@sunshinelife83/hearth 1.0.0

package/dist/dashboard/app.js

@@ -0,0 +1,226 @@
+"use strict";
+/* Hearth local dashboard. Same-origin fetch; session cookie is HttpOnly.
+ * All mutations send JSON (required by the server as fetch-only CSRF defense). */
+const $ = (id) => document.getElementById(id);
+const esc = (s) => String(s ?? "").replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
+
+async function api(path, options = {}) {
+  const res = await fetch(path, {
+    credentials: "same-origin",
+    headers: { "Content-Type": "application/json", ...(options.headers || {}) },
+    ...options,
+  });
+  if (res.status === 401) { showLogin(); throw new Error("unauthorized"); }
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(body.error || `request failed (${res.status})`);
+  return body;
+}
+
+function showLogin() {
+  $("login").hidden = false;
+  $("tabs").hidden = true;
+  $("logout").hidden = true;
+  document.querySelectorAll(".tab").forEach((el) => { el.hidden = true; });
+}
+
+function showApp() {
+  $("login").hidden = true;
+  $("tabs").hidden = false;
+  $("logout").hidden = false;
+  switchTab("overview");
+}
+
+function switchTab(name) {
+  document.querySelectorAll("#tabs button").forEach((b) => b.classList.toggle("active", b.dataset.tab === name));
+  document.querySelectorAll(".tab").forEach((el) => { el.hidden = el.id !== name; });
+  renderers[name]();
+}
+
+$("tabs").addEventListener("click", (e) => {
+  const tab = e.target.closest("button")?.dataset.tab;
+  if (tab) switchTab(tab);
+});
+
+$("login-form").addEventListener("submit", async (e) => {
+  e.preventDefault();
+  $("login-error").hidden = true;
+  try {
+    await api("/dashboard/api/login", { method: "POST", body: JSON.stringify({ ownerToken: $("owner-token").value }) });
+    $("owner-token").value = "";
+    showApp();
+  } catch (err) {
+    $("login-error").textContent = err.message;
+    $("login-error").hidden = false;
+  }
+});
+
+$("logout").addEventListener("click", async () => {
+  await api("/dashboard/api/logout", { method: "POST", body: "{}" }).catch(() => {});
+  showLogin();
+});
+
+const pill = (text, cls = "") => `<span class="pill ${cls}">${esc(text)}</span>`;
+
+const renderers = {
+  async overview() {
+    const el = $("overview");
+    try {
+      const s = await api("/dashboard/api/status");
+      const tasks = Object.entries(s.tasks || {}).map(([k, v]) => `${pill(`${k}: ${v}`)}`).join(" ") || "<span class='muted'>no tasks</span>";
+      const providers = (s.providers || []).map((p) => `<tr><td>${esc(p.id)}</td><td>${p.enabled ? "yes" : "no"}</td><td>${p.available ? "<span class='good'>available</span>" : "<span class='muted'>unavailable</span>"}</td></tr>`).join("");
+      el.innerHTML = `
+        <div class="card"><h3>Status</h3>
+          <div>Version ${esc(s.version)} · mode ${pill(s.mode)} · sandbox ${esc(s.sandbox)} (${esc(s.sandboxAdapter)})</div>
+          <div class="muted">MCP ${esc("/mcp")} · health ${esc("/healthz")}</div></div>
+        <div class="card"><h3>Tasks</h3><div>${tasks}</div></div>
+        <div class="card"><h3>Providers</h3><table><tr><th>ID</th><th>Enabled</th><th>Status</th></tr>${providers}</table></div>
+        <div class="card"><h3>Open workspaces</h3><pre>${esc((s.workspaces || []).map((w) => `${w.id}  ${w.root}`).join("\n") || "none")}</pre></div>`;
+    } catch (err) { el.innerHTML = `<p class="error">${esc(err.message)}</p>`; }
+  },
+
+  async workspaces() {
+    const el = $("workspaces");
+    try {
+      const w = await api("/dashboard/api/workspaces");
+      const open = (w.open || []).map((o) => `<tr><td><code>${esc(o.id)}</code></td><td>${esc(o.root)}</td><td>${esc(o.mode)}</td></tr>`).join("") || `<tr><td colspan="3" class="muted">none open</td></tr>`;
+      const profiles = (w.profiles || []).map((p) => `<tr><td>${esc(p.path)}</td><td>${esc(p.mode || "inherit")}</td><td>${p.agentsAllowed === false ? "agents off" : "agents on"}</td></tr>`).join("") || `<tr><td colspan="3" class="muted">no profiles</td></tr>`;
+      el.innerHTML = `
