@truefoundry/trueforge 0.1.0 → 0.1.2

package/dist/main.js

@@ -92,8 +92,12 @@ function parseBoolean(options) {
     return defaultValue;
   }
   const value = raw.trim().toLowerCase();
-  if (value === "true") return true;
-  if (value === "false") return false;
+  if (value === "true") {
+    return true;
+  }
+  if (value === "false") {
+    return false;
+  }
   throw new Error(`Environment variable ${envKey} must be "true" or "false", got "${raw}"`);
 }
 function resolveDefaultFrontendDir() {
@@ -192,11 +196,13 @@ function getPublicBaseUrl(config = configuration) {
   }
   return config.PUBLIC_BASE_URL;
 }
-var DEFAULT_PORT, PACKAGE_ROOT, LOCAL_EXECUTOR_ID, ENV_PATHS_APP_NAME, DEFAULT_POSTGRES_USER, DEFAULT_POSTGRES_PASSWORD, DEFAULT_POSTGRES_DB, DEFAULT_POSTGRES_HOST, DEFAULT_POSTGRES_PORT, DEFAULT_REDIS_URL, DEFAULT_OIDC_USER_REFERENCE_CLAIM, DEFAULT_OIDC_USER_ROLE_CLAIM, DEFAULT_OIDC_ADMIN_ROLE_VALUE, DEFAULT_OIDC_SCOPES, serverExecutionTimeoutSeconds, standalone, port, shared, configuration, config_default;
+var DEFAULT_PORT, DEFAULT_HOST, DEFAULT_MAX_REQUEST_BODY_BYTES, PACKAGE_ROOT, LOCAL_EXECUTOR_ID, ENV_PATHS_APP_NAME, DEFAULT_POSTGRES_USER, DEFAULT_POSTGRES_PASSWORD, DEFAULT_POSTGRES_DB, DEFAULT_POSTGRES_HOST, DEFAULT_POSTGRES_PORT, DEFAULT_REDIS_URL, DEFAULT_OIDC_USER_REFERENCE_CLAIM, DEFAULT_OIDC_USER_ROLE_CLAIM, DEFAULT_OIDC_ADMIN_ROLE_VALUE, DEFAULT_OIDC_SCOPES, serverExecutionTimeoutSeconds, standalone, port, host, shared, configuration, config_default;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     DEFAULT_PORT = 8790;
+    DEFAULT_HOST = "localhost";
+    DEFAULT_MAX_REQUEST_BODY_BYTES = 30 * 1024 * 1024;
     PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
     LOCAL_EXECUTOR_ID = "local";
     ENV_PATHS_APP_NAME = "trueforge";
@@ -221,10 +227,12 @@ var init_config = __esm({
       defaultValue: true
     });
     port = parsePort(getEnv("PORT"));
+    host = getEnv("HOST", { defaultValue: DEFAULT_HOST }) ?? DEFAULT_HOST;
     shared = {
       LOG_LEVEL: getEnv("LOG_LEVEL", { defaultValue: "info" }) ?? "info",
       NODE_ENV: getEnv("NODE_ENV"),
       PORT: port,
+      HOST: host,
       EXECUTOR_ID: standalone ? LOCAL_EXECUTOR_ID : randomAlphanumeric(6),
       MODEL_CATALOG_PATH: resolveOptionalPathEnv("MODEL_CATALOG_PATH"),
       MCP_CATALOG_PATH: resolveOptionalPathEnv("MCP_CATALOG_PATH"),
@@ -247,6 +255,11 @@ var init_config = __esm({
         raw: getEnv("SANDBOX_FILE_MAX_BYTES_FOR_DOWNLOAD"),
         defaultValue: 20971520
       }),
+      MAX_REQUEST_BODY_BYTES: parsePositiveInt({
+        envKey: "MAX_REQUEST_BODY_BYTES",
+        raw: getEnv("MAX_REQUEST_BODY_BYTES"),
+        defaultValue: DEFAULT_MAX_REQUEST_BODY_BYTES
+      }),
       GRACEFUL_TIMEOUT_SECONDS: parsePositiveInt({
         envKey: "GRACEFUL_TIMEOUT_SECONDS",
         raw: getEnv("GRACEFUL_TIMEOUT_SECONDS"),
@@ -576,15 +589,15 @@ __export(migrateSqlite_exports, {
   migrateSqliteToLatest: () => migrateSqliteToLatest
 });
 import { promises as fs2 } from "fs";
-import path3 from "path";
+import path4 from "path";
 import { FileMigrationProvider, Migrator } from "kysely/migration";
 async function migrateSqliteToLatest(db) {
   const migrator = new Migrator({
     db,
     provider: new FileMigrationProvider({
       fs: fs2,
-      path: path3,
-      migrationFolder: path3.join(import.meta.dirname, "sqlite", "migrations")
+      path: path4,
+      migrationFolder: path4.join(import.meta.dirname, "sqlite", "migrations")
     })
   });
   const { error, results } = await migrator.migrateToLatest();
@@ -613,8 +626,8 @@ import { sql } from "kysely";
 function jsonbBind(value) {
   return sql`jsonb(${JSON.stringify(value)})`;
 }
-function jsonbSet(column, path6, value) {
-  return sql`jsonb_set(${column}, ${path6}, ${jsonbBind(value)})`;
+function jsonbSet(column, path7, value) {
+  return sql`jsonb_set(${column}, ${path7}, ${jsonbBind(value)})`;
 }
 function jsonText(column) {
   return sql`json(${column})`;
@@ -642,9 +655,7 @@ var init_sqlExpressions2 = __esm({
 });
 
