@truefoundry/trueforge 0.1.0 → 0.1.1

package/dist/main.js

@@ -92,8 +92,12 @@ function parseBoolean(options) {
     return defaultValue;
   }
   const value = raw.trim().toLowerCase();
-  if (value === "true") return true;
-  if (value === "false") return false;
+  if (value === "true") {
+    return true;
+  }
+  if (value === "false") {
+    return false;
+  }
   throw new Error(`Environment variable ${envKey} must be "true" or "false", got "${raw}"`);
 }
 function resolveDefaultFrontendDir() {
@@ -192,11 +196,13 @@ function getPublicBaseUrl(config = configuration) {
   }
   return config.PUBLIC_BASE_URL;
 }
-var DEFAULT_PORT, PACKAGE_ROOT, LOCAL_EXECUTOR_ID, ENV_PATHS_APP_NAME, DEFAULT_POSTGRES_USER, DEFAULT_POSTGRES_PASSWORD, DEFAULT_POSTGRES_DB, DEFAULT_POSTGRES_HOST, DEFAULT_POSTGRES_PORT, DEFAULT_REDIS_URL, DEFAULT_OIDC_USER_REFERENCE_CLAIM, DEFAULT_OIDC_USER_ROLE_CLAIM, DEFAULT_OIDC_ADMIN_ROLE_VALUE, DEFAULT_OIDC_SCOPES, serverExecutionTimeoutSeconds, standalone, port, shared, configuration, config_default;
+var DEFAULT_PORT, DEFAULT_HOST, DEFAULT_MAX_REQUEST_BODY_BYTES, PACKAGE_ROOT, LOCAL_EXECUTOR_ID, ENV_PATHS_APP_NAME, DEFAULT_POSTGRES_USER, DEFAULT_POSTGRES_PASSWORD, DEFAULT_POSTGRES_DB, DEFAULT_POSTGRES_HOST, DEFAULT_POSTGRES_PORT, DEFAULT_REDIS_URL, DEFAULT_OIDC_USER_REFERENCE_CLAIM, DEFAULT_OIDC_USER_ROLE_CLAIM, DEFAULT_OIDC_ADMIN_ROLE_VALUE, DEFAULT_OIDC_SCOPES, serverExecutionTimeoutSeconds, standalone, port, host, shared, configuration, config_default;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     DEFAULT_PORT = 8790;
+    DEFAULT_HOST = "localhost";
+    DEFAULT_MAX_REQUEST_BODY_BYTES = 30 * 1024 * 1024;
     PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
     LOCAL_EXECUTOR_ID = "local";
     ENV_PATHS_APP_NAME = "trueforge";
@@ -221,10 +227,12 @@ var init_config = __esm({
       defaultValue: true
     });
     port = parsePort(getEnv("PORT"));
+    host = getEnv("HOST", { defaultValue: DEFAULT_HOST }) ?? DEFAULT_HOST;
     shared = {
       LOG_LEVEL: getEnv("LOG_LEVEL", { defaultValue: "info" }) ?? "info",
       NODE_ENV: getEnv("NODE_ENV"),
       PORT: port,
+      HOST: host,
       EXECUTOR_ID: standalone ? LOCAL_EXECUTOR_ID : randomAlphanumeric(6),
       MODEL_CATALOG_PATH: resolveOptionalPathEnv("MODEL_CATALOG_PATH"),
       MCP_CATALOG_PATH: resolveOptionalPathEnv("MCP_CATALOG_PATH"),
@@ -247,6 +255,11 @@ var init_config = __esm({
         raw: getEnv("SANDBOX_FILE_MAX_BYTES_FOR_DOWNLOAD"),
         defaultValue: 20971520
       }),
+      MAX_REQUEST_BODY_BYTES: parsePositiveInt({
+        envKey: "MAX_REQUEST_BODY_BYTES",
+        raw: getEnv("MAX_REQUEST_BODY_BYTES"),
+        defaultValue: DEFAULT_MAX_REQUEST_BODY_BYTES
+      }),
       GRACEFUL_TIMEOUT_SECONDS: parsePositiveInt({
         envKey: "GRACEFUL_TIMEOUT_SECONDS",
         raw: getEnv("GRACEFUL_TIMEOUT_SECONDS"),
@@ -576,15 +589,15 @@ __export(migrateSqlite_exports, {
   migrateSqliteToLatest: () => migrateSqliteToLatest
 });
 import { promises as fs2 } from "fs";
-import path3 from "path";
+import path4 from "path";
 import { FileMigrationProvider, Migrator } from "kysely/migration";
 async function migrateSqliteToLatest(db) {
   const migrator = new Migrator({
     db,
     provider: new FileMigrationProvider({
       fs: fs2,
-      path: path3,
-      migrationFolder: path3.join(import.meta.dirname, "sqlite", "migrations")
+      path: path4,
+      migrationFolder: path4.join(import.meta.dirname, "sqlite", "migrations")
     })
   });
   const { error, results } = await migrator.migrateToLatest();
@@ -613,8 +626,8 @@ import { sql } from "kysely";
 function jsonbBind(value) {
   return sql`jsonb(${JSON.stringify(value)})`;
 }
-function jsonbSet(column, path6, value) {
-  return sql`jsonb_set(${column}, ${path6}, ${jsonbBind(value)})`;
+function jsonbSet(column, path7, value) {
+  return sql`jsonb_set(${column}, ${path7}, ${jsonbBind(value)})`;
 }
 function jsonText(column) {
   return sql`json(${column})`;
@@ -724,7 +737,9 @@ async function assembleTurnRecord(db, args) {
     "created_at",
     "updated_at"
   ]).where("session_id", "=", args.session_id).where("turn_id", "=", args.turn_id).executeTakeFirst();
-  if (!turn) return void 0;
+  if (!turn) {
+    return void 0;
+  }
   const contextRows = await db.selectFrom("turn_thread as tt").leftJoin(
     "turn_thread_context as ttc",
     (join) => join.on("ttc.session_id", "=", args.session_id).on("ttc.turn_id", "=", args.turn_id).onRef("ttc.thread_id", "=", "tt.thread_id")
@@ -806,7 +821,9 @@ async function createTurn(db, input) {