+        <div class="card"><h3>Allowed roots</h3><pre>${esc((w.allowedRoots || []).join("\n"))}</pre></div>
+        <div class="card"><h3>Open workspaces</h3><table><tr><th>ID</th><th>Root</th><th>Mode</th></tr>${open}</table></div>
+        <div class="card"><h3>Workspace profiles</h3><table><tr><th>Path</th><th>Mode</th><th>Agents</th></tr>${profiles}</table></div>`;
+    } catch (err) { el.innerHTML = `<p class="error">${esc(err.message)}</p>`; }
+  },
+
+  async agents() {
+    const el = $("agents");
+    try {
+      const w = await api("/dashboard/api/workspaces");
+      if (!w.open.length) { el.innerHTML = `<p class="muted">No open workspaces.</p>`; return; }
+      const sel = document.createElement("select");
+      w.open.forEach((o) => { const opt = document.createElement("option"); opt.value = o.id; opt.textContent = `${o.id} — ${o.root}`; sel.appendChild(opt); });
+      el.innerHTML = `<div class="card"><div class="row"></div><div id="agent-list"></div></div>`;
+      el.querySelector(".row").append(sel);
+      const load = async () => {
+        const data = await api(`/dashboard/api/agents?workspaceId=${encodeURIComponent(sel.value)}`);
+        const rows = (data.agents || []).map((a) => `<tr><td><code>${esc(a.id)}</code></td><td>${esc(a.provider)}/${esc(a.profileName)}</td><td>${esc(a.status)}</td><td>${esc((a.latestResponse || a.latestOutput || a.error || "").slice(0, 120))}</td></tr>`).join("") || `<tr><td colspan="4" class="muted">no agents</td></tr>`;
+        el.querySelector("#agent-list").innerHTML = `<table><tr><th>ID</th><th>Backend</th><th>Status</th><th>Latest</th></tr>${rows}</table>`;
+      };
+      sel.addEventListener("change", () => load().catch((e) => { el.querySelector("#agent-list").innerHTML = `<p class="error">${esc(e.message)}</p>`; }));
+      await load();
+    } catch (err) { el.innerHTML = `<p class="error">${esc(err.message)}</p>`; }
+  },
+
+  async tasks() {
+    const el = $("tasks");
+    try {
+      const data = await api("/dashboard/api/tasks?limit=50");
+      el.innerHTML = (data.tasks || []).map((t) => `
+        <div class="card"><h3><code>${esc(t.id)}</code> ${pill(t.status)} ${t.completionState ? pill(t.completionState) : ""}</h3>
+          <div>${esc(t.goal)}</div>
+          ${t.error ? `<div class="error">${esc(t.error)}</div>` : ""}
+          <pre>${esc((t.evidence || []).slice(-8).map((e) => `- [${e.kind}] ${e.summary}`).join("\n") || "no evidence yet")}</pre>
+        </div>`).join("") || `<p class="muted">No tasks yet. Create one from any MCP client with task_create.</p>`;
+    } catch (err) { el.innerHTML = `<p class="error">${esc(err.message)}</p>`; }
+  },
+
+  async logs() {
+    const el = $("logs");
+    try {
+      const data = await api("/dashboard/api/logs?limit=100");
+      const rows = (data.entries || []).reverse().map((e) => `<tr><td class="muted">${esc(e.ts)}</td><td>${esc(e.level)}</td><td><code>${esc(e.event)}</code></td><td>${esc(e.tool || "")}</td><td>${esc(e.workspaceId || "")}</td></tr>`).join("");
+      el.innerHTML = `<div class="card"><table><tr><th>Time</th><th>Level</th><th>Event</th><th>Tool</th><th>Workspace</th></tr>${rows}</table></div>`;
+    } catch (err) { el.innerHTML = `<p class="error">${esc(err.message)}</p>`; }
+  },
+
+  async config() {
+    const el = $("config");
+    try {
+      const c = await api("/dashboard/api/config");
+      const opt = (v, cur) => `<option value="${v}"${v === cur ? " selected" : ""}>${v}</option>`;
+      el.innerHTML = `
+        <div class="card"><h3>Execution</h3>
+          <div class="row"><label>Mode <select id="cfg-mode">${opt("readonly", c.execution.mode)}${opt("supervised", c.execution.mode)}${opt("autonomous", c.execution.mode)}</select></label>
+          <label>Sandbox <select id="cfg-sandbox">${opt("auto", c.execution.sandbox)}${opt("none", c.execution.sandbox)}</select></label></div>
+          <div class="row"><label><input type="checkbox" id="cfg-reqsandbox" ${c.execution.requireSandboxForAutonomous ? "checked" : ""}> require sandbox for autonomous</label>