 // src/db/sqlite/session-store/queries/turns.ts
-import {
-  CancellationReason as CancellationReason4
-} from "@truefoundry/trueforge-core/agent-session/schemas/turn";
+import "@truefoundry/trueforge-core/agent-session/schemas/turn";
 import { assertCreateTurnThreadDelta } from "@truefoundry/trueforge-core/agent-session/store/assertCreateTurnThreadDelta";
 import {
   PreviousTurnRunningError,
@@ -653,7 +664,7 @@ import {
   SessionStoreInvariantError as SessionStoreInvariantError2,
   SessionStoreNotFoundError as SessionStoreNotFoundError3,
   TurnAlreadyExistsError,
-  TurnNotFoundError,
+  TurnNotFoundError as TurnNotFoundError2,
   TurnNotRunningError
 } from "@truefoundry/trueforge-core/agent-session/store/SessionStoreErrors";
 import { getEmptyCurrentContextUsage } from "@truefoundry/trueforge-core/core/runtime/contextUsage";
@@ -687,14 +698,14 @@ async function loadTurnState(db, keys) {
 async function classifyTurnFenceWriteFailure(db, keys) {
   const state = await loadTurnState(db, keys);
   if (!state) {
-    throw new TurnNotFoundError(keys.turn_id);
+    throw new TurnNotFoundError2(keys.turn_id);
   }
   throw new TurnNotRunningError(keys.turn_id, terminalTurnState(state, keys.turn_id));
 }
 async function classifyTurnThreadWriteFailure(db, keys, thread_id) {
   const state = await loadTurnState(db, keys);
   if (!state) {
-    throw new TurnNotFoundError(keys.turn_id);
+    throw new TurnNotFoundError2(keys.turn_id);
   }
   if (state.status !== "running") {
     throw new TurnNotRunningError(keys.turn_id, terminalTurnState(state, keys.turn_id));
@@ -704,7 +715,7 @@ async function classifyTurnThreadWriteFailure(db, keys, thread_id) {
 async function assertTurnRunning(db, keys) {
   const state = await loadTurnState(db, keys);
   if (!state) {
-    throw new TurnNotFoundError(keys.turn_id);
+    throw new TurnNotFoundError2(keys.turn_id);
   }
   if (state.status !== "running") {
     throw new TurnNotRunningError(keys.turn_id, terminalTurnState(state, keys.turn_id));
@@ -724,7 +735,9 @@ async function assembleTurnRecord(db, args) {
     "created_at",
     "updated_at"
   ]).where("session_id", "=", args.session_id).where("turn_id", "=", args.turn_id).executeTakeFirst();
-  if (!turn) return void 0;
+  if (!turn) {
+    return void 0;
+  }
   const contextRows = await db.selectFrom("turn_thread as tt").leftJoin(
     "turn_thread_context as ttc",
     (join) => join.on("ttc.session_id", "=", args.session_id).on("ttc.turn_id", "=", args.turn_id).onRef("ttc.thread_id", "=", "tt.thread_id")
@@ -806,7 +819,9 @@ async function createTurn(db, input) {
   try {
     await db.transaction().execute(async (trx) => {
       const locked = await trx.selectFrom("session").select(["last_turn_id"]).where("session_id", "=", input.session_id).executeTakeFirst();
-      if (!locked) throw new SessionNotFoundError(input.session_id);
+      if (!locked) {
+        throw new SessionNotFoundError(input.session_id);
+      }
       let sessionUpdate = trx.updateTable("session").set({
         last_turn_id: input.turn.turn_id,
         updated_at: nowIso(),
@@ -845,7 +860,9 @@ async function createTurn(db, input) {
           }
           prevCheckpoint = first.turn_checkpoint;
           for (const row of prevRows) {
-            if (row.thread_id === null) continue;
+            if (row.thread_id === null) {
+              continue;
+            }
             if (row.thread_checkpoint === null || row.current_context_usage === null) {
               throw new SessionStoreInvariantError2(`previous turn_thread row for ${row.thread_id} is incomplete`);
             }
@@ -997,7 +1014,9 @@ async function createTurn(db, input) {
       }
       const capabilityStateRows = [];
       for (const capability of input.capability_states) {
-        if (capability.capability_state === null) continue;
+        if (capability.capability_state === null) {
+          continue;
+        }
         for (const [key, state] of Object.entries(capability.capability_state)) {
           capabilityStateRows.push({
             session_id: input.session_id,
@@ -1014,8 +1033,12 @@ async function createTurn(db, input) {
       }
     });
   } catch (err) {
-    if (err instanceof SessionStoreNotFoundError3 || err instanceof SessionStoreConflictError3) throw err;
-    if (isUniqueViolation(err)) throw new TurnAlreadyExistsError(input.turn.turn_id, { cause: err });
+    if (err instanceof SessionStoreNotFoundError3 || err instanceof SessionStoreConflictError3) {
+      throw err;
+    }
+    if (isUniqueViolation(err)) {
+      throw new TurnAlreadyExistsError(input.turn.turn_id, { cause: err });
+    }
     throw err;
   }
 }
@@ -1023,7 +1046,7 @@ async function freezeAndGetTurn(db, input) {
   return await db.transaction().execute(async (trx) => {
     const cancelledState = {
       status: "cancelled",
-      reason: CancellationReason4.CancelledForNextTurn,
+      reason: input.reason,
       completed_at: nowIso()
     };
     const updateResult = await trx.updateTable("turn").set({
@@ -1040,7 +1063,9 @@ async function freezeAndGetTurn(db, input) {
       }).execute();
     }
     const record = await assembleTurnRecord(trx, input);
-    if (!record) throw new TurnNotFoundError(input.turn_id);
+    if (!record) {
+      throw new TurnNotFoundError2(input.turn_id);
+    }
     return record;
   });
 }
@@ -1088,7 +1113,9 @@ async function updateTurnState(db, input) {
     const numUpdated = Number(result.numUpdatedRows);
     if (numUpdated === 0) {
       const existing = await trx.selectFrom("turn").select([jsonText(sql2.ref("state")).as("state")]).where("session_id", "=", input.session_id).where("turn_id", "=", input.turn_id).executeTakeFirst();
-      if (!existing) throw new TurnNotFoundError(input.turn_id);
+      if (!existing) {
+        throw new TurnNotFoundError2(input.turn_id);
+      }
       throw new TurnNotRunningError(input.turn_id, terminalTurnState(existing.state, input.turn_id));
     }
     await trx.insertInto("session_event").values({
@@ -1153,11 +1180,13 @@ import {
 } from "@truefoundry/trueforge-core/agent-session/store/SessionEventPageToken";
 import {
   SessionNotFoundError as SessionNotFoundError2,
-  TurnNotFoundError as TurnNotFoundError2
+  TurnNotFoundError as TurnNotFoundError3
 } from "@truefoundry/trueforge-core/agent-session/store/SessionStoreErrors";
 import { sql as sql4 } from "kysely";
 async function appendToEvents(db, input) {
-  if (input.events.length === 0) return;
+  if (input.events.length === 0) {
+    return;
+  }
   const keys = {
     session_id: input.session_id,
     turn_id: input.turn_id
@@ -1186,7 +1215,7 @@ async function listTurnEvents(db, input) {
     (join) => join.onRef("e.session_id", "=", "t.session_id").onRef("e.turn_id", "=", "t.turn_id")
   ).select(["t.turn_id", "e.event"]).where("t.session_id", "=", input.session_id).where("t.turn_id", "=", input.turn_id).orderBy("e.event_id", eventOrder).execute();
   if (rows.length === 0) {
-    throw new TurnNotFoundError2(input.turn_id);
+    throw new TurnNotFoundError3(input.turn_id);
   }
   const events = [];
   for (const row of rows) {
@@ -1202,11 +1231,17 @@ async function resolveAncestorChain(db, sessionId, anchor) {
   let oldestId = chain[0];
   while (oldestId && oldestId !== anchor.turn_id) {
     const oldest = await db.selectFrom("turn").select([jsonText(sql4.ref("ancestor_ids")).as("ancestor_ids")]).where("session_id", "=", sessionId).where("turn_id", "=", oldestId).executeTakeFirst();
-    if (!oldest) break;
+    if (!oldest) {
+      break;
+    }
     const older = oldest.ancestor_ids.filter((id) => !seen.has(id));
-    if (older.length === 0) break;
+    if (older.length === 0) {
+      break;
+    }
     chain.unshift(...older);
-    for (const id of older) seen.add(id);
+    for (const id of older) {
+      seen.add(id);
+    }
     oldestId = older[0];
   }
   return chain;
@@ -1228,7 +1263,7 @@ async function listSessionEvents(db, input) {
   };
   const anchor = await db.selectFrom("turn").select(["turn_id", jsonText(sql4.ref("ancestor_ids")).as("ancestor_ids")]).where("session_id", "=", input.session_id).where("turn_id", "=", cursor.last_turn_id).executeTakeFirst();
   if (!anchor) {
-    throw new TurnNotFoundError2(cursor.last_turn_id);
+    throw new TurnNotFoundError3(cursor.last_turn_id);
   }
   const chainIds = await resolveAncestorChain(db, input.session_id, {
     turn_id: anchor.turn_id,
@@ -2067,6 +2102,9 @@ async function consumePendingAuthorization(db, params) {
     ...fromStoredOAuthPendingAuthorizationData(row.auth_data)
   };
 }
+async function deletePendingAuthorizationsForServer(db, params) {
+  await db.deleteFrom("oauth_pending_authorization").where("oauth_server_id", "=", params.id).execute();
+}
 var init_pendingAuthorization = __esm({
   "src/db/sqlite/token-store/queries/pendingAuthorization.ts"() {
     "use strict";
@@ -2104,6 +2142,9 @@ async function getTokens(db, params) {
 async function deleteToken(db, params) {
   await db.deleteFrom("oauth_token").where("oauth_server_id", "=", params.id).where("user_id", "=", params.userRef).execute();
 }
+async function deleteTokensForServer(db, params) {
+  await db.deleteFrom("oauth_token").where("oauth_server_id", "=", params.id).execute();
+}
 var init_token = __esm({
   "src/db/sqlite/token-store/queries/token.ts"() {
     "use strict";
@@ -2152,6 +2193,12 @@ var init_SqliteOAuthTokenStore = __esm({
       deleteToken(params, transaction) {
         return deleteToken(transaction ?? this.db, params);
       }
+      deleteTokensForServer(params, transaction) {
+        return deleteTokensForServer(transaction ?? this.db, params);
+      }
+      deletePendingAuthorizationsForServer(params, transaction) {
+        return deletePendingAuthorizationsForServer(transaction ?? this.db, params);
+      }
     };
   }
 });
@@ -2448,15 +2495,15 @@ __export(migratePostgres_exports, {
   migrateToLatest: () => migrateToLatest
 });
 import { promises as fs3 } from "fs";
-import path4 from "path";
+import path5 from "path";
 import { FileMigrationProvider as FileMigrationProvider2, Migrator as Migrator2 } from "kysely/migration";
 async function migrateToLatest(db) {
   const migrator = new Migrator2({
     db,
     provider: new FileMigrationProvider2({
       fs: fs3,
-      path: path4,
-      migrationFolder: path4.join(import.meta.dirname, "postgres", "migrations")
+      path: path5,
+      migrationFolder: path5.join(import.meta.dirname, "postgres", "migrations")
     })
   });
   const { error, results } = await migrator.migrateToLatest();
@@ -2485,12 +2532,12 @@ var redis_exports = {};
 __export(redis_exports, {
   connectRedis: () => connectRedis
 });
-import { extractErrorLogFields as extractErrorLogFields7 } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields8 } from "@truefoundry/trueforge-core/core";
 import { createClient } from "redis";
 async function connectRedis(input) {
   const client = createClient({ url: input.url });
   client.on("error", (error) => {
-    input.logger.error("[Redis] Client error", extractErrorLogFields7(error));
+    input.logger.error("[Redis] Client error", extractErrorLogFields8(error));
   });
   await client.connect();
   return client;
@@ -2506,8 +2553,8 @@ import { sql as sql9 } from "kysely";
 function json(value) {
   return sql9`${JSON.stringify(value)}::jsonb`;
 }
-function jsonbSet2(target, path6, newValue) {
-  return sql9`jsonb_set(${target}, ${path6}, ${newValue})`;
+function jsonbSet2(target, path7, newValue) {
+  return sql9`jsonb_set(${target}, ${path7}, ${newValue})`;
 }
 function now() {
   return sql9`now()`;
@@ -2552,9 +2599,7 @@ var init_sqlExpressions4 = __esm({
 });
 
