-Control': 'no-cache',
-            'Connection': 'keep-alive',
-        });
-        const clientId = generateUlid();
-        const client = {
-            id: clientId,
-            response: res,
-            jobId,
-            lastActivity: Date.now(),
-            token,
-        };
-        this.sseClients.set(clientId, client);
-        const lastEventId = req.headers['last-event-id'];
-        if (lastEventId && typeof lastEventId === 'string') {
-            this.sseReplayEvents(client, lastEventId);
-        }
-        const keepaliveInterval = setInterval(() => {
-            if (!res.writable) {
-                clearInterval(keepaliveInterval);
-                return;
-            }
-            res.write(':keep-alive\n\n');
-        }, SSE_KEEPALIVE_INTERVAL_MS);
-        res.on('close', () => {
-            clearInterval(keepaliveInterval);
-            this.sseClients.delete(clientId);
-        });
-    }
-    sseSend(client, event) {
-        if (!client.response.writable) {
-            this.sseClients.delete(client.id);
-            return;
-        }
-        if (client.response.writableLength > SSE_BACKPRESSURE_LIMIT) {
-            client.response.end();
-            this.sseClients.delete(client.id);
-            return;
-        }
-        client.lastActivity = Date.now();
-        const data = JSON.stringify(event.data);
-        const message = `id: ${event.id}\nevent: ${event.type}\ndata: ${data}\n\n`;
-        client.response.write(message);
-    }
-    sseReplayEvents(client, lastEventId) {
-        const now = Date.now();
-        const cutoff = now - SSE_EVENT_BUFFER_MAX_AGE_MS;
-        for (const buffered of this.eventBuffer) {
-            if (buffered.timestamp < cutoff)
-                continue;
-            if (buffered.id <= lastEventId)
-                continue;
-            const message = `id: ${buffered.id}\nevent: ${buffered.event}\ndata: ${buffered.data}\n\n`;
-            client.response.write(message);
-        }
-    }
-    bufferEvent(event) {
-        const data = JSON.stringify(event.data);
-        const size = Buffer.byteLength(data) + Buffer.byteLength(event.id) + Buffer.byteLength(event.type);
-        const buffered = {
-            id: event.id,
-            event: event.type,
-            data,
-            timestamp: Date.now(),
-            size,
-        };
-        this.eventBuffer.push(buffered);
-        this.eventBufferSize += size;
-        while (this.eventBuffer.length > SSE_EVENT_BUFFER_MAX_COUNT ||
-            this.eventBufferSize > SSE_EVENT_BUFFER_MAX_BYTES) {
-            const removed = this.eventBuffer.shift();
-            if (removed)
-                this.eventBufferSize -= removed.size;
-        }
-    }
-    // ========================================================================
-    // Auth Helpers
-    // ========================================================================
-    extractToken(req) {
-        const auth = req.headers.authorization;
-        if (auth) {
-            const [scheme, token] = auth.split(' ');
-            if (scheme === 'Bearer' && token)
-                return token;
-        }
-        const url = new URL(req.url || '', `http://${req.headers.host}`);
-        const queryToken = url.searchParams.get('token');
-        if (queryToken)
-            return queryToken;
-        return null;
-    }
-    verifyToken(token) {
-        if (this.config.authMode === 'cloud') {
-            return this.verifyJwt(token);
-        }
-        if (this.config.authMode === 'google') {
-            return this.verifyGoogleSessionJwt(token);
-        }
-        const tokenBuf = Buffer.from(token);
-        const expectedBuf = Buffer.from(this.config.authToken);
-        if (tokenBuf.length !== expectedBuf.length)
-            return false;
-        return crypto.timingSafeEqual(tokenBuf, expectedBuf);
-    }
-    verifyJwt(token) {
-        if (!this.config.jwtSecret)
-            return false;
-        try {
-            const parts = token.split('.');
-            if (parts.length !== 3)
-                return false;
-            const [headerB64, payloadB64, signatureB64] = parts;
-            const header = JSON.parse(base64urlDecode(headerB64));
-            if (header.alg !== 'HS256')
