@zhixuan92/multi-model-agent 3.0.0

package/dist/http/handlers/tools/verify.js

@@ -0,0 +1,39 @@
+import * as verify from '@zhixuan92/multi-model-agent-core/tool-schemas/verify';
+import { executeVerify } from '@zhixuan92/multi-model-agent-core/executors/verify';
+import { sendError, sendJson } from '../../errors.js';
+import { asyncDispatch } from '../../async-dispatch.js';
+export function buildVerifyHandler(deps) {
+    return async (_req, res, _params, ctx) => {
+        const parsed = verify.inputSchema.safeParse(ctx.body);
+        if (!parsed.success) {
+            sendError(res, 400, 'invalid_request', 'Request body validation failed', {
+                fieldErrors: parsed.error.flatten(),
+            });
+            return;
+        }
+        const input = parsed.data;
+        const cwd = ctx.cwd;
+        const reserveResult = deps.projectRegistry.reserveProject(cwd);
+        if (!reserveResult.ok) {
+            sendError(res, 503, reserveResult.error, reserveResult.message);
+            return;
+        }
+        const pc = reserveResult.projectContext;
+        pc.lastActivityAt = Date.now();
+        deps.projectRegistry.cancelReservation(cwd);
+        const blockIds = input.contextBlockIds ?? [];
+        const { batchId, statusUrl } = asyncDispatch({
+            tool: 'verify',
+            projectCwd: cwd,
+            blockIds,
+            batchRegistry: deps.batchRegistry,
+            projectContext: pc,
+            deps,
+            executor: async (executionCtx) => {
+                return executeVerify(executionCtx, input);
+            },
+        });
+        sendJson(res, 202, { batchId, statusUrl });
+    };
+}
+//# sourceMappingURL=verify.js.map

package/dist/http/handlers/tools/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../src/http/handlers/tools/verify.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,uDAAuD,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,oDAAoD,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAIxD,MAAM,UAAU,kBAAkB,CAAC,IAAiB;IAClD,OAAO,KAAK,EAAE,IAAqB,EAAE,GAAmB,EAAE,OAA+B,EAAE,GAAG,EAAE,EAAE;QAChG,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,gCAAgC,EAAE;gBACvE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;aACpC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;QAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAI,CAAC;QAErB,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,aAAa,CAAC,cAAc,CAAC;QACxC,EAAE,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAE5C,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC;QAC7C,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;YAC3C,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,GAAG;YACf,QAAQ;YACR,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,cAAc,EAAE,EAAE;YAClB,IAAI;YACJ,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;gBAC/B,OAAO,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC5C,CAAC;SACF,CAAC,CAAC;QAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC;AACJ,CAAC"}

package/dist/http/loopback.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Returns true iff the given address string refers to the loopback interface.
+ * Accepts all forms Node's socket layer surfaces:
+ *   - IPv4 loopback (any 127.0.0.0/8 address): 127.0.0.1, 127.0.1.1, etc.
+ *   - IPv6 loopback: ::1
+ *   - IPv4-mapped IPv6 loopback: ::ffff:127.0.0.1 (and other 127/8 mapped forms)
+ *   - Hostname: localhost
+ */
+export declare function isLoopbackAddress(addr: string | undefined): boolean;
+/**
+ * Returns true iff the request should be rejected because it came from a
+ * non-loopback address on a loopback-only endpoint.
+ *
+ * @param remoteAddress The socket remote address (req.socket?.remoteAddress)
+ */
+export declare function shouldRejectNonLoopback(remoteAddress: string | undefined): boolean;
+//# sourceMappingURL=loopback.d.ts.map

package/dist/http/loopback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.d.ts","sourceRoot":"","sources":["../../src/http/loopback.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAoBnE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAElF"}

