agent-board-runner 0.1.0

package/dist/index.js

@@ -0,0 +1,2133 @@
+// src/index.ts
+import { config as loadEnv } from "dotenv";
+
+// src/runner.ts
+import { createServer } from "node:http";
+
+// src/auth.ts
+import { createClient } from "@supabase/supabase-js";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+import open from "open";
+
+// src/config.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { hostname, homedir } from "node:os";
+import { join, resolve } from "node:path";
+var CONFIG_DIR = join(homedir(), ".agent-board");
+var CONFIG_FILE = join(CONFIG_DIR, "credentials.json");
+function loadConfig() {
+  if (!existsSync(CONFIG_FILE)) return null;
+  return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
+}
+function saveConfig(config) {
+  if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true });
+  writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), "utf-8");
+}
+function applyAllowedRoot(config, explicitPath) {
+  const raw = explicitPath ?? process.env.AGENT_BOARD_ALLOWED_ROOT;
+  if (!raw) return config;
+  const resolved = resolve(raw);
+  if (config.allowedRootPath === resolved) return config;
+  config.allowedRootPath = resolved;
+  saveConfig(config);
+  return config;
+}
+function applyRunnerName(config) {
+  const name = process.env.AGENT_BOARD_RUNNER_NAME ?? hostname();
+  if (config.runnerName === name) return config;
+  config.runnerName = name;
+  saveConfig(config);
+  return config;
+}
+function resolveRepoPath(config, relativeRepoPath) {
+  if (!config.allowedRootPath) {
+    throw new Error("Runner has no repos root configured (AGENT_BOARD_ALLOWED_ROOT or `start --path`).");
+  }
+  return resolve(config.allowedRootPath, relativeRepoPath);
+}
+
+// src/auth.ts
+var SESSION_FILE = join2(CONFIG_DIR, "session.json");
+var DEFAULT_SUPABASE_URL = "https://brpxshvnmxgkbffgdfcc.supabase.co";
+var DEFAULT_SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImJycHhzaHZubXhna2JmZmdkZmNjIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODc1OTQwMTEsImV4cCI6MjEwMzE3MDAxMX0.ErsAGZysLFgNvijetR7w1YvIziXC-1D2sx04Hm2UW9c";
+function resolveSupabaseUrl() {
+  return process.env.AGENT_BOARD_SUPABASE_URL ?? DEFAULT_SUPABASE_URL;
+}
+function resolveSupabaseAnonKey() {
+  return process.env.AGENT_BOARD_SUPABASE_ANON_KEY ?? DEFAULT_SUPABASE_ANON_KEY;
+}
+function readSessionFile() {
+  if (!existsSync2(SESSION_FILE)) return {};
+  try {
+    return JSON.parse(readFileSync2(SESSION_FILE, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+var fileStorage = {
+  getItem(key) {
+    return readSessionFile()[key] ?? null;
+  },
+  setItem(key, value) {
+    if (!existsSync2(CONFIG_DIR)) mkdirSync2(CONFIG_DIR, { recursive: true });
+    const all = readSessionFile();
+    all[key] = value;
+    writeFileSync2(SESSION_FILE, JSON.stringify(all), "utf-8");
+  },
+  removeItem(key) {
+    const all = readSessionFile();
+    delete all[key];
+    writeFileSync2(SESSION_FILE, JSON.stringify(all), "utf-8");
+  }
+};
+function createAuthedSupabaseClient() {
+  return createClient(resolveSupabaseUrl(), resolveSupabaseAnonKey(), {
+    db: { schema: "agent_board" },
+    auth: {
+      storage: fileStorage,
+      persistSession: true,
+      autoRefreshToken: true,
+      detectSessionInUrl: false,
+      flowType: "pkce"
+    }
+  });
+}
+async function getSession(supabase) {
+  const { data } = await supabase.auth.getSession();
+  return data.session;
+}
+async function requireSession(supabase) {
+  const session = await getSession(supabase);
+  if (!session) {
+    throw new Error('Not logged in. Run "agent-board-runner login" first.');
+  }
+  return session;
+}
+
+// src/deploy.ts
+import { join as join6 } from "node:path";
+
+// src/devServer.ts
+import { spawn as spawn2 } from "node:child_process";
+
+// src/cloudflared.ts
+import { spawn } from "node:child_process";
+import { accessSync, constants } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { delimiter, join as join3 } from "node:path";
+import { bin as bundledBinaryPath, install as downloadCloudflared } from "cloudflared";
+
+// src/logger.ts
+var ANSI = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  cyan: "\x1B[36m",
+  yellow: "\x1B[33m",
+  red: "\x1B[31m",
+  gray: "\x1B[90m",
+  blue: "\x1B[34m",
+  green: "\x1B[32m"
+};
+var LEVEL_COLOR = {
+  INF: ANSI.cyan,
+  WAR: ANSI.yellow,
+  ERR: ANSI.red,
+  DEB: ANSI.gray
+};
+var KIND_COLOR = {
+  RUNNER: ANSI.blue,
+  CARD: ANSI.green
+};
+var useColor = process.stdout.isTTY;
+function paint(text, ...codes) {
+  return useColor ? `${codes.join("")}${text}${ANSI.reset}` : text;
+}
+function pad2(value) {
+  return value.toString().padStart(2, "0");
+}
+function timestamp() {
+  const now = /* @__PURE__ */ new Date();
+  const date = `${pad2(now.getDate())}-${pad2(now.getMonth() + 1)}-${now.getFullYear()}`;
+  const time = `${pad2(now.getHours())}:${pad2(now.getMinutes())}:${pad2(now.getSeconds())}`;
+  return `${date} ${time}`;
+}
+function emit(level, kind, id, message, extra) {
+  const stream = level === "ERR" ? console.error : level === "WAR" ? console.warn : console.log;
+  const prefix = [
+    paint(`[${timestamp()}]`, ANSI.dim),
+    paint(`[${level}]`, ANSI.bold, LEVEL_COLOR[level]),
+    paint(`[${kind}]`, ANSI.bold, KIND_COLOR[kind]),
+    paint(`[${id}]`, ANSI.dim)
+  ].join(" ");
+  stream(`${prefix} ${message}`, ...extra);
+}
+function scoped(kind) {
+  return {
+    info: (id, message, ...extra) => emit("INF", kind, id, message, extra),
+    warn: (id, message, ...extra) => emit("WAR", kind, id, message, extra),
+    error: (id, message, ...extra) => emit("ERR", kind, id, message, extra),
+    debug: (id, message, ...extra) => emit("DEB", kind, id, message, extra)
+  };
+}
+var logger = {
+  runner: scoped("RUNNER"),
+  card: scoped("CARD")
+};
+
+// src/cloudflared.ts
+var TRYCLOUDFLARE_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
+var STARTUP_TIMEOUT_MS = 2e4;
+var IS_WINDOWS = process.platform === "win32";
+var BINARY_NAME = IS_WINDOWS ? "cloudflared.exe" : "cloudflared";
+var CLOUDFLARED_INSTALL_DOCS_URL = "https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/";
+function wellKnownDirectories() {
+  const home = homedir2();
+  if (IS_WINDOWS) {
+    const candidates = [
+      process.env.ProgramFiles && join3(process.env.ProgramFiles, "cloudflared"),
+      process.env["ProgramFiles(x86)"] && join3(process.env["ProgramFiles(x86)"], "cloudflared"),
+      process.env.LOCALAPPDATA && join3(process.env.LOCALAPPDATA, "Microsoft", "WinGet", "Links"),
+      join3(home, "scoop", "shims"),
+      process.env.ChocolateyInstall && join3(process.env.ChocolateyInstall, "bin")
+    ];
+    return candidates.filter((dir) => Boolean(dir));
+  }
+  return ["/usr/local/bin", "/usr/bin", "/opt/homebrew/bin", join3(home, ".local", "bin")];
+}
+function pathDirectories() {
+  return (process.env.PATH ?? "").split(delimiter).map((dir) => dir.trim().replace(/^"|"$/g, "")).filter(Boolean);
+}
+function isExecutableFile(path) {
+  try {
+    accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function findInstalledBinary() {
+  const override = process.env.AGENT_BOARD_CLOUDFLARED_PATH;
+  const directories = [...pathDirectories(), ...wellKnownDirectories()];
+  const candidates = [...override ? [override] : [], ...directories.map((dir) => join3(dir, BINARY_NAME))];
+  return candidates.find(isExecutableFile) ?? null;
+}
+async function locateCloudflared() {
+  const installed = findInstalledBinary();
+  if (installed) return installed;
+  if (isExecutableFile(bundledBinaryPath)) return bundledBinaryPath;
+  try {
+    logger.runner.info("CLOUDFLARE", "Downloading the cloudflared binary (first run only)...");
+    return await downloadCloudflared(bundledBinaryPath);
+  } catch (err) {
+    logger.runner.error("CLOUDFLARE", `Failed to download cloudflared. Install it manually: ${CLOUDFLARED_INSTALL_DOCS_URL}`, err);
+    return null;
+  }
+}
+var lookup = null;
+function resolveCloudflaredPath() {
+  lookup ??= locateCloudflared().then((path) => {
+    if (!path) lookup = null;
+    return path;
+  });
+  return lookup;
+}
+async function startQuickTunnel(label, port) {
+  const executable = await resolveCloudflaredPath();
+  if (!executable) {
+    logger.runner.error("CLOUDFLARE", `No cloudflared binary available, so ${label} cannot be exposed.`);
+    return null;
+  }
+  return new Promise((resolve4) => {
+    let child2;
+    try {
+      child2 = spawn(executable, [
+        "tunnel",
+        "--url",
+        `http://localhost:${port}`,
+        "--http-host-header",
+        `localhost:${port}`
+      ]);
+    } catch (err) {
+      logger.runner.error("CLOUDFLARE", `Failed to spawn cloudflared for ${label}:`, err);
+      resolve4(null);
+      return;
+    }
+    let settled = false;
+    const settle = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve4(value);
+    };
+    const timer = setTimeout(() => {
+      logger.runner.warn("CLOUDFLARE", `cloudflared for ${label} did not print a trycloudflare.com URL within ${STARTUP_TIMEOUT_MS}ms.`);
+      settle(null);
+    }, STARTUP_TIMEOUT_MS);
+    const onOutput = (chunk) => {
+      if (settled) return;
+      const match = chunk.toString("utf-8").match(TRYCLOUDFLARE_URL_RE);
+      if (match) settle({ url: match[0], child: child2 });
+    };
+    child2.stdout?.on("data", onOutput);
+    child2.stderr?.on("data", onOutput);
+    child2.on("error", (err) => {
+      logger.runner.error("CLOUDFLARE", `cloudflared process error for ${label} (${executable}):`, err);
+      settle(null);
+    });
+    child2.on("exit", (code) => {
+      logger.runner.info("CLOUDFLARE", `cloudflared tunnel for ${label} exited (code ${code}).`);
+      settle(null);
+    });
+  });
+}
+function toTunnelHostname(url) {
+  return new URL(url).host;
+}
+
+// src/devServer.ts
+var STARTUP_TIMEOUT_MS2 = 45e3;
+var IS_WINDOWS2 = process.platform === "win32";
+var LOCAL_URL_PORT_RE = /https?:\/\/(?:localhost|127\.0\.0\.1|\[::1\]|0\.0\.0\.0):(\d{2,5})/i;
+var GENERIC_PORT_RE = /(?:listening|running|server).{0,40}?:?\s*(\d{4,5})\b/i;
+var ANSI_ESCAPE_RE = /\x1b\[[0-9;]*m/g;
+function detectPortFromOutput(chunk) {
+  const clean = chunk.replace(ANSI_ESCAPE_RE, "");
+  const match = LOCAL_URL_PORT_RE.exec(clean) ?? GENERIC_PORT_RE.exec(clean);
+  return match ? Number(match[1]) : null;
+}
+function killProcessTree(child2) {
+  if (child2.pid == null) return;
+  if (IS_WINDOWS2) {
