agent-relay-server 0.119.0 → 0.119.2

package/runner/plugins/claude/monitors/relay-monitor.provisioned.mjs

@@ -71,7 +71,7 @@ var claudeProviderManifest = {
     }
   },
   catalog: {
-    defaultModel: "sonnet-4.6",
+    defaultModel: "sonnet-5",
     models: [
       { alias: "fable-5", label: "Fable 5", providerModel: "claude-fable-5", efforts: CLAUDE_LOW_TO_XHIGH_MAX, defaultEffort: "medium", unavailable: "suspended by export-control directive, 2026-06-12", ...codeModel({ contextWindowTokens: CONTEXT_1M }) },
       { alias: "opus-4.8", label: "Opus 4.8", providerModel: "claude-opus-4-8", efforts: CLAUDE_LOW_TO_XHIGH_MAX, defaultEffort: "medium", ...codeModel({ contextWindowTokens: CONTEXT_200K }) },
@@ -80,8 +80,8 @@ var claudeProviderManifest = {
       { alias: "opus-4.7[1m]", label: "Opus 4.7 1M", providerModel: "claude-opus-4-7[1m]", efforts: CLAUDE_LOW_TO_XHIGH_MAX, defaultEffort: "medium", ...codeModel({ contextWindowTokens: CONTEXT_1M }) },
       { alias: "opus-4.6", label: "Opus 4.6", providerModel: "claude-opus-4-6", efforts: CLAUDE_LOW_TO_MAX, defaultEffort: "medium", ...codeModel({ contextWindowTokens: CONTEXT_200K }) },
       { alias: "opus-4.6[1m]", label: "Opus 4.6 1M", providerModel: "claude-opus-4-6[1m]", efforts: CLAUDE_LOW_TO_MAX, defaultEffort: "medium", ...codeModel({ contextWindowTokens: CONTEXT_1M }) },
-      { alias: "sonnet-4.6", label: "Sonnet 4.6", providerModel: "claude-sonnet-4-6", efforts: CLAUDE_LOW_TO_MAX, defaultEffort: "medium", ...codeModel({ contextWindowTokens: CONTEXT_200K }) },
-      { alias: "sonnet-4.6[1m]", label: "Sonnet 4.6 1M", providerModel: "claude-sonnet-4-6[1m]", efforts: CLAUDE_LOW_TO_MAX, defaultEffort: "medium", ...codeModel({ contextWindowTokens: CONTEXT_1M }) },
+      { alias: "sonnet-5", label: "Sonnet 5", providerModel: "claude-sonnet-5", efforts: CLAUDE_LOW_TO_XHIGH_MAX, defaultEffort: "medium", ...codeModel({ contextWindowTokens: CONTEXT_200K }) },
+      { alias: "sonnet-5[1m]", label: "Sonnet 5 1M", providerModel: "claude-sonnet-5[1m]", efforts: CLAUDE_LOW_TO_XHIGH_MAX, defaultEffort: "medium", ...codeModel({ contextWindowTokens: CONTEXT_1M }) },
       { alias: "haiku", label: "Haiku", providerModel: "haiku", efforts: [], ...codeModel() }
     ]
   },
@@ -344,6 +344,10 @@ function relayTokenFromEnv() {
 }
 // sdk/src/bus-client.ts
 import { EventEmitter } from "events";
+function unrefTimer(timer) {
+  timer?.unref?.();
+}
+
 class MemoryCursorStore {
   value = null;
   async load() {
@@ -655,6 +659,7 @@ class RelayBusClient extends EventEmitter {
     this.heartbeat = setInterval(() => {
       this.sendHeartbeat();
     }, this.options.heartbeatIntervalMs ?? 30000);
+    unrefTimer(this.heartbeat);
   }
   stopHeartbeat() {
     if (this.heartbeat)
@@ -667,6 +672,7 @@ class RelayBusClient extends EventEmitter {
     this.stopHeartbeatWatchdog();
     const intervalMs = Math.max(100, Math.min(5000, this.heartbeatIntervalMs()));
     this.heartbeatWatchdog = setInterval(() => this.checkHeartbeatAck(), intervalMs);
+    unrefTimer(this.heartbeatWatchdog);
   }
   stopHeartbeatWatchdog() {
     if (this.heartbeatWatchdog)
@@ -753,6 +759,10 @@ class RelayBusClient extends EventEmitter {
   }
 }
 // sdk/src/provider-base.ts
+function unrefTimer2(timer) {
+  timer?.unref?.();
+}
+
 class ProviderBase {
   options;
   client;
@@ -814,6 +824,7 @@ class ProviderBase {
         this.client.status({ agentStatus: "online", ready: false });
       }
     }, 30000);
+    unrefTimer2(this.drain);
   }
 }
 // sdk/src/claim-tracker.ts