package/dist/http/loopback.js

@@ -0,0 +1,43 @@
+import * as net from 'node:net';
+/**
+ * Returns true iff the given address string refers to the loopback interface.
+ * Accepts all forms Node's socket layer surfaces:
+ *   - IPv4 loopback (any 127.0.0.0/8 address): 127.0.0.1, 127.0.1.1, etc.
+ *   - IPv6 loopback: ::1
+ *   - IPv4-mapped IPv6 loopback: ::ffff:127.0.0.1 (and other 127/8 mapped forms)
+ *   - Hostname: localhost
+ */
+export function isLoopbackAddress(addr) {
+    if (!addr)
+        return false;
+    if (addr === 'localhost')
+        return true;
+    // Strip any scope ID (fe80::1%lo0 style) — rare for loopback but cheap to handle.
+    const clean = addr.split('%')[0];
+    const kind = net.isIP(clean);
+    if (kind === 4) {
+        return clean.startsWith('127.');
+    }
+    if (kind === 6) {
+        if (clean === '::1')
+            return true;
+        // IPv4-mapped IPv6: ::ffff:A.B.C.D
+        const mappedPrefix = '::ffff:';
+        if (clean.toLowerCase().startsWith(mappedPrefix)) {
+            const v4 = clean.slice(mappedPrefix.length);
+            return net.isIPv4(v4) && v4.startsWith('127.');
+        }
+        return false;
+    }
+    return false;
+}
+/**
+ * Returns true iff the request should be rejected because it came from a
+ * non-loopback address on a loopback-only endpoint.
+ *
+ * @param remoteAddress The socket remote address (req.socket?.remoteAddress)
+ */
+export function shouldRejectNonLoopback(remoteAddress) {
+    return !isLoopbackAddress(remoteAddress);
+}
+//# sourceMappingURL=loopback.js.map

package/dist/http/loopback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../src/http/loopback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,kFAAkF;IAClF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACjC,mCAAmC;QACnC,MAAM,YAAY,GAAG,SAAS,CAAC;QAC/B,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACjD,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC5C,OAAO,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,aAAiC;IACvE,OAAO,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;AAC3C,CAAC"}

package/dist/http/middleware/body-reader.d.ts

@@ -0,0 +1,16 @@
+import type { IncomingMessage } from 'node:http';
+export type BodyReadResult = {
+    ok: true;
+    body: Buffer;
+} | {
+    ok: false;
+    reason: 'too_large';
+};
+/**
+ * Reads the request body up to `maxBytes`.
+ * If the body exceeds `maxBytes`, drains remaining data and resolves with
+ * { ok: false, reason: 'too_large' } so the server can still send a 413 response
+ * before closing the connection.
+ */
+export declare function readBody(req: IncomingMessage, maxBytes: number): Promise<BodyReadResult>;
+//# sourceMappingURL=body-reader.d.ts.map

package/dist/http/middleware/body-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-reader.d.ts","sourceRoot":"","sources":["../../../src/http/middleware/body-reader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAEvC;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAuCxF"}

package/dist/http/middleware/body-reader.js

@@ -0,0 +1,44 @@
+/**
+ * Reads the request body up to `maxBytes`.
+ * If the body exceeds `maxBytes`, drains remaining data and resolves with
+ * { ok: false, reason: 'too_large' } so the server can still send a 413 response
+ * before closing the connection.
+ */
+export function readBody(req, maxBytes) {
+    return new Promise((resolve) => {
+        const chunks = [];
+        let size = 0;
+        let settled = false;
+        let overflow = false;
+        function settle(result) {
+            if (settled)
+                return;
+            settled = true;
+            resolve(result);
+        }
+        req.on('data', (chunk) => {
+            if (overflow) {
+                // Drain remaining data silently after overflow is detected
+                return;
+            }
+            size += chunk.length;
+            if (size > maxBytes) {
+                overflow = true;
+                // Don't push this chunk; signal overflow and continue draining
+                settle({ ok: false, reason: 'too_large' });
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => {
+            if (!overflow) {
+                settle({ ok: true, body: Buffer.concat(chunks) });
+            }
+            // If overflow, already settled — no-op
+        });
+        req.on('error', () => {
+            settle({ ok: false, reason: 'too_large' });
+        });
+    });
+}
+//# sourceMappingURL=body-reader.js.map

package/dist/http/middleware/body-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-reader.js","sourceRoot":"","sources":["../../../src/http/middleware/body-reader.ts"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAoB,EAAE,QAAgB;IAC7D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,SAAS,MAAM,CAAC,MAAsB;YACpC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;QAED,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,2DAA2D;gBAC3D,OAAO;YACT,CAAC;YACD,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,QAAQ,GAAG,IAAI,CAAC;gBAChB,+DAA+D;gBAC/D,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,uCAAuC;QACzC,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/http/project-registry.d.ts

