agentgui 1.0.1126 → 1.0.1127

package/lib/http-routes/shared.js

@@ -1,225 +0,0 @@
-import fs from 'fs';
-import path from 'path';
-import os from 'os';
-import crypto from 'crypto';
-
-// Module-level platform constant — never changes at runtime.
-export const IS_WINDOWS = os.platform() === 'win32';
-
-// Confine a requested filesystem path to an allowlist of roots. Two layers:
-//   1. normalize + resolved-prefix check on the LEXICAL path (blocks `../`
-//      traversal, which path.normalize collapses so a literal `..` test is a
-//      no-op);
-//   2. fs.realpathSync + the SAME prefix check on the REAL path, so a symlink
-//      that lives inside an allowed root but points outside it cannot escape
-//      (the lexical path passes layer 1, the resolved target fails layer 2).
-// Returns { ok, realPath, reason }. realPath is the symlink-resolved absolute
-// path to stat/read; callers use it, never the raw input. A non-existent path
-// has no realpath yet, so it fails closed with reason 'not found'.
-export function confineToRoots(inputPath, allowRoots) {
-  const norms = allowRoots.map(r => path.normalize(r));
-  const expanded = inputPath && inputPath.startsWith('~') ? inputPath.replace('~', os.homedir()) : inputPath;
-  const normalizedPath = path.normalize(expanded || '');
-  const isAbsolute = IS_WINDOWS ? /^[A-Za-z]:[\\/]/.test(normalizedPath) : normalizedPath.startsWith('/');
-  const within = (p) => {
-    const np = IS_WINDOWS ? p.toLowerCase() : p;
-    return norms.some(root => {
-      const r = IS_WINDOWS ? root.toLowerCase() : root;
-      return np === r || np.startsWith(r + path.sep);
-    });
-  };
-  if (!isAbsolute || !within(normalizedPath)) return { ok: false, reason: 'path outside allowed roots' };
-  // realpath the target and re-confine, defeating symlink escape (TOCTOU/link
-  // traversal). If realpath throws (missing path / broken link) fail closed.
-  let realPath;
-  try { realPath = fs.realpathSync(normalizedPath); }
-  catch (e) { return { ok: false, reason: e && e.code === 'ENOENT' ? 'not found' : 'cannot resolve path', code: e && e.code }; }
-  if (!within(realPath)) return { ok: false, reason: 'symlink target outside allowed roots' };
-  return { ok: true, realPath };
-}
-
-// Mask ?token=VALUE in a URL string before logging so credentials never
-// appear in server logs or error messages.
-export function maskToken(url) {
-  if (typeof url !== 'string') return url;
-  return url.replace(/([?&]token=)[^&]*/gi, '$1***');
-}
-
-// Secret-bearing basenames that must never be readable through ANY confined
-// raw-bytes route (preview or download), even when they sit inside an allowed
-// root: dotfiles, env/key/cert material, and credential stores. One const so
-// /api/file and /api/download can never drift apart.
-export const SECRET_RE = /(^\.|\.(env|pem|key|crt|p12|pfx)$|secret|credential|\.npmrc$|\.netrc$)/i;
-
-// The allowlist the Files surface operates within: server cwd + Claude
-// projects dir, widened via FS_ROOTS (path-separated). One construction so
-// /api/list,file,download and the mutation routes can never drift apart.
-export function fsAllowRoots() {
-  const roots = [
-    process.env.CLAUDE_PROJECTS_DIR || path.join(os.homedir(), '.claude', 'projects'),
-  ];
-  // The server cwd is only exposed when PASSWORD is set (the witnessed
-  // localhost-PASSWORD deploy lists the repo tree) or FS_ALLOW_CWD=1 is opted
-  // in. An open no-PASSWORD deploy must NOT expose the whole server tree.
-  if (process.env.PASSWORD || process.env.FS_ALLOW_CWD === '1') {
-    roots.push(process.env.STARTUP_CWD || process.cwd());
-  }
-  if (process.env.FS_ROOTS) roots.push(...process.env.FS_ROOTS.split(path.delimiter));
-  return roots.map(r => path.normalize(r));
-}
-
-// A new file/dir name must be a single path component: no separators, no
-// traversal, no NTFS alternate-data-stream colon, no reserved Windows device
-// names, no trailing dot/space (Windows silently strips them, aliasing two
-// names onto one entry). Returns the trimmed name or null when inadmissible.