package/src/cli/context-probe.ts

@@ -41,13 +41,15 @@ export async function handleContextProbeCommand(args: string[]): Promise<void> {
   }
 
   if (printStatusLine) {
-    const command = [
-      "agent-relay",
-      "context-probe",
-      ...(wrapRequested ? ["--wrap", ...(wrapCommand ? [shellQuote(wrapCommand)] : [])] : ["--standalone"]),
-      ...(agentId ? ["--agent-id", shellQuote(agentId)] : []),
-      ...(stateDir ? ["--state-dir", shellQuote(stateDir)] : []),
-    ].join(" ");
+    const command = wrapRequested && !wrapCommand && !agentId && !stateDir
+      ? "agent-relay-claude-statusline"
+      : [
+          "agent-relay",
+          "context-probe",
+          ...(wrapRequested ? ["--wrap", ...(wrapCommand ? [shellQuote(wrapCommand)] : [])] : ["--standalone"]),
+          ...(agentId ? ["--agent-id", shellQuote(agentId)] : []),
+          ...(stateDir ? ["--state-dir", shellQuote(stateDir)] : []),
+        ].join(" ");
     console.log(command);
     return;
   }

package/src/db/migrations.ts

@@ -276,6 +276,7 @@ export function applyMigrations(): void {
   getDb().run("CREATE INDEX IF NOT EXISTS idx_msg_thread ON messages(thread_id)");
   getDb().run("CREATE UNIQUE INDEX IF NOT EXISTS idx_msg_idempotency ON messages(from_agent, idempotency_key) WHERE idempotency_key IS NOT NULL");
   getDb().run("CREATE INDEX IF NOT EXISTS idx_msg_delivery_status ON messages(delivery_status)");
+  getDb().run("CREATE INDEX IF NOT EXISTS idx_msg_claimed_expires ON messages(claimed_by, claim_expires_at, id) WHERE claimed_by IS NOT NULL");
   // (#846) composite replaces the old single-column idx_msg_resolved_to_agent; created
   // here — AFTER the resolved_to_agent ALTER above — so existing DBs without the column
   // don't crash (same hazard as idx_msg_from_kind_id / #483/#559).
@@ -1076,6 +1077,7 @@ export function applyMigrations(): void {
   addTaskCol("owner_agent_label", "owner_agent_label TEXT");
   addTaskCol("dispatch", "dispatch TEXT");
   addTaskCol("reaped_at", "reaped_at INTEGER");
+  getDb().run("CREATE INDEX IF NOT EXISTS idx_tasks_message_status ON tasks(message_id, status) WHERE message_id IS NOT NULL");
   getDb().run("CREATE INDEX IF NOT EXISTS idx_tasks_kind ON tasks(kind, status, updated_at)");
   getDb().run("CREATE INDEX IF NOT EXISTS idx_tasks_branch ON tasks(branch) WHERE branch IS NOT NULL");
   getDb().run("CREATE INDEX IF NOT EXISTS idx_tasks_team ON tasks(team_id) WHERE team_id IS NOT NULL");

package/src/db/schema.ts

@@ -672,6 +672,9 @@ export function initDb(path: string = "agent-relay.db"): Database {
     CREATE INDEX IF NOT EXISTS idx_tasks_status ON tasks(status);
     CREATE INDEX IF NOT EXISTS idx_tasks_target ON tasks(target);
     CREATE INDEX IF NOT EXISTS idx_tasks_updated ON tasks(updated_at);
+    CREATE INDEX IF NOT EXISTS idx_tasks_message_status
+      ON tasks(message_id, status)
+      WHERE message_id IS NOT NULL;
     -- idx_tasks_kind / idx_tasks_branch / idx_tasks_team reference the #834 columns and are
     -- created in applyMigrations() AFTER the ALTERs — never inline here: an existing pre-#834
     -- tasks table makes CREATE TABLE IF NOT EXISTS a no-op, so an inline index over a column