-                return false;
-            const payload = JSON.parse(base64urlDecode(payloadB64));
-            const now = Math.floor(Date.now() / 1000);
-            if (payload.exp && payload.exp < now - JWT_CLOCK_SKEW_SECONDS)
-                return false;
-            if (payload.iat && payload.iat > now + JWT_CLOCK_SKEW_SECONDS)
-                return false;
-            if (payload.nbf && payload.nbf > now + JWT_CLOCK_SKEW_SECONDS)
-                return false;
-            if (!payload.sub)
-                return false;
-            if (this.config.jwtIssuer && payload.iss !== this.config.jwtIssuer)
-                return false;
-            if (this.config.jwtAudience && payload.aud !== this.config.jwtAudience)
-                return false;
-            const hmac = crypto.createHmac('sha256', this.config.jwtSecret);
-            hmac.update(`${headerB64}.${payloadB64}`);
-            const expectedSignature = hmac.digest('base64url');
-            return crypto.timingSafeEqual(Buffer.from(signatureB64), Buffer.from(expectedSignature));
-        }
-        catch {
-            return false;
-        }
-    }
-    // ========================================================================
-    // Rate Limiting (per-token, sliding window)
-    // ========================================================================
-    checkRateLimit(token) {
-        const now = Date.now();
-        let entry = this.rateLimits.get(token);
-        if (!entry) {
-            entry = {
-                tokens: 0,
-                lastRefill: now,
-                windowStart: now,
-                requestTimestamps: [],
-            };
-            this.rateLimits.set(token, entry);
-        }
-        entry.requestTimestamps = entry.requestTimestamps.filter((ts) => ts > now - RATE_LIMIT_WINDOW_MS);
-        if (entry.requestTimestamps.length >= RATE_LIMIT_MAX_REQUESTS) {
-            return false;
-        }
-        entry.requestTimestamps.push(now);
-        return true;
-    }
-    // ========================================================================
-    // Maintenance
-    // ========================================================================
-    heartbeat() {
-        const now = Date.now();
-        for (const [id, client] of this.wsClients.entries()) {
-            if (now - client.lastActivity > this.config.idleTimeoutMs) {
-                this.wsClose(client.socket, WS_CLOSE_NORMAL, 'Idle timeout');
-                this.wsClients.delete(id);
-                continue;
-            }
-            if (now - client.lastPong > WS_PING_INTERVAL_MS * 2) {
-                this.wsClose(client.socket, WS_CLOSE_NORMAL, 'No pong');
-                this.wsClients.delete(id);
-                continue;
-            }
-            this.wsSendFrame(client.socket, WS_OPCODE_PING, Buffer.from('ping'));
-        }
-    }
-    cleanup() {
-        const now = Date.now();
-        for (const [id, client] of this.sseClients.entries()) {
-            if (now - client.lastActivity > SSE_IDLE_TIMEOUT_MS) {
-                client.response.end();
-                this.sseClients.delete(id);
-            }
-        }
-        const cutoff = now - SSE_EVENT_BUFFER_MAX_AGE_MS;
-        this.eventBuffer = this.eventBuffer.filter((e) => e.timestamp >= cutoff);
-        for (const [token, entry] of this.rateLimits.entries()) {
-            if (now - entry.windowStart > RATE_LIMIT_WINDOW_MS * 2) {
-                this.rateLimits.delete(token);
-            }
-        }
-    }
-    // ========================================================================
-    // Google OAuth
-    // ========================================================================
-    handleGoogleLogin(res) {
-        const clientId = this.config.googleClientId;
-        if (!clientId) {
-            res.writeHead(500, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Google OAuth not configured (missing googleClientId)' }));
-            return;
-        }
-        // Generate PKCE
-        const verifier = crypto.randomBytes(32).toString('base64url');
-        const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
-        const state = crypto.randomBytes(32).toString('base64url');
-        // Store state → verifier (5min TTL)