   try {
     await db.transaction().execute(async (trx) => {
       const locked = await trx.selectFrom("session").select(["last_turn_id"]).where("session_id", "=", input.session_id).executeTakeFirst();
-      if (!locked) throw new SessionNotFoundError(input.session_id);
+      if (!locked) {
+        throw new SessionNotFoundError(input.session_id);
+      }
       let sessionUpdate = trx.updateTable("session").set({
         last_turn_id: input.turn.turn_id,
         updated_at: nowIso(),
@@ -845,7 +862,9 @@ async function createTurn(db, input) {
           }
           prevCheckpoint = first.turn_checkpoint;
           for (const row of prevRows) {
-            if (row.thread_id === null) continue;
+            if (row.thread_id === null) {
+              continue;
+            }
             if (row.thread_checkpoint === null || row.current_context_usage === null) {
               throw new SessionStoreInvariantError2(`previous turn_thread row for ${row.thread_id} is incomplete`);
             }
@@ -997,7 +1016,9 @@ async function createTurn(db, input) {
       }
       const capabilityStateRows = [];
       for (const capability of input.capability_states) {
-        if (capability.capability_state === null) continue;
+        if (capability.capability_state === null) {
+          continue;
+        }
         for (const [key, state] of Object.entries(capability.capability_state)) {
           capabilityStateRows.push({
             session_id: input.session_id,
@@ -1014,8 +1035,12 @@ async function createTurn(db, input) {
       }
     });
   } catch (err) {
-    if (err instanceof SessionStoreNotFoundError3 || err instanceof SessionStoreConflictError3) throw err;
-    if (isUniqueViolation(err)) throw new TurnAlreadyExistsError(input.turn.turn_id, { cause: err });
+    if (err instanceof SessionStoreNotFoundError3 || err instanceof SessionStoreConflictError3) {
+      throw err;
+    }
+    if (isUniqueViolation(err)) {
+      throw new TurnAlreadyExistsError(input.turn.turn_id, { cause: err });
+    }
     throw err;
   }
 }
@@ -1040,7 +1065,9 @@ async function freezeAndGetTurn(db, input) {
       }).execute();
     }
     const record = await assembleTurnRecord(trx, input);
-    if (!record) throw new TurnNotFoundError(input.turn_id);
+    if (!record) {
+      throw new TurnNotFoundError(input.turn_id);
+    }
     return record;
   });
 }
@@ -1088,7 +1115,9 @@ async function updateTurnState(db, input) {
     const numUpdated = Number(result.numUpdatedRows);
     if (numUpdated === 0) {
       const existing = await trx.selectFrom("turn").select([jsonText(sql2.ref("state")).as("state")]).where("session_id", "=", input.session_id).where("turn_id", "=", input.turn_id).executeTakeFirst();
-      if (!existing) throw new TurnNotFoundError(input.turn_id);
+      if (!existing) {
+        throw new TurnNotFoundError(input.turn_id);
+      }
       throw new TurnNotRunningError(input.turn_id, terminalTurnState(existing.state, input.turn_id));
     }
     await trx.insertInto("session_event").values({
@@ -1157,7 +1186,9 @@ import {
 } from "@truefoundry/trueforge-core/agent-session/store/SessionStoreErrors";
 import { sql as sql4 } from "kysely";
 async function appendToEvents(db, input) {
-  if (input.events.length === 0) return;
+  if (input.events.length === 0) {
+    return;
+  }
   const keys = {
     session_id: input.session_id,
     turn_id: input.turn_id
@@ -1202,11 +1233,17 @@ async function resolveAncestorChain(db, sessionId, anchor) {
   let oldestId = chain[0];
   while (oldestId && oldestId !== anchor.turn_id) {
     const oldest = await db.selectFrom("turn").select([jsonText(sql4.ref("ancestor_ids")).as("ancestor_ids")]).where("session_id", "=", sessionId).where("turn_id", "=", oldestId).executeTakeFirst();
-    if (!oldest) break;
+    if (!oldest) {
+      break;
+    }
     const older = oldest.ancestor_ids.filter((id) => !seen.has(id));
-    if (older.length === 0) break;
+    if (older.length === 0) {
+      break;
+    }
     chain.unshift(...older);
-    for (const id of older) seen.add(id);
+    for (const id of older) {
+      seen.add(id);
+    }
     oldestId = older[0];
   }
   return chain;
@@ -2448,15 +2485,15 @@ __export(migratePostgres_exports, {
   migrateToLatest: () => migrateToLatest
 });
 import { promises as fs3 } from "fs";
-import path4 from "path";
+import path5 from "path";
 import { FileMigrationProvider as FileMigrationProvider2, Migrator as Migrator2 } from "kysely/migration";
 async function migrateToLatest(db) {
   const migrator = new Migrator2({
     db,
