amalgm 0.0.0 → 0.0.1

package/runtime/scripts/local-gateway.js

@@ -0,0 +1,852 @@
+'use strict';
+
+/**
+ * Local Gateway
+ *
+ * One discoverable loopback entrypoint for the local Amalgm runtime. The
+ * individual services still run as separate processes, but clients only need
+ * to find this gateway port from ~/.amalgm/runtime-state.json.
+ */
+
+const crypto = require('crypto');
+const fs = require('fs');
+const http = require('http');
+const net = require('net');
+const os = require('os');
+const path = require('path');
+const { URL } = require('url');
+const { WebSocket, WebSocketServer } = require('ws');
+
+const {
+  authorizeRuntimeHttp,
+  isAuthorizedRuntimeRequest,
+  runtimeAuthHeaders,
+} = require('./runtime-auth');
+
+function loadPty() {
+  const candidates = [
+    '@homebridge/node-pty-prebuilt-multiarch',
+    'node-pty',
+  ];
+  for (const packageName of candidates) {
+    try {
+      return {
+        packageName,
+        module: require(packageName),
+      };
+    } catch {
+      // Try the next compatible PTY implementation.
+    }
+  }
+  throw new Error('No PTY implementation is installed. Reinstall Amalgm and try again.');
+}
+
+const pty = loadPty();
+
+const AMALGM_DIR = process.env.AMALGM_DIR || path.join(os.homedir(), '.amalgm');
+const STATE_FILE = path.join(AMALGM_DIR, 'runtime-state.json');
+const ARTIFACTS_FILE = path.join(AMALGM_DIR, 'artifacts.json');
+const BIND_HOST = process.env.AMALGM_BIND_HOST || '127.0.0.1';
+const OWNER = process.env.AMALGM_RUNTIME_SOURCE || 'local';
+const VERSION = process.env.npm_package_version || process.env.AMALGM_RUNTIME_VERSION || '';
+const DEFAULT_CWD = process.env.AMALGM_DEFAULT_CWD || os.homedir();
+const PORT = Number.parseInt(process.env.AMALGM_GATEWAY_PORT || '28781', 10);
+const RUNTIME_TOKEN_HEADER = 'x-amalgm-runtime-token';
+
+const SERVICE_PORTS = {
+  gateway: PORT,
+  portMonitor: Number.parseInt(process.env.PORT_MONITOR_PORT || '8081', 10),
+  fsWatcher: Number.parseInt(process.env.FS_WATCHER_PORT || '8082', 10),
+  mcp: Number.parseInt(process.env.AMALGM_MCP_PORT || '8083', 10),
+  chat: Number.parseInt(process.env.CHAT_SERVER_PORT || '8084', 10),
+};
+const LOCAL_AGENT_APP_PORT = Number.parseInt(process.env.AMALGM_LOCAL_APP_PORT || '3456', 10);
+
+const HOP_BY_HOP_HEADERS = new Set([
+  'connection',
+  'keep-alive',
+  'proxy-authenticate',
+  'proxy-authorization',
+  'te',
+  'trailer',
+  'trailers',
+  'transfer-encoding',
+  'upgrade',
+  'host',
+  'content-length',
+]);
+
+const WS_HANDSHAKE_HEADERS = new Set([
+  'connection',
+  'upgrade',
+  'host',
+  'sec-websocket-key',
+  'sec-websocket-version',
+  'sec-websocket-extensions',
+  'sec-websocket-accept',
+  'sec-websocket-protocol',
+]);
+
+const CHAT_PREFIXES = [
+  '/chat',
+  '/raw-temp',
+  '/active',
+  '/stop',
+  '/destroy',
+  '/egress',
+  '/mcp-relay',
+];
+
+const MCP_PREFIXES = [
+  '/mcp',
+  '/events',
+  '/tasks',
+  '/event-triggers',
+  '/workspace',
+  '/github',
+  '/fs',
+  '/mcp-connections',
+  '/local',
+  '/credentials',
+  '/email',
+  '/slack',
+  '/user-api-keys',
+  '/artifacts',
+  '/agents',
+];
+
+const PORT_MONITOR_PREFIXES = [
+  '/ports',
+  '/port-monitor',
+];
+
+const ptySessions = new Map();
+const monitoredPreviewPorts = new Set();
+
+function readArtifacts() {
+  const data = readJson(ARTIFACTS_FILE, { artifacts: [] });
