@therealjsmastery/jsm-hq 0.0.0-stage → 0.1.0

package/dist-server/main.mjs

@@ -0,0 +1,2342 @@
+// server/main.ts
+import { existsSync as existsSync11 } from "node:fs";
+import { dirname as dirname2, join as join10, resolve as resolve2 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// src/data/types.ts
+var SERVICE_KEYS = ["anthropic", "openai", "github", "google", "groq", "mistral", "openrouter", "xai", "nebius", "copilot", "cursor", "devin", "droid"];
+
+// server/lib/exec.ts
+import { execFile } from "node:child_process";
+function run(cmd, args, opts = {}) {
+  return new Promise((resolve3) => {
+    const child = execFile(
+      cmd,
+      args,
+      { cwd: opts.cwd, timeout: opts.timeoutMs ?? 2e4, maxBuffer: 8 * 1024 * 1024, env: process.env },
+      (err, stdout, stderr) => {
+        const code = err && typeof err.code === "number" ? Number(err.code) : err ? null : 0;
+        resolve3({ ok: !err, code: err ? code ?? 1 : 0, stdout: String(stdout), stderr: String(stderr || (err && !stderr ? err.message : "")) });
+      }
+    );
+    if (opts.input !== void 0) child.stdin?.end(opts.input);
+  });
+}
+async function has(cmd) {
+  const r = process.platform === "win32" ? await run("where", [cmd], { timeoutMs: 5e3 }) : await run("sh", ["-c", `command -v ${cmd}`], { timeoutMs: 5e3 });
+  return r.ok && r.stdout.trim().length > 0;
+}
+function shq(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+
+// src/theme/tokens.ts
+var colors = {
+  ink: "#241a2e",
+  cream: "#fff6e9",
+  cream2: "#f0dfc2",
+  cream3: "#e2cba6",
+  muted: "#7d6b73",
+  navy: "#1d2b53",
+  navy2: "#16213f",
+  blue: "#29adff",
+  red: "#ff004d",
+  orange: "#ffa300",
+  green: "#00e436",
+  lav: "#83769c",
+  yellow: "#ffec27",
+  pink: "#ff77a8",
+  grass: "#4a8f3d",
+  white: "#fff1e8"
+};
+var stateStyle = {
+  working: { label: "Working", color: colors.blue, dim: "#1d6fb8" },
+  "needs-input": { label: "Needs input", color: colors.red, dim: "#7e0f33" },
+  "in-review": { label: "In review", color: colors.orange, dim: "#a86a00" },
+  "review-passed": { label: "Review passed", color: colors.green, dim: "#00873a" },
+  idle: { label: "Idle", color: colors.lav, dim: "#5a5170" }
+};
+var reviewStyle = {
+  pending: { label: "Queued", color: colors.lav, dim: "#5a5170" },
+  reviewing: { label: "Reviewing", color: colors.orange, dim: "#a86a00" },
+  "changes-requested": { label: "Changes", color: colors.red, dim: "#7e0f33" },
+  passed: { label: "Passed", color: colors.green, dim: "#00873a" }
+};
+var agentPalette = [
+  "#ff77a8",
+  // pink
+  "#29adff",
+  // blue
+  "#ffd23a",
+  // yellow
+  "#00e436",
+  // green
+  "#ff8a3d",
+  // orange
+  "#a98bff",
+  // violet
+  "#3ee0d0",
+  // teal
+  "#ff5c5c",
+  // coral
+  "#c2c3c7",
+  // silver
+  "#b0e04a",
+  // lime
+  "#f0a6ff",
+  // lilac
+  "#6fa8ff"
+  // periwinkle
+];
+
+// server/planExport.ts
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+var PLAN_EXPORT_PATH = "docs/plan.md";
+var BOX = { todo: "[ ]", "in-progress": "[ ]", "in-review": "[ ]", blocked: "[ ]", done: "[x]" };
+var STATUS = { todo: "", "in-progress": "in progress", "in-review": "in review", blocked: "blocked", done: "" };
+function planMarkdown(config, plan) {
+  const name = (id) => id ? config.team.find((a) => a.id === id)?.name ?? id : null;
+  const lines = [`# ${config.project.name} plan`, "", "_Written by JSM HQ from .jsmhq/plan.json. Edits here are overwritten; change the plan in HQ._", ""];
+  for (const b of [...plan.boards].sort((x, y) => x.order - y.order)) {
+    lines.push(`## ${b.title} (${b.status})`, "");
+    const tasks = plan.tasks.filter((t2) => t2.boardId === b.id);
+    if (!tasks.length) lines.push("_No tasks._");
+    for (const t2 of tasks) {
+      const meta = [name(t2.ownerId), STATUS[t2.status], t2.prNumber ? `PR #${t2.prNumber}` : "", t2.needs.length ? `needs ${t2.needs.join(", ")}` : ""].filter(Boolean);
+      lines.push(`- ${BOX[t2.status]} **${t2.id}** ${t2.title}${meta.length ? ` \u2014 ${meta.join(" \xB7 ")}` : ""}`);
+      if (t2.description) lines.push(`  - ${t2.description.replace(/\s*\n\s*/g, " ")}`);
+      if (t2.doneWhen) lines.push(`  - Done when: ${t2.doneWhen.replace(/\s*\n\s*/g, " ")}`);
+      if (t2.note) lines.push(`  - Note: ${t2.note}`);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function writePlanExport(root, config, plan) {
+  const file = join(root, PLAN_EXPORT_PATH);
+  mkdirSync(join(file, ".."), { recursive: true });
+  writeFileSync(file, planMarkdown(config, plan));
+}
+
+// server/store.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, renameSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join3 } from "node:path";
+
+// server/paths.ts
+import { randomBytes } from "node:crypto";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { join as join2 } from "node:path";
+var slugify = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "") || "project";
+function projectHome(projectSlug) {
+  const dir2 = join2(homedir(), ".jsmhq", projectSlug);
+  mkdirSync2(dir2, { recursive: true });
+  return dir2;
+}
+function managedWorkspace(projectSlug, agentId) {
+  return join2(projectHome(projectSlug), agentId);
+}
+var sessionName = (projectSlug, agentId) => `hq-${projectSlug}-${agentId}`;
+function agentToken(projectSlug) {
+  const file = join2(projectHome(projectSlug), "agent-token");
+  if (existsSync(file)) return readFileSync(file, "utf8").trim();
+  const tok = randomBytes(24).toString("hex");
+  writeFileSync2(file, tok, { mode: 384 });
+  return tok;
+}
+function browserToken(projectSlug, dev) {
+  if (!dev) return randomBytes(24).toString("hex");
+  const file = join2(projectHome(projectSlug), "dev-browser-token");
+  if (existsSync(file)) return readFileSync(file, "utf8").trim();
+  const tok = randomBytes(24).toString("hex");
+  writeFileSync2(file, tok, { mode: 384 });
+  return tok;
+}
+
+// server/store.ts
+var dir = (root) => join3(root, ".jsmhq");
+function readJson(file) {
+  if (!existsSync2(file)) return null;
+  return JSON.parse(readFileSync2(file, "utf8"));
+}
+function writeJson(file, value) {
+  mkdirSync3(join3(file, ".."), { recursive: true });
+  const tmp = `${file}.tmp`;
+  writeFileSync3(tmp, JSON.stringify(value, null, 2) + "\n");
+  renameSync(tmp, file);
+}
+var defaultSandbox = () => ({
+  resources: { cpus: null, memoryGb: null },
+  // sbx's own defaults
+  allow: [],
+  deny: []
+});
+function newAgent(id, name, role, color, isLead) {
+  return {
+    id,
+    name,
+    role,
+    isLead,
+    cli: "claude",
+    model: "",
+    // the CLI's default; users can pick with /model or "Start with model"
+    mode: "sandbox",
+    color,
+    skills: [],
+    roleMd: isLead ? `You are ${name}, the lead. You plan and assign work. You never write app code.` : `You are ${name}, a ${role.toLowerCase()} on the team. You build the tasks assigned to you.`,
+    sandbox: defaultSandbox(),
+    workspacePath: null
+  };
+}
+function defaultConfig(repo, port) {
+  return {
+    project: { id: slugify(repo.name), name: repo.name, repo: repo.github ?? repo.name, path: repo.root, hqPort: port },
+    team: [newAgent("john", "John", "Lead", "#ff77a8", true), newAgent("bob", "Bob", "Developer", "#29adff", false)],
+    workflow: {
+      review: { enabled: true, tool: repo.hasCodeRabbit ? "coderabbit" : "human", command: "" },
+      merge: { by: "human" },
+      deploy: { enabled: repo.hasInsta, tool: "instacloud", command: "", perAgentEnvironments: repo.hasInsta }
+    }
+  };
+}
+function loadConfig(repo, port) {
+  const file = join3(dir(repo.root), "config.json");
+  const found = readJson(file);
+  if (found) {
+    for (const a of found.team) {
+      a.workspacePath ??= null;
+      a.cli ??= "claude";
+      a.sandbox.resources ??= { cpus: null, memoryGb: null };
+      const old = a.sandbox;
+      delete old.policy;
+      delete old.proxy;
+      delete old.secrets;
+    }
+    found.project.id = slugify(found.project.id ?? found.project.name);
+    found.project.path = repo.root;
+    return { config: found, isNew: false };
+  }
+  return { config: defaultConfig(repo, port), isNew: true };
+}
+function saveConfig(root, cfg) {
+  const { path: _path, ...project } = cfg.project;
+  writeJson(join3(dir(root), "config.json"), { ...cfg, project: { ...project, path: "" } });
+}
+function loadPlan(root) {
+  return readJson(join3(dir(root), "plan.json")) ?? { boards: [{ id: "B1", title: "Backlog", status: "active", order: 0 }], tasks: [] };
+}
+function savePlan(root, plan) {
+  writeJson(join3(dir(root), "plan.json"), plan);
+}
+
+// server/hub.ts
+var now = () => (/* @__PURE__ */ new Date()).toISOString();
+var Hub = class _Hub {
+  constructor(repo, slug2, config, plan, setup) {
+    this.repo = repo;
+    this.slug = slug2;
+    this.snap = {
+      setup,
+      sbx: { basePolicy: "unknown", proxy: null, globalKeys: [], agents: {}, checkedAt: now() },
+      config,
+      agents: config.team.map((a) => _Hub.freshStatus(a.id)),
+      boards: plan.boards,
+      tasks: plan.tasks,
+      pullRequests: [],
+      environments: [],
+      messages: [],
+      activity: []
+    };
+  }
+  repo;
+  slug;
+  snap;
+  listeners = /* @__PURE__ */ new Set();
+  seq = 0;
+  static freshStatus(agentId) {
+    return {
+      agentId,
+      state: "idle",
+      currentTaskId: null,
+      stateSince: now(),
+      note: "Not started",
+      session: { state: "stopped", detail: null, workspace: null, sandbox: null }
+    };
+  }
+  subscribe(fn) {
+    this.listeners.add(fn);
+    return () => this.listeners.delete(fn);
+  }
+  emit(e) {
+    for (const fn of this.listeners) fn(e);
+  }
+  // ------------------------------------------------------------ lookups
+  cfg(id) {
+    return this.snap.config.team.find((a) => a.id === id);
+  }
+  status(id) {
+    return this.snap.agents.find((a) => a.agentId === id);
+  }
+  name(id) {
+    if (id === "you") return "You";
+    if (id === "hq") return "HQ";
+    return id && this.cfg(id)?.name || "Someone";
+  }
+  // ------------------------------------------------------------ mutations
+  setStatus(id, patch) {
+    const s = this.status(id);
+    if (!s) return;
+    if (patch.state !== void 0 && patch.state !== s.state) s.stateSince = now();
+    Object.assign(s, patch);
+    this.emit({ type: "agent.updated", agent: structuredClone(s) });
+  }
+  setSession(id, patch) {
+    const s = this.status(id);
+    if (!s) return;
+    s.session = { ...s.session, ...patch };
+    this.emit({ type: "agent.updated", agent: structuredClone(s) });
+  }
+  setSetup(setup) {
+    this.snap.setup = setup;
+    this.emit({ type: "setup.updated", setup });
+  }
+  activity(type, agentId, text) {
+    this.seq += 1;
+    const event = { id: `a${this.seq}`, at: now(), type, agentId, text };
+    this.snap.activity = [event, ...this.snap.activity].slice(0, 50);
+    this.emit({ type: "activity", event });
+  }
+  configChanged() {
+    saveConfig(this.repo.root, this.snap.config);
+    this.emit({ type: "config.updated", config: structuredClone(this.snap.config) });
+  }
+  planChanged() {
+    const plan = { boards: this.snap.boards, tasks: this.snap.tasks };
+    savePlan(this.repo.root, plan);
+    if (this.snap.config.project.exportPlan) writePlanExport(this.repo.root, this.snap.config, plan);
+  }
+  terminal(agentId, data) {
+    this.emit({ type: "terminal.output", agentId, data });
+  }
+};
+
+// server/commands.ts
+var slug = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "") || "agent";
+var str = (v, max = 2e3) => typeof v === "string" ? v.slice(0, max) : "";
+var num = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
+function makeCommands(hub, sessions, planner, inbox, sbx) {
+  const attempt = async (agentId, what, fn) => {
+    try {
+      await fn();
+      hub.activity("config", agentId, what);
+    } catch (err) {
+      hub.activity("config", agentId, `Couldn't ${what.charAt(0).toLowerCase() + what.slice(1)}: ${err instanceof Error ? err.message : err}`);
+    }
+  };
+  const team = () => hub.snap.config.team;
+  const commands = {
+    sendTerminalInput: (id, data) => sessions.input(str(id, 80), str(data, 1e5)),
+    resizeTerminal: (id, cols, rows) => sessions.resize(str(id, 80), num(cols), num(rows)),
+    startAgent: (id) => sessions.start(str(id, 80)),
+    stopAgent: (id) => sessions.stop(str(id, 80)),
+    openWorkspace: (id) => sessions.openWorkspace(str(id, 80)),
+    recreateSandbox: (id) => sessions.recreate(str(id, 80)),
+    recheckSetup: async () => {
+      await sessions.recheckSetup();
+      await sbx.refresh();
+    },
+    runSetupFix: (id) => sessions.runFix(str(id, 40)),
+    // You → agent: same delivery path as the lead's assign_task / send_message.