 // src/db/postgres/session-store/queries/turns.ts
-import {
-  CancellationReason as CancellationReason5
-} from "@truefoundry/trueforge-core/agent-session/schemas/turn";
+import "@truefoundry/trueforge-core/agent-session/schemas/turn";
 import { assertCreateTurnThreadDelta as assertCreateTurnThreadDelta2 } from "@truefoundry/trueforge-core/agent-session/store/assertCreateTurnThreadDelta";
 import {
   PreviousTurnRunningError as PreviousTurnRunningError2,
@@ -2563,7 +2608,7 @@ import {
   SessionStoreInvariantError as SessionStoreInvariantError4,
   SessionStoreNotFoundError as SessionStoreNotFoundError4,
   TurnAlreadyExistsError as TurnAlreadyExistsError2,
-  TurnNotFoundError as TurnNotFoundError3,
+  TurnNotFoundError as TurnNotFoundError4,
   TurnNotRunningError as TurnNotRunningError2
 } from "@truefoundry/trueforge-core/agent-session/store/SessionStoreErrors";
 import { getEmptyCurrentContextUsage as getEmptyCurrentContextUsage2 } from "@truefoundry/trueforge-core/core/runtime/contextUsage";
@@ -2596,14 +2641,14 @@ function turnRunningFence(db, keys) {
 async function classifyTurnFenceWriteFailure2(db, keys) {
   const row = await db.selectFrom("turn").select("state").where("session_id", "=", keys.session_id).where("turn_id", "=", keys.turn_id).executeTakeFirst();
   if (!row) {
-    throw new TurnNotFoundError3(keys.turn_id);
+    throw new TurnNotFoundError4(keys.turn_id);
   }
   throw new TurnNotRunningError2(keys.turn_id, terminalTurnState2(row.state, keys.turn_id));
 }
 async function classifyTurnThreadWriteFailure2(db, keys, thread_id) {
   const row = await db.selectFrom("turn").select("state").where("session_id", "=", keys.session_id).where("turn_id", "=", keys.turn_id).executeTakeFirst();
   if (!row) {
-    throw new TurnNotFoundError3(keys.turn_id);
+    throw new TurnNotFoundError4(keys.turn_id);
   }
   if (row.state.status !== "running") {
     throw new TurnNotRunningError2(keys.turn_id, terminalTurnState2(row.state, keys.turn_id));
@@ -2613,7 +2658,7 @@ async function classifyTurnThreadWriteFailure2(db, keys, thread_id) {
 async function assertTurnRunning2(db, keys) {
   const row = await db.selectFrom("turn").select("state").where("session_id", "=", keys.session_id).where("turn_id", "=", keys.turn_id).forShare().executeTakeFirst();
   if (!row) {
-    throw new TurnNotFoundError3(keys.turn_id);
+    throw new TurnNotFoundError4(keys.turn_id);
   }
   if (row.state.status !== "running") {
     throw new TurnNotRunningError2(keys.turn_id, terminalTurnState2(row.state, keys.turn_id));
@@ -2621,7 +2666,9 @@ async function assertTurnRunning2(db, keys) {
 }
 async function assembleTurnRecord2(db, args) {
   const turn = await db.selectFrom("turn").selectAll().where("session_id", "=", args.session_id).where("turn_id", "=", args.turn_id).executeTakeFirst();
-  if (!turn) return void 0;
+  if (!turn) {
+    return void 0;
+  }
   const contextRows = await db.selectFrom("turn_thread as tt").leftJoin(lateralUnnestBigintArrayWithOrdinality(sql11`tt.context_ids`, "c"), (join) => join.onTrue()).leftJoin(
     "thread_context_log as l",
     (join) => join.on("l.session_id", "=", args.session_id).onRef("l.thread_id", "=", "tt.thread_id").onRef("l.append_id", "=", "c.append_id")
@@ -2690,7 +2737,9 @@ async function createTurn2(db, input) {
   try {
     await db.transaction().execute(async (trx) => {
       const locked = await trx.selectFrom("session").select(["last_turn_id"]).where("session_id", "=", input.session_id).forUpdate().executeTakeFirst();
-      if (!locked) throw new SessionNotFoundError4(input.session_id);
+      if (!locked) {
+        throw new SessionNotFoundError4(input.session_id);
+      }
       await trx.updateTable("session").set({
         last_turn_id: input.turn.turn_id,
         updated_at: sql11`now()`,
@@ -2722,7 +2771,9 @@ async function createTurn2(db, input) {
           }
           prevCheckpoint = first.turn_checkpoint;
           for (const row of prevRows) {
-            if (row.thread_id === null) continue;
+            if (row.thread_id === null) {
+              continue;
+            }
             if (row.thread_checkpoint === null || row.current_context_usage === null || row.context_ids === null) {
               throw new SessionStoreInvariantError4(`previous turn_thread row for ${row.thread_id} is incomplete`);
             }
@@ -2830,7 +2881,9 @@ async function createTurn2(db, input) {
       }
       const capabilityStateRows = [];
       for (const capability of input.capability_states) {
-        if (capability.capability_state === null) continue;
+        if (capability.capability_state === null) {
+          continue;
+        }
         for (const [key, state] of Object.entries(capability.capability_state)) {
           capabilityStateRows.push({
             session_id: input.session_id,
@@ -2847,8 +2900,12 @@ async function createTurn2(db, input) {
       }
     });
   } catch (err) {
-    if (err instanceof SessionStoreNotFoundError4 || err instanceof SessionStoreConflictError4) throw err;
-    if (isUniqueViolation2(err)) throw new TurnAlreadyExistsError2(input.turn.turn_id, { cause: err });
+    if (err instanceof SessionStoreNotFoundError4 || err instanceof SessionStoreConflictError4) {
+      throw err;
+    }
+    if (isUniqueViolation2(err)) {
+      throw new TurnAlreadyExistsError2(input.turn.turn_id, { cause: err });
+    }
     throw err;
   }
 }
@@ -2856,7 +2913,7 @@ async function freezeAndGetTurn2(db, input) {
   return await db.transaction().execute(async (trx) => {
     const cancelledState = {
       status: "cancelled",
-      reason: CancellationReason5.CancelledForNextTurn,
+      reason: input.reason,
       completed_at: (/* @__PURE__ */ new Date()).toISOString()
     };
     const updateResult = await trx.updateTable("turn").set({
@@ -2873,7 +2930,9 @@ async function freezeAndGetTurn2(db, input) {
       }).execute();
     }
     const record = await assembleTurnRecord2(trx, input);
-    if (!record) throw new TurnNotFoundError3(input.turn_id);
+    if (!record) {
+      throw new TurnNotFoundError4(input.turn_id);
+    }
     return record;
   });
 }
@@ -2912,7 +2971,9 @@ async function updateTurnState2(db, input) {
     const numUpdated = Number(result.numUpdatedRows);
     if (numUpdated === 0) {
       const existing = await trx.selectFrom("turn").select("state").where("session_id", "=", input.session_id).where("turn_id", "=", input.turn_id).executeTakeFirst();
-      if (!existing) throw new TurnNotFoundError3(input.turn_id);
+      if (!existing) {
+        throw new TurnNotFoundError4(input.turn_id);
+      }
       throw new TurnNotRunningError2(input.turn_id, terminalTurnState2(existing.state, input.turn_id));
     }
     await trx.insertInto("session_event").values({
@@ -2979,11 +3040,13 @@ import {
 } from "@truefoundry/trueforge-core/agent-session/store/SessionEventPageToken";
 import {
   SessionNotFoundError as SessionNotFoundError5,
-  TurnNotFoundError as TurnNotFoundError4
+  TurnNotFoundError as TurnNotFoundError5
 } from "@truefoundry/trueforge-core/agent-session/store/SessionStoreErrors";
 import { sql as sql13 } from "kysely";
 async function appendToEvents2(db, input) {
-  if (input.events.length === 0) return;
+  if (input.events.length === 0) {
+    return;
+  }
   const keys = {
     session_id: input.session_id,
     turn_id: input.turn_id
@@ -3016,7 +3079,7 @@ async function listTurnEvents2(db, input) {
     (join) => join.onRef("e.session_id", "=", "t.session_id").onRef("e.turn_id", "=", "t.turn_id")
   ).select(["t.turn_id", "e.event"]).where("t.session_id", "=", input.session_id).where("t.turn_id", "=", input.turn_id).orderBy("e.event_id", eventOrder).execute();
   if (rows.length === 0) {
-    throw new TurnNotFoundError4(input.turn_id);
+    throw new TurnNotFoundError5(input.turn_id);
   }
   const events = [];
   for (const row of rows) {
@@ -3043,7 +3106,7 @@ async function listSessionEvents2(db, input) {
   };
   const anchor = await db.selectFrom("turn").select(["turn_id", "ancestor_ids"]).where("session_id", "=", input.session_id).where("turn_id", "=", cursor.last_turn_id).executeTakeFirst();
   if (!anchor) {
-    throw new TurnNotFoundError4(cursor.last_turn_id);
+    throw new TurnNotFoundError5(cursor.last_turn_id);
   }
   const chainIds = await resolveAncestorChain2(db, input.session_id, anchor);
   const rows = await db.selectFrom(unnestWithOrdinality(chainIds, "c")).innerJoin(
@@ -3058,11 +3121,17 @@ async function resolveAncestorChain2(db, sessionId, anchor) {
   let oldestId = chain[0];
   while (oldestId && oldestId !== anchor.turn_id) {
     const oldest = await db.selectFrom("turn").select(["ancestor_ids"]).where("session_id", "=", sessionId).where("turn_id", "=", oldestId).executeTakeFirst();
-    if (!oldest) break;
+    if (!oldest) {
+      break;
+    }
     const older = oldest.ancestor_ids.filter((id) => !seen.has(id));
-    if (older.length === 0) break;
+    if (older.length === 0) {
+      break;
+    }
     chain.unshift(...older);
-    for (const id of older) seen.add(id);
+    for (const id of older) {
+      seen.add(id);
+    }
     oldestId = older[0];
   }
   return chain;
@@ -3816,6 +3885,9 @@ async function consumePendingAuthorization2(db, params) {
     ...fromStoredOAuthPendingAuthorizationData(row.auth_data)
   };
 }
+async function deletePendingAuthorizationsForServer2(db, params) {
+  await db.deleteFrom("oauth_pending_authorization").where("oauth_server_id", "=", params.id).execute();
+}
 var init_pendingAuthorization2 = __esm({
   "src/db/postgres/token-store/queries/pendingAuthorization.ts"() {
     "use strict";
@@ -3853,6 +3925,9 @@ async function getTokens2(db, params) {
 async function deleteToken2(db, params) {
   await db.deleteFrom("oauth_token").where("oauth_server_id", "=", params.id).where("user_id", "=", params.userRef).execute();
 }
+async function deleteTokensForServer2(db, params) {
+  await db.deleteFrom("oauth_token").where("oauth_server_id", "=", params.id).execute();
+}
 var init_token2 = __esm({
   "src/db/postgres/token-store/queries/token.ts"() {
     "use strict";
@@ -3901,6 +3976,12 @@ var init_PostgresOAuthTokenStore = __esm({
       deleteToken(params, transaction) {
         return deleteToken2(transaction ?? this.db, params);
       }
+      deleteTokensForServer(params, transaction) {
+        return deleteTokensForServer2(transaction ?? this.db, params);
+      }
+      deletePendingAuthorizationsForServer(params, transaction) {
+        return deletePendingAuthorizationsForServer2(transaction ?? this.db, params);
+      }
     };
   }
 });
@@ -4136,22 +4217,22 @@ var init_PostgresAgentStore = __esm({
 });
 