+    spawn2("taskkill", ["/pid", String(child2.pid), "/t", "/f"], { stdio: "ignore" });
+  } else {
+    child2.kill();
+  }
+}
+var previews = /* @__PURE__ */ new Map();
+function ensurePreview(key, label, cwd, command, cardId) {
+  const existing = previews.get(key);
+  if (existing) {
+    existing.cardIds.add(cardId);
+    return existing.result;
+  }
+  let child2;
+  try {
+    child2 = spawn2(command, { cwd, shell: true, windowsHide: true });
+  } catch (err) {
+    logger.runner.error("DEV_SERVER", `Failed to spawn "${command}" in ${cwd}:`, err);
+    return Promise.resolve(null);
+  }
+  const entry = { child: child2, tunnelChild: null, cardIds: /* @__PURE__ */ new Set([cardId]), result: null };
+  entry.result = new Promise((resolve4) => {
+    let settled = false;
+    const settle = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (!value) {
+        killProcessTree(child2);
+        previews.delete(key);
+      }
+      resolve4(value);
+    };
+    const timer = setTimeout(() => {
+      logger.runner.warn("DEV_SERVER", `"${command}" in ${cwd} did not reveal a port within ${STARTUP_TIMEOUT_MS2}ms.`);
+      settle(null);
+    }, STARTUP_TIMEOUT_MS2);
+    const onOutput = async (chunk) => {
+      if (settled) return;
+      const port = detectPortFromOutput(chunk.toString("utf-8"));
+      if (port == null) return;
+      settled = true;
+      clearTimeout(timer);
+      const tunnel = await startQuickTunnel(`dev server ${key}`, port);
+      if (!tunnel) {
+        logger.runner.warn("DEV_SERVER", `Detected port ${port} for ${key} but cloudflared could not tunnel it.`);
+        killProcessTree(child2);
+        previews.delete(key);
+        resolve4(null);
+        return;
+      }
+      entry.tunnelChild = tunnel.child;
+      logger.runner.info("DEV_SERVER", `${key} is up on port ${port}, tunneled at ${tunnel.url}.`);
+      resolve4({ label, url: tunnel.url });
+    };
+    child2.stdout?.on("data", onOutput);
+    child2.stderr?.on("data", onOutput);
+    child2.on("error", (err) => {
+      logger.runner.error("DEV_SERVER", `Dev server process error for ${key} (${command} in ${cwd}):`, err);
+      settle(null);
+    });
+    child2.on("exit", (code) => {
+      logger.runner.info("DEV_SERVER", `Dev server for ${key} exited (code ${code}) before/without a usable preview.`);
+      settle(null);
+    });
+  });
+  previews.set(key, entry);
+  return entry.result;
+}
+function releaseCard(cardId) {
+  for (const [key, entry] of previews) {
+    if (!entry.cardIds.delete(cardId)) continue;
+    if (entry.cardIds.size > 0) continue;
+    killProcessTree(entry.child);
+    entry.tunnelChild?.kill();
+    previews.delete(key);
+  }
+}
+function stopProjectPreviews(projectId) {
+  const prefix = `${projectId}:`;
+  for (const [key, entry] of previews) {
+    if (!key.startsWith(prefix)) continue;
+    killProcessTree(entry.child);
+    entry.tunnelChild?.kill();
+    previews.delete(key);
+  }
+}
+function stopAll() {
+  for (const key of [...previews.keys()]) {
+    const entry = previews.get(key);
+    if (!entry) continue;
+    killProcessTree(entry.child);
+    entry.tunnelChild?.kill();
+    previews.delete(key);
+  }
+}
+
+// src/git.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+async function pushBranchToMain(repoPath) {
+  try {
+    await execFileAsync("git", ["push", "origin", "HEAD:main"], { cwd: repoPath });
+    return { ok: true };
+  } catch (err) {
+    const stderr = err.stderr;
+    const error = stderr?.trim() || (err instanceof Error ? err.message : String(err));
+    return { ok: false, error };
+  }
+}
+
+// src/orchestrator.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+
+// src/agentActivity.ts
+var RECENT_WINDOW_MS = 6e3;
+var IDLE_AFTER_MS = 45e3;
+var EVAL_INTERVAL_MS = 2e3;
+var ANSI_PATTERN = /\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g;
+var BOX_DRAWING_PATTERN = /[─-╿]/g;
+var WORKING_PATTERN = /esc to interrupt/i;
+var USAGE_LIMIT_PATTERN = /(usage limit reached|limit reached[^\n]{0,60}resets|reached your (?:usage|session) limit|out of (?:weekly|session) (?:usage|limit))/i;
+var PLAN_APPROVAL_PATTERN = /would you like to proceed\??/i;
+var USER_PROMPT_PATTERNS = [
+  /do you want to\b/i,
+  /would you like to\b/i,
+  /do you trust the files\b/i,
+  /press enter to continue/i,
+  /\(y\/n\)/i,
+  /❯\s*1\.\s/
+];
+function normalizeTerminalOutput(raw) {
+  return raw.replace(ANSI_PATTERN, "").replace(BOX_DRAWING_PATTERN, " ").replace(/[ \t]+/g, " ");
+}
+function classifyAgentOutput(recentOutput, options) {
+  if (WORKING_PATTERN.test(recentOutput)) return "implementing";
+  if (options.usageLimited) return "usage_limited";
+  if (options.planApprovalPending) return "waiting_plan_approval";
+  if (USER_PROMPT_PATTERNS.some((pattern) => pattern.test(recentOutput))) return "waiting_user";
+  if (options.silentForMs >= IDLE_AFTER_MS) return "waiting_user";
+  return options.previous;
+}
+var AgentActivityWatcher = class {
+  constructor(onChange) {
+    this.onChange = onChange;
+    this.timer = setInterval(() => this.evaluate(), EVAL_INTERVAL_MS);
+    this.timer.unref();
+  }
+  chunks = [];
+  state = "implementing";
+  lastOutputAt = Date.now();
+  usageLimited = false;
+  planApprovalPending = false;
+  timer;
+  push(chunk) {
+    const now = Date.now();
+    const text = normalizeTerminalOutput(chunk);
+    this.lastOutputAt = now;
+    this.chunks.push({ at: now, text });
+    if (USAGE_LIMIT_PATTERN.test(text)) this.usageLimited = true;
+    if (PLAN_APPROVAL_PATTERN.test(text)) this.planApprovalPending = true;
+    if (WORKING_PATTERN.test(text)) {
+      this.usageLimited = false;
+      this.planApprovalPending = false;
+    }
+    this.evaluate(now);
+  }
+  stop() {
+    clearInterval(this.timer);
+  }
+  evaluate(now = Date.now()) {
+    while (this.chunks.length > 0 && now - this.chunks[0].at > RECENT_WINDOW_MS) this.chunks.shift();
+    const next = classifyAgentOutput(this.chunks.map((chunk) => chunk.text).join(""), {
+      silentForMs: now - this.lastOutputAt,
+      usageLimited: this.usageLimited,
+      planApprovalPending: this.planApprovalPending,
+      previous: this.state
+    });
+    if (next === this.state) return;
+    this.state = next;
+    this.onChange(next);
+  }
+};
+
+// src/agentSession.ts
+import { randomUUID } from "node:crypto";
+import { spawn as spawn3 } from "node-pty";
+
+// src/sessionName.ts
+var MAX_LENGTH = 60;
+var FALLBACK_NAME = "card";
+function toSessionName(title) {
+  const slug = title.normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  if (slug.length === 0) return FALLBACK_NAME;
+  if (slug.length <= MAX_LENGTH) return slug;
+  const truncated = slug.slice(0, MAX_LENGTH);
+  const lastHyphen = truncated.lastIndexOf("-");
+  return (lastHyphen > 0 ? truncated.slice(0, lastHyphen) : truncated).replace(/-+$/, "");
+}
+
+// src/statuslineScript.ts
+import { writeFileSync as writeFileSync3 } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join4 } from "node:path";
+var CLAUDE_BINARY = process.platform === "win32" ? "claude.exe" : "claude";
+var STATUSLINE_SCRIPT_PATH = join4(tmpdir(), "agent-board-statusline.cjs");
+var SCRIPT_SOURCE = `#!/usr/bin/env node
+"use strict";
+const http = require("node:http");
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let raw = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => { raw += chunk; });
+    process.stdin.on("end", () => resolve(raw));
+    process.stdin.on("error", () => resolve(raw));
+  });
+}
+
+function formatPercent(value) {
+  return typeof value === "number" ? \`\${Math.round(value)}%\` : "?";
+}
+
+function buildDisplayText(data) {
+  const rateLimits = data && data.rate_limits;
+  if (!rateLimits) return "";
+  const parts = [];
+  if (rateLimits.five_hour) parts.push(\`5h \${formatPercent(rateLimits.five_hour.used_percentage)}\`);
+  if (rateLimits.seven_day) parts.push(\`7d \${formatPercent(rateLimits.seven_day.used_percentage)}\`);
+  return parts.join(" \xB7 ");
+}
+
+function reportToRunner(sessionId, ticket, port, rateLimits) {
+  return new Promise((resolve) => {
+    try {
+      const body = JSON.stringify({ sessionId, ticket, fiveHour: rateLimits.five_hour, sevenDay: rateLimits.seven_day });
+      const req = http.request(
+        {
+          host: "127.0.0.1",
+          port,
+          path: "/statusline",
+          method: "POST",
+          headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) },
+          timeout: 1000,
+        },
+        (res) => {
+          res.resume();
+          resolve();
+        },
+      );
+      req.on("error", () => resolve());
+      req.on("timeout", () => { req.destroy(); resolve(); });
+      req.end(body);
+    } catch {
+      resolve();
+    }
+  });
+}
+
+(async () => {
+  try {
+    const raw = await readStdin();
+    const data = JSON.parse(raw);
+    process.stdout.write(buildDisplayText(data));
+
+    const sessionId = process.env.AGENT_BOARD_SESSION_ID;
+    const ticket = process.env.AGENT_BOARD_STATUSLINE_TICKET;
+    const port = Number(process.env.AGENT_BOARD_STATUSLINE_PORT);
+    if (sessionId && ticket && port && data && data.rate_limits) {
+      await reportToRunner(sessionId, ticket, port, data.rate_limits);
+    }
+  } catch {
+    // Never let a malformed/unexpected payload break the status line itself.
+  }
+  process.exit(0);
+})();
+`;
+function ensureStatuslineScriptWritten() {
+  writeFileSync3(STATUSLINE_SCRIPT_PATH, SCRIPT_SOURCE, { mode: 493 });
+  logger.runner.info("STATUSLINE", `Status line script written to ${STATUSLINE_SCRIPT_PATH}.`);
+}
+function statuslineSettingsArgs() {
+  return [
+    "--settings",
+    JSON.stringify({
+      statusLine: {
+        type: "command",
+        command: `${JSON.stringify(process.execPath)} ${JSON.stringify(STATUSLINE_SCRIPT_PATH)}`
+      }
+    })
+  ];
+}
+function statuslineEnv(sessionId, ticket) {
+  return {
+    ...process.env,
+    AGENT_BOARD_SESSION_ID: sessionId,
+    AGENT_BOARD_STATUSLINE_TICKET: ticket,
+    AGENT_BOARD_STATUSLINE_PORT: String(process.env.AGENT_BOARD_TERMINAL_PORT ?? 8787),
+    // The Claude CLI itself (not our code) occasionally logs Node's DEP0169 url.parse()
+    // deprecation warning into the pty, which shows up in the card terminal looking like
+    // it came from the runner. --no-deprecation only reaches this child process's Node
+    // runtime, appended so it doesn't clobber a NODE_OPTIONS the user already has set.