+    assignTask: (taskId, agentId) => planner.assign(str(taskId, 40), str(agentId, 80), "you"),
+    sendMessage: (toId, text) => planner.message("you", str(toId, 80), str(text, 2e3)),
+    addAgent: (raw) => {
+      const input = raw ?? {};
+      const name = str(input.name, 40).trim() || "Agent";
+      let id = slug(name);
+      for (let i = 2; team().some((a) => a.id === id); i++) id = `${slug(name)}-${i}`;
+      const used = new Set(team().map((a) => a.color));
+      const color = agentPalette.find((c) => !used.has(c)) ?? agentPalette[team().length % agentPalette.length];
+      const agent = newAgent(id, name, str(input.role, 40).trim() || "Developer", color, false);
+      agent.cli = input.cli === "codex" ? "codex" : "claude";
+      agent.model = str(input.model, 60).trim();
+      agent.mode = input.mode === "local" ? "local" : "sandbox";
+      const lead = team().find((a) => a.isLead);
+      if (lead) agent.sandbox = structuredClone(lead.sandbox);
+      team().push(agent);
+      const status = Hub.freshStatus(id);
+      hub.snap.agents.push(status);
+      hub.configChanged();
+      hub.emit({ type: "agent.updated", agent: structuredClone(status) });
+      hub.activity("config", null, `Added ${agent.name} (${agent.role}). Press Start to launch their session.`);
+      if (agent.cli === "codex") void sessions.recheckSetup();
+    },
+    updateAgent: (id, patch) => {
+      const agent = hub.cfg(str(id));
+      if (!agent) return;
+      const p = patch ?? {};
+      const before = `${agent.cli}/${agent.mode}`;
+      for (const k of ["name", "role", "model", "color", "roleMd"]) if (typeof p[k] === "string") agent[k] = str(p[k], 8e3);
+      if (p.mode === "sandbox" || p.mode === "local") agent.mode = p.mode;
+      if ((p.cli === "claude" || p.cli === "codex") && p.cli !== agent.cli) {
+        agent.cli = p.cli;
+        if (typeof p.model !== "string") agent.model = "";
+      }
+      if (Array.isArray(p.skills)) agent.skills = p.skills.map((s) => str(s, 60)).filter(Boolean);
+      if (p.workspacePath !== void 0) agent.workspacePath = p.workspacePath ? str(p.workspacePath, 500).trim() || null : null;
+      hub.configChanged();
+      if (`${agent.cli}/${agent.mode}` !== before) void sessions.recheckSetup();
+    },
+    inspectWorkspace: async (id) => {
+      const info = await sessions.inspectWorkspace(str(id, 80));
+      if (info) hub.emit({ type: "workspace.info", info });
+    },
+    removeAgent: async (id, opts) => {
+      const agent = hub.cfg(str(id));
+      if (!agent || agent.isLead) return;
+      const o = opts ?? {};
+      const removed = await sessions.removeResources(agent.id, { deleteSandbox: o.deleteSandbox !== false, deleteFolder: o.deleteFolder === true });
+      hub.snap.config.team = team().filter((a) => a.id !== agent.id);
+      hub.snap.agents = hub.snap.agents.filter((a) => a.agentId !== agent.id);
+      inbox.forget(agent.id);
+      for (const t2 of hub.snap.tasks)
+        if (t2.ownerId === agent.id && t2.status !== "done") {
+          t2.ownerId = null;
+          if (t2.status === "in-progress") t2.status = "todo";
+          hub.emit({ type: "task.updated", task: { ...t2 } });
+        }
+      hub.planChanged();
+      hub.emit({ type: "agent.removed", agentId: agent.id });
+      hub.configChanged();
+      const what = removed.length ? ` Deleted: ${removed.join(" and ")}.` : "";
+      const kept = removed.includes("folder") ? "" : " Their folder is kept.";
+      hub.activity("config", null, `Removed ${agent.name}.${what}${kept}`);
+    },
+    updateSandbox: (id, patch) => {
+      const agent = hub.cfg(str(id));
+      if (!agent) return;
+      const p = patch ?? {};
+      const clean = (list) => [...new Set(list.map((d) => str(d, 200).trim().toLowerCase()).filter(Boolean))];
+      const rulesChanged = Array.isArray(p.allow) || Array.isArray(p.deny);
+      if (Array.isArray(p.allow)) agent.sandbox.allow = clean(p.allow);
+      if (Array.isArray(p.deny)) agent.sandbox.deny = clean(p.deny);
+      if (p.resources) {
+        const m = hub.snap.setup.machine;
+        const cpus2 = p.resources.cpus === null ? null : Math.round(Math.min(m.cpus, Math.max(1, num(p.resources.cpus))));
+        const maxMem = Math.max(0.5, Math.floor(m.memoryGb * 0.75 * 2) / 2);
+        const memoryGb = p.resources.memoryGb === null ? null : Math.min(maxMem, Math.max(0.5, Math.round(num(p.resources.memoryGb) * 2) / 2));
+        agent.sandbox.resources = { cpus: cpus2, memoryGb };
+      }
+      hub.configChanged();
+      if (rulesChanged) void sbx.syncRules(agent.id);
+    },
+    setSecret: (id, service, value) => {
+      const agentId = id === null ? null : str(id, 80);
+      const svc = str(service, 40);
+      if (!SERVICE_KEYS.includes(svc) || typeof value !== "string" || !value.trim()) return;
+      if (agentId && !hub.cfg(agentId)) return;
+      return attempt(agentId, `Stored the ${svc} key ${agentId ? `for ${hub.name(agentId)}'s sandbox` : "for every sandbox"}`, () => sbx.setKey(agentId, svc, value));
+    },
+    removeSecret: (id, service) => {
+      const agentId = id === null ? null : str(id, 80);
+      const svc = str(service, 40);
+      if (!SERVICE_KEYS.includes(svc)) return;
+      return attempt(agentId, `Removed the ${svc} key ${agentId ? `from ${hub.name(agentId)}'s sandbox` : "from every sandbox"}`, () => sbx.removeKey(agentId, svc));
+    },
+    setProxy: (url) => {
+      const u = typeof url === "string" && url.trim() ? str(url, 300).trim() : null;
+      if (u && !/^https?:\/\/[^\s]+$/i.test(u)) return hub.activity("config", null, "Proxy must be an http(s):// URL");
+      return attempt(null, u ? `Set the sandbox proxy to ${u}` : "Removed the sandbox proxy", () => sbx.setProxy(u));
+    },
+    openEnvFile: async (id) => {
+      const agent = hub.cfg(str(id, 80));
+      if (!agent) return;
+      const file = sbx.ensureEnvFile(agent.id);
+      const [cmd, args] = process.platform === "darwin" ? ["open", ["-t", file]] : process.platform === "win32" ? ["notepad", [file]] : ["xdg-open", [file]];
+      await run(cmd, args, { timeoutMs: 5e3 });
+      await sbx.refresh();
+    },
+    refreshSbx: () => sbx.refresh(),
+    completeWelcome: async (raw) => {
+      if (!hub.snap.welcome) return;
+      const input = raw ?? {};
+      const cli = (c) => c === "codex" ? "codex" : "claude";
+      const used = /* @__PURE__ */ new Set();
+      const make = (name, role, agentCli, isLead) => {
+        const clean = str(name, 40).trim() || (isLead ? "Lead" : "Agent");
+        let id = slug(clean);
+        for (let i = 2; used.has(id); i++) id = `${slug(clean)}-${i}`;
+        used.add(id);
+        const agent = newAgent(id, clean, isLead ? "Lead" : str(role, 40).trim() || "Developer", agentPalette[used.size - 1] ?? agentPalette[0], isLead);
+        agent.cli = agentCli;
+        return agent;
+      };
+      const lead = make(input.lead?.name ?? "John", "Lead", cli(input.lead?.cli), true);
+      const workers = (Array.isArray(input.workers) ? input.workers : []).slice(0, 11).map((w) => make(w?.name ?? "", w?.role ?? "", cli(w?.cli), false));
+      if (!workers.length) return hub.activity("config", null, "Add at least one worker to the team.");
+      const cfg = hub.snap.config;
+      if (typeof input.projectName === "string" && input.projectName.trim()) cfg.project.name = str(input.projectName, 80).trim();
+      cfg.team = [lead, ...workers];
+      const tools = ["coderabbit", "greptile", "copilot", "human", "custom"];
+      if (tools.includes(input.reviewTool)) cfg.workflow.review.tool = input.reviewTool;
+      if (typeof input.reviewEnabled === "boolean") cfg.workflow.review.enabled = input.reviewEnabled;
+      hub.snap.agents = cfg.team.map((a) => Hub.freshStatus(a.id));
+      hub.snap.welcome = false;
+      hub.configChanged();
+      hub.planChanged();
+      await sessions.recheckSetup();
+      await sbx.refresh();
+      hub.emit({ type: "snapshot", snapshot: structuredClone(hub.snap) });
+      hub.activity("config", null, `Welcome! Team created: ${cfg.team.map((a) => a.name).join(", ")}. Press Start team when you're ready.`);
+    },
+    updateWorkflow: (patch) => {
+      const p = patch ?? {};
+      const wf = hub.snap.config.workflow;
+      Object.assign(wf.review, p.review ?? {});
+      Object.assign(wf.merge, p.merge ?? {});
+      Object.assign(wf.deploy, p.deploy ?? {});
+      hub.configChanged();
+    },
+    updateProject: (patch) => {
+      const p = patch ?? {};
+      const project = hub.snap.config.project;
+      if (typeof p.name === "string" && p.name.trim()) project.name = str(p.name, 80);
+      if (typeof p.repo === "string" && p.repo.trim()) project.repo = str(p.repo, 200);
+      const exportOn = typeof p.exportPlan === "boolean" && p.exportPlan && !project.exportPlan;
+      if (typeof p.exportPlan === "boolean") project.exportPlan = p.exportPlan;
+      hub.configChanged();
+      if (exportOn) {
+        hub.planChanged();
+        hub.activity("config", null, "Plan export on: HQ writes docs/plan.md whenever the plan changes.");
+      }
+    },
+    createBoard: (title) => planner.createBoard(str(title, 80)),
+    updateBoard: (id, patch) => {
+      const p = patch ?? {};
+      const status = p.status === "active" || p.status === "planned" || p.status === "done" ? p.status : void 0;
+      planner.updateBoard(str(id, 20), { title: typeof p.title === "string" ? p.title : void 0, status });
+    }
+  };
+  return commands;
+}
+
+// server/http.ts
+import { createReadStream, existsSync as existsSync3, statSync } from "node:fs";
+import { createServer } from "node:http";
+import { extname, join as join4, normalize } from "node:path";
+import { timingSafeEqual } from "node:crypto";
+import { WebSocketServer } from "ws";
+
+// server/hooks.ts
+var clip = (s, n = 80) => s.length > n ? s.slice(0, n - 1) + "\u2026" : s;
+var turnOpen = /* @__PURE__ */ new Map();
+function handleHook(hub, inbox, agentId, event, body) {
+  const st = hub.status(agentId);
+  const name = hub.name(agentId);
+  if (!st) return { ok: false };
+  inbox.noteHook(agentId, event);
+  switch (event) {
+    case "SessionStart":
+      turnOpen.set(agentId, false);
+      hub.setStatus(agentId, { state: "idle", note: "Ready" });
+      break;
+    case "UserPromptSubmit":
+      turnOpen.set(agentId, true);
+      hub.setStatus(agentId, { state: "working", note: body.prompt ? clip(body.prompt.replace(/\s+/g, " ")) : null });
+      if (st.state !== "working") hub.activity("task.started", agentId, `${name} is working`);
+      break;
+    case "PreToolUse":
+      if (turnOpen.get(agentId) === false) break;
+      if (st.state !== "working" || st.note?.startsWith("Asking")) hub.setStatus(agentId, { state: "working", note: body.tool_name ? `Using ${body.tool_name}` : null });
+      break;
+    case "PermissionRequest": {
+      const what = body.tool_name ? `Approve ${body.tool_name}?` : "Approval needed in the terminal";
+      hub.setStatus(agentId, { state: "needs-input", note: `Asking: ${what}` });
+      hub.activity("agent.needs-input", agentId, `${name} needs you: ${what}`);
+      break;
+    }
+    case "Notification": {
+      const msg = body.message ?? "Needs your attention";
+      if (/waiting for your input/i.test(msg) || body.notification_type === "idle_prompt") {
+        hub.setStatus(agentId, { state: "idle", note: "Waiting for you" });
+        break;
+      }
+      hub.setStatus(agentId, { state: "needs-input", note: `Asking: ${clip(msg)}` });
+      hub.activity("agent.needs-input", agentId, `${name} needs you: ${clip(msg, 60)}`);
+      break;
+    }
+    case "Stop": {
+      const queued = inbox.takeForStop(agentId);
+      if (queued) {
+        turnOpen.set(agentId, true);
+        hub.setStatus(agentId, { state: "working", note: "Reading new messages" });
+        return { ok: true, response: { decision: "block", reason: queued } };
+      }
+      turnOpen.set(agentId, false);
+      hub.setStatus(agentId, { state: "idle", note: "Finished \u2014 ready for the next instruction" });
+      hub.activity("agent.answered", agentId, `${name} finished a turn`);
+      break;
+    }
+    case "SessionEnd":
+      turnOpen.set(agentId, false);
+      hub.setStatus(agentId, { state: "idle", note: "Session ended" });
+      break;
+    default:
+      return { ok: false };
+  }
+  return { ok: true };
+}
+
+// server/mcp.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { z } from "zod";
+var ok = (value) => ({ content: [{ type: "text", text: typeof value === "string" ? value : JSON.stringify(value, null, 2) }] });
+var fail = (msg) => ({ content: [{ type: "text", text: msg }], isError: true });
+function guard(fn) {
+  return async (args) => {
+    try {
+      return fn(args);
+    } catch (err) {
+      return fail(err instanceof Error ? err.message : String(err));
+    }
+  };
+}
+function buildServer(hub, planner, me) {
+  const server = new McpServer({ name: "hq", version: "0.1.0" });
+  const isLead = !!hub.cfg(me)?.isLead;
+  const leadOnly = () => {
+    if (!isLead) throw new Error("Only the lead can do this. Ask the lead with send_message.");
+  };
+  const taskView = (id) => {
+    const t2 = planner.task(id);
+    return t2 && { ...t2, owner: t2.ownerId ? hub.name(t2.ownerId) : null };
+  };
+  server.registerTool(
+    "list_workers",
+    { description: "The team: each agent's id, name, role, whether they are running, and what they are doing now." },
+    guard(
+      () => ok(
+        hub.snap.config.team.map((a) => {
+          const st = hub.status(a.id);
+          return {
+            id: a.id,
+            name: a.name,
+            role: a.role,
+            lead: a.isLead,
+            you: a.id === me,
+            running: st?.session.state === "running",
+            state: st?.state,
+            task: st?.currentTaskId ?? null,
+            free: st?.session.state === "running" && !a.isLead && !planner.currentTask(a.id)
+          };
+        })
+      )
+    )
+  );
+  server.registerTool(
+    "get_status",
+    { description: "Live status of every agent (state, note, current task) plus the active boards with task counts." },
+    guard(
+      () => ok({
+        agents: hub.snap.agents.map((s) => ({ id: s.agentId, name: hub.name(s.agentId), state: s.state, note: s.note, task: s.currentTaskId, session: s.session.state })),
+        boards: hub.snap.boards.map((b) => {
+          const ts = hub.snap.tasks.filter((t2) => t2.boardId === b.id);
+          const n = (st) => ts.filter((t2) => t2.status === st).length;
+          return { id: b.id, title: b.title, status: b.status, todo: n("todo"), inProgress: n("in-progress"), inReview: n("in-review"), blocked: n("blocked"), done: n("done") };