package/src/index.ts

@@ -1,443 +1,19 @@
 #!/usr/bin/env bun
-import type { ServerWebSocket } from "bun";
-import { initDb, getOrchestrator } from "./db";
-import { matchRoute } from "./routes";
-import { emitNewMessage, emitTaskChanged } from "./sse";
-import { busHandleClose, busHandleMessage, busHandleOpen, handleBusUpgrade } from "./bus";
-import { emitRelayEvent } from "./events";
-import { reconcileAutomationRuns, runDueAutomations, type AutomationDispatchResult, type AutomationReconcileResult } from "./automations";
-import { getLifecycleManager } from "./lifecycle-manager";
-import { getCompactionWatch } from "./compaction-watch";
-import { getConfig, setConfig } from "./config-store";
-import { startConnectorStatusPoller } from "./connectors";
-import { installNotificationSubscriptionRule } from "./notification-subscription-rules";
-import { installQuotaAdvisoryHandler } from "./quota-advisory";
-import { startPlanLiveBindings } from "./services/plan-live-bindings";
-import { startRelayScheduler } from "./services/scheduler";
-import { recordWorkspaceIssueActivity } from "./services/spawn-issue-activity";
-import { onWorkspaceCreate } from "./db";
-import { resolve, sep } from "path";
-import { gzipSync, brotliCompressSync, constants as zlibConstants } from "node:zlib";
-import {
-  AUTOMATION_INTERVAL_MS,
-  IDLE_TIMEOUT_SECONDS,
-  LOG_REQUESTS,
-  VERSION,
-  relayToken,
-} from "./config";
-import { CONTRACT_VERSIONS } from "./contracts";
-import {
-  applyCors,
-  assertSafeNetworkConfig,
-  corsPreflight,
-  forbidden,
-  getComponentAuth,
-  getIntegrationAuth,
-  isAuthorized,
-  isScopedRequestAuthorized,
-  isOriginAllowed,
-  isRequestAuthorizedFor,
-  unauthorized,
-} from "./security";
-import { handleCli } from "./cli";
-import { startMaintenanceScheduler } from "./maintenance";
-import { errMessage, RELAY_TOKEN_HEADER } from "agent-relay-sdk";
+import { errMessage } from "agent-relay-sdk";
 