-        this.oauthStates.set(state, { verifier, createdAt: Date.now() });
-        this.cleanupOAuthStates();
-        const redirectUri = `http://localhost:${this.config.port}/auth/google/callback`;
-        const url = new URL('https://accounts.google.com/o/oauth2/v2/auth');
-        url.searchParams.set('client_id', clientId);
-        url.searchParams.set('response_type', 'code');
-        url.searchParams.set('redirect_uri', redirectUri);
-        url.searchParams.set('scope', 'openid email profile');
-        url.searchParams.set('code_challenge', challenge);
-        url.searchParams.set('code_challenge_method', 'S256');
-        url.searchParams.set('state', state);
-        url.searchParams.set('access_type', 'offline');
-        url.searchParams.set('prompt', 'consent');
-        res.writeHead(302, { Location: url.toString() });
-        res.end();
-    }
-    async handleGoogleCallback(req, res) {
-        const reqUrl = new URL(req.url ?? '/', `http://localhost:${this.config.port}`);
-        const code = reqUrl.searchParams.get('code');
-        const state = reqUrl.searchParams.get('state');
-        const error = reqUrl.searchParams.get('error');
-        if (error) {
-            res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(`<h1>Authentication Failed</h1><p>${error}</p>`);
-            return;
-        }
-        if (!code || !state) {
-            res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end('<h1>Authentication Failed</h1><p>Missing code or state</p>');
-            return;
-        }
-        // Verify state + consume
-        const stateData = this.oauthStates.get(state);
-        if (!stateData || Date.now() - stateData.createdAt > 5 * 60 * 1000) {
-            this.oauthStates.delete(state);
-            res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end('<h1>Authentication Failed</h1><p>Invalid or expired state</p>');
-            return;
-        }
-        this.oauthStates.delete(state);
-        try {
-            // Exchange code for tokens
-            const redirectUri = `http://localhost:${this.config.port}/auth/google/callback`;
-            const tokenBody = new URLSearchParams({
-                client_id: this.config.googleClientId,
-                code,
-                grant_type: 'authorization_code',
-                redirect_uri: redirectUri,
-                code_verifier: stateData.verifier,
-            });
-            if (this.config.googleClientSecret) {
-                tokenBody.set('client_secret', this.config.googleClientSecret);
-            }
-            const tokenRes = await fetch('https://oauth2.googleapis.com/token', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                body: tokenBody.toString(),
-            });
-            if (!tokenRes.ok) {
-                const errText = await tokenRes.text();
-                this.logger('error', `Google token exchange failed: ${errText}`);
-                res.writeHead(500, { 'Content-Type': 'text/html; charset=utf-8' });
-                res.end('<h1>Authentication Failed</h1><p>Token exchange failed</p>');
-                return;
-            }
-            const tokenData = await tokenRes.json();
-            // Get user info
-            const userRes = await fetch('https://www.googleapis.com/oauth2/v1/userinfo?alt=json', {
-                headers: { Authorization: `Bearer ${tokenData.access_token}` },
-            });
-            const userInfo = userRes.ok
-                ? await userRes.json()
-                : { email: 'unknown', name: 'unknown' };
-            // Create session JWT (24h expiry)
-            const sessionToken = this.createGoogleSessionJwt(userInfo.email ?? 'user');
-            // Return success page with token
-            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end(`
-        <html>
-          <head><title>Authentication Successful</title></head>
-          <body style="font-family: sans-serif; text-align: center; padding-top: 50px; max-width: 600px; margin: 0 auto;">
-            <h1>Authentication Successful</h1>
-            <p>Logged in as <strong>${userInfo.email ?? 'unknown'}</strong></p>
-            <p style="margin-top: 20px;">Your API token:</p>
-            <textarea readonly style="width: 100%; height: 80px; font-size: 12px; word-break: break-all;">${sessionToken}</textarea>