+        })
+      })
+    )
+  );
+  server.registerTool(
+    "list_tasks",
+    {
+      description: "Tasks, optionally filtered by board, status or owner.",
+      inputSchema: {
+        boardId: z.string().optional().describe("Board id, e.g. P3"),
+        status: z.enum(["todo", "in-progress", "in-review", "done", "blocked"]).optional(),
+        owner: z.string().optional().describe("Agent id or name")
+      }
+    },
+    guard(({ boardId, status, owner }) => {
+      const ownerId = owner ? planner.agentId(owner) : void 0;
+      const list = hub.snap.tasks.filter((t2) => (!boardId || t2.boardId === boardId) && (!status || t2.status === status) && (!owner || t2.ownerId === ownerId));
+      return ok(list.map((t2) => ({ id: t2.id, board: t2.boardId, title: t2.title, status: t2.status, owner: t2.ownerId ? hub.name(t2.ownerId) : null, needs: t2.needs })));
+    })
+  );
+  server.registerTool(
+    "create_board",
+    { description: "Lead only. Create a board (a phase or an area of work).", inputSchema: { title: z.string(), active: z.boolean().optional().describe("Agents only pick tasks from active boards") } },
+    guard(({ title, active }) => {
+      leadOnly();
+      return ok(planner.createBoard(title, active ? "active" : "planned"));
+    })
+  );
+  server.registerTool(
+    "create_task",
+    {
+      description: "Lead only. Add a task. Keep tasks small: one task = one branch = one PR.",
+      inputSchema: {
+        title: z.string(),
+        boardId: z.string().optional().describe("Defaults to the first active board"),
+        description: z.string().optional().describe("What to build and why"),
+        files: z.array(z.string()).optional().describe("The only files/folders this task may edit"),
+        doneWhen: z.string().optional().describe("Acceptance criteria"),
+        needs: z.array(z.string()).optional().describe("Task ids that must be done first")
+      }
+    },
+    guard((args) => {
+      leadOnly();
+      return ok(planner.createTask(args, me));
+    })
+  );
+  server.registerTool(
+    "update_task",
+    {
+      description: "Lead only. Edit a task's details or status.",
+      inputSchema: {
+        taskId: z.string(),
+        title: z.string().optional(),
+        description: z.string().optional(),
+        files: z.array(z.string()).optional(),
+        doneWhen: z.string().optional(),
+        needs: z.array(z.string()).optional(),
+        status: z.enum(["todo", "in-progress", "in-review", "done", "blocked"]).optional()
+      }
+    },
+    guard(({ taskId, ...patch }) => {
+      leadOnly();
+      return ok(planner.updateTask(taskId, patch));
+    })
+  );
+  server.registerTool(
+    "assign_task",
+    {
+      description: "Lead only. Give a task to an agent. HQ tells them to pull main and start it (right away if idle, otherwise when their current turn ends).",
+      inputSchema: { taskId: z.string(), agent: z.string().describe("Agent id or name") }
+    },
+    guard(({ taskId, agent }) => {
+      leadOnly();
+      const t2 = planner.assign(taskId, agent, me);
+      return ok(`Assigned ${t2.id} to ${hub.name(t2.ownerId)}. They have been told to start.`);
+    })
+  );
+  server.registerTool(
+    "get_my_task",
+    { description: "Your current task: title, description, the files you may edit, done-when, and what it needs. Marks it in progress." },
+    guard(() => {
+      const t2 = planner.currentTask(me);
+      if (!t2) return ok("You have no task right now. Wait for the lead, or ask with send_message.");
+      if (t2.status === "todo") planner.setStatus(me, "in-progress");
+      const blockedBy = t2.needs.filter((n) => planner.task(n)?.status !== "done");
+      return ok({ ...taskView(t2.id), waitingOn: blockedBy, rules: "Work only on this task, on its own branch. Edit only the listed files. Title the PR `[" + t2.id + "] " + t2.title + "`. When the PR is open, call set_my_status with in-review and the PR number." });
+    })
+  );
+  server.registerTool(
+    "set_my_status",
+    {
+      description: "Update your current task: in-progress, blocked (say why), in-review (PR opened), or done. The lead is told automatically.",
+      inputSchema: {
+        status: z.enum(["in-progress", "blocked", "in-review", "done"]),
+        note: z.string().optional().describe("Why you are blocked, or a short summary"),
+        prNumber: z.number().int().optional()
+      }
+    },
+    guard(({ status, note, prNumber }) => {
+      const t2 = planner.setStatus(me, status, note, prNumber);
+      return ok(`${t2.id} is now ${t2.status}.`);
+    })
+  );
+  server.registerTool(
+    "send_message",
+    {
+      description: 'Send a message to another agent (id, name, or "lead"). HQ delivers it: right away if they are idle, otherwise when their current turn ends.',
+      inputSchema: { to: z.string(), text: z.string() }
+    },
+    guard(({ to, text }) => {
+      const toId = planner.agentId(to);
+      if (toId === me) throw new Error("That's you.");
+      planner.message(me, to, text);
+      return ok(`Sent to ${hub.name(toId)}.`);
+    })
+  );
+  return server;
+}
+async function handleMcp(hub, planner, agentId, req, res, body) {
+  const server = buildServer(hub, planner, agentId);
+  const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0, enableJsonResponse: true });
+  res.on("close", () => {
+    void transport.close();
+    void server.close();
+  });
+  await server.connect(transport);
+  await transport.handleRequest(req, res, body);
+}
+
+// server/lib/log.ts
+var dim = (s) => `\x1B[2m${s}\x1B[0m`;
+var log = {
+  info: (...a) => console.log(dim("[hq]"), ...a),
+  warn: (...a) => console.warn("\x1B[33m[hq]\x1B[0m", ...a),
+  error: (...a) => console.error("\x1B[31m[hq]\x1B[0m", ...a)
+};
+
+// server/http.ts
+var MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript",
+  ".css": "text/css",
+  ".svg": "image/svg+xml",
+  ".woff2": "font/woff2",
+  ".woff": "font/woff",
+  ".png": "image/png",
+  ".json": "application/json"
+};
+function safeEqual(a, b) {
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && timingSafeEqual(x, y);
+}
+function readBody(req, limit = 256 * 1024) {
+  return new Promise((resolve3, reject) => {
+    let size = 0;
+    const chunks = [];
+    req.on("data", (c) => {
+      size += c.length;
+      if (size > limit) reject(new Error("too large"));
+      else chunks.push(c);
+    });
+    req.on("end", () => resolve3(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
+}
+function startHttp(o) {
+  const send = (res, code, body, type = "text/plain") => {
+    res.writeHead(code, { "Content-Type": type });
+    res.end(body);
+  };
+  const server = createServer(async (req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (req.method === "POST" && url.pathname.startsWith("/hook/")) {
+      const auth = req.headers.authorization ?? "";
+      if (!safeEqual(auth, `Bearer ${o.agentToken}`)) return send(res, 401, "unauthorized");
+      const [, , agentId, event] = url.pathname.split("/");
+      try {
+        const body = await readBody(req);
+        const r = handleHook(o.hub, o.inbox, decodeURIComponent(agentId ?? ""), event ?? "", body ? JSON.parse(body) : {});
+        if (!r.ok) return send(res, 404, "");
+        if (r.response) return send(res, 200, JSON.stringify(r.response), "application/json");
+        res.writeHead(204);
+        return void res.end();
+      } catch {
+        return send(res, 400, "bad request");
+      }
+    }
+    if (url.pathname === "/mcp") {
+      const auth = req.headers.authorization ?? "";
+      const agentId = String(req.headers["x-hq-agent"] ?? "");
+      if (!safeEqual(auth, `Bearer ${o.agentToken}`) || !o.hub.cfg(agentId)) return send(res, 401, "unauthorized");
+      if (req.method === "GET" || req.method === "DELETE") return send(res, 405, "stateless server");
+      try {
+        const raw = await readBody(req, 1024 * 1024);
+        return await handleMcp(o.hub, o.planner, agentId, req, res, raw ? JSON.parse(raw) : void 0);
+      } catch {
+        return res.headersSent ? void res.end() : send(res, 400, "bad request");
+      }
+    }
+    if (url.pathname === "/api/health") return send(res, 200, JSON.stringify({ ok: true }), "application/json");
+    if (req.method === "GET" && o.distDir) {
+      const rel = normalize(url.pathname === "/" ? "/index.html" : url.pathname).replace(/^(\.\.[/\\])+/, "");
+      let file = join4(o.distDir, rel);
+      if (!file.startsWith(o.distDir) || !existsSync3(file) || statSync(file).isDirectory()) file = join4(o.distDir, "index.html");
+      res.writeHead(200, { "Content-Type": MIME[extname(file)] ?? "application/octet-stream" });
+      return void createReadStream(file).pipe(res);
+    }
+    send(res, 404, "not found");
+  });
+  const wss = new WebSocketServer({ noServer: true, maxPayload: 1024 * 1024 });
+  server.on("upgrade", (req, socket, head) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    const origin = req.headers.origin ?? "";
+    const token = url.searchParams.get("token") ?? "";
+    if (url.pathname !== "/ws" || !safeEqual(token, o.browserToken) || origin && !o.allowedOrigins.includes(origin)) {
+      socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
+      return socket.destroy();
+    }
+    wss.handleUpgrade(req, socket, head, (ws) => onClient(ws));
+  });
+  function onClient(ws) {
+    const sendEvent = (e) => ws.readyState === ws.OPEN && ws.send(JSON.stringify(e));
+    sendEvent({ type: "snapshot", snapshot: o.hub.snap });
+    const unsub = o.hub.subscribe(sendEvent);
+    ws.on("message", async (raw) => {
+      try {
+        const msg = JSON.parse(String(raw));
+        const fn = msg.cmd ? o.commands[msg.cmd] : void 0;
+        if (!fn) return log.warn("unknown command", msg.cmd);
+        await fn(...Array.isArray(msg.args) ? msg.args : []);
+      } catch (err) {
+        log.warn("command failed:", err instanceof Error ? err.message : err);
+      }
+    });
+    ws.on("close", () => unsub());
+  }
+  return new Promise((resolve3, reject) => {
+    server.once("error", reject);
+    server.listen(o.port, "127.0.0.1", () => resolve3(server));
+  });
+}
+
+// server/github.ts
+var PR_FIELDS = `
+  number title url headRefName createdAt mergedAt state mergeable isDraft reviewDecision
+  reviews(last: 20) { nodes { author { login } state submittedAt } }
+  reviewThreads(first: 100) { nodes { isResolved isOutdated comments(first: 1) { nodes { author { login } } } } }
+  commits(last: 1) { nodes { commit { statusCheckRollup { contexts(first: 50) { nodes {
+    __typename
+    ... on CheckRun { name status conclusion }
+    ... on StatusContext { context state description }
+  } } } } } }`;
+var QUERY = `query($owner: String!, $name: String!) {
+  repository(owner: $owner, name: $name) {
+    open: pullRequests(states: OPEN, first: 30, orderBy: { field: UPDATED_AT, direction: DESC }) { nodes { ${PR_FIELDS} } }
+    merged: pullRequests(states: MERGED, first: 15, orderBy: { field: UPDATED_AT, direction: DESC }) { nodes { ${PR_FIELDS} } }
+  }
+}`;
+async function fetchPrs(repo) {
+  const [owner, name] = repo.split("/");
+  const r = await run("gh", ["api", "graphql", "-f", `query=${QUERY}`, "-F", `owner=${owner}`, "-F", `name=${name}`], { timeoutMs: 3e4 });
+  if (!r.ok) throw new Error(r.stderr.trim().split("\n")[0] || "gh api failed");
+  const data = JSON.parse(r.stdout);
+  if (!data.data?.repository) throw new Error(data.errors?.[0]?.message ?? "Repository not found");
+  return { open: data.data.repository.open.nodes, merged: data.data.repository.merged.nodes };
+}
+var BOTS = {
+  coderabbit: { logins: ["coderabbitai", "coderabbitai[bot]"], check: /coderabbit/i, label: "CodeRabbit" },
+  greptile: { logins: ["greptile-apps", "greptile-apps[bot]"], check: /greptile/i, label: "Greptile" },
+  copilot: { logins: ["copilot-pull-request-reviewer", "copilot-pull-request-reviewer[bot]", "Copilot"], check: /copilot/i, label: "Copilot" }
+};
+var contexts = (pr) => pr.commits.nodes[0]?.commit.statusCheckRollup?.contexts.nodes ?? [];
+var openThreads = (pr, logins) => pr.reviewThreads.nodes.filter((t2) => !t2.isResolved && !t2.isOutdated && (!logins || logins.includes(t2.comments.nodes[0]?.author?.login ?? ""))).length;
+function reviewOf(pr, tool) {
+  if (tool === "custom") return { review: "pending", openComments: openThreads(pr), note: "Custom review checks aren't run by HQ yet" };
+  if (tool === "human") {
+    const decided = pr.reviewDecision ?? [...pr.reviews.nodes].reverse().find((r) => r.state === "APPROVED" || r.state === "CHANGES_REQUESTED")?.state ?? null;
+    const open2 = openThreads(pr);
+    if (decided === "APPROVED") return { review: "passed", openComments: open2, note: null };
+    if (decided === "CHANGES_REQUESTED") return { review: "changes-requested", openComments: open2, note: null };
+    return { review: "pending", openComments: open2, note: "Waiting for a reviewer" };
+  }
+  const bot = BOTS[tool];
+  const open = openThreads(pr, bot.logins);
+  const ctx = contexts(pr).find((c) => bot.check.test(c.__typename === "CheckRun" ? c.name : c.context));
+  const pending = ctx && (ctx.__typename === "CheckRun" ? ctx.status !== "COMPLETED" : ctx.state === "PENDING" || ctx.state === "EXPECTED");
+  if (pending) return { review: "reviewing", openComments: open, note: null };
+  if (open > 0) return { review: "changes-requested", openComments: open, note: null };
+  const desc = ctx?.__typename === "StatusContext" ? ctx.description ?? "" : "";
+  if (/rate.?limit|skip|paused|disabled/i.test(desc)) return { review: "pending", openComments: 0, note: `${bot.label}: ${desc.toLowerCase()}` };
+  const ok2 = ctx && (ctx.__typename === "CheckRun" ? ctx.conclusion === "SUCCESS" || ctx.conclusion === "NEUTRAL" : ctx.state === "SUCCESS");
+  if (ok2) return { review: "passed", openComments: 0, note: null };
+  if (ctx) return { review: "changes-requested", openComments: 0, note: `${bot.label} check failed` };
+  const botReviewed = pr.reviews.nodes.some((r) => bot.logins.includes(r.author?.login ?? ""));
+  return botReviewed ? { review: "passed", openComments: 0, note: null } : { review: "pending", openComments: 0, note: `Waiting for ${bot.label}` };
+}
+var TASK_ID = /([A-Z][A-Z0-9]*-T\d+)/i;
+function taskIdOf(pr) {
+  const inTitle = pr.title.match(/\[([A-Z][A-Z0-9]*-T\d+)\]/i);
+  if (inTitle) return inTitle[1].toUpperCase();
+  const inBranch = pr.headRefName.match(TASK_ID);
+  return inBranch ? inBranch[1].toUpperCase() : null;
+}
+function branchAgent(branch) {
+  const m = branch.match(/^([a-z0-9][a-z0-9-]*)\//i);