 // src/main.ts
-import { extractErrorLogFields as extractErrorLogFields8 } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields9 } from "@truefoundry/trueforge-core/core";
 import { mkdir } from "fs/promises";
-import path5 from "path";
+import path6 from "path";
 import { serve } from "@hono/node-server";
 import {
-  CancellationReason as CancellationReason6,
+  CancellationReason as CancellationReason4,
   Sessions
 } from "@truefoundry/trueforge-core/agent-session";
 import { RequestReplyExecutor, RequestReplyRouter } from "@truefoundry/trueforge-core/request-reply";
-import winston from "winston";
 
 // src/app.ts
 import { swaggerUI } from "@hono/swagger-ui";
 import { OpenAPIHono as OpenAPIHono14, z as z24 } from "@hono/zod-openapi";
-import { extractErrorLogFields as extractErrorLogFields6 } from "@truefoundry/trueforge-core/core";
-import { HTTPException as HTTPException6 } from "hono/http-exception";
+import { extractErrorLogFields as extractErrorLogFields7 } from "@truefoundry/trueforge-core/core";
+import { bodyLimit } from "hono/body-limit";
+import { HTTPException as HTTPException5 } from "hono/http-exception";
 
 // src/apis/agents.ts
 init_agentStore();
@@ -4744,6 +4825,7 @@ function toDaytonaSandboxProvider({
   const { apiKey, ...settings } = toDaytonaSandboxProviderInput(manifest);
   return new DaytonaSandboxProvider({
     client: new Daytona({ apiKey }),
+    apiKey,
     ...settings,
     tenantName: tenant_id,
     sandboxImage: build_metadata?.["image_uri"] ?? SANDBOX_IMAGE_URI,
@@ -4759,6 +4841,13 @@ function toSandboxStatus(build) {
     build_metadata: build.metadata
   };
 }
+function sandboxStatusFromRecord(record) {
+  return {
+    status: record.status,
+    status_reason: record.status_reason,
+    build_metadata: record.build_metadata
+  };
+}
 var READY_REVALIDATE_INTERVAL_MS = 13 * 24 * 60 * 60 * 1e3;
 async function checkSnapshotStatus({
   store,
@@ -4769,11 +4858,7 @@ async function checkSnapshotStatus({
   if (!record) {
     return void 0;
   }
-  const persisted = {
-    status: record.status,
-    status_reason: record.status_reason,
-    build_metadata: record.build_metadata
-  };
+  const persisted = sandboxStatusFromRecord(record);
   const readyIsFresh = record.status === "ready" && Date.now() - Date.parse(record.updated_at) < READY_REVALIDATE_INTERVAL_MS;
   if (record.status === "failed" || readyIsFresh) {
     return persisted;
@@ -4791,8 +4876,8 @@ async function checkSnapshotStatus({
     build = await provider.getImageBuildStatus();
   }
   const next = toSandboxStatus(build);
-  await store.updateSandboxStatus({ tenant_id, ...next });
-  return next;
+  const updated = await store.updateSandboxStatus({ tenant_id, ...next });
+  return updated ? sandboxStatusFromRecord(updated) : next;
 }
 
 // src/schemas/mcpServer.ts
@@ -5105,10 +5190,14 @@ import {
   CancellationReason,
   SessionStoreConflictError,
   SessionStoreInvariantError,
-  SessionStoreNotFoundError
+  SessionStoreNotFoundError,
+  TurnNotFoundError
 } from "@truefoundry/trueforge-core/agent-session";
-import { NoResponderError, redisRequest, RequestTimeoutError } from "@truefoundry/trueforge-core/request-reply";
-import { HTTPException as HTTPException3 } from "hono/http-exception";
+import { extractErrorLogFields } from "@truefoundry/trueforge-core/core";
+import {
+  redisRequest,
+  RequestTimeoutError
+} from "@truefoundry/trueforge-core/request-reply";
 import { ulid as ulid2 } from "ulid";
 import { z as z11 } from "zod";
 
@@ -5529,7 +5618,8 @@ function cancelSessionTurnPeerHandler(activeTurns) {
   };
 }
 async function cancelSessionTurn(deps, input) {
-  const { sessionId, turnId, reason = CancellationReason.ClientCancelled } = input;
+  const { turnId, reason = CancellationReason.ClientCancelled } = input;
+  const sessionId = deps.session.session_id;
   const turn = await deps.sessionStore.getTurn({
     session_id: sessionId,
     turn_id: turnId
@@ -5552,33 +5642,39 @@ async function cancelSessionTurn(deps, input) {
           pollIntervalMs: config_default.REDIS_REQUEST_REPLY_POLL_INTERVAL_MS
         }
       });
-      if (reply.status !== 200 && reply.status !== 412) {
-        throw new HTTPException3(500, { message: "Failed to cancel turn on the owning executor", cause: reply });
+      if (reply.status === 200) {
+        return;
       }
     } catch (error) {
-      if (error instanceof NoResponderError) {
-        throw new HTTPException3(412, {
-          message: `Executor owning the running turn is unreachable: ${owner}`,
-          cause: error
-        });
-      }
+      const fields = {
+        sessionId,
+        turnId,
+        owner,
+        ...extractErrorLogFields(error)
+      };
       if (error instanceof RequestTimeoutError) {
-        throw new HTTPException3(424, {
-          message: "Timed out waiting for the owning executor to cancel the turn",
-          cause: error
-        });
-      }
-      if (error instanceof HTTPException3) {
-        throw error;
+        deps.logger.warn("Timed out waiting for owning executor to cancel; freezing the running turn", fields);
+      } else {
+        deps.logger.warn("Failed to reach owning executor over Redis; freezing the running turn", fields);
       }
-      throw new HTTPException3(500, {
-        message: `Unexpected error while cancelling the turn on the owning executor: ${owner}`,
-        cause: error
-      });
     }
+    await freezeTurnIgnoringMissing(deps.session, { turnId, reason });
     return;
   }
-  cancelTurnOnThisExecutor(deps.activeTurns, { sessionId, turnId, reason });
+  const aborted = cancelTurnOnThisExecutor(deps.activeTurns, { sessionId, turnId, reason });
+  if (!aborted) {
+    await freezeTurnIgnoringMissing(deps.session, { turnId, reason });
+  }
+}
+async function freezeTurnIgnoringMissing(session, input) {
+  try {
+    await session.freezeTurn({ turn_id: input.turnId, reason: input.reason });
+  } catch (error) {
+    if (error instanceof TurnNotFoundError) {
+      return;
+    }
+    throw error;
+  }
 }
 var FORBIDDEN_SESSION_ACCESS = "Only the session creator can access this session";
 function checkSessionAccess({ userRef, createdBy }) {
@@ -5708,18 +5804,18 @@ function createSessionsRouter(deps) {
   };
   const cancelSessionHandler = async (c) => {
     const { session_id: sessionId } = c.req.valid("param");
-    const record = await deps.sessionStore.getSession({ tenant_id: TENANT_ID, session_id: sessionId });
-    if (!record) {
+    const session = await deps.sessions.get({ tenant_id: TENANT_ID, session_id: sessionId });
+    if (!session) {
       return c.json({ error: { message: `Session not found: ${sessionId}` } }, 404);
     }
-    if (!checkSessionAccess({ userRef: deps.resolveUserContext(c).userRef, createdBy: record.created_by })) {
+    if (!checkSessionAccess({ userRef: deps.resolveUserContext(c).userRef, createdBy: session.record.created_by })) {
       return c.json({ error: { message: FORBIDDEN_SESSION_ACCESS } }, 403);
     }
-    const turnId = record.last_turn_id;
+    const turnId = session.record.last_turn_id;
     if (!turnId) {
       return c.json({}, 200);
     }
-    await cancelSessionTurn(deps, { sessionId, turnId });
+    await cancelSessionTurn({ ...deps, session }, { turnId });
     return c.json({}, 200);
   };
   const listSessionEventsHandler = async (c) => {
@@ -5843,7 +5939,7 @@ function createAgentsRouter(deps) {
 
 // src/apis/auth.ts
 import { OpenAPIHono as OpenAPIHono3 } from "@hono/zod-openapi";
-import { extractErrorLogFields } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields2 } from "@truefoundry/trueforge-core/core";
 