 async function main(): Promise<void> {
-  const result = await handleCli(process.argv.slice(2));
-  if (result === "handled") return;
-  startServer();
-}
-
-// Restart-on-update gating (issue #341).
-//
-// A `restartOnUpdate` policy should cycle its managed agent only when the agent's
-// running runner code is now protocol-INCOMPATIBLE with the relay — i.e. on a
-// runner-protocol bump — NOT on every package version change. Gating on the package
-// version churned the always-on Telegram agent ~12×/day (one restart per patch
-// redeploy), dropping in-flight work (surfaced #340). The runner protocol
-// (CONTRACT_VERSIONS.runnerProtocol) only moves on a breaking runner change, so this
-// fires ~never during normal releases.
-//
-// `relay-version` is still tracked for observability/telemetry, but it no longer
-// triggers restarts.
-export function reconcileRelayVersion(): void {
-  const storedVersion = getConfig<string>("system", "relay-version")?.value;
-  if (storedVersion !== VERSION) setConfig("system", "relay-version", VERSION, "server-startup");
-
-  const storedProtocol = getConfig<string>("system", "runner-protocol-version")?.value;
-  const currentProtocol = String(CONTRACT_VERSIONS.runnerProtocol);
-  if (storedProtocol === currentProtocol) return;
-  // Skip the very first run (no stored protocol yet) — that's initial bootstrap, not an upgrade.
-  if (storedProtocol) getLifecycleManager().onRelayUpdated(VERSION);
-  setConfig("system", "runner-protocol-version", currentProtocol, "server-startup");
-}
-
-function startServer(): void {
-  const PORT = Number(process.env.PORT) || 4850;
-  const HOST = process.env.HOST || "127.0.0.1";
-  const DB_PATH = process.env.DB_PATH || "agent-relay.db";
-
-  assertSafeNetworkConfig(HOST);
-  initDb(DB_PATH);
-  onWorkspaceCreate(recordWorkspaceIssueActivity);
-  installQuotaAdvisoryHandler();
-  installNotificationSubscriptionRule();
-  startPlanLiveBindings();
-  getLifecycleManager().start();
-  getCompactionWatch().start();
-  reconcileRelayVersion();
-  startConnectorStatusPoller();
-  startMaintenanceScheduler();
-  startRelayScheduler();
-
-  setInterval(() => {
-    emitAutomationReconciliations(reconcileAutomationRuns());
-    emitAutomationDispatches(runDueAutomations());
-  }, AUTOMATION_INTERVAL_MS);
-
-  Bun.serve<RelaySocketData>({
-    port: PORT,
-    hostname: HOST,
-    idleTimeout: IDLE_TIMEOUT_SECONDS,
-    fetch: createFetchHandler({ publicDir: process.env.PUBLIC_DIR, logRequests: LOG_REQUESTS }),
-    websocket: {
-      open(ws) {
-        if (ws.data?.kind === "terminal-proxy") return openTerminalProxy(ws as TerminalProxySocket);
-        return busHandleOpen(ws as any);
-      },
-      message(ws, data) {
-        if (ws.data?.kind === "terminal-proxy") return sendTerminalProxyFrame(ws as TerminalProxySocket, data);
-        return busHandleMessage(ws as any, data);
-      },
-      close(ws) {
-        if (ws.data?.kind === "terminal-proxy") return closeTerminalProxy(ws as TerminalProxySocket);
-        return busHandleClose(ws as any);
-      },
-    },
-  });
-
-  console.log(`agent-relay ${VERSION} running on http://${HOST}:${PORT}`);
-}
-
-interface TerminalProxySocketData {
-  kind: "terminal-proxy";
