@zhanguym/chatroom 1.0.0

package/dist/plugins/web/http/api-router.js

@@ -0,0 +1,47 @@
+import { Router } from "express";
+import { ChatRoomError } from "#core/errors/chatroom-error";
+import { boundedIntegerQuery, requireString, } from "#presentation/http/http-utils";
+import { createProcessApiRouter } from "./process-api-router.js";
+import { createWorkspaceApiRouter } from "./workspace-api-router.js";
+import { createGitApiRouter } from "./git-api-router.js";
+import { createCloudApiRouter } from "./cloud-api-router.js";
+import { createComputerApiRouter } from "./computer-api-router.js";
+import { apiAuthentication, createPrivateAuthApiRouter, createPublicAuthApiRouter, } from "./auth-api-router.js";
+import { createRuntimeApiRouter } from "./runtime-api-router.js";
+import { createLogsApiRouter } from "./logs-api-router.js";
+export function createApiRouter(application, eventBus, auth, passkeys, ingress, cloud, logs, runtimeStatus) {
+    const router = Router();
+    router.use(createPublicAuthApiRouter(auth, passkeys, ingress, logs));
+    router.use(apiAuthentication(auth, ingress));
+    router.use(createPrivateAuthApiRouter(passkeys, ingress, logs));
+    router.use(createRuntimeApiRouter(application, eventBus, runtimeStatus));
+    router.use(createLogsApiRouter(logs));
+    router.get("/operations", (req, res) => {
+        res.json(application.operations.list({
+            limit: boundedIntegerQuery(req.query.limit, 100, 0, 500),
+            offset: boundedIntegerQuery(req.query.offset, 0, 0, 100000),
+            ...(typeof req.query.pluginId === "string"
+                ? { pluginId: req.query.pluginId }
+                : {}),
+            ...(typeof req.query.status === "string"
+                ? { status: req.query.status }
+                : {}),
+        }));
+    });
+    router.delete("/operations", (_req, res) => {
+        res.json(application.operations.clearHistory());
+    });
+    router.get("/operations/:operationId", (req, res) => {
+        const operationId = requireString(req.params.operationId, "operationId");
+        const event = application.operations.get(operationId);
+        if (!event)
+            throw new ChatRoomError("NOT_FOUND", "Operation not found");
+        res.json(event);
+    });
+    router.use(createWorkspaceApiRouter(application));
+    router.use(createGitApiRouter(application));
+    router.use(createProcessApiRouter(application));
+    router.use(createComputerApiRouter(application.computer, application.operations, ingress));
+    router.use(createCloudApiRouter(cloud, application.operations));
+    return router;
+}

package/dist/plugins/web/http/auth-api-router.d.ts

@@ -0,0 +1,8 @@
+import { Router, type RequestHandler } from "express";
+import type { AuthService } from "#auth/auth-service";
+import type { IngressPolicy } from "#auth/ingress-policy";
+import type { PasskeyService } from "#auth/passkey-service";
+import type { LogWriter } from "#core/logging/types";
+export declare function createPublicAuthApiRouter(auth: AuthService, passkeys: PasskeyService, ingress: IngressPolicy, logs: LogWriter): Router;
+export declare function createPrivateAuthApiRouter(passkeys: PasskeyService, ingress: IngressPolicy, logs: LogWriter): Router;
+export declare function apiAuthentication(auth: AuthService, ingress: IngressPolicy): RequestHandler;