 // src/auth/cookies.ts
 init_config();
@@ -6061,7 +6157,7 @@ function resolveUserContext(c) {
 }
 
 // src/auth/middleware.ts
-import { HTTPException as HTTPException4 } from "hono/http-exception";
+import { HTTPException as HTTPException3 } from "hono/http-exception";
 import { jwtVerify } from "jose";
 var AUTH_HEADER_TYPE = "Bearer";
 function readBearerIdToken(c) {
@@ -6108,14 +6204,14 @@ var authMiddleware = async (c, next) => {
   try {
     const user = await resolveAuthUser(c);
     if (!user) {
-      throw new HTTPException4(401, { message: "Authentication required" });
+      throw new HTTPException3(401, { message: "Authentication required" });
     }
     c.set("user_context", user);
   } catch (error) {
-    if (error instanceof HTTPException4) {
+    if (error instanceof HTTPException3) {
       throw error;
     }
-    throw new HTTPException4(401, { message: "Authentication required", cause: error });
+    throw new HTTPException3(401, { message: "Authentication required", cause: error });
   }
   return next();
 };
@@ -6127,17 +6223,17 @@ var adminAuthMiddleware = async (c, next) => {
   try {
     const user = await resolveAuthUser(c);
     if (!user) {
-      throw new HTTPException4(401, { message: "Authentication required" });
+      throw new HTTPException3(401, { message: "Authentication required" });
     }
     if (!isAdmin(user)) {
-      throw new HTTPException4(403, { message: "Admin access required" });
+      throw new HTTPException3(403, { message: "Admin access required" });
     }
     c.set("user_context", user);
   } catch (error) {
-    if (error instanceof HTTPException4) {
+    if (error instanceof HTTPException3) {
       throw error;
     }
-    throw new HTTPException4(401, { message: "Authentication required", cause: error });
+    throw new HTTPException3(401, { message: "Authentication required", cause: error });
   }
   return next();
 };
@@ -6243,7 +6339,7 @@ function createAuthRouter(params) {
       });
       return c.redirect(authorizationUrl, 302);
     } catch (error) {
-      params.logger.error("Failed to build login authorization", extractErrorLogFields(error));
+      params.logger.error("Failed to build login authorization", extractErrorLogFields2(error));
       return c.redirect(oauthErrorRedirect("login_failed"), 302);
     }
   });
@@ -6269,7 +6365,7 @@ function createAuthRouter(params) {
       });
       return c.redirect(safeReturnTo(pending.return_to), 302);
     } catch (error) {
-      params.logger.error("Failed to exchange authorization code", extractErrorLogFields(error));
+      params.logger.error("Failed to exchange authorization code", extractErrorLogFields2(error));
       const reason = error instanceof Error ? error.message : "login_failed";
       return c.redirect(oauthErrorRedirect(reason), 302);
     }
@@ -6291,7 +6387,7 @@ function createAuthRouter(params) {
 
 // src/apis/capabilities.ts
 import { OpenAPIHono as OpenAPIHono4 } from "@hono/zod-openapi";
-import { extractErrorLogFields as extractErrorLogFields2 } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields3 } from "@truefoundry/trueforge-core/core";
 
 // src/routes/capabilityRoutes.ts
 import { createRoute as createRoute4, z as z14 } from "@hono/zod-openapi";
@@ -6348,7 +6444,7 @@ function createCapabilitiesRouter(deps) {
       });
       status = refreshed?.status;
     } catch (error) {
-      deps.logger.warn("Sandbox image status check failed; reporting sandbox disabled", extractErrorLogFields2(error));
+      deps.logger.warn("Sandbox image status check failed; reporting sandbox disabled", extractErrorLogFields3(error));
     }
     const sandboxEnabled = status === "ready";
     const settingsEnabled = isAdmin(resolveUserContext(c));
@@ -6732,7 +6828,7 @@ function createCatalogRouter(deps) {
 
 // src/apis/mcpOAuth.ts
 import { OpenAPIHono as OpenAPIHono6 } from "@hono/zod-openapi";
-import { extractErrorLogFields as extractErrorLogFields3, McpConnectionError as McpConnectionError3 } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields4, McpConnectionError as McpConnectionError3 } from "@truefoundry/trueforge-core/core";
 
 // src/routes/mcpOAuthRoutes.ts
 import { createRoute as createRoute6 } from "@hono/zod-openapi";
@@ -6814,10 +6910,10 @@ function createMcpOAuthRouter(deps) {
       });
     } catch (err) {
       if (err instanceof McpConnectionError3) {
-        deps.logger.warn("MCP OAuth callback token exchange failed", extractErrorLogFields3(err));
+        deps.logger.warn("MCP OAuth callback token exchange failed", extractErrorLogFields4(err));
         return callbackFailure({ c, pending, message: err.message });
       }
-      deps.logger.error("MCP OAuth callback unexpected failure", extractErrorLogFields3(err));
+      deps.logger.error("MCP OAuth callback unexpected failure", extractErrorLogFields4(err));
       return callbackFailure({ c, pending, message: "Internal server error", jsonStatus: 500 });
     }
     return callbackSuccess({ c, pending });
@@ -6831,7 +6927,7 @@ function createMcpOAuthRouter(deps) {
 init_config();
 init_mcpServerStore();
 import { OpenAPIHono as OpenAPIHono7 } from "@hono/zod-openapi";
-import { extractErrorLogFields as extractErrorLogFields4, isAuthRequired, McpConnectionError as McpConnectionError4, RemoteMCP } from "@truefoundry/trueforge-core/core";
+import { extractErrorLogFields as extractErrorLogFields5, isAuthRequired, McpConnectionError as McpConnectionError4, RemoteMCP } from "@truefoundry/trueforge-core/core";
 
 // src/routes/mcpServerRoutes.ts
 import { createRoute as createRoute7, z as z21 } from "@hono/zod-openapi";
@@ -7209,7 +7305,7 @@ function createSettingsMcpServersRouter(deps) {
       } catch (error) {
         deps.logger.error(
           `DCR client registration failed for "${incomingManifest.name}"; rejecting create`,
-          extractErrorLogFields4(error)
+          extractErrorLogFields5(error)
         );
         const message = error instanceof Error ? error.message : "Failed to register OAuth client for this MCP server";
         return c.json({ error: { message } }, 422);
@@ -7265,9 +7361,9 @@ function createSettingsMcpServersRouter(deps) {
           existing: existing?.manifest
         });
         let dcrClientToSave;
+        const urlChanged = existing !== void 0 && existing.manifest.url !== manifest.url && manifest.auth?.type === "dcr";
         if (manifest.auth?.type === "dcr") {
           const existingClient = existing ? await deps.mcpServerStore.getClient({ id: existing.id }, transaction) : void 0;
-          const urlChanged = existing && existing.manifest.url !== manifest.url;
           const needsDcr = existingClient === void 0 || urlChanged;
           if (needsDcr) {
             dcrClientToSave = await createMcpOAuthClient({
@@ -7289,6 +7385,10 @@ function createSettingsMcpServersRouter(deps) {
         if (dcrClientToSave !== void 0) {
           await deps.mcpServerStore.saveClient({ id: saved.id, record: dcrClientToSave }, transaction);
         }
+        if (urlChanged) {
+          await deps.tokenStore.deleteTokensForServer({ id: saved.id }, transaction);
+          await deps.tokenStore.deletePendingAuthorizationsForServer({ id: saved.id }, transaction);
+        }
         return saved;
       });
       const token = record.manifest.auth?.type === "dcr" ? await deps.tokenStore.getToken({ id: record.id, userRef }) : void 0;
@@ -7300,7 +7400,7 @@ function createSettingsMcpServersRouter(deps) {
       if (error instanceof McpConnectionError4) {
         deps.logger.error(
           `DCR client registration failed for "${incomingManifest.name}"; rejecting upsert`,
-          extractErrorLogFields4(error)
+          extractErrorLogFields5(error)
         );
         return c.json({ error: { message: error.message } }, 422);
       }
@@ -7340,7 +7440,7 @@ function createSettingsMcpServersRouter(deps) {
       return c.json({ data }, 200);
     } catch (error) {
       if (error instanceof McpConnectionError4) {
-        deps.logger.warn(`MCP tools/list failed for "${name}"`, extractErrorLogFields4(error));
+        deps.logger.warn(`MCP tools/list failed for "${name}"`, extractErrorLogFields5(error));
         if (error.statusCode === 401) {
           return c.json({ error: { message: error.message } }, 422);
         }
@@ -7387,7 +7487,7 @@ function createMcpServersRouter(deps) {
       return c.json(authStatus, 200);
     } catch (error) {
       if (error instanceof McpConnectionError4) {
-        deps.logger.warn(`MCP authorize failed for "${name}"`, extractErrorLogFields4(error));
+        deps.logger.warn(`MCP authorize failed for "${name}"`, extractErrorLogFields5(error));
         if (error.statusCode === 400) {
           return c.json({ error: { message: error.message } }, 400);
         }
@@ -7399,7 +7499,7 @@ function createMcpServersRouter(deps) {
         }
         return c.json({ error: { message: error.message } }, 500);
       }
-      deps.logger.error(`MCP authorize unexpected failure for "${name}"`, extractErrorLogFields4(error));
+      deps.logger.error(`MCP authorize unexpected failure for "${name}"`, extractErrorLogFields5(error));
       return c.json({ error: { message: "Internal server error" } }, 500);
     }
   };
@@ -8002,7 +8102,7 @@ import {
 } from "@truefoundry/trueforge-core/agent-session";
 import {
   AgentHarnessError,
-  extractErrorLogFields as extractErrorLogFields5,
+  extractErrorLogFields as extractErrorLogFields6,
   isAgentInputUserMessage,
   isFileContentPart,
   McpConnectionError as McpConnectionError5,
@@ -8010,7 +8110,7 @@ import {
   validateSandboxOwnedByTenant,
   VercelAILLM
 } from "@truefoundry/trueforge-core/core";
-import { HTTPException as HTTPException5 } from "hono/http-exception";
+import { HTTPException as HTTPException4 } from "hono/http-exception";
 import { streamSSE } from "hono/streaming";
 