-  upstreamUrl: string;
-  upstreamToken?: string;
-  upstream?: WebSocket;
-  pending: Array<string | Buffer>;
-}
-
-type RelaySocketData = {
-  kind: "bus";
-  id: string;
-  componentScopes?: string[];
-} | TerminalProxySocketData;
-
-type TerminalProxySocket = ServerWebSocket<TerminalProxySocketData>;
-
-function emitAutomationDispatches(results: AutomationDispatchResult[]): void {
-  for (const result of results) {
-    if (result.command) emitAutomationCommand(result.command);
-    if (result.message) emitNewMessage(result.message);
-    if (result.task) emitTaskChanged(result.task, "task.created");
-    emitRelayEvent({
-      type: "automation.run",
-      source: "server",
-      subject: result.run.id,
-      data: { automation: result.automation, run: result.run, task: result.task },
-    });
-  }
-}
-
-function emitAutomationReconciliations(results: AutomationReconcileResult[]): void {
-  for (const result of results) {
-    if (result.command) emitAutomationCommand(result.command);
-    if (result.message) emitNewMessage(result.message);
-    if (result.task) emitTaskChanged(result.task, "task.updated");
-    emitRelayEvent({
-      type: "automation.run",
-      source: "server",
-      subject: result.run.id,
-      data: { run: result.run, task: result.task },
-    });
-  }
-}
-
-function emitAutomationCommand(command: { id: string; source: string; status: string }): void {
-  emitRelayEvent({
-    type: command.status === "pending" ? "command.requested" : `command.${command.status}`,
-    source: command.source,
-    subject: command.id,
-    data: { command },
-  });
-}
-
-function openTerminalProxy(ws: TerminalProxySocket): void {
-  const token = ws.data.upstreamToken;
-  // Bun's client WebSocket accepts a `headers` option (non-standard; absent from DOM types).
-  const upstream = token
-    ? new WebSocket(ws.data.upstreamUrl, { headers: { [RELAY_TOKEN_HEADER]: token } } as unknown as string[])
-    : new WebSocket(ws.data.upstreamUrl);
-  ws.data.upstream = upstream;
-
-  upstream.onopen = () => {
-    const pending = ws.data.pending.splice(0);
-    for (const frame of pending) upstream.send(frame);
-  };
-  upstream.onmessage = (event) => {
-    if (typeof event.data === "string" || event.data instanceof Buffer) {
-      ws.send(event.data);
-    } else if (event.data instanceof ArrayBuffer) {
-      ws.send(event.data);
-    } else if (event.data instanceof Blob) {
-      void event.data.arrayBuffer().then((buffer) => ws.send(buffer)).catch(() => {});
-    }
-  };
-  upstream.onerror = () => {
-    ws.send(JSON.stringify({ type: "error", error: "terminal stream upstream error" }));
-  };
-  upstream.onclose = () => {
-    ws.close();
-  };
-}
-
-function sendTerminalProxyFrame(ws: TerminalProxySocket, data: string | Buffer): void {
-  const upstream = ws.data.upstream;
-  if (!upstream || upstream.readyState === WebSocket.CONNECTING) {
-    ws.data.pending.push(data);
+  const args = process.argv.slice(2);
+  if (args[0] === "context-probe") {
+    const { handleContextProbeCommand } = await import("./cli/context-probe");
+    await handleContextProbeCommand(args.slice(1));
     return;
   }
-  if (upstream.readyState !== WebSocket.OPEN) return;
-  upstream.send(data);
-}
 