+  return m ? m[1].toLowerCase() : null;
+}
+function toPullRequest(pr, tool, reviewEnabled, taskId, authorId) {
+  const merged = pr.state === "MERGED";
+  const r = reviewEnabled ? reviewOf(pr, tool) : { review: "passed", openComments: 0, note: null };
+  return {
+    number: pr.number,
+    title: pr.title,
+    taskId,
+    authorId,
+    review: merged && r.review !== "changes-requested" ? "passed" : r.review,
+    openComments: r.openComments,
+    mergeable: pr.mergeable === "MERGEABLE",
+    merged,
+    openedAt: pr.createdAt,
+    url: pr.url,
+    branch: pr.headRefName,
+    closed: pr.state === "CLOSED",
+    conflict: pr.mergeable === "CONFLICTING",
+    reviewNote: pr.isDraft ? "Draft" : r.note
+  };
+}
+
+// server/githubSync.ts
+var POLL_MS = 2e4;
+var label = { coderabbit: "CodeRabbit", greptile: "Greptile", copilot: "Copilot", human: "The reviewer", custom: "The review check" };
+var GitHubSync = class {
+  constructor(hub, planner, repo) {
+    this.hub = hub;
+    this.planner = planner;
+    this.repo = repo;
+  }
+  hub;
+  planner;
+  repo;
+  prev = /* @__PURE__ */ new Map();
+  first = true;
+  timer = null;
+  nudgeTimer = null;
+  busy = false;
+  lastError = null;
+  start() {
+    if (!this.repo) {
+      log.warn("No GitHub remote: PRs and reviews are off.");
+      return;
+    }
+    void this.refresh();
+    this.timer = setInterval(() => void this.refresh(), POLL_MS);
+    let reviewCfg = JSON.stringify(this.hub.snap.config.workflow.review);
+    this.hub.subscribe((e) => {
+      if (e.type === "config.updated" && JSON.stringify(e.config.workflow.review) !== reviewCfg) {
+        reviewCfg = JSON.stringify(e.config.workflow.review);
+        this.first = true;
+        this.nudge(500);
+      }
+      if (e.type === "activity" && e.event.type === "agent.answered") this.nudge();
+      if (e.type === "task.updated" && e.task.status === "in-review") this.nudge(1500);
+    });
+  }
+  stop() {
+    if (this.timer) clearInterval(this.timer);
+  }
+  /** Refresh soon (debounced): an agent just opened a PR or finished a turn. */
+  nudge(delayMs = 3e3) {
+    if (!this.repo) return;
+    if (this.nudgeTimer) clearTimeout(this.nudgeTimer);
+    this.nudgeTimer = setTimeout(() => void this.refresh(), delayMs);
+  }
+  async refresh() {
+    if (!this.repo || this.busy) return;
+    if (!this.hub.snap.setup.checks.find((c) => c.id === "gh" && c.status === "ok")) return;
+    this.busy = true;
+    try {
+      const { open, merged } = await fetchPrs(this.repo);
+      if (this.lastError) log.info("GitHub reachable again");
+      this.lastError = null;
+      const wf = this.hub.snap.config.workflow;
+      const team = new Set(this.hub.snap.config.team.map((a) => a.id));
+      const next = [...open, ...merged].map((gh) => {
+        const taskId = taskIdOf(gh);
+        const task = taskId ? this.planner.task(taskId) : void 0;
+        const fromBranch = branchAgent(gh.headRefName);
+        const authorId = task?.ownerId ?? (fromBranch && team.has(fromBranch) ? fromBranch : "");
+        return toPullRequest(gh, wf.review.tool, wf.review.enabled, task?.id ?? taskId ?? "", authorId);
+      });
+      const seen = new Set(next.map((p) => p.number));
+      for (const old of this.prev.values()) if (!seen.has(old.number) && !old.merged && !old.closed) next.push({ ...old, closed: true });
+      for (const pr of next) {
+        const old = this.prev.get(pr.number);
+        if (JSON.stringify(old) !== JSON.stringify(pr)) this.hub.emit({ type: "pr.updated", pr: { ...pr } });
+        if (!this.first) this.react(old, pr);
+        this.syncTask(pr);
+      }
+      this.hub.snap.pullRequests = next;
+      this.prev = new Map(next.map((p) => [p.number, p]));
+      this.first = false;
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg !== this.lastError) log.warn(`GitHub: ${msg}`);
+      this.lastError = msg;
+    } finally {
+      this.busy = false;
+    }
+  }
+  /** Keep the task board in line with its PR. */
+  syncTask(pr) {
+    const task = pr.taskId ? this.planner.task(pr.taskId) : void 0;
+    if (!task || pr.closed) return;
+    if (pr.merged && task.status !== "done") this.planner.updateTask(task.id, { status: "done", prNumber: pr.number });
+    else if (!pr.merged && (task.status === "todo" || task.status === "in-progress")) this.planner.updateTask(task.id, { status: "in-review", prNumber: pr.number });
+    else if (!pr.merged && task.prNumber !== pr.number) this.planner.updateTask(task.id, { prNumber: pr.number });
+  }
+  react(old, pr) {
+    const hub = this.hub;
+    const who = pr.authorId || null;
+    const tool = label[hub.snap.config.workflow.review.tool];
+    const lead = hub.snap.config.team.find((a) => a.isLead);
+    const ref = `#${pr.number} ${pr.title}`;
+    if (!old && !pr.merged && !pr.closed) hub.activity("pr.opened", who, `${hub.name(who)} opened PR ${ref}`);
+    if (pr.closed && !old?.closed) return hub.activity("config", who, `PR #${pr.number} was closed without merging`);
+    if (pr.merged && !old?.merged) {
+      hub.activity("pr.merged", null, `PR ${ref} was merged`);
+      if (lead) this.planner.notify(lead.id, `PR #${pr.number} (${pr.title}) was merged${pr.taskId ? `; ${pr.taskId} is done` : ""}. Assign the next task if anything is waiting.`);
+      return;
+    }
+    if (pr.merged) return;
+    if (pr.review === "reviewing" && old?.review !== "reviewing") hub.activity("review.started", null, `${tool} is reviewing #${pr.number}`);
+    const newComments = pr.review === "changes-requested" && (old?.review !== "changes-requested" || pr.openComments > (old?.openComments ?? 0));
+    if (newComments) {
+      const n = pr.openComments;
+      hub.activity("review.changes", who, `${tool} left ${n || "new"} comment${n === 1 ? "" : "s"} on #${pr.number}`);
+      if (who)
+        this.planner.notify(
+          who,
+          `${tool} reviewed your PR #${pr.number} (${pr.title}) and left ${n || "new"} open comment${n === 1 ? "" : "s"}. Read them with \`gh pr view ${pr.number} --comments\` (or the GitHub API), fix them on the same branch, push, and resolve each thread you fixed.`
+        );
+    }
+    if (pr.review === "passed" && old?.review !== "passed") {
+      hub.activity("review.passed", who, `${tool} approved #${pr.number}`);
+      if (lead) this.planner.notify(lead.id, `PR #${pr.number} (${pr.title}) by ${hub.name(who)} passed review and is ready to merge.`);
+    }
+    if (pr.conflict && !old?.conflict && who)
+      this.planner.notify(who, `Your PR #${pr.number} has merge conflicts with main. Pull main, rebase or merge it into your branch, fix the conflicts, and push.`);
+  }
+};
+
+// server/inbox.ts
+var QUIET_MS = 1e3;
+var SUBMIT_CHECK_MS = 3e3;
+var Inbox = class {
+  constructor(hub, keys) {
+    this.hub = hub;
+    this.keys = keys;
+    this.timer = setInterval(() => {
+      for (const id of this.queues.keys()) void this.tryType(id);
+    }, 2e3);
+  }
+  hub;
+  keys;
+  queues = /* @__PURE__ */ new Map();
+  sessionUp = /* @__PURE__ */ new Set();
+  // SessionStart seen: Claude Code's prompt exists
+  lastHook = /* @__PURE__ */ new Map();
+  lastSubmit = /* @__PURE__ */ new Map();
+  typing = /* @__PURE__ */ new Set();
+  timer;
+  stop() {
+    clearInterval(this.timer);
+  }
+  push(agentId, item) {
+    const q = this.queues.get(agentId) ?? [];
+    q.push(item);
+    this.queues.set(agentId, q);
+    void this.tryType(agentId);
+  }
+  pending(agentId) {
+    return this.queues.get(agentId)?.length ?? 0;
+  }
+  /** Every hook event goes through here (before the state change it causes). */
+  noteHook(agentId, event) {
+    this.lastHook.set(agentId, Date.now());
+    if (event === "SessionStart") this.sessionUp.add(agentId);
+    if (event === "SessionEnd") this.sessionUp.delete(agentId);
+    if (event === "UserPromptSubmit") this.lastSubmit.set(agentId, Date.now());
+    if (event === "Stop" || event === "SessionStart" || event === "Notification") setTimeout(() => void this.tryType(agentId), QUIET_MS + 100);
+  }
+  /** An already-running session was reattached: its prompt exists even though HQ missed SessionStart. */
+  sessionReattached(agentId) {
+    this.sessionUp.add(agentId);
+  }
+  /** The session stopped or restarted: Claude Code's prompt is gone until the next SessionStart. */
+  sessionDown(agentId) {
+    this.sessionUp.delete(agentId);
+  }
+  forget(agentId) {
+    this.queues.delete(agentId);
+    this.sessionUp.delete(agentId);
+  }
+  /** Called from the Stop hook: everything queued, as the reason Claude continues with. */
+  takeForStop(agentId) {
+    const q = this.queues.get(agentId);
+    if (!q?.length) return null;
+    this.queues.set(agentId, []);
+    return this.format(q);
+  }
+  canType(agentId) {
+    const st = this.hub.status(agentId);
+    return !!st && this.sessionUp.has(agentId) && st.session.state === "running" && st.state === "idle" && !this.typing.has(agentId) && Date.now() - (this.lastHook.get(agentId) ?? 0) >= QUIET_MS;
+  }
+  whyNot(agentId) {
+    const st = this.hub.status(agentId);
+    return JSON.stringify({ up: this.sessionUp.has(agentId), session: st?.session.state, state: st?.state, note: st?.note, typing: this.typing.has(agentId), quietMs: Date.now() - (this.lastHook.get(agentId) ?? 0) });
+  }
+  /** Types queued items into an idle agent. Safe to call any time. */
+  async tryType(agentId) {
+    const q = this.queues.get(agentId);
+    if (!q?.length) return;
+    if (!this.canType(agentId)) {
+      if (process.env.HQ_DEBUG) log.info(`inbox ${agentId}: holding ${q.length} \u2014 ${this.whyNot(agentId)}`);
+      return;
+    }
+    const items = q.splice(0);
+    this.typing.add(agentId);
+    const typedAt = Date.now();
+    try {
+      if (!await this.keys.type(agentId, this.format(items))) {
+        log.warn(`could not type into ${agentId}; keeping ${items.length} message(s) queued`);
+        this.queues.set(agentId, [...items, ...this.queues.get(agentId) ?? []]);
+        return;
+      }
+      await new Promise((r) => setTimeout(r, SUBMIT_CHECK_MS));
+      if ((this.lastSubmit.get(agentId) ?? 0) < typedAt && this.hub.status(agentId)?.state === "idle") {
+        log.warn(`${agentId}: no prompt submit after typing; pressing Enter again`);
+        await this.keys.enter(agentId);
+      }
+    } finally {
+      this.typing.delete(agentId);
+    }
+  }
+  format(items) {
+    const lines = items.map(
+      (i) => i.kind === "message" ? `[HQ] Message from ${this.hub.name(i.fromId)}: ${i.text}` : `[HQ] ${i.text}`
+    );
+    const fromAgent = items.some((i) => i.kind === "message" && i.fromId !== "you");
+    return (lines.join("  \xB7  ") + (fromAgent ? "  (Reply with the hq send_message tool only if a reply is needed.)" : "")).replace(/\s*\n\s*/g, " ");
+  }
+};
+
+// server/planner.ts
+var now2 = () => (/* @__PURE__ */ new Date()).toISOString();
+var Planner = class {
+  constructor(hub, inbox) {
+    this.hub = hub;
+    this.inbox = inbox;
+  }
+  hub;
+  inbox;
+  seq = 0;
+  get snap() {
+    return this.hub.snap;
+  }
+  task(id) {
+    return this.snap.tasks.find((t2) => t2.id.toLowerCase() === id.trim().toLowerCase());
+  }
+  /** An agent by id or (case-insensitive) name; "lead" means the lead. */
+  agentId(ref) {
+    const r = ref.trim().toLowerCase();
+    const team = this.snap.config.team;
+    if (r === "lead") return team.find((a) => a.isLead)?.id ?? null;
+    return team.find((a) => a.id === r || a.name.toLowerCase() === r)?.id ?? null;
+  }
+  defaultBoard() {
+    const active = this.snap.boards.filter((b) => b.status === "active").sort((a, b) => a.order - b.order);
+    if (active[0]) return active[0];
+    return this.createBoard("Backlog", "active");
+  }
+  // ------------------------------------------------------------ boards
+  createBoard(title, status = "planned") {
+    const clean = title.trim().slice(0, 80) || "Board";
+    const base = clean.split(/\s+/).map((w) => w[0]).join("").toUpperCase().replace(/[^A-Z0-9]/g, "").slice(0, 3) || "B";
+    let id = base;
+    for (let i = 2; this.snap.boards.some((b) => b.id === id); i++) id = `${base}${i}`;
+    const board = { id, title: clean, status, order: this.snap.boards.length };
+    this.snap.boards.push(board);
+    this.hub.emit({ type: "board.updated", board: { ...board } });
+    this.hub.planChanged();
+    return board;
+  }
+  updateBoard(id, patch) {
+    const board = this.snap.boards.find((b) => b.id === id);
+    if (!board) throw new Error(`No board ${id}`);
+    if (patch.title?.trim()) board.title = patch.title.trim().slice(0, 80);
+    if (patch.status) board.status = patch.status;
+    this.hub.emit({ type: "board.updated", board: { ...board } });
+    this.hub.planChanged();
+    return board;
+  }
+  // ------------------------------------------------------------ tasks
+  createTask(input, byId) {
+    const board = input.boardId ? this.snap.boards.find((b) => b.id === input.boardId) : this.defaultBoard();
+    if (!board) throw new Error(`No board ${input.boardId}. Boards: ${this.snap.boards.map((b) => b.id).join(", ")}`);
+    let n = this.snap.tasks.filter((t2) => t2.boardId === board.id).length + 1;
+    let id = `${board.id}-T${String(n).padStart(2, "0")}`;
+    while (this.task(id)) id = `${board.id}-T${String(++n).padStart(2, "0")}`;
+    const task = {
+      id,
+      boardId: board.id,
+      title: input.title.trim().slice(0, 120),
+      ownerId: null,
+      status: "todo",
+      needs: input.needs ?? [],
+      prNumber: null,
+      description: input.description ?? "",
+      files: input.files ?? [],
+      doneWhen: input.doneWhen ?? "",
+      note: null
+    };
+    this.snap.tasks.push(task);
+    this.hub.emit({ type: "task.updated", task: { ...task } });
+    this.hub.activity("task.created", byId === "you" ? null : byId, `${this.hub.name(byId)} added ${task.id} ${task.title}`);
+    this.hub.planChanged();
+    return task;
+  }
+  updateTask(id, patch) {
+    const task = this.task(id);
+    if (!task) throw new Error(`No task ${id}`);
+    Object.assign(task, Object.fromEntries(Object.entries(patch).filter(([, v]) => v !== void 0)));
+    if (task.status === "done") {
+      for (const a of this.snap.agents) if (a.currentTaskId === task.id) this.hub.setStatus(a.agentId, { currentTaskId: null });
+    }
+    this.hub.emit({ type: "task.updated", task: { ...task } });
+    this.hub.planChanged();
+    return task;
+  }
+  /** Gives a task to an agent and tells them to start. */
+  assign(taskId, agentRef, byId) {
+    const task = this.task(taskId);
+    const agentId = this.agentId(agentRef);
+    if (!task) throw new Error(`No task ${taskId}`);
