atoo-studio 0.0.1 → 0.0.2

package/dist/src/handlers/ssh.d.ts

@@ -0,0 +1 @@
+export declare const sshRouter: import("express-serve-static-core").Router;

package/dist/src/handlers/ssh.js

@@ -0,0 +1,162 @@
+import { Router } from 'express';
+import crypto from 'crypto';
+import { db } from '../state/db.js';
+import { sshManager } from '../services/ssh-manager.js';
+import { obfuscate } from '../services/obfuscation.js';
+export const sshRouter = Router();
+// Connect to SSH host (creates DB record + live connection)
+sshRouter.post('/api/ssh/connect', async (req, res) => {
+    const { label, host, port, username, auth_method, password, privateKey, passphrase, systemKeyPath } = req.body;
+    if (!host || !username || !auth_method) {
+        return res.status(400).json({ error: 'host, username, and auth_method are required' });
+    }
+    try {
+        const config = {
+            label: label || `${username}@${host}`,
+            host,
+            port: port || 22,
+            username,
+            auth_method,
+        };
+        if (auth_method === 'password' && password) {
+            config.password_obfuscated = obfuscate(password);
+        }
+        else if (auth_method === 'privatekey' && privateKey) {
+            config.private_key_obfuscated = obfuscate(privateKey);
+            if (passphrase)
+                config.passphrase_obfuscated = obfuscate(passphrase);
+        }
+        else if (auth_method === 'systemkey' && systemKeyPath) {
+            config.system_key_path = systemKeyPath;
+            if (passphrase)
+                config.passphrase_obfuscated = obfuscate(passphrase);
+        }
+        const dbRecord = db.createSshConnection(config);
+        // Attempt live connection
+        await sshManager.connect(dbRecord);
+        // Verify claude CLI
+        const hasClaude = await sshManager.verifyClaudeCli(dbRecord.id);
+        res.json({
+            id: dbRecord.id,
+            label: dbRecord.label,
+            host: dbRecord.host,
+            port: dbRecord.port,
+            username: dbRecord.username,
+            auth_method: dbRecord.auth_method,
+            connected: true,
+            has_claude: hasClaude,
+        });
+    }
+    catch (err) {
+        console.error('[ssh] Connect failed:', err.message);
+        res.status(500).json({ error: err.message });
+    }
+});
+// Generate ed25519 keypair
+sshRouter.post('/api/ssh/generate-keypair', (_req, res) => {
+    try {
+        const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', {
+            publicKeyEncoding: { type: 'spki', format: 'pem' },
+            privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+        });
+        // Convert PEM public key to OpenSSH format for authorized_keys
+        const pubKeyObj = crypto.createPublicKey(publicKey);
+        const sshPublicKey = pubKeyObj.export({ type: 'spki', format: 'der' });
+        const opensshPubKey = `ssh-ed25519 ${Buffer.from(sshPublicKey).toString('base64')} atoo-studio-generated`;
+        res.json({ privateKey, publicKey: opensshPubKey });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// Disconnect
+sshRouter.post('/api/ssh/:id/disconnect', async (req, res) => {
+    try {
+        await sshManager.disconnect(req.params.id);
+        res.json({ success: true });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// Connection status
+sshRouter.get('/api/ssh/:id/status', (req, res) => {
+    const status = sshManager.getStatus(req.params.id);
+    const dbRecord = db.getSshConnection(req.params.id);
+    res.json({
+        ...status,
+        label: dbRecord?.label,
+        host: dbRecord?.host,
+        port: dbRecord?.port,
+        username: dbRecord?.username,
+    });
+});