 // src/routes/turnRoutes.ts
@@ -8210,6 +8310,10 @@ Use \`previous_turn_id\` to chain to the session's last turn (defaults to \`auto
       content: { "application/json": { schema: RequestErrorResponseSchema } },
       description: "Requested action cannot be performed on the session because it is no longer usable."
     },
+    413: {
+      content: { "application/json": { schema: RequestErrorResponseSchema } },
+      description: "Request body exceeds the configured maximum size (MAX_REQUEST_BODY_BYTES)."
+    },
     422: {
       content: { "application/json": { schema: RequestErrorResponseSchema } },
       description: "The request is well-formed but cannot be processed: a referenced resource is missing (named agent, model, MCP server, skill, or sandbox provider), sandbox is required but unavailable (e.g. file uploads), or the turn input conflicts with current state (e.g. unresolved tool calls or approvals, tool name collision)."
@@ -8503,30 +8607,30 @@ var StreamGoneError = class extends Error {
 import { SandboxError, validateNoPathTraversal } from "@truefoundry/trueforge-core/core";
 var SandboxInvalidPathError = class extends SandboxError {
   statusCode = 400;
-  constructor({ path: path6, reason }) {
-    super(`Path ${reason}: ${path6}`);
+  constructor({ path: path7, reason }) {
+    super(`Path ${reason}: ${path7}`);
     this.name = "SandboxInvalidPathError";
   }
 };
 var MAX_PATH_BYTES = 4095;
 var MAX_SEGMENT_BYTES = 255;
-function validateSandboxFilePath(path6) {
-  if (!path6.startsWith("/")) {
-    throw new SandboxInvalidPathError({ path: path6, reason: "must be absolute" });
+function validateSandboxFilePath(path7) {
+  if (!path7.startsWith("/")) {
+    throw new SandboxInvalidPathError({ path: path7, reason: "must be absolute" });
   }
-  if (path6.includes("\0")) {
-    throw new SandboxInvalidPathError({ path: path6, reason: "must not contain a NUL byte" });
+  if (path7.includes("\0")) {
+    throw new SandboxInvalidPathError({ path: path7, reason: "must not contain a NUL byte" });
   }
-  if (Buffer.byteLength(path6) > MAX_PATH_BYTES) {
-    throw new SandboxInvalidPathError({ path: path6, reason: `must be at most ${String(MAX_PATH_BYTES)} bytes` });
+  if (Buffer.byteLength(path7) > MAX_PATH_BYTES) {
+    throw new SandboxInvalidPathError({ path: path7, reason: `must be at most ${String(MAX_PATH_BYTES)} bytes` });
   }
-  if (path6.split("/").some((segment) => Buffer.byteLength(segment) > MAX_SEGMENT_BYTES)) {
+  if (path7.split("/").some((segment) => Buffer.byteLength(segment) > MAX_SEGMENT_BYTES)) {
     throw new SandboxInvalidPathError({
-      path: path6,
+      path: path7,
       reason: `must not have a segment longer than ${String(MAX_SEGMENT_BYTES)} bytes`
     });
   }
-  validateNoPathTraversal(path6);
+  validateNoPathTraversal(path7);
 }
 
 // src/apis/turns.ts
@@ -8545,8 +8649,8 @@ function toArrayBuffer(content) {
   new Uint8Array(buffer).set(content);
   return buffer;
 }
-function toContentDisposition(path6) {
-  const fileName = path6.split("/").filter(Boolean).pop() ?? "download";
+function toContentDisposition(path7) {
+  const fileName = path7.split("/").filter(Boolean).pop() ?? "download";
   const encoded = encodeURIComponent(fileName).replace(
     /['()*]/g,
     (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`
@@ -8591,7 +8695,7 @@ function createTurnResolver(deps) {
         userRef
       });
       if (connection === void 0) {
-        throw new HTTPException5(422, {
+        throw new HTTPException4(422, {
           message: `Unknown MCP server "${name}" \u2014 not configured`
         });
       }
@@ -8606,14 +8710,14 @@ function createTurnResolver(deps) {
         logger
       });
       if (provider === void 0) {
-        throw new HTTPException5(422, {
+        throw new HTTPException4(422, {
           message: "no sandbox provider configured \u2014 PUT /settings/sandbox-providers"
         });
       }
       if (existingSandboxId === void 0) {
         const status = await checkSnapshotStatus({ store: sandboxProviderStore, tenant_id: TENANT_ID, logger });
         if (status?.status !== "ready") {
-          throw new HTTPException5(422, {
+          throw new HTTPException4(422, {
             message: status?.status === "failed" ? `sandbox image build failed (${status.status_reason ?? "unknown error"})` : "sandbox image is activating \u2014 retry shortly"
           });
         }
@@ -8636,7 +8740,7 @@ function createTurnResolver(deps) {
     agent: async (agentId) => {
       const record = await agentStore.getAgent({ tenant_id: TENANT_ID, id: agentId });
       if (record === void 0) {
-        throw new HTTPException5(422, { message: `Agent not found: ${agentId}` });
+        throw new HTTPException4(422, { message: `Agent not found: ${agentId}` });
       }
       return record.manifest;
     },
@@ -8688,13 +8792,13 @@ async function drainTurnEvents(input) {
       logger.warn("Turn stream ended after session/turn was removed", {
         sessionId,
         turnId,
-        ...extractErrorLogFields5(error)
+        ...extractErrorLogFields6(error)
       });
     } else {
       logger.error("Unexpected error in turn event drain", {
         sessionId,
         turnId,
-        ...extractErrorLogFields5(error)
+        ...extractErrorLogFields6(error)
       });
     }
   } finally {
@@ -8706,7 +8810,7 @@ function resolveAfterSequenceNumber(c, bodyAfterSequenceNumber) {
   if (lastEventId) {
     const sequenceNumber = Number(lastEventId);
     if (!Number.isInteger(sequenceNumber) || sequenceNumber < 0) {
-      throw new HTTPException5(400, { message: "Invalid Last-Event-Id header" });
+      throw new HTTPException4(400, { message: "Invalid Last-Event-Id header" });
     }
     return sequenceNumber;
   }
@@ -8758,10 +8862,10 @@ function createTurnsRouter(deps) {
   };
   const downloadSandboxFileHandler = async (c) => {
     const { session_id: sessionId, turn_id: turnId } = c.req.valid("param");
-    const { path: path6 } = c.req.valid("query");
+    const { path: path7 } = c.req.valid("query");
     let sandboxId;
     try {
-      validateSandboxFilePath(path6);
+      validateSandboxFilePath(path7);
       const session = await deps.sessions.get({ tenant_id: TENANT_ID, session_id: sessionId });
       if (!session) {
         return c.json({ error: { message: `Session not found: ${sessionId}` } }, 404);
@@ -8786,11 +8890,11 @@ function createTurnsRouter(deps) {
         return c.json({ error: { message: "No sandbox provider configured" } }, 412);
       }
       validateSandboxOwnedByTenant(sandboxId, TENANT_ID);
-      const content = await provider.downloadFile({ sandboxId, path: path6 });
+      const content = await provider.downloadFile({ sandboxId, path: path7 });
       return c.body(toArrayBuffer(content), 200, {
         "Content-Type": "application/octet-stream",
         "Content-Length": String(content.byteLength),
-        "Content-Disposition": toContentDisposition(path6),
+        "Content-Disposition": toContentDisposition(path7),
         "Cache-Control": "private, no-store"
       });
     } catch (error) {
@@ -8798,11 +8902,11 @@ function createTurnsRouter(deps) {
         return c.json({ error: { message: error.message } }, error.statusCode);
       }
       deps.logger.error("Sandbox file download failed", {
-        ...extractErrorLogFields5(error),
+        ...extractErrorLogFields6(error),
         sessionId,
         turnId,
         sandboxId,
-        path: path6
+        path: path7
       });
       return c.json({ error: { message: "Failed to download file from sandbox" } }, 424);
     }
@@ -8934,7 +9038,7 @@ function createTurnsRouter(deps) {
             try {
               await stream.writeSSE(turnEventSsePayload(event, sequenceNumber));
             } catch (error) {
-              deps.logger.error("SSE stream write error", extractErrorLogFields5(error));
+              deps.logger.error("SSE stream write error", extractErrorLogFields6(error));
               shouldWriteToSSEStream = false;
             }
           }
@@ -8963,7 +9067,7 @@ function createTurnsRouter(deps) {
       await turnEventStream.assertSubscribable();
     } catch (error) {
       if (error instanceof StreamGoneError) {
-        throw new HTTPException5(412, { message: error.message, cause: error });
+        throw new HTTPException4(412, { message: error.message, cause: error });
       }
       throw error;
     }
@@ -8992,7 +9096,7 @@ function createTurnsRouter(deps) {
         }
       } catch (error) {
         if (!subscribeAbort.signal.aborted) {
-          deps.logger.error("Unexpected error in turn subscribe SSE loop", extractErrorLogFields5(error));
+          deps.logger.error("Unexpected error in turn subscribe SSE loop", extractErrorLogFields6(error));
         }
       } finally {
         clearTimeout(timeoutHandler);
@@ -9012,6 +9116,28 @@ function createTurnsRouter(deps) {
   return router;
 }
 
