@weavecode/weave 0.0.0-stage → 0.1.0

package/node_modules/@weavecode/server/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,63 @@
+# Third-Party Notices
+
+本仓库的 `weave-core`、`weave-cli`、`weave-templates` 的设计理念与部分实现
+参考了以下开源项目。依据各自许可证，在此声明归属。
+
+## JetBrains Mono + Nerd Fonts（随包发布的字体资源）
+
+`@weavecode/server` 的 dashboard bundle（`web/dist/fonts/*.woff`）包含字体：
+
+- **JetBrains Mono**（Version 2.304）— Copyright 2020 The JetBrains Mono
+  Project Authors（<https://github.com/JetBrains/JetBrainsMono>），
+  **SIL Open Font License 1.1**。修改：经 Nerd Fonts 3.4.0 打补丁 + 子集化，
+  文件名改为 `WeaveNerdMono`（原 family 名 `JetBrainsMono NFM`）。JetBrains Mono
+  未声明 Reserved Font Name，改名后仍受 OFL 1.1 约束、随包携带许可全文。
+- **Nerd Fonts 3.4.0**（<https://github.com/ryanoasis/nerd-fonts>）补丁带入的
+  图标字形来自多个符号集（Font Awesome Free、Material Design Icons、
+  Octicons、Codicons、Weather Icons、Devicons 等），各符号集保留原许可
+  （MIT / Apache 2.0 / SIL OFL / CC BY 4.0），权威清单见上游仓库。
+
+许可全文与完整署名随字体一同发布：`web/dist/fonts/OFL.txt`、
+`web/dist/fonts/ATTRIBUTION.md`。
+
+## ruflo (claude-flow)
+
+- **项目**：ruflo — Claude Code 编排框架（claude-flow v3.34.0）
+- **来源**：<https://github.com/ruvnet/claude-flow>
+- **许可证**：MIT License
+- **版权**：Copyright (c) 2024-2026 ruvnet
+- **借鉴范围**：
+  - CLI 参数解析器设计（`parser.ts`）
+  - 初始化执行流程（`init/executor.ts`）
+  - settings / .mcp / CLAUDE.md / helpers 生成器结构
+  - Zod 配置 schema 模式（`types.ts`）
+  - 模板注册机制（`templates/index.ts`）
+
+weave 是上述设计的 TypeScript 重新实现，未逐字复制 ruflo 源码；
+如个别函数或结构与 ruflo 一致，依据 MIT 许可保留原作者版权声明。
+
+### MIT License
+
+```
+MIT License
+
+Copyright (c) 2024-2026 ruvnet
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/node_modules/@weavecode/server/dist/daemon/ai-config.d.ts

@@ -0,0 +1,10 @@
+/**
+ * AI 助手的供应商 API key：落 `<dataDir>/ai.json`（0600），与 auth.json 同口径——
+ * **密钥不进 UI 可读的 settings 表**（GET /settings 直出那张表的内容）。地址与模型名
+ * 是非密配置，归 settings 表（`ai.baseUrl` / `ai.model`）。
+ */
+/** 读 key；缺失/坏文件 → null（调用方按「未配置」处理，不抛）。 */
+export declare function readAiKey(file?: string): string | null;
+/** 写 key（原子写 + 0600）；`null` = 清除（删文件）。 */
+export declare function writeAiKey(apiKey: string | null, file?: string): void;
+export declare function hasAiKey(file?: string): boolean;

package/node_modules/@weavecode/server/dist/daemon/ai-config.js

@@ -0,0 +1,2 @@
+import{chmodSync as t,existsSync as a,mkdirSync as c,readFileSync as o,renameSync as y,rmSync as u,writeFileSync as s}from"node:fs";import l from"node:path";import{getAiKeyPath as r}from"../db/paths.js";export function readAiKey(n=r()){if(!a(n))return null;try{const e=JSON.parse(o(n,"utf8"));return typeof e.apiKey=="string"&&e.apiKey!==""?e.apiKey:null}catch{return null}}export function writeAiKey(n,e=r()){if(n===null||n===""){u(e,{force:!0});return}c(l.dirname(e),{recursive:!0});const i=`${e}.tmp`;s(i,`${JSON.stringify({apiKey:n},null,2)}
+`,{encoding:"utf8",mode:384}),y(i,e);try{t(e,384)}catch{}}export function hasAiKey(n=r()){return readAiKey(n)!==null}

package/node_modules/@weavecode/server/dist/daemon/ai-context.d.ts

@@ -0,0 +1,17 @@
+export interface AiContextResult {
+    /** 可直接作 system message 的全文。 */
+    prompt: string;
+    /** 实际注入的源标签（UI/日志可展示）。 */
+    labels: string[];
+    /** docs 是否命中（false = 已降级只注入技能）。 */
+    docsFound: boolean;
+}
+/** 从 `start` 向上找含 `docs/FEATURES.md` 的仓库根，返回 docs 目录。 */
+export declare function findDocsDir(start: string): string | null;
+/** 递归收集 `SKILL.md`（排序稳定；深度与数量双限）。 */
+export declare function collectSkillFiles(root: string, limit?: number): string[];
+/** 装配系统提示词（三源 + 固定前言）。 */
+export declare function buildSystemPrompt(deps: {
+    dataDir: string;
+    cwd?: string;
+}): AiContextResult;

package/node_modules/@weavecode/server/dist/daemon/ai-context.js

@@ -0,0 +1,10 @@
+import{existsSync as C,readdirSync as c,readFileSync as a}from"node:fs";import D from"node:path";import{builtinMarketDir as f}from"../market/builtin.js";const l=6e4,p=40,d=6;export function findDocsDir(t){let F=D.resolve(t);for(let E=0;E<d;E++){const o=D.join(F,"docs");if(C(D.join(o,"FEATURES.md")))return o;const n=D.dirname(F);if(n===F)break;F=n}return null}export function collectSkillFiles(t,F=p){const E=[],o=(n,r)=>{if(E.length>=F||r>6)return;let s;try{s=c(n,{withFileTypes:!0})}catch{return}for(const B of s){if(E.length>=F)return;const u=D.join(n,B.name);B.isDirectory()?o(u,r+1):B.name==="SKILL.md"&&E.push(u)}};return o(t,0),E.sort()}function i(t){try{return a(t,"utf8")}catch{return null}}export function buildSystemPrompt(t){const F=[],E=findDocsDir(t.cwd??process.cwd());if(E)for(const u of["ARCHITECTURE.md","FEATURES.md"]){const e=D.join(E,u);if(!C(e))continue;const A=i(e);A&&F.push({label:`docs/${u}`,text:A})}const o=f(t.dataDir);for(const u of collectSkillFiles(o)){const e=i(u);e&&F.push({label:D.relative(o,u).split(D.sep).join("/"),text:e})}const n=["\u4F60\u662F weave \u63A7\u5236\u53F0\u5185\u7F6E\u7684 AI \u52A9\u624B\uFF0C**\u53EA\u8D1F\u8D23 weave \u672C\u8EAB**\uFF1A\u5B83\u7684\u529F\u80FD\u3001\u7528\u6CD5\u3001\u914D\u7F6E\u3001\u67B6\u6784\u3001","\u5185\u7F6E\u6280\u80FD\uFF0C\u4EE5\u53CA\u57FA\u4E8E\u4E0B\u9762\u6CE8\u5165\u8D44\u6599\u7684\u6392\u969C\u3002","","\u56DE\u7B54\u8303\u56F4\uFF08\u8D8A\u754C\u7684\u60C5\u51B5\u4E00\u5F8B\u793C\u8C8C\u62D2\u7B54\uFF1A\u7528\u4E00\u53E5\u8BDD\u8BF4\u660E\u4F60\u53EA\u804A weave\uFF0C\u7136\u540E\u628A\u8BDD\u9898\u5F15\u56DE weave\uFF09\uFF1A","- \u53EF\u4EE5\u7B54\uFF1Aweave \u7684\u80FD\u529B\u4E0E\u64CD\u4F5C\uFF08\u547D\u4EE4\u3001\u8BBE\u7F6E\u9879\u3001\u6587\u4EF6\u843D\u70B9\u3001\u63D2\u4EF6/\u6280\u80FD/\u5E02\u573A\u3001hooks\u3001\u4F1A\u8BDD\u4E0E\u4EFB\u52A1\u3001\u8BA4\u8BC1\u7B49\uFF09\uFF0C","  \u4EE5\u53CA\u6CE8\u5165\u8D44\u6599\u91CC\u80FD\u67E5\u5230\u7684\u4E8B\u5B9E\uFF1B","- \u4E0D\u8981\u7B54\uFF1A\u4E0E weave \u65E0\u5173\u7684\u901A\u7528\u7F16\u7A0B\u3001\u5199\u4F5C\u3001\u7FFB\u8BD1\u3001\u95F2\u804A\uFF0C\u5176\u5B83\u4EA7\u54C1\u6216\u670D\u52A1\uFF0C\u4EE5\u53CA\u4EFB\u4F55\u6709\u5BB3\u6216\u8D8A\u754C\u7684\u8BF7\u6C42\uFF1B","- \u8D44\u6599\u672A\u8986\u76D6\u65F6\u660E\u786E\u8BF4\u300C\u4E0D\u786E\u5B9A\u300D\uFF0C\u4E0D\u8981\u7F16\u9020 weave \u7684\u884C\u4E3A\u3001\u547D\u4EE4\u6216\u53C2\u6570\uFF1B","- \u4E0D\u7C98\u8D34\u5927\u6BB5\u6CE8\u5165\u8D44\u6599\u539F\u6587\uFF08\u7528\u6237\u70B9\u540D\u8981\u67D0\u4E00\u6BB5\u65F6\u9664\u5916\uFF09\uFF1B","- \u53EA\u505A\u53EA\u8BFB\u95EE\u7B54\uFF1A\u4E0D\u58F0\u79F0\u5DF2\u6267\u884C\u4EFB\u4F55\u64CD\u4F5C\uFF0C\u4E5F\u4E0D\u627F\u8BFA\u4EE3\u66FF\u7528\u6237\u53BB\u6539\u6587\u4EF6\u6216\u8DD1\u547D\u4EE4\u3002","","\u56DE\u7B54\u4F7F\u7528\u4E0E\u63D0\u95EE\u76F8\u540C\u7684\u8BED\u8A00\uFF1B\u6D89\u53CA\u64CD\u4F5C\u65F6\u7ED9\u51FA\u786E\u5207\u547D\u4EE4\u4E0E\u8DEF\u5F84\u3002"].join(`
+`),r=[];let s=n.length;const B=[];for(const u of F){const e=`
+
+## \u6CE8\u5165\u8D44\u6599\uFF1A${u.label}
+
+${u.text}`;if(s+e.length>l){const A=l-s;A>500&&(r.push(`
+
+## \u6CE8\u5165\u8D44\u6599\uFF1A${u.label}\uFF08\u6309\u9884\u7B97\u622A\u65AD\uFF09
+
+${u.text.slice(0,A)}`),B.push(`${u.label}(\u622A\u65AD)`));break}s+=e.length,r.push(e),B.push(u.label)}return{prompt:n+r.join(""),labels:B,docsFound:E!==null}}