+    NODE_OPTIONS: [process.env.NODE_OPTIONS, "--no-deprecation"].filter(Boolean).join(" ")
+  };
+}
+
+// src/agentSession.ts
+var TUI_IDLE_MS = 1500;
+var TUI_READY_TIMEOUT_MS = 6e4;
+var SUBMIT_DELAY_MS = 150;
+var PASTE_START = "\x1B[200~";
+var PASTE_END = "\x1B[201~";
+var SHIFT_TAB = "\x1B[Z";
+var SHIFT_TAB_PRESSES_TO_PLAN_MODE = 4;
+var SHIFT_TAB_DELAY_MS = 400;
+var PLAN_MODE_INDICATOR = /plan mode on/i;
+function spawnAgentPty(repoPath, cardId, cardTitle, instructions, sessionId, ticket, planFirst) {
+  const claudeSessionId = randomUUID();
+  const pty = spawn3(
+    CLAUDE_BINARY,
+    [
+      "--dangerously-skip-permissions",
+      "--model",
+      "claude-sonnet-5",
+      "--session-id",
+      claudeSessionId,
+      ...statuslineSettingsArgs(),
+      `/rename ${toSessionName(cardTitle)}`
+    ],
+    {
+      name: "xterm-color",
+      cols: 120,
+      rows: 32,
+      cwd: repoPath,
+      env: statuslineEnv(sessionId, ticket)
+    }
+  );
+  sendMessageWhenIdle(pty, cardId, instructions, planFirst);
+  return { pty, claudeSessionId };
+}
+function sendMessageWhenIdle(pty, cardId, message, planFirst) {
+  let idleTimer;
+  let deadlineTimer;
+  let dataSubscription;
+  let settled = false;
+  const stopWaiting = () => {
+    if (settled) return false;
+    settled = true;
+    clearTimeout(idleTimer);
+    clearTimeout(deadlineTimer);
+    dataSubscription?.dispose();
+    return true;
+  };
+  const send = async () => {
+    if (!stopWaiting()) return;
+    if (planFirst) await enterPlanMode(pty, cardId);
+    try {
+      pty.write(`${PASTE_START}${message}${PASTE_END}`);
+      setTimeout(() => {
+        try {
+          pty.write("\r");
+        } catch (err) {
+          logger.card.error(cardId, "Failed to submit the card instructions to the agent:", err);
+        }
+      }, SUBMIT_DELAY_MS);
+    } catch (err) {
+      logger.card.error(cardId, "Failed to send the card instructions to the agent:", err);
+    }
+  };
+  deadlineTimer = setTimeout(send, TUI_READY_TIMEOUT_MS);
+  dataSubscription = pty.onData(() => {
+    clearTimeout(idleTimer);
+    idleTimer = setTimeout(send, TUI_IDLE_MS);
+  });
+  pty.onExit(() => stopWaiting());
+}
+async function enterPlanMode(pty, cardId) {
+  let recentOutput = "";
+  const subscription = pty.onData((chunk) => {
+    recentOutput += normalizeTerminalOutput(chunk);
+  });
+  try {
+    for (let attempt = 1; attempt <= SHIFT_TAB_PRESSES_TO_PLAN_MODE; attempt++) {
+      pty.write(SHIFT_TAB);
+      await new Promise((resolve4) => setTimeout(resolve4, SHIFT_TAB_DELAY_MS));
+    }
+    if (!PLAN_MODE_INDICATOR.test(recentOutput)) {
+      logger.card.warn(
+        cardId,
+        `Sent ${SHIFT_TAB_PRESSES_TO_PLAN_MODE} Shift+Tab presses but never saw the plan-mode indicator \u2014 the session may not actually be in Plan Mode.`
+      );
+    }
+  } catch (err) {
+    logger.card.error(cardId, "Failed to switch the session into Plan Mode:", err);
+  } finally {
+    subscription.dispose();
+  }
+}
+function sendContinue(pty, cardId) {
+  try {
+    pty.write(`${PASTE_START}continue${PASTE_END}`);
+    setTimeout(() => {
+      try {
+        pty.write("\r");
+      } catch (err) {
+        logger.card.error(cardId, 'Failed to submit the auto-resume "continue" message:', err);
+      }
+    }, SUBMIT_DELAY_MS);
+  } catch (err) {
+    logger.card.error(cardId, 'Failed to send the auto-resume "continue" message:', err);
+  }
+}
+function resumeAgentPty(repoPath, claudeSessionId, sessionId, ticket) {
+  return spawn3(
+    CLAUDE_BINARY,
+    [
+      "--dangerously-skip-permissions",
+      "--model",
+      "claude-sonnet-5",
+      "--resume",
+      claudeSessionId,
+      ...statuslineSettingsArgs()
+    ],
+    {
+      name: "xterm-color",
+      cols: 120,
+      rows: 32,
+      cwd: repoPath,
+      env: statuslineEnv(sessionId, ticket)
+    }
+  );
+}
+
+// ../../packages/shared-types/dist/index.js
+var CARD_IMAGES_BUCKET = "agent-board-card-images";
+var MAX_CARD_IMAGE_BYTES = 10 * 1024 * 1024;
+
+// src/cardImages.ts
+import { mkdir, writeFile } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
+import { extname, join as join5 } from "node:path";
+var IMAGES_ROOT = join5(tmpdir2(), "agent-board", "card-images");
+function sanitizeFileName(fileName) {
+  return fileName.replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+async function downloadCardImages(supabase, cardId) {
+  const { data, error } = await supabase.from("card_images").select("id, storage_path, file_name").eq("card_id", cardId).order("created_at", { ascending: true });
+  if (error) {
+    logger.card.error(cardId, "Failed to list images:", error.message);
+    return [];
+  }
+  const rows = data ?? [];
+  if (rows.length === 0) return [];
+  const targetDir = join5(IMAGES_ROOT, cardId);
+  await mkdir(targetDir, { recursive: true });
+  const paths = [];
+  for (const row of rows) {
+    const baseName = sanitizeFileName(row.file_name);
+    const fileName = extname(baseName) ? baseName : `${baseName}${extname(row.storage_path)}`;
+    const localPath = join5(targetDir, `${row.id}-${fileName}`);
+    try {
+      const { data: blob, error: downloadError } = await supabase.storage.from(CARD_IMAGES_BUCKET).download(row.storage_path);
+      if (downloadError) throw downloadError;
+      await writeFile(localPath, Buffer.from(await blob.arrayBuffer()));
+      paths.push(localPath);
+    } catch (err) {
+      logger.card.error(cardId, `Failed to download image ${row.storage_path}:`, err);
+    }
+  }
+  return paths;
+}
+function buildInstructionsWithImages(instructions, imagePaths) {
+  if (imagePaths.length === 0) return instructions;
+  const list = imagePaths.map((path) => `- ${path}`).join("\n");
+  return `${instructions}
+
+Images attached to this card (read each one before starting; they are part of the task):
+${list}`;
+}
+
+// src/fileReferences.ts
+function buildInstructionsWithFileReferences(instructions, fileReferences) {
+  if (fileReferences.length === 0) return instructions;
+  const list = fileReferences.map((path) => `- ${path}`).join("\n");
+  return `${instructions}
+
+Files/folders referenced on this card (read them before starting \u2014 they are part of the task):
+${list}`;
+}
+
+// src/ptyRegistry.ts
+var MAX_BUFFERED_CHUNKS = 2e3;
+var registry = /* @__PURE__ */ new Map();
+function registerPtySession(sessionId, pty, ticket) {
+  const handle = { pty, ticket, outputBuffer: [], sockets: /* @__PURE__ */ new Set() };
+  pty.onData((data) => {
+    handle.outputBuffer.push(data);
+    if (handle.outputBuffer.length > MAX_BUFFERED_CHUNKS) handle.outputBuffer.shift();
+    for (const socket of handle.sockets) {
+      if (socket.readyState === socket.OPEN) socket.send(data);
+    }
+  });
+  registry.set(sessionId, handle);
+}
+function getPtySession(sessionId) {
+  return registry.get(sessionId);
+}
+function resizePtySession(sessionId, cols, rows) {
+  const handle = registry.get(sessionId);
+  if (!handle) return;
+  handle.pty.resize(cols, rows);
+}
+function stopPtySession(sessionId) {
+  const handle = registry.get(sessionId);
+  if (!handle) return;
+  for (const socket of handle.sockets) socket.close(4e3, "Session ended");
+  handle.pty.kill();
+  registry.delete(sessionId);
+}
+
+// src/activityLog.ts
+async function logActivity(supabase, params) {
+  try {
+    const { error } = await supabase.from("activity_log").insert({
+      project_id: params.projectId,
+      card_id: params.cardId,
+      user_id: params.userId,
+      event_type: params.eventType,
+      payload: params.payload ?? {}
+    });
+    if (error) throw error;
+  } catch (err) {
+    logger.runner.error("ACTIVITY", `Failed to record activity log entry (${params.eventType}):`, err);
+  }
+}
+
+// src/sessions.ts
+async function countRunningSessions(supabase, projectId, ownerUserId) {
+  const { count, error } = await supabase.from("sessions").select("id, cards!inner(project_id, assigned_user_id)", { count: "exact", head: true }).eq("cards.project_id", projectId).eq("cards.assigned_user_id", ownerUserId).eq("status", "running");
+  if (error) throw error;
+  return count ?? 0;
+}
+async function listQueuedSessionsForRunner(supabase, ownerUserId) {
+  const { data, error } = await supabase.from("sessions").select(
+    "id, card_id, claude_session_id, created_at, cards!inner(project_id, assigned_user_id, title, instructions, file_references, plan_first)"
+  ).eq("cards.assigned_user_id", ownerUserId).eq("status", "queued").order("created_at", { ascending: true });
+  if (error) throw error;
+  return data;
+}
+async function createSession(supabase, userId, cardId) {
+  const { data, error } = await supabase.from("sessions").insert({ card_id: cardId, user_id: userId, status: "queued" }).select("id").single();
+  if (error) throw error;
+  return data.id;
+}
+async function updateSession(supabase, sessionId, changes, activityContext) {
+  const { error } = await supabase.from("sessions").update({
+    ...changes.status !== void 0 ? { status: changes.status } : {},
+    ...changes.agentState !== void 0 ? { agent_state: changes.agentState } : {},
+    ...changes.startedAt !== void 0 ? { started_at: changes.startedAt } : {},
+    ...changes.endedAt !== void 0 ? { ended_at: changes.endedAt } : {},
+    ...changes.terminalTicket !== void 0 ? { terminal_ticket: changes.terminalTicket } : {},
+    ...changes.terminalTicketExpiresAt !== void 0 ? { terminal_ticket_expires_at: changes.terminalTicketExpiresAt } : {},
+    ...changes.claudeSessionId !== void 0 ? { claude_session_id: changes.claudeSessionId } : {}
+  }).eq("id", sessionId);
+  if (error) throw error;
+  if (changes.status !== void 0 && activityContext) {
+    await logActivity(supabase, {
+      projectId: activityContext.projectId,
+      cardId: activityContext.cardId,
+      userId: activityContext.userId,
+      eventType: "session_status_changed",
+      payload: { status: changes.status }
+    });
+  }
+}
+async function getActiveSessionForCard(supabase, cardId) {
+  const { data, error } = await supabase.from("sessions").select("id").eq("card_id", cardId).in("status", ["queued", "running", "waiting_input"]).order("created_at", { ascending: false }).limit(1).maybeSingle();
+  if (error) throw error;
+  return data;
+}
+async function updateCard(supabase, cardId, changes) {
+  const { error } = await supabase.from("cards").update({
+    ...changes.column !== void 0 ? { column_name: changes.column } : {},
+    ...changes.previewUrls !== void 0 ? { preview_urls: changes.previewUrls } : {},
+    ...changes.deployError !== void 0 ? { deploy_error: changes.deployError } : {}
+  }).eq("id", cardId);
+  if (error) throw error;
+}
+async function getProject(supabase, projectId) {
+  const { data, error } = await supabase.from("projects").select("*").eq("id", projectId).single();
+  if (error) throw error;
+  return data;
+}
+async function getProjectRepos(supabase, projectId) {
+  const { data, error } = await supabase.from("project_repos").select("subpath, dev_command").eq("project_id", projectId);
+  if (error) throw error;
+  return data;
+}
+async function listCardsInColumn(supabase, projectId, column) {
+  const { data, error } = await supabase.from("cards").select("id, project_id, title, instructions, column_name, assigned_user_id, deploy_error, file_references, preview_urls").eq("project_id", projectId).eq("column_name", column);