+// List all connections (with live status)
+sshRouter.get('/api/ssh/connections', (_req, res) => {
+    const connections = db.listSshConnections();
+    const result = connections.map(c => ({
+        id: c.id,
+        label: c.label,
+        host: c.host,
+        port: c.port,
+        username: c.username,
+        auth_method: c.auth_method,
+        created_at: c.created_at,
+        ...sshManager.getStatus(c.id),
+    }));
+    res.json(result);
+});
+// Remote folder browser (SFTP)
+sshRouter.get('/api/ssh/:id/browse', async (req, res) => {
+    const browsePath = req.query.path || '/home';
+    try {
+        const entries = await sshManager.sftpReaddir(req.params.id, browsePath);
+        const dirs = entries.filter(e => e.type === 'dir').map(e => ({
+            name: e.name,
+            path: browsePath === '/' ? `/${e.name}` : `${browsePath}/${e.name}`,
+        }));
+        const parent = browsePath === '/' ? null : browsePath.substring(0, browsePath.lastIndexOf('/')) || '/';
+        res.json({ current: browsePath, parent, dirs });
+    }
+    catch (err) {
+        res.status(400).json({ error: err.message });
+    }
+});
+// Create remote directory
+sshRouter.post('/api/ssh/:id/browse/mkdir', async (req, res) => {
+    const { path: dirPath } = req.body;
+    if (!dirPath)
+        return res.status(400).json({ error: 'path is required' });
+    try {
+        await sshManager.sftpMkdir(req.params.id, dirPath);
+        res.json({ success: true, path: dirPath });
+    }
+    catch (err) {
+        res.status(400).json({ error: err.message });
+    }
+});
+// Delete SSH connection
+sshRouter.delete('/api/ssh/:id', async (req, res) => {
+    try {
+        await sshManager.disconnect(req.params.id);
+        db.deleteSshConnection(req.params.id);
+        res.json({ success: true });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});
+// Reconnect to a saved connection
+sshRouter.post('/api/ssh/:id/reconnect', async (req, res) => {
+    const dbRecord = db.getSshConnection(req.params.id);
+    if (!dbRecord)
+        return res.status(404).json({ error: 'Connection not found' });
+    try {
+        await sshManager.connect(dbRecord);
+        const hasClaude = await sshManager.verifyClaudeCli(dbRecord.id);
+        res.json({ connected: true, has_claude: hasClaude });
+    }
+    catch (err) {
+        res.status(500).json({ error: err.message });
+    }
+});

package/dist/src/handlers/users.d.ts

@@ -0,0 +1 @@
+export declare const usersRouter: import("express-serve-static-core").Router;

package/dist/src/handlers/users.js

@@ -0,0 +1,195 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import { db } from '../state/db.js';
+import { hashPassword, verifyPassword } from '../auth/password.js';
+import { requireAuth, requireAdmin } from '../auth/middleware.js';
+import { destroyAllUserSessions } from '../auth/session.js';
+import { generateTotpSecret, verifyTotpToken, saveTotpSecret, markTotpVerified, removeTotpSecret, getUnverifiedTotpSecret, hasTotpEnabled } from '../auth/totp.js';
+import { getRegistrationOptions, verifyAndSaveRegistration } from '../auth/webauthn.js';
+export const usersRouter = Router();
+// ═══════════════════════════════════════════════════
+// ADMIN: User management
+// ═══════════════════════════════════════════════════
+// GET /api/users — list all users (admin only)
+usersRouter.get('/api/users', requireAdmin, (_req, res) => {
+    const users = db.listUsers();
+    const usersWithMfa = users.map(u => ({
+        ...u,
+        hasTOTP: hasTotpEnabled(u.id),
+        passkeyCount: db.listPasskeys(u.id).length,
+    }));
+    res.json(usersWithMfa);
+});
+// POST /api/users — create user (admin only)
+const createUserSchema = z.object({