package/dist/plugins/web/http/auth-api-router.js

@@ -0,0 +1,123 @@
+import { Router } from "express";
+import { asyncRoute, bodyRecord, parseCookie, requireString, } from "#presentation/http/http-utils";
+const SESSION_COOKIE = "chatroom_session";
+export function createPublicAuthApiRouter(auth, passkeys, ingress, logs) {
+    const router = Router();
+    router.get("/auth/status", (req, res) => {
+        const token = sessionToken(req.headers.cookie);
+        const enabled = ingress.requiresWebAuth(req);
+        const passkeyAvailable = Boolean(ingress.webAuthnOrigin(req));
+        res.json({
+            enabled,
+            authenticated: !enabled || Boolean(token && auth.verifyWebSession(token)),
+            passkeyAvailable,
+            passkeyRegistered: passkeyAvailable && passkeys.list().length > 0,
+        });
+    });
+    router.post("/auth/login", asyncRoute(async (req, res) => {
+        if (!ingress.requiresWebAuth(req)) {
+            res.json({ authenticated: true });
+            return;
+        }
+        const body = bodyRecord(req.body);
+        try {
+            const session = auth.createWebSession(requireString(body.ownerToken, "ownerToken"), body.remember !== false);
+            setSessionCookie(res, session.token, session.maxAgeSeconds, ingress.secureWebCookie(req));
+            logs.info("auth", "auth.success", "Web authentication succeeded", {
+                method: "owner_token",
+            });
+            res.json({ authenticated: true, expiresAt: session.expiresAt });
+        }
+        catch (error) {
+            logs.warn("auth", "auth.failed", "Web authentication failed", {
+                method: "owner_token",
+                reason: "invalid_owner_token",
+            });
+            throw error;
+        }
+    }));
+    router.post("/auth/passkey/options", asyncRoute(async (req, res) => {
+        res.json(await passkeys.authenticationOptions(ingress.webAuthnOrigin(req)));
+    }));
+    router.post("/auth/passkey/verify", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        try {
+            await passkeys.verifyAuthentication({
+                challengeId: requireString(body.challengeId, "challengeId"),
+                response: body.response,
+            });
+            const session = auth.createPasskeyWebSession(body.remember !== false);
+            setSessionCookie(res, session.token, session.maxAgeSeconds, ingress.secureWebCookie(req));
+            logs.info("auth", "auth.passkey_success", "Passkey authentication succeeded");
+            res.json({ authenticated: true, expiresAt: session.expiresAt });
+        }
+        catch (error) {
+            logs.warn("auth", "auth.passkey_failed", "Passkey authentication failed", { reason: "passkey_verification_failed" });
+            throw error;
+        }
+    }));
+    router.post("/auth/logout", (req, res) => {
+        const token = sessionToken(req.headers.cookie);
+        if (token) {
+            auth.revokeWebSession(token);
+            logs.info("auth", "auth.logout", "Web session signed out");
+        }
+        const secure = ingress.secureWebCookie(req) ? "; Secure" : "";
+        res.setHeader("Set-Cookie", `${SESSION_COOKIE}=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0${secure}`);
+        res.json({ authenticated: false });
+    });
+    return router;
+}
+export function createPrivateAuthApiRouter(passkeys, ingress, logs) {
+    const router = Router();
+    router.get("/auth/passkeys", (_req, res) => res.json(passkeys.list()));
+    router.post("/auth/passkeys/register/options", asyncRoute(async (req, res) => {
+        res.json(await passkeys.registrationOptions(ingress.webAuthnOrigin(req)));
+    }));
+    router.post("/auth/passkeys/register/verify", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        try {
+            const passkey = await passkeys.verifyRegistration({
+                challengeId: requireString(body.challengeId, "challengeId"),
+                response: body.response,
+                ...(typeof body.name === "string" ? { name: body.name } : {}),
+            });
+            logs.info("auth", "auth.passkey_registered", "Passkey registered");
+            res.status(201).json(passkey);
+        }
+        catch (error) {
+            logs.warn("auth", "auth.passkey_register_failed", "Passkey registration failed", { reason: "passkey_registration_failed" });
+            throw error;
+        }
+    }));
+    router.delete("/auth/passkeys/:credentialId", (req, res) => {
+        passkeys.remove(requireString(req.params.credentialId, "credentialId"));
+        logs.info("auth", "auth.passkey_removed", "Passkey removed");
+        res.status(204).end();
+    });
+    return router;
+}
+export function apiAuthentication(auth, ingress) {
+    return (req, res, next) => {
+        if (!ingress.requiresWebAuth(req)) {
+            next();
+            return;
+        }
+        const token = sessionToken(req.headers.cookie);
+        if (token && auth.verifyWebSession(token)) {
+            next();
+            return;
+        }
+        res.status(401).json({
+            error: { code: "FORBIDDEN", message: "Authentication required" },
+        });
+    };
+}
+function sessionToken(cookieHeader) {
+    return parseCookie(cookieHeader, SESSION_COOKIE);
+}
+function setSessionCookie(res, token, maxAgeSeconds, secureCookie) {
+    const secure = secureCookie ? "; Secure" : "";
+    const maxAge = maxAgeSeconds === null ? "" : `; Max-Age=${maxAgeSeconds}`;
+    res.setHeader("Set-Cookie", `${SESSION_COOKIE}=${encodeURIComponent(token)}; HttpOnly; SameSite=Strict; Path=/${maxAge}${secure}`);
+}