+  return Array.isArray(data?.artifacts) ? data.artifacts : [];
+}
+
+function normalizeArtifactRef(artifact) {
+  return String(artifact?.artifactRef || artifact?.artifact_ref || '').trim();
+}
+
+function isArtifactRoutable(artifact) {
+  const port = Number(artifact?.port);
+  const connected = artifact?.dnsConnected !== false && artifact?.connected !== false;
+  const desiredRunning = (artifact?.desiredState || 'running') === 'running';
+  const active = artifact?.status !== 'stopped' && artifact?.status !== 'error';
+  return (
+    /^[a-z0-9]{8,24}$/.test(normalizeArtifactRef(artifact))
+    && Number.isInteger(port)
+    && port > 0
+    && port <= 65535
+    && connected
+    && desiredRunning
+    && active
+  );
+}
+
+function findArtifactByRef(artifactRef) {
+  return readArtifacts().find((artifact) =>
+    normalizeArtifactRef(artifact) === artifactRef && isArtifactRoutable(artifact),
+  ) || null;
+}
+
+function activeArtifactPorts() {
+  return new Set(readArtifacts().filter(isArtifactRoutable).map((artifact) => Number(artifact.port)));
+}
+
+function isInternalRuntimePort(port) {
+  return (
+    port === LOCAL_AGENT_APP_PORT
+    || Object.values(SERVICE_PORTS).some((value) => Number(value) === port)
+  );
+}
+
+function isAllowedPreviewPort(port) {
+  return (
+    Number.isInteger(port)
+    && port > 0
+    && port <= 65535
+    && !isInternalRuntimePort(port)
+    && (activeArtifactPorts().has(port) || monitoredPreviewPorts.has(port))
+  );
+}
+
+function refreshMonitoredPreviewPorts() {
+  const req = http.request(
+    {
+      host: '127.0.0.1',
+      port: SERVICE_PORTS.portMonitor,
+      method: 'GET',
+      path: '/api/ports',
+      headers: runtimeAuthHeaders({ accept: 'application/json' }),
+      timeout: 2000,
+    },
+    (res) => {
+      const chunks = [];
+      res.on('data', (chunk) => chunks.push(Buffer.from(chunk)));
+      res.on('end', () => {
+        if ((res.statusCode || 500) < 200 || (res.statusCode || 500) >= 300) return;
+        let payload = null;
+        try {
+          payload = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+        } catch {
+          return;
+        }
+        const next = new Set();
+        for (const value of Array.isArray(payload?.ports) ? payload.ports : []) {
+          const port = Number(
+            typeof value === 'object' && value !== null && 'port' in value
+              ? value.port
+              : value,
+          );
+          if (
+            Number.isInteger(port)
+            && port > 0
+            && port <= 65535
+            && !isInternalRuntimePort(port)
+          ) {
+            next.add(port);
+          }
+        }
+        monitoredPreviewPorts.clear();
+        for (const port of next) monitoredPreviewPorts.add(port);
+      });
+    },
+  );
+  req.on('timeout', () => req.destroy());
+  req.on('error', () => {});
+  req.end();
+}
+
+function ensureDir(dir, mode = 0o700) {
+  fs.mkdirSync(dir, { recursive: true, mode });
+  try {
+    fs.chmodSync(dir, mode);
+  } catch {
+    // Best effort.
+  }
+}
+
+function writeJsonSecret(file, data) {
+  ensureDir(path.dirname(file));
+  const temp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(temp, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o600 });
+  fs.renameSync(temp, file);
+  try {
+    fs.chmodSync(file, 0o600);
+  } catch {
+    // Best effort.