@@ -0,0 +1,54 @@
+import { type ProjectContext, BatchRegistry } from '@zhixuan92/multi-model-agent-core';
+export type ReserveError = 'project_cap' | 'invalid_cwd' | 'missing_cwd' | 'cwd_not_dir' | 'forbidden_cwd';
+export type ReserveResult = {
+    ok: true;
+    projectContext: ProjectContext;
+    created: boolean;
+} | {
+    ok: false;
+    error: ReserveError;
+    message: string;
+};
+export interface ProjectRegistryOptions {
+    cap: number;
+    idleEvictionMs: number;
+    evictionIntervalMs: number;
+    onProjectCreated?: (cwd: string) => void;
+    onProjectEvicted?: (cwd: string, idleMs: number) => void;
+}
+export declare class ProjectRegistry {
+    private readonly map;
+    private readonly cap;
+    private readonly idleEvictionMs;
+    private readonly evictionIntervalMs;
+    private evictionTimer;
+    private readonly onProjectCreated?;
+    private readonly onProjectEvicted?;
+    constructor(options: ProjectRegistryOptions);
+    startEvictionTimer(): void;
+    stopEvictionTimer(): void;
+    /** Synchronous lookup-or-create with cap enforcement. Increments pendingReservations on success. */
+    reserveProject(cwd: string): ReserveResult;
+    /**
+     * Called from onsessioninitialized. Decrements pendingReservations and registers the session.
+     * `canonicalCwd` MUST be the `.cwd` value returned from a prior `reserveProject` call.
+     */
+    attachSession(canonicalCwd: string, sessionId: string): void;
+    /** Detach a session. `canonicalCwd` must match `projectContext.cwd`. No-op if unknown. */
+    detachSession(canonicalCwd: string, sessionId: string): void;
+    /** Called if attachSession never fires. `canonicalCwd` must match `projectContext.cwd`. */
+    cancelReservation(canonicalCwd: string): void;
+    /** Look up a project by its canonical cwd. */
+    get(canonicalCwd: string): ProjectContext | undefined;
+    get size(): number;
+    entries(): IterableIterator<[string, ProjectContext]>;
+    /**
+     * Returns true if the project context is idle and eligible for eviction.
+     * Gates on: no active HTTP requests, no active batches in the registry,
+     * no active sessions, no pending reservations, and idle for at least idleTimeoutMs.
+     */
+    isIdleFor(pc: ProjectContext, now: number, idleTimeoutMs: number, batchRegistry: BatchRegistry): boolean;
+    evictIdle(batchRegistry?: BatchRegistry): void;
+    clear(): void;
+}
+//# sourceMappingURL=project-registry.d.ts.map

package/dist/http/project-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-registry.d.ts","sourceRoot":"","sources":["../../src/http/project-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,cAAc,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAG7G,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,aAAa,GAAG,aAAa,GAAG,aAAa,GAAG,eAAe,CAAC;AAE3G,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,cAAc,EAAE,cAAc,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1D;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqC;IACzD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,aAAa,CAA+B;IACpD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAwB;IAC1D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAwC;gBAE9D,OAAO,EAAE,sBAAsB;IAQ3C,kBAAkB,IAAI,IAAI;IAM1B,iBAAiB,IAAI,IAAI;IAKzB,oGAAoG;IACpG,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa;IAoB1C;;;OAGG;IACH,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAQ5D,0FAA0F;IAC1F,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAO5D,2FAA2F;IAC3F,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAO7C,8CAA8C;IAC9C,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIrD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAEA,OAAO,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAItD;;;;OAIG;IACH,SAAS,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,GAAG,OAAO;IAUxG,SAAS,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI;IAwB9C,KAAK,IAAI,IAAI;CAQd"}