-export function sanitizeEntryName(name) {
-  if (typeof name !== 'string') return null;
-  const n = name.trim();
-  if (!n || n.length > 255) return null;
-  if (/[\\/:*?"<>|\x00-\x1f]/.test(n)) return null;
-  if (n === '.' || n === '..') return null;
-  if (/[. ]$/.test(n)) return null;
-  if (/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\.|$)/i.test(n)) return null;
-  return n;
-}
-
-// Every confined filesystem route accepts its target path via a `?path=`/
-// `?dir=` query param, preferred over a path SEGMENT. A reverse proxy's
-// proxy_pass URI normalization can decode-then-reencode the request path,
-// collapsing an encoded %2F segment slash back into a literal '/' before
-// forwarding - the app then sees extra path segments instead of one opaque
-// one, strips what it thinks is a leading '/', and silently turns an absolute
-// path into a relative one that fails confinement even for genuinely
-// accessible directories/files. A query param is untouched by that
-// normalization on any proxy in front of this app. `legacyPrefix` is the old
-// `/api/xxx/<path>` route prefix, still accepted for any caller not yet
-// updated to the query-param form.
-export function resolveConfinedPath(req, routePath, queryKey, legacyPrefix) {
-  const url = new URL(req.url, 'http://x');
-  const qVal = url.searchParams.get(queryKey);
-  if (qVal != null) return qVal;
-  const raw = routePath.split('?')[0].slice(legacyPrefix.length).replace(/^\//, '');
-  return raw ? decodeURIComponent(raw) : '';
-}
-
-// Map a Node.js filesystem error code to a safe human-readable string that
-// does not disclose host paths or internal stack context. Used everywhere an
-// err.message would otherwise be returned to the client.
-export function safeErrMsg(err) {
-  if (!err) return 'unknown error';
-  switch (err.code) {
-    case 'ENOENT': return 'file not found';
-    case 'EACCES': return 'permission denied';
-    case 'EPERM':  return 'operation not permitted';
-    case 'EISDIR': return 'path is a directory';
-    case 'ENOTDIR': return 'path is not a directory';
-    case 'ENOTEMPTY': return 'directory is not empty';
-    case 'EEXIST': return 'file already exists';
-    case 'EXDEV': return 'cannot move across drives';
-    case 'EMFILE': return 'too many open files';
-    case 'ENOSPC': return 'no space left on device';
-    default: return 'operation failed';
-  }
-}
-
-// Read a request body with a hard size cap; resolves a Buffer or rejects with
-// .code='TOO_LARGE' so the caller can answer 413 without buffering the rest.
-// Stops accumulating further chunks (req.pause()) but does NOT destroy the
-// socket - a destroyed request cannot carry the caller's 413 response back to
-// the client, which instead sees a raw ECONNRESET with zero information
-// (live-witnessed: fetch() reported only "fetch failed", no status code).
-// The still-open connection is closed normally once the 413 response is sent.
-export function readBody(req, maxBytes) {
-  return new Promise((resolve, reject) => {
-    const chunks = []; let total = 0; let tooLarge = false;
-    req.on('data', (c) => {
-      if (tooLarge) return;
-      total += c.length;
-      if (total > maxBytes) {
-        tooLarge = true;
-        req.pause();
-        const e = new Error('body too large'); e.code = 'TOO_LARGE';
-        reject(e);
-        return;
-      }
-      chunks.push(c);
-    });
-    req.on('end', () => { if (!tooLarge) resolve(Buffer.concat(chunks)); });
-    req.on('error', reject);
-  });
-}
-
-// True when the resolved path IS one of the allowlist roots - the roots
-// themselves are never mutation targets (rename/delete of a root would orphan
-// the whole surface).