+    username: z.string().min(1).max(64),
+    display_name: z.string().min(1).max(128),
+    role: z.enum(['admin', 'basic']),
+    password: z.string().min(8).max(256),
+});
+usersRouter.post('/api/users', requireAdmin, async (req, res) => {
+    const parsed = createUserSchema.safeParse(req.body);
+    if (!parsed.success) {
+        return res.status(400).json({ error: 'Invalid input', details: parsed.error.flatten() });
+    }
+    const { username, display_name, role, password } = parsed.data;
+    if (db.getUserByUsername(username)) {
+        return res.status(409).json({ error: 'Username already exists' });
+    }
+    const passwordHash = await hashPassword(password);
+    const user = db.createUser(username, display_name, role, passwordHash);
+    res.json({ id: user.id, username: user.username, display_name: user.display_name, role: user.role });
+});
+// PUT /api/users/:id — update user (admin only)
+const updateUserSchema = z.object({
+    display_name: z.string().min(1).max(128).optional(),
+    role: z.enum(['admin', 'basic']).optional(),
+});
+usersRouter.put('/api/users/:id', requireAdmin, (req, res) => {
+    const parsed = updateUserSchema.safeParse(req.body);
+    if (!parsed.success) {
+        return res.status(400).json({ error: 'Invalid input' });
+    }
+    const user = db.getUser(req.params.id);
+    if (!user) {
+        return res.status(404).json({ error: 'User not found' });
+    }
+    db.updateUser(req.params.id, parsed.data);
+    res.json({ ok: true });
+});
+// DELETE /api/users/:id — delete user (admin only, cannot delete self)
+usersRouter.delete('/api/users/:id', requireAdmin, (req, res) => {
+    if (req.params.id === req.user.id) {
+        return res.status(400).json({ error: 'Cannot delete yourself' });
+    }
+    const user = db.getUser(req.params.id);
+    if (!user) {
+        return res.status(404).json({ error: 'User not found' });
+    }
+    destroyAllUserSessions(req.params.id);
+    db.deleteUser(req.params.id);
+    res.json({ ok: true });
+});
+// POST /api/users/:id/reset-password — admin resets password
+const resetPasswordSchema = z.object({
+    password: z.string().min(8).max(256),
+});
+usersRouter.post('/api/users/:id/reset-password', requireAdmin, async (req, res) => {
+    const parsed = resetPasswordSchema.safeParse(req.body);
+    if (!parsed.success) {
+        return res.status(400).json({ error: 'Invalid input' });
+    }
+    const user = db.getUser(req.params.id);
+    if (!user) {
+        return res.status(404).json({ error: 'User not found' });
+    }
+    const hash = await hashPassword(parsed.data.password);
+    db.updateUserPassword(req.params.id, hash);
+    destroyAllUserSessions(req.params.id);
+    res.json({ ok: true });
+});
+// POST /api/users/:id/reset-totp — admin removes TOTP
+usersRouter.post('/api/users/:id/reset-totp', requireAdmin, (req, res) => {
+    removeTotpSecret(req.params.id);
+    res.json({ ok: true });
+});
+// POST /api/users/:id/reset-passkeys — admin removes all passkeys
+usersRouter.post('/api/users/:id/reset-passkeys', requireAdmin, (req, res) => {
+    db.deleteAllUserPasskeys(req.params.id);
+    res.json({ ok: true });
+});
+// ═══════════════════════════════════════════════════
+// SELF: Profile & security
+// ═══════════════════════════════════════════════════
+// PUT /api/users/me/password — change own password
+const changePasswordSchema = z.object({
+    current_password: z.string().min(1),
+    new_password: z.string().min(8).max(256),
+});
+usersRouter.put('/api/users/me/password', requireAuth, async (req, res) => {
+    const parsed = changePasswordSchema.safeParse(req.body);
+    if (!parsed.success) {
+        return res.status(400).json({ error: 'Invalid input' });