+  if (error) throw error;
+  return data;
+}
+async function clearProjectDeployRequest(supabase, projectId) {
+  const { error } = await supabase.from("projects").update({ deploy_requested_at: null }).eq("id", projectId);
+  if (error) throw error;
+}
+async function clearDevServerRestartRequest(supabase, projectId) {
+  const { error } = await supabase.from("projects").update({ dev_server_restart_requested_at: null }).eq("id", projectId);
+  if (error) throw error;
+}
+async function updateProjectFilesTicket(supabase, projectId, ticket, expiresAt) {
+  const { error } = await supabase.from("projects").update({ files_ticket: ticket, files_ticket_expires_at: expiresAt }).eq("id", projectId);
+  if (error) throw error;
+}
+async function updateRunnerSetupTicket(supabase, runnerId, ticket, expiresAt, allowedRootPath) {
+  const { error } = await supabase.from("runners").update({ setup_ticket: ticket, setup_ticket_expires_at: expiresAt, allowed_root_path: allowedRootPath }).eq("id", runnerId);
+  if (error) throw error;
+}
+async function listMyProjects(supabase) {
+  const { data, error } = await supabase.from("projects").select("id, runner_id, repo_path, logo_path");
+  if (error) throw error;
+  return data;
+}
+async function listProjectRunnerIds(supabase, runnerId) {
+  const { data, error } = await supabase.from("project_runners").select("project_id").eq("runner_id", runnerId);
+  if (error) throw error;
+  return new Set(data.map((row) => row.project_id));
+}
+async function addProjectRunner(supabase, projectId, runnerId) {
+  const { error } = await supabase.from("project_runners").insert({ project_id: projectId, runner_id: runnerId });
+  if (error) throw error;
+}
+async function getRunnerMaxConcurrentProjects(supabase, runnerId) {
+  const { data, error } = await supabase.from("runners").select("max_concurrent_projects").eq("id", runnerId).single();
+  if (error) throw error;
+  return data.max_concurrent_projects;
+}
+async function updateProjectLogoPath(supabase, projectId, logoPath) {
+  const { error } = await supabase.from("projects").update({ logo_path: logoPath }).eq("id", projectId);
+  if (error) throw error;
+}
+async function getClaudeUsage(supabase, userId) {
+  const { data, error } = await supabase.from("claude_usage").select("session_resets_at, week_resets_at").eq("user_id", userId).maybeSingle();
+  if (error) throw error;
+  if (!data) return null;
+  return { sessionResetsAt: data.session_resets_at, weekResetsAt: data.week_resets_at };
+}
+async function upsertClaudeUsage(supabase, userId, changes) {
+  const { error } = await supabase.from("claude_usage").upsert({
+    user_id: userId,
+    ...changes.sessionPercent !== void 0 ? { session_pct: changes.sessionPercent } : {},
+    ...changes.sessionResetsAt !== void 0 ? { session_resets_at: changes.sessionResetsAt } : {},
+    ...changes.weekPercent !== void 0 ? { week_pct: changes.weekPercent } : {},
+    ...changes.weekResetsAt !== void 0 ? { week_resets_at: changes.weekResetsAt } : {},
+    updated_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  if (error) throw error;
+}
+
+// src/usageResume.ts
+var RESET_BUFFER_MS = 3e4;
+var UNKNOWN_RESET_RETRY_MS = 5 * 6e4;
+var pending = /* @__PURE__ */ new Map();
+function scheduleUsageResume(supabase, config, cardId, sessionId, pty) {
+  if (pending.has(sessionId)) return;
+  void (async () => {
+    const usage = await getClaudeUsage(supabase, config.ownerUserId).catch((err) => {
+      logger.card.error(cardId, "Failed to read claude_usage for usage-limit resume:", err);
+      return null;
+    });
+    const now = Date.now();
+    const candidates = [usage?.sessionResetsAt, usage?.weekResetsAt].map((iso) => iso ? new Date(iso).getTime() : null).filter((ms) => ms !== null && ms > now);
+    const resetAt = candidates.length > 0 ? Math.min(...candidates) : null;
+    const delay = resetAt !== null ? resetAt - now + RESET_BUFFER_MS : UNKNOWN_RESET_RETRY_MS;
+    logger.card.info(
+      cardId,
+      resetAt !== null ? `Usage limit hit \u2014 will send "continue" automatically at ${new Date(resetAt).toISOString()}.` : `Usage limit hit but no reset time known yet \u2014 will retry in ${Math.round(delay / 6e4)}min.`
+    );
+    const timer = setTimeout(() => {
+      pending.delete(sessionId);
+      sendContinue(pty, cardId);
+    }, delay);
+    timer.unref();
+    pending.set(sessionId, timer);
+  })();
+}
+function cancelUsageResume(sessionId) {
+  const timer = pending.get(sessionId);
+  if (!timer) return;
+  clearTimeout(timer);
+  pending.delete(sessionId);
+}
+
+// src/orchestrator.ts
+var TERMINAL_TICKET_TTL_MS = 60 * 60 * 1e3;
+var inFlightCardIds = /* @__PURE__ */ new Set();
+var activeSessionByCard = /* @__PURE__ */ new Map();
+var dispatchingRunner = false;
+async function scanForWork(supabase, config) {
+  for (const project of config.registeredProjects) {
+    await reconcileStaleSessions(supabase, config, project.id);
+    const { data: cards, error } = await supabase.from("cards").select("*").eq("project_id", project.id).eq("column_name", "desenvolvimento").eq("assigned_user_id", config.ownerUserId);
+    if (error) {
+      logger.runner.error("ORCHESTRATOR", `Failed to scan cards for project ${project.id}:`, error.message);
+      continue;
+    }
+    for (const card of cards ?? []) {
+      void enqueueCard(supabase, config, card);
+    }
+  }
+  void dispatchRunnerQueue(supabase, config);
+}
+async function enqueueCard(supabase, config, card) {
+  if (inFlightCardIds.has(card.id)) return;
+  const registered = config.registeredProjects.find((project) => project.id === card.project_id);
+  if (!registered) {
+    logger.card.warn(card.id, `Ignoring card: project ${card.project_id} is not registered on this runner.`);
+    return;
+  }
+  if (card.assigned_user_id !== config.ownerUserId) return;
+  inFlightCardIds.add(card.id);
+  try {
+    const active = await getActiveSessionForCard(supabase, card.id);
+    if (active) return;
+    await createQueuedSession(supabase, config, card);
+  } finally {
+    inFlightCardIds.delete(card.id);
+  }
+  await dispatchRunnerQueue(supabase, config);
+}
+async function createQueuedSession(supabase, config, card) {
+  const sessionId = await createSession(supabase, config.ownerUserId, card.id);
+  logger.card.info(card.id, `"${card.title}" queued (session ${sessionId}).`);
+}
+async function reconcileStaleSessions(supabase, config, projectId) {
+  const { data, error } = await supabase.from("sessions").select("id, card_id, cards!inner(project_id, column_name, assigned_user_id)").eq("cards.project_id", projectId).eq("cards.assigned_user_id", config.ownerUserId).in("status", ["queued", "running", "waiting_input"]).neq("cards.column_name", "desenvolvimento");
+  if (error) {
+    logger.runner.error("ORCHESTRATOR", `Failed to scan stale sessions for project ${projectId}:`, error.message);
+    return;
+  }
+  const stale = data ?? [];
+  if (stale.length === 0) return;
+  for (const { id: sessionId, card_id: cardId } of stale) {
+    stopPtySession(sessionId);
+    cancelUsageResume(sessionId);
+    activeSessionByCard.delete(cardId);
+    await updateSession(
+      supabase,
+      sessionId,
+      { status: "done", endedAt: (/* @__PURE__ */ new Date()).toISOString() },
+      { projectId, cardId, userId: config.ownerUserId }
+    );
+    logger.card.info(cardId, `Ended stale session ${sessionId} (its card left "desenvolvimento" while this runner missed the event).`);
+  }
+  await dispatchRunnerQueue(supabase, config);
+}
+async function dispatchRunnerQueue(supabase, config) {
+  if (dispatchingRunner) return;
+  dispatchingRunner = true;
+  try {
+    const queued = await listQueuedSessionsForRunner(supabase, config.ownerUserId);
+    if (queued.length === 0) return;
+    const maxConcurrentProjects = await getRunnerMaxConcurrentProjects(supabase, config.runnerId);
+    const runningProjectIds = /* @__PURE__ */ new Set();
+    for (const project of config.registeredProjects) {
+      const runningCount = await countRunningSessions(supabase, project.id, config.ownerUserId);
+      if (runningCount > 0) runningProjectIds.add(project.id);
+    }
+    let freeProjectSlots = maxConcurrentProjects - runningProjectIds.size;
+    if (freeProjectSlots <= 0) return;
+    const promotedThisPass = /* @__PURE__ */ new Set();
+    for (const entry of queued) {
+      const projectId = entry.cards.project_id;
+      if (runningProjectIds.has(projectId) || promotedThisPass.has(projectId)) continue;
+      if (freeProjectSlots <= 0) break;
+      try {
+        await promoteQueuedSession(supabase, config, entry);
+        promotedThisPass.add(projectId);
+        freeProjectSlots -= 1;
+      } catch (err) {
+        logger.card.error(entry.card_id, `Failed to promote queued session ${entry.id}:`, err);
+      }
+    }
+  } finally {
+    dispatchingRunner = false;
+  }
+}
+async function promoteQueuedSession(supabase, config, entry) {
+  const spawned = await spawnSessionPty(supabase, config, entry);
+  if (spawned) logger.card.info(entry.card_id, "Promoted from queue.");
+}
+async function spawnSessionPty(supabase, config, entry) {
+  const { id: sessionId, card_id: cardId, cards: card, claude_session_id: claudeSessionId } = entry;
+  const registered = config.registeredProjects.find((project) => project.id === card.project_id);
+  if (!registered) {
+    logger.card.error(cardId, `Session ${sessionId}: project ${card.project_id} is not registered \u2014 skipping.`);
+    await updateSession(
+      supabase,
+      sessionId,
+      { status: "failed", endedAt: (/* @__PURE__ */ new Date()).toISOString() },
+      { projectId: card.project_id, cardId, userId: config.ownerUserId }
+    );
+    return false;
+  }
+  const ticket = randomUUID2();
+  let pty;
+  let newClaudeSessionId = null;
+  try {
+    if (claudeSessionId) {
+      pty = resumeAgentPty(registered.repoPath, claudeSessionId, sessionId, ticket);
+    } else {
+      const imagePaths = await downloadCardImages(supabase, cardId);
+      const instructions = buildInstructionsWithFileReferences(
+        buildInstructionsWithImages(card.instructions, imagePaths),
+        card.file_references
+      );
+      const spawned = spawnAgentPty(registered.repoPath, cardId, card.title, instructions, sessionId, ticket, card.plan_first);
+      pty = spawned.pty;
+      newClaudeSessionId = spawned.claudeSessionId;
+    }
+  } catch (err) {
+    logger.card.error(cardId, `Failed to spawn pty for session ${sessionId}:`, err);
+    await updateSession(
+      supabase,
+      sessionId,
+      { status: "failed", endedAt: (/* @__PURE__ */ new Date()).toISOString() },
+      { projectId: card.project_id, cardId, userId: config.ownerUserId }
+    );
+    return false;
+  }
+  registerPtySession(sessionId, pty, ticket);
+  activeSessionByCard.set(cardId, sessionId);
+  const activityWatcher = watchAgentActivity(supabase, config, cardId, sessionId, pty);
+  await updateSession(
+    supabase,
+    sessionId,
+    {
+      status: "running",
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      terminalTicket: ticket,
+      terminalTicketExpiresAt: new Date(Date.now() + TERMINAL_TICKET_TTL_MS).toISOString(),
+      // Only stamp a fresh spawn as "implementing" — a resumed session (claudeSessionId was
+      // already set) keeps whatever agent_state it had before the restart (e.g.