+// src/app.ts
+init_config();
+
+// src/packageVersion.ts
+import { readFileSync } from "fs";
+import path2 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var PACKAGE_ROOT2 = path2.resolve(path2.dirname(fileURLToPath2(import.meta.url)), "..");
+function readPackageVersion() {
+  const packageJsonPath = path2.join(PACKAGE_ROOT2, "package.json");
+  const parsed = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+  if (typeof parsed !== "object" || parsed === null || !("version" in parsed)) {
+    throw new Error(`${packageJsonPath} is missing a version field`);
+  }
+  const { version } = parsed;
+  if (typeof version !== "string" || version.length === 0) {
+    throw new Error(`${packageJsonPath} version must be a non-empty string`);
+  }
+  return version;
+}
+var PACKAGE_VERSION = readPackageVersion();
+
 // src/zodErrorResponse.ts
 import { z as z23 } from "@hono/zod-openapi";
 function zodErrorResponse(c, error) {
@@ -9026,21 +9152,27 @@ var zodValidationHook = (result, c) => {
 
 // src/app.ts
 var BEARER_AUTH_SCHEME = "BearerAuth";
+function createRequestBodyLimitMiddleware(maxSize) {
+  return bodyLimit({
+    maxSize,
+    onError: (c) => c.json({ error: { message: `Request body exceeds the maximum size of ${String(maxSize)} bytes` } }, 413)
+  });
+}
 function createAppErrorHandler(params) {
   return (error, c) => {
     if (error instanceof z24.ZodError) {
       return zodErrorResponse(c, error);
     }
-    if (error instanceof HTTPException6) {
+    if (error instanceof HTTPException5) {
       if (error.status >= 500) {
         params.logger.error("Server API error", {
           status: error.status,
-          ...extractErrorLogFields6(error)
+          ...extractErrorLogFields7(error)
         });
       }
       return c.json({ error: { message: error.message } }, error.status);
     }
-    params.logger.error("Unhandled error", extractErrorLogFields6(error));
+    params.logger.error("Unhandled error", extractErrorLogFields7(error));
     return c.json({ error: { message: "Internal server error" } }, 500);
   };
 }
@@ -9049,7 +9181,7 @@ var openApiDocConfig = {
   info: {
     title: "TrueForge API",
     description: "HTTP API for the TrueForge agent server (`/api/v1`). Interactive docs are served at `/api/v1/docs` (OpenAPI JSON at `/api/v1/openapi.json`).\n\n**Authentication:** Standalone deployments (no OIDC) accept requests without credentials \u2014 middleware stamps a local default user. When OIDC is configured, protected routes require a valid `id_token` cookie or `Authorization: Bearer` ID token. There is no built-in API-key scheme; pass custom headers only if your reverse proxy or IdP layer requires them.\n\nCovers DB-backed sessions, the agent registry, settings catalogs, and model/MCP/skill/sandbox providers.",
-    version: "0.1.0"
+    version: PACKAGE_VERSION
   }
 };
 function registerOpenApiBearerAuth(app) {
@@ -9088,6 +9220,7 @@ function withAdminAuth(router) {
 function createServerApp(deps) {
   const app = new OpenAPIHono14({ defaultHook: zodValidationHook });
   const authEnabled = deps.oidcClient != null;
+  app.use("*", createRequestBodyLimitMiddleware(config_default.MAX_REQUEST_BODY_BYTES));
   app.get("/healthz", (c) => c.text("OK!"));
   app.route("/api/v1/auth", createAuthRouter({ oidcClient: deps.oidcClient, logger: deps.logger }));
   app.route(
@@ -9191,7 +9324,8 @@ function createServerApp(deps) {
         sandboxProviderStore: deps.sandboxProviderStore,
         redis: deps.redis,
         requestReplyRouter: deps.requestReplyRouter,
-        resolveUserContext
+        resolveUserContext,
+        logger: deps.logger
       })
     )
   );
@@ -9480,7 +9614,7 @@ import { serveStatic } from "@hono/node-server/serve-static";
 import { every } from "hono/combine";
 import { compress } from "hono/compress";
 import { existsSync as existsSync2 } from "fs";
-import path2 from "path";
+import path3 from "path";
 var SERVER_PATH_PREFIXES = ["/api", "/healthz"];
 var HASHED_ASSET_PREFIX = "/assets/";
 var IMMUTABLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
@@ -9489,7 +9623,7 @@ function isServerPath(pathname) {
   return SERVER_PATH_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
 }
 function mountFrontend(app, dir) {
-  if (!existsSync2(path2.join(dir, "index.html"))) {
+  if (!existsSync2(path3.join(dir, "index.html"))) {
     return false;
   }
   const serveFile = serveStatic({ root: dir, precompressed: true });
@@ -9504,14 +9638,108 @@ function mountFrontend(app, dir) {
   };
   const serveCompressed = every(compress(), serveWithCacheHeaders);
   const serveBuild = async (c, next) => {
-    if (isServerPath(c.req.path)) return next();
-    if (c.req.method !== "GET" && c.req.method !== "HEAD") return next();
+    if (isServerPath(c.req.path)) {
+      return next();
+    }
+    if (c.req.method !== "GET" && c.req.method !== "HEAD") {
+      return next();
+    }
     return serveCompressed(c, next);
   };
+  const serveAppShell = serveStatic({ root: dir, rewriteRequestPath: () => "/index.html", precompressed: true });
+  const serveSpaFallback = async (c, next) => {
+    if (isServerPath(c.req.path)) {
+      return next();
+    }
+    if (c.req.method !== "GET" && c.req.method !== "HEAD") {
+      return next();
+    }
+    if (c.req.header("accept")?.includes("text/html") !== true) {
+      return next();
+    }
+    const response = await serveAppShell(c, next);
+    if (response instanceof Response) {
+      response.headers.set("Cache-Control", REVALIDATE_CACHE_CONTROL);
+      response.headers.set("Vary", "Accept-Encoding");
+    }
+    return response;
+  };
   app.use("/*", serveBuild);
+  app.use("/*", serveSpaFallback);
   return true;
 }
 
+// src/logger.ts
+import winston from "winston";
+var STANDALONE_META_SKIP = /* @__PURE__ */ new Set(["level", "message", "timestamp", "version", "stack", "splat"]);
+function shouldColorize() {
+  const noColor = process.env["NO_COLOR"];
+  if (noColor !== void 0 && noColor !== "") {
+    return false;
+  }
+  const forceColor = process.env["FORCE_COLOR"];
+  if (forceColor === "0") {
+    return false;
+  }
+  if (forceColor !== void 0 && forceColor !== "") {
+    return true;
+  }
+  return process.stderr.isTTY;
+}
+function standaloneMeta(info) {
+  const copied = { ...info };
+  const meta = {};
+  for (const key of Object.keys(copied)) {
+    if (STANDALONE_META_SKIP.has(key)) {
+      continue;
+    }
+    meta[key] = copied[key];
+  }
+  if (Object.keys(meta).length === 0) {
+    return "";
+  }
+  return ` ${JSON.stringify(meta)}`;
+}
+function standaloneFormat(color) {
+  const parts = [
+    winston.format.timestamp({ format: "HH:mm:ss" }),
+    winston.format.errors({ stack: true })
+  ];
+  if (color) {
+    parts.push(winston.format.colorize({ level: true }));
+  }
+  parts.push(
+    winston.format.printf((info) => {
+      const extra = standaloneMeta(info);
+      const stack = typeof info["stack"] === "string" ? `
+${info["stack"]}` : "";
+      return `${String(info["timestamp"])} ${info.level} ${String(info.message)}${extra}${stack}`;
+    })
+  );
+  return winston.format.combine(...parts);
+}
+function jsonFormat() {
+  return winston.format.combine(
+    winston.format.timestamp(),
+    winston.format.errors({ stack: true }),
+    winston.format.json()
+  );
+}
+function serverLogFormat(options) {
+  if (options.standalone) {
+    return standaloneFormat(shouldColorize());
+  }
+  return jsonFormat();
+}
+function createServerLogger(options) {
+  return winston.createLogger({
+    level: options.level,
+    defaultMeta: { version: options.version },
+    format: serverLogFormat({ standalone: options.standalone }),
+    transports: [new winston.transports.Console()]
+  });
+}
+
 // src/runtime/activeTurns.ts
 import "@truefoundry/trueforge-core/agent-session";
 function activeTurnKey(sessionId, turnId) {
@@ -9594,6 +9822,118 @@ var ActiveTurnRegistry = class {
   }
 };
 