+    }
+    const { current_password, new_password } = parsed.data;
+    const user = db.getUser(req.user.id);
+    const valid = await verifyPassword(current_password, user.password_hash);
+    if (!valid) {
+        return res.status(401).json({ error: 'Current password is incorrect' });
+    }
+    const hash = await hashPassword(new_password);
+    db.updateUserPassword(user.id, hash);
+    res.json({ ok: true });
+});
+// POST /api/users/me/totp/setup — generate TOTP secret + QR
+usersRouter.post('/api/users/me/totp/setup', requireAuth, async (req, res) => {
+    const user = req.user;
+    const result = await generateTotpSecret(user.username);
+    saveTotpSecret(user.id, result.secret);
+    res.json({ otpauthUri: result.otpauthUri, qrDataUrl: result.qrDataUrl });
+});
+// POST /api/users/me/totp/verify — activate TOTP with verification code
+const totpVerifySchema = z.object({
+    token: z.string().length(6),
+});
+usersRouter.post('/api/users/me/totp/verify', requireAuth, (req, res) => {
+    const parsed = totpVerifySchema.safeParse(req.body);
+    if (!parsed.success) {
+        return res.status(400).json({ error: 'Invalid input' });
+    }
+    const secret = getUnverifiedTotpSecret(req.user.id);
+    if (!secret) {
+        return res.status(400).json({ error: 'No TOTP setup in progress' });
+    }
+    if (!verifyTotpToken(secret, parsed.data.token)) {
+        return res.status(400).json({ error: 'Invalid TOTP code' });
+    }
+    markTotpVerified(req.user.id);
+    res.json({ ok: true });
+});
+// DELETE /api/users/me/totp — remove own TOTP
+usersRouter.delete('/api/users/me/totp', requireAuth, (req, res) => {
+    removeTotpSecret(req.user.id);
+    res.json({ ok: true });
+});
+// POST /api/users/me/passkey/register-options — get WebAuthn registration options
+usersRouter.post('/api/users/me/passkey/register-options', requireAuth, async (req, res) => {
+    const rpID = req.hostname;
+    const options = await getRegistrationOptions(req.user, rpID);
+    res.json(options);
+});
+// POST /api/users/me/passkey/register — complete passkey registration
+const passkeyRegisterSchema = z.object({
+    response: z.any(),
+    device_name: z.string().max(128).optional(),
+});
+usersRouter.post('/api/users/me/passkey/register', requireAuth, async (req, res) => {
+    const parsed = passkeyRegisterSchema.safeParse(req.body);
+    if (!parsed.success) {
+        return res.status(400).json({ error: 'Invalid input' });
+    }
+    const rpID = req.hostname;
+    const origin = `${req.protocol}://${req.headers.host}`;
+    const verified = await verifyAndSaveRegistration(req.user, rpID, origin, parsed.data.response, parsed.data.device_name);
+    if (!verified) {
+        return res.status(400).json({ error: 'Passkey registration failed' });
+    }
+    res.json({ ok: true });
+});
+// GET /api/users/me/passkeys — list own passkeys
+usersRouter.get('/api/users/me/passkeys', requireAuth, (req, res) => {
+    const passkeys = db.listPasskeys(req.user.id);
+    res.json(passkeys.map(pk => ({
+        id: pk.id,
+        device_name: pk.device_name,
+        created_at: pk.created_at,
+    })));
+});
+// DELETE /api/users/me/passkeys/:id — remove a passkey
+usersRouter.delete('/api/users/me/passkeys/:id', requireAuth, (req, res) => {
+    const deleted = db.deletePasskey(req.params.id, req.user.id);
+    if (!deleted) {
+        return res.status(404).json({ error: 'Passkey not found' });
+    }
+    res.json({ ok: true });
+});

package/dist/src/index.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/index.js

@@ -0,0 +1,228 @@
+import path from 'path';
+import fs from 'fs';
+import os from 'os';
+import https from 'https';
+import forge from 'node-forge';