+          <button class="primary" id="cfg-save-exec">Save</button></div>
+          <p class="muted">Saving restarts nothing: restart <code>hearth serve</code> to apply.</p></div>
+        <div class="card"><h3>Fleet lanes (JSON)</h3>
+          <textarea id="cfg-lanes" rows="8" cols="60">${esc(JSON.stringify(c.fleet?.lanes ?? {}, null, 2))}</textarea>
+          <div class="row"><button class="primary" id="cfg-save-lanes">Save lanes</button></div></div>
+        <div class="card"><h3>Full safe config</h3><pre>${esc(JSON.stringify(c, null, 2))}</pre></div>
+        <p id="cfg-msg"></p>`;
+      const msg = (t, bad = false) => { const m = $("cfg-msg"); m.textContent = t; m.className = bad ? "error" : "good"; };
+      $("cfg-save-exec").addEventListener("click", async () => {
+        try {
+          await api("/dashboard/api/config", { method: "PUT", body: JSON.stringify({ path: ["execution", "mode"], value: $("cfg-mode").value }) });
+          await api("/dashboard/api/config", { method: "PUT", body: JSON.stringify({ path: ["execution", "sandbox"], value: $("cfg-sandbox").value }) });
+          await api("/dashboard/api/config", { method: "PUT", body: JSON.stringify({ path: ["execution", "requireSandboxForAutonomous"], value: $("cfg-reqsandbox").checked }) });
+          msg("Saved. Restart the server to apply.");
+        } catch (e) { msg(e.message, true); }
+      });
+      $("cfg-save-lanes").addEventListener("click", async () => {
+        try {
+          const lanes = JSON.parse($("cfg-lanes").value);
+          await api("/dashboard/api/config", { method: "PUT", body: JSON.stringify({ path: ["fleet"], value: { lanes } }) });
+          msg("Lanes saved. Restart the server to apply.");
+        } catch (e) { msg(e.message, true); }
+      });
+    } catch (err) { el.innerHTML = `<p class="error">${esc(err.message)}</p>`; }
+  },
+
+  async setup() {
+    const el = $("setup");
+    try {
+      const s = await api("/dashboard/api/setup");
+      const providers = (s.providers || []).map((p) => `<tr><td>${esc(p.id)}</td><td>${p.enabled ? "yes" : "no"}</td><td>${p.available ? "<span class='good'>ready</span>" : "<span class='muted'>missing</span>"}</td></tr>`).join("");
+      el.innerHTML = `
+        <div class="card"><h3>Installation checklist</h3><table>
+          <tr><td>This machine</td><td><code>${esc(s.machineId || "unknown")}</code> <span class="muted">(<code>hearth id</code>)</span></td></tr>
+          <tr><td>Allowed roots configured</td><td>${s.hasAllowedRoots ? "<span class='good'>yes</span>" : "<span class='error'>no — run hearth init or add roots</span>"}</td></tr>
+          <tr><td>Public base URL</td><td><code>${esc(s.publicBaseUrl)}</code></td></tr>
+          <tr><td>Public MCP URL</td><td><code>${esc(s.publicMcpUrl || `${s.publicBaseUrl}/mcp`)}</code></td></tr>
+          <tr><td>Tool mode</td><td><code>${esc(s.toolMode || "")}</code></td></tr>
+          <tr><td>Redirect hosts</td><td><code>${esc((s.redirectHosts || []).join(", "))}</code></td></tr>
+          <tr><td>Subagents enabled</td><td>${s.subagentsEnabled ? "yes" : "no"}</td></tr>
+          <tr><td>MCP endpoint</td><td><code>${esc(s.mcpEndpoint)}</code></td></tr>
+          <tr><td>Health endpoint</td><td><code>${esc(s.healthEndpoint)}</code></td></tr>
+        </table></div>
+        <div class="card"><h3>Agent backends</h3><table><tr><th>ID</th><th>Enabled</th><th>Status</th></tr>${providers}</table>
+        <p class="muted">Missing CLIs are optional — delegation to them fails loud with install hints. opencode needs a model allow-list from you (see its skill docs) so you never get a surprise bill.</p></div>
+        <div class="card"><h3>Fleet lanes</h3><pre>${esc((s.fleetLanes || []).join("\n") || "none configured — pass target directly or add fleet.lanes in config")}</pre></div>`;
+    } catch (err) { el.innerHTML = `<p class="error">${esc(err.message)}</p>`; }
+  },
+
+  async connect() {
+    const el = $("connect");
+    try {
+      const s = await api("/dashboard/api/setup");
+      const mcpUrl = s.publicMcpUrl || `${s.publicBaseUrl}/mcp`;