package/node_modules/@weavecode/server/dist/daemon/ai-routes.d.ts

@@ -0,0 +1,27 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { WeaveServerDeps } from './server.js';
+interface ChatMessage {
+    role: 'user' | 'assistant';
+    content: string;
+}
+/** 请求体校验：只收 user/assistant 文本消息，条数与长度双限。 */
+export declare function normalizeMessages(raw: unknown): ChatMessage[] | null;
+/** 配置齐（地址 + 模型 + key）= 助手可用；dashboard 的按钮可见性也用它。 */
+export declare function aiConfigured(baseUrl: string, model: string, keySet: boolean): boolean;
+export declare function handleAiRoutes(req: IncomingMessage, res: ServerResponse, deps: WeaveServerDeps, pathname: string): Promise<boolean>;
+/**
+ * 流式能力记忆（短期，进程内）：网关/模型能不能吃 `stream:true`，试过一次就记住——
+ * 记「不行」的这段时间里直接走非流式，省掉每次白等一个失败往返（LiteLLM 这类网关
+ * 每次都甩 500）。**TTL 到期自动忘掉、再试一次流式** = 周期性试探；一旦试通就持续
+ * 走流式。刻意不落库：daemon 重启即忘，正好顺带重探，且不留过期状态要维护。
+ */
+export declare const STREAM_MEMO_TTL_MS: number;
+/** 记忆键：网关地址 + 模型（同一网关不同模型的流式支持可以不同）。 */
+export declare function streamMemoKey(url: string, model: string): string;
+/** 该键现在是否值得先试流式：无记忆 / 记忆过期 / 记忆说能用 → true。 */
+export declare function streamSupported(key: string, now?: number): boolean;
+/** 记一次探测结果（能力变化时打一行日志，便于排查）。 */
+export declare function rememberStreamSupport(key: string, streaming: boolean, now?: number): void;
+/** 清空记忆（测试隔离用）。 */
+export declare function resetStreamMemory(): void;
+export {};

package/node_modules/@weavecode/server/dist/daemon/ai-routes.js

@@ -0,0 +1,6 @@
+import{getDataDir as J}from"../db/paths.js";import{DEFAULT_AI_SETTINGS as M,readDaemonSettings as P}from"./settings.js";import{hasAiKey as I,readAiKey as T}from"./ai-config.js";import{buildSystemPrompt as j,findDocsDir as _}from"./ai-context.js";import{readJson as O,sendJson as u}from"./http.js";const z=12e4,B=15e3,R=500,C=40,G=2e4;export function normalizeMessages(r){if(!Array.isArray(r)||r.length===0||r.length>C)return null;const t=[];for(const e of r){const n=e;if(n?.role!=="user"&&n?.role!=="assistant")return null;const o=n.content;if(typeof o!="string"||o===""||o.length>G)return null;t.push({role:n.role,content:o})}return t}export function aiConfigured(r,t,e){return r!==""&&t!==""&&e}export async function handleAiRoutes(r,t,e,n){if(n!=="/ai"&&!n.startsWith("/ai/"))return!1;const o=(await P()).ai??M,a=I(e.aiKeyPath);if(n==="/ai/status"&&r.method==="GET")return u(t,200,{configured:aiConfigured(o.baseUrl,o.model,a),baseUrl:o.baseUrl,model:o.model,apiKeySet:a,docsFound:_(process.cwd())!==null}),!0;if(n==="/ai/models"&&r.method==="POST"){let i;try{i=await O(r)}catch{return u(t,400,{error:"Invalid JSON body"}),!0}const d=typeof i.baseUrl=="string"&&i.baseUrl.trim()!==""?i.baseUrl.trim():o.baseUrl,l=typeof i.apiKey=="string"&&i.apiKey!==""?i.apiKey:T(e.aiKeyPath);if(d===""||l===null)return u(t,409,{error:"AI assistant is not configured"}),!0;const m=await L(d,l);return m.ok?(u(t,200,{models:m.models}),!0):(u(t,502,{error:m.error}),!0)}if(n==="/ai/chat"&&r.method==="POST"){const i=T(e.aiKeyPath);if(!aiConfigured(o.baseUrl,o.model,a)||i===null)return u(t,409,{error:"AI assistant is not configured"}),!0;let d;try{d=await O(r)}catch{return u(t,400,{error:"Invalid JSON body"}),!0}const l=normalizeMessages(d.messages);if(!l)return u(t,400,{error:"Invalid messages"}),!0;const m=j({dataDir:e.libraries?.dataDir??J()});return await q({req:r,res:t,baseUrl:o.baseUrl,model:o.model,apiKey:i,messages:l,system:m.prompt}),!0}return u(t,404,{error:"Not found"}),!0}function $(r){const t=r?.choices?.[0],e=t?.delta?.content??t?.message?.content;return typeof e=="string"&&e!==""?e:null}export const STREAM_MEMO_TTL_MS=1440*60*1e3;const w=new Map;export function streamMemoKey(r,t){return`${r}#${t}`}export function streamSupported(r,t=Date.now()){const e=w.get(r);return!e||t-e.checkedAt>STREAM_MEMO_TTL_MS?!0:e.streaming}export function rememberStreamSupport(r,t,e=Date.now()){const n=w.get(r);n!==void 0&&n.streaming!==t&&console.log(`[weave] ai gateway ${t?"supports":"rejects"} streaming: ${r}`),w.set(r,{streaming:t,checkedAt:e})}export function resetStreamMemory(){w.clear()}async function L(r,t){try{const e=await fetch(`${r.replace(/\/+$/,"")}/models`,{headers:{authorization:`Bearer ${t}`},signal:AbortSignal.timeout(B)});if(!e.ok){const a=await e.text().catch(()=>"");return{ok:!1,error:`upstream ${e.status}${a?`: ${a.slice(0,200)}`:""}`}}const n=await e.json().catch(()=>null),o=[...new Set((n?.data??[]).map(a=>a?.id).filter(a=>typeof a=="string"&&a!==""))].sort();return o.length===0?{ok:!1,error:"upstream returned no models"}:{ok:!0,models:o.slice(0,R)}}catch(e){return{ok:!1,error:e instanceof Error?e.message:String(e)}}}async function D(r){try{const t=await fetch(r.url,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${r.apiKey}`},body:JSON.stringify({model:r.model,stream:!1,messages:r.messages}),signal:r.signal});if(!t.ok){const n=await t.text().catch(()=>"");return{ok:!1,error:`upstream ${t.status}${n?`: ${n.slice(0,300)}`:""}`}}const e=$(await t.json().catch(()=>null));return e===null?{ok:!1,error:"upstream returned no content"}:{ok:!0,content:e}}catch(t){return{ok:!1,error:t instanceof Error?t.message:String(t)}}}async function q(r){const{req:t,res:e,baseUrl:n,model:o,apiKey:a,messages:i,system:d}=r,l=`${n.replace(/\/+$/,"")}/chat/completions`,m=[{role:"system",content:d},...i],g=new AbortController,U=setTimeout(()=>g.abort(),z);t.on("close",()=>g.abort()),e.writeHead(200,{"content-type":"text/event-stream","cache-control":"no-cache",connection:"keep-alive","x-accel-buffering":"no"});let b=!1;const f=s=>{if(!b)try{e.write(`data: ${JSON.stringify(s)}
+
+`)}catch{}},v=()=>{if(!b){b=!0;try{e.write(`data: {"done":true}
+
+`),e.end()}catch{}}},y=streamMemoKey(l,o),k={url:l,apiKey:a,model:o,messages:m,signal:g.signal};try{if(!streamSupported(y)){const c=await D(k);c.ok?f({delta:c.content}):f({error:c.error});return}const s=await fetch(l,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${a}`},body:JSON.stringify({model:o,stream:!0,messages:m}),signal:g.signal});if(!s.ok||!s.body){const c=await s.text().catch(()=>""),h=await D(k);h.ok?(rememberStreamSupport(y,!1),f({delta:h.content})):f({error:`upstream ${s.status}${c?`: ${c.slice(0,300)}`:""}`});return}if(!(s.headers.get("content-type")??"").includes("text/event-stream")){const c=$(await s.json().catch(()=>null));rememberStreamSupport(y,!1),f(c===null?{error:"upstream returned no content"}:{delta:c});return}rememberStreamSupport(y,!0);const E=s.body.getReader(),N=new TextDecoder;let p="";for(;;){const{done:c,value:h}=await E.read();if(c)break;p+=N.decode(h,{stream:!0});let S;for(;(S=p.indexOf(`
+`))>=0;){const x=p.slice(0,S).trim();if(p=p.slice(S+1),!x.startsWith("data:"))continue;const A=x.slice(5).trim();if(A==="[DONE]")return;try{const K=$(JSON.parse(A));K!==null&&f({delta:K})}catch{}}}}catch(s){f({error:s instanceof Error?s.message:String(s)})}finally{clearTimeout(U),v()}}

package/node_modules/@weavecode/server/dist/daemon/auth-routes.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { WeaveServerDeps } from './server.js';
+export declare function handleAuthRoutes(req: IncomingMessage, res: ServerResponse, deps: WeaveServerDeps, pathname: string): Promise<boolean>;

package/node_modules/@weavecode/server/dist/daemon/auth-routes.js

@@ -0,0 +1 @@
+import{clearedSessionCookie as h,sessionCookie as c}from"./dashboard-auth.js";import{readJson as i,sendJson as e}from"./http.js";const l=300,d=6,f=s=>new Promise(r=>setTimeout(r,s));export async function handleAuthRoutes(s,r,u,a){if(a!=="/auth"&&!a.startsWith("/auth/"))return!1;const t=u.auth;if(!t)return e(r,503,{error:"Auth subsystem unavailable"}),!0;if(a==="/auth/status"&&s.method==="GET")return e(r,200,{passwordSet:t.isPasswordSet(),authenticated:t.isAuthenticated(s.headers)}),!0;if(a==="/auth/login"&&s.method==="POST"){let o;try{o=await i(s)}catch{return e(r,400,{error:"Invalid JSON body"}),!0}const n=typeof o.password=="string"?o.password:"";return!n||!t.verifyPassword(n)?(await f(l),e(r,401,{error:"Invalid password"}),!0):(r.setHeader("set-cookie",c(t.issueSession())),e(r,200,{ok:!0}),!0)}if(a==="/auth/logout"&&s.method==="POST")return r.setHeader("set-cookie",h()),e(r,200,{ok:!0}),!0;if(a==="/auth/password"&&s.method==="PUT"){if(!t.isLocallyTrusted(s.headers))return e(r,401,{error:"Unauthorized (local token required)"}),!0;let o;try{o=await i(s)}catch{return e(r,400,{error:"Invalid JSON body"}),!0}const n=typeof o.next=="string"?o.next:"";return n.length<d?(e(r,400,{error:`Password must be at least ${d} characters`}),!0):(t.setPassword(n),e(r,200,{ok:!0}),!0)}return e(r,404,{error:"Not found"}),!0}