     provider: new FileMigrationProvider2({
       fs: fs3,
-      path: path4,
-      migrationFolder: path4.join(import.meta.dirname, "postgres", "migrations")
+      path: path5,
+      migrationFolder: path5.join(import.meta.dirname, "postgres", "migrations")
     })
   });
   const { error, results } = await migrator.migrateToLatest();
@@ -2506,8 +2543,8 @@ import { sql as sql9 } from "kysely";
 function json(value) {
   return sql9`${JSON.stringify(value)}::jsonb`;
 }
-function jsonbSet2(target, path6, newValue) {
-  return sql9`jsonb_set(${target}, ${path6}, ${newValue})`;
+function jsonbSet2(target, path7, newValue) {
+  return sql9`jsonb_set(${target}, ${path7}, ${newValue})`;
 }
 function now() {
   return sql9`now()`;
@@ -2621,7 +2658,9 @@ async function assertTurnRunning2(db, keys) {
 }
 async function assembleTurnRecord2(db, args) {
   const turn = await db.selectFrom("turn").selectAll().where("session_id", "=", args.session_id).where("turn_id", "=", args.turn_id).executeTakeFirst();
-  if (!turn) return void 0;
+  if (!turn) {
+    return void 0;
+  }
   const contextRows = await db.selectFrom("turn_thread as tt").leftJoin(lateralUnnestBigintArrayWithOrdinality(sql11`tt.context_ids`, "c"), (join) => join.onTrue()).leftJoin(
     "thread_context_log as l",
     (join) => join.on("l.session_id", "=", args.session_id).onRef("l.thread_id", "=", "tt.thread_id").onRef("l.append_id", "=", "c.append_id")
@@ -2690,7 +2729,9 @@ async function createTurn2(db, input) {
   try {
     await db.transaction().execute(async (trx) => {
       const locked = await trx.selectFrom("session").select(["last_turn_id"]).where("session_id", "=", input.session_id).forUpdate().executeTakeFirst();
-      if (!locked) throw new SessionNotFoundError4(input.session_id);
+      if (!locked) {
+        throw new SessionNotFoundError4(input.session_id);
+      }
       await trx.updateTable("session").set({
         last_turn_id: input.turn.turn_id,
         updated_at: sql11`now()`,
@@ -2722,7 +2763,9 @@ async function createTurn2(db, input) {
           }
           prevCheckpoint = first.turn_checkpoint;
           for (const row of prevRows) {
-            if (row.thread_id === null) continue;
+            if (row.thread_id === null) {
+              continue;
+            }
             if (row.thread_checkpoint === null || row.current_context_usage === null || row.context_ids === null) {
               throw new SessionStoreInvariantError4(`previous turn_thread row for ${row.thread_id} is incomplete`);
             }
@@ -2830,7 +2873,9 @@ async function createTurn2(db, input) {
       }
       const capabilityStateRows = [];
       for (const capability of input.capability_states) {
-        if (capability.capability_state === null) continue;
+        if (capability.capability_state === null) {
+          continue;
+        }
         for (const [key, state] of Object.entries(capability.capability_state)) {
           capabilityStateRows.push({
             session_id: input.session_id,
@@ -2847,8 +2892,12 @@ async function createTurn2(db, input) {
       }
     });
   } catch (err) {
-    if (err instanceof SessionStoreNotFoundError4 || err instanceof SessionStoreConflictError4) throw err;
-    if (isUniqueViolation2(err)) throw new TurnAlreadyExistsError2(input.turn.turn_id, { cause: err });
+    if (err instanceof SessionStoreNotFoundError4 || err instanceof SessionStoreConflictError4) {
+      throw err;
+    }
+    if (isUniqueViolation2(err)) {
+      throw new TurnAlreadyExistsError2(input.turn.turn_id, { cause: err });
+    }
     throw err;
   }
 }
@@ -2873,7 +2922,9 @@ async function freezeAndGetTurn2(db, input) {
       }).execute();
     }
     const record = await assembleTurnRecord2(trx, input);
-    if (!record) throw new TurnNotFoundError3(input.turn_id);
+    if (!record) {
+      throw new TurnNotFoundError3(input.turn_id);
+    }
     return record;
   });
 }
@@ -2912,7 +2963,9 @@ async function updateTurnState2(db, input) {
     const numUpdated = Number(result.numUpdatedRows);
     if (numUpdated === 0) {
       const existing = await trx.selectFrom("turn").select("state").where("session_id", "=", input.session_id).where("turn_id", "=", input.turn_id).executeTakeFirst();
-      if (!existing) throw new TurnNotFoundError3(input.turn_id);
+      if (!existing) {
+        throw new TurnNotFoundError3(input.turn_id);
+      }
       throw new TurnNotRunningError2(input.turn_id, terminalTurnState2(existing.state, input.turn_id));
     }
     await trx.insertInto("session_event").values({
@@ -2983,7 +3036,9 @@ import {