-export function isAllowRoot(realPath, allowRoots) {
-  const p = IS_WINDOWS ? realPath.toLowerCase() : realPath;
-  return allowRoots.some(r => (IS_WINDOWS ? r.toLowerCase() : r) === p);
-}
-
-// --- Soft-delete (trash) -----------------------------------------------
-// /api/delete moves entries into <root>/.agentgui-trash/<trashId>__<name>
-// instead of unlinking, giving a short undo window. In-memory index only
-// (server restart forfeits the undo window - acceptable since the retention
-// window itself is short and this is a convenience net on top of, not a
-// replacement for, the pre-delete ConfirmDialog). Purged after
-// TRASH_RETENTION_MS or when trashIndex grows past TRASH_MAX_ENTRIES
-// (oldest-first), so a long-running server's trash dir can't grow unbounded.
-const TRASH_DIR_NAME = '.agentgui-trash';
-const TRASH_RETENTION_MS = parseInt(process.env.AGENTGUI_TRASH_RETENTION_MS || '', 10) || 10 * 60 * 1000;
-const TRASH_MAX_ENTRIES = 200;
-const trashIndex = new Map(); // trashId -> { trashPath, originalPath, root, deletedAt }
-
-function purgeExpiredTrash() {
-  const now = Date.now();
-  for (const [id, info] of trashIndex) {
-    if (now - info.deletedAt > TRASH_RETENTION_MS) {
-      try { fs.rmSync(info.trashPath, { recursive: true, force: true }); } catch { /* already gone */ }
-      trashIndex.delete(id);
-    }
-  }
-  if (trashIndex.size > TRASH_MAX_ENTRIES) {
-    const sorted = [...trashIndex.entries()].sort((a, b) => a[1].deletedAt - b[1].deletedAt);
-    for (const [id, info] of sorted.slice(0, trashIndex.size - TRASH_MAX_ENTRIES)) {
-      try { fs.rmSync(info.trashPath, { recursive: true, force: true }); } catch {}
-      trashIndex.delete(id);
-    }
-  }
-}
-
-// Which allowed root a confined realPath lives under - the trash dir sits
-// alongside it (still inside the SAME root, so confineToRoots covers the
-// trash path too - no new unconfined surface).
-function rootFor(realPath, allowRoots) {
-  const p = IS_WINDOWS ? realPath.toLowerCase() : realPath;
-  return allowRoots.find(r => { const rr = IS_WINDOWS ? r.toLowerCase() : r; return p === rr || p.startsWith(rr + path.sep); });
-}
-
-export function moveToTrash(realPath, allowRoots) {
-  purgeExpiredTrash();
-  const root = rootFor(realPath, allowRoots);
-  if (!root) { const e = new Error('not confined to an allowed root'); e.code = 'EACCES'; throw e; }
-  const trashDir = path.join(root, TRASH_DIR_NAME);
-  fs.mkdirSync(trashDir, { recursive: true });
-  const trashId = crypto.randomBytes(8).toString('hex');
-  const base = path.basename(realPath);
-  const trashPath = path.join(trashDir, trashId + '__' + base);
-  fs.renameSync(realPath, trashPath);
-  trashIndex.set(trashId, { trashPath, originalPath: realPath, root, deletedAt: Date.now() });
-  return { trashId };
-}
-
-export function restoreFromTrash(trashId, allowRoots) {
-  const info = trashIndex.get(trashId);
-  if (!info) { const e = new Error('nothing to restore - the undo window has expired or this was already restored'); e.code = 'NOT_FOUND'; throw e; }
-  // Re-confine the ORIGINAL path at restore time (not trust the cached one
-  // blindly) - the allowlist itself doesn't change at runtime, but this keeps
-  // restore honoring the exact same confinement contract every other route does.