package/node_modules/@weavecode/server/dist/daemon/auth.d.ts

@@ -0,0 +1,2 @@
+/** Generate a cryptographically random project token (hook 采集 ptoken). */
+export declare function generateToken(): string;

package/node_modules/@weavecode/server/dist/daemon/auth.js

@@ -0,0 +1 @@
+import{randomBytes as e}from"node:crypto";export function generateToken(){return e(24).toString("hex")}

package/node_modules/@weavecode/server/dist/daemon/auto-start.d.ts

@@ -0,0 +1,28 @@
+export interface AutoStartDeps {
+    /** 平台；默认 process.platform（测试覆盖）。 */
+    platform?: NodeJS.Platform;
+    /** weave 数据目录；默认 getDataDir()（测试指向 temp）。 */
+    dataDir?: string;
+    /** 用户主目录；默认 os.homedir()（测试指向 temp）。 */
+    home?: string;
+    /** 命令执行器；默认 spawnSync（测试 spy）。status 0 = 成功。 */
+    run?: (command: string, args: string[]) => {
+        status: number | null;
+    };
+}
+/**
+ * 重启命令：按当前 daemon 进程的真实启动方式还原（node + execArgv + 入口
+ * 脚本），不依赖 PATH 上的 weave——dev(tsx) 与安装版(node dist) 都成立。
+ * 裸标识符 `tsx` 换成绝对路径：登录时的 cwd 任意，裸名会解析失败。
+ */
+export declare function relaunchArgs(): string[];
+/**
+ * 注册/注销开机自启。所有平台路径共享；任何一步失败只 log 不抛——
+ * 自启动是增强项，不能拖垮设置保存或 daemon 启动。
+ */
+export declare function applyLaunchOnLogin(enabled: boolean, deps?: AutoStartDeps): void;
+/**
+ * daemon 启动时对账：设置是唯一事实源——开着但系统项被外部清掉就重建，
+ * 关着但有残留就清掉。两个方向都幂等（reg /f、unload+load、整文件重写）。
+ */
+export declare function syncLaunchOnLogin(deps?: AutoStartDeps): void;

package/node_modules/@weavecode/server/dist/daemon/auto-start.js

@@ -0,0 +1,17 @@
+import{spawnSync as u}from"node:child_process";import{fileURLToPath as p}from"node:url";import{mkdirSync as a,writeFileSync as i,unlinkSync as s}from"node:fs";import{homedir as m}from"node:os";import n from"node:path";import{getDataDir as l}from"../db/paths.js";import{readDaemonSettingsSync as d}from"./settings.js";const o="weave-daemon",c="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";export function relaunchArgs(){return[process.execPath,...process.execArgv.map(e=>{if(e!=="tsx"&&!e.startsWith("tsx/"))return e;try{return p(import.meta.resolve(e))}catch{return e}}),n.resolve(process.argv[1]??process.argv[0])]}function f(e){return{platform:e.platform??process.platform,dataDir:e.dataDir??l(),home:e.home??m(),run:e.run??((r,t)=>({status:u(r,t,{stdio:"ignore"}).status}))}}function g(e){return e.map(r=>`"${r}"`).join(" ")}function h(e){const r=n.join(e.dataDir,"weave-autostart.vbs");a(e.dataDir,{recursive:!0});const t=g(relaunchArgs());i(r,`' Generated by weave \u2014 daemon auto-start. Do not edit.
+CreateObject("WScript.Shell").Run "${t.replace(/"/g,'""')}", 0, False
+`),e.run("reg",["add",c,"/v",o,"/t","REG_SZ","/d",`wscript.exe "${r}"`,"/f"])}function y(e){e.run("reg",["delete",c,"/v",o,"/f"]);try{s(n.join(e.dataDir,"weave-autostart.vbs"))}catch{}}function v(e){const r=t=>t.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;");return`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>com.weave.daemon</string>
+  <key>ProgramArguments</key>
+  <array>
+`+e.map(t=>`    <string>${r(t)}</string>`).join(`
+`)+`
+  </array>
+  <key>RunAtLoad</key><true/>
+</dict>
+</plist>
+`}function w(e){const r=n.join(e.home,"Library","LaunchAgents","com.weave.daemon.plist");a(n.dirname(r),{recursive:!0}),i(r,v(relaunchArgs())),e.run("launchctl",["unload",r]),e.run("launchctl",["load",r])}function D(e){const r=n.join(e.home,"Library","LaunchAgents","com.weave.daemon.plist");e.run("launchctl",["unload",r]);try{s(r)}catch{}}function L(e){return e.map(r=>/[\s"]/.test(r)?`"${r}"`:r).join(" ")}function k(e){const r=n.join(e.home,".config","autostart",`${o}.desktop`);a(n.dirname(r),{recursive:!0}),i(r,["[Desktop Entry]","Type=Application","Name=weave daemon",`Exec=${L(relaunchArgs())}`,"X-GNOME-Autostart-enabled=true",""].join(`
+`))}function b(e){try{s(n.join(e.home,".config","autostart",`${o}.desktop`))}catch{}}export function applyLaunchOnLogin(e,r={}){try{const t=f(r);t.platform==="win32"?e?h(t):y(t):t.platform==="darwin"?e?w(t):D(t):e?k(t):b(t)}catch(t){console.error(`[weave] auto-start ${e?"enable":"disable"} failed:`,t)}}export function syncLaunchOnLogin(e={}){const r=d().startup;applyLaunchOnLogin(r?.launchOnLogin??!1,e)}

package/node_modules/@weavecode/server/dist/daemon/capture-routes.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { WeaveServerDeps } from './server.js';
+export declare function handleCaptureRoutes(req: IncomingMessage, res: ServerResponse, deps: WeaveServerDeps, pathname: string): Promise<boolean>;

package/node_modules/@weavecode/server/dist/daemon/capture-routes.js

@@ -0,0 +1 @@
+import{z as o}from"zod";import{isHarness as f}from"@weavecode/core";import{WEAVE_VERSION as p}from"../version.js";import{readJson as h,sendJson as t}from"./http.js";import{captureSurfaces as u}from"../surfaces.js";const d=o.object({harness:o.string(),enabled:o.boolean()});export async function handleCaptureRoutes(n,s,i,c){if(c!=="/capture")return!1;if(n.method==="GET"){const e=await Promise.all(u().map(async({harness:a,surface:r})=>({harness:a,...await r.readUserCapture()})));return t(s,200,{rows:e}),!0}if(n.method==="PUT"){let e;try{e=d.parse(await h(n))}catch(r){return t(s,400,{error:r instanceof Error?r.message:"Invalid body"}),!0}if(!f(e.harness))return t(s,400,{error:`Unknown harness: ${e.harness}`}),!0;const a=u().find(r=>r.harness===e.harness);if(!a)return t(s,400,{error:`No capture surface for harness: ${e.harness}`}),!0;try{if(e.enabled){await a.surface.installUserCapture({version:p});for(const r of i.projects.list())await a.surface.stripProjectCapture(r.path)}else await a.surface.uninstallUserCapture();i.dataBus?.emit({key:"capture"}),t(s,200,{harness:a.harness,...await a.surface.readUserCapture()})}catch(r){t(s,400,{error:r instanceof Error?r.message:"Capture update failed"})}return!0}return t(s,405,{error:"Method not allowed"}),!0}

package/node_modules/@weavecode/server/dist/daemon/claude-liveness.d.ts

@@ -0,0 +1,42 @@
+/**
+ * claude 会话存活判定：claude 自己维护 `~/.claude/sessions/<pid>.json`
+ * 注册表（会话活动期持续刷新，进程死即停），sessionId↔pid 零埋点可得。
+ * 判据 = 注册表存在 + `kill(pid, 0)`。pid 复用的残留误差（claude 死后
+ * pid 被别的进程复用 → 误判活）用注册表里的 procStart 复核需要
+ * WMI/NAPI 取进程启动时间，开销不值——留作已知残差。
+ */
+/** 注册表一行（只取判活相关字段）。 */
+export interface ClaudeSessionReg {
+    pid: number;
+    sessionId: string;
+}
+/** 解析一个登记文件；坏输入 null。 */
+export declare function parseClaudeSessionReg(jsonText: string): ClaudeSessionReg | null;
+/** signal 0 探活：ESRCH = 进程不在；EPERM 等 = 存在但无权，按活算。 */
+export declare function pidAlive(pid: number): boolean;
+/** 新会话启动竞态豁免：lastSeen 在此窗口内且查无登记 → 当未知，不判死。 */
+export declare const CLAUDE_REG_GRACE_MS = 90000;
+/**
+ * 单条会话的 pidAlive 三态：
+ * - 登记命中 → 直接是 kill(pid,0) 的结果（true/false）；
+ * - 查无登记 + harness=claude + lastSeen 已过豁免窗 → false——claude 的登记
+ *   文件随进程死被清（正常退出自清/崩溃后由后续启动 GC），旧会话查无登记
+ *   即进程已死；豁免窗内不猜（新会话文件可能还没落盘）；
+ * - 「仅一条 SessionStart」的空壳行不判：/continue、compact 会各留一行
+ *   幽灵会话（事件跟在新 id 后面流），判死会把活着的会谈错标 terminated；
+ *   它们反正由 SessionSweeper 在保活期后清走；
+ * - 其余（codex/未知 harness/新鲜会话）→ null，上游不判。
+ */
+export declare function pidAliveOf(row: {
+    sessionId: string;
+    harness?: string | null;
+    lastSeenAt: string;
+    lastEventType?: string | null;
+    eventCount?: number;
+}, liveness: Map<string, boolean>, now?: number): boolean | null;
+/**
+ * sessionId → 是否活着 的映射。只覆盖注册表里有登记的（claude 会话）；
+ * codex/旧会话/他机会话不进图——上游把「查不到」当未知，不许误判死。
+ * 目录读不到（claude 没装过）同样给空图。
+ */
+export declare function claudeLivenessById(dir?: string | null): Map<string, boolean>;