-            <p style="color: #666; font-size: 14px;">Use this token as Bearer token for API requests.</p>
-            <p style="color: #666; font-size: 14px;">You may close this window.</p>
-          </body>
-        </html>
-      `);
-            this.logger('info', `Google OAuth login: ${userInfo.email}`);
-        }
-        catch (err) {
-            this.logger('error', 'Google OAuth callback error', err);
-            res.writeHead(500, { 'Content-Type': 'text/html; charset=utf-8' });
-            res.end('<h1>Authentication Failed</h1><p>Internal error</p>');
-        }
-    }
-    createGoogleSessionJwt(email) {
-        const header = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url');
-        const now = Math.floor(Date.now() / 1000);
-        const payload = Buffer.from(JSON.stringify({
-            sub: email,
-            iss: 'vibe',
-            aud: 'vibe-web',
-            iat: now,
-            exp: now + 86400, // 24h
-        })).toString('base64url');
-        const signature = crypto.createHmac('sha256', this.googleSessionSecret)
-            .update(`${header}.${payload}`)
-            .digest('base64url');
-        return `${header}.${payload}.${signature}`;
-    }
-    verifyGoogleSessionJwt(token) {
-        try {
-            const parts = token.split('.');
-            if (parts.length !== 3)
-                return false;
-            const [headerB64, payloadB64, signatureB64] = parts;
-            const header = JSON.parse(base64urlDecode(headerB64));
-            if (header.alg !== 'HS256')
-                return false;
-            const payload = JSON.parse(base64urlDecode(payloadB64));
-            const now = Math.floor(Date.now() / 1000);
-            if (payload.exp && payload.exp < now - JWT_CLOCK_SKEW_SECONDS)
-                return false;
-            if (!payload.sub)
-                return false;
-            const expected = crypto.createHmac('sha256', this.googleSessionSecret)
-                .update(`${headerB64}.${payloadB64}`)
-                .digest('base64url');
-            const sigBuf = Buffer.from(signatureB64);
-            const expBuf = Buffer.from(expected);
-            if (sigBuf.length !== expBuf.length)
-                return false;
-            return crypto.timingSafeEqual(sigBuf, expBuf);
-        }
-        catch {
-            return false;
-        }
-    }
-    cleanupOAuthStates() {
-        const now = Date.now();
-        for (const [key, val] of this.oauthStates) {
-            if (now - val.createdAt > 5 * 60 * 1000) {
-                this.oauthStates.delete(key);
-            }
-        }
-    }
-    // ========================================================================
-    // Utility
-    // ========================================================================
-    mapEventType(type) {
-        const mapping = {
-            'job_created': 'job:created',
-            'job_progress': 'job:progress',
-            'job_chunk': 'job:chunk',
-            'job_complete': 'job:complete',
-            'job_error': 'job:error',
-            'permission_request': 'permission:request',
-        };
-        return mapping[type] || 'job:progress';
-    }
-    isOriginAllowed(origin) {
-        return this.config.corsOrigins.some((pattern) => {
-            if (pattern.includes('*')) {
-                const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '[^/]*');
-                const regex = new RegExp('^' + escaped + '$');
-                return regex.test(origin);
-            }
-            return pattern === origin;
-        });
-    }
-    generateToken() {
-        return crypto.randomBytes(32).toString('hex');
-    }
-    saveToken() {
-        try {
-            const dir = path.dirname(TOKEN_FILE);
-            if (!fs.existsSync(dir)) {
-                fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-            }
-            fs.writeFileSync(TOKEN_FILE, this.config.authToken, { mode: 0o600 });
-        }
-        catch (err) {
-            this.logger('warn', 'Failed to save web token', {
-                error: err instanceof Error ? err.message : String(err),
-            });
-        }
-    }
-}
-//# sourceMappingURL=WebServer.js.map