+// src/startupBanner.ts
+var STANDALONE_MODE_DISCLAIMER = "Standalone mode is intended for local use on your own machine. It is not hardened for production or shared internet access \u2014 please keep it on localhost. We cannot take responsibility for data loss or unauthorized access if this mode is used beyond that.";
+var ANSI_SHADOW = {
+  T: ["\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557", "\u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D", "   \u2588\u2588\u2551   ", "   \u2588\u2588\u2551   ", "   \u2588\u2588\u2551   ", "   \u255A\u2550\u255D   "],
+  R: ["\u2588\u2588\u2588\u2588\u2588\u2588\u2557 ", "\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557", "\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D", "\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557", "\u2588\u2588\u2551  \u2588\u2588\u2551", "\u255A\u2550\u255D  \u255A\u2550\u255D"],
+  U: ["\u2588\u2588\u2557   \u2588\u2588\u2557", "\u2588\u2588\u2551   \u2588\u2588\u2551", "\u2588\u2588\u2551   \u2588\u2588\u2551", "\u2588\u2588\u2551   \u2588\u2588\u2551", "\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D", " \u255A\u2550\u2550\u2550\u2550\u2550\u255D "],
+  E: ["\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557", "\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D", "\u2588\u2588\u2588\u2588\u2588\u2557  ", "\u2588\u2588\u2554\u2550\u2550\u255D  ", "\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557", "\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D"],
+  F: ["\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557", "\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D", "\u2588\u2588\u2588\u2588\u2588\u2557  ", "\u2588\u2588\u2554\u2550\u2550\u255D  ", "\u2588\u2588\u2551     ", "\u255A\u2550\u255D     "],
+  O: [" \u2588\u2588\u2588\u2588\u2588\u2588\u2557 ", "\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557", "\u2588\u2588\u2551   \u2588\u2588\u2551", "\u2588\u2588\u2551   \u2588\u2588\u2551", "\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D", " \u255A\u2550\u2550\u2550\u2550\u2550\u255D "],
+  G: [" \u2588\u2588\u2588\u2588\u2588\u2588\u2557 ", "\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D ", "\u2588\u2588\u2551  \u2588\u2588\u2588\u2557", "\u2588\u2588\u2551   \u2588\u2588\u2551", "\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D", " \u255A\u2550\u2550\u2550\u2550\u2550\u255D "]
+};
+var WORDMARK_TEXT = "TRUEFORGE";
+var WARNING_INNER_WIDTH = 72;
+var BRAND_COLOR = "\x1B[38;5;99m";
+var YELLOW = "\x1B[33m";
+var BOLD = "\x1B[1m";
+var DIM = "\x1B[2m";
+var RESET = "\x1B[0m";
+function glyphFor(ch) {
+  const glyph = ANSI_SHADOW[ch];
+  if (glyph === void 0) {
+    throw new Error(`No ASCII glyph for ${JSON.stringify(ch)}`);
+  }
+  return glyph;
+}
+function rowOf(glyph, row) {
+  const cell = glyph[row];
+  if (cell === void 0) {
+    throw new Error(`Glyph is missing row ${String(row)}`);
+  }
+  return cell;
+}
+function renderTrueForgeWordmark() {
+  const glyphs = [];
+  for (let i = 0; i < WORDMARK_TEXT.length; i += 1) {
+    const ch = WORDMARK_TEXT[i];
+    if (ch === void 0) {
+      throw new Error(`Missing character at index ${String(i)}`);
+    }
+    glyphs.push(glyphFor(ch));
+  }
+  const rowCount = glyphs[0]?.length;
+  if (rowCount === void 0) {
+    throw new Error("Wordmark text must not be empty");
+  }
+  const rows = [];
+  for (let row = 0; row < rowCount; row += 1) {
+    rows.push(glyphs.map((glyph) => rowOf(glyph, row)).join(""));
+  }
+  return rows.join("\n");
+}
+function wrapText(text, width) {
+  const words = text.split(/\s+/).filter((word) => word.length > 0);
+  const lines = [];
+  let current = "";
+  for (const word of words) {
+    if (current.length === 0) {
+      if (word.length > width) {
+        lines.push(word);
+      } else {
+        current = word;
+      }
+      continue;
+    }
+    const next = `${current} ${word}`;
+    if (next.length <= width) {
+      current = next;
+    } else {
+      lines.push(current);
+      current = word.length > width ? "" : word;
+      if (word.length > width) {
+        lines.push(word);
+      }
+    }
+  }
+  if (current.length > 0) {
+    lines.push(current);
+  }
+  return lines;
+}
+function paint(options) {
+  if (!options.enabled) {
+    return options.text;
+  }
+  return `${options.color}${options.text}${RESET}`;
+}
+function warningBox(message) {
+  const label = " WARNING ";
+  const inner = wrapText(message, WARNING_INNER_WIDTH);
+  const width = Math.max(WARNING_INNER_WIDTH, ...inner.map((line) => line.length), label.length);
+  const topPad = width + 1 - label.length;
+  const top = `\u250C\u2500${label}${"\u2500".repeat(topPad)}\u2510`;
+  const body = inner.map((line) => `\u2502 ${line.padEnd(width)} \u2502`);
+  const bottom = `\u2514${"\u2500".repeat(width + 2)}\u2518`;
+  return [top, ...body, bottom].join("\n");
+}
+function formatStandaloneStartupBanner(options) {
+  const { version, color } = options;
+  const wordmark = paint({ text: renderTrueForgeWordmark(), color: `${BOLD}${BRAND_COLOR}`, enabled: color });
+  const subtitle = paint({ text: `  TrueForge v${version}  \xB7  standalone`, color: DIM, enabled: color });
+  const warning = paint({ text: warningBox(STANDALONE_MODE_DISCLAIMER), color: `${BOLD}${YELLOW}`, enabled: color });
+  return { wordmark: `
+${wordmark}
+${subtitle}
+`, warning };
+}
+function printStandaloneStartupBanner(options) {
+  const { wordmark, warning } = formatStandaloneStartupBanner(options);
+  console.log(wordmark);
+  console.warn(warning);
+}
+
 // src/main.ts
 var configuration2;
 var isOidcConfigured2;
@@ -9608,7 +9948,7 @@ try {
 }
 async function createStandalonePersistence(options) {
   const { sqlitePath, logger } = options;
-  await mkdir(path5.dirname(sqlitePath), { recursive: true });
+  await mkdir(path6.dirname(sqlitePath), { recursive: true });
   const [{ createSqliteDb: createSqliteDb2 }, { migrateSqliteToLatest: migrateSqliteToLatest2 }, sqliteStores] = await Promise.all([
     Promise.resolve().then(() => (init_client(), client_exports)),
     Promise.resolve().then(() => (init_migrateSqlite(), migrateSqlite_exports)),
@@ -9750,11 +10090,16 @@ async function createServerRuntime(persistence, logger) {
   return { activeTurns, app, destroyDb, redis, requestReplyRouter };
 }
 try {
-  const logger = winston.createLogger({
+  const logger = createServerLogger({
     level: configuration2.LOG_LEVEL,
-    format: winston.format.combine(winston.format.timestamp(), winston.format.json()),
-    transports: [new winston.transports.Console()]
+    standalone: configuration2.STANDALONE,
+    version: PACKAGE_VERSION
   });
+  if (configuration2.STANDALONE) {
+    printStandaloneStartupBanner({ version: PACKAGE_VERSION, color: shouldColorize() });
+  } else {
+    logger.info("TrueForge starting", { mode: "distributed" });
+  }
   const { activeTurns, app, destroyDb, redis, requestReplyRouter } = configuration2.STANDALONE ? await createServerRuntime(
     await createStandalonePersistence({ sqlitePath: configuration2.SQLITE_PATH, logger }),
     logger
@@ -9771,7 +10116,7 @@ try {
   if (redis) {
     requestReplySubscriber = redis.duplicate();
     requestReplySubscriber.on("error", (error) => {
-      logger.error("[RedisSubscriber] Client error", extractErrorLogFields8(error));
+      logger.error("[RedisSubscriber] Client error", extractErrorLogFields9(error));
     });
     await requestReplySubscriber.connect();
     requestReplyExecutor = new RequestReplyExecutor({
@@ -9787,8 +10132,8 @@ try {
     });
     await requestReplyExecutor.init();
   }
-  const server = serve({ fetch: app.fetch, port: configuration2.PORT }, (info) => {
-    console.log(`Agent server listening on http://localhost:${String(info.port)} (docs at /api/v1/docs)`);
+  const server = serve({ fetch: app.fetch, port: configuration2.PORT, hostname: configuration2.HOST }, (info) => {
+    logger.info(`Agent server listening on http://${configuration2.HOST}:${String(info.port)} (docs at /api/v1/docs)`);
   });
   server.on("error", (error) => {
     console.error("Failed to start server:", error instanceof Error ? error.message : error);
@@ -9797,7 +10142,9 @@ try {
   if (configuration2.NODE_ENV !== "development") {
     let shuttingDown = false;
     const shutdown = async (signal) => {
-      if (shuttingDown) return;
+      if (shuttingDown) {
+        return;
+      }
       shuttingDown = true;
       logger.info(`Received ${signal}, draining connections before shutdown`);
       setTimeout(() => {
@@ -9809,14 +10156,14 @@ try {
           resolve();
         });
       });
-      await activeTurns.shutdownAndWait(CancellationReason6.Abandoned);
+      await activeTurns.shutdownAndWait(CancellationReason4.Abandoned);
       await closed;
       await requestReplyExecutor?.drain();
       await requestReplySubscriber?.close().catch((error) => {
-        logger.warn("[Redis] Error closing subscriber client during shutdown", extractErrorLogFields8(error));
+        logger.warn("[Redis] Error closing subscriber client during shutdown", extractErrorLogFields9(error));
       });
       await redis?.close().catch((error) => {
-        logger.warn("[Redis] Error closing client during shutdown", extractErrorLogFields8(error));
+        logger.warn("[Redis] Error closing client during shutdown", extractErrorLogFields9(error));
       });
       await destroyDb();
       process.exit(0);