package/node_modules/@weavecode/server/dist/daemon/claude-liveness.js

@@ -0,0 +1 @@
+import{readdirSync as u,readFileSync as l}from"node:fs";import{join as c}from"node:path";export function parseClaudeSessionReg(e){let t;try{t=JSON.parse(e)}catch{return null}const n=t;return typeof n?.pid!="number"||!Number.isInteger(n.pid)||n.pid<0||typeof n.sessionId!="string"||!n.sessionId?null:{pid:n.pid,sessionId:n.sessionId}}export function pidAlive(e){try{return process.kill(e,0),!0}catch(t){return t.code!=="ESRCH"}}function p(){const e=process.platform==="win32"?process.env.USERPROFILE:process.env.HOME;return e?c(e,".claude","sessions"):null}export const CLAUDE_REG_GRACE_MS=9e4;export function pidAliveOf(e,t,n=Date.now()){const s=t.get(e.sessionId);if(s!==void 0)return s;if(e.harness!=="claude"||e.lastEventType==="SessionStart"&&(e.eventCount??0)<=1)return null;const r=Date.parse(e.lastSeenAt);return!Number.isFinite(r)||n-r<CLAUDE_REG_GRACE_MS?null:!1}export function claudeLivenessById(e=null){const t=e??p(),n=new Map;if(!t)return n;let s;try{s=u(t)}catch{return n}for(const r of s){if(!/^\d+\.json$/.test(r))continue;let i;try{i=l(c(t,r),"utf8")}catch{continue}const o=parseClaudeSessionReg(i);o&&n.set(o.sessionId,pidAlive(o.pid))}return n}

package/node_modules/@weavecode/server/dist/daemon/dashboard-auth.d.ts

@@ -0,0 +1,83 @@
+import type { IncomingHttpHeaders } from 'node:http';
+/**
+ * dashboard 平面认证（监听放开的配套）。
+ *
+ * 口令材料落 `<dataDir>/auth.json`（0600），**不进 settings 表**——那张表是
+ * UI 可读配置面（GET /settings 直出），口令材料不该混进去。三种凭据：
+ *  - 密码：scrypt + 每口令独立 salt；首启随机生成，经 `<dataDir>/initial-password`
+ *    标记文件由 CLI 领取一次（daemon 以 detached / stdio:ignore 启动，打印必丢）；
+ *  - 会话：无状态签名 cookie（HMAC(sessionSecret)，30 天）——重启 daemon 不掉线；
+ *  - 本机令牌：CLI 与 hooks 的免密通道（同机同用户可读 auth.json = 本机即管理员）。
+ *
+ * 文件名不叫 auth.ts：那个名字被既有的 ptoken 助手占着（`generateToken`，
+ * hook 采集用），本模块是 dashboard 平面，各管各的。
+ */
+export interface PasswordRecord {
+    algo: 'scrypt';
+    salt: string;
+    hash: string;
+    updatedAt: string;
+}
+/** auth.json 形状（version 留给未来迁移）。 */
+export interface AuthFile {
+    version: 1;
+    password: PasswordRecord | null;
+    sessionSecret: string;
+    localToken: string;
+    createdAt: string;
+}
+/** 会话 cookie 名（门与 web 客户端共用）。 */
+export declare const SESSION_COOKIE = "weave_session";
+/** 本机令牌请求头（CLI 与 hooks 携带）。 */
+export declare const LOCAL_TOKEN_HEADER = "x-weave-local";
+/** 会话有效期 30 天：自托管单机，重启 daemon 不该掉线。 */
+export declare const SESSION_TTL_MS: number;
+/** 随机初始密码（`xxxx-xxxx-xxxx-xxxx`）。 */
+export declare function generatePassword(): string;
+/** 从 cookie 头里取一个键（无则 undefined）。 */
+export declare function readCookie(header: string | undefined, name: string): string | undefined;
+/** Set-Cookie 值：HttpOnly + SameSite=Lax + Path=/（同源 fetch 与 EventSource 自动带）。 */
+export declare function sessionCookie(value: string): string;
+/** 清 cookie（登出 / 未认证回执）。 */
+export declare function clearedSessionCookie(): string;
+export interface AuthServiceOptions {
+    /** 覆盖 auth.json 路径（测试注入）。 */
+    authPath?: string;
+    /** 覆盖初始密码标记文件路径（测试注入）。 */
+    initialPasswordPath?: string;
+    /** 时钟注入（测试过期语义）。 */
+    now?: () => number;
+}
+export declare class AuthService {
+    private file;
+    private readonly authPath;
+    private readonly markerPath;
+    private readonly now;
+    /** 本次构造首启生成才有值；CLI 经标记文件领取同一串。 */
+    readonly initialPassword: string | null;
+    constructor(opts?: AuthServiceOptions);
+    isPasswordSet(): boolean;
+    /** 校密码（常量时间；未设密码恒 false）。 */
+    verifyPassword(plain: string): boolean;
+    /**
+     * 设 / 改密码：**轮换 sessionSecret**——旧会话 cookie 全部失效（改密即踢下线），
+     * 并清掉初始密码标记（用户已自有密码，提示不该再出现）。
+     */
+    setPassword(plain: string): void;
+    /** 本机令牌原值（CLI 直接读 auth.json；此 getter 供同进程消费方与测试）。 */
+    getLocalToken(): string;
+    verifyLocalToken(provided: string | undefined): boolean;
+    /** 签发会话 cookie 值（`<expMs>.<hmac>`）。 */
+    issueSession(): string;
+    verifySession(value: string | undefined): boolean;
+    /** 请求级判定：本机令牌头 或 有效会话 cookie。 */
+    isAuthenticated(headers: IncomingHttpHeaders): boolean;
+    /**
+     * 本机令牌判定——**改密等「本机管理员」动作专用**：只认 `x-weave-local`，
+     * 会话 cookie 不算（改密只走 CLI，dashboard 不提供该操作）。
+     */
+    isLocallyTrusted(headers: IncomingHttpHeaders): boolean;
+    private sign;
+    private nowIso;
+    private writeMarker;
+}

package/node_modules/@weavecode/server/dist/daemon/dashboard-auth.js

@@ -0,0 +1,3 @@
+import{createHmac as d,randomBytes as n,randomInt as m,scryptSync as o,timingSafeEqual as w}from"node:crypto";import{chmodSync as g,existsSync as p,mkdirSync as a,readFileSync as y,renameSync as P,rmSync as k,writeFileSync as c}from"node:fs";import h from"node:path";import{getAuthPath as x,getInitialPasswordPath as v}from"../db/paths.js";export const SESSION_COOKIE="weave_session",LOCAL_TOKEN_HEADER="x-weave-local",SESSION_TTL_MS=720*60*60*1e3;const l=64,O=16,u="abcdefghjkmnpqrstuvwxyz23456789";export function generatePassword(){const s=()=>Array.from({length:4},()=>u[m(u.length)]??"a").join("");return[s(),s(),s(),s()].join("-")}function f(s,t){const e=n(O).toString("hex");return{algo:"scrypt",salt:e,hash:o(s,e,l).toString("hex"),updatedAt:t}}function r(s,t){const e=Buffer.from(s),i=Buffer.from(t);return e.length===i.length&&w(e,i)}export function readCookie(s,t){if(s)for(const e of s.split(";")){const i=e.indexOf("=");if(!(i<0)&&e.slice(0,i).trim()===t)return e.slice(i+1).trim()}}export function sessionCookie(s){return`${SESSION_COOKIE}=${s}; HttpOnly; SameSite=Lax; Path=/; Max-Age=${Math.floor(SESSION_TTL_MS/1e3)}`}export function clearedSessionCookie(){return`${SESSION_COOKIE}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`}function T(s){if(!p(s))return null;try{const t=JSON.parse(y(s,"utf8"));return t?.version!==1||typeof t.sessionSecret!="string"||typeof t.localToken!="string"?null:{version:1,password:t.password??null,sessionSecret:t.sessionSecret,localToken:t.localToken,createdAt:typeof t.createdAt=="string"?t.createdAt:new Date().toISOString()}}catch{return null}}function S(s,t){a(h.dirname(s),{recursive:!0});const e=`${s}.tmp`;c(e,`${JSON.stringify(t,null,2)}
+`,{encoding:"utf8",mode:384}),P(e,s);try{g(s,384)}catch{}}export class AuthService{file;authPath;markerPath;now;initialPassword;constructor(t={}){this.authPath=t.authPath??x(),this.markerPath=t.initialPasswordPath??v(),this.now=t.now??Date.now;const e=T(this.authPath);if(e){this.file=e,this.initialPassword=null;return}const i=generatePassword();this.file={version:1,password:f(i,this.nowIso()),sessionSecret:n(32).toString("hex"),localToken:n(24).toString("hex"),createdAt:this.nowIso()},S(this.authPath,this.file),this.writeMarker(i),this.initialPassword=i}isPasswordSet(){return this.file.password!==null}verifyPassword(t){const e=this.file.password;return e?r(o(t,e.salt,l).toString("hex"),e.hash):!1}setPassword(t){this.file={...this.file,password:f(t,this.nowIso()),sessionSecret:n(32).toString("hex")},S(this.authPath,this.file),k(this.markerPath,{force:!0})}getLocalToken(){return this.file.localToken}verifyLocalToken(t){return typeof t=="string"&&t!==""&&r(t,this.file.localToken)}issueSession(){const t=this.now()+SESSION_TTL_MS;return`${t}.${this.sign(t)}`}verifySession(t){if(!t)return!1;const e=t.indexOf(".");if(e<=0)return!1;const i=Number(t.slice(0,e));return!Number.isFinite(i)||i<=this.now()?!1:r(t.slice(e+1),this.sign(i))}isAuthenticated(t){return this.isLocallyTrusted(t)?!0:this.verifySession(readCookie(t.cookie,SESSION_COOKIE))}isLocallyTrusted(t){const e=t[LOCAL_TOKEN_HEADER];return this.verifyLocalToken(typeof e=="string"?e:void 0)}sign(t){return d("sha256",this.file.sessionSecret).update(`weave-session:${t}`).digest("hex")}nowIso(){return new Date(this.now()).toISOString()}writeMarker(t){a(h.dirname(this.markerPath),{recursive:!0}),c(this.markerPath,`${t}
+`,{encoding:"utf8",mode:384})}}

package/node_modules/@weavecode/server/dist/daemon/data-bus.d.ts

@@ -0,0 +1,31 @@
+/**
+ * 数据变更帧总线（WatchService/HookEventBus 的 EventEmitter + subscribe 形态）。
+ *
+ * SSE /events 的**第三**订阅源，与资产变更（watch）、hook 分发（hookBus）并列。
+ * 承载两类帧，靠 payload 有无区分：
+ * - 带 payload = 后端已经算好，前端直接写状态（小/便宜的域，如终端角标）
+ * - 不带 payload = 只给 key，前端收到后调既有 fetcher 重拉（重/嵌套的域）
+ *
+ * `key` 即数据域。订阅者计数用来回答「有没有人在看」：没有事件源的隐藏刷新器
+ * （终端数量、会话存活）只在有人看时才值得去 spawn 探测。
+ */
+/** 前端可订阅的数据域。 */
+export type DataKey = 'projects' | 'settings' | 'statusline' | 'sessions' | 'terminalTopology' | 'sessionLiveness' | 'sessionInterrupt' | 'inflightCounts' | 'assets' | 'toolkit' | 'market' | 'libraries' | 'updates' | 'capture';
+/** 一帧数据变更通知。 */
+export interface DataFrame {
+    key: DataKey;
+    /** 后端算好的载荷；缺省 = 前端收到后按 key 重拉。 */
+    payload?: unknown;
+    /** 失效域限定的项目路径（assets/toolkit 等按项目划分的域）。 */
+    projectPath?: string;
+}
+export declare class DataBus {
+    private readonly emitter;
+    private subscribers;
+    constructor();
+    emit(frame: DataFrame): void;
+    /** 至少一个打开的 SSE 连接 —— 无事件源的探测以此为准。 */
+    hasSubscribers(): boolean;
+    /** 返回退订函数（与 WatchService.subscribe 一致）。 */
+    subscribe(listener: (frame: DataFrame) => void): () => void;
+}

package/node_modules/@weavecode/server/dist/daemon/data-bus.js

@@ -0,0 +1 @@
+import{EventEmitter as s}from"node:events";export class DataBus{emitter=new s;subscribers=0;constructor(){this.emitter.setMaxListeners(100)}emit(t){this.emitter.emit("change",t)}hasSubscribers(){return this.subscribers>0}subscribe(t){return this.subscribers+=1,this.emitter.on("change",t),()=>{this.subscribers-=1,this.emitter.off("change",t)}}}

package/node_modules/@weavecode/server/dist/daemon/dev-entry.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@weavecode/server/dist/daemon/dev-entry.js