+      el.innerHTML = `
+        <div class="card"><h3>This PC</h3>
+          <div>Machine <code>${esc(s.machineId || "unknown")}</code> (diagnostic label — keep one public URL per PC; the label does not prevent cloning).</div>
+          <div>Public MCP URL: <code>${esc(mcpUrl)}</code></div>
+          <div class="muted">Local: <code>${esc(s.mcpEndpoint)}</code> · health: <code>${esc(s.healthEndpoint)}</code> · tool mode: <code>${esc(s.toolMode || "")}</code></div></div>
+        <div class="card"><h3>ChatGPT</h3>
+          <ol><li>Keep <code>hearth serve</code> running; tunnel must proxy the whole origin, not only <code>/mcp</code>.</li>
+          <li>Add connector URL <code>${esc(mcpUrl)}</code>.</li>
+          <li>Approve with the Owner password (<code>~/.hearth/auth.json</code>).</li></ol></div>
+        <div class="card"><h3>Claude</h3>
+          <ol><li>Redirect hosts now: <code>${esc((s.redirectHosts || []).join(", "))}</code> (needs <code>claude.ai</code>).</li>
+          <li>Add MCP server <code>${esc(mcpUrl)}</code>, approve with Owner password.</li>
+          <li>Local-only alternative: <code>hearth token create claude-local</code> + <code>hearth mcp</code> as stdio.</li></ol></div>
+        <div class="card"><h3>Any MCP client</h3>
+          <div>Remote OAuth: <code>${esc(mcpUrl)}</code></div>
+          <div>Local stdio: <code>hearth mcp</code> (device token via <code>hearth token create &lt;name&gt;</code> for bearer).</div>
+          <p class="muted">CLI equivalent: <code>hearth connect [chatgpt|claude|generic]</code>.</p></div>`;
+    } catch (err) { el.innerHTML = `<p class="error">${esc(err.message)}</p>`; }
+  },
+};
+
+(async () => {
+  try {
+    const me = await api("/dashboard/api/me");
+    if (me.authenticated) showApp();
+    else showLogin();
+  } catch { showLogin(); }
+})();

package/dist/dashboard/index.html

@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Hearth Dashboard</title>
+<link rel="stylesheet" href="/dashboard/styles.css">
+</head>
+<body>
+<header>
+  <h1>Hearth</h1>
+  <nav id="tabs" hidden>
+    <button data-tab="overview" class="active">Overview</button>
+    <button data-tab="connect">Connect</button>
+    <button data-tab="workspaces">Workspaces</button>
+    <button data-tab="agents">Agents</button>
+    <button data-tab="tasks">Tasks</button>
+    <button data-tab="logs">Logs</button>
+    <button data-tab="config">Config</button>
+    <button data-tab="setup">Setup</button>
+  </nav>
+  <button id="logout" hidden>Log out</button>
+</header>
+<main>
+  <section id="login">
+    <h2>Sign in</h2>
+    <p>Enter the Owner password printed by <code>hearth init</code>.</p>
+    <form id="login-form">
+      <input id="owner-token" type="password" autocomplete="current-password" placeholder="Owner password" required>
+      <button type="submit">Sign in</button>
+    </form>
+    <p id="login-error" class="error" hidden></p>
+  </section>
+  <section id="overview" class="tab" hidden></section>
+  <section id="connect" class="tab" hidden></section>
+  <section id="workspaces" class="tab" hidden></section>
+  <section id="agents" class="tab" hidden></section>
+  <section id="tasks" class="tab" hidden></section>
+  <section id="logs" class="tab" hidden></section>
+  <section id="config" class="tab" hidden></section>
+  <section id="setup" class="tab" hidden></section>
+</main>
+<script src="/dashboard/app.js"></script>
+</body>
+</html>

package/dist/dashboard/landing.html

@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Hearth — local AI engineering runtime</title>
+<link rel="stylesheet" href="/dashboard/styles.css">
+</head>
+<body>
+<main>
+  <h1>Hearth</h1>
+  <p>Your computer as a local-first AI software engineering runtime, exposed
+  to ChatGPT, Claude, and other MCP-compatible clients. You run the server,
+  the execution environment, and the workspace authority.</p>
+
+  <div class="card">
+    <h3>Install</h3>
+    <p>Install once, then <code>hearth</code> works like <code>opencode</code>:</p>
+    <pre>npm install -g @sunshinelife83/hearth