+  }
+}
+
+function readJson(file, fallback = null) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return fallback;
+  }
+}
+
+function ensurePtySpawnHelperExecutable() {
+  try {
+    const nodePtyRoot = path.dirname(require.resolve(`${pty.packageName}/package.json`));
+    const candidates = [
+      path.join(nodePtyRoot, 'prebuilds', `${process.platform}-${process.arch}`, 'spawn-helper'),
+      path.join(nodePtyRoot, 'build', 'Release', 'spawn-helper'),
+    ];
+    for (const helper of candidates) {
+      if (fs.existsSync(helper)) fs.chmodSync(helper, 0o755);
+    }
+  } catch {
+    // Best effort. node-pty either does not need a helper on this platform or
+    // spawn will return the underlying error to the caller.
+  }
+}
+
+function writeRuntimeState(actualPort) {
+  const computer = readJson(path.join(AMALGM_DIR, 'computer.json'), null);
+  writeJsonSecret(STATE_FILE, {
+    schema_version: 1,
+    owner: OWNER,
+    source: OWNER,
+    pid: process.pid,
+    supervisor_pid: process.ppid,
+    version: VERSION,
+    package_version: VERSION,
+    runtime_dir: process.env.AMALGM_RUNTIME_DIR || process.cwd(),
+    local_only: process.env.AMALGM_LOCAL_ONLY === 'true',
+    bind_host: BIND_HOST,
+    gateway_port: actualPort,
+    gateway_url: `http://${BIND_HOST}:${actualPort}`,
+    ports: {
+      gateway: actualPort,
+      port_monitor: SERVICE_PORTS.portMonitor,
+      fs_watcher: SERVICE_PORTS.fsWatcher,
+      amalgm_mcp: SERVICE_PORTS.mcp,
+      chat_server: SERVICE_PORTS.chat,
+    },
+    computer_id: computer?.computer_id || process.env.AMALGM_COMPUTER_ID || '',
+    user_id: computer?.user_id || process.env.AMALGM_USER_ID || '',
+    updated_at: new Date().toISOString(),
+  });
+}
+
+function removeRuntimeStateForThisProcess() {
+  try {
+    const state = readJson(STATE_FILE, null);
+    if (state?.pid === process.pid) fs.unlinkSync(STATE_FILE);
+  } catch {
+    // noop
+  }
+}
+
+function sendJson(res, statusCode, payload) {
+  res.writeHead(statusCode, {
+    'Content-Type': 'application/json',
+    'Cache-Control': 'no-store',
+  });
+  res.end(JSON.stringify(payload));
+}
+
+async function readBody(req) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks);
+}
+
+async function readJsonBody(req) {
+  const body = await readBody(req);
+  if (body.length === 0) return {};
+  return JSON.parse(body.toString('utf8'));
+}
+
+function normalizeHeaders(headers = {}) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    const lower = key.toLowerCase();
+    if (HOP_BY_HOP_HEADERS.has(lower)) continue;
+    if (Array.isArray(value)) out[key] = value.join(', ');
+    else if (typeof value === 'string') out[key] = value;
+    else if (value != null) out[key] = String(value);
+  }
+  return out;
+}
+
+function normalizeExternalHeaders(headers = {}) {
+  const out = normalizeHeaders(headers);
+  for (const key of Object.keys(out)) {
+    const lower = key.toLowerCase();
+    if (lower === RUNTIME_TOKEN_HEADER) {
+      delete out[key];
+    }
+  }
+  return out;
+}
+
+function normalizeWsHeaders(headers = {}) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    const lower = key.toLowerCase();
+    if (HOP_BY_HOP_HEADERS.has(lower) || WS_HANDSHAKE_HEADERS.has(lower)) continue;
+    if (Array.isArray(value)) out[key] = value.join(', ');
+    else if (typeof value === 'string') out[key] = value;
+    else if (value != null) out[key] = String(value);
+  }
+  return out;
+}
+
+function normalizeExternalWsHeaders(headers = {}) {
+  const out = normalizeWsHeaders(headers);
+  for (const key of Object.keys(out)) {
+    const lower = key.toLowerCase();
+    if (lower === RUNTIME_TOKEN_HEADER) {
+      delete out[key];
+    }
+  }
+  return out;
+}
+
+function parseWsProtocols(value) {
+  const raw = Array.isArray(value) ? value.join(',') : String(value || '');
+  return raw.split(',').map((entry) => entry.trim()).filter(Boolean);
+}
+
+function forwardedHost(headers = {}) {
+  const value = headers['x-forwarded-host'] || headers['X-Forwarded-Host'];