-  const conf = confineToRoots(info.originalPath, allowRoots);
-  if (!conf.ok && conf.reason !== 'not found') { const e = new Error('restore target is no longer inside an accessible folder'); e.code = 'CONFLICT'; throw e; }
-  if (fs.existsSync(info.originalPath)) { const e = new Error('a file already exists at the original location'); e.code = 'CONFLICT'; throw e; }
-  fs.mkdirSync(path.dirname(info.originalPath), { recursive: true });
-  fs.renameSync(info.trashPath, info.originalPath);
-  trashIndex.delete(trashId);
-  return { path: info.originalPath };
-}

package/lib/ws-handlers/agents.js

@@ -1,137 +0,0 @@
-import { registry } from '../claude-runner-agents.js';
-import { restart as restartAcpAgent } from '../acp-sdk-manager.js';
-import { err } from './shared.js';
-import { spawnSync } from 'child_process';
-
-const SUB_AGENT_MAP = {
-  'opencode': [{ id: 'gm-oc', name: 'GM OpenCode' }], 'cli-opencode': [{ id: 'gm-oc', name: 'GM OpenCode' }],
-  'gemini': [{ id: 'gm-gc', name: 'GM Gemini' }], 'cli-gemini': [{ id: 'gm-gc', name: 'GM Gemini' }],
-  'kilo': [{ id: 'gm-kilo', name: 'GM Kilo' }], 'cli-kilo': [{ id: 'gm-kilo', name: 'GM Kilo' }],
-  'codex': [], 'cli-codex': []
-};
-
-export function register(router, deps) {
-  const { getProviderConfigs, getModelsForAgent } = deps;
-
-  // --- agents.list: enumerate registered ACP agents + claude-code ---
-  router.handle('agents.list', () => {
-    const agents = registry.list().map(a => ({
-      id: a.id,
-      name: a.name,
-      protocol: a.protocol,
-      supportsStdin: !!a.supportsStdin,
-      features: a.supportedFeatures || [],
-      available: registry.isAvailable(a.id),
-      npxInstallable: !!a.npxPackage,
-      // The CLI binary name a manual (non-npx) install would need - lets the
-      // settings panel say what to install instead of just "not installed".
-      cmd: a.command || null,
-    }));
-    return { agents };
-  });
-
-  // --- agents.models: model choices for a given agent ---
-  router.handle('agents.models', async (p) => {
-    const id = p?.id || p?.agentId;
-    if (!id) err(400, 'agent id required');
-    if (id === 'claude-code') {
-      return { models: [
-        { id: 'sonnet', name: 'Claude Sonnet (latest)' },
-        { id: 'opus', name: 'Claude Opus (latest)' },
-        { id: 'haiku', name: 'Claude Haiku (latest)' },
-      ] };
-    }
-    // Other agents: discover their models via getModelsForAgent (queries the
-    // running ACP server). Fail closed to an empty list on any error or when
-    // the dep isn't a function.
-    if (typeof getModelsForAgent === 'function') {
-      try {
-        const raw = await getModelsForAgent(id);
-        const list = Array.isArray(raw) ? raw : (raw?.models || []);
-        return { models: list.map(m => ({ id: m.id, name: m.name || m.label || m.id })) };
-      } catch { return { models: [] }; }
-    }
-    return { models: [] };
-  });
-
-  router.handle('acp.restart', async (p) => {
-    if (!p.id) err(400, 'Missing agent id');
-    const ok = await restartAcpAgent(p.id);
-    return { ok: !!ok };
-  });
-
-  router.handle('agent.subagents', async (p) => {
-    if (!p.id) err(400, 'Missing agent id');
-    if (p.id === 'claude-code' || p.id === 'cli-claude') {
-      const spawnEnv = { ...process.env }; delete spawnEnv.CLAUDECODE;
-      const result = spawnSync('claude', ['agents', 'list'], { encoding: 'utf-8', timeout: 10000, stdio: ['pipe', 'pipe', 'pipe'], env: spawnEnv });
-      if (result.status !== 0 || !result.stdout) return { subAgents: [] };
-      const agents = result.stdout.trim().split('\n').filter(l => l.trim()).map(l => l.match(/^  (\S+)\s+·/)).filter(Boolean).map(m => ({ id: m[1], name: m[1] }));
-      return { subAgents: agents };
-    }
-    return { subAgents: SUB_AGENT_MAP[p.id] || [] };
-  });
-
-  // --- models.availability: composes agentgui's REAL model surface into the
-  // ModelsConfig component's shape (design SDK's ModelsConfig.js). agentgui
-  // has no freddie-style probed-availability matrix (no /v1/models round-trip
-  // per mode) - what it actually has is: discovered agent CLIs (registry,
-  // same data agents.list already exposes), each agent's model choices
-  // (agents.models' getModelsForAgent), and per-provider API-key presence
-  // (auth.configs' getProviderConfigs). This handler is a read-only
-  // composition of those three real sources, not a new probe and not fake
-  // data - "usable_in_any_mode" is derived from registry.isAvailable(agentId)
-  // (the CLI binary was actually found on this server), and "key_present"
-  // comes straight from getProviderConfigs' filesystem check.