+hearth init
+hearth serve</pre>
+    <p class="muted">Then <code>hearth connect</code> prints per-host steps, and <code>hearth doctor</code> checks Node, Git, Bash, URLs, and hosts.</p>
+    <p class="muted">From a source checkout: <code>./install.sh</code>, then <code>hearth init</code>. Requires Node 22.19+.</p>
+  </div>
+
+  <div class="card">
+    <h3>Use it</h3>
+    <ol>
+      <li>Run <code>hearth serve</code> (or <code>hearth mcp</code> for local stdio).</li>
+      <li>Open the <a href="/dashboard">local dashboard</a> and sign in with your Owner password.</li>
+      <li>Run <code>hearth connect</code> and paste the public <code>/mcp</code> URL into your MCP client (via your own tunnel for remote clients).</li>
+      <li>Ask it to open a project, plan a task, delegate to a coding agent, verify, land.</li>
+    </ol>
+  </div>
+
+  <div class="card">
+    <h3>Connect</h3>
+    <p>Each PC has a stable <code>hearth-xxxx</code> diagnostic label (<code>hearth id</code>). Keep one public URL per PC — OAuth tokens are bound to that machine's resource URL. The label is not a security boundary: copying the state directory copies the identity.</p>
+    <ul>
+      <li><strong>ChatGPT:</strong> add the public <code>/mcp</code> URL as a connector, approve with the Owner password.</li>
+      <li><strong>Claude:</strong> same public <code>/mcp</code> URL; ensure <code>oauth.allowedRedirectHosts</code> includes <code>claude.ai</code>. Or <code>hearth token create claude-local</code> + <code>hearth mcp</code> for local stdio.</li>
+      <li><strong>Any MCP client:</strong> remote OAuth via public <code>/mcp</code>, or local <code>hearth mcp</code> with a device token bearer.</li>
+    </ul>
+    <p class="muted">Tip: <code>hearth connect chatgpt|claude|generic</code> prints the exact snippet for this machine. <a href="/healthz">/healthz</a> reports this machine's id and MCP URL.</p>
+  </div>
+
+  <div class="card">
+    <h3>Endpoints</h3>
+    <table>
+      <tr><td><a href="/dashboard">/dashboard</a></td><td>Local ops console (Owner sign-in)</td></tr>
+      <tr><td><code>/mcp</code></td><td>MCP endpoint (OAuth bearer)</td></tr>
+      <tr><td><a href="/healthz">/healthz</a></td><td>Liveness probe</td></tr>
+    </table>
+  </div>
+</main>
+</body>
+</html>

package/dist/dashboard/styles.css

@@ -0,0 +1,23 @@
+:root { color-scheme: dark; --bg: #14171c; --panel: #1d2129; --text: #e6e9ee; --muted: #9aa3b2; --accent: #6aa5ff; --bad: #ff7a7a; --good: #7ddf9a; }
+* { box-sizing: border-box; }
+body { margin: 0; background: var(--bg); color: var(--text); font: 14px/1.5 system-ui, sans-serif; }
+header { display: flex; align-items: center; gap: 1rem; padding: 0.6rem 1rem; background: var(--panel); position: sticky; top: 0; }
+header h1 { font-size: 1.1rem; margin: 0; }
+nav { display: flex; gap: 0.25rem; flex-wrap: wrap; }
+nav button, #logout { background: none; border: 1px solid transparent; color: var(--text); padding: 0.35rem 0.7rem; border-radius: 6px; cursor: pointer; }
+nav button.active { border-color: var(--accent); }
+nav button:hover, #logout:hover { background: #2a303b; }
+#logout { margin-left: auto; }
+main { padding: 1rem; max-width: 1100px; margin: 0 auto; }
+.card { background: var(--panel); border-radius: 8px; padding: 0.8rem 1rem; margin-bottom: 0.8rem; }
+.muted { color: var(--muted); }
+.error { color: var(--bad); }
+.good { color: var(--good); }
+table { border-collapse: collapse; width: 100%; }
+th, td { text-align: left; padding: 0.35rem 0.5rem; border-bottom: 1px solid #2a303b; vertical-align: top; }
+code, pre { font-family: ui-monospace, monospace; }
+pre { white-space: pre-wrap; word-break: break-word; background: #10131a; padding: 0.6rem; border-radius: 6px; max-height: 320px; overflow: auto; }
+input, select, textarea { background: #10131a; color: var(--text); border: 1px solid #2a303b; border-radius: 6px; padding: 0.4rem 0.6rem; }
+button.primary { background: var(--accent); border: none; color: #0b0e13; padding: 0.4rem 0.9rem; border-radius: 6px; cursor: pointer; }