+    if (!agentId) throw new Error(`No agent "${agentRef}". Team: ${this.snap.config.team.map((a) => a.id).join(", ")}`);
+    const agent = this.hub.cfg(agentId);
+    task.ownerId = agentId;
+    if (task.status === "done") task.status = "todo";
+    this.hub.emit({ type: "task.updated", task: { ...task } });
+    this.hub.setStatus(agentId, { currentTaskId: task.id });
+    this.hub.planChanged();
+    this.hub.activity("task.assigned", byId === "you" ? null : byId, `${this.hub.name(byId)} assigned ${task.id} ${task.title} to ${agent.name}`);
+    const by = byId === "you" ? "The user (your human)" : this.hub.name(byId);
+    const text = `${by} assigned you ${task.id} (${task.title}). Pull main, start ${task.id}. Call the hq get_my_task tool for the details.`;
+    this.record(byId, agentId, `Start ${task.id}: ${task.title}`);
+    this.inbox.push(agentId, { fromId: byId, kind: "assign", text });
+    return task;
+  }
+  setStatus(agentId, status, note, prNumber) {
+    const task = this.currentTask(agentId);
+    if (!task) throw new Error("You have no task. Ask the lead for one.");
+    task.status = status;
+    task.note = note?.slice(0, 300) || null;
+    if (prNumber) task.prNumber = prNumber;
+    if (status === "done") this.hub.setStatus(agentId, { currentTaskId: null });
+    else this.hub.setStatus(agentId, { currentTaskId: task.id });
+    this.hub.emit({ type: "task.updated", task: { ...task } });
+    this.hub.planChanged();
+    const name = this.hub.name(agentId);
+    const words = { "in-progress": "started", blocked: "is blocked on", "in-review": "sent for review", done: "finished" }[status];
+    this.hub.activity(status === "blocked" ? "agent.needs-input" : "task.started", agentId, `${name} ${words} ${task.id}${note ? `: ${note}` : ""}`);
+    const lead = this.snap.config.team.find((a) => a.isLead);
+    if (lead && lead.id !== agentId && (status === "blocked" || status === "in-review" || status === "done"))
+      this.message(agentId, lead.id, `${task.id} ${words}${note ? `: ${note}` : ""}${prNumber ? ` (PR #${prNumber})` : ""}`);
+    return task;
+  }
+  currentTask(agentId) {
+    const st = this.hub.status(agentId);
+    const byCurrent = st?.currentTaskId ? this.task(st.currentTaskId) : void 0;
+    if (byCurrent && byCurrent.ownerId === agentId) return byCurrent;
+    const mine = this.snap.tasks.filter((t2) => t2.ownerId === agentId && t2.status !== "done");
+    return mine.find((t2) => t2.status === "in-progress") ?? mine.find((t2) => t2.status === "todo") ?? mine[0];
+  }
+  // ------------------------------------------------------------ messages
+  /** Records a message, shows it in the office, and delivers it. */
+  message(fromId, toRef, text) {
+    const toId = this.agentId(toRef);
+    if (!toId) throw new Error(`No agent "${toRef}". Team: ${this.snap.config.team.map((a) => a.id).join(", ")}`);
+    const clean = text.trim().slice(0, 2e3);
+    if (!clean) throw new Error("Empty message");
+    this.record(fromId, toId, clean);
+    this.hub.activity("message", fromId === "you" ? null : fromId, `${this.hub.name(fromId)} \u2192 ${this.hub.name(toId)}: ${clean.slice(0, 80)}`);
+    this.inbox.push(toId, { fromId, kind: "message", text: clean });
+    return toId;
+  }
+  /** A notice from HQ itself (review results, merges) to one agent. */
+  notify(agentId, text) {
+    if (!this.hub.cfg(agentId)) return;
+    this.record("hq", agentId, text);
+    this.inbox.push(agentId, { fromId: "hq", kind: "notice", text });
+  }
+  record(fromId, toId, text) {
+    this.seq += 1;
+    const msg = { id: `m${Date.now().toString(36)}${this.seq}`, at: now2(), fromId, toId, text };
+    this.snap.messages = [msg, ...this.snap.messages].slice(0, 100);
+    this.hub.emit({ type: "message", message: msg });
+  }
+};
+
+// server/sbx.ts
+import { chmodSync, existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join5 } from "node:path";
+var key = (decision, resource) => `${decision} ${resource}`;
+var Sbx = class {
+  // sandbox name → "allow foo.com" entries HQ added
+  constructor(hub) {
+    this.hub = hub;
+    this.ownedFile = join5(projectHome(hub.slug), "sbx-owned.json");
+    this.owned = existsSync4(this.ownedFile) ? JSON.parse(readFileSync3(this.ownedFile, "utf8")) : {};
+    this.state = { basePolicy: "unknown", proxy: null, globalKeys: [], agents: {}, checkedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  }
+  hub;
+  state;
+  ownedFile;
+  owned;
+  saveOwned() {
+    writeFileSync4(this.ownedFile, JSON.stringify(this.owned, null, 2));
+  }
+  name(agentId) {
+    return sessionName(this.hub.slug, agentId);
+  }
+  envFile(agentId) {
+    return join5(projectHome(this.hub.slug), `${agentId}.env`);
+  }
+  publish() {
+    this.state.checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+    this.hub.snap.sbx = this.state;
+    this.hub.emit({ type: "sbx.updated", sbx: structuredClone(this.state) });
+  }
+  // ------------------------------------------------------------ read back
+  async rules() {
+    const r = await run("sbx", ["policy", "ls", "--json", "--type", "network"], { timeoutMs: 15e3 });
+    if (!r.ok) return [];
+    try {
+      return (JSON.parse(r.stdout).rules ?? []).filter((x) => x.resource_type === "network" && x.status !== "inactive");
+    } catch {
+      return [];
+    }
+  }
+  async basePolicy() {
+    const allowed = async (target) => /^Allowed/m.test((await run("sbx", ["policy", "check", "network", target], { timeoutMs: 1e4 })).stdout);
+    if (await allowed("hq-probe.invalid")) return "allow-all";
+    if (await allowed("registry.npmjs.org")) return "balanced";
+    return "deny-all";
+  }
+  /** Re-reads everything from sbx and publishes it. */
+  async refresh() {
+    if (!this.hub.snap.setup.sandboxReady) {
+      this.state.agents = Object.fromEntries(this.hub.snap.config.team.map((a) => [a.id, this.emptyAgent(a.id)]));
+      return this.publish();
+    }
+    const [rules, keysOut, proxyOut, base] = await Promise.all([
+      this.rules(),
+      run("sbx", ["secret", "ls", "--json"], { timeoutMs: 15e3 }),
+      run("sbx", ["settings", "get", "proxy.sandbox"], { timeoutMs: 1e4 }),
+      this.basePolicy()
+    ]);
+    let secrets = [];
+    try {
+      secrets = JSON.parse(keysOut.stdout).secrets ?? [];
+    } catch {
+    }
+    this.state.basePolicy = base;
+    this.state.proxy = proxyOut.stdout.trim() || null;
+    this.state.globalKeys = secrets.filter((s) => s.type === "service" && s.scope === "global").map((s) => s.name);
+    const prevErrors = this.state.agents;
+    this.state.agents = {};
+    for (const a of this.hub.snap.config.team) {
+      const name = this.name(a.id);
+      const mine = new Set(this.owned[name] ?? []);
+      const sandboxRules = rules.filter((r) => r.applies_to === `sandbox:${name}`).map((r) => ({
+        id: r.id,
+        decision: r.decision,
+        resources: r.resources,
+        source: r.layer === "org" ? "org" : r.origin === "kit" || ["default", "provisioned"].includes(r.provenance?.created_via ?? "") ? "kit" : r.resources.every((x) => mine.has(key(r.decision, x))) ? "hq" : "cli"
+      }));
+      this.state.agents[a.id] = {
+        rules: sandboxRules,
+        // sbx reports a sandbox scope as the bare sandbox name.
+        keys: secrets.filter((s) => s.type === "service" && (s.scope === name || s.scope === `sandbox:${name}`)).map((s) => s.name),
+        envFile: { path: this.envFile(a.id), exists: existsSync4(this.envFile(a.id)) },
+        syncError: prevErrors[a.id]?.syncError ?? null
+      };
+    }
+    this.publish();
+  }
+  emptyAgent(agentId) {
+    return { rules: [], keys: [], envFile: { path: this.envFile(agentId), exists: existsSync4(this.envFile(agentId)) }, syncError: null };
+  }
+  // ------------------------------------------------------------ apply
+  /** True if sbx knows a sandbox with this name. */
+  async exists(agentId) {
+    const r = await run("sbx", ["ls", "--json"], { timeoutMs: 1e4 });
+    try {
+      return (JSON.parse(r.stdout).sandboxes ?? []).some((s) => s.name === this.name(agentId));
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Makes the sandbox's allow/deny rules match the agent's lists. Adds what's
+   * missing; removes only rules HQ added earlier. Needs the sandbox to exist.
+   */
+  async syncRules(agentId) {
+    const agent = this.hub.cfg(agentId);
+    if (!agent || agent.mode !== "sandbox" || !await this.exists(agentId)) return;
+    const name = this.name(agentId);
+    const want = /* @__PURE__ */ new Set([...agent.sandbox.allow.map((r) => key("allow", r)), ...agent.sandbox.deny.map((r) => key("deny", r))]);
+    const owned = new Set(this.owned[name] ?? []);
+    const rules = (await this.rules()).filter((r) => r.applies_to === `sandbox:${name}`);
+    const have = new Set(rules.flatMap((r) => r.resources.map((x) => key(r.decision, x))));
+    const errors = [];
+    for (const entry of want) {
+      if (have.has(entry)) continue;
+      const [decision, resource] = entry.split(" ");
+      const r = await run("sbx", ["policy", decision, "network", "--sandbox", name, resource], { timeoutMs: 15e3 });
+      if (r.ok) owned.add(entry);
+      else errors.push(`${decision} ${resource}: ${r.stderr.trim().split("\n")[0]}`);
+    }
+    for (const entry of [...owned]) {
+      if (want.has(entry)) continue;
+      const [decision, resource] = entry.split(" ");
+      const rule = rules.find((r2) => r2.decision === decision && r2.resources.includes(resource));
+      const r = rule ? await run("sbx", ["policy", "rm", "network", "--sandbox", name, "--id", rule.id, "--force"], { timeoutMs: 15e3 }) : { ok: true, stderr: "" };
+      if (r.ok) owned.delete(entry);
+      else errors.push(`remove ${resource}: ${r.stderr.trim().split("\n")[0]}`);
+    }
+    this.owned[name] = [...owned];
+    this.saveOwned();
+    if (errors.length) log.warn(`sbx rules for ${name}:`, errors.join("; "));
+    await this.refresh();
+    if (this.state.agents[agentId]) {
+      this.state.agents[agentId].syncError = errors.length ? errors.join("; ") : null;
+      this.publish();
+    }
+  }
+  /** Stores a service key (value via stdin, never kept). agentId null = every sandbox. */
+  async setKey(agentId, service, value) {
+    const args = ["secret", "set", service, ...agentId ? ["--sandbox", this.name(agentId)] : [], "--force"];
+    const r = await run("sbx", args, { timeoutMs: 2e4, input: value.trim() + "\n" });
+    if (!r.ok) throw new Error(r.stderr.trim().split("\n")[0] || "sbx secret set failed");
+    await this.refresh();
+  }
+  async removeKey(agentId, service) {
+    const r = await run("sbx", ["secret", "rm", service, ...agentId ? ["--sandbox", this.name(agentId)] : [], "--force"], { timeoutMs: 2e4 });
+    if (!r.ok) throw new Error(r.stderr.trim().split("\n")[0] || "sbx secret rm failed");
+    await this.refresh();
+  }
+  async setProxy(url) {
+    const r = url ? await run("sbx", ["settings", "set", "proxy.sandbox", url], { timeoutMs: 15e3 }) : await run("sbx", ["settings", "unset", "proxy.sandbox"], { timeoutMs: 15e3 });
+    if (!r.ok) throw new Error(r.stderr.trim().split("\n")[0] || "sbx settings failed");
+    await this.refresh();
+  }
+  /** Creates the agent's env file (0600) if missing. Returns its path. Never reads values. */
+  ensureEnvFile(agentId) {
+    const file = this.envFile(agentId);
+    if (!existsSync4(file)) {
+      writeFileSync4(
+        file,
+        `# App variables for ${this.hub.name(agentId)} (${this.hub.snap.config.project.name}).
+# One KEY=value per line. These values ENTER the agent's VM \u2014 use test/dev credentials.
+# Restart the agent after editing. JSM HQ never reads or commits this file.
+`,
+        { mode: 384 }
+      );
+    }
+    chmodSync(file, 384);
+    return file;
+  }
+};
+
+// server/lib/ptyFix.ts
+import { chmodSync as chmodSync2, existsSync as existsSync5, readdirSync, statSync as statSync2 } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join as join6 } from "node:path";
+function ensurePtyHelperExecutable() {
+  try {
+    const root = dirname(createRequire(import.meta.url).resolve("node-pty/package.json"));
+    const prebuilds = join6(root, "prebuilds");
+    if (!existsSync5(prebuilds)) return;
+    for (const dir2 of readdirSync(prebuilds)) {
+      const helper = join6(prebuilds, dir2, "spawn-helper");
+      if (existsSync5(helper) && !(statSync2(helper).mode & 73)) chmodSync2(helper, 493);
+    }
+  } catch {
+  }
+}
+
+// server/repo.ts
+import { existsSync as existsSync6 } from "node:fs";
+import { basename, join as join7 } from "node:path";
+async function detectRepo(start) {
+  const top = await run("git", ["rev-parse", "--show-toplevel"], { cwd: start });
+  if (!top.ok) throw new Error(`${start} is not inside a git repository. Run HQ from your project folder or pass --repo <path>.`);
+  const root = top.stdout.trim();
+  const origin = await run("git", ["remote", "get-url", "origin"], { cwd: root });
+  const originUrl = origin.ok ? origin.stdout.trim() : null;
+  const m = originUrl?.match(/github\.com[:/]([^/]+\/[^/]+?)(\.git)?$/);
+  return {
+    root,
+    name: basename(root),
+    originUrl,
+    github: m ? m[1] : null,
+    hasCodeRabbit: existsSync6(join7(root, ".coderabbit.yaml")) || existsSync6(join7(root, ".coderabbit.yml")),
+    hasInsta: existsSync6(join7(root, ".insta"))
+  };
+}
+
+// server/sessions.ts
+import { spawn as spawnPty } from "node-pty";
+import { existsSync as existsSync10, rmSync } from "node:fs";
+import { resolve, sep } from "node:path";
+
+// server/adapters.ts
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join9 } from "node:path";
+
+// server/agentFiles.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join8 } from "node:path";
+var MCP_CONFIG = ".claude/hq-mcp.json";
+var HQ_FILES = ["ROLE.md", ".claude/settings.local.json", MCP_CONFIG];
+var MARK = "# jsmhq-hook";
+var HOOK_EVENTS = ["SessionStart", "UserPromptSubmit", "PreToolUse", "Notification", "Stop", "SessionEnd"];
+function hqUrl(agent, port) {
+  return agent.mode === "sandbox" ? `http://host.docker.internal:${port}` : `http://127.0.0.1:${port}`;
+}
+function roleMd(agent, cfg) {
+  const team = cfg.team.map((a) => `- ${a.name} \u2014 ${a.role}${a.isLead ? " (lead)" : ""}${a.id === agent.id ? " \u2190 you" : ""}`).join("\n");
+  const rules = agent.isLead ? [
+    "You plan the work and assign it to the team. You never write app code.",
+    "Keep tasks small: one task = one branch = one PR. Give each task the files it may edit and a clear done-when.",
+    "Assign only to agents that are running and free (check list_workers).",
+    "Decide merge order and resolve conflicts between PRs."