+import { createWebServer } from './web/server.js';
+import { killAllCliProcesses } from './spawner.js';
+import { WEB_PORT, CA_CERT_PATH, CA_KEY_PATH, WEB_CERT_PATH, WEB_KEY_PATH } from './config.js';
+import { cleanupStaleMcpConfigs } from './mcp/config.js';
+import { fsMonitor } from './fs-monitor.js';
+import { db } from './state/db.js';
+import { agentRegistry } from './agents/registry.js';
+import { ClaudeCodeTerminalAgentFactory } from './agents/claude-code-terminal/index.js';
+import { ClaudeCodeTerminalChatROAgentFactory } from './agents/claude-code-terminal-chatro/index.js';
+import { CodexTerminalAgentFactory } from './agents/codex-terminal/index.js';
+import { sshManager } from './services/ssh-manager.js';
+import { previewManager } from './services/preview-manager.js';
+async function main() {
+    console.log('=== Atoo Studio ===');
+    console.log('');
+    // 1. Connect to filesystem monitor (graceful — no-op if unavailable)
+    fsMonitor.connect().catch(err => console.warn('[init] FS monitor not available:', err.message));
+    // 2. Register agent factories
+    agentRegistry.registerFactory(new ClaudeCodeTerminalAgentFactory());
+    agentRegistry.registerFactory(new ClaudeCodeTerminalChatROAgentFactory());
+    // agentRegistry.registerFactory(new CodexTerminalChatROAgentFactory());
+    agentRegistry.registerFactory(new CodexTerminalAgentFactory());
+    // 3. Clean up stale per-session MCP config files (older than 24h)
+    cleanupStaleMcpConfigs();
+    // 3.5. Generate CA-signed TLS cert for web frontend
+    const tlsOptions = getOrCreateWebCert();
+    // 4. Create and start the web frontend server over HTTPS (bind to 0.0.0.0 for WSL access from Windows)
+    const webServer = createWebServer(tlsOptions);
+    // Dynamic SAN expansion: detect new hosts from incoming requests and hot-swap cert
+    if (webServer instanceof https.Server) {
+        setupDynamicSan(webServer);
+    }
+    webServer.listen(WEB_PORT, '0.0.0.0', () => {
+        console.log(`[init] Web frontend listening on 0.0.0.0:${WEB_PORT} (HTTPS)`);
+    });
+    // Detect local IPs for display
+    const localIps = getLocalIps();
+    console.log('');
+    for (const ip of localIps) {
+        console.log(`Web frontend: https://${ip}:${WEB_PORT}`);
+    }
+    console.log('');
+    // Auto-reconnect saved SSH connections
+    const savedSshConns = db.listSshConnections();
+    for (const conn of savedSshConns) {
+        sshManager.connect(conn).then(() => {
+            console.log(`[init] SSH auto-reconnected: ${conn.label}`);
+        }).catch(err => {
+            console.warn(`[init] SSH auto-reconnect failed for ${conn.label}: ${err.message}`);
+        });
+    }
+    // Graceful shutdown
+    process.on('SIGINT', async () => {
+        console.log('\n[shutdown] Stopping...');
+        await previewManager.shutdown();
+        fsMonitor.disconnect();
+        sshManager.disconnectAll();
+        killAllCliProcesses();
+        db.close();
+        webServer.close();
+        process.exit(0);
+    });
+    process.on('SIGTERM', async () => {
+        await previewManager.shutdown();
+        fsMonitor.disconnect();
+        sshManager.disconnectAll();
+        killAllCliProcesses();
+        db.close();
+        webServer.close();
+        process.exit(0);
+    });
+}
+// Track known SANs so we can detect new ones
+const knownSans = new Set();
+let webKeyPem = '';
+function ensureCACert() {
+    if (fs.existsSync(CA_CERT_PATH))
+        return;
+    console.log('[tls] First run — generating CA certificate...');
+    fs.mkdirSync(path.dirname(CA_CERT_PATH), { recursive: true });
+    const keys = forge.pki.rsa.generateKeyPair(2048);
+    const cert = forge.pki.createCertificate();