package/dist/http/project-registry.js

@@ -0,0 +1,132 @@
+import { createProjectContext } from '@zhixuan92/multi-model-agent-core';
+import { validateCwd } from './cwd-validator.js';
+export class ProjectRegistry {
+    map = new Map();
+    cap;
+    idleEvictionMs;
+    evictionIntervalMs;
+    evictionTimer = null;
+    onProjectCreated;
+    onProjectEvicted;
+    constructor(options) {
+        this.cap = options.cap;
+        this.idleEvictionMs = options.idleEvictionMs;
+        this.evictionIntervalMs = options.evictionIntervalMs;
+        this.onProjectCreated = options.onProjectCreated;
+        this.onProjectEvicted = options.onProjectEvicted;
+    }
+    startEvictionTimer() {
+        if (this.evictionTimer)
+            return;
+        this.evictionTimer = setInterval(() => this.evictIdle(), this.evictionIntervalMs);
+        this.evictionTimer.unref?.();
+    }
+    stopEvictionTimer() {
+        if (this.evictionTimer)
+            clearInterval(this.evictionTimer);
+        this.evictionTimer = null;
+    }
+    /** Synchronous lookup-or-create with cap enforcement. Increments pendingReservations on success. */
+    reserveProject(cwd) {
+        const v = validateCwd(cwd);
+        if (!v.ok)
+            return { ok: false, error: v.error, message: v.message };
+        const key = v.canonicalCwd;
+        const existing = this.map.get(key);
+        if (existing) {
+            existing.pendingReservations += 1;
+            existing.lastActivityAt = Date.now();
+            return { ok: true, projectContext: existing, created: false };
+        }
+        if (this.map.size >= this.cap) {
+            return { ok: false, error: 'project_cap', message: `server at ${this.cap} projects; close some connections and retry` };
+        }
+        const pc = createProjectContext(key);
+        pc.pendingReservations = 1;
+        this.map.set(key, pc);
+        this.onProjectCreated?.(key);
+        return { ok: true, projectContext: pc, created: true };
+    }
+    /**
+     * Called from onsessioninitialized. Decrements pendingReservations and registers the session.
+     * `canonicalCwd` MUST be the `.cwd` value returned from a prior `reserveProject` call.
+     */
+    attachSession(canonicalCwd, sessionId) {
+        const pc = this.map.get(canonicalCwd);
+        if (!pc)
+            throw new Error(`attachSession: no project for ${canonicalCwd} (did you pass the raw cwd instead of projectContext.cwd?)`);
+        pc.activeSessions.add(sessionId);
+        if (pc.pendingReservations > 0)
+            pc.pendingReservations -= 1;
+        pc.lastActivityAt = Date.now();
+    }
+    /** Detach a session. `canonicalCwd` must match `projectContext.cwd`. No-op if unknown. */
+    detachSession(canonicalCwd, sessionId) {
+        const pc = this.map.get(canonicalCwd);
+        if (!pc)
+            return;
+        pc.activeSessions.delete(sessionId);
+        pc.lastActivityAt = Date.now();
+    }
+    /** Called if attachSession never fires. `canonicalCwd` must match `projectContext.cwd`. */
+    cancelReservation(canonicalCwd) {
+        const pc = this.map.get(canonicalCwd);
+        if (!pc)
+            return;
+        if (pc.pendingReservations > 0)
+            pc.pendingReservations -= 1;
+        pc.lastActivityAt = Date.now();
+    }
+    /** Look up a project by its canonical cwd. */
+    get(canonicalCwd) {
+        return this.map.get(canonicalCwd);
+    }
+    get size() {
+        return this.map.size;
+    }
+    *entries() {
+        yield* this.map.entries();
+    }
+    /**
+     * Returns true if the project context is idle and eligible for eviction.
+     * Gates on: no active HTTP requests, no active batches in the registry,
+     * no active sessions, no pending reservations, and idle for at least idleTimeoutMs.
+     */
+    isIdleFor(pc, now, idleTimeoutMs, batchRegistry) {
+        return (pc.activeRequests === 0 &&
+            batchRegistry.countActiveForProject(pc.cwd) === 0 &&
+            pc.activeSessions.size === 0 &&
+            pc.pendingReservations === 0 &&
+            (now - pc.lastActivityAt) > idleTimeoutMs);
+    }
+    evictIdle(batchRegistry) {
+        const now = Date.now();
+        const victims = [];
+        for (const [cwd, pc] of this.map.entries()) {
+            if (pc.activeSessions.size === 0 &&
+                pc.activeRequests === 0 &&
+                pc.pendingReservations === 0 &&
+                (batchRegistry === undefined || batchRegistry.countActiveForProject(cwd) === 0) &&
+                now - pc.lastActivityAt > this.idleEvictionMs) {
+                victims.push(cwd);
+            }
+        }
+        for (const cwd of victims) {
+            const pc = this.map.get(cwd);
+            pc.contextBlocks.clear();
+            pc.batchCache.clear();
+            pc.clarifications.clear();
+            this.map.delete(cwd);
+            this.onProjectEvicted?.(cwd, now - pc.lastActivityAt);
+        }
+    }
+    clear() {
+        for (const pc of this.map.values()) {
+            pc.contextBlocks.clear();
+            pc.batchCache.clear();
+            pc.clarifications.clear();
+        }
+        this.map.clear();
+    }
+}
+//# sourceMappingURL=project-registry.js.map