package/dist/plugins/web/http/cloud-api-router.d.ts

@@ -0,0 +1,4 @@
+import { Router } from "express";
+import type { OperationLog } from "#operations/operation-log";
+import type { CloudController } from "#plugins/cloud/controller";
+export declare function createCloudApiRouter(controller: CloudController, operations: OperationLog): Router;

package/dist/plugins/web/http/cloud-api-router.js

@@ -0,0 +1,29 @@
+import { Router } from "express";
+import { z } from "zod";
+import { CLOUD_SERVICE_SCHEMA } from "#plugins/cloud/types";
+import { asyncRoute } from "#presentation/http/http-utils";
+export function createCloudApiRouter(controller, operations) {
+    const router = Router();
+    router.get("/cloud/status", (_req, res) => res.json(controller.status()));
+    router.post("/cloud/sync", asyncRoute(async (_req, res) => res.json(await operations.run({ pluginId: "cloud", source: "gui", action: "sync" }, () => controller.syncStatus()))));
+    router.post("/cloud/management", asyncRoute(async (_req, res) => res.json(await operations.run({ pluginId: "cloud", source: "gui", action: "management" }, () => controller.managementUrl()))));
+    router.post("/cloud/restore", asyncRoute(async (req, res) => {
+        const body = z
+            .object({ recoveryKey: z.string().min(20) })
+            .strict()
+            .parse(req.body);
+        res.json(await operations.run({ pluginId: "cloud", source: "gui", action: "restore", input: body }, () => controller.restore(body.recoveryKey)));
+    }));
+    router.post("/cloud/recovery-key", asyncRoute(async (_req, res) => res.json(await operations.run({ pluginId: "cloud", source: "gui", action: "recovery-key.replace" }, async () => ({ recoveryKey: await controller.replaceRecoveryKey() })))));
+    router.post("/cloud/services/:service", asyncRoute(async (req, res) => {
+        const service = CLOUD_SERVICE_SCHEMA.parse(req.params.service);
+        const body = z.object({ enabled: z.boolean() }).strict().parse(req.body);
+        res.json(await operations.run({
+            pluginId: "cloud",
+            source: "gui",
+            action: "service.set",
+            input: { service, enabled: body.enabled },
+        }, () => controller.setService(service, body.enabled)));
+    }));
+    return router;
+}

package/dist/plugins/web/http/computer-api-router.d.ts

@@ -0,0 +1,5 @@
+import { Router } from "express";
+import type { ComputerService } from "#plugins/computer/computer-service";
+import type { OperationLog } from "#operations/operation-log";
+import type { IngressPolicy } from "#auth/ingress-policy";
+export declare function createComputerApiRouter(computer: ComputerService, operations: OperationLog, ingress: IngressPolicy): Router;