+      // "usage_limited"), so reconcileUsageLimitedSessions can find it afterwards. The
+      // freshly (re)constructed AgentActivityWatcher below will correct it the moment real
+      // output gives it something conclusive to classify.
+      ...newClaudeSessionId ? { agentState: "implementing", claudeSessionId: newClaudeSessionId } : {}
+    },
+    { projectId: card.project_id, cardId, userId: config.ownerUserId }
+  );
+  pty.onExit(({ exitCode }) => {
+    logger.card.warn(cardId, `Session exited (code ${exitCode}) \u2014 this only happens if the process crashed or was killed, the card doesn't auto-advance.`);
+    activityWatcher.stop();
+    cancelUsageResume(sessionId);
+    activeSessionByCard.delete(cardId);
+  });
+  return true;
+}
+function watchAgentActivity(supabase, config, cardId, sessionId, pty) {
+  const watcher = new AgentActivityWatcher((state) => {
+    updateSession(supabase, sessionId, { agentState: state }).catch(
+      (err) => logger.card.error(cardId, `Failed to publish agent state "${state}" for session ${sessionId}:`, err)
+    );
+    if (state === "usage_limited") {
+      scheduleUsageResume(supabase, config, cardId, sessionId, pty);
+    } else {
+      cancelUsageResume(sessionId);
+    }
+  });
+  pty.onData((chunk) => watcher.push(chunk));
+  return watcher;
+}
+async function reconcileOrphanedSessions(supabase, config) {
+  for (const project of config.registeredProjects) {
+    const { data, error } = await supabase.from("sessions").select("id, card_id, claude_session_id, created_at, cards!inner(project_id, assigned_user_id, title, instructions, file_references, plan_first)").eq("cards.project_id", project.id).eq("cards.assigned_user_id", config.ownerUserId).eq("status", "running");
+    if (error) {
+      logger.runner.error("ORCHESTRATOR", `Failed to scan orphaned sessions for project ${project.id}:`, error.message);
+      continue;
+    }
+    for (const entry of data ?? []) {
+      let spawned;
+      try {
+        spawned = await spawnSessionPty(supabase, config, entry);
+      } catch (err) {
+        logger.card.error(entry.card_id, `Failed to re-spawn orphaned session ${entry.id}:`, err);
+        continue;
+      }
+      if (spawned) {
+        logger.card.info(entry.card_id, "Re-spawned orphaned session (runner restarted since it was last running).");
+      }
+    }
+  }
+}
+async function reconcileUsageLimitedSessions(supabase, config) {
+  for (const project of config.registeredProjects) {
+    const { data, error } = await supabase.from("sessions").select("id, card_id, cards!inner(project_id, assigned_user_id)").eq("cards.project_id", project.id).eq("cards.assigned_user_id", config.ownerUserId).eq("status", "running").eq("agent_state", "usage_limited");
+    if (error) {
+      logger.runner.error("ORCHESTRATOR", `Failed to scan usage-limited sessions for project ${project.id}:`, error.message);
+      continue;
+    }
+    for (const { id: sessionId, card_id: cardId } of data ?? []) {
+      const handle = getPtySession(sessionId);
+      if (!handle) continue;
+      scheduleUsageResume(supabase, config, cardId, sessionId, handle.pty);
+    }
+  }
+}
+async function stopCardSession(supabase, config, card) {
+  const sessionId = activeSessionByCard.get(card.id) ?? (await getActiveSessionForCard(supabase, card.id))?.id;
+  if (!sessionId) return;
+  stopPtySession(sessionId);
+  cancelUsageResume(sessionId);
+  activeSessionByCard.delete(card.id);
+  await updateSession(
+    supabase,
+    sessionId,
+    { status: "done", endedAt: (/* @__PURE__ */ new Date()).toISOString() },
+    { projectId: card.project_id, cardId: card.id, userId: config.ownerUserId }
+  );
+  logger.card.info(card.id, `Session ${sessionId} stopped.`);
+  await dispatchRunnerQueue(supabase, config);
+}
+
+// src/deploy.ts
+async function handleDeployRequested(supabase, config, project) {
+  const registered = config.registeredProjects.find((candidate) => candidate.id === project.id);
+  if (!registered) {
+    logger.runner.warn("DEPLOY", `Ignoring deploy request: project ${project.id} is not registered on this runner.`);
+    return;
+  }
+  const allCards = await listCardsInColumn(supabase, project.id, "deploy");
+  const cards = allCards.filter((card) => card.assigned_user_id === config.ownerUserId);
+  if (cards.length === 0) {
+    logger.runner.info("DEPLOY", `Deploy requested for project ${project.id} but no cards assigned to this runner's user are waiting in "deploy".`);
+    await clearProjectDeployRequest(supabase, project.id);
+    return;
+  }
+  const children = await getProjectRepos(supabase, project.id);
+  const repoRoot = resolveRepoPath(config, project.repo_path);
+  const targets = children.length > 0 ? children.map((child2) => ({ label: child2.subpath, path: join6(repoRoot, child2.subpath) })) : [{ label: null, path: repoRoot }];
+  const failures = [];
+  for (const target of targets) {
+    const result = await pushBranchToMain(target.path);
+    if (result.ok) {
+      logger.runner.info("DEPLOY", target.label ? `Pushed HEAD to main in "${target.label}".` : "Pushed HEAD to main.");
+    } else {
+      logger.runner.error("DEPLOY", target.label ? `Push to main failed in "${target.label}": ${result.error}` : `Push to main failed: ${result.error}`);
+      failures.push(target.label ? `${target.label}: ${result.error}` : result.error);
+    }
+  }
+  if (failures.length > 0) {
+    const message = failures.join("; ");
+    await Promise.all(cards.map((card) => updateCard(supabase, card.id, { deployError: message })));
+    await clearProjectDeployRequest(supabase, project.id);
+    return;
+  }
+  await Promise.all(cards.map((card) => updateCard(supabase, card.id, { deployError: null, column: "fim" })));
+  await clearProjectDeployRequest(supabase, project.id);
+}
+async function checkPendingDeploys(supabase, config) {
+  for (const registered of config.registeredProjects) {
+    const project = await getProject(supabase, registered.id);
+    if (project.deploy_requested_at) {
+      await handleDeployRequested(supabase, config, project);
+    }
+  }
+}
+async function handleCardReachedFim(supabase, config, card) {
+  await stopCardSession(supabase, config, card);
+  releaseCard(card.id);
+  logger.card.info(card.id, 'Reached "fim" \u2014 session stopped, preview tunnel (if any) closed.');
+}
+
+// src/filesServer.ts
+import { execFile as execFile2 } from "node:child_process";
+import { randomUUID as randomUUID5 } from "node:crypto";
+import { existsSync as existsSync4, lstatSync, readdirSync, readFileSync as readFileSync4 } from "node:fs";
+import { join as join8, resolve as resolve2, sep } from "node:path";
+import { parse } from "node:url";
+import { promisify as promisify2 } from "node:util";
+
+// src/shellSession.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { spawn as spawn4 } from "node-pty";
+var SHELL_COMMAND = process.platform === "win32" ? process.env.COMSPEC ?? "cmd.exe" : process.env.SHELL ?? "bash";
+function openShellSession(repoPath) {
+  const sessionId = `shell:${randomUUID3()}`;
+  const ticket = randomUUID3();
+  const pty = spawn4(SHELL_COMMAND, [], {
+    name: "xterm-color",
+    cols: 120,
+    rows: 32,
+    cwd: repoPath
+  });
+  registerPtySession(sessionId, pty, ticket);
+  pty.onExit(({ exitCode }) => {
+    logger.runner.info("SHELL", `Standalone shell ${sessionId} exited (code ${exitCode}).`);
+    stopPtySession(sessionId);
+  });
+  return { sessionId, ticket };
+}
+
+// src/usageMonitor.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir3, tmpdir as tmpdir3 } from "node:os";
+import { join as join7 } from "node:path";
+import { spawn as spawn5 } from "node-pty";
+var SESSION_ID = "usage-monitor";
+var TICKET = randomUUID4();
+var SCRATCH_DIR = join7(tmpdir3(), "agent-board-usage-monitor");
+var POLL_INTERVAL_MS = Number(process.env.AGENT_BOARD_USAGE_POLL_INTERVAL_MS ?? 15 * 6e4);
+var IDLE_MS = 2e3;
+var HARD_TIMEOUT_MS = 6e4;
+function usageMonitorSessionId() {
+  return SESSION_ID;
+}
+function usageMonitorTicket() {
+  return TICKET;
+}
+function ensureScratchDirTrusted() {
+  const claudeJsonPath = join7(homedir3(), ".claude.json");
+  if (!existsSync3(claudeJsonPath)) return;
+  try {
+    const raw = readFileSync3(claudeJsonPath, "utf8");
+    const data = JSON.parse(raw);
+    data.projects ??= {};
+    const keys = [SCRATCH_DIR, SCRATCH_DIR.replace(/\\/g, "/")];
+    const alreadyTrusted = keys.every((key) => data.projects[key]?.hasTrustDialogAccepted === true);
+    if (alreadyTrusted) return;
+    for (const key of keys) {
+      data.projects[key] = { ...data.projects[key], hasTrustDialogAccepted: true };
+    }
+    writeFileSync4(claudeJsonPath, JSON.stringify(data, null, 2));
+    logger.runner.info("USAGE_MONITOR", `Pre-trusted scratch directory ${SCRATCH_DIR} in ~/.claude.json.`);
+  } catch (err) {
+    logger.runner.error("USAGE_MONITOR", "Failed to pre-trust the usage-monitor scratch directory:", err);
+  }