package/dist/http/project-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-registry.js","sourceRoot":"","sources":["../../src/http/project-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAsC,MAAM,mCAAmC,CAAC;AAC7G,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAgBjD,MAAM,OAAO,eAAe;IACT,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAC;IACxC,GAAG,CAAS;IACZ,cAAc,CAAS;IACvB,kBAAkB,CAAS;IACpC,aAAa,GAA0B,IAAI,CAAC;IACnC,gBAAgB,CAAyB;IACzC,gBAAgB,CAAyC;IAE1E,YAAY,OAA+B;QACzC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACnD,CAAC;IAED,kBAAkB;QAChB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO;QAC/B,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAClF,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;IAC/B,CAAC;IAED,iBAAiB;QACf,IAAI,IAAI,CAAC,aAAa;YAAE,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;IAC5B,CAAC;IAED,oGAAoG;IACpG,cAAc,CAAC,GAAW;QACxB,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACpE,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,mBAAmB,IAAI,CAAC,CAAC;YAClC,QAAQ,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,CAAC,GAAG,6CAA6C,EAAE,CAAC;QAC1H,CAAC;QACD,MAAM,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACrC,EAAE,CAAC,mBAAmB,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtB,IAAI,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,YAAoB,EAAE,SAAiB;QACnD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,YAAY,4DAA4D,CAAC,CAAC;QACpI,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC,mBAAmB,GAAG,CAAC;YAAE,EAAE,CAAC,mBAAmB,IAAI,CAAC,CAAC;QAC5D,EAAE,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACjC,CAAC;IAED,0FAA0F;IAC1F,aAAa,CAAC,YAAoB,EAAE,SAAiB;QACnD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACpC,EAAE,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACjC,CAAC;IAED,2FAA2F;IAC3F,iBAAiB,CAAC,YAAoB;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,IAAI,EAAE,CAAC,mBAAmB,GAAG,CAAC;YAAE,EAAE,CAAC,mBAAmB,IAAI,CAAC,CAAC;QAC5D,EAAE,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACjC,CAAC;IAED,8CAA8C;IAC9C,GAAG,CAAC,YAAoB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,CAAC,OAAO;QACN,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,EAAkB,EAAE,GAAW,EAAE,aAAqB,EAAE,aAA4B;QAC5F,OAAO,CACL,EAAE,CAAC,cAAc,KAAK,CAAC;YACvB,aAAa,CAAC,qBAAqB,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;YACjD,EAAE,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC;YAC5B,EAAE,CAAC,mBAAmB,KAAK,CAAC;YAC5B,CAAC,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,aAAa,CAC1C,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,aAA6B;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3C,IACE,EAAE,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC;gBAC5B,EAAE,CAAC,cAAc,KAAK,CAAC;gBACvB,EAAE,CAAC,mBAAmB,KAAK,CAAC;gBAC5B,CAAC,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC/E,GAAG,GAAG,EAAE,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,EAC7C,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAC9B,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;YACzB,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,KAAK;QACH,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACnC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;YACzB,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;CACF"}