+    cert.publicKey = keys.publicKey;
+    cert.serialNumber = '01';
+    cert.validity.notBefore = new Date();
+    cert.validity.notAfter = new Date();
+    cert.validity.notAfter.setFullYear(cert.validity.notAfter.getFullYear() + 10);
+    const attrs = [
+        { name: 'commonName', value: 'Atoo Studio Local CA' },
+        { name: 'organizationName', value: 'Atoo Studio' },
+    ];
+    cert.setSubject(attrs);
+    cert.setIssuer(attrs);
+    cert.setExtensions([
+        { name: 'basicConstraints', cA: true, critical: true },
+        { name: 'keyUsage', keyCertSign: true, cRLSign: true, critical: true },
+        { name: 'subjectKeyIdentifier' },
+    ]);
+    cert.sign(keys.privateKey, forge.md.sha256.create());
+    fs.writeFileSync(CA_CERT_PATH, forge.pki.certificateToPem(cert));
+    fs.writeFileSync(CA_KEY_PATH, forge.pki.privateKeyToPem(keys.privateKey), { mode: 0o600 });
+    console.log('[tls] CA certificate generated.');
+}
+function getOrCreateWebCert() {
+    ensureCACert();
+    // Seed known SANs with local IPs
+    knownSans.add('localhost');
+    knownSans.add('127.0.0.1');
+    for (const ip of getLocalIps())
+        knownSans.add(ip);
+    // If existing cert was CA-signed and covers all current SANs, reuse it
+    if (fs.existsSync(WEB_CERT_PATH) && fs.existsSync(WEB_KEY_PATH)) {
+        try {
+            const existingCert = forge.pki.certificateFromPem(fs.readFileSync(WEB_CERT_PATH, 'utf-8'));
+            const sanExt = existingCert.getExtension('subjectAltName');
+            const existingSans = new Set();
+            if (sanExt?.altNames) {
+                for (const an of sanExt.altNames)
+                    existingSans.add(an.value || an.ip);
+            }
+            // Check issuer is our CA (not self-signed)
+            const caCert = forge.pki.certificateFromPem(fs.readFileSync(CA_CERT_PATH, 'utf-8'));
+            const issuedByCA = existingCert.issuer.hash === caCert.subject.hash;
+            const allCovered = [...knownSans].every(s => existingSans.has(s));
+            if (issuedByCA && allCovered) {
+                webKeyPem = fs.readFileSync(WEB_KEY_PATH, 'utf-8');
+                // Also add any extra SANs from existing cert to our tracking set
+                for (const s of existingSans)
+                    knownSans.add(s);
+                console.log('[init] Reusing existing CA-signed web certificate');
+                return { key: webKeyPem, cert: fs.readFileSync(WEB_CERT_PATH, 'utf-8') };
+            }
+        }
+        catch { }
+    }
+    return regenerateWebCert('initial generation');
+}
+function regenerateWebCert(reason) {
+    console.log(`[tls] Generating CA-signed web certificate (${reason})...`);
+    const caCertPem = fs.readFileSync(CA_CERT_PATH, 'utf-8');
+    const caKeyPem = fs.readFileSync(CA_KEY_PATH, 'utf-8');
+    const caCert = forge.pki.certificateFromPem(caCertPem);
+    const caKey = forge.pki.privateKeyFromPem(caKeyPem);
+    // Reuse existing key if we have one, otherwise generate new
+    let privateKey;
+    let publicKey;
+    if (webKeyPem) {
+        privateKey = forge.pki.privateKeyFromPem(webKeyPem);
+        publicKey = forge.pki.setRsaPublicKey(privateKey.n, privateKey.e);
+    }
+    else {
+        const keys = forge.pki.rsa.generateKeyPair(2048);
+        privateKey = keys.privateKey;
+        publicKey = keys.publicKey;
+        webKeyPem = forge.pki.privateKeyToPem(privateKey);
+    }
+    const cert = forge.pki.createCertificate();
+    cert.publicKey = publicKey;
+    cert.serialNumber = Date.now().toString(16);
+    cert.validity.notBefore = new Date();
+    cert.validity.notAfter = new Date();
+    cert.validity.notAfter.setFullYear(cert.validity.notAfter.getFullYear() + 1);