package/dist/plugins/web/http/computer-api-router.js

@@ -0,0 +1,69 @@
+import { Router } from "express";
+import { z } from "zod";
+import { asyncRoute } from "#presentation/http/http-utils";
+import { ChatRoomError } from "#core/errors/chatroom-error";
+const settingsPatchSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    remoteAccess: z.boolean().optional(),
+})
+    .strict();
+export function createComputerApiRouter(computer, operations, ingress) {
+    const router = Router();
+    router.get("/computer/status", asyncRoute(async (_req, res) => res.json(await computer.status())));
+    router.post("/computer/permissions/accessibility/request", asyncRoute(async (req, res) => {
+        assertLocalPermissionRequest(req);
+        res.json(await computer.requestPermission("accessibility"));
+    }));
+    router.post("/computer/permissions/screen-recording/request", asyncRoute(async (req, res) => {
+        assertLocalPermissionRequest(req);
+        res.json(await computer.requestPermission("screenRecording"));
+    }));
+    function assertLocalPermissionRequest(req) {
+        if (ingress.isExternalWeb(req))
+            throw new ChatRoomError("FORBIDDEN", "Computer permissions can be requested only from the local WebUI");
+    }
+    router.patch("/computer/settings", asyncRoute(async (req, res) => {
+        const parsed = settingsPatchSchema.parse(req.body);
+        const patch = {
+            ...(parsed.enabled === undefined ? {} : { enabled: parsed.enabled }),
+            ...(parsed.remoteAccess === undefined
+                ? {}
+                : { remoteAccess: parsed.remoteAccess }),
+        };
+        res.json(await operations.run({
+            pluginId: "computer",
+            source: "gui",
+            action: "settings.set",
+            input: patch,
+        }, async () => computer.setSettings(patch)));
+    }));
+    router.get("/computer/preview", (req, res) => {
+        const scope = ingress.isExternalWeb(req) ? "remote" : "local";
+        res.json(presentPreview(computer.latestSnapshot(scope), computer.latestSnapshotTimestamp()));
+    });
+    router.post("/computer/snapshot", asyncRoute(async (req, res) => {
+        const scope = ingress.isExternalWeb(req) ? "remote" : "local";
+        const value = await computer.snapshot(scope, {
+            includeScreenshot: true,
+            includeElements: true,
+        });
+        res.json(presentPreview(value, computer.latestSnapshotTimestamp()));
+    }));
+    return router;
+}
+function presentPreview(value, capturedAt) {
+    if (!value)
+        return null;
+    return {
+        snapshotId: value.snapshotId,
+        revision: value.revision,
+        capturedAt,
+        display: value.display,
+        activeApp: value.activeApp,
+        activeWindow: value.activeWindow,
+        cursor: value.cursor,
+        elementCount: value.elements.length,
+        screenshot: value.screenshot ?? null,
+    };
+}

package/dist/plugins/web/http/git-api-router.d.ts

@@ -0,0 +1,3 @@
+import { Router } from "express";
+import type { WebRuntime } from "#plugins/web/runtime";
+export declare function createGitApiRouter(application: WebRuntime): Router;