-  router.handle('models.availability', async () => {
-    const agents = registry.list();
-    const providerConfigs = typeof getProviderConfigs === 'function' ? getProviderConfigs() : {};
-    const providers = [];
-    for (const a of agents) {
-      const available = registry.isAvailable(a.id);
-      let models = [];
-      if (a.id === 'claude-code') {
-        models = [
-          { id: 'sonnet', name: 'Claude Sonnet (latest)' },
-          { id: 'opus', name: 'Claude Opus (latest)' },
-          { id: 'haiku', name: 'Claude Haiku (latest)' },
-        ];
-      } else if (typeof getModelsForAgent === 'function') {
-        try {
-          const raw = await getModelsForAgent(a.id);
-          const list = Array.isArray(raw) ? raw : (raw?.models || []);
-          models = list.map((m) => ({ id: m.id, name: m.name || m.label || m.id }));
-        } catch { models = []; }
-      }
-      // Map onto agentgui's one real signal per model: is the agent CLI itself
-      // available on this server (registry.isAvailable). agentgui does not
-      // probe individual (model, mode) cells the way freddie's matrix does,
-      // so every model under an available agent reports the same single
-      // 'cli' mode rather than fabricating per-mode probe results.
-      providers.push({
-        id: a.id,
-        key_present: !!(providerConfigs[a.id] && providerConfigs[a.id].hasKey) || available,
-        discovery_error: available ? null : ((a.name || a.id) + ' CLI not found on this server'),
-        models: models.map((m) => ({
-          id: m.id,
-          name: m.name,
-          discovered_via: a.protocol || 'cli',
-          modes: { cli: { ok: !!available, skipped: !available, reason: available ? undefined : 'agent_not_installed' } },
-          usable_in_any_mode: !!available,
-        })),
-      });
-    }
-    const totalModels = providers.reduce((n, p) => n + p.models.length, 0);
-    const usableModels = providers.reduce((n, p) => n + p.models.filter((m) => m.usable_in_any_mode).length, 0);
-    return {
-      timestamp: new Date().toISOString(),
-      providers,
-      sampler: [],
-      summary: {
-        total_providers: providers.length,
-        total_models: totalModels,
-        usable_in_any_mode: usableModels,
-      },
-    };
-  });
-}

package/lib/ws-handlers/chat.js

@@ -1,157 +0,0 @@
-import crypto from 'crypto';
-import { runClaudeWithStreaming } from '../claude-runner-run.js';
-import { registry } from '../claude-runner-agents.js';
-import { confineToRoots, fsAllowRoots } from '../http-handler.js';
-import { err } from './shared.js';
-import { recordTerminal, getTerminal } from './terminal-state.js';
-
-export function register(router, deps) {
-  const { wsOptimizer, broadcastSync, STARTUP_CWD, subscriptionIndex, activeChats } = deps;
-
-  // --- conversation.subscribe: register this ws for sessionId broadcasts ---
-  router.handle('conversation.subscribe', (p, ws) => {
-    const sid = p?.sessionId;
-    if (!sid || typeof sid !== 'string') err(400, 'sessionId required');
-    if (!subscriptionIndex.has(sid)) subscriptionIndex.set(sid, new Set());
-    subscriptionIndex.get(sid).add(ws);
-    ws.subscriptions = ws.subscriptions || new Set();
-    ws.subscriptions.add(sid);
-    // Replay a buffered terminal frame (complete/error/cancelled) so a client
-    // that re-subscribes after a ws drop learns the turn already ended.