 } from "@truefoundry/trueforge-core/agent-session/store/SessionStoreErrors";
 import { sql as sql13 } from "kysely";
 async function appendToEvents2(db, input) {
-  if (input.events.length === 0) return;
+  if (input.events.length === 0) {
+    return;
+  }
   const keys = {
     session_id: input.session_id,
     turn_id: input.turn_id
@@ -3058,11 +3113,17 @@ async function resolveAncestorChain2(db, sessionId, anchor) {
   let oldestId = chain[0];
   while (oldestId && oldestId !== anchor.turn_id) {
     const oldest = await db.selectFrom("turn").select(["ancestor_ids"]).where("session_id", "=", sessionId).where("turn_id", "=", oldestId).executeTakeFirst();
-    if (!oldest) break;
+    if (!oldest) {
+      break;
+    }
     const older = oldest.ancestor_ids.filter((id) => !seen.has(id));
-    if (older.length === 0) break;
+    if (older.length === 0) {
+      break;
+    }
     chain.unshift(...older);
-    for (const id of older) seen.add(id);
+    for (const id of older) {
+      seen.add(id);
+    }
     oldestId = older[0];
   }
   return chain;
@@ -4138,19 +4199,19 @@ var init_PostgresAgentStore = __esm({
 // src/main.ts
 import { extractErrorLogFields as extractErrorLogFields8 } from "@truefoundry/trueforge-core/core";
 import { mkdir } from "fs/promises";
-import path5 from "path";
+import path6 from "path";
 import { serve } from "@hono/node-server";
 import {
   CancellationReason as CancellationReason6,
   Sessions
 } from "@truefoundry/trueforge-core/agent-session";
 import { RequestReplyExecutor, RequestReplyRouter } from "@truefoundry/trueforge-core/request-reply";
-import winston from "winston";
 
 // src/app.ts
 import { swaggerUI } from "@hono/swagger-ui";
 import { OpenAPIHono as OpenAPIHono14, z as z24 } from "@hono/zod-openapi";
 import { extractErrorLogFields as extractErrorLogFields6 } from "@truefoundry/trueforge-core/core";
+import { bodyLimit } from "hono/body-limit";
 import { HTTPException as HTTPException6 } from "hono/http-exception";
 
 // src/apis/agents.ts
@@ -4744,6 +4805,7 @@ function toDaytonaSandboxProvider({
   const { apiKey, ...settings } = toDaytonaSandboxProviderInput(manifest);
   return new DaytonaSandboxProvider({
     client: new Daytona({ apiKey }),
+    apiKey,
     ...settings,
     tenantName: tenant_id,
     sandboxImage: build_metadata?.["image_uri"] ?? SANDBOX_IMAGE_URI,
@@ -4759,6 +4821,13 @@ function toSandboxStatus(build) {
     build_metadata: build.metadata
   };
 }
+function sandboxStatusFromRecord(record) {
+  return {
+    status: record.status,
+    status_reason: record.status_reason,
+    build_metadata: record.build_metadata
+  };
+}
 var READY_REVALIDATE_INTERVAL_MS = 13 * 24 * 60 * 60 * 1e3;
 async function checkSnapshotStatus({
   store,
@@ -4769,11 +4838,7 @@ async function checkSnapshotStatus({
   if (!record) {
     return void 0;
   }
-  const persisted = {
-    status: record.status,
-    status_reason: record.status_reason,
-    build_metadata: record.build_metadata
-  };
+  const persisted = sandboxStatusFromRecord(record);
   const readyIsFresh = record.status === "ready" && Date.now() - Date.parse(record.updated_at) < READY_REVALIDATE_INTERVAL_MS;
   if (record.status === "failed" || readyIsFresh) {
     return persisted;
@@ -4791,8 +4856,8 @@ async function checkSnapshotStatus({
     build = await provider.getImageBuildStatus();
   }
   const next = toSandboxStatus(build);
-  await store.updateSandboxStatus({ tenant_id, ...next });
-  return next;
+  const updated = await store.updateSandboxStatus({ tenant_id, ...next });
+  return updated ? sandboxStatusFromRecord(updated) : next;
 }
 
 // src/schemas/mcpServer.ts
@@ -8210,6 +8275,10 @@ Use \`previous_turn_id\` to chain to the session's last turn (defaults to \`auto
       content: { "application/json": { schema: RequestErrorResponseSchema } },
       description: "Requested action cannot be performed on the session because it is no longer usable."
     },
+    413: {
+      content: { "application/json": { schema: RequestErrorResponseSchema } },
+      description: "Request body exceeds the configured maximum size (MAX_REQUEST_BODY_BYTES)."
+    },
     422: {
       content: { "application/json": { schema: RequestErrorResponseSchema } },
       description: "The request is well-formed but cannot be processed: a referenced resource is missing (named agent, model, MCP server, skill, or sandbox provider), sandbox is required but unavailable (e.g. file uploads), or the turn input conflicts with current state (e.g. unresolved tool calls or approvals, tool name collision)."