+  ] : [
+    "Work only on the task you were given. One task = one branch = one PR.",
+    "When HQ tells you to start a task, call get_my_task first, then `git pull origin main` and create a branch.",
+    "Edit only the files the task lists. Need another file? Ask the lead with send_message.",
+    "Title PRs `[TASK-ID] Short title` and open them with `gh pr create`, then call set_my_status in-review with the PR number.",
+    "set_my_status tells the lead automatically. Don't also send_message the same news.",
+    "If you are blocked or need a decision, call set_my_status blocked with the reason."
+  ];
+  const tools = agent.isLead ? "list_workers, get_status, list_tasks, create_board, create_task, update_task, assign_task, send_message" : "get_my_task, set_my_status, list_workers, get_status, list_tasks, send_message";
+  return [
+    `# ${agent.name} \u2014 ${agent.role}`,
+    "",
+    agent.roleMd.trim(),
+    "",
+    "## Team",
+    team,
+    "",
+    "## Rules",
+    ...rules.map((r) => `- ${r}`),
+    "",
+    "## Team MCP (server `hq`)",
+    `Your tools: ${tools}.`,
+    "Messages that start with `[HQ]` come from JSM HQ: assignments from the lead, or messages from teammates. Act on them.",
+    "Teammates work in their own sandboxes and cannot see your files or terminal. Talk to them only with send_message.",
+    "",
+    `Project: ${cfg.project.name} (${cfg.project.repo}). You are managed by JSM HQ.`,
+    ""
+  ].join("\n");
+}
+function hookCommand(url, token, agentId, event) {
+  const out = event === "Stop" ? "2>/dev/null" : ">/dev/null 2>&1";
+  return `curl -sf -m 4 -X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' --data-binary @- '${url}/hook/${agentId}/${event}' ${out} || true ${MARK}`;
+}
+function writeSettings(dir2, agent, port, token) {
+  const file = join8(dir2, ".claude", "settings.local.json");
+  mkdirSync4(join8(dir2, ".claude"), { recursive: true });
+  let settings = {};
+  if (existsSync7(file)) {
+    try {
+      settings = JSON.parse(readFileSync4(file, "utf8"));
+    } catch {
+      settings = {};
+    }
+  }
+  const hooks = { ...settings.hooks ?? {} };
+  const url = hqUrl(agent, port);
+  for (const event of HOOK_EVENTS) {
+    const kept = (hooks[event] ?? []).map((e) => ({ ...e, hooks: e.hooks.filter((h) => !h.command.includes(MARK)) })).filter((e) => e.hooks.length);
+    const ours = [{ type: "command", command: hookCommand(url, token, agent.id, event), timeout: 5 }];
+    if (event === "SessionStart") ours.unshift({ type: "command", command: `cat "$CLAUDE_PROJECT_DIR/ROLE.md" 2>/dev/null || true ${MARK}` });
+    hooks[event] = [...kept, event === "PreToolUse" ? { matcher: "*", hooks: ours } : { hooks: ours }];
+  }
+  const allow = /* @__PURE__ */ new Set([...settings.permissions?.allow ?? [], "mcp__hq"]);
+  writeFileSync5(file, JSON.stringify({ ...settings, hooks, permissions: { ...settings.permissions ?? {}, allow: [...allow] } }, null, 2) + "\n");
+}
+function writeMcpConfig(dir2, agent, port, token) {
+  const config = {
+    mcpServers: {
+      hq: { type: "http", url: `${hqUrl(agent, port)}/mcp`, headers: { Authorization: `Bearer ${token}`, "X-HQ-Agent": agent.id } }
+    }
+  };
+  mkdirSync4(join8(dir2, ".claude"), { recursive: true });
+  writeFileSync5(join8(dir2, MCP_CONFIG), JSON.stringify(config, null, 2) + "\n", { mode: 384 });
+}
+function writeClaudeFiles(dir2, agent, cfg, token) {
+  writeFileSync5(join8(dir2, "ROLE.md"), roleMd(agent, cfg));
+  writeSettings(dir2, agent, cfg.project.hqPort, token);
+  writeMcpConfig(dir2, agent, cfg.project.hqPort, token);
+  excludeFromGit(dir2, HQ_FILES);
+}
+function excludeFromGit(dir2, paths) {
+  const infoDir = join8(dir2, ".git", "info");
+  if (!existsSync7(join8(dir2, ".git"))) return;
+  mkdirSync4(infoDir, { recursive: true });
+  const file = join8(infoDir, "exclude");
+  const current = existsSync7(file) ? readFileSync4(file, "utf8") : "";
+  const missing = paths.filter((p) => !current.split("\n").includes(p));
+  if (missing.length) writeFileSync5(file, current + (current.endsWith("\n") || !current ? "" : "\n") + "# JSM HQ\n" + missing.join("\n") + "\n");
+}
+
+// server/adapters.ts
+var claude = {
+  async writeFiles(dir2, agent, cfg, token) {
+    writeClaudeFiles(dir2, agent, cfg, token);
+  },
+  launch(agent, dir2) {
+    const m = agent.model.trim();
+    const model = !m || /^default$/i.test(m) ? null : /^(opus|sonnet|haiku)$/i.test(m) ? m.toLowerCase() : m;
+    return { sbxAgent: "claude", args: ["--mcp-config", shq(`${dir2}/${MCP_CONFIG}`), ...model ? ["--model", shq(model)] : []] };
+  }
+};
+var CODEX_CONFIG = ".codex/config.toml";
+var CODEX_EVENTS = ["SessionStart", "UserPromptSubmit", "PreToolUse", "PermissionRequest", "Stop", "SessionEnd"];
+var t = (s) => JSON.stringify(s);
+function codexConfig(agent, cfg, token) {
+  const url = hqUrl(agent, cfg.project.hqPort);
+  const lines = [
+    "# Written by JSM HQ for this agent (git-excluded). Codex loads it once you trust this folder.",
+    `developer_instructions = ${t(roleMd(agent, cfg))}`,
+    "",
+    "[features]",
+    "hooks = true",
+    "",
+    "[mcp_servers.hq]",
+    `url = ${t(`${url}/mcp`)}`,
+    `http_headers = { Authorization = ${t(`Bearer ${token}`)}, "X-HQ-Agent" = ${t(agent.id)} }`
+  ];
+  for (const event of CODEX_EVENTS)
+    lines.push("", `[[hooks.${event}]]`, `[[hooks.${event}.hooks]]`, 'type = "command"', `command = ${t(hookCommand(url, token, agent.id, event))}`);
+  return lines.join("\n") + "\n";
+}
+var codex = {
+  async writeFiles(dir2, agent, cfg, token) {
+    const tracked = await run("git", ["ls-files", "--error-unmatch", CODEX_CONFIG], { cwd: dir2 });
+    if (tracked.ok) throw new Error(`This repo commits ${CODEX_CONFIG}, so HQ can't add its Codex settings without changing a tracked file. Use Claude Code for this agent, or remove that file from the repo.`);
+    writeFileSync6(join9(dir2, "ROLE.md"), roleMd(agent, cfg));
+    mkdirSync5(join9(dir2, ".codex"), { recursive: true });
+    writeFileSync6(join9(dir2, CODEX_CONFIG), codexConfig(agent, cfg, token), { mode: 384 });
+    excludeFromGit(dir2, ["ROLE.md", CODEX_CONFIG]);
+  },
+  launch(agent) {
+    const model = agent.model.trim() && !/^default$/i.test(agent.model.trim()) ? agent.model.trim() : null;
+    return { sbxAgent: "codex", args: model ? ["-m", shq(model)] : [] };
+  }
+};
+var adapters = { claude, codex };
+var localBinary = { claude: "claude", codex: "codex" };
+
+// server/setup.ts
+import { existsSync as existsSync8, readFileSync as readFileSync5 } from "node:fs";
+import { arch, cpus, platform, release, totalmem } from "node:os";
+var SBX_DOCS = "https://docs.docker.com/ai/sandboxes/install/";
+var os = platform();
+var fix = (command, runnable, docs) => ({ command, runnable, docs });
+async function checkOs() {
+  const base = { id: "os", label: "Machine supports sandboxes", neededFor: "sandbox", fix: fix("", false, SBX_DOCS) };
+  if (os === "darwin") {
+    const v = (await run("sw_vers", ["-productVersion"])).stdout.trim();
+    const major = Number(v.split(".")[0]);
+    if (arch() !== "arm64") return { ...base, status: "unsupported", detail: `macOS ${v} on Intel. Sandboxes need Apple silicon \u2014 use Local mode.` };
+    if (major < 14) return { ...base, status: "unsupported", detail: `macOS ${v}. Sandboxes need macOS 14 (Sonoma) or later.` };
+    return { ...base, status: "ok", detail: `macOS ${v} \xB7 Apple silicon`, fix: null };
+  }
+  if (os === "win32") {
+    const build = Number(release().split(".")[2] ?? 0);
+    return build >= 22e3 ? { ...base, status: "ok", detail: "Windows 11 (needs Windows Hypervisor Platform enabled)", fix: null } : { ...base, status: "unsupported", detail: "Windows 10. Sandboxes need Windows 11 \u2014 use Local mode." };
+  }
+  const osRelease = existsSync8("/etc/os-release") ? readFileSync5("/etc/os-release", "utf8") : "";
+  const id = osRelease.match(/^ID=(.*)$/m)?.[1]?.replace(/"/g, "");
+  const ver = Number(osRelease.match(/^VERSION_ID="?([\d.]+)/m)?.[1] ?? 0);
+  if (id === "ubuntu" && ver >= 24.04) return { ...base, status: "ok", detail: `Ubuntu ${ver} (needs KVM)`, fix: null };
+  return { ...base, status: "warning", detail: `${id ?? "Linux"} ${ver || ""} \u2014 Docker documents Ubuntu 24.04+ with KVM.` };
+}
+async function checkSbx(brew) {
+  const base = { id: "sbx", label: "Docker Sandboxes (sbx)", neededFor: "sandbox" };
+  const v = await run("sbx", ["version"], { timeoutMs: 8e3 });
+  if (v.ok) return { ...base, status: "ok", detail: v.stdout.trim().split(/\s+/)[2] ?? v.stdout.trim(), fix: null };
+  const cmd = os === "darwin" ? "brew trust docker/tap && brew install docker/tap/sbx" : os === "win32" ? "winget install -h Docker.sbx" : "curl -fsSL https://get.docker.com | sudo SBX=1 sh";
+  const runnable = os === "darwin" ? brew : os === "win32";
+  return { ...base, status: "missing", detail: "Not installed.", fix: fix(cmd, runnable, SBX_DOCS) };
+}
+async function checkSbxLogin(sbxOk) {
+  const base = { id: "sbx-login", label: "Signed in to Docker", neededFor: "sandbox" };
+  if (!sbxOk) return { ...base, status: "missing", detail: "Waiting for sbx.", fix: null };
+  const r = await run("sbx", ["ls", "--json"], { timeoutMs: 1e4 });
+  if (r.ok) {
+    const n = JSON.parse(r.stdout || "{}").sandboxes?.length ?? 0;
+    return { ...base, status: "ok", detail: `Signed in \xB7 ${n} sandbox${n === 1 ? "" : "es"} on this machine`, fix: null };
+  }
+  const msg = (r.stderr || r.stdout).trim();
+  const loggedOut = /log ?in|sign ?in|unauthori[sz]ed|not authenticated/i.test(msg);
+  return {
+    ...base,
+    status: loggedOut ? "missing" : "warning",
+    detail: loggedOut ? "Not signed in. Sign-in opens your browser." : msg.split("\n")[0] || "sbx did not respond.",
+    fix: fix(loggedOut ? "sbx login" : "sbx diagnose", true, SBX_DOCS)
+  };
+}
+async function checkTmux(brew) {
+  const base = { id: "tmux", label: "tmux (keeps agents running if HQ closes)", neededFor: "all" };
+  const v = await run("tmux", ["-V"], { timeoutMs: 5e3 });
+  if (v.ok) return { ...base, status: "ok", detail: v.stdout.trim(), fix: null };
+  if (os === "win32") return { ...base, status: "unsupported", detail: "tmux needs WSL on Windows. Run HQ inside WSL.", fix: fix("wsl --install", false, "https://learn.microsoft.com/windows/wsl/install") };
+  return {
+    ...base,
+    status: "missing",
+    detail: "Not installed.",
+    fix: os === "darwin" ? fix("brew install tmux", brew, "https://github.com/tmux/tmux/wiki/Installing") : fix("sudo apt install tmux", false, "https://github.com/tmux/tmux/wiki/Installing")
+  };
+}
+async function checkClaude() {
+  const base = { id: "claude", label: "Claude Code (for Local mode)", neededFor: "local" };
+  const v = await run("claude", ["--version"], { timeoutMs: 8e3 });
+  if (v.ok) return { ...base, status: "ok", detail: v.stdout.trim(), fix: null };
+  return {
+    ...base,
+    status: "missing",
+    detail: "Not installed. Only needed for agents in Local mode.",
+    fix: fix(os === "win32" ? "irm https://claude.ai/install.ps1 | iex" : "curl -fsSL https://claude.ai/install.sh | bash", false, "https://docs.claude.com/en/docs/claude-code/setup")
+  };
+}
+async function checkGh(brew) {
+  const base = { id: "gh", label: "GitHub CLI (reads PRs and reviews)", neededFor: "github" };
+  if (!await has("gh"))
+    return {
+      ...base,
+      status: "missing",
+      detail: "Not installed.",
+      fix: fix(os === "darwin" ? "brew install gh" : os === "win32" ? "winget install --id GitHub.cli" : "sudo apt install gh", os === "darwin" ? brew : os === "win32", "https://cli.github.com")
+    };
+  const r = await run("gh", ["auth", "status"], { timeoutMs: 1e4 });
+  const out = r.stdout + r.stderr;
+  if (r.ok) return { ...base, status: "ok", detail: `Signed in as ${out.match(/account (\S+)/)?.[1] ?? "you"}`, fix: null };
+  return { ...base, status: "missing", detail: "Not signed in.", fix: fix("gh auth login", true, "https://cli.github.com/manual/gh_auth_login") };
+}
+function checkRemote(repo) {
+  const base = { id: "gh-remote", label: "GitHub remote", neededFor: "github" };
+  if (repo.github) return { ...base, status: "ok", detail: repo.github, fix: null };
+  return {
+    ...base,
+    status: "warning",
+    detail: repo.originUrl ? `origin is ${repo.originUrl} (not GitHub)` : "No origin remote. Agents can't push or open PRs.",
+    fix: fix("gh repo create --source . --private --push", false, "https://cli.github.com/manual/gh_repo_create")
+  };
+}
+async function checkGithubSecret(sbxOk) {
+  const base = { id: "github-secret", label: "GitHub access inside sandboxes", neededFor: "sandbox" };
+  if (!sbxOk) return { ...base, status: "missing", detail: "Waiting for sbx.", fix: null };
+  const r = await run("sbx", ["secret", "ls"], { timeoutMs: 1e4 });
+  if (r.ok && /\bgithub\b/.test(r.stdout)) return { ...base, status: "ok", detail: "Stored in Docker's secret store; injected by the proxy.", fix: null };
+  return {
+    ...base,
+    status: "missing",
+    detail: "Agents can't push or open PRs until this is set.",
+    fix: fix("sbx secret set github --command 'gh auth token'", true, "https://docs.docker.com/ai/sandboxes/get-started/")
+  };
+}
+async function checkCodex() {
+  const base = { id: "codex", label: "Codex (for Codex agents in Local mode)", neededFor: "local" };
+  const v = await run("codex", ["--version"], { timeoutMs: 8e3 });
+  if (v.ok) return { ...base, status: "ok", detail: v.stdout.trim(), fix: null };
+  return { ...base, status: "missing", detail: "Not installed. Only needed for Codex agents in Local mode (sandboxes have it).", fix: fix("npm install -g @openai/codex", false, "https://developers.openai.com/codex/cli") };
+}
+async function checkOpenAiSecret(sbxOk) {
+  const base = { id: "openai-secret", label: "OpenAI sign-in for Codex agents", neededFor: "sandbox" };