+.row { display: flex; gap: 0.6rem; align-items: center; flex-wrap: wrap; margin-bottom: 0.6rem; }
+.pill { display: inline-block; padding: 0.1rem 0.5rem; border-radius: 999px; background: #2a303b; font-size: 0.8rem; }

package/dist/dashboard.js

@@ -0,0 +1,271 @@
+import { randomBytes, timingSafeEqual, createHmac } from "node:crypto";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import express from "express";
+import * as z from "zod/v4";
+import { createLocalAgentClient } from "./local-agent-client.js";
+import { listSnapshots } from "./snapshot-manager.js";
+import { probeSandboxAdapter } from "./policy/sandbox.js";
+import { hearthVersion } from "./app-version.js";
+import { recentLogEntries, logEvent } from "./logger.js";
+import { setHearthConfigValue } from "./user-config.js";
+import { RateLimiter, ipRateLimitMiddleware } from "./rate-limit.js";
+import { fleetConfigSchema } from "./orchestration/lanes.js";
+import { loadMachineIdentity } from "./machine-id.js";
+const SESSION_TTL_MS = 12 * 3600 * 1000;
+const SESSION_COOKIE = "hearth_session";
+function safeEqual(a, b) {
+    const aBuf = Buffer.from(a, "utf8");
+    const bBuf = Buffer.from(b, "utf8");
+    if (aBuf.length !== bBuf.length)
+        return false;
+    return timingSafeEqual(aBuf, bBuf);
+}
+export function dashboardDirectory() {
+    const dist = fileURLToPath(new URL("../dist/dashboard", import.meta.url));
+    if (existsSync(dist))
+        return dist;
+    return fileURLToPath(new URL("./dashboard", import.meta.url));
+}
+const configEditSchema = z.object({
+    path: z.array(z.union([z.string(), z.number()])).min(1).max(4),
+    value: z.unknown(),
+});
+const ALLOWED_CONFIG_PATHS = [
+    { path: ["execution", "mode"], validate: (v) => z.enum(["readonly", "supervised", "autonomous"]).parse(v) },
+    { path: ["execution", "sandbox"], validate: (v) => z.enum(["auto", "none"]).parse(v) },
+    { path: ["execution", "sandboxNetwork"], validate: (v) => z.enum(["allow", "deny"]).parse(v) },
+    { path: ["execution", "requireSandboxForAutonomous"], validate: (v) => z.boolean().parse(v) },
+    { path: ["fleet"], validate: (v) => fleetConfigSchema.parse(v) },
+    { path: ["workspaces", "profiles"], validate: (v) => z.array(z.record(z.string(), z.unknown())).parse(v) },
+];
+export function registerDashboard(app, context) {
+    const { config, workspaces, taskStore } = context;
+    const sessionSecret = randomBytes(32);
+    const sessions = new Map();
+    const loginLimiter = new RateLimiter({
+        keyPrefix: "dashboard-login",
+        rule: { limit: 10, windowMs: 15 * 60 * 1000 },
+    });
+    const signSession = (id) => `${id}.${createHmac("sha256", sessionSecret).update(id).digest("hex")}`;
+    const readSession = (req) => {
+        const cookie = req.headers.cookie
+            ?.split(";")
+            .map((part) => part.trim())
+            .find((part) => part.startsWith(`${SESSION_COOKIE}=`))
+            ?.slice(SESSION_COOKIE.length + 1);
+        if (!cookie)
+            return undefined;
+        const dot = cookie.lastIndexOf(".");
+        if (dot <= 0)
+            return undefined;
+        const id = cookie.slice(0, dot);
+        const signature = cookie.slice(dot + 1);
+        const expected = createHmac("sha256", sessionSecret).update(id).digest("hex");
+        if (!safeEqual(signature, expected))
+            return undefined;
+        const expires = sessions.get(id);
+        if (!expires || expires < Date.now()) {
+            sessions.delete(id);
+            return undefined;
+        }
+        return id;
+    };
+    const requireSession = (req, res, next) => {
+        if (!readSession(req)) {
+            res.status(401).json({ error: "Dashboard session required. POST /dashboard/api/login first." });
+            return;
+        }
+        next();
+    };
+    const requireJson = (req, res, next) => {
+        if (!req.is("application/json")) {
+            res.status(415).json({ error: "JSON content type required." });
+            return;
+        }
+        next();
+    };
+    const configEnv = { ...process.env, HEARTH_CONFIG_DIR: config.configDir };