@@ -8503,30 +8572,30 @@ var StreamGoneError = class extends Error {
 import { SandboxError, validateNoPathTraversal } from "@truefoundry/trueforge-core/core";
 var SandboxInvalidPathError = class extends SandboxError {
   statusCode = 400;
-  constructor({ path: path6, reason }) {
-    super(`Path ${reason}: ${path6}`);
+  constructor({ path: path7, reason }) {
+    super(`Path ${reason}: ${path7}`);
     this.name = "SandboxInvalidPathError";
   }
 };
 var MAX_PATH_BYTES = 4095;
 var MAX_SEGMENT_BYTES = 255;
-function validateSandboxFilePath(path6) {
-  if (!path6.startsWith("/")) {
-    throw new SandboxInvalidPathError({ path: path6, reason: "must be absolute" });
+function validateSandboxFilePath(path7) {
+  if (!path7.startsWith("/")) {
+    throw new SandboxInvalidPathError({ path: path7, reason: "must be absolute" });
   }
-  if (path6.includes("\0")) {
-    throw new SandboxInvalidPathError({ path: path6, reason: "must not contain a NUL byte" });
+  if (path7.includes("\0")) {
+    throw new SandboxInvalidPathError({ path: path7, reason: "must not contain a NUL byte" });
   }
-  if (Buffer.byteLength(path6) > MAX_PATH_BYTES) {
-    throw new SandboxInvalidPathError({ path: path6, reason: `must be at most ${String(MAX_PATH_BYTES)} bytes` });
+  if (Buffer.byteLength(path7) > MAX_PATH_BYTES) {
+    throw new SandboxInvalidPathError({ path: path7, reason: `must be at most ${String(MAX_PATH_BYTES)} bytes` });
   }
-  if (path6.split("/").some((segment) => Buffer.byteLength(segment) > MAX_SEGMENT_BYTES)) {
+  if (path7.split("/").some((segment) => Buffer.byteLength(segment) > MAX_SEGMENT_BYTES)) {
     throw new SandboxInvalidPathError({
-      path: path6,
+      path: path7,
       reason: `must not have a segment longer than ${String(MAX_SEGMENT_BYTES)} bytes`
     });
   }
-  validateNoPathTraversal(path6);
+  validateNoPathTraversal(path7);
 }
 
 // src/apis/turns.ts
@@ -8545,8 +8614,8 @@ function toArrayBuffer(content) {
   new Uint8Array(buffer).set(content);
   return buffer;
 }
-function toContentDisposition(path6) {
-  const fileName = path6.split("/").filter(Boolean).pop() ?? "download";
+function toContentDisposition(path7) {
+  const fileName = path7.split("/").filter(Boolean).pop() ?? "download";
   const encoded = encodeURIComponent(fileName).replace(
     /['()*]/g,
     (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`
@@ -8758,10 +8827,10 @@ function createTurnsRouter(deps) {
   };
   const downloadSandboxFileHandler = async (c) => {
     const { session_id: sessionId, turn_id: turnId } = c.req.valid("param");
-    const { path: path6 } = c.req.valid("query");
+    const { path: path7 } = c.req.valid("query");
     let sandboxId;
     try {
-      validateSandboxFilePath(path6);
+      validateSandboxFilePath(path7);
       const session = await deps.sessions.get({ tenant_id: TENANT_ID, session_id: sessionId });
       if (!session) {
         return c.json({ error: { message: `Session not found: ${sessionId}` } }, 404);
@@ -8786,11 +8855,11 @@ function createTurnsRouter(deps) {
         return c.json({ error: { message: "No sandbox provider configured" } }, 412);
       }
       validateSandboxOwnedByTenant(sandboxId, TENANT_ID);
-      const content = await provider.downloadFile({ sandboxId, path: path6 });
+      const content = await provider.downloadFile({ sandboxId, path: path7 });
       return c.body(toArrayBuffer(content), 200, {
         "Content-Type": "application/octet-stream",
         "Content-Length": String(content.byteLength),
-        "Content-Disposition": toContentDisposition(path6),
+        "Content-Disposition": toContentDisposition(path7),
         "Cache-Control": "private, no-store"
       });
     } catch (error) {
@@ -8802,7 +8871,7 @@ function createTurnsRouter(deps) {
         sessionId,
         turnId,
         sandboxId,
-        path: path6
+        path: path7
       });
       return c.json({ error: { message: "Failed to download file from sandbox" } }, 424);
     }
@@ -9012,6 +9081,28 @@ function createTurnsRouter(deps) {
   return router;
 }
 
+// src/app.ts
+init_config();
+
+// src/packageVersion.ts
+import { readFileSync } from "fs";
+import path2 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var PACKAGE_ROOT2 = path2.resolve(path2.dirname(fileURLToPath2(import.meta.url)), "..");
+function readPackageVersion() {
+  const packageJsonPath = path2.join(PACKAGE_ROOT2, "package.json");
+  const parsed = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+  if (typeof parsed !== "object" || parsed === null || !("version" in parsed)) {
+    throw new Error(`${packageJsonPath} is missing a version field`);
+  }
+  const { version } = parsed;
+  if (typeof version !== "string" || version.length === 0) {
+    throw new Error(`${packageJsonPath} version must be a non-empty string`);
