autodev-cli 1.4.0 → 1.4.3

package/out/webSocketPoller.js

@@ -0,0 +1,986 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebSocketPoller = void 0;
+const net = __importStar(require("net"));
+const tls = __importStar(require("tls"));
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const vnc_1 = require("./vnc");
+const rdp_1 = require("./rdp");
+const messageBuilder_1 = require("./messageBuilder");
+const todo_1 = require("./todo");
+const todoWriteManager_1 = require("./todoWriteManager");
+const gitService = __importStar(require("./git/gitService"));
+// ---------------------------------------------------------------------------
+// WebSocketPoller — persistent WS connection for ws:// / wss:// endpoints
+// ---------------------------------------------------------------------------
+class WebSocketPoller {
+    wsUrl;
+    apiKey;
+    slug;
+    _socket = null;
+    _connected = false;
+    _buffer = Buffer.alloc(0);
+    _todoPath = '';
+    _workspaceRoot;
+    _destroyed = false;
+    _reconnectTimer = null;
+    _log = () => { };
+    static RECONNECT_DELAY_MS = 5_000;
+    _vncPassword;
+    _vncSessions = new Map();
+    _rdpSessions = new Map();
+    _rdpSettings = {};
+    _gitEnabled = false;
+    _onConnect = null;
+    _onTaskAppend = null;
+    _onCommand = null;
+    _onMcpUpdate = null;
+    _onExportRequest = null;
+    _onRestoreRequest = null;
+    _onExportConfig = null;
+    _pendingFrames = [];
+    _seenTaskIds = new Set();
+    // Heartbeat: send a WS Ping every 25 s and expect a Pong. If 2 pings in a
+    // row come back without a pong (≈55 s), force-reconnect. Without this the
+    // server's 10-min stale-connection sweep silently drops idle agents and the
+    // client doesn't notice until the next manual restart.
+    static PING_INTERVAL_MS = 25_000;
+    static PONG_GRACE_MS = 55_000;
+    _pingTimer = null;
+    _lastPongAt = 0;
+    constructor(wsUrl, apiKey, slug) {
+        this.wsUrl = wsUrl;
+        this.apiKey = apiKey;
+        this.slug = slug;
+    }
+    /** Called once when the WS connection is first established (and on each reconnect). */
+    setOnConnect(cb) { this._onConnect = cb; }
+    /** Called whenever a task is successfully appended to TODO.md via a WS push. */
+    setOnTaskAppend(cb) { this._onTaskAppend = cb; }
+    /** Called when a slash command (e.g. /restart) is received via WS push. */
+    setOnCommand(cb) { this._onCommand = cb; }
+    /** Called when a mcp_update frame arrives — receives the new mcpServers map. */
+    setOnMcpUpdate(cb) { this._onMcpUpdate = cb; }
+    /** Called when an export_request frame arrives — agent should create + upload a backup. */
+    setOnExportRequest(cb) { this._onExportRequest = cb; }
+    /** Called when a restore_request frame arrives — agent should download + restore a backup. */
+    setOnRestoreRequest(cb) { this._onRestoreRequest = cb; }
+    /** Called when an export_config frame arrives — sync exportEnabled/exportDailyBackup settings. */
+    setOnExportConfig(cb) { this._onExportConfig = cb; }
+    /** Start the WebSocket connection (call once). */
+    start(todoPath, log, workspaceRoot) {
+        this._todoPath = todoPath;
+        this._workspaceRoot = workspaceRoot;
+        if (log) {
+            this._log = log;
+        }
+        this._log(`WS connecting → ${this.wsUrl} (slug: ${this.slug})`);
+        this._connect();
+    }
+    /** Tear down the connection permanently. */
+    destroy() {
+        this._destroyed = true;
+        this._stopHeartbeat();
+        this._stopAllVncSessions();
+        this._stopAllRdpSessions();
+        if (this._reconnectTimer) {
+            clearTimeout(this._reconnectTimer);
+            this._reconnectTimer = null;
+        }
+        this._closeSocket();
+    }
+    /**
+     * Called by the poller loop — always returns false because the WebSocket