@@ -0,0 +1 @@
+import Z from"node:http";import{openDatabase as ee}from"../db/db.js";import{ProjectRepository as se}from"../repositories/projects.js";import{HookEventRepository as oe}from"../repositories/hook-events.js";import{LibraryRepository as te}from"../repositories/libraries.js";import{HookRuleRepository as W}from"../repositories/hook-rules.js";import{HookDispatchRepository as re}from"../repositories/hook-dispatches.js";import{PluginStateRepository as b}from"../repositories/plugin-states.js";import{SessionRepository as ie}from"../repositories/sessions.js";import{createRuntimeRegistry as ne}from"@weavecode/harness";import{HookRuleRegistry as ae}from"../hooks/registry.js";import{HookDispatcher as le}from"../hooks/dispatcher.js";import{HookEventBus as pe}from"../hooks/bus.js";import{ResumeRunner as me}from"../hooks/resume-runner.js";import{HeadlessRunner as ce}from"../hooks/headless-runner.js";import{MessageDeliverer as ue}from"../hooks/message-deliverer.js";import{QuestionTracker as de}from"../hooks/question-tracker.js";import{startPromptFlusher as he}from"../hooks/prompt-flusher.js";import{SessionWatchRepository as fe}from"../repositories/session-watches.js";import{PushSubscriptionRepository as we}from"../repositories/push-subscriptions.js";import{PushNotifier as ge}from"../hooks/push-notify.js";import{SessionSequenceRepository as Se}from"../repositories/session-sequences.js";import{WatchEngine as be}from"../hooks/watch-engine.js";import{SequenceEngine as ve}from"../hooks/sequence-engine.js";import{loadAllPlugins as Re}from"../hooks/plugin-loader.js";import{ensureBuiltinMarket as ke,builtinMarketDir as De}from"../market/builtin.js";import{ToolkitService as Ee}from"../hooks/toolkit.js";import{startSessionSweeper as Pe}from"../hooks/session-sweeper.js";import{startStatuslineCacheSweeper as ye}from"../statusline/cache-sweeper.js";import{WatchService as Ie}from"../watch/watch-service.js";import{weaveRequestHandler as Te}from"./server.js";import{startTlsServer as Ae}from"./tls.js";import{DataBus as Ce}from"./data-bus.js";import{TerminalTopologyRefresher as $e}from"./terminal-topology-refresher.js";import{SnapshotRefresher as G}from"./snapshot-refresher.js";import{SessionProbe as He}from"./session-probe.js";import{InflightCountsRefresher as qe}from"./inflight-counts-refresher.js";import{ProjectUpdatesRefresher as je}from"./project-updates-refresher.js";import{FingerprintCache as Oe}from"../install/fingerprint.js";import{detectProjectUpdateCounts as _e}from"../install/updates.js";import{claudeLivenessById as Le,pidAliveOf as Fe}from"./claude-liveness.js";import{promptTerminalChannel as Me,readTerminalCounts as Ne}from"./opener.js";import{wireHookFilePipeline as Be}from"./hook-pipeline.js";import{DEFAULT_PORT as C,DAEMON_HOST as Ue,DEFAULT_BIND_HOST as We,findFreePort as Ge,isPortFree as xe}from"./port.js";import{writeDaemonState as x}from"./state.js";import{readDaemonSettingsSync as $,setDaemonSettingsDb as Qe,DEFAULT_SERVER_SETTINGS as Ve}from"./settings.js";import{AuthService as ze}from"./dashboard-auth.js";import{resolveStaticDir as Je}from"./static.js";const Ke="CLAUDE_CODE_CHILD_SESSION"in process.env;delete process.env.CLAUDE_CODE_CHILD_SESSION;async function Xe(){const m=await xe(C)?C:await Ge(C+1);x({pid:process.pid,port:m,startedAt:new Date().toISOString()});const s=ee();Qe(s);const c=$().server?.bindHost??We,v=$().server?.tlsPort??Ve.tlsPort,R=new ze;R.initialPassword&&console.log(`[dev] initial dashboard password: ${R.initialPassword}`);const i=new se(s),d=new oe(s),p=new te(s),k=ne(),Q=k.byCapability("events").flatMap(e=>e.events??[]),h=new ae(new W(s)),f=new re(s),t=new ie(s),r=new pe;{const e=await ke({libraries:p});e.error?console.error(`[dev] builtin market unavailable: ${e.error}`):e.changed&&console.log(`[dev] builtin market ${e.form==="link"?"linked":"copied"} -> ${De(p.dataDir)}`)}const{loader:a}=await Re({rules:new W(s),registry:h,states:new b(s),bus:r,libraries:p},i.list());{const e=a.list().filter(o=>o.status==="rejected");console.log(`[dev] plugins loaded: ${a.list().length} (rejected: ${e.length})`);for(const o of e)console.log(`[dev]   rejected ${o.id}: ${o.error}`)}a.watchRoots();const H={list:()=>a.list(),setPluginEnabled:(e,o)=>a.setPluginEnabled(e,o),reloadAll:()=>a.reloadAll(),rescan:()=>a.rescanRoots(i.list(),p)},V=new Ee({projects:i,states:new b(s),plugins:H,libraries:p}),q=new le({registry:h,dispatches:f,bus:r,projects:i,sessions:t,plugins:a,pluginStates:new b(s)}),D=new ce,z=new me({dispatches:f,sessions:t,projects:i,bus:r,resumeSpec:k.get("claude")?.resume,headless:D}),l=new ue({sessions:t,projects:i,hookEvents:d,bus:r,headless:D,terminal:Me(()=>$().terminal)});he(l);const E=new fe(s),P=new be({watches:E,deliverer:l,sessions:t,bus:r}),j=new we(s),J=new ge({subscriptions:j,sessions:t,bus:r}),y=new Se(s),w=new ve({sequences:y,deliverer:l,sessions:t,bus:r});w.rearm();const g=new de({sessions:t,hookEvents:d,onPending:e=>{r.emit({kind:"question.pending",sessionId:e.sessionId,harness:e.harness,count:e.questions.length,at:e.at})}});g.seedFromDb();const O=new Ie(i);O.start();const n=new Ce,S=new He,I=new $e(async()=>({counts:await Ne(i.list()),terminals:await l.sessionTerminals()}),n,{shouldRun:()=>n.hasSubscribers(),graceMs:1e4});I.start();const _=new G(()=>{const e=Le(),o={};for(const u of t.listWithCounts()){const U=Fe(u,e);U!==null&&(o[u.sessionId]=U)}return{alive:o}},n,{key:"sessionLiveness",shouldRun:()=>n.hasSubscribers()});_.start();const T=new G(()=>{const e={};for(const o of t.listWithCounts()){if(o.turnOpen!==!0)continue;const u=S.interruptedAt(o.sessionId,o.lastSeenAt);u!==null&&(e[o.sessionId]=u)}return{interrupted:e}},n,{key:"sessionInterrupt",intervalMs:5e3,shouldRun:()=>n.hasSubscribers()});T.start();const K=new qe(()=>l.listInflightCounts(),n,r),X=new Oe,Y=new je(()=>_e(i.list(),p.list(),X),n,r,()=>n.hasSubscribers());Pe({sessions:t,events:d,dispatches:f,deliverer:l,watches:E,sequences:y,watchEngine:P,sequenceEngine:w,questions:g,probe:S}),ye();const L=Be({projects:i,rules:h,sessions:t,bus:r,dispatcher:q,watchEngine:P,sequenceEngine:w,messagePipe:l,questionTracker:g,sessionProbe:S}),A=Je(),F=Te({projects:i,port:m,tlsPort:v,watch:O,hookEvents:d,adapters:Q,harnesses:k,libraries:p,staticDir:A,hookRegistry:h,hookDispatches:f,hookSessions:t,hookBus:r,dataBus:n,terminalRefresher:I,interruptRefresher:T,sessionProbe:S,inflightRefresher:K,updatesRefresher:Y,hookDispatcher:q,hookRunner:z,messageDeliverer:l,questionTracker:g,sessionWatches:E,watchEngine:P,sessionSequences:y,sequenceEngine:w,pushSubscriptions:j,pushNotifier:J,hookPlugins:H,hookMirror:L.mirror,pluginStates:new b(s),toolkit:V,auth:R}),M=Z.createServer(F);let N=null;Ae({port:v,bindHost:c,handler:F}).then(e=>{N=e,e&&console.log(`[dev] weave daemon tls listening on https://${c}:${e.port}`)});const B=()=>{I.stop(),_.stop(),T.stop(),D.killAll(),L.stop(),M.close(),N?.server.close(),process.exit(0)};process.on("SIGTERM",B),process.on("SIGINT",B),M.listen(m,c,()=>{x({pid:process.pid,port:m,startedAt:new Date().toISOString(),host:c,tlsPort:v}),console.log(`[dev] weave daemon listening on http://${c}:${m}`),console.log(`[dev] cli/dashboard local url: http://${Ue}:${m}`),console.log(`[dev] child-session marker stripped: ${Ke}`),console.log(A?`[dev] static: ${A}`:"[dev] static: (web/dist not built \u2014 run pnpm build:web)")})}Xe();

package/node_modules/@weavecode/server/dist/daemon/entry.d.ts

@@ -0,0 +1 @@
+export {};

package/node_modules/@weavecode/server/dist/daemon/entry.js

@@ -0,0 +1 @@
+import{startDaemon as m}from"./start.js";m();