+  }
+  return version;
+}
+var PACKAGE_VERSION = readPackageVersion();
+
 // src/zodErrorResponse.ts
 import { z as z23 } from "@hono/zod-openapi";
 function zodErrorResponse(c, error) {
@@ -9026,6 +9117,12 @@ var zodValidationHook = (result, c) => {
 
 // src/app.ts
 var BEARER_AUTH_SCHEME = "BearerAuth";
+function createRequestBodyLimitMiddleware(maxSize) {
+  return bodyLimit({
+    maxSize,
+    onError: (c) => c.json({ error: { message: `Request body exceeds the maximum size of ${String(maxSize)} bytes` } }, 413)
+  });
+}
 function createAppErrorHandler(params) {
   return (error, c) => {
     if (error instanceof z24.ZodError) {
@@ -9049,7 +9146,7 @@ var openApiDocConfig = {
   info: {
     title: "TrueForge API",
     description: "HTTP API for the TrueForge agent server (`/api/v1`). Interactive docs are served at `/api/v1/docs` (OpenAPI JSON at `/api/v1/openapi.json`).\n\n**Authentication:** Standalone deployments (no OIDC) accept requests without credentials \u2014 middleware stamps a local default user. When OIDC is configured, protected routes require a valid `id_token` cookie or `Authorization: Bearer` ID token. There is no built-in API-key scheme; pass custom headers only if your reverse proxy or IdP layer requires them.\n\nCovers DB-backed sessions, the agent registry, settings catalogs, and model/MCP/skill/sandbox providers.",
-    version: "0.1.0"
+    version: PACKAGE_VERSION
   }
 };
 function registerOpenApiBearerAuth(app) {
@@ -9088,6 +9185,7 @@ function withAdminAuth(router) {
 function createServerApp(deps) {
   const app = new OpenAPIHono14({ defaultHook: zodValidationHook });
   const authEnabled = deps.oidcClient != null;
+  app.use("*", createRequestBodyLimitMiddleware(config_default.MAX_REQUEST_BODY_BYTES));
   app.get("/healthz", (c) => c.text("OK!"));
   app.route("/api/v1/auth", createAuthRouter({ oidcClient: deps.oidcClient, logger: deps.logger }));
   app.route(
@@ -9480,7 +9578,7 @@ import { serveStatic } from "@hono/node-server/serve-static";
 import { every } from "hono/combine";
 import { compress } from "hono/compress";
 import { existsSync as existsSync2 } from "fs";
-import path2 from "path";
+import path3 from "path";
 var SERVER_PATH_PREFIXES = ["/api", "/healthz"];
 var HASHED_ASSET_PREFIX = "/assets/";
 var IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
@@ -9489,7 +9587,7 @@ function isServerPath(pathname) {
   return SERVER_PATH_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
 }
 function mountFrontend(app, dir) {
-  if (!existsSync2(path2.join(dir, "index.html"))) {
+  if (!existsSync2(path3.join(dir, "index.html"))) {
     return false;
   }
   const serveFile = serveStatic({ root: dir, precompressed: true });
@@ -9504,14 +9602,108 @@ function mountFrontend(app, dir) {
   };
   const serveCompressed = every(compress(), serveWithCacheHeaders);
   const serveBuild = async (c, next) => {
-    if (isServerPath(c.req.path)) return next();
-    if (c.req.method !== "GET" && c.req.method !== "HEAD") return next();
+    if (isServerPath(c.req.path)) {
+      return next();
+    }
+    if (c.req.method !== "GET" && c.req.method !== "HEAD") {
+      return next();
+    }
     return serveCompressed(c, next);
   };
+  const serveAppShell = serveStatic({ root: dir, rewriteRequestPath: () => "/index.html", precompressed: true });
+  const serveSpaFallback = async (c, next) => {
+    if (isServerPath(c.req.path)) {
+      return next();
+    }
+    if (c.req.method !== "GET" && c.req.method !== "HEAD") {
+      return next();
+    }
+    if (c.req.header("accept")?.includes("text/html") !== true) {
+      return next();
+    }
+    const response = await serveAppShell(c, next);
+    if (response instanceof Response) {
+      response.headers.set("Cache-Control", REVALIDATE_CACHE_CONTROL);
+      response.headers.set("Vary", "Accept-Encoding");
+    }
+    return response;
+  };
   app.use("/*", serveBuild);
+  app.use("/*", serveSpaFallback);
   return true;
 }
 
+// src/logger.ts
+import winston from "winston";
+var STANDALONE_META_SKIP = /* @__PURE__ */ new Set(["level", "message", "timestamp", "version", "stack", "splat"]);
+function shouldColorize() {
+  const noColor = process.env["NO_COLOR"];
+  if (noColor !== void 0 && noColor !== "") {
+    return false;
+  }
+  const forceColor = process.env["FORCE_COLOR"];
+  if (forceColor === "0") {
+    return false;
+  }
+  if (forceColor !== void 0 && forceColor !== "") {
+    return true;
+  }
+  return process.stderr.isTTY;
+}
+function standaloneMeta(info) {
+  const copied = { ...info };
+  const meta = {};
+  for (const key of Object.keys(copied)) {
+    if (STANDALONE_META_SKIP.has(key)) {
+      continue;
+    }
+    meta[key] = copied[key];
+  }
+  if (Object.keys(meta).length === 0) {