+  if (Array.isArray(value)) return value[0] || '';
+  return typeof value === 'string' ? value : '';
+}
+
+function serviceForPath(pathname) {
+  if (pathname === '/healthz' || pathname === '/' || pathname === '/runtime-state') {
+    return null;
+  }
+  if (CHAT_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`))) {
+    return { port: SERVICE_PORTS.chat, stripPrefix: '' };
+  }
+  if (MCP_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`))) {
+    return { port: SERVICE_PORTS.mcp, stripPrefix: '' };
+  }
+  if (pathname === '/fs-watcher' || pathname.startsWith('/fs-watcher/')) {
+    return {
+      port: SERVICE_PORTS.fsWatcher,
+      stripPrefix: '/fs-watcher',
+    };
+  }
+  if (PORT_MONITOR_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`))) {
+    return {
+      port: SERVICE_PORTS.portMonitor,
+      stripPrefix: pathname.startsWith('/port-monitor') ? '/port-monitor' : '/ports',
+    };
+  }
+  return null;
+}
+
+function forwardPathAfterPrefix(req, prefix) {
+  const url = new URL(req.url || '/', 'http://127.0.0.1');
+  url.pathname = url.pathname.slice(prefix.length) || '/';
+  if (!url.pathname.startsWith('/')) url.pathname = `/${url.pathname}`;
+  return `${url.pathname}${url.search}`;
+}
+
+function externalProxyTargetForPath(pathname) {
+  const artifactMatch = pathname.match(/^\/__amalgm\/artifacts\/([a-z0-9]{8,24})(?:\/|$)/);
+  if (artifactMatch) {
+    const artifactRef = artifactMatch[1];
+    const artifact = findArtifactByRef(artifactRef);
+    if (!artifact) {
+      return { error: { status: 404, message: `Artifact is not routable: ${artifactRef}` } };
+    }
+    return {
+      port: Number(artifact.port),
+      prefix: `/__amalgm/artifacts/${artifactRef}`,
+      kind: 'artifact',
+    };
+  }
+
+  const previewMatch = pathname.match(/^\/__amalgm\/preview\/(\d{1,5})(?:\/|$)/);
+  if (previewMatch) {
+    const port = Number(previewMatch[1]);
+    if (!isAllowedPreviewPort(port)) {
+      return { error: { status: 403, message: `Preview port is not allowed: ${port}` } };
+    }
+    return {
+      port,
+      prefix: `/__amalgm/preview/${port}`,
+      kind: 'preview',
+    };
+  }
+
+  return null;
+}
+
+function proxiedPath(req, target) {
+  if (!target?.stripPrefix) return req.url || '/';
+  const url = new URL(req.url || '/', 'http://127.0.0.1');
+  url.pathname = url.pathname.slice(target.stripPrefix.length) || '/';
+  return `${url.pathname}${url.search}`;
+}
+
+async function proxyHttp(req, res, target) {
+  const body = await readBody(req);
+  const upstreamHeaders = runtimeAuthHeaders({
+    ...normalizeHeaders(req.headers),
+    ...(body.length > 0 ? { 'Content-Length': String(body.length) } : {}),
+    host: `127.0.0.1:${target.port}`,
+  });
+
+  const upstream = http.request(
+    {
+      host: '127.0.0.1',
+      port: target.port,
+      method: req.method || 'GET',
+      path: proxiedPath(req, target),
+      headers: upstreamHeaders,
+      timeout: 60_000,
+    },
+    (upstreamRes) => {
+      res.writeHead(upstreamRes.statusCode || 502, normalizeHeaders(upstreamRes.headers));
+      upstreamRes.pipe(res);
+    },
+  );
+
+  upstream.on('timeout', () => upstream.destroy(new Error('Upstream request timed out')));
+  upstream.on('error', (err) => {
+    if (!res.headersSent) {
+      sendJson(res, 502, { error: 'Upstream request failed', detail: err.message });
+      return;
+    }
+    res.destroy(err);
+  });
+
+  upstream.end(body);
+}
+
+async function proxyExternalHttp(req, res, target) {
+  const body = await readBody(req);
+  const upstreamHeaders = {
+    ...normalizeExternalHeaders(req.headers),
+    ...(body.length > 0 ? { 'Content-Length': String(body.length) } : {}),
+    host: forwardedHost(req.headers) || `127.0.0.1:${target.port}`,
+  };
+
+  const upstream = http.request(
+    {
+      host: '127.0.0.1',
+      port: target.port,
+      method: req.method || 'GET',
+      path: forwardPathAfterPrefix(req, target.prefix),
+      headers: upstreamHeaders,
+      timeout: 60_000,