package/node_modules/@weavecode/server/dist/daemon/fs-browser.d.ts

@@ -0,0 +1,17 @@
+/** Where a browse root comes from — the frontend maps each kind to a label/icon. */
+export type BrowseRootKind = 'home' | 'desktop' | 'downloads' | 'documents' | 'library-parent' | 'drive' | 'root';
+export interface BrowseRoot {
+    path: string;
+    kind: BrowseRootKind;
+}
+export interface BrowseChild {
+    name: string;
+    path: string;
+}
+/** Cross-platform browse starting points for the directory picker: the user's
+ * home area, the parents of already-registered libraries, and every drive (or
+ * `/` on POSIX). */
+export declare function listBrowseRoots(libraryPaths: string[]): Promise<BrowseRoot[]>;
+/** Subdirectories of a folder, sorted by name (numeric-aware). Throws on
+ * unreadable/nonexistent paths — the route layer maps that to a 4xx. */
+export declare function listDirectoryChildren(dirPath: string): Promise<BrowseChild[]>;

package/node_modules/@weavecode/server/dist/daemon/fs-browser.js

@@ -0,0 +1 @@
+import{readdir as p,stat as u}from"node:fs/promises";import f from"node:os";import s from"node:path";function d(n,r){return new Promise((t,o)=>{const a=setTimeout(()=>o(new Error("timeout")),r);n.then(i=>{clearTimeout(a),t(i)},i=>{clearTimeout(a),o(i)})})}let c=null;const w=5*6e4;async function h(){if(c&&Date.now()-c.at<w)return c.drives;const n="ABCDEFGHIJKLMNOPQRSTUVWXYZ".split(""),r=(await Promise.all(n.map(async t=>{const o=`${t}:\\`;try{return await d(u(o),4e3),o}catch{return null}}))).filter(t=>t!==null);return c={at:Date.now(),drives:r},r}export async function listBrowseRoots(n){const r=[],t=new Set,o=(e,m)=>{t.has(e)||(t.add(e),r.push({path:e,kind:m}))},a=f.homedir();o(a,"home");const i=[["Desktop","desktop"],["Downloads","downloads"],["Documents","documents"]];for(const[e,m]of i){const l=s.join(a,e);try{await u(l),o(l,m)}catch{}}for(const e of n)typeof e=="string"&&e&&o(s.dirname(e),"library-parent");if(process.platform==="win32")for(const e of await h())o(e,"drive");else o(s.parse(a).root,"root");return r}export async function listDirectoryChildren(n){const r=(await p(n,{withFileTypes:!0})).filter(t=>t.isDirectory()).map(t=>({name:t.name,path:s.join(n,t.name)}));return r.sort((t,o)=>t.name.localeCompare(o.name,void 0,{numeric:!0})),r}

package/node_modules/@weavecode/server/dist/daemon/hook-pipeline.d.ts

@@ -0,0 +1,59 @@
+import type { HookEventBus } from '../hooks/bus.js';
+import type { HookDispatcher } from '../hooks/dispatcher.js';
+import type { WatchEngine } from '../hooks/watch-engine.js';
+import type { SequenceEngine } from '../hooks/sequence-engine.js';
+import { MirrorWriter } from '../hooks/mirror.js';
+import type { MessageDeliverer } from '../hooks/message-deliverer.js';
+import type { QuestionTracker } from '../hooks/question-tracker.js';
+import type { HookRuleRegistry } from '../hooks/registry.js';
+import type { ProjectRepository } from '../repositories/projects.js';
+import type { SessionRepository } from '../repositories/sessions.js';
+export interface HookPipelineDeps {
+    projects: ProjectRepository;
+    rules: HookRuleRegistry;
+    sessions: SessionRepository;
+    bus: HookEventBus;
+    dispatcher: HookDispatcher;
+    /** 空闲订阅引擎（批 2）：透传给 handleIngestedRecords（与 dispatcher 平行触发）。 */
+    watchEngine?: Pick<WatchEngine, 'onEvent'>;
+    /** 序列引擎（批 3）：同透传——inject 步完成判据挂在 ingest 消费路径。 */
+    sequenceEngine?: Pick<SequenceEngine, 'onEvent'>;
+    /** prompt 队列冲洗（消息域重塑）：ingest 事件 = 会话活着，即时试递队列行。 */
+    messagePipe?: Pick<MessageDeliverer, 'hasQueued' | 'flushSession'>;
+    /** 阻塞式问答跟踪（AskUserQuestion/计划/权限确认）：ingest 事件派生待答面。 */
+    questionTracker?: Pick<QuestionTracker, 'onEvent'>;
+    /** 会话转录路径上报（中断态探测；同 pane env 口径）。 */
+    sessionProbe?: {
+        noteTranscript(sessionId: string, path: string | null): void;
+    };
+}
+/** 删除一个项目的全部管道文件（忽略不存在）。删项目路由落地时一行调用。 */
+export declare function purgeProjectPipeline(hooksDir: string, token: string): void;
+/**
+ * 孤儿管道文件回收：项目行已删（或历史上删过）留下的 shard 文件不会有人再消费
+ * ——启动时扫一遍三个目录，shard 不匹配任何活跃项目 token 的直接删（归档项目
+ * 的 shard 也不在活跃集内：归档即焚，残留文件一并回收）。
+ *
+ * 安全性：命中即「DB 里没这个 token（或已归档不消费）」，这类文件的行无论谁
+ * 消费都归因不到活跃项目（消费侧按 token 查不到项目/查到归档即丢行），所以
+ * 删除不损失任何可入库的数据。只在启动时跑一次（装配点），避免与运行中的
+ * hook 写侧互相追尾。
+ */
+export declare function purgeOrphanPipelineFiles(deps: {
+    projects: Pick<ProjectRepository, 'list'>;
+    hooksDir: string;
+}): number;
+export interface HookPipeline {
+    /** 交给 createWeaveServer：会话改名/删除后即时重写镜像。 */
+    mirror: MirrorWriter;
+    stop(): Promise<void>;
+}
+/**
+ * hook 文件管道的 daemon 侧装配——两个入口共用（start.ts 生产 / dev-entry.ts 开发）：
+ * - mirror：规则变更（registry.onChange）与会话标题变更（bus）时重写注入计划；
+ * - inbox 消费线程：认领→入库（worker 内独立 db 连接），记录回主线程补 SSE/规则分发。
+ *
+ * 漏挂任何一环的表现都是「hook 在写 inbox，但 dashboard 没有事件」——新增入口时
+ * 必须调用本函数，不要各自手写装配（dev-entry 曾因此静默漏掉整条链路）。
+ */
+export declare function wireHookFilePipeline(deps: HookPipelineDeps): HookPipeline;

package/node_modules/@weavecode/server/dist/daemon/hook-pipeline.js

@@ -0,0 +1 @@
+import{readdirSync as u,unlinkSync as c}from"node:fs";import{join as a}from"node:path";import{getDbPath as f}from"../db/paths.js";import{MirrorWriter as m,hookShardId as p,hooksRoot as b,mirrorPathOf as k,outboxPathOf as g}from"../hooks/mirror.js";import{promptboxPathOf as x}from"../hooks/promptbox.js";import{startInboxWorker as d,handleIngestedRecords as P,unparkFailedInbox as j,INBOX_CLAIM_SUFFIX as l,INBOX_FAILED_SUFFIX as h}from"../hooks/inbox-worker.js";function $(o,r){return[a(o,"inbox",`${r}.jsonl`),a(o,"inbox",`${r}${l}`),a(o,"inbox",`${r}${h}`),k(o,r),g(o,r),x(o,r)]}export function purgeProjectPipeline(o,r){for(const s of $(o,p(r)))try{c(s)}catch{}}function w(o){return(o.endsWith(".tmp")?o.slice(0,-4):o).replace(new RegExp(`(${l}|${h})$`),"").replace(/\.(jsonl|json)$/,"")}const I=/^[0-9a-f]{16}$/;export function purgeOrphanPipelineFiles(o){const r=new Set(o.projects.list().map(e=>p(e.token)));let s=0;for(const e of["inbox","mirror","outbox","promptbox"]){let n;try{n=u(a(o.hooksDir,e))}catch{continue}for(const t of n){const i=w(t);if(!(!I.test(i)||r.has(i)))try{c(a(o.hooksDir,e,t)),s++}catch{}}}return s}export function wireHookFilePipeline(o){const r=b(),s=purgeOrphanPipelineFiles({projects:o.projects,hooksDir:r});s>0&&console.log(`[weave] hook pipeline: purged ${s} orphan file(s)`);const e=j(r);e>0&&console.log(`[weave] hook pipeline: revived ${e} parked inbox file(s)`);const n=new m({projects:o.projects,rules:o.rules,sessions:o.sessions});o.rules.onChange=()=>n.syncAll(),n.attachToBus(o.bus),n.syncAll();const t=d({dbPath:f(),hooksDir:r});return t.on("message",i=>{P({projects:o.projects,hooksDir:r,bus:o.bus,dispatcher:o.dispatcher,watchEngine:o.watchEngine,sequenceEngine:o.sequenceEngine,messagePipe:o.messagePipe,questionTracker:o.questionTracker,sessionProbe:o.sessionProbe},i)}),t.on("error",i=>console.error("[weave] inbox worker failed:",i)),{mirror:n,stop:()=>t.terminate().then(()=>{})}}

package/node_modules/@weavecode/server/dist/daemon/hooks-routes.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { WeaveServerDeps } from './server.js';
+export declare function handleHooksRoutes(req: IncomingMessage, res: ServerResponse, deps: WeaveServerDeps, pathname: string, url: URL): Promise<boolean>;