package/dist/plugins/web/http/git-api-router.js

@@ -0,0 +1,85 @@
+import { Router } from "express";
+import { asyncRoute, bodyRecord, requireString, requireStringArray, } from "#presentation/http/http-utils";
+export function createGitApiRouter(application) {
+    const router = Router();
+    router.get("/git/status", asyncRoute(async (req, res) => {
+        const root = await resolveRoot(application, req.query.root);
+        res.json(await application.git.status(root));
+    }));
+    router.get("/git/diff", asyncRoute(async (req, res) => {
+        const root = await resolveRoot(application, req.query.root);
+        const filePath = typeof req.query.path === "string" ? req.query.path : undefined;
+        res.json(await application.git.diff(root, filePath));
+    }));
+    router.get("/git/branches", asyncRoute(async (req, res) => {
+        const root = await resolveRoot(application, req.query.root);
+        res.json(await application.git.branches(root));
+    }));
+    router.get("/git/log", asyncRoute(async (req, res) => {
+        const root = await resolveRoot(application, req.query.root);
+        const requested = Number(req.query.limit ?? 30);
+        const limit = Number.isFinite(requested) ? requested : 30;
+        res.json(await application.git.log(root, limit));
+    }));
+    router.post("/git/stage", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        const root = await resolveRoot(application, body.root);
+        const paths = requireStringArray(body.paths, "paths");
+        res.json(await mutate(application, "git.stage", root, { paths }, () => application.git.stage(root, paths)));
+    }));
+    router.post("/git/unstage", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        const root = await resolveRoot(application, body.root);
+        const paths = requireStringArray(body.paths, "paths");
+        res.json(await mutate(application, "git.unstage", root, { paths }, () => application.git.unstage(root, paths)));
+    }));
+    router.post("/git/restore", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        const root = await resolveRoot(application, body.root);
+        const filePath = requireString(body.path, "path");
+        res.json(await mutate(application, "git.restore", root, { path: filePath }, () => application.git.restore(root, filePath)));
+    }));
+    router.post("/git/commit", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        const root = await resolveRoot(application, body.root);
+        const message = requireString(body.message, "message");
+        res.json(await mutate(application, "git.commit", root, { message }, () => application.git.commit(root, message)));
+    }));
+    router.post("/git/branches", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        const root = await resolveRoot(application, body.root);
+        const name = requireString(body.name, "name");
+        res.json(await mutate(application, "git.branch.create", root, { name }, () => application.git.createBranch(root, name)));
+    }));
+    router.post("/git/switch", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        const root = await resolveRoot(application, body.root);
+        const name = requireString(body.name, "name");
+        res.json(await mutate(application, "git.branch.switch", root, { name }, () => application.git.switchBranch(root, name)));
+    }));
+    router.delete("/git/branches", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        const root = await resolveRoot(application, body.root);
+        const name = requireString(body.name, "name");
+        res.json(await mutate(application, "git.branch.delete", root, { name }, () => application.git.deleteBranch(root, name)));
+    }));
+    for (const action of ["fetch", "pull", "push"]) {
+        router.post(`/git/${action}`, asyncRoute(async (req, res) => {
+            const body = bodyRecord(req.body);
+            const root = await resolveRoot(application, body.root);
+            res.json(await mutate(application, `git.${action}`, root, {}, () => application.git[action](root)));
+        }));
+    }
+    return router;
+}
+async function resolveRoot(application, value) {
+    return application.workspaces.resolve(requireString(value, "root"));
+}
+function mutate(application, action, root, input, operation) {
+    return application.operations.run({
+        pluginId: "git",
+        source: "gui",
+        action,
+        input: { root, ...input },
+    }, operation);
+}

package/dist/plugins/web/http/logs-api-router.d.ts

@@ -0,0 +1,3 @@
+import { Router } from "express";
+import type { LogService } from "#core/logging/types";
+export declare function createLogsApiRouter(logs: LogService): Router;