+    },
+    (upstreamRes) => {
+      res.writeHead(upstreamRes.statusCode || 502, normalizeHeaders(upstreamRes.headers));
+      upstreamRes.pipe(res);
+    },
+  );
+
+  upstream.on('timeout', () => upstream.destroy(new Error('Upstream request timed out')));
+  upstream.on('error', (err) => {
+    if (!res.headersSent) {
+      sendJson(res, 502, { error: 'External preview request failed', detail: err.message });
+      return;
+    }
+    res.destroy(err);
+  });
+
+  upstream.end(body);
+}
+
+function createPtySession(payload) {
+  const cols = Math.max(20, Math.min(400, Number(payload?.cols || 80)));
+  const rows = Math.max(5, Math.min(200, Number(payload?.rows || 24)));
+  const cwd = typeof payload?.cwd === 'string' && path.isAbsolute(payload.cwd) ? payload.cwd : DEFAULT_CWD;
+  const shell = process.env.SHELL || (process.platform === 'win32' ? 'powershell.exe' : '/bin/zsh');
+  const sessionId = `pty-${Date.now()}-${crypto.randomBytes(4).toString('hex')}`;
+  ensurePtySpawnHelperExecutable();
+  const proc = pty.module.spawn(shell, [], {
+    name: 'xterm-256color',
+    cols,
+    rows,
+    cwd,
+    env: {
+      ...process.env,
+      TERM: 'xterm-256color',
+      LANG: process.env.LANG || 'en_US.UTF-8',
+    },
+  });
+
+  const session = {
+    id: sessionId,
+    proc,
+    clients: new Set(),
+    createdAt: Date.now(),
+  };
+  ptySessions.set(sessionId, session);
+  proc.onExit(({ exitCode }) => {
+    for (const ws of session.clients) {
+      try {
+        ws.send(JSON.stringify({ type: 'exit', exitCode }));
+        ws.close(1000, 'pty exited');
+      } catch {
+        // noop
+      }
+    }
+    ptySessions.delete(sessionId);
+  });
+
+  return session;
+}
+
+async function handlePtyHttp(req, res, pathname) {
+  if (req.method === 'POST' && pathname === '/pty/session') {
+    const payload = await readJsonBody(req);
+    const session = createPtySession(payload);
+    sendJson(res, 200, {
+      success: true,
+      sessionId: session.id,
+      wsPath: `/pty/${session.id}/connect`,
+    });
+    return;
+  }
+
+  if (req.method === 'POST' && pathname === '/pty/resize') {
+    const payload = await readJsonBody(req);
+    const sessionId = String(payload?.sessionId || '');
+    const session = ptySessions.get(sessionId);
+    if (!session) {
+      sendJson(res, 404, { error: 'PTY session not found' });
+      return;
+    }
+    const cols = Math.max(20, Math.min(400, Number(payload?.cols || 80)));
+    const rows = Math.max(5, Math.min(200, Number(payload?.rows || 24)));
+    session.proc.resize(cols, rows);
+    sendJson(res, 200, { success: true });
+    return;
+  }
+
+  if (req.method === 'DELETE' && pathname === '/pty/session') {
+    const payload = await readJsonBody(req);
+    const sessionId = String(payload?.sessionId || '');
+    const session = ptySessions.get(sessionId);
+    if (session) {
+      try {
+        session.proc.kill();
+      } catch {
+        // noop
+      }
+      ptySessions.delete(sessionId);
+    }
+    sendJson(res, 200, { success: true });
+    return;
+  }
+
+  sendJson(res, 404, { error: 'Unknown PTY route' });
+}
+
+function bridgePtyWebSocket(req, ws, pathname) {
+  if (!isAuthorizedRuntimeRequest(req)) {
+    ws.close(4401, 'Unauthorized');
+    return;
+  }
+
+  const match = pathname.match(/^\/pty\/([^/]+)\/connect$/);
+  const session = match ? ptySessions.get(match[1]) : null;
+  if (!session) {
+    ws.close(4404, 'PTY session not found');
+    return;
+  }
+
+  session.clients.add(ws);
+  const disposable = session.proc.onData((data) => {
+    if (ws.readyState === WebSocket.OPEN) ws.send(data);
+  });
+
+  ws.on('message', (data) => {
+    try {
+      session.proc.write(Buffer.isBuffer(data) ? data.toString('utf8') : String(data));
+    } catch {
+      // noop
+    }
+  });
+
+  ws.on('close', () => {
+    session.clients.delete(ws);
+    disposable.dispose();
+    if (session.clients.size === 0) {
+      // Keep the terminal briefly alive across tab reloads, then clean it up.