package/node_modules/@weavecode/server/dist/daemon/hooks-routes.js

@@ -0,0 +1 @@
+import{stat as x}from"node:fs/promises";import{z as a}from"zod";import{HookRuleFilterSchema as N,HookRuleSourceSchema as G,HandlerConfigSchema as F,HookDispatchStatusSchema as L,isHarness as v}from"@weavecode/core";import{readJson as g,sendJson as s}from"./http.js";import{installPlugin as K,uninstallPlugin as _}from"../hooks/plugin-installer.js";import{purgeSession as Q}from"../hooks/session-purge.js";import{composeAnswerAtoms as z}from"../hooks/answer-keys.js";import{effective as J,setProjectEnabled as V}from"../hooks/plugin-project-state.js";import{readDaemonSettings as X}from"./settings.js";import{defaultProjectOpener as Y,terminalBackendFor as Z}from"./opener.js";import{claudeLivenessById as ee,pidAliveOf as se}from"./claude-liveness.js";import{messagingSurfaceFor as w,messagingSurfaces as oe}from"../surfaces.js";import{DEFAULT_WATCH_ON as ne}from"../repositories/session-watches.js";import{SEQUENCE_HOP_LIMIT as U}from"../hooks/sequence-engine.js";const M=a.object({name:a.string().min(1),enabled:a.boolean().optional(),priority:a.number().int().optional(),projectId:a.number().int().nullable(),source:G,filter:N.optional(),handler:F,timeoutMs:a.number().int().positive().optional(),record:a.boolean().optional()}),te=M.partial(),re=a.object({enabled:a.boolean()}),ie=a.object({enabled:a.boolean(),projectId:a.number().int().optional()}),ae=a.object({title:a.string().min(1).max(200)}),ue=a.object({sessionId:a.string().min(1)}),le=a.object({text:a.string().min(1).max(2e4),fromKind:a.enum(["dashboard","session"]).optional(),fromSessionId:a.string().min(1).nullable().optional()}),ce=a.object({answers:a.array(a.object({questionKey:a.string().min(1),options:a.array(a.number().int().min(0)).max(32),text:a.string().max(2e3).optional()})).min(1)}),de=a.object({watcherSessionId:a.string().min(1).nullable().optional(),notify:a.string().min(1).max(2e4).nullable().optional(),on:a.array(a.enum(["idle","turnEnd","messageFailed"])).min(1).optional(),times:a.number().int().min(1).max(100).nullable().optional()}),me=a.object({watchId:a.number().int().positive()}),he=a.object({endpoint:a.string().url(),keys:a.object({p256dh:a.string().min(1),auth:a.string().min(1)})}),ge=a.object({endpoint:a.string().url()}),pe=a.object({name:a.string().max(200).optional(),steps:a.array(a.object({to:a.string().min(1),text:a.string().min(1).max(2e4),mode:a.enum(["prompt","inject","headless","auto"]).optional()})).min(1)}),fe=a.object({src:a.string().min(1)});function E(r,e){return r.prompt!==null||e}export async function handleHooksRoutes(r,e,o,l,k){if(!(l.startsWith("/hooks/")||l==="/sessions"||l.startsWith("/sessions/")||l.startsWith("/messaging")))return!1;if(l==="/hooks/rules"){if(!o.hookRegistry)return s(e,503,{error:"Hooks subsystem unavailable"}),!0;if(r.method==="GET"){const n=k.searchParams.get("projectId"),t=n!=null&&n!==""?Number(n):void 0;return s(e,200,{rules:o.hookRegistry.list(t)}),!0}if(r.method==="POST"){try{const n=M.parse(await g(r)),t=o.hookRegistry.create(n);s(e,201,{rule:t})}catch(n){s(e,400,{error:n instanceof Error?n.message:"Invalid rule body"})}return!0}}const P=l.match(/^\/hooks\/rules\/([^/]+)$/);if(P){if(!o.hookRegistry)return s(e,503,{error:"Hooks subsystem unavailable"}),!0;const n=decodeURIComponent(P[1]);if(r.method==="PUT"){try{const t=te.parse(await g(r)),i=o.hookRegistry.update(n,t);if(!i)return s(e,404,{error:"Rule not found"}),!0;s(e,200,{rule:i})}catch(t){s(e,400,{error:t instanceof Error?t.message:"Invalid rule body"})}return!0}if(r.method==="DELETE")return o.hookRegistry.remove(n)?(s(e,200,{ok:!0}),!0):(s(e,404,{error:"Rule not found"}),!0)}const T=l.match(/^\/hooks\/rules\/([^/]+)\/toggle$/);if(T&&r.method==="POST"){if(!o.hookRegistry)return s(e,503,{error:"Hooks subsystem unavailable"}),!0;try{const n=re.parse(await g(r)),t=o.hookRegistry.setEnabled(decodeURIComponent(T[1]),n.enabled);if(!t)return s(e,404,{error:"Rule not found"}),!0;s(e,200,{rule:t})}catch(n){s(e,400,{error:n instanceof Error?n.message:"Invalid body"})}return!0}if(l==="/hooks/plugins"){if(r.method==="GET"){const n=k.searchParams.get("projectId");if(n==null||n==="")return s(e,200,{plugins:o.hookPlugins?.list()??[]}),!0;const t=o.projects.getById(Number(n));if(!t)return s(e,404,{error:"Project not found"}),!0;if(!o.pluginStates)return s(e,503,{error:"Plugin states unavailable"}),!0;const i=o.pluginStates;return s(e,200,{plugins:(o.hookPlugins?.list()??[]).map(u=>{if(u.status==="rejected")return u;const d=J(t,u.id,{states:i})?"active":"disabled";return d===u.status?u:{...u,status:d}})}),!0}if(r.method==="POST"){if(!o.hookPlugins)return s(e,503,{error:"Plugin loader unavailable"}),!0;try{const n=fe.parse(await g(r)),t=await K(n.src);await o.hookPlugins.reloadAll(),s(e,201,t)}catch(n){s(e,400,{error:n instanceof Error?n.message:"Install failed"})}return!0}}const j=l.match(/^\/hooks\/plugins\/([^/]+)\/uninstall$/);if(j&&r.method==="POST"){if(!o.hookPlugins)return s(e,503,{error:"Plugin loader unavailable"}),!0;const n=decodeURIComponent(j[1]);return await _(n)?(await o.hookPlugins.reloadAll(),s(e,200,{ok:!0}),!0):(s(e,404,{error:"Plugin directory not found"}),!0)}if(l==="/hooks/plugins/rescan"&&r.method==="POST"){if(!o.hookPlugins)return s(e,503,{error:"Plugin loader unavailable"}),!0;try{await o.hookPlugins.rescan(),s(e,200,{ok:!0,plugins:o.hookPlugins.list().length})}catch(n){s(e,500,{error:n instanceof Error?n.message:"Rescan failed"})}return!0}const R=l.match(/^\/hooks\/plugins\/([^/]+)\/toggle$/);if(R&&r.method==="POST"){if(!o.hookPlugins)return s(e,503,{error:"Plugin loader unavailable"}),!0;try{const n=ie.parse(await g(r)),t=decodeURIComponent(R[1]);if(n.projectId!==void 0){const i=o.projects.getById(n.projectId);return i?o.hookPlugins.list().some(u=>u.id===t)?(V(i,t,n.enabled,{projects:o.projects}),s(e,200,{ok:!0}),!0):(s(e,404,{error:"Plugin not found"}),!0):(s(e,404,{error:"Project not found"}),!0)}if(!o.hookPlugins.setPluginEnabled(t,n.enabled))return s(e,404,{error:"Plugin not found"}),!0;s(e,200,{ok:!0})}catch(n){s(e,400,{error:n instanceof Error?n.message:"Invalid body"})}return!0}if(l==="/hooks/dispatches"&&r.method==="GET"){if(!o.hookDispatches)return s(e,503,{error:"Hooks subsystem unavailable"}),!0;const n=k.searchParams.get("ruleId")??void 0,t=k.searchParams.get("status"),i=t?L.parse(t):void 0,u=k.searchParams.get("sessionId")??void 0,d=k.searchParams.get("limit"),c=d?Number(d):void 0;return s(e,200,{dispatches:o.hookDispatches.list({ruleId:n,status:i,sessionId:u,limit:Number.isFinite(c)?c:void 0})}),!0}const q=l.match(/^\/hooks\/dispatches\/(\d+)\/run$/);if(q&&r.method==="POST"){if(!o.hookRunner)return s(e,503,{error:"Resume runner unavailable"}),!0;let n;try{n=ue.parse(await g(r)).sessionId}catch(i){return s(e,400,{error:i instanceof Error?i.message:"Invalid body"}),!0}const t=await o.hookRunner.run(Number(q[1]),n);return t.ok?s(e,200,{ok:!0,dispatchId:t.dispatchId}):s(e,t.status,{error:t.error}),!0}if(l==="/sessions"&&r.method==="GET"){if(!o.hookSessions)return s(e,503,{error:"Hooks subsystem unavailable"}),!0;const n=k.searchParams.get("projectId"),t=n!=null&&n!==""?Number(n):void 0,i=o.hookSessions.listWithCounts(t),u=ee(),d=o.terminalRefresher?.lastSnapshot?.terminals??{};return s(e,200,{sessions:i.map(c=>({...c,pidAlive:se(c,u),terminal:d[c.sessionId]??null,interruptedAt:c.turnOpen===!0?o.sessionProbe?.interruptedAt(c.sessionId,c.lastSeenAt)??null:null}))}),!0}const y=l.match(/^\/sessions\/([^/]+)$/);if(y&&r.method==="PATCH"){if(!o.hookSessions)return s(e,503,{error:"Hooks subsystem unavailable"}),!0;const n=decodeURIComponent(y[1]);if(!o.hookSessions.getBySessionId(n))return s(e,404,{error:"Session not found"}),!0;try{const t=ae.parse(await g(r)),i=o.hookSessions.setPendingTitle(n,t.title);i?.projectId!=null&&o.hookMirror?.syncProject(i.projectId),s(e,200,{session:i})}catch(t){s(e,400,{error:t instanceof Error?t.message:"Invalid body"})}return!0}if(y&&r.method==="DELETE"){if(!o.hookSessions||!o.hookEvents)return s(e,503,{error:"Hooks subsystem unavailable"}),!0;const n=decodeURIComponent(y[1]),t=o.hookSessions.getBySessionId(n);if(!t)return s(e,404,{error:"Session not found"}),!0;const i=Q({sessions:o.hookSessions,events:o.hookEvents,dispatches:o.hookDispatches,deliverer:o.messageDeliverer,watches:o.sessionWatches,questions:o.questionTracker,probe:o.sessionProbe},n);return t.projectId!=null&&o.hookMirror?.syncProject(t.projectId),s(e,200,{ok:!0,sessionId:n,...i}),!0}const $=l.match(/^\/sessions\/([^/]+)\/open-terminal$/);if($&&r.method==="POST"){const n=decodeURIComponent($[1]);if(!o.hookSessions)return s(e,503,{error:"Hooks subsystem unavailable"}),!0;const t=o.hookSessions.getBySessionId(n);if(!t)return s(e,404,{error:"Session not found"}),!0;if(!o.hookEvents)return s(e,503,{error:"Hook ingestion unavailable"}),!0;const i=o.hookEvents.listBySession(n,1),u=i[i.length-1]?.source;if(!v(u))return s(e,400,{error:"Session has no hook events to determine its harness"}),!0;const d=o.harnesses?.get(u)?.resume;if(!d?.supported||!d.openArgs)return s(e,501,{error:`Harness "${u}" does not support interactive resume`}),!0;if(!t.projectId)return s(e,400,{error:"Session is not bound to a project"}),!0;const c=o.projects.getById(t.projectId);if(!c)return s(e,404,{error:"Project not found"}),!0;const p=o.opener??Y;let h;if(r.method==="POST")try{const m=await g(r);typeof m?.target=="string"&&m.target&&(h=m.target)}catch{}try{if(!