-function closeTerminalProxy(ws: TerminalProxySocket): void {
-  const upstream = ws.data.upstream;
-  ws.data.pending = [];
-  if (upstream && upstream.readyState === WebSocket.OPEN) upstream.close();
-}
-
-export function createFetchHandler(
-  opts: { publicDir?: string; logRequests?: boolean } = {},
-): {
-  (req: Request): Promise<Response>;
-  (req: Request, server: Bun.Server<RelaySocketData>): Promise<Response | undefined>;
-} {
-  const publicDir = resolve(opts.publicDir ?? resolve(import.meta.dir, "../public"));
-  const publicDirPrefix = publicDir + sep;
-  const logRequests = opts.logRequests ?? false;
-
-  return async function fetch(req: Request, server?: Bun.Server<RelaySocketData>): Promise<Response | undefined> {
-    const url = new URL(req.url);
-
-    if (url.pathname === "/bus") {
-      if (!server) return new Response("WebSocket upgrade unavailable", { status: 400 });
-      return handleBusUpgrade(req, server);
-    }
-
-    const terminalStreamMatch = url.pathname.match(/^\/api\/orchestrators\/([^/]+)\/terminal\/([^/]+)\/stream$/);
-    if (req.method === "GET" && terminalStreamMatch) {
-      if (!server) return new Response("WebSocket upgrade unavailable", { status: 400 });
-      if (!isOriginAllowed(req)) return Response.json({ error: "origin not allowed" }, { status: 403 });
-      if (!isAuthorized(req)) return unauthorized(req);
-      const orchestratorId = decodeURIComponent(terminalStreamMatch[1]!);
-      const session = decodeURIComponent(terminalStreamMatch[2]!);
-      if (!isRequestAuthorizedFor(req, { scope: "terminal:attach", resource: { orchestratorId, terminalAttach: true } })) {
-        return forbidden(req);
-      }
-      const orch = getOrchestrator(orchestratorId);
-      if (!orch) return Response.json({ error: "orchestrator not found" }, { status: 404 });
-      if (!orch.apiUrl) return Response.json({ error: "orchestrator does not expose an API" }, { status: 422 });
-      if (orch.status !== "online") return Response.json({ error: "orchestrator is offline" }, { status: 422 });
-      const upstream = new URL(`/api/terminal/${encodeURIComponent(session)}/stream`, orch.apiUrl);
-      upstream.protocol = upstream.protocol === "https:" ? "wss:" : "ws:";
-      // Pass the relay token as a header (not a query param) so it never lands in
-      // access/proxy logs (#149). The orchestrator accepts both, but headers are safer.
-      const token = relayToken();
-      const upgraded = server.upgrade(req, {
-        data: { kind: "terminal-proxy", upstreamUrl: upstream.toString(), upstreamToken: token, pending: [] },
-      });
-      if (!upgraded) return new Response("WebSocket upgrade failed", { status: 400 });
-      return undefined;
-    }
-
-    if (req.method === "OPTIONS") {
-      return corsPreflight(req);
-    }
-    if (!isOriginAllowed(req)) {
-      return Response.json({ error: "origin not allowed" }, { status: 403 });
-    }
-
-    // API routes
-    const matched = matchRoute(req.method, url.pathname);
-    if (matched) {
-      const publicPaths = ["/api/spec", "/api/docs", "/api/health"];
-      // Pre-auth allowlist (#389): the auth endpoints must be reachable unauthenticated — they ARE
-      // the way a session is obtained. Each handler self-authenticates (login verifies credentials,
-      // refresh validates the refresh token, logout revokes the presented token). Everything else
-      // still flows through the component-token gate below.
-      const publicAuthPaths = ["/api/auth/providers", "/api/auth/login", "/api/auth/refresh", "/api/auth/logout"];
-      if (!publicPaths.includes(url.pathname) && !publicAuthPaths.includes(url.pathname)) {
-        const integrationAuth = getIntegrationAuth(req);
-        const componentAuth = getComponentAuth(req);
-        const handlerOwnsScopedAuth = url.pathname === "/api/tokens/me" ||
-          url.pathname === "/api/settings" ||
-          url.pathname.startsWith("/api/settings/");
-        if (!isAuthorized(req)) {
-          if (!integrationAuth) {
-            return unauthorized(req);
-          }
-          if (!handlerOwnsScopedAuth && !isScopedRequestAuthorized(req)) return forbidden(req);
-        }
-        if (componentAuth && !handlerOwnsScopedAuth && !isScopedRequestAuthorized(req)) return forbidden(req);
-      }
-      const response = await matched.handler(req, matched.params);
-      applyCors(req, response);
-      if (logRequests && url.pathname.startsWith("/api/")) {
-        console.log(`${req.method} ${url.pathname} → ${response.status}`);
-      }
-      return response;
-    }
-
-    // Dashboard — serve static files, rejecting path traversal and directory requests
-    let requested = url.pathname === "/" ? "/index.html" : url.pathname;
-    if (requested.endsWith("/")) requested += "index.html";
-    const resolved = resolve(publicDir, `.${requested}`);
-    if (!resolved.startsWith(publicDirPrefix)) {
-      return Response.json({ error: "not found" }, { status: 404 });
-    }
-    const file = Bun.file(resolved);
-    if (await file.exists()) {
-      return await serveStaticFile(req, resolved, requested, file);
-    }
-
-    return Response.json({ error: "not found" }, { status: 404 });