+  if (!sbxOk) return { ...base, status: "missing", detail: "Waiting for sbx.", fix: null };
+  const r = await run("sbx", ["secret", "ls", "--json"], { timeoutMs: 1e4 });
+  let has2 = false;
+  try {
+    has2 = (JSON.parse(r.stdout).secrets ?? []).some((s) => s.name === "openai" && s.scope === "global");
+  } catch {
+  }
+  if (has2) return { ...base, status: "ok", detail: "Stored in Docker's secret store.", fix: null };
+  return { ...base, status: "missing", detail: "Codex agents can't sign in until this is set. Opens your browser to sign in with ChatGPT.", fix: fix("sbx secret set openai --oauth", true, "https://docs.docker.com/ai/sandboxes/") };
+}
+async function runSetupChecks(repo, team = []) {
+  const brew = os === "darwin" && await has("brew");
+  const [osCheck, sbx, tmux, claude2, gh] = await Promise.all([checkOs(), checkSbx(brew), checkTmux(brew), checkClaude(), checkGh(brew)]);
+  const sbxOk = sbx.status === "ok";
+  const [login, secret] = await Promise.all([checkSbxLogin(sbxOk), checkGithubSecret(sbxOk)]);
+  const checks = [osCheck, sbx, login, secret, tmux, claude2, gh, checkRemote(repo)];
+  const codexAgents = team.filter((a) => a.cli === "codex");
+  if (codexAgents.some((a) => a.mode === "sandbox")) checks.splice(4, 0, await checkOpenAiSecret(sbxOk));
+  if (codexAgents.some((a) => a.mode === "local")) checks.push(await checkCodex());
+  const ok2 = (c) => c.status === "ok";
+  return {
+    machine: { cpus: cpus().length, memoryGb: Math.round(totalmem() / 1024 ** 3) },
+    checks,
+    sandboxReady: osCheck.status !== "unsupported" && ok2(sbx) && ok2(login) && ok2(tmux),
+    localReady: ok2(tmux) && ok2(claude2),
+    checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
+// server/tmux.ts
+async function hasSession(name) {
+  return (await run("tmux", ["has-session", "-t", `=${name}`], { timeoutMs: 5e3 })).ok;
+}
+async function newSession(name, cwd, command, env = {}) {
+  const args = ["new-session", "-d", "-s", name, "-x", "200", "-y", "50", "-c", cwd];
+  for (const [k, v] of Object.entries(env)) args.push("-e", `${k}=${v}`);
+  args.push(command);
+  const r = await run("tmux", args, { timeoutMs: 1e4 });
+  if (!r.ok) throw new Error(`tmux: ${r.stderr.trim()}`);
+  await run("tmux", ["set-option", "-t", name, "remain-on-exit", "on"], { timeoutMs: 5e3 });
+  await run("tmux", ["set-option", "-t", name, "mouse", "on"], { timeoutMs: 5e3 });
+  await run("tmux", ["set-option", "-t", name, "status", "off"], { timeoutMs: 5e3 });
+  await run("tmux", ["set-option", "-t", name, "focus-events", "on"], { timeoutMs: 5e3 });
+}
+async function killSession(name) {
+  await run("tmux", ["kill-session", "-t", `=${name}`], { timeoutMs: 5e3 });
+}
+async function paneInfo(name) {
+  const r = await run("tmux", ["display-message", "-p", "-t", `=${name}:`, "#{pane_dead} #{pane_dead_status}"], { timeoutMs: 5e3 });
+  if (!r.ok) return null;
+  const [dead, status] = r.stdout.trim().split(" ");
+  return { dead: dead === "1", exitStatus: status ? Number(status) : null };
+}
+async function tailText(name, n = 6) {
+  const r = await run("tmux", ["capture-pane", "-p", "-t", `=${name}:`], { timeoutMs: 5e3 });
+  return r.stdout.split("\n").map((l) => l.trimEnd()).filter(Boolean).slice(-n).join("\n");
+}
+
+// server/workspace.ts
+import { existsSync as existsSync9 } from "node:fs";
+function workspaceFor(agent, projectSlug) {
+  return agent.workspacePath || managedWorkspace(projectSlug, agent.id);
+}
+async function ensureWorkspace(agent, projectSlug, repo) {
+  const dir2 = workspaceFor(agent, projectSlug);
+  if (agent.workspacePath) {
+    if (!existsSync9(dir2)) throw new Error(`Folder not found: ${dir2}`);
+    if (!(await run("git", ["rev-parse", "--git-dir"], { cwd: dir2 })).ok) throw new Error(`${dir2} is not a git repository.`);
+    return dir2;
+  }
+  if (!existsSync9(dir2)) {
+    const clone = await run("git", ["clone", "--quiet", repo.root, dir2], { timeoutMs: 3e5 });
+    if (!clone.ok) throw new Error(`git clone failed: ${clone.stderr.trim()}`);
+  }
+  if (repo.originUrl) await run("git", ["remote", "set-url", "origin", repo.originUrl], { cwd: dir2 });
+  return dir2;
+}
+
+// server/sessions.ts
+var TERM_ENV = { ...process.env, TERM: "xterm-256color", COLORTERM: "truecolor" };
+var Sessions = class {
+  constructor(hub, agentToken2) {
+    this.hub = hub;
+    this.agentToken = agentToken2;
+  }
+  hub;
+  agentToken;
+  ptys = /* @__PURE__ */ new Map();
+  sizes = /* @__PURE__ */ new Map();
+  fixes = /* @__PURE__ */ new Map();
+  policyOk = false;
+  /** Called whenever an agent's Claude Code session goes away (stop, restart, crash). */
+  onSessionDown = () => {
+  };
+  /** Called once an agent's sandbox exists after Start (to apply its network rules). */
+  onSandboxReady = () => {
+  };
+  /** The agent's env file, if it has one (passed with --env-file / sourced). */
+  envFileFor = () => null;
+  /** Called when HQ reattaches to a session that was already running (e.g. after an HQ restart). */
+  onSessionReattached = () => {
+  };
+  polling = null;
+  name(agentId) {
+    return sessionName(this.hub.slug, agentId);
+  }
+  // ------------------------------------------------------------ lifecycle
+  async start(id) {
+    const hub = this.hub;
+    const agent = hub.cfg(id);
+    const st = hub.status(id);
+    if (!agent || !st || st.session.state === "running" || st.session.state === "starting") return;
+    const setup = hub.snap.setup;
+    const fail2 = (detail) => {
+      hub.setSession(id, { state: "failed", detail });
+      hub.setStatus(id, { state: "idle", note: "Could not start" });
+      hub.activity("session", id, `${agent.name} could not start: ${detail.split("\n")[0]}`);
+    };
+    if (!setup.checks.find((c) => c.id === "tmux" && c.status === "ok")) return fail2("tmux is not installed. See the setup checklist.");
+    if (agent.mode === "sandbox" && !setup.sandboxReady) return fail2("Docker Sandboxes isn't ready on this machine. Finish the setup checklist, or switch this agent to Local mode.");
+    const check = (cid) => setup.checks.find((c) => c.id === cid)?.status;
+    if (agent.mode === "local" && agent.cli === "claude" && check("claude") !== "ok") return fail2("Claude Code isn't installed. See the setup checklist.");
+    if (agent.mode === "local" && agent.cli === "codex" && check("codex") !== "ok") return fail2("Codex isn't installed on this machine. See the setup checklist, or run this agent in a sandbox.");
+    if (agent.mode === "sandbox" && agent.cli === "codex" && check("openai-secret") !== "ok")
+      return fail2("Codex needs an OpenAI key in sbx. Run `sbx secret set openai --oauth` (Setup checklist \u2192 Run in terminal).");
+    const name = this.name(id);
+    this.onSessionDown(id);
+    try {
+      hub.setSession(id, { state: "starting", detail: "Preparing folder\u2026", workspace: workspaceFor(agent, hub.slug) });
+      const dir2 = await ensureWorkspace(agent, hub.slug, hub.repo);
+      const adapter = adapters[agent.cli];
+      await adapter.writeFiles(dir2, agent, hub.snap.config, this.agentToken);
+      if (!await hasSession(name)) {
+        const launch = adapter.launch(agent, dir2);
+        const envFile = this.envFileFor(id);
+        let command = (envFile ? `set -a && . ${shq(envFile)} && set +a && ` : "") + [localBinary[agent.cli], ...launch.args].join(" ");
+        if (agent.mode === "sandbox") {
+          hub.setSession(id, { detail: "Allowing the sandbox to reach HQ\u2026" });
+          await this.ensurePolicy();
+          hub.setSession(id, { detail: "Starting sandbox\u2026" });
+          const { cpus: cpus2, memoryGb } = agent.sandbox.resources;
+          const size = [cpus2 ? `--cpus ${cpus2}` : "", memoryGb ? `--memory ${Math.round(memoryGb * 1024)}m` : ""];
+          const env = envFile ? ["--env-file", shq(envFile)] : [];
+          const args = launch.args.length ? ["--", ...launch.args] : [];
+          command = ["sbx run --name", shq(name), ...size, ...env, launch.sbxAgent, shq(dir2), ...args].filter(Boolean).join(" ");
+        }
+        await newSession(name, dir2, command);
+      }
+      this.attach(id);
+      hub.setSession(id, { state: "running", detail: null, workspace: dir2 });
+      hub.setStatus(id, { state: "idle", note: agent.mode === "sandbox" ? "Sandbox running" : "Running locally" });
+      hub.activity("session", id, `${agent.name} started (${agent.cli === "codex" ? "Codex" : "Claude Code"}, ${agent.mode === "sandbox" ? "Docker Sandbox" : "Local mode"})`);
+      if (agent.mode === "sandbox") {
+        setTimeout(() => void this.refreshSandboxSizes(), 4e3);
+        void this.whenSandboxExists(id).then((ok2) => ok2 && this.onSandboxReady(id));
+      }
+    } catch (err) {
+      fail2(err instanceof Error ? err.message : String(err));
+    }
+  }
+  async stop(id) {
+    const hub = this.hub;
+    const agent = hub.cfg(id);
+    if (!agent) return;
+    const name = this.name(id);
+    this.onSessionDown(id);
+    this.ptys.get(id)?.kill();
+    this.ptys.delete(id);
+    await killSession(name);
+    if (agent.mode === "sandbox") void run("sbx", ["stop", name], { timeoutMs: 3e4 });
+    hub.setSession(id, { state: "stopped", detail: null });
+    hub.setStatus(id, { state: "idle", currentTaskId: null, note: "Stopped" });
+    hub.activity("session", id, `${agent.name} stopped`);
+  }
+  /** What removing this agent would delete: folder state and whether a sandbox exists. */
+  async inspectWorkspace(id) {
+    const agent = this.hub.cfg(id);
+    if (!agent) return null;
+    const dir2 = workspaceFor(agent, this.hub.slug);
+    const exists = existsSync10(dir2);
+    let changedFiles = 0;
+    let unpushedCommits = 0;
+    if (exists) {
+      const status = await run("git", ["status", "--porcelain"], { cwd: dir2 });
+      changedFiles = status.stdout.split("\n").filter(Boolean).length;
+      const log2 = await run("git", ["log", "--oneline", "--branches", "--not", "--remotes"], { cwd: dir2 });
+      unpushedCommits = log2.stdout.split("\n").filter(Boolean).length;
+    }
+    const name = this.name(id);
+    const ls = await run("sbx", ["ls", "--json"], { timeoutMs: 1e4 });
+    let sandboxExists = false;
+    try {
+      sandboxExists = ls.ok && (JSON.parse(ls.stdout).sandboxes ?? []).some((s) => s.name === name);
+    } catch {
+    }
+    return { agentId: id, path: dir2, managed: !agent.workspacePath, exists, changedFiles, unpushedCommits, sandboxName: name, sandboxExists };
+  }
+  /** Stops the agent and deletes what was asked. Only HQ-made folders inside HQ's home can be deleted. */
+  async removeResources(id, opts) {
+    const agent = this.hub.cfg(id);
+    if (!agent) return [];
+    const done = [];
+    const name = this.name(id);
+    this.onSessionDown(id);
+    this.ptys.get(id)?.kill();
+    this.ptys.delete(id);
+    await killSession(name);
+    if (opts.deleteSandbox) {
+      const rm = await run("sbx", ["rm", "-f", name], { timeoutMs: 6e4 });
+      if (rm.ok) done.push("sandbox");
+      else if (!/not found|no such/i.test(rm.stderr)) log.warn(`sbx rm ${name}: ${rm.stderr.trim()}`);
+    } else if (agent.mode === "sandbox") void run("sbx", ["stop", name], { timeoutMs: 3e4 });
+    if (opts.deleteFolder && !agent.workspacePath) {
+      const home = resolve(projectHome(this.hub.slug));
+      const dir2 = resolve(workspaceFor(agent, this.hub.slug));
+      if (dir2.startsWith(home + sep) && dir2 !== home && existsSync10(dir2)) {
+        rmSync(dir2, { recursive: true, force: true });
+        done.push("folder");
+      }
+    }
+    return done;
+  }
+  /** Waits (up to ~90s) for sbx to list the agent's sandbox — creation can take a while the first time. */
+  async whenSandboxExists(id) {
+    for (let i = 0; i < 45; i++) {
+      const r = await run("sbx", ["ls", "--json"], { timeoutMs: 1e4 });
+      try {
+        if ((JSON.parse(r.stdout).sandboxes ?? []).some((s) => s.name === this.name(id))) return true;
+      } catch {
+      }
+      await new Promise((res) => setTimeout(res, 2e3));
+    }
+    return false;
+  }
+  /** Removes the agent's sandbox and starts a fresh one (applies new CPU/memory). The folder is kept. */
+  async recreate(id) {
+    const agent = this.hub.cfg(id);
+    if (!agent || agent.mode !== "sandbox") return;
+    const name = this.name(id);
+    if (this.hub.status(id)?.session.state === "running") await this.stop(id);
+    this.hub.setSession(id, { state: "starting", detail: "Removing the old sandbox\u2026", sandbox: null });
+    const rm = await run("sbx", ["rm", "-f", name], { timeoutMs: 6e4 });
+    if (!rm.ok && !/not found|no such/i.test(rm.stderr)) {
+      this.hub.setSession(id, { state: "failed", detail: `sbx rm failed: ${rm.stderr.trim()}` });
+      return;
+    }
+    this.hub.setSession(id, { state: "stopped", detail: null });
+    this.hub.activity("session", id, `Recreating ${agent.name}'s sandbox with new resources`);
+    await this.start(id);
+  }
+  /** Reads each HQ sandbox's real CPU/memory from `sbx ls --json`. */
+  async refreshSandboxSizes() {
+    const r = await run("sbx", ["ls", "--json"], { timeoutMs: 1e4 });
+    if (!r.ok) return;
+    let list = [];
+    try {
+      list = JSON.parse(r.stdout).sandboxes ?? [];
+    } catch {
+      return;
+    }
+    for (const agent of this.hub.snap.config.team) {
+      const found = list.find((s) => s.name === this.name(agent.id));
+      const m = this.hub.snap.setup.machine;
+      const size = !found ? null : found.cpus && found.memory_mib ? { cpus: found.cpus, memoryGb: Math.round(found.memory_mib / 1024 * 10) / 10 } : { cpus: m.cpus, memoryGb: Math.min(32, Math.max(0.5, m.memoryGb / 2)) };
+      const cur = this.hub.status(agent.id)?.session.sandbox;
+      if (JSON.stringify(cur ?? null) !== JSON.stringify(size)) this.hub.setSession(agent.id, { sandbox: size });
+    }
+  }
+  /**
+   * Lets sandboxes reach HQ's port (checked once per run, added only if missing).