(await x(c.path)).isDirectory())throw new Error(`Not a directory: ${c.path}`);const m=await X(),b=[d.bin,...d.openArgs(n)];if(h){if(!Z(m.terminal).enumerable)throw new Error(`Terminal preset "${m.terminal.preset}" cannot attach to a chosen pane \u2014 pick wezterm, wt or Terminal.app in settings`);const f=p.runInTerminalAt;if(!f)throw new Error("Targeted attach is unavailable");await f(c.path,b,h,m.terminal)}else await p.runInTerminal(c.path,b,m.terminal);setTimeout(()=>{o.terminalRefresher?.refreshNow()},600),s(e,200,{ok:!0,sessionId:n,command:b.join(" "),cwd:c.path,...h?{target:h}:{}})}catch(m){s(e,400,{error:m instanceof Error?m.message:"Open failed"})}return!0}const D=l.match(/^\/sessions\/([^/]+)\/messages$/);if(D){const n=decodeURIComponent(D[1]);if(r.method==="GET")return o.messageDeliverer?o.hookSessions?.getBySessionId(n)?(s(e,200,{messages:o.messageDeliverer.listVisible(n)}),!0):(s(e,404,{error:"Session not found"}),!0):(s(e,503,{error:"Messaging subsystem unavailable"}),!0);if(r.method==="POST"){if(!o.messageDeliverer||!o.hookSessions)return s(e,503,{error:"Messaging subsystem unavailable"}),!0;let t;try{t=le.parse(await g(r))}catch(u){return s(e,400,{error:u instanceof Error?u.message:"Invalid body"}),!0}const i=await o.messageDeliverer.send({toSessionId:n,text:t.text,mode:"prompt",fromKind:t.fromKind??"dashboard",fromSessionId:t.fromSessionId??null,oneWay:!0});return i.ok?s(e,201,{ok:!0,messageId:i.messageId,status:i.status,message:i.message}):s(e,i.status,{error:i.error}),!0}}const H=l.match(/^\/sessions\/([^/]+)\/messages\/([^/]+)\/resend$/);if(H&&r.method==="POST"){if(!o.messageDeliverer)return s(e,503,{error:"Messaging subsystem unavailable"}),!0;const n=await o.messageDeliverer.resend(decodeURIComponent(H[2]));return n.ok?s(e,200,{ok:!0,messageId:n.messageId,status:n.status,message:n.message}):s(e,n.status,{error:n.error}),!0}const I=l.match(/^\/sessions\/([^/]+)\/messages\/([^/]+)\/dismiss$/);if(I&&r.method==="POST"){if(!o.messageDeliverer)return s(e,503,{error:"Messaging subsystem unavailable"}),!0;const n=o.messageDeliverer.dismiss(decodeURIComponent(I[1]),decodeURIComponent(I[2]));return n.ok?s(e,200,{ok:!0}):s(e,n.status,{error:n.error}),!0}if(l==="/messaging/questions"&&r.method==="GET")return o.questionTracker?(s(e,200,{questions:o.questionTracker.snapshot()}),!0):(s(e,503,{error:"Question tracking unavailable"}),!0);const O=l.match(/^\/sessions\/([^/]+)\/answer$/);if(O&&r.method==="POST"){if(!o.questionTracker||!o.messageDeliverer)return s(e,503,{error:"Question tracking unavailable"}),!0;const n=decodeURIComponent(O[1]);let t;try{t=ce.parse(await g(r))}catch(c){return s(e,400,{error:c instanceof Error?c.message:"Invalid body"}),!0}const i=o.questionTracker.get(n);if(!i)return s(e,409,{error:"Session has no pending question"}),!0;const u=z(i.questions,t.answers);if(!u.ok)return s(e,400,{error:u.error}),!0;const d=await o.messageDeliverer.answer(n,u.atoms);return d.ok?(o.questionTracker.markAnswered(n),s(e,200,{ok:!0,sessionId:n}),!0):(s(e,d.status,{error:d.error}),!0)}const B=l.match(/^\/sessions\/([^/]+)\/interrupt$/);if(B&&r.method==="POST"){if(!o.messageDeliverer)return s(e,503,{error:"Messaging subsystem unavailable"}),!0;const n=decodeURIComponent(B[1]),t=await o.messageDeliverer.interrupt(n);return t.ok?(setTimeout(()=>o.interruptRefresher?.tick(),1500),s(e,200,{ok:!0,sessionId:n}),!0):(s(e,t.status,{error:t.error}),!0)}const C=l.match(/^\/sessions\/([^/]+)\/watch$/);if(C){const n=decodeURIComponent(C[1]);if(r.method==="POST"){if(!o.sessionWatches||!o.hookSessions||!o.hookEvents)return s(e,503,{error:"Messaging subsystem unavailable"}),!0;let t;try{t=de.parse(await g(r))}catch(f){return s(e,400,{error:f instanceof Error?f.message:"Invalid body"}),!0}if(!o.hookSessions.getBySessionId(n))return s(e,404,{error:"Session not found"}),!0;const i=o.hookEvents.listBySession(n,1),u=i[i.length-1]?.source;if(!v(u))return s(e,400,{error:"Session has no hook events to determine its harness"}),!0;const d=w(u),c=t.on??[...ne];if((c.includes("idle")||c.includes("turnEnd"))&&d.idleSignals.length===0)return s(e,409,{error:d.unsupportedReasons?.watch??`Harness "${u}" does not support idle watching`}),!0;if(c.includes("messageFailed")&&!(E(d,o.messageDeliverer?.hasTerminalChannel()??!1)||d.inject!==null||d.headless!==null))return s(e,409,{error:d.unsupportedReasons?.prompt??`Harness "${u}" supports no messaging channel`}),!0;if(t.watcherSessionId){if(!o.hookSessions.getBySessionId(t.watcherSessionId))return s(e,404,{error:"Watcher session not found"}),!0;const f=o.hookEvents.listBySession(t.watcherSessionId,1),S=f[f.length-1]?.source;if(!v(S))return s(e,400,{error:"Watcher session has no hook events to determine its harness"}),!0;const A=w(S);if(!A.inject)return s(e,409,{error:A.unsupportedReasons?.inject??`Harness "${S}" cannot receive watch notifications`}),!0}const p=t.times===void 0?1:t.times,h=(t.watcherSessionId??null)===null?o.sessionWatches.listPendingByTarget(n).find(f=>f.watcherSessionId===null):void 0,m=h?o.sessionWatches.updateById(h.id,{onEvents:c,remaining:p}):void 0,b=m??o.sessionWatches.insert({watcherSessionId:t.watcherSessionId??null,targetSessionId:n,notify:t.notify??null,onEvents:c,times:p});return o.watchEngine?.created(b),s(e,m?200:201,{ok:!0,watchId:b.id,watch:b}),!0}if(r.method==="DELETE"){if(!o.sessionWatches)return s(e,503,{error:"Messaging subsystem unavailable"}),!0;let t;try{t=me.parse(await g(r))}catch(u){return s(e,400,{error:u instanceof Error?u.message:"Invalid body"}),!0}const i=o.sessionWatches.getById(t.watchId);return!i||i.targetSessionId!==n||i.firedAt!==null?(s(e,404,{error:"Watch not found"}),!0):(o.sessionWatches.deleteById(t.watchId),s(e,200,{ok:!0,watchId:t.watchId}),!0)}}if(l==="/messaging/watches"&&r.method==="GET")return o.sessionWatches?(s(e,200,{watches:o.sessionWatches.listPending()}),!0):(s(e,503,{error:"Messaging subsystem unavailable"}),!0);if(l==="/messaging/push/key"&&r.method==="GET")return o.pushNotifier?(s(e,200,{publicKey:o.pushNotifier.publicKey()}),!0):(s(e,503,{error:"Push subsystem unavailable"}),!0);if(l==="/messaging/push/subscribe"&&r.method==="POST"){if(!o.pushSubscriptions)return s(e,503,{error:"Push subsystem unavailable"}),!0;try{const n=he.parse(await g(r)),t=o.pushSubscriptions.upsert({endpoint:n.endpoint,p256dh:n.keys.p256dh,auth:n.keys.auth,userAgent:r.headers["user-agent"]??null});s(e,201,{ok:!0,subscription:t})}catch(n){s(e,400,{error:n instanceof Error?n.message:"Invalid body"})}return!0}if(l==="/messaging/push/unsubscribe"&&r.method==="POST"){if(!o.pushSubscriptions)return s(e,503,{error:"Push subsystem unavailable"}),!0;try{const n=ge.parse(await g(r));o.pushSubscriptions.deleteByEndpoint(n.endpoint),s(e,200,{ok:!0})}catch(n){s(e,400,{error:n instanceof Error?n.message:"Invalid body"})}return!0}if(l==="/messaging/sequences"){if(r.method==="GET")return o.sessionSequences?(s(e,200,{sequences:o.sessionSequences.list()}),!0):(s(e,503,{error:"Messaging subsystem unavailable"}),!0);if(r.method==="POST"){if(!o.sessionSequences||!o.sequenceEngine||!o.hookSessions||!o.hookEvents)return s(e,503,{error:"Messaging subsystem unavailable"}),!0;let n;try{n=pe.parse(await g(r))}catch(u){return s(e,400,{error:u instanceof Error?u.message:"Invalid body"}),!0}if(n.steps.length>U)return s(e,400,{error:`Sequences are capped at ${U} steps (hop limit)`}),!0;const t=o.messageDeliverer?.hasTerminalChannel()??!1;for(let u=0;u<n.steps.length;u++){const d=n.steps[u];if(!o.hookSessions.getBySessionId(d.to))return s(e,404,{error:`Step ${u+1}: session not found`}),!0;const c=o.hookEvents.listBySession(d.to,1),p=c[c.length-1]?.source;if(!v(p))return s(e,400,{error:`Step ${u+1}: session has no hook events to determine its harness`}),!0;const h=w(p),m=d.mode??"auto";if(!(m==="prompt"?E(h,t):m==="inject"?h.inject!==null:m==="headless"?h.headless!==null:h.inject!==null||h.headless!==null)){const b=m==="auto"?h.unsupportedReasons?.inject??`Harness "${p}" supports no messaging channel`:h.unsupportedReasons?.[m]??`Harness "${p}" does not support the ${m} channel`;return s(e,409,{error:`Step ${u+1}: ${b}`}),!0}}const i=o.sessionSequences.insert({name:n.name??"",steps:n.steps.map(u=>({...u,mode:u.mode??"auto"}))});return await o.sequenceEngine.trigger(i),s(e,201,{ok:!0,sequence:o.sessionSequences.getById(i.id)??i}),!0}}const W=l.match(/^\/messaging\/sequences\/(\d+)$/);if(W&&r.method==="DELETE"){if(!o.sessionSequences)return s(e,503,{error:"Messaging subsystem unavailable"}),!0;const n=o.sessionSequences.getById(Number(W[1]));return n?n.status!=="running"?(s(e,409,{error:`Sequence already ${n.status}`}),!0):(o.sequenceEngine?o.sequenceEngine.cancel(n.id):o.sessionSequences.finish(n.id,"cancelled"),s(e,200,{ok:!0,sequenceId:n.id}),!0):(s(e,404,{error:"Sequence not found"}),!0)}if(l==="/messaging/capabilities"&&r.method==="GET"){const n=o.messageDeliverer?.hasTerminalChannel()??!1;return s(e,200,{capabilities:oe().map(({harness:t,surface:i})=>({harness:t,discovery:i.discovery,prompt:E(i,n),inject:i.inject!==null,headless:i.headless!==null,watch:i.idleSignals.length>0,unsupportedReasons:i.unsupportedReasons??null}))}),!0}return!1}