+    cert.setSubject([{ name: 'commonName', value: 'Atoo Studio Web' }]);
+    cert.setIssuer(caCert.subject.attributes);
+    // Build SAN list from all known hosts
+    const altNames = [];
+    for (const san of knownSans) {
+        if (/^\d{1,3}(\.\d{1,3}){3}$/.test(san)) {
+            altNames.push({ type: 7, ip: san });
+        }
+        else {
+            altNames.push({ type: 2, value: san });
+        }
+    }
+    cert.setExtensions([
+        { name: 'basicConstraints', cA: false },
+        { name: 'keyUsage', digitalSignature: true, keyEncipherment: true },
+        { name: 'extKeyUsage', serverAuth: true },
+        { name: 'subjectAltName', altNames },
+    ]);
+    cert.sign(caKey, forge.md.sha256.create());
+    const certPem = forge.pki.certificateToPem(cert);
+    fs.writeFileSync(WEB_KEY_PATH, webKeyPem, { mode: 0o600 });
+    fs.writeFileSync(WEB_CERT_PATH, certPem);
+    console.log(`[tls] Web certificate issued with SANs: ${[...knownSans].join(', ')}`);
+    return { key: webKeyPem, cert: certPem };
+}
+function setupDynamicSan(server) {
+    // Intercept connections to check the Host header for unknown SANs
+    const origEmit = server.emit.bind(server);
+    server.emit = function (event, ...args) {
+        if (event === 'request') {
+            const req = args[0];
+            const host = req.headers.host;
+            if (host) {
+                const hostname = host.replace(/:\d+$/, '');
+                if (hostname && !knownSans.has(hostname)) {
+                    knownSans.add(hostname);
+                    console.log(`[tls] New host detected: ${hostname} — regenerating certificate`);
+                    const newTls = regenerateWebCert(`adding ${hostname}`);
+                    server.setSecureContext({ key: newTls.key, cert: newTls.cert });
+                }
+            }
+        }
+        return origEmit(event, ...args);
+    };
+}
+function getLocalIps() {
+    const ips = ['localhost'];
+    const interfaces = os.networkInterfaces();
+    for (const name of Object.keys(interfaces)) {
+        for (const iface of interfaces[name] || []) {
+            if (iface.family === 'IPv4' && !iface.internal) {
+                ips.push(iface.address);
+            }
+        }
+    }
+    return ips;
+}
+main().catch((err) => {
+    console.error('Fatal error:', err);
+    process.exit(1);
+});

package/dist/src/mcp/config.d.ts

@@ -0,0 +1,32 @@
+/** Register an MCP token as valid. */
+export declare function registerMcpToken(token: string): void;
+/** Remove an MCP token (called on session cleanup). */
+export declare function removeMcpToken(token: string): void;
+/** Check if an MCP token is valid. */
+export declare function validateMcpToken(token: string): boolean;
+/** Returns the command, args, and env needed to launch the MCP server process. */
+export declare function getMcpServerDef(): {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+};
+export declare const MCP_SYSTEM_PROMPT: string;
+/**
+ * Additional system prompt appended for chain continuation sessions.
+ * Tells the LLM that this is a continuation and how to search previous chain links.
+ */
+export declare const CHAIN_SYSTEM_PROMPT: string;
+/**
+ * Get or create an MCP config file.
+ * When sessionUuid is provided, creates a per-session config that includes
+ * ATOO_CURRENT_SESSION_UUID in the env — enabling chain-scoped search.
+ */
+export declare function getMcpConfigPath(sessionUuid?: string): string;
+/**
+ * Clean up a per-session MCP config file.
+ */
+export declare function cleanupMcpConfig(sessionUuid: string): void;
+/**
+ * Clean up stale per-session MCP config files older than maxAgeMs.
+ */
+export declare function cleanupStaleMcpConfigs(maxAgeMs?: number): void;