+}
+function pollUsageOnce() {
+  let pty;
+  try {
+    pty = spawn5(
+      CLAUDE_BINARY,
+      [
+        "--dangerously-skip-permissions",
+        "--model",
+        "claude-haiku-4-5",
+        // cheapest model — this exchange exists only to trigger a statusLine update
+        ...statuslineSettingsArgs(),
+        "reply with just the word: ok"
+      ],
+      {
+        name: "xterm-color",
+        cols: 80,
+        rows: 24,
+        cwd: SCRATCH_DIR,
+        env: statuslineEnv(SESSION_ID, TICKET)
+      }
+    );
+  } catch (err) {
+    logger.runner.error("USAGE_MONITOR", "Failed to spawn the usage-poll session:", err);
+    return;
+  }
+  let settled = false;
+  let idleTimer;
+  const hardTimer = setTimeout(finish, HARD_TIMEOUT_MS);
+  function finish() {
+    if (settled) return;
+    settled = true;
+    clearTimeout(idleTimer);
+    clearTimeout(hardTimer);
+    try {
+      pty.kill();
+    } catch {
+    }
+  }
+  pty.onData(() => {
+    clearTimeout(idleTimer);
+    idleTimer = setTimeout(finish, IDLE_MS);
+  });
+  pty.onExit(() => finish());
+}
+function startUsageMonitor() {
+  mkdirSync3(SCRATCH_DIR, { recursive: true });
+  ensureScratchDirTrusted();
+  pollUsageOnce();
+  setInterval(pollUsageOnce, POLL_INTERVAL_MS);
+}
+
+// src/filesServer.ts
+var execFileAsync2 = promisify2(execFile2);
+var FILES_TICKET_TTL_MS = 15 * 60 * 1e3;
+var FILES_TICKET_REFRESH_MARGIN_MS = FILES_TICKET_TTL_MS / 3;
+var MAX_FILE_SIZE_BYTES = 1e6;
+var MAX_LOGO_SIZE_BYTES = 5e6;
+var IGNORED_ENTRY_NAMES = /* @__PURE__ */ new Set([".git", ".claude", "node_modules", "dist", "build"]);
+var BRAND_ICON_BASE_NAMES = ["logo", "favicon"];
+var MIME_TYPES_BY_EXT = {
+  svg: "image/svg+xml",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  webp: "image/webp",
+  gif: "image/gif",
+  ico: "image/x-icon"
+};
+var ticketsByProject = /* @__PURE__ */ new Map();
+var setupTicket = null;
+var statuslineSupabase = null;
+var statuslineConfig = null;
+var MAX_STATUSLINE_BODY_BYTES = 16e3;
+var HttpError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+};
+async function ensureFilesTickets(supabase, config) {
+  for (const project of config.registeredProjects) {
+    if (!project.isReferenceRunner) continue;
+    const existing = ticketsByProject.get(project.id);
+    if (existing && existing.expiresAt - Date.now() > FILES_TICKET_REFRESH_MARGIN_MS) continue;
+    const ticket = randomUUID5();
+    const expiresAtMs = Date.now() + FILES_TICKET_TTL_MS;
+    ticketsByProject.set(project.id, { ticket, expiresAt: expiresAtMs, repoRoot: resolve2(project.repoPath) });
+    try {
+      await updateProjectFilesTicket(supabase, project.id, ticket, new Date(expiresAtMs).toISOString());
+    } catch (err) {
+      logger.runner.error("FILES", `Failed to publish files ticket for project ${project.id}:`, err);
+    }
+  }
+}
+function authenticate(query) {
+  const projectId = typeof query.projectId === "string" ? query.projectId : null;
+  const ticket = typeof query.ticket === "string" ? query.ticket : null;
+  if (!projectId || !ticket) return null;
+  const entry = ticketsByProject.get(projectId);
+  if (!entry || entry.ticket !== ticket || entry.expiresAt < Date.now()) return null;
+  return entry;
+}
+async function ensureSetupTicket(supabase, config) {
+  if (!config.allowedRootPath) return;
+  if (setupTicket && setupTicket.expiresAt - Date.now() > FILES_TICKET_REFRESH_MARGIN_MS) return;
+  const ticket = randomUUID5();
+  const expiresAtMs = Date.now() + FILES_TICKET_TTL_MS;
+  setupTicket = { ticket, expiresAt: expiresAtMs, rootPath: resolve2(config.allowedRootPath) };
+  try {
+    await updateRunnerSetupTicket(supabase, config.runnerId, ticket, new Date(expiresAtMs).toISOString(), config.allowedRootPath);
+  } catch (err) {
+    logger.runner.error("FILES", `Failed to publish setup ticket for runner ${config.runnerId}:`, err);
+  }
+}
+function authenticateSetup(query) {
+  const ticket = typeof query.ticket === "string" ? query.ticket : null;
+  if (!ticket || !setupTicket) return null;
+  if (setupTicket.ticket !== ticket || setupTicket.expiresAt < Date.now()) return null;
+  return setupTicket;
+}
+function resolveWithinRepo(repoRoot, relPath) {
+  const normalizedRel = relPath.replace(/^[/\\]+/, "");
+  const resolved = resolve2(repoRoot, normalizedRel);
+  const rootWithSep = repoRoot.endsWith(sep) ? repoRoot : repoRoot + sep;
+  if (resolved !== repoRoot && !resolved.startsWith(rootWithSep)) {
+    throw new HttpError(403, "Caminho fora do reposit\xF3rio.");
+  }
+  return resolved;
+}
+function listDirectory(repoRoot, relPath) {
+  const target = resolveWithinRepo(repoRoot, relPath);
+  let stat;
+  try {
+    stat = lstatSync(target);
+  } catch {
+    throw new HttpError(404, "Diret\xF3rio n\xE3o encontrado.");
+  }
+  if (stat.isSymbolicLink()) throw new HttpError(403, "Links simb\xF3licos n\xE3o s\xE3o suportados.");
+  if (!stat.isDirectory()) throw new HttpError(400, "O caminho informado n\xE3o \xE9 um diret\xF3rio.");
+  const prefix = relPath.replace(/\/+$/, "");
+  return readdirSync(target, { withFileTypes: true }).filter((dirent) => !dirent.isSymbolicLink() && !IGNORED_ENTRY_NAMES.has(dirent.name)).map((dirent) => ({
+    name: dirent.name,
+    path: prefix ? `${prefix}/${dirent.name}` : dirent.name,
+    type: dirent.isDirectory() ? "dir" : "file"
+  })).sort((a, b) => a.type !== b.type ? a.type === "dir" ? -1 : 1 : a.name.localeCompare(b.name));
+}
+function listDirectoryForBrowse(rootPath, relPath) {
+  return listDirectory(rootPath, relPath).map((entry) => ({
+    ...entry,
+    hasGit: entry.type === "dir" && existsSync4(join8(rootPath, entry.path, ".git"))
+  }));
+}
+function looksBinary(buffer) {
+  const sample = buffer.subarray(0, Math.min(buffer.length, 8e3));
+  return sample.includes(0);
+}
+function readTextFile(repoRoot, relPath) {
+  const target = resolveWithinRepo(repoRoot, relPath);
+  let stat;
+  try {
+    stat = lstatSync(target);
+  } catch {
+    throw new HttpError(404, "Arquivo n\xE3o encontrado.");
+  }
+  if (stat.isSymbolicLink()) throw new HttpError(403, "Links simb\xF3licos n\xE3o s\xE3o suportados.");
+  if (!stat.isFile()) throw new HttpError(400, "O caminho informado n\xE3o \xE9 um arquivo.");
+  if (stat.size > MAX_FILE_SIZE_BYTES) {
+    throw new HttpError(413, `Arquivo maior que o limite de ${MAX_FILE_SIZE_BYTES / 1e6}MB para visualiza\xE7\xE3o.`);
+  }
+  const buffer = readFileSync4(target);
+  if (looksBinary(buffer)) throw new HttpError(415, "Arquivo bin\xE1rio n\xE3o pode ser exibido.");
+  return { content: buffer.toString("utf8"), size: stat.size };
+}
+function findBrandIconPath(repoRoot) {
+  const patterns = BRAND_ICON_BASE_NAMES.map((baseName) => ({
+    baseName,
+    pattern: new RegExp(`^${baseName}\\.[a-z0-9]+$`, "i")
+  }));
+  const candidatesByBaseName = new Map(
+    BRAND_ICON_BASE_NAMES.map((baseName) => [baseName, []])
+  );
+  function walk(dir, relDir, depth) {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.isSymbolicLink() || IGNORED_ENTRY_NAMES.has(entry.name)) continue;
+      const relPath = relDir ? `${relDir}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        walk(join8(dir, entry.name), relPath, depth + 1);
+      } else if (entry.isFile()) {
+        const match = patterns.find(({ pattern }) => pattern.test(entry.name));
+        if (match) candidatesByBaseName.get(match.baseName).push({ relPath, depth });
+      }
+    }
+  }
+  walk(repoRoot, "", 0);
+  for (const baseName of BRAND_ICON_BASE_NAMES) {
+    const candidates = candidatesByBaseName.get(baseName);
+    if (candidates.length === 0) continue;
+    candidates.sort((a, b) => a.depth - b.depth || a.relPath.localeCompare(b.relPath));
+    return candidates[0].relPath;
+  }
+  return null;
+}
+function readImageFile(repoRoot, relPath) {
+  const target = resolveWithinRepo(repoRoot, relPath);
+  let stat;
+  try {
+    stat = lstatSync(target);
+  } catch {
+    throw new HttpError(404, "Arquivo de logo n\xE3o encontrado.");
+  }
+  if (stat.isSymbolicLink()) throw new HttpError(403, "Links simb\xF3licos n\xE3o s\xE3o suportados.");
+  if (!stat.isFile()) throw new HttpError(400, "O caminho configurado n\xE3o \xE9 um arquivo.");
+  if (stat.size > MAX_LOGO_SIZE_BYTES) {
+    throw new HttpError(413, `Arquivo maior que o limite de ${MAX_LOGO_SIZE_BYTES / 1e6}MB.`);
+  }
+  const ext = relPath.split(".").pop()?.toLowerCase() ?? "";
+  return { buffer: readFileSync4(target), contentType: MIME_TYPES_BY_EXT[ext] ?? "application/octet-stream" };
+}
+function sendJson(res, status, body) {
+  const payload = JSON.stringify(body);
+  res.writeHead(status, {
+    "Content-Type": "application/json; charset=utf-8",
+    // This runner is a trusted process on the user's own machine and the web app is served
+    // from a different origin (e.g. Vercel) — the ticket is the actual security boundary,
+    // so CORS is left wide open rather than trying to keep an allowlist of web origins.