+    app.post("/dashboard/api/login", ipRateLimitMiddleware(loginLimiter, config.oauth.trustProxy), express.json({ limit: "16kb" }), (req, res) => {
+        const parsed = z.object({ ownerToken: z.string().min(1).max(500) }).safeParse(req.body);
+        if (!parsed.success || !safeEqual(parsed.data.ownerToken, config.oauth.ownerToken)) {
+            logEvent(config.logging, "warn", "dashboard_login_denied", {});
+            res.status(401).json({ error: "Invalid owner password." });
+            return;
+        }
+        const id = randomBytes(16).toString("hex");
+        sessions.set(id, Date.now() + SESSION_TTL_MS);
+        res.cookie(SESSION_COOKIE, signSession(id), {
+            httpOnly: true,
+            sameSite: "lax",
+            path: "/",
+            maxAge: SESSION_TTL_MS,
+        });
+        logEvent(config.logging, "info", "dashboard_login", {});
+        res.json({ ok: true });
+    });
+    app.post("/dashboard/api/logout", express.json({ limit: "1kb" }), (req, res) => {
+        const id = readSession(req);
+        if (id)
+            sessions.delete(id);
+        res.clearCookie(SESSION_COOKIE, { path: "/" });
+        res.json({ ok: true });
+    });
+    app.get("/dashboard/api/me", (req, res) => {
+        res.json({ authenticated: readSession(req) !== undefined });
+    });
+    app.get("/dashboard/api/status", requireSession, (_req, res) => {
+        const tasks = taskStore?.list() ?? [];
+        const byStatus = {};
+        for (const task of tasks)
+            byStatus[task.status] = (byStatus[task.status] ?? 0) + 1;
+        res.json({
+            version: hearthVersion(),
+            mode: config.execution.mode,
+            sandbox: config.execution.sandbox,
+            sandboxAdapter: probeSandboxAdapter(),
+            requireSandboxForAutonomous: config.execution.requireSandboxForAutonomous,
+            toolMode: config.toolMode,
+            publicBaseUrl: config.publicBaseUrl,
+            providers: context.resolveLocalAgentProviders(),
+            workspaces: workspaces.listWorkspaces(),
+            tasks: byStatus,
+            lanes: config.fleet.lanes,
+        });
+    });
+    app.get("/dashboard/api/workspaces", requireSession, (_req, res) => {
+        res.json({
+            open: workspaces.listWorkspaces(),
+            allowedRoots: config.allowedRoots,
+            profiles: config.workspaceProfiles,
+        });
+    });
+    app.get("/dashboard/api/tasks", requireSession, (req, res) => {
+        const limit = Math.min(Math.max(1, Number(req.query.limit ?? 50)), 200);
+        res.json({ tasks: (taskStore?.list() ?? []).slice(0, limit) });
+    });
+    app.get("/dashboard/api/agents", requireSession, async (req, res) => {
+        const workspaceId = String(req.query.workspaceId ?? "");
+        if (!workspaceId) {
+            res.status(400).json({ error: "workspaceId query parameter required." });
+            return;
+        }
+        try {
+            const workspace = workspaces.getWorkspace(workspaceId);
+            const client = createLocalAgentClient(config);
+            const result = await client.list({ workspaceId, workspaceRoot: workspace.root });
+            if (result.isErr()) {
+                res.status(502).json({ error: `${result.error.code}: ${result.error.message}` });
+                return;
+            }
+            res.json({ agents: result.value });
+        }
+        catch (error) {
+            res.status(404).json({ error: error instanceof Error ? error.message : String(error) });
+        }
+    });
+    app.get("/dashboard/api/snapshots", requireSession, async (req, res) => {
+        const workspaceId = String(req.query.workspaceId ?? "");
+        if (!workspaceId) {
+            res.status(400).json({ error: "workspaceId query parameter required." });
+            return;
+        }
+        try {
+            const workspace = workspaces.getWorkspace(workspaceId);
+            res.json({ snapshots: await listSnapshots({ root: workspace.root, workspaceId }) });
+        }