+    return "";
+  }
+  return ` ${JSON.stringify(meta)}`;
+}
+function standaloneFormat(color) {
+  const parts = [
+    winston.format.timestamp({ format: "HH:mm:ss" }),
+    winston.format.errors({ stack: true })
+  ];
+  if (color) {
+    parts.push(winston.format.colorize({ level: true }));
+  }
+  parts.push(
+    winston.format.printf((info) => {
+      const extra = standaloneMeta(info);
+      const stack = typeof info["stack"] === "string" ? `
+${info["stack"]}` : "";
+      return `${String(info["timestamp"])} ${info.level} ${String(info.message)}${extra}${stack}`;
+    })
+  );
+  return winston.format.combine(...parts);
+}
+function jsonFormat() {
+  return winston.format.combine(
+    winston.format.timestamp(),
+    winston.format.errors({ stack: true }),
+    winston.format.json()
+  );
+}
+function serverLogFormat(options) {
+  if (options.standalone) {
+    return standaloneFormat(shouldColorize());
+  }
+  return jsonFormat();
+}
+function createServerLogger(options) {
+  return winston.createLogger({
+    level: options.level,
+    defaultMeta: { version: options.version },
+    format: serverLogFormat({ standalone: options.standalone }),
+    transports: [new winston.transports.Console()]
+  });
+}
+
 // src/runtime/activeTurns.ts
 import "@truefoundry/trueforge-core/agent-session";
 function activeTurnKey(sessionId, turnId) {
@@ -9594,6 +9786,118 @@ var ActiveTurnRegistry = class {
   }
 };
 
+// src/startupBanner.ts
+var STANDALONE_MODE_DISCLAIMER = "Standalone mode is intended for local use on your own machine. It is not hardened for production or shared internet access \u2014 please keep it on localhost. We cannot take responsibility for data loss or unauthorized access if this mode is used beyond that.";
+var ANSI_SHADOW = {
+  T: ["\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557", "\u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D", "   \u2588\u2588\u2551   ", "   \u2588\u2588\u2551   ", "   \u2588\u2588\u2551   ", "   \u255A\u2550\u255D   "],
+  R: ["\u2588\u2588\u2588\u2588\u2588\u2588\u2557 ", "\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557", "\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D", "\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557", "\u2588\u2588\u2551  \u2588\u2588\u2551", "\u255A\u2550\u255D  \u255A\u2550\u255D"],
+  U: ["\u2588\u2588\u2557   \u2588\u2588\u2557", "\u2588\u2588\u2551   \u2588\u2588\u2551", "\u2588\u2588\u2551   \u2588\u2588\u2551", "\u2588\u2588\u2551   \u2588\u2588\u2551", "\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D", " \u255A\u2550\u2550\u2550\u2550\u2550\u255D "],
+  E: ["\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557", "\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D", "\u2588\u2588\u2588\u2588\u2588\u2557  ", "\u2588\u2588\u2554\u2550\u2550\u255D  ", "\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557", "\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D"],
+  F: ["\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557", "\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D", "\u2588\u2588\u2588\u2588\u2588\u2557  ", "\u2588\u2588\u2554\u2550\u2550\u255D  ", "\u2588\u2588\u2551     ", "\u255A\u2550\u255D     "],
+  O: [" \u2588\u2588\u2588\u2588\u2588\u2588\u2557 ", "\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557", "\u2588\u2588\u2551   \u2588\u2588\u2551", "\u2588\u2588\u2551   \u2588\u2588\u2551", "\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D", " \u255A\u2550\u2550\u2550\u2550\u2550\u255D "],
+  G: [" \u2588\u2588\u2588\u2588\u2588\u2588\u2557 ", "\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D ", "\u2588\u2588\u2551  \u2588\u2588\u2588\u2557", "\u2588\u2588\u2551   \u2588\u2588\u2551", "\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D", " \u255A\u2550\u2550\u2550\u2550\u2550\u255D "]
+};
+var WORDMARK_TEXT = "TRUEFORGE";
+var WARNING_INNER_WIDTH = 72;
+var BRAND_COLOR = "\x1B[38;5;99m";
+var YELLOW = "\x1B[33m";
+var BOLD = "\x1B[1m";
+var DIM = "\x1B[2m";
+var RESET = "\x1B[0m";
+function glyphFor(ch) {
+  const glyph = ANSI_SHADOW[ch];
+  if (glyph === void 0) {
+    throw new Error(`No ASCII glyph for ${JSON.stringify(ch)}`);
+  }
+  return glyph;
+}
+function rowOf(glyph, row) {
+  const cell = glyph[row];
+  if (cell === void 0) {
+    throw new Error(`Glyph is missing row ${String(row)}`);
+  }
+  return cell;
+}
+function renderTrueForgeWordmark() {
+  const glyphs = [];
+  for (let i = 0; i < WORDMARK_TEXT.length; i += 1) {
+    const ch = WORDMARK_TEXT[i];
+    if (ch === void 0) {
+      throw new Error(`Missing character at index ${String(i)}`);
+    }
+    glyphs.push(glyphFor(ch));
+  }
+  const rowCount = glyphs[0]?.length;
+  if (rowCount === void 0) {
+    throw new Error("Wordmark text must not be empty");