+      setTimeout(() => {
+        if (session.clients.size > 0 || !ptySessions.has(session.id)) return;
+        try {
+          session.proc.kill();
+        } catch {
+          // noop
+        }
+        ptySessions.delete(session.id);
+      }, 30_000).unref?.();
+    }
+  });
+}
+
+function proxyWebSocket(req, client, target, pathOverride) {
+  if (!isAuthorizedRuntimeRequest(req)) {
+    client.close(4401, 'Unauthorized');
+    return;
+  }
+
+  const targetPath = pathOverride || proxiedPath(req, target);
+  const upstream = new WebSocket(`ws://127.0.0.1:${target.port}${targetPath}`, {
+    headers: runtimeAuthHeaders(normalizeWsHeaders(req.headers)),
+  });
+
+  client.on('message', (data, isBinary) => {
+    if (upstream.readyState === WebSocket.OPEN) upstream.send(data, { binary: isBinary });
+  });
+  upstream.on('message', (data, isBinary) => {
+    if (client.readyState === WebSocket.OPEN) client.send(data, { binary: isBinary });
+  });
+  client.on('close', (code, reason) => {
+    try {
+      upstream.close(code, reason.toString('utf8'));
+    } catch {
+      // noop
+    }
+  });
+  upstream.on('close', (code, reason) => {
+    try {
+      client.close(code, reason.toString('utf8'));
+    } catch {
+      // noop
+    }
+  });
+  upstream.on('error', (err) => {
+    try {
+      client.close(1011, err.message);
+    } catch {
+      // noop
+    }
+  });
+}
+
+function proxyExternalWebSocket(req, client, target) {
+  if (!isAuthorizedRuntimeRequest(req)) {
+    client.close(4401, 'Unauthorized');
+    return;
+  }
+
+  const targetPath = forwardPathAfterPrefix(req, target.prefix);
+  const protocols = parseWsProtocols(req.headers['sec-websocket-protocol']);
+  const upstream = protocols.length > 0
+    ? new WebSocket(`ws://127.0.0.1:${target.port}${targetPath}`, protocols, {
+      headers: normalizeExternalWsHeaders(req.headers),
+    })
+    : new WebSocket(`ws://127.0.0.1:${target.port}${targetPath}`, {
+      headers: normalizeExternalWsHeaders(req.headers),
+    });
+
+  client.on('message', (data, isBinary) => {
+    if (upstream.readyState === WebSocket.OPEN) upstream.send(data, { binary: isBinary });
+  });
+  upstream.on('message', (data, isBinary) => {
+    if (client.readyState === WebSocket.OPEN) client.send(data, { binary: isBinary });
+  });
+  client.on('close', (code, reason) => {
+    try {
+      upstream.close(code, reason.toString('utf8'));
+    } catch {
+      // noop
+    }
+  });
+  upstream.on('close', (code, reason) => {
+    try {
+      client.close(code, reason.toString('utf8'));
+    } catch {
+      // noop
+    }
+  });
+  upstream.on('error', (err) => {
+    try {
+      client.close(1011, err.message);
+    } catch {
+      // noop
+    }
+  });
+}
+
+const server = http.createServer(async (req, res) => {
+  const url = new URL(req.url || '/', `http://${BIND_HOST}:${PORT}`);
+  try {
+    if (url.pathname === '/healthz' || url.pathname === '/') {
+      sendJson(res, 200, {
+        status: 'ok',
+        service: 'local-gateway',
+        owner: OWNER,
+        pid: process.pid,
+        ports: SERVICE_PORTS,
+      });
+      return;
+    }
+