-  } as {
-    (req: Request): Promise<Response>;
-    (req: Request, server: Bun.Server<RelaySocketData>): Promise<Response | undefined>;
-  };
-}
-
-// In-memory compressed-variant cache, keyed by absolute path. Invalidated when
-// the file's mtime/size changes, so a rebuilt bundle is recompressed on next
-// request. The dashboard ships as a minified, code-split bundle (#200/#201);
-// brotli/gzip on top cuts the wire size further, which is the dominant cost over
-// high-latency links. Hashed /assets/* chunks are also served immutable so
-// repeat visits skip them entirely (see staticHeaders).
-type CompressedVariant = { body: Uint8Array; encoding: "br" | "gzip" };
-const compressedCache = new Map<
-  string,
-  { mtimeMs: number; size: number; br?: Uint8Array; gzip?: Uint8Array }
->();
-
-const COMPRESSIBLE = /\.(html|js|css|svg|json|webmanifest|map)$/;
-
-function isCompressible(pathname: string): boolean {
-  return pathname === "/" || pathname.endsWith("/") || COMPRESSIBLE.test(pathname);
-}
-
-function negotiateEncoding(req: Request): "br" | "gzip" | null {
-  const accept = req.headers.get("accept-encoding") ?? "";
-  if (/\bbr\b/.test(accept)) return "br";
-  if (/\bgzip\b/.test(accept)) return "gzip";
-  return null;
-}
-
-async function getCompressedVariant(
-  resolved: string,
-  mtimeMs: number,
-  size: number,
-  encoding: "br" | "gzip",
-  raw: () => Promise<Uint8Array>,
-): Promise<CompressedVariant> {
-  let entry = compressedCache.get(resolved);
-  if (!entry || entry.mtimeMs !== mtimeMs || entry.size !== size) {
-    entry = { mtimeMs, size };
-    compressedCache.set(resolved, entry);
-  }
-  const cached = entry[encoding];
-  if (cached) return { body: cached, encoding };
-  const data = await raw();
-  const body =
-    encoding === "br"
-      ? brotliCompressSync(data, {
-          params: {
-            // Quality 5 ~ near-gzip CPU, much better ratio; this runs once per
-            // file version then serves from cache, so cost is amortized away.
-            [zlibConstants.BROTLI_PARAM_QUALITY]: 5,
-            [zlibConstants.BROTLI_PARAM_SIZE_HINT]: data.byteLength,
-          },
-        })
-      : gzipSync(data, { level: 6 });
-  entry[encoding] = body;
-  return { body, encoding };
-}
-
-async function serveStaticFile(
-  req: Request,
-  resolved: string,
-  requested: string,
-  file: ReturnType<typeof Bun.file>,
-): Promise<Response> {
-  const stat = await file.stat();
-  const headers = staticHeaders(requested);
-  // Strong-ish validator from mtime + size; encoding-suffixed so a client never
-  // gets a 304 for a variant it didn't store.
-  const baseTag = `${stat.mtime.getTime().toString(36)}-${stat.size.toString(36)}`;
-
-  const encoding = isCompressible(requested) ? negotiateEncoding(req) : null;
-  const etag = `"${baseTag}${encoding ? `-${encoding}` : ""}"`;
-  headers.set("ETag", etag);
-  if (req.headers.get("if-none-match") === etag) {
-    return new Response(null, { status: 304, headers });
-  }
-
-  if (encoding) {
-    const { body } = await getCompressedVariant(
-      resolved,
-      stat.mtime.getTime(),
-      stat.size,
-      encoding,
-      () => file.bytes(),
-    );
-    headers.set("Content-Encoding", encoding);
-    headers.set("Vary", "Accept-Encoding");
-    headers.set("Content-Length", String(body.byteLength));
-    // Uint8Array is a valid BodyInit at runtime in Bun; the DOM lib types omit it.
-    return new Response(body as unknown as BodyInit, { headers });
-  }
-
-  return new Response(file, { headers });
-}
-
-function staticHeaders(pathname: string): Headers {
-  const headers = new Headers();
-  const contentType = staticContentType(pathname);
-  if (contentType) headers.set("Content-Type", contentType);
-  // Hashed build assets are content-addressed (a content change = a new
-  // filename), so they're safe to cache forever — the browser never needs to
-  // revalidate them. The shell + PWA control files must always revalidate
-  // instead (ETag makes that a cheap 304 when unchanged).
-  if (pathname.startsWith("/assets/")) {
-    headers.set("Cache-Control", "public, max-age=31536000, immutable");
-  } else if (pathname === "/sw.js" || pathname === "/manifest.webmanifest") {
-    headers.set("Cache-Control", "no-cache");
-  } else if (pathname === "/" || pathname.endsWith("/") || pathname.endsWith(".html")) {
-    headers.set("Cache-Control", "no-cache");
-  }
-  return headers;
-}
-
-function staticContentType(pathname: string): string | undefined {
-  if (pathname.endsWith(".webmanifest")) return "application/manifest+json; charset=utf-8";
-  if (pathname.endsWith(".js")) return "text/javascript; charset=utf-8";
-  if (pathname.endsWith(".css")) return "text/css; charset=utf-8";
-  if (pathname.endsWith(".map")) return "application/json; charset=utf-8";
-  if (pathname.endsWith(".html")) return "text/html; charset=utf-8";
-  if (pathname.endsWith(".svg")) return "image/svg+xml";
-  if (pathname.endsWith(".png")) return "image/png";
-  return undefined;
+  const { handleCli } = await import("./cli");
+  const result = await handleCli(args);
+  if (result === "handled") return;
+  const { startServer } = await import("./server");
+  startServer();
 }
 