-    const term = getTerminal(sid);
-    if (term) { try { wsOptimizer.sendToClient(ws, { ...term, replayed: true }); } catch {} }
-    return { subscribed: true, sessionId: sid, replayedTerminal: !!term };
-  });
-
-  // --- chat.sendMessage: start a one-shot streaming chat with an agent.
-  // Bypasses the gutted db-queries layer entirely; calls runClaudeWithStreaming
-  // directly and broadcasts streaming_* events scoped to an ephemeral sessionId.
-  router.handle('chat.sendMessage', async (p, ws) => {
-    let content = (p?.content || '').toString();
-    if (!content) err(400, 'content required');
-    const agentId = p?.agentId || 'claude-code';
-    // For non-resume agents (not claude-code which uses --resume), prepend prior
-    // conversation turns so the agent has context. claude-code handles multi-turn
-    // natively via resumeSessionId; direct runners (agy, etc.) get a preamble.
-    const priorMessages = Array.isArray(p?.messages) ? p.messages.filter(m => m?.role && m?.content) : [];
-    if (agentId !== 'claude-code' && !p?.resumeSid && !p?.resumeSessionId && priorMessages.length > 0) {
-      const preamble = priorMessages.map(m => (m.role === 'user' ? 'User: ' : 'Assistant: ') + (m.content || '').trim()).join('\n\n');
-      content = '[Prior conversation]\n' + preamble + '\n\n[Current message]\n' + content;
-    }
-    const model = p?.model || undefined;
-    const subAgent = p?.subAgent || undefined;
-    const cwd = p?.cwd || STARTUP_CWD;
-    const resumeSessionId = p?.resumeSid || p?.resumeSessionId || undefined;
-    if (!registry.has(agentId)) err(404, `Unknown agentId: ${agentId}`);
-    // A client-supplied cwd must be confined to the SAME allowlist as the Files
-    // routes (fsAllowRoots) - an unconfined cwd would let a client spawn the
-    // agent CLI anywhere on disk. Use the realpath-resolved value as the spawn
-    // cwd (defeats symlink escape, same as the HTTP file routes). No p.cwd ->
-    // STARTUP_CWD, which is itself an allowed root, so it needs no check.
-    let spawnCwd = STARTUP_CWD;
-    if (p?.cwd) {
-      const conf = confineToRoots(cwd, fsAllowRoots());
-      if (!conf.ok) err(conf.reason === 'not found' ? 400 : 403, `cwd outside allowed roots: ${cwd}`);
-      spawnCwd = conf.realPath;
-    }
-
-    const sessionId = 'chat-' + crypto.randomBytes(8).toString('hex');
-    // Auto-subscribe the originating ws so it receives its own broadcasts.
-    if (!subscriptionIndex.has(sessionId)) subscriptionIndex.set(sessionId, new Set());
-    subscriptionIndex.get(sessionId).add(ws);
-    ws.subscriptions = ws.subscriptions || new Set();
-    ws.subscriptions.add(sessionId);
-
-    const ctrl = { aborted: false, proc: null, agentId, model, cwd: spawnCwd, startedAt: Date.now() };
-    activeChats.set(sessionId, ctrl);
-    // Push-driven hint so clients refresh active-session state without
-    // waiting for the 3s chat.active poll (finding 48).
-    broadcastSync({ type: 'chat_active_changed', reason: 'started', sessionId, agentId, timestamp: Date.now() });
-
-    // Fire-and-forget. Errors broadcast as streaming_error.
-    (async () => {
-      let eventCount = 0;
-      broadcastSync({ type: 'streaming_start', sessionId, agentId, timestamp: Date.now() });
-      let claudeSessionBroadcast = false;
-      const onEvent = (parsed) => {
-        eventCount++;
-        // Surface claude's REAL session id (from the stream) once, so the client
-        // can --resume this conversation on its next turn. The ephemeral
-        // 'chat-...' sessionId is not a claude session id and cannot be resumed.