package/dist/plugins/web/http/logs-api-router.js

@@ -0,0 +1,49 @@
+import { Router } from "express";
+import { asyncRoute, boundedIntegerQuery } from "#presentation/http/http-utils";
+const LEVELS = new Set(["debug", "info", "warn", "error"]);
+export function createLogsApiRouter(logs) {
+    const router = Router();
+    router.get("/logs", asyncRoute(async (req, res) => {
+        const limit = boundedIntegerQuery(req.query.limit, 100, 1, 500);
+        const levels = stringSet(req.query.level)?.filter((value) => LEVELS.has(value));
+        const modules = stringSet(req.query.module);
+        res.json(await logs.list({
+            limit,
+            ...(typeof req.query.cursor === "string" && req.query.cursor
+                ? { cursor: req.query.cursor }
+                : {}),
+            ...(levels?.length ? { levels: new Set(levels) } : {}),
+            ...(modules?.length ? { modules: new Set(modules) } : {}),
+        }));
+    }));
+    router.get("/logs/stream", (req, res) => {
+        res.status(200);
+        res.setHeader("Content-Type", "text/event-stream");
+        res.setHeader("Cache-Control", "no-cache, no-transform");
+        res.setHeader("Connection", "keep-alive");
+        res.flushHeaders();
+        res.write(`event: ready\ndata: ${JSON.stringify({ time: new Date().toISOString() })}\n\n`);
+        const unsubscribe = logs.subscribe((record) => {
+            res.write(`event: log\ndata: ${JSON.stringify(record)}\n\n`);
+        });
+        const keepalive = setInterval(() => res.write(": keepalive\n\n"), 15000);
+        keepalive.unref();
+        req.on("close", () => {
+            clearInterval(keepalive);
+            unsubscribe();
+        });
+    });
+    return router;
+}
+function stringSet(value) {
+    const raw = Array.isArray(value)
+        ? value
+        : typeof value === "string"
+            ? [value]
+            : [];
+    const values = raw
+        .flatMap((item) => (typeof item === "string" ? item.split(",") : []))
+        .map((item) => item.trim())
+        .filter(Boolean);
+    return values.length ? [...new Set(values)] : null;
+}

package/dist/plugins/web/http/process-api-router.d.ts

@@ -0,0 +1,3 @@
+import { Router } from "express";
+import type { WebRuntime } from "#plugins/web/runtime";
+export declare function createProcessApiRouter(application: WebRuntime): Router;

package/dist/plugins/web/http/process-api-router.js

@@ -0,0 +1,16 @@
+import { Router } from "express";
+import { asyncRoute, requireString } from "#presentation/http/http-utils";
+export function createProcessApiRouter(application) {
+    const router = Router();
+    router.get("/processes", (_req, res) => res.json(application.listProcesses()));
+    router.get("/processes/:processId", (req, res) => {
+        res.json(application.getProcess(requireString(req.params.processId, "processId")));
+    });
+    router.post("/processes/:processId/terminate", asyncRoute(async (req, res) => {
+        res.json(await application.processKill(requireString(req.params.processId, "processId"), false));
+    }));
+    router.post("/processes/:processId/kill", asyncRoute(async (req, res) => {
+        res.json(await application.processKill(requireString(req.params.processId, "processId"), true));
+    }));
+    return router;
+}

package/dist/plugins/web/http/runtime-api-router.d.ts

@@ -0,0 +1,10 @@
+import { Router } from "express";
+import type { RuntimeEventBus } from "#app/event-bus";
+import type { WebRuntime } from "#plugins/web/runtime";
+interface RuntimeStatus {
+    version: string;
+    mcpRequests: number;
+    uptimeMinutes: number;
+}
+export declare function createRuntimeApiRouter(application: WebRuntime, eventBus: RuntimeEventBus, runtimeStatus: () => RuntimeStatus): Router;
+export {};