 if (import.meta.main) {

package/src/issue-tracker/github.ts

@@ -3,8 +3,9 @@ import type { IssueTrackerAdapter, IssueTrackerCloseOptions, IssueTrackerIssueDe
 
 export const GITHUB_FIXED_LABEL = "fixed";
 const GITHUB_CREDENTIAL_REQUIREMENT = "GitHub issue tracker adapter requires gh authenticated with a token that has issues:write scope";
-// #838 — hard bound on the spawn-time issue read so hydration never stalls the spawn.
-const ISSUE_DETAIL_READ_TIMEOUT_MS = 10_000;
+// #935 — spawn-time issue hydration sits on the dashboard /agents/spawn -> 202 path.
+// Keep it sub-second and degrade to "spec unavailable" if GitHub is slow.
+const ISSUE_DETAIL_READ_TIMEOUT_MS = 750;
 
 type GitHubApiMethod = "GET" | "PATCH" | "POST";
 
@@ -83,19 +84,19 @@ async function ghApi(request: GitHubApiRequest): Promise<unknown> {
   // auth backed by a GitHub token with `issues:write` scope.
   const args = ["gh", "api", "--method", request.method, request.path, "--header", "Accept: application/vnd.github+json"];
   appendBodyArgs(args, request.body);
-  // `Bun.spawnSync` blocks the event loop synchronously, so a JS-level timeout race can't preempt
-  // a hung `gh`; the subprocess `timeout` (kills with SIGTERM on expiry) is the only effective bound.
-  const proc = Bun.spawnSync(args, {
+  const proc = Bun.spawn(args, {
     stdin: "ignore",
     stdout: "pipe",
     stderr: "pipe",
     env: process.env,
-    ...(request.timeoutMs ? { timeout: request.timeoutMs } : {}),
   });
-  const stdout = textFromBytes(proc.stdout).trim();
-  if (proc.exitCode !== 0) {
-    const stderr = textFromBytes(proc.stderr).trim();
-    const timedOut = request.timeoutMs && (proc.signalCode === "SIGTERM" || proc.exitCode === null);
+  const stdoutPromise = streamText(proc.stdout);
+  const stderrPromise = streamText(proc.stderr);
+  const timedOut = await waitForExitOrTimeout(proc, request.timeoutMs);
+  const [stdoutRaw, stderrRaw] = await Promise.all([stdoutPromise, stderrPromise]);
+  const stdout = stdoutRaw.trim();
+  if (timedOut || proc.exitCode !== 0) {
+    const stderr = stderrRaw.trim();
     throw new Error(`${GITHUB_CREDENTIAL_REQUIREMENT}; gh api ${timedOut ? `timed out after ${request.timeoutMs}ms` : "failed"}: ${stderr || stdout || `exit ${proc.exitCode}`}`);
   }
   if (!stdout) return {};
@@ -106,6 +107,40 @@ async function ghApi(request: GitHubApiRequest): Promise<unknown> {
   }
 }
 
+async function streamText(stream: ReadableStream<Uint8Array> | null): Promise<string> {
+  if (!stream) return "";
+  try {
+    return await new Response(stream).text();
+  } catch {
+    return "";
+  }
+}
+
+async function waitForExitOrTimeout(proc: Bun.Subprocess<"ignore", "pipe", "pipe">, timeoutMs: number | undefined): Promise<boolean> {
+  if (!timeoutMs || timeoutMs <= 0) {
+    await proc.exited;
+    return false;
+  }
+  let timedOut = false;
+  let kill: ReturnType<typeof setTimeout> | undefined;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    try { proc.kill("SIGTERM"); } catch {}
+    kill = setTimeout(() => {
+      try { proc.kill("SIGKILL"); } catch {}
+    }, 1_000);
+    kill.unref?.();
+  }, timeoutMs);
+  timeout.unref?.();
+  try {
+    await proc.exited;
+  } finally {
+    clearTimeout(timeout);
+    if (kill) clearTimeout(kill);
+  }
+  return timedOut;
+}
+
 function appendBodyArgs(args: string[], body: Record<string, unknown> | undefined): void {
   if (!body) return;
   for (const [key, value] of Object.entries(body)) {