-        if (!claudeSessionBroadcast && parsed?.session_id) {
-          claudeSessionBroadcast = true;
-          ctrl.claudeSessionId = parsed.session_id;
-          broadcastSync({ type: 'streaming_session', sessionId, claudeSessionId: parsed.session_id, agentId, timestamp: Date.now() });
-        }
-        if (parsed?.type === 'assistant' && parsed.message?.content) {
-          for (const block of parsed.message.content) {
-            broadcastSync({ type: 'streaming_progress', sessionId, block, blockRole: 'assistant', seq: eventCount, timestamp: Date.now() });
-          }
-        } else if (parsed?.type === 'user' && parsed.message?.content) {
-          const blocks = Array.isArray(parsed.message.content) ? parsed.message.content : [];
-          for (const block of blocks) {
-            if (block?.type === 'tool_result') {
-              broadcastSync({ type: 'streaming_progress', sessionId, block, blockRole: 'tool_result', seq: eventCount, timestamp: Date.now() });
-            }
-          }
-        } else if (parsed?.type === 'result') {
-          const block = { type: 'result', result: parsed.result, subtype: parsed.subtype, duration_ms: parsed.duration_ms, total_cost_usd: parsed.total_cost_usd, is_error: !!parsed.is_error };
-          broadcastSync({ type: 'streaming_progress', sessionId, block, blockRole: 'result', seq: eventCount, isResult: true, timestamp: Date.now() });
-        }
-      };
-      try {
-        const config = {
-          verbose: true, outputFormat: 'stream-json', timeout: 1800000, print: true,
-          model, subAgent, onEvent, resumeSessionId,
-          onPid: () => {}, onProcess: (proc) => { ctrl.proc = proc; },
-        };
-        await runClaudeWithStreaming(content, spawnCwd, agentId, config);
-        if (!ctrl.aborted) {
-          const ev = { type: 'streaming_complete', sessionId, claudeSessionId: ctrl.claudeSessionId || null, agentId, eventCount, timestamp: Date.now() };
-          recordTerminal(sessionId, ev);
-          broadcastSync(ev);
-        }
-      } catch (e) {
-        if (!ctrl.aborted) {
-          const ev = { type: 'streaming_error', sessionId, claudeSessionId: ctrl.claudeSessionId || null, agentId, error: e.message || String(e), recoverable: false, timestamp: Date.now() };
-          recordTerminal(sessionId, ev);
-          broadcastSync(ev);
-        }
-      } finally {
-        activeChats.delete(sessionId);
-        broadcastSync({ type: 'chat_active_changed', reason: 'ended', sessionId, agentId, timestamp: Date.now() });
-      }
-    })();
-
-    return { sessionId, started: true };
-  });
-
-  // --- chat.active: list in-flight chats started via this server ---
-  router.handle('chat.active', () => {
-    const sessions = [];
-    for (const [sid, c] of activeChats) {
-      sessions.push({ sessionId: sid, claudeSessionId: c.claudeSessionId || null, agentId: c.agentId || null, model: c.model || null, cwd: c.cwd || null, startedAt: c.startedAt || null, pid: c.proc?.pid || null });
-    }
-    return { sessions };
-  });
-
-  // --- chat.cancel: abort an in-flight chat ---
-  router.handle('chat.cancel', (p) => {
-    const sid = p?.sessionId;
-    if (!sid) err(400, 'sessionId required');
-    const ctrl = activeChats.get(sid);
-    if (!ctrl) return { cancelled: false, reason: 'not-found' };
-    ctrl.aborted = true;
-    // Broadcast the terminal 'cancelled' frame BEFORE killing the proc so a
-    // remote cancellation (other tab, dashboard stop-all) does not read as a
-    // normal completion (finding 44). streaming_cancelled is in BROADCAST_TYPES
-    // so every connected client sees it; it is also buffered for re-subscribers.
-    const ev = { type: 'streaming_cancelled', sessionId: sid, claudeSessionId: ctrl.claudeSessionId || null, agentId: ctrl.agentId || null, cancelled: true, timestamp: Date.now() };
-    recordTerminal(sid, ev);
-    broadcastSync(ev);
-    try { ctrl.proc?.kill?.(); } catch {}
-    activeChats.delete(sid);
-    broadcastSync({ type: 'chat_active_changed', reason: 'cancelled', sessionId: sid, agentId: ctrl.agentId || null, timestamp: Date.now() });
-    return { cancelled: true };
-  });
-}