+    "Access-Control-Allow-Origin": "*"
+  });
+  res.end(payload);
+}
+function readRequestBody(req, maxBytes) {
+  return new Promise((resolve4, reject) => {
+    let received = 0;
+    const chunks = [];
+    req.on("data", (chunk) => {
+      received += chunk.length;
+      if (received > maxBytes) {
+        req.destroy();
+        reject(new HttpError(413, "Corpo da requisi\xE7\xE3o excede o limite."));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => resolve4(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
+}
+async function handleStatuslineReport(req, res, supabase, config) {
+  let body;
+  try {
+    const raw = await readRequestBody(req, MAX_STATUSLINE_BODY_BYTES);
+    body = JSON.parse(raw);
+  } catch (err) {
+    const status = err instanceof HttpError ? err.status : 400;
+    sendJson(res, status, { error: "Corpo inv\xE1lido." });
+    return;
+  }
+  if (!body.sessionId || !body.ticket) {
+    sendJson(res, 400, { error: "sessionId e ticket s\xE3o obrigat\xF3rios." });
+    return;
+  }
+  const isMonitor = body.sessionId === usageMonitorSessionId();
+  const ticketValid = isMonitor ? body.ticket === usageMonitorTicket() : getPtySession(body.sessionId)?.ticket === body.ticket;
+  if (!ticketValid) {
+    sendJson(res, 403, { error: "Ticket inv\xE1lido para esta sess\xE3o." });
+    return;
+  }
+  try {
+    await upsertClaudeUsage(supabase, config.ownerUserId, {
+      ...typeof body.fiveHour?.used_percentage === "number" ? { sessionPercent: body.fiveHour.used_percentage } : {},
+      ...typeof body.fiveHour?.resets_at === "number" ? { sessionResetsAt: new Date(body.fiveHour.resets_at * 1e3).toISOString() } : {},
+      ...typeof body.sevenDay?.used_percentage === "number" ? { weekPercent: body.sevenDay.used_percentage } : {},
+      ...typeof body.sevenDay?.resets_at === "number" ? { weekResetsAt: new Date(body.sevenDay.resets_at * 1e3).toISOString() } : {}
+    });
+    res.writeHead(204, { "Access-Control-Allow-Origin": "*" });
+    res.end();
+  } catch (err) {
+    logger.runner.error("STATUSLINE", `Failed to persist Claude usage from session ${body.sessionId}:`, err);
+    sendJson(res, 500, { error: "Erro interno do runner." });
+  }
+}
+async function handleBranchRequest(entry, res) {
+  try {
+    const { stdout } = await execFileAsync2("git", ["branch", "--show-current"], { cwd: entry.repoRoot });
+    sendJson(res, 200, { branch: stdout.trim() });
+  } catch (err) {
+    logger.runner.error("FILES", "Unexpected error handling a branch request:", err);
+    sendJson(res, 500, { error: "Erro interno do runner." });
+  }
+}
+function handleRequest(req, res) {
+  if (req.method === "OPTIONS") {
+    res.writeHead(204, { "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Methods": "GET, POST, OPTIONS" });
+    res.end();
+    return;
+  }
+  const { pathname, query } = parse(req.url ?? "", true);
+  if (req.method === "POST" && pathname === "/statusline") {
+    if (!statuslineSupabase || !statuslineConfig) {
+      sendJson(res, 500, { error: "Runner ainda n\xE3o inicializado." });
+      return;
+    }
+    void handleStatuslineReport(req, res, statuslineSupabase, statuslineConfig);
+    return;
+  }
+  if (req.method !== "GET") {
+    sendJson(res, 405, { error: "M\xE9todo n\xE3o suportado." });
+    return;
+  }
+  const relPath = typeof query.path === "string" ? query.path : "";
+  if (pathname === "/browse") {
+    const setupEntry = authenticateSetup(query);
+    if (!setupEntry) {
+      sendJson(res, 401, { error: "Ticket inv\xE1lido, expirado, ou navega\xE7\xE3o de pastas desativada." });
+      return;
+    }
+    try {
+      sendJson(res, 200, { entries: listDirectoryForBrowse(setupEntry.rootPath, relPath) });
+    } catch (err) {
+      if (err instanceof HttpError) {
+        sendJson(res, err.status, { error: err.message });
+        return;
+      }
+      logger.runner.error("FILES", "Unexpected error handling a browse request:", err);
+      sendJson(res, 500, { error: "Erro interno do runner." });
+    }
+    return;
+  }
+  const entry = authenticate(query);
+  if (!entry) {
+    sendJson(res, 401, { error: "Ticket inv\xE1lido, expirado, ou projeto desconhecido." });
+    return;
+  }
+  if (pathname === "/branch") {
+    void handleBranchRequest(entry, res);
+    return;
+  }
+  try {
+    if (pathname === "/tree") {
+      sendJson(res, 200, { entries: listDirectory(entry.repoRoot, relPath) });
+      return;
+    }
+    if (pathname === "/file") {
+      sendJson(res, 200, readTextFile(entry.repoRoot, relPath));
+      return;
+    }
+    if (pathname === "/logo") {
+      if (!relPath) throw new HttpError(404, "Nenhuma logo configurada para este projeto.");
+      const { buffer, contentType } = readImageFile(entry.repoRoot, relPath);
+      res.writeHead(200, {
+        "Content-Type": contentType,
+        "Content-Length": buffer.length,
+        "Cache-Control": "no-cache",
+        "Access-Control-Allow-Origin": "*"
+      });
+      res.end(buffer);
+      return;
+    }
+    if (pathname === "/shell/open") {
+      sendJson(res, 200, openShellSession(entry.repoRoot));
+      return;
+    }
+    sendJson(res, 404, { error: "Rota desconhecida." });
+  } catch (err) {
+    if (err instanceof HttpError) {
+      sendJson(res, err.status, { error: err.message });
+      return;
+    }
+    logger.runner.error("FILES", "Unexpected error handling a files request:", err);
+    sendJson(res, 500, { error: "Erro interno do runner." });
+  }
+}
+function attachFilesServer(httpServer, supabase, config) {
+  statuslineSupabase = supabase;
+  statuslineConfig = config;
+  httpServer.on("request", handleRequest);
+  logger.runner.info("FILES", "Files HTTP handler attached.");
+}
+
+// src/repoValidation.ts
+import { existsSync as existsSync5 } from "node:fs";
+import { resolve as resolve3 } from "node:path";
+function validateRepoOnDisk(repoPath, children) {
+  if (children.length > 0) {
+    for (const child2 of children) {
+      if (!existsSync5(resolve3(repoPath, child2, ".git"))) {
+        return {
+          ok: false,
+          reason: `"${resolve3(repoPath, child2)}" does not look like a git repository (no .git folder found).`
+        };
+      }
+    }
+    return { ok: true };
+  }
+  if (!existsSync5(resolve3(repoPath, ".git"))) {
+    return {
+      ok: false,
+      reason: `"${repoPath}" does not look like a git repository (no .git folder found). If this is a monolith container of independent repos, register it with child repos.`
+    };
+  }
+  return { ok: true };
+}
+
+// src/projectSync.ts
+async function syncRegisteredProjects(supabase, config, registeredPaths) {
+  const remoteProjects = await listMyProjects(supabase);
+  const remoteById = new Map(remoteProjects.map((project) => [project.id, project]));
+  const localById = new Map(config.registeredProjects.map((project) => [project.id, project]));
+  const linkedRunnerIds = await listProjectRunnerIds(supabase, config.runnerId);
+  let changed = false;
+  for (const remote of remoteProjects) {
+    const local = localById.get(remote.id);
+    if (local) {
+      const isReferenceRunner = remote.runner_id === config.runnerId;
+      if (local.isReferenceRunner !== isReferenceRunner) {
+        local.isReferenceRunner = isReferenceRunner;
+        changed = true;
+      }
+      continue;
+    }
+    const children = (await getProjectRepos(supabase, remote.id)).map((repo) => repo.subpath);
+    const repoPath = resolveRepoPath(config, remote.repo_path);
+    const validation = validateRepoOnDisk(repoPath, children);
+    if (!validation.ok) {
+      continue;
+    }
+    if (!linkedRunnerIds.has(remote.id)) {
+      try {
+        await addProjectRunner(supabase, remote.id, config.runnerId);
+      } catch (err) {
+        logger.runner.error("PROJECT_SYNC", `Failed to register this runner for project ${remote.id}:`, err);
+        continue;
+      }
+    }
+    const entry = { id: remote.id, repoPath, logoPathChecked: false, isReferenceRunner: remote.runner_id === config.runnerId };
+    config.registeredProjects.push(entry);
+    localById.set(remote.id, entry);
+    registeredPaths.add(remote.id);
+    changed = true;
+    logger.runner.info("PROJECT_SYNC", `Registered project ${remote.id} (${repoPath}) \u2014 found on this runner's disk.`);
+  }
+  for (const local of config.registeredProjects) {
+    if (local.logoPathChecked) continue;
+    const remote = remoteById.get(local.id);
+    if (!remote) continue;
+    if (!remote.logo_path) {
+      const found = findBrandIconPath(resolveRepoPath(config, remote.repo_path));
+      if (found) {
+        try {
+          await updateProjectLogoPath(supabase, local.id, found);
+          logger.runner.info("PROJECT_SYNC", `Auto-detected logo "${found}" for project ${local.id}.`);
+        } catch (err) {
+          logger.runner.error("PROJECT_SYNC", `Failed to publish auto-detected logo for project ${local.id}:`, err);
+          continue;
+        }
+      }
+    }
+    local.logoPathChecked = true;
+    changed = true;
+  }
+  const stillRegistered = config.registeredProjects.filter((project) => {
+    if (remoteById.has(project.id)) return true;
+    registeredPaths.delete(project.id);
+    changed = true;
+    logger.runner.info("PROJECT_SYNC", `Project ${project.id} (${project.repoPath}) was removed from the web app; no longer watching it.`);
+    return false;
+  });
+  config.registeredProjects = stillRegistered;
+  if (changed) saveConfig(config);
+}
+
+// src/review.ts
+import { join as join9 } from "node:path";
+var inFlightCardIds2 = /* @__PURE__ */ new Set();
+async function handleCardEnteredRevisao(supabase, config, card) {
+  if (inFlightCardIds2.has(card.id)) return;
+  inFlightCardIds2.add(card.id);
+  try {
+    const project = await getProject(supabase, card.project_id);
+    const children = await getProjectRepos(supabase, project.id);
+    const repoRoot = resolveRepoPath(config, project.repo_path);
+    const targets = children.length > 0 ? children.filter((child2) => child2.dev_command).map((child2) => ({ label: child2.subpath, cwd: join9(repoRoot, child2.subpath), command: child2.dev_command })) : project.dev_command ? [{ label: "", cwd: repoRoot, command: project.dev_command }] : [];
+    if (targets.length === 0) {
+      logger.card.info(card.id, `No dev_command configured for project ${project.id}, skipping automatic preview.`);
+      return;
+    }
+    const results = await Promise.all(
+      targets.map((target) => ensurePreview(`${project.id}:${target.label}`, target.label, target.cwd, target.command, card.id))
+    );
+    const previews2 = results.filter((result) => result !== null);
+    if (previews2.length === 0) {
+      logger.card.warn(card.id, `None of the ${targets.length} configured dev command(s) produced a usable preview.`);
+      return;
+    }
+    await updateCard(supabase, card.id, { previewUrls: previews2 });
+    logger.card.info(card.id, `Preview URLs set: ${previews2.map((preview) => preview.url).join(", ")}.`);
+  } finally {
+    inFlightCardIds2.delete(card.id);
+  }
+}
+async function checkPendingPreviews(supabase, config) {
+  for (const registered of config.registeredProjects) {
+    const cards = await listCardsInColumn(supabase, registered.id, "revisao");
+    for (const card of cards) {
+      if (card.assigned_user_id !== config.ownerUserId) continue;
+      if (card.preview_urls.length > 0) continue;
+      await handleCardEnteredRevisao(supabase, config, card);
+    }
+  }
+}
+async function handleDevServerRestartRequested(supabase, config, project) {
+  const registered = config.registeredProjects.find((candidate) => candidate.id === project.id);
+  if (!registered) {
+    logger.runner.warn("REVIEW", `Ignoring dev server restart request: project ${project.id} is not registered on this runner.`);
+    await clearDevServerRestartRequest(supabase, project.id);
+    return;
+  }
+  stopProjectPreviews(project.id);
+  const allCards = await listCardsInColumn(supabase, project.id, "revisao");
+  const cards = allCards.filter((card) => card.assigned_user_id === config.ownerUserId);
+  if (cards.length === 0) {