package/dist/plugins/web/http/runtime-api-router.js

@@ -0,0 +1,34 @@
+import { Router } from "express";
+import { ChatRoomError } from "#core/errors/chatroom-error";
+import { bodyRecord, requireString } from "#presentation/http/http-utils";
+export function createRuntimeApiRouter(application, eventBus, runtimeStatus) {
+    const router = Router();
+    router.get("/runtime", (_req, res) => res.json(runtimeStatus()));
+    router.get("/mcp/tools", (_req, res) => {
+        res.json(application.mcpTools.list());
+    });
+    router.patch("/mcp/tools/:toolName", (req, res) => {
+        const body = bodyRecord(req.body);
+        if (typeof body.enabled !== "boolean")
+            throw new ChatRoomError("INVALID_INPUT", "enabled must be a boolean");
+        res.json(application.mcpTools.setEnabled(requireString(req.params.toolName, "toolName"), body.enabled));
+    });
+    router.get("/events", (req, res) => {
+        res.status(200);
+        res.setHeader("Content-Type", "text/event-stream");
+        res.setHeader("Cache-Control", "no-cache, no-transform");
+        res.setHeader("Connection", "keep-alive");
+        res.flushHeaders();
+        res.write(`event: ready\ndata: ${JSON.stringify({ time: new Date().toISOString() })}\n\n`);
+        const unsubscribe = eventBus.subscribe((event) => {
+            res.write(`event: runtime\ndata: ${JSON.stringify(event)}\n\n`);
+        });
+        const keepalive = setInterval(() => res.write(": keepalive\n\n"), 15000);
+        keepalive.unref();
+        req.on("close", () => {
+            clearInterval(keepalive);
+            unsubscribe();
+        });
+    });
+    return router;
+}

package/dist/plugins/web/http/workspace-api-router.d.ts

@@ -0,0 +1,3 @@
+import { Router } from "express";
+import type { WebRuntime } from "#plugins/web/runtime";
+export declare function createWorkspaceApiRouter(application: WebRuntime): Router;

package/dist/plugins/web/http/workspace-api-router.js

@@ -0,0 +1,91 @@
+import { Router } from "express";
+import { ChatRoomError } from "#core/errors/chatroom-error";
+import { asyncRoute, bodyRecord, requireString, } from "#presentation/http/http-utils";
+const MAX_WRITE_BYTES = 1024 * 1024;
+export function createWorkspaceApiRouter(application) {
+    const router = Router();
+    router.get("/workspaces", asyncRoute(async (_req, res) => {
+        res.json(await application.workspaces.list());
+    }));
+    router.post("/workspaces", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        const parent = requireString(body.parent, "parent");
+        const name = requireString(body.name, "name");
+        res.json(await application.operations.run({
+            pluginId: "workspace",
+            source: "gui",
+            action: "create",
+            input: { parent, name },
+        }, () => application.workspaces.createProject(parent, name)));
+    }));
+    router.get("/workspace/roots", (_req, res) => {
+        res.json(application.workspaces.roots());
+    });
+    router.get("/workspace", asyncRoute(async (req, res) => {
+        res.json(await application.workspaces.info(requireString(req.query.root, "root")));
+    }));
+    router.get("/workspace/files", asyncRoute(async (req, res) => {
+        const fs = await application.workspaces.fs(requireString(req.query.root, "root"));
+        const filePath = typeof req.query.path === "string" ? req.query.path : ".";
+        res.json(await fs.list(filePath, { recursive: req.query.recursive === "1" }));
+    }));
+    router.get("/workspace/file", asyncRoute(async (req, res) => {
+        const fs = await application.workspaces.fs(requireString(req.query.root, "root"));
+        res.json(await fs.read(requireString(req.query.path, "path"), {
+            maxBytes: 2 * 1024 * 1024,
+        }));
+    }));
+    router.put("/workspace/file", asyncRoute(async (req, res) => {
+        const body = bodyRecord(req.body);
+        const fs = await application.workspaces.fs(requireString(body.root, "root"));
+        const filePath = requireString(body.path, "path");
+        if (typeof body.content !== "string")
+            throw new ChatRoomError("INVALID_INPUT", "content must be a string");
+        const bytes = Buffer.byteLength(body.content, "utf8");
+        if (bytes > MAX_WRITE_BYTES)
+            throw new ChatRoomError("INVALID_INPUT", `File content exceeds ${MAX_WRITE_BYTES} bytes`);
+        res.json(await application.operations.run({
+            pluginId: "workspace",
+            source: "gui",
+            action: "file.write",
+            input: { root: fs.root, path: filePath, bytes },
+        }, () => fs.write(filePath, body.content)));
+    }));
+    router.get("/workspace/file/image", asyncRoute(async (req, res) => {
+        const filePath = requireString(req.query.path, "path");
+        const mime = imageMime(filePath);
+        if (!mime)
+            throw new ChatRoomError("INVALID_INPUT", "File type is not supported for image preview");
+        const fs = await application.workspaces.fs(requireString(req.query.root, "root"));
+        const file = await fs.readBytes(filePath, { maxBytes: 10 * 1024 * 1024 });
+        if (file.truncated)
+            throw new ChatRoomError("INVALID_INPUT", "Image is too large to preview");
+        res.setHeader("Content-Type", mime);
+        res.setHeader("Content-Length", String(file.data.byteLength));
+        res.setHeader("Cache-Control", "no-store");
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        res.send(file.data);
+    }));
+    return router;
+}
+function imageMime(filePath) {
+    switch (filePath.split(".").pop()?.toLowerCase()) {
+        case "png":
+            return "image/png";
+        case "jpg":
+        case "jpeg":
+            return "image/jpeg";
+        case "gif":
+            return "image/gif";
+        case "webp":
+            return "image/webp";
+        case "avif":
+            return "image/avif";
+        case "bmp":
+            return "image/bmp";
+        case "ico":
+            return "image/x-icon";
+        default:
+            return null;
+    }
+}