+        catch (error) {
+            res.status(404).json({ error: error instanceof Error ? error.message : String(error) });
+        }
+    });
+    app.get("/dashboard/api/logs", requireSession, (req, res) => {
+        const limit = Math.min(Math.max(1, Number(req.query.limit ?? 100)), 200);
+        res.json({ entries: recentLogEntries(limit) });
+    });
+    app.get("/dashboard/api/setup", requireSession, (_req, res) => {
+        const providers = context.resolveLocalAgentProviders();
+        let machineId;
+        try {
+            machineId = loadMachineIdentity(config.stateDir).id;
+        }
+        catch {
+            machineId = undefined;
+        }
+        res.json({
+            machineId,
+            allowedRoots: config.allowedRoots,
+            hasAllowedRoots: config.allowedRoots.length > 0,
+            publicBaseUrl: config.publicBaseUrl,
+            publicMcpUrl: new URL("/mcp", config.publicBaseUrl).toString(),
+            toolMode: config.toolMode,
+            redirectHosts: config.oauth.allowedRedirectHosts,
+            subagentsEnabled: config.subagents.enabled,
+            providers: providers.map((provider) => ({
+                id: provider.id,
+                enabled: provider.enabled,
+                available: provider.available,
+            })),
+            fleetLanes: Object.keys(config.fleet.lanes),
+            healthEndpoint: "/healthz",
+            mcpEndpoint: "/mcp",
+        });
+    });
+    app.get("/dashboard/api/config", requireSession, (_req, res) => {
+        res.json({
+            execution: {
+                mode: config.execution.mode,
+                sandbox: config.execution.sandbox,
+                sandboxNetwork: config.execution.sandboxNetwork,
+                requireSandboxForAutonomous: config.execution.requireSandboxForAutonomous,
+            },
+            toolMode: config.toolMode,
+            publicBaseUrl: config.publicBaseUrl,
+            allowedRoots: config.allowedRoots,
+            fleet: config.fleet,
+            subagents: {
+                enabled: config.subagents.enabled,
+                providers: config.subagents.providers.map((provider) => ({
+                    id: provider.id,
+                    enabled: provider.enabled,
+                    ...(provider.model ? { model: provider.model } : {}),
+                    ...(provider.effort ? { effort: provider.effort } : {}),
+                })),
+            },
+            workspaceProfiles: config.workspaceProfiles,
+        });
+    });
+    app.put("/dashboard/api/config", requireSession, requireJson, express.json({ limit: "64kb" }), (req, res) => {
+        const parsed = configEditSchema.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({ error: "Body must be { path: [...], value }." });
+            return;
+        }
+        const allowed = ALLOWED_CONFIG_PATHS.find((entry) => entry.path.length === parsed.data.path.length
+            && entry.path.every((segment, index) => segment === parsed.data.path[index]));
+        if (!allowed) {
+            res.status(403).json({ error: "Config path is not editable from the dashboard." });
+            return;
+        }
+        let value;
+        try {
+            value = allowed.validate(parsed.data.value);
+        }
+        catch (error) {
+            res.status(400).json({ error: error instanceof Error ? error.message : String(error) });
+            return;
+        }
+        try {
+            setHearthConfigValue(allowed.path, value, configEnv);
+        }
+        catch (error) {
+            res.status(500).json({ error: error instanceof Error ? error.message : String(error) });
+            return;
+        }
+        logEvent(config.logging, "info", "dashboard_config_edit", { path: allowed.path.join(".") });
+        res.json({ ok: true, restartRequired: true });
+    });
+    app.get("/dashboard", (_req, res) => {
+        res.sendFile("index.html", { root: dashboardDirectory() });
+    });
+    app.use("/dashboard", express.static(dashboardDirectory(), { fallthrough: false }));
+}