+   * The sandbox proxy evaluates host.docker.internal as localhost, so both are allowed.
+   */
+  async ensurePolicy() {
+    if (this.policyOk) return;
+    const port = this.hub.snap.config.project.hqPort;
+    for (const target of [`localhost:${port}`, `host.docker.internal:${port}`]) {
+      const check = await run("sbx", ["policy", "check", "network", target], { timeoutMs: 1e4 });
+      if (/^Allowed/m.test(check.stdout)) continue;
+      const add = await run("sbx", ["policy", "allow", "network", target], { timeoutMs: 1e4 });
+      if (!add.ok) throw new Error(`Could not allow ${target}: ${add.stderr.trim()}`);
+      log.info(`added sandbox network rule: allow ${target}`);
+    }
+    this.policyOk = true;
+  }
+  // ------------------------------------------------------------ terminals
+  /** One pty per agent, attached to its tmux session; output goes to every browser. */
+  attach(id) {
+    if (this.ptys.has(id)) return;
+    const size = this.sizes.get(id) ?? { cols: 120, rows: 36 };
+    const pty = spawnPty("tmux", ["attach-session", "-t", `=${this.name(id)}`], { name: "xterm-256color", cols: size.cols, rows: size.rows, env: TERM_ENV });
+    this.ptys.set(id, pty);
+    pty.onData((d) => this.hub.terminal(id, d));
+    pty.onExit(() => {
+      if (this.ptys.get(id) === pty) this.ptys.delete(id);
+    });
+  }
+  /** Types a line into an agent's Claude Code prompt and submits it. */
+  async typeInto(agentId, text) {
+    const target = `=${this.name(agentId)}:`;
+    if (!await hasSession(this.name(agentId))) return false;
+    if (!(await run("tmux", ["send-keys", "-t", target, "-l", text], { timeoutMs: 5e3 })).ok) return false;
+    await new Promise((r) => setTimeout(r, 200));
+    return (await run("tmux", ["send-keys", "-t", target, "Enter"], { timeoutMs: 5e3 })).ok;
+  }
+  async pressEnter(agentId) {
+    return (await run("tmux", ["send-keys", "-t", `=${this.name(agentId)}:`, "Enter"], { timeoutMs: 5e3 })).ok;
+  }
+  input(id, data) {
+    if (id.startsWith("setup:")) return this.fixes.get(id)?.write(data);
+    this.ptys.get(id)?.write(data);
+  }
+  resize(id, cols, rows) {
+    const c = Math.max(20, Math.min(400, Math.floor(cols)));
+    const r = Math.max(5, Math.min(200, Math.floor(rows)));
+    const same = this.sizes.get(id)?.cols === c && this.sizes.get(id)?.rows === r;
+    this.sizes.set(id, { cols: c, rows: r });
+    const pty = id.startsWith("setup:") ? this.fixes.get(id) : this.ptys.get(id);
+    if (!pty) return;
+    if (same) {
+      pty.resize(c, Math.max(5, r - 1));
+      setTimeout(() => pty.resize(c, r), 60);
+    } else pty.resize(c, r);
+  }
+  async openWorkspace(id) {
+    const st = this.hub.status(id);
+    const agent = this.hub.cfg(id);
+    const dir2 = st?.session.workspace ?? (agent ? workspaceFor(agent, this.hub.slug) : null);
+    if (!dir2) return;
+    const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
+    await run(opener, [dir2], { timeoutMs: 5e3 });
+  }
+  // ------------------------------------------------------------ health
+  /** Keeps session state honest: picks up sessions from before a restart, notices crashes. */
+  startPolling() {
+    const tick = async () => {
+      if (this.hub.snap.setup.checks.find((c) => c.id === "tmux")?.status !== "ok") return;
+      for (const agent of this.hub.snap.config.team) {
+        const st = this.hub.status(agent.id);
+        if (!st || st.session.state === "starting") continue;
+        const name = this.name(agent.id);
+        const alive = await hasSession(name);
+        if (alive) {
+          const pane = await paneInfo(name);
+          if (pane?.dead) {
+            const detail = await tailText(name) || `Exited with code ${pane.exitStatus}`;
+            await killSession(name);
+            this.ptys.delete(agent.id);
+            this.onSessionDown(agent.id);
+            this.hub.setSession(agent.id, { state: "failed", detail });
+            this.hub.setStatus(agent.id, { state: "idle", note: "Session ended" });
+            this.hub.activity("session", agent.id, `${agent.name}'s session ended`);
+            continue;
+          }
+          this.attach(agent.id);
+          if (st.session.state !== "running") {
+            this.hub.setSession(agent.id, { state: "running", detail: null, workspace: workspaceFor(agent, this.hub.slug) });
+            this.hub.setStatus(agent.id, { note: "Reattached" });
+            this.onSessionReattached(agent.id);
+          }
+          if (agent.cli === "codex") await this.watchCodexScreen(agent.id, name);
+        } else if (st.session.state === "running") {
+          this.ptys.delete(agent.id);
+          this.onSessionDown(agent.id);
+          this.hub.setSession(agent.id, { state: "stopped", detail: null });
+          this.hub.setStatus(agent.id, { state: "idle", note: "Stopped" });
+        }
+      }
+    };
+    void tick();
+    let n = 0;
+    this.polling = setInterval(() => {
+      void tick().catch((e) => log.warn("poll:", e));
+      if (n++ % 10 === 0 && this.hub.snap.setup.sandboxReady) void this.refreshSandboxSizes();
+    }, 3e3);
+  }
+  /**
+   * Codex fires SessionStart only on the first prompt, so HQ reads its screen:
+   * the trust prompts mean "needs you"; the empty prompt means HQ can type.
+   */
+  async watchCodexScreen(agentId, name) {
+    const st = this.hub.status(agentId);
+    if (!st) return;
+    const screen = await tailText(name, 14);
+    const TRUST_NOTE = "Asking: approve Codex's folder and hook prompts in the terminal (choose Yes, then Trust all)";
+    if (/Do you trust the contents of this directory|Hooks need review/i.test(screen)) {
+      if (st.note !== TRUST_NOTE) {
+        this.hub.setStatus(agentId, { state: "needs-input", note: TRUST_NOTE });
+        this.hub.activity("agent.needs-input", agentId, `${this.hub.name(agentId)} needs you: approve Codex's trust prompts`);
+      }
+      return;
+    }
+    if (/Ask Codex to do anything/i.test(screen)) {
+      this.onSessionReattached(agentId);
+      if (st.note === TRUST_NOTE || st.note === "Sandbox running" || st.note === "Running locally" || st.note === "Reattached")
+        this.hub.setStatus(agentId, { state: "idle", note: "Ready" });
+    }
+  }
+  // ------------------------------------------------------------ setup helper
+  async recheckSetup() {
+    this.hub.setSetup(await runSetupChecks(this.hub.repo, this.hub.snap.config.team));
+  }
+  /** Runs a check's fix command in a visible terminal. Only commands HQ itself suggested. */
+  runFix(checkId) {
+    const check = this.hub.snap.setup.checks.find((c) => c.id === checkId);
+    if (!check?.fix?.runnable || !check.fix.command) return;
+    const id = `setup:${checkId}`;
+    if (this.fixes.has(id)) return;
+    const shell = process.platform === "win32" ? "powershell.exe" : process.env.SHELL || "/bin/sh";
+    const args = process.platform === "win32" ? ["-NoProfile", "-Command", check.fix.command] : ["-lc", check.fix.command];
+    const size = this.sizes.get(id) ?? { cols: 100, rows: 16 };
+    const pty = spawnPty(shell, args, { name: "xterm-256color", cols: size.cols, rows: size.rows, cwd: this.hub.repo.root, env: TERM_ENV });
+    this.fixes.set(id, pty);
+    this.hub.terminal(id, `\x1B[2m$ ${check.fix.command}\x1B[0m\r
+`);
+    pty.onData((d) => this.hub.terminal(id, d));
+    pty.onExit(({ exitCode }) => {
+      this.fixes.delete(id);
+      this.hub.terminal(id, `\r
+\x1B[${exitCode === 0 ? "32m\u2713 Done" : `31m\u2717 Exited with code ${exitCode}`}\x1B[0m\r
+`);
+      void this.recheckSetup();
+    });
+  }
+  shutdown() {
+    if (this.polling) clearInterval(this.polling);
+    for (const p of this.ptys.values()) p.kill();
+    for (const p of this.fixes.values()) p.kill();
+  }
+};
+
+// server/main.ts
+function arg(name) {
+  const i = process.argv.indexOf(`--${name}`);
+  return i > -1 ? process.argv[i + 1] : void 0;
+}
+var flag = (name) => process.argv.includes(`--${name}`);
+async function main() {
+  ensurePtyHelperExecutable();
+  const dev = flag("dev");
+  const port = Number(arg("port") ?? process.env.HQ_PORT ?? 7420);
+  const repo = await detectRepo(resolve2(arg("repo") ?? process.env.HQ_REPO ?? process.cwd()));
+  const { config, isNew } = loadConfig(repo, port);
+  config.project.hqPort = port;
+  const slug2 = config.project.id;
+  const token = agentToken(slug2);
+  const uiToken = browserToken(slug2, dev);
+  log.info(`repo   ${repo.root}${repo.github ? `  (github.com/${repo.github})` : ""}`);
+  log.info("checking setup\u2026");
+  const setup = await runSetupChecks(repo, config.team);
+  for (const c of setup.checks) log.info(`  ${c.status === "ok" ? "\u2713" : c.status === "warning" ? "!" : "\u2717"} ${c.label}: ${c.detail}`);
+  const hub = new Hub(repo, slug2, config, loadPlan(repo.root), setup);
+  hub.snap.welcome = isNew;
+  const sessions = new Sessions(hub, token);
+  const inbox = new Inbox(hub, { type: (id, text) => sessions.typeInto(id, text), enter: (id) => sessions.pressEnter(id) });
+  sessions.onSessionDown = (id) => inbox.sessionDown(id);
+  sessions.onSessionReattached = (id) => inbox.sessionReattached(id);
+  const sbx = new Sbx(hub);
+  sessions.envFileFor = (id) => existsSync11(sbx.envFile(id)) ? sbx.envFile(id) : null;
+  sessions.onSandboxReady = (id) => void sbx.syncRules(id);
+  void sbx.refresh();
+  const planner = new Planner(hub, inbox);
+  const root = dirname2(dirname2(fileURLToPath(import.meta.url)));
+  const distDir = join10(root, "dist");
+  const uiPort = Number(process.env.HQ_UI_PORT ?? 5173);
+  const uiOrigin = dev ? `http://localhost:${uiPort}` : `http://127.0.0.1:${port}`;
+  if (!dev && !existsSync11(join10(distDir, "index.html"))) log.warn("No built UI found. Run `pnpm build` first, or use `pnpm dev:hq`.");
+  await startHttp({
+    hub,
+    inbox,
+    planner,
+    port,
+    browserToken: uiToken,
+    agentToken: token,
+    distDir: dev ? null : distDir,
+    allowedOrigins: [uiOrigin, `http://127.0.0.1:${uiPort}`, `http://localhost:${port}`, `http://127.0.0.1:${port}`],
+    commands: makeCommands(hub, sessions, planner, inbox, sbx)
+  });
+  sessions.startPolling();
+  const github = new GitHubSync(hub, planner, repo.github);
+  github.start();
+  const url = `${uiOrigin}/?token=${uiToken}`;
+  log.info(`
+
+  JSM HQ is running \u2192 ${url}
+`);
+  if (!flag("no-open")) {
+    const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
+    setTimeout(() => void run(opener, [url]), dev ? 1500 : 0);
+  }
+  const quit = () => {
+    log.info("stopping HQ \u2014 agent sessions keep running in tmux");
+    sessions.shutdown();
+    github.stop();
+    process.exit(0);
+  };
+  process.on("SIGINT", quit);
+  process.on("SIGTERM", quit);
+}
+main().catch((err) => {
+  if (err?.code === "EADDRINUSE") {
+    log.error(`Port ${arg("port") ?? 7420} is in use \u2014 another HQ may be running. Stop it, or pick another port: npx @therealjsmastery/jsm-hq --port 7421`);
+    process.exit(1);
+  }
+  log.error(err instanceof Error ? err.message : err);
+  process.exit(1);
+});