package/dist/plugins/web/plugin.d.ts

@@ -0,0 +1,8 @@
+import type { InternalPlugin } from "#plugins/types";
+import { WebRuntime } from "./runtime.js";
+interface WebPluginService {
+    application: WebRuntime;
+}
+export declare const WebServiceToken: import("#plugins/types").ServiceToken<WebPluginService>;
+export declare function createWebPlugin(): InternalPlugin;
+export {};

package/dist/plugins/web/plugin.js

@@ -0,0 +1,17 @@
+import { createServiceToken } from "#plugins/types";
+import { ComputerServiceToken } from "#plugins/computer/plugin";
+import { GitServiceToken } from "#plugins/git/plugin";
+import { ProcessService } from "#plugins/process/plugin";
+import { WorkspaceServiceToken } from "#plugins/workspace/plugin";
+import { WebRuntime } from "./runtime.js";
+export const WebServiceToken = createServiceToken("web");
+export function createWebPlugin() {
+    return {
+        id: "web",
+        activate(context) {
+            context.services.provide(WebServiceToken, {
+                application: new WebRuntime(context.services.require(WorkspaceServiceToken), context.services.require(GitServiceToken), context.operations, context.services.require(ProcessService), context.services.require(ComputerServiceToken), context.mcpTools),
+            });
+        },
+    };
+}

package/dist/plugins/web/runtime.d.ts

@@ -0,0 +1,18 @@
+import type { OperationLog } from "#operations/operation-log";
+import type { ComputerService } from "#plugins/computer/computer-service";
+import type { GitService } from "#plugins/git/git-service";
+import type { ProcessSupervisor } from "#plugins/process/process-supervisor";
+import type { WorkspaceService } from "#plugins/workspace/workspace-service";
+import type { McpToolControl } from "#mcp/server/tool-control";
+export declare class WebRuntime {
+    readonly workspaces: WorkspaceService;
+    readonly git: GitService;
+    readonly operations: OperationLog;
+    readonly processes: ProcessSupervisor;
+    readonly computer: ComputerService;
+    readonly mcpTools: McpToolControl;
+    constructor(workspaces: WorkspaceService, git: GitService, operations: OperationLog, processes: ProcessSupervisor, computer: ComputerService, mcpTools: McpToolControl);
+    processKill(processId: string, force?: boolean): Promise<import("./api-types.js").ProcessSnapshot>;
+    listProcesses(): import("./api-types.js").ProcessSummary[];
+    getProcess(processId: string): import("./api-types.js").ProcessSnapshot;
+}