+    logger.runner.info("REVIEW", `Dev server restart requested for project ${project.id} but no card assigned to this runner's user is in "revisao" \u2014 nothing to respawn.`);
+    await clearDevServerRestartRequest(supabase, project.id);
+    return;
+  }
+  await Promise.all(cards.map((card) => updateCard(supabase, card.id, { previewUrls: [] })));
+  await Promise.all(cards.map((card) => handleCardEnteredRevisao(supabase, config, card)));
+  await clearDevServerRestartRequest(supabase, project.id);
+}
+async function checkPendingDevServerRestarts(supabase, config) {
+  for (const registered of config.registeredProjects) {
+    const project = await getProject(supabase, registered.id);
+    if (project.dev_server_restart_requested_at) {
+      await handleDevServerRestartRequested(supabase, config, project);
+    }
+  }
+}
+
+// src/terminalServer.ts
+import { parse as parse2 } from "node:url";
+import { WebSocketServer } from "ws";
+function attachTerminalServer(httpServer) {
+  const wss = new WebSocketServer({ server: httpServer });
+  wss.on("connection", (socket, request) => {
+    const { query } = parse2(request.url ?? "", true);
+    const sessionId = typeof query.sessionId === "string" ? query.sessionId : null;
+    const ticket = typeof query.ticket === "string" ? query.ticket : null;
+    if (!sessionId || !ticket) {
+      logger.runner.warn("TERMINAL", "Terminal WS rejected: missing sessionId or ticket in request URL.");
+      socket.close(4400, "Missing sessionId or ticket");
+      return;
+    }
+    const handle = getPtySession(sessionId);
+    if (!handle || handle.ticket !== ticket) {
+      logger.runner.warn("TERMINAL", `Terminal WS rejected for session ${sessionId}: ${handle ? "ticket mismatch" : "no pty registered for this session"}.`);
+      socket.close(4401, "Invalid session or ticket");
+      return;
+    }
+    handle.sockets.add(socket);
+    for (const chunk of handle.outputBuffer) socket.send(chunk);
+    socket.on("message", (data, isBinary) => {
+      if (isBinary) {
+        try {
+          const { cols, rows } = JSON.parse(data.toString("utf8"));
+          if (typeof cols === "number" && typeof rows === "number") resizePtySession(sessionId, cols, rows);
+        } catch (err) {
+          logger.runner.warn("TERMINAL", `Terminal WS: ignoring malformed resize frame for session ${sessionId}:`, err);
+        }
+        return;
+      }
+      handle.pty.write(data.toString());
+    });
+    socket.on("close", () => {
+      handle.sockets.delete(socket);
+    });
+  });
+  logger.runner.info("TERMINAL", "Terminal WebSocket handler attached.");
+}
+
+// src/terminalTunnel.ts
+var RESTART_DELAY_MS = 5e3;
+var child = null;
+var stopping = false;
+var tunnelPending = false;
+async function publishHostname(supabase, config, hostname2) {
+  const { error } = await supabase.from("runners").update({ tunnel_hostname: hostname2 }).eq("id", config.runnerId);
+  if (error) logger.runner.error("CLOUDFLARE", "Failed to update runners.tunnel_hostname:", error);
+}
+async function openQuickTunnel(supabase, config, port) {
+  tunnelPending = true;
+  const tunnel = await startQuickTunnel("the terminal server", port);
+  if (!tunnel) {
+    tunnelPending = false;
+    await publishHostname(supabase, config, null);
+    logger.runner.warn("CLOUDFLARE", "Terminal tunnel unavailable \u2014 the web terminal will not be able to reach this runner.");
+    return;
+  }
+  child = tunnel.child;
+  tunnelPending = false;
+  const hostname2 = toTunnelHostname(tunnel.url);
+  await publishHostname(supabase, config, hostname2);
+  logger.runner.info("CLOUDFLARE", `Terminal tunnel up: ${hostname2} -> localhost:${port}.`);
+  tunnel.child.on("exit", () => {
+    child = null;
+    if (stopping) return;
+    void publishHostname(supabase, config, null);
+    logger.runner.warn("CLOUDFLARE", `Terminal tunnel dropped, restarting in ${RESTART_DELAY_MS}ms.`);
+    setTimeout(() => {
+      if (!stopping) void openQuickTunnel(supabase, config, port);
+      else tunnelPending = false;
+    }, RESTART_DELAY_MS);
+  });
+}
+async function ensureTerminalTunnel(supabase, config, port) {
+  stopping = false;
+  if (child || tunnelPending) return;
+  await openQuickTunnel(supabase, config, port);
+}
+async function stopTerminalTunnel(supabase, config) {
+  stopping = true;
+  child?.kill();
+  child = null;
+  tunnelPending = false;
+  await publishHostname(supabase, config, null);
+}
+
+// src/runner.ts
+async function startRunner() {
+  const loadedConfig = loadConfig();
+  if (!loadedConfig) {
+    logger.runner.error("BOOT", 'No runner set up yet. Run "agent-board-runner start --path <repos-root>" first.');
+    process.exit(1);
+  }
+  const config = applyRunnerName(applyAllowedRoot(loadedConfig));
+  if (!config.allowedRootPath) {
+    logger.runner.error(
+      "BOOT",
+      "No repos root configured. Pass --path <folder> to `start` or set AGENT_BOARD_ALLOWED_ROOT."
+    );
+    process.exit(1);
+  }
+  const supabase = createAuthedSupabaseClient();
+  let session;
+  try {
+    session = await requireSession(supabase);
+  } catch (error) {
+    logger.runner.error("BOOT", error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+  config.ownerUserId = session.user.id;
+  await supabase.auth.startAutoRefresh();
+  const { error: linkError } = await supabase.rpc("link_my_membership");
+  if (linkError) {
+    logger.runner.error("BOOT", "Failed to link pending project invites:", linkError);
+  }
+  const { data: existingRunner, error: existingRunnerError } = await supabase.from("runners").select("id").eq("user_id", config.ownerUserId).eq("name", config.runnerName).neq("id", config.runnerId).maybeSingle();
+  if (existingRunnerError) {
+    logger.runner.error("BOOT", "Failed to check for an existing runner row to adopt:", existingRunnerError);
+  } else if (existingRunner) {
+    logger.runner.warn(
+      "BOOT",
+      `Local identity (${config.runnerId}) has no matching Supabase row for "${config.runnerName}" \u2014 adopting the existing one (${existingRunner.id}) instead of registering a duplicate.`
+    );
+    config.runnerId = existingRunner.id;
+    saveConfig(config);
+  }
+  const { error: runnerError } = await supabase.from("runners").upsert({
+    id: config.runnerId,
+    user_id: config.ownerUserId,
+    name: config.runnerName,
+    auth_token_hash: config.authToken
+  });
+  if (runnerError) {
+    logger.runner.error("BOOT", "Failed to upsert this runner's row in Supabase:", runnerError);
+    process.exit(1);
+  }
+  const registeredPaths = new Set(config.registeredProjects.map((project) => project.id));
+  await syncRegisteredProjects(supabase, config, registeredPaths).catch((err) => logger.runner.error("PROJECT_SYNC", "syncRegisteredProjects failed:", err));
+  logger.runner.info("BOOT", `Agent Board runner "${config.runnerName}" starting (${registeredPaths.size} project(s) registered).`);
+  for (const project of config.registeredProjects) {
+    await reconcileStaleSessions(supabase, config, project.id).catch((err) => logger.runner.error("ORCHESTRATOR", "reconcileStaleSessions failed:", err));
+  }
+  await reconcileOrphanedSessions(supabase, config).catch((err) => logger.runner.error("ORCHESTRATOR", "reconcileOrphanedSessions failed:", err));
+  await reconcileUsageLimitedSessions(supabase, config).catch((err) => logger.runner.error("ORCHESTRATOR", "reconcileUsageLimitedSessions failed:", err));
+  const terminalPort = Number(process.env.AGENT_BOARD_TERMINAL_PORT ?? 8787);
+  ensureStatuslineScriptWritten();
+  const httpServer = createServer();
+  attachTerminalServer(httpServer);
+  attachFilesServer(httpServer, supabase, config);
+  let httpServerReady = false;
+  let realtimeReady = false;
+  function logRunnerReadyOnceBothUp() {
+    if (httpServerReady && realtimeReady) {
+      logger.runner.info("BOOT", "Runner ready.");
+    }
+  }
+  httpServer.listen(terminalPort, () => {
+    logger.runner.info("BOOT", `Runner HTTP/WebSocket server listening on port ${terminalPort}.`);
+    httpServerReady = true;
+    logRunnerReadyOnceBothUp();
+  });
+  startUsageMonitor();
+  void ensureTerminalTunnel(supabase, config, terminalPort).catch((err) => logger.runner.error("CLOUDFLARE", "ensureTerminalTunnel failed:", err));
+  void ensureFilesTickets(supabase, config).catch((err) => logger.runner.error("FILES", "ensureFilesTickets failed:", err));
+  void ensureSetupTicket(supabase, config).catch((err) => logger.runner.error("FILES", "ensureSetupTicket failed:", err));
+  let shuttingDown = false;
+  for (const signal of ["SIGINT", "SIGTERM"]) {
+    process.on(signal, () => {
+      if (shuttingDown) return;
+      shuttingDown = true;
+      stopAll();
+      void stopTerminalTunnel(supabase, config).finally(() => process.exit(0));
+    });
+  }
+  async function heartbeat() {
+    await supabase.from("runners").update({ last_heartbeat_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", config.runnerId);
+  }
+  supabase.channel(`runner:${config.runnerId}`).on(
+    "postgres_changes",
+    { event: "UPDATE", schema: "agent_board", table: "cards" },
+    (payload) => {
+      const card = payload.new;
+      const previous = payload.old;
+      if (!registeredPaths.has(card.project_id)) return;
+      if (card.assigned_user_id !== config.ownerUserId) return;
+      if (card.column_name === "desenvolvimento") {
+        void enqueueCard(supabase, config, card);
+      }
+      if (previous.column_name === "desenvolvimento" && card.column_name !== "desenvolvimento") {
+        void stopCardSession(supabase, config, card);
+      }
+      if (card.column_name === "revisao" && previous.column_name !== "revisao") {
+        void handleCardEnteredRevisao(supabase, config, card);
+      }
+      if (previous.column_name === "revisao" && card.column_name !== "revisao") {
+        releaseCard(card.id);
+      }
+      if (card.column_name === "fim" && previous.column_name !== "fim") {
+        void handleCardReachedFim(supabase, config, card);
+      }
+    }
+  ).on(
+    "postgres_changes",
+    { event: "UPDATE", schema: "agent_board", table: "projects" },
+    (payload) => {
+      const project = payload.new;
+      const previous = payload.old;
+      if (!registeredPaths.has(project.id)) return;
+      if (project.deploy_requested_at && project.deploy_requested_at !== previous.deploy_requested_at) {
+        void handleDeployRequested(supabase, config, project);
+      }
+      if (project.dev_server_restart_requested_at && project.dev_server_restart_requested_at !== previous.dev_server_restart_requested_at) {
+        void handleDevServerRestartRequested(supabase, config, project);
+      }
+    }
+  ).subscribe((status) => {
+    if (status === "SUBSCRIBED") {
+      logger.runner.info("REALTIME", "Subscribed to cards/projects changes.");
+      realtimeReady = true;
+      logRunnerReadyOnceBothUp();
+    } else {
+      logger.runner.warn("REALTIME", `Subscription status changed to "${status}" \u2014 card moves may only be picked up by the 60s tick fallback until this recovers.`);
+    }
+  });
+  async function tick() {
+    await heartbeat();
+    await syncRegisteredProjects(supabase, config, registeredPaths).catch((err) => logger.runner.error("PROJECT_SYNC", "syncRegisteredProjects failed:", err));
+    await ensureTerminalTunnel(supabase, config, terminalPort);
+    await ensureFilesTickets(supabase, config);
+    await ensureSetupTicket(supabase, config);
+    await scanForWork(supabase, config);
+    await reconcileUsageLimitedSessions(supabase, config).catch((err) => logger.runner.error("ORCHESTRATOR", "reconcileUsageLimitedSessions failed:", err));
+    await checkPendingDeploys(supabase, config).catch((err) => logger.runner.error("DEPLOY", "checkPendingDeploys failed:", err));
+    await checkPendingPreviews(supabase, config).catch((err) => logger.runner.error("REVIEW", "checkPendingPreviews failed:", err));
+    await checkPendingDevServerRestarts(supabase, config).catch((err) => logger.runner.error("REVIEW", "checkPendingDevServerRestarts failed:", err));
+  }
+  void tick();
+  setInterval(() => void tick(), 6e4);
+}
+
+// src/index.ts
+process.noDeprecation = true;
+loadEnv();
+loadEnv({ path: ".env.local", override: true });
+void startRunner();