+  }
+  const rows = [];
+  for (let row = 0; row < rowCount; row += 1) {
+    rows.push(glyphs.map((glyph) => rowOf(glyph, row)).join(""));
+  }
+  return rows.join("\n");
+}
+function wrapText(text, width) {
+  const words = text.split(/\s+/).filter((word) => word.length > 0);
+  const lines = [];
+  let current = "";
+  for (const word of words) {
+    if (current.length === 0) {
+      if (word.length > width) {
+        lines.push(word);
+      } else {
+        current = word;
+      }
+      continue;
+    }
+    const next = `${current} ${word}`;
+    if (next.length <= width) {
+      current = next;
+    } else {
+      lines.push(current);
+      current = word.length > width ? "" : word;
+      if (word.length > width) {
+        lines.push(word);
+      }
+    }
+  }
+  if (current.length > 0) {
+    lines.push(current);
+  }
+  return lines;
+}
+function paint(options) {
+  if (!options.enabled) {
+    return options.text;
+  }
+  return `${options.color}${options.text}${RESET}`;
+}
+function warningBox(message) {
+  const label = " WARNING ";
+  const inner = wrapText(message, WARNING_INNER_WIDTH);
+  const width = Math.max(WARNING_INNER_WIDTH, ...inner.map((line) => line.length), label.length);
+  const topPad = width + 1 - label.length;
+  const top = `\u250C\u2500${label}${"\u2500".repeat(topPad)}\u2510`;
+  const body = inner.map((line) => `\u2502 ${line.padEnd(width)} \u2502`);
+  const bottom = `\u2514${"\u2500".repeat(width + 2)}\u2518`;
+  return [top, ...body, bottom].join("\n");
+}
+function formatStandaloneStartupBanner(options) {
+  const { version, color } = options;
+  const wordmark = paint({ text: renderTrueForgeWordmark(), color: `${BOLD}${BRAND_COLOR}`, enabled: color });
+  const subtitle = paint({ text: `  TrueForge v${version}  \xB7  standalone`, color: DIM, enabled: color });
+  const warning = paint({ text: warningBox(STANDALONE_MODE_DISCLAIMER), color: `${BOLD}${YELLOW}`, enabled: color });
+  return { wordmark: `
+${wordmark}
+${subtitle}
+`, warning };
+}
+function printStandaloneStartupBanner(options) {
+  const { wordmark, warning } = formatStandaloneStartupBanner(options);
+  console.log(wordmark);
+  console.warn(warning);
+}
+
 // src/main.ts
 var configuration2;
 var isOidcConfigured2;
@@ -9608,7 +9912,7 @@ try {
 }
 async function createStandalonePersistence(options) {
   const { sqlitePath, logger } = options;
-  await mkdir(path5.dirname(sqlitePath), { recursive: true });
+  await mkdir(path6.dirname(sqlitePath), { recursive: true });
   const [{ createSqliteDb: createSqliteDb2 }, { migrateSqliteToLatest: migrateSqliteToLatest2 }, sqliteStores] = await Promise.all([
     Promise.resolve().then(() => (init_client(), client_exports)),
     Promise.resolve().then(() => (init_migrateSqlite(), migrateSqlite_exports)),
@@ -9750,11 +10054,16 @@ async function createServerRuntime(persistence, logger) {
   return { activeTurns, app, destroyDb, redis, requestReplyRouter };
 }
 try {
-  const logger = winston.createLogger({
+  const logger = createServerLogger({
     level: configuration2.LOG_LEVEL,
-    format: winston.format.combine(winston.format.timestamp(), winston.format.json()),
-    transports: [new winston.transports.Console()]
+    standalone: configuration2.STANDALONE,
+    version: PACKAGE_VERSION
   });
+  if (configuration2.STANDALONE) {
+    printStandaloneStartupBanner({ version: PACKAGE_VERSION, color: shouldColorize() });
+  } else {
+    logger.info("TrueForge starting", { mode: "distributed" });
+  }
   const { activeTurns, app, destroyDb, redis, requestReplyRouter } = configuration2.STANDALONE ? await createServerRuntime(
     await createStandalonePersistence({ sqlitePath: configuration2.SQLITE_PATH, logger }),
     logger
@@ -9787,8 +10096,8 @@ try {
     });
     await requestReplyExecutor.init();
   }
-  const server = serve({ fetch: app.fetch, port: configuration2.PORT }, (info) => {
-    console.log(`Agent server listening on http://localhost:${String(info.port)} (docs at /api/v1/docs)`);
+  const server = serve({ fetch: app.fetch, port: configuration2.PORT, hostname: configuration2.HOST }, (info) => {
+    logger.info(`Agent server listening on http://${configuration2.HOST}:${String(info.port)} (docs at /api/v1/docs)`);
   });
   server.on("error", (error) => {
     console.error("Failed to start server:", error instanceof Error ? error.message : error);
@@ -9797,7 +10106,9 @@ try {
   if (configuration2.NODE_ENV !== "development") {
     let shuttingDown = false;
     const shutdown = async (signal) => {
-      if (shuttingDown) return;
+      if (shuttingDown) {
+        return;
+      }
       shuttingDown = true;
       logger.info(`Received ${signal}, draining connections before shutdown`);
       setTimeout(() => {