package/dist/http/router.d.ts

@@ -0,0 +1,14 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { RequestContext } from './types.js';
+export type RawHandler = (req: IncomingMessage, res: ServerResponse, params: Record<string, string>, ctx: RequestContext) => Promise<void> | void;
+export declare class Router {
+    private routes;
+    register(method: string, path: string, handler: RawHandler): void;
+    match(method: string, url: string): {
+        handler: RawHandler;
+        params: Record<string, string>;
+    } | null;
+    /** Returns all HTTP methods registered for routes that match the given url pathname. */
+    methodsFor(url: string): string[];
+}
+//# sourceMappingURL=router.d.ts.map

package/dist/http/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/http/router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAQlJ,qBAAa,MAAM;IACjB,OAAO,CAAC,MAAM,CAA8C;IAE5D,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI;IAWjE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI;IAalG,wFAAwF;IACxF,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE;CAalC"}

package/dist/http/router.js

@@ -0,0 +1,41 @@
+export class Router {
+    routes = new Map();
+    register(method, path, handler) {
+        const paramNames = [];
+        const regexStr = path.replace(/:(\w+)/g, (_, name) => {
+            paramNames.push(name);
+            return '([^/]+)';
+        });
+        const regex = new RegExp('^' + regexStr + '$');
+        if (!this.routes.has(method))
+            this.routes.set(method, new Map());
+        this.routes.get(method).set(path, { handler, paramNames, regex });
+    }
+    match(method, url) {
+        const pathname = url.split('?')[0];
+        for (const [, entry] of this.routes.get(method) ?? new Map()) {
+            const m = pathname.match(entry.regex);
+            if (m) {
+                const params = {};
+                entry.paramNames.forEach((n, i) => { params[n] = m[i + 1]; });
+                return { handler: entry.handler, params };
+            }
+        }
+        return null;
+    }
+    /** Returns all HTTP methods registered for routes that match the given url pathname. */
+    methodsFor(url) {
+        const pathname = url.split('?')[0];
+        const methods = [];
+        for (const [method, entries] of this.routes) {
+            for (const [, entry] of entries) {
+                if (entry.regex.test(pathname)) {
+                    methods.push(method);
+                    break;
+                }
+            }
+        }
+        return methods;
+    }
+}
+//# sourceMappingURL=router.js.map

package/dist/http/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/http/router.ts"],"names":[],"mappings":"AAWA,MAAM,OAAO,MAAM;IACT,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAC;IAE5D,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAE,OAAmB;QACxD,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE;YAC3D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,QAAQ,GAAG,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,MAAc,EAAE,GAAW;QAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAsB,EAAE,CAAC;YACjF,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,EAAE,CAAC;gBACN,MAAM,MAAM,GAA2B,EAAE,CAAC;gBAC1C,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wFAAwF;IACxF,UAAU,CAAC,GAAW;QACpB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBAChC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/http/server.d.ts

@@ -0,0 +1,16 @@
+import type { ServerConfig, BatchRegistry } from '@zhixuan92/multi-model-agent-core';
+import type { ProjectRegistry } from './project-registry.js';
+export interface RunningServer {
+    port: number;
+    /** The resolved address the server is bound to. Used by CLI to log the actual listen address. */
+    serverAddress: string | null;
+    stop(): Promise<void>;
+    /** Shared BatchRegistry — exposed for testing and introspection handlers. */
+    batchRegistry: BatchRegistry;
+    /** Shared ProjectRegistry — exposed for testing and introspection handlers. */
+    projectRegistry: ProjectRegistry;
+    /** Wall-clock ms when the server finished starting (Date.now()). Used for uptimeMs in /status. */
+    serverStartedAt: number;
+}
+export declare function startServer(config: ServerConfig): Promise<RunningServer>;
+//# sourceMappingURL=server.d.ts.map

package/dist/http/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAQrF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAiB7D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,iGAAiG;IACjG,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,6EAA6E;IAC7E,aAAa,EAAE,aAAa,CAAC;IAC7B,+EAA+E;IAC/E,eAAe,EAAE,eAAe,CAAC;IACjC,kGAAkG;IAClG,eAAe,EAAE,MAAM,CAAC;CACzB;AA4FD,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAmE9E"}