+    if (!authorizeRuntimeHttp(req, res, { exposeHeaders: 'Mcp-Session-Id' })) return;
+
+    if (url.pathname === '/runtime-state') {
+      sendJson(res, 200, readJson(STATE_FILE, {}));
+      return;
+    }
+
+    if (url.pathname === '/pty/session' || url.pathname === '/pty/resize') {
+      await handlePtyHttp(req, res, url.pathname);
+      return;
+    }
+
+    const externalTarget = externalProxyTargetForPath(url.pathname);
+    if (externalTarget?.error) {
+      sendJson(res, externalTarget.error.status, { error: externalTarget.error.message });
+      return;
+    }
+    if (externalTarget) {
+      await proxyExternalHttp(req, res, externalTarget);
+      return;
+    }
+
+    const target = serviceForPath(url.pathname);
+    if (!target) {
+      sendJson(res, 404, { error: 'Unknown local gateway route' });
+      return;
+    }
+
+    await proxyHttp(req, res, target);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (!res.headersSent) {
+      sendJson(res, 500, { error: 'Local gateway request failed', detail: message });
+      return;
+    }
+    res.destroy(err);
+  }
+});
+
+const wss = new WebSocketServer({ noServer: true });
+server.on('upgrade', (req, socket, head) => {
+  const url = new URL(req.url || '/', `http://${BIND_HOST}:${PORT}`);
+  wss.handleUpgrade(req, socket, head, (ws) => {
+    const externalTarget = externalProxyTargetForPath(url.pathname);
+    if (externalTarget?.error) {
+      ws.close(externalTarget.error.status === 403 ? 1008 : 1011, externalTarget.error.message);
+      return;
+    }
+    if (externalTarget) {
+      proxyExternalWebSocket(req, ws, externalTarget);
+      return;
+    }
+    if (/^\/pty\/[^/]+\/connect$/.test(url.pathname)) {
+      bridgePtyWebSocket(req, ws, url.pathname);
+      return;
+    }
+    if (url.pathname === '/ws/fs' || url.pathname === '/fs-watcher/ws') {
+      proxyWebSocket(req, ws, { port: SERVICE_PORTS.fsWatcher, stripPrefix: '' }, '/');
+      return;
+    }
+    const target = serviceForPath(url.pathname);
+    if (!target) {
+      ws.close(1008, 'Unknown local gateway route');
+      return;
+    }
+    proxyWebSocket(req, ws, target);
+  });
+});
+
+server.on('error', (err) => {
+  console.error('[local-gateway] fatal:', err.message);
+  process.exit(1);
+});
+
+server.listen({ host: BIND_HOST, port: PORT }, () => {
+  const address = server.address();
+  const actualPort = typeof address === 'object' && address ? address.port : PORT;
+  SERVICE_PORTS.gateway = actualPort;
+  writeRuntimeState(actualPort);
+  refreshMonitoredPreviewPorts();
+  const previewPortRefreshTimer = setInterval(refreshMonitoredPreviewPorts, 2000);
+  if (typeof previewPortRefreshTimer.unref === 'function') previewPortRefreshTimer.unref();
+  console.log(`[local-gateway] listening on http://${BIND_HOST}:${actualPort}`);
+});
+
+for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
+  process.once(signal, () => {
+    removeRuntimeStateForThisProcess();
+    for (const session of ptySessions.values()) {
+      try {
+        session.proc.kill();
+      } catch {
+        // noop
+      }
+    }
+    server.close(() => process.exit(0));
+    setTimeout(() => process.exit(0), 1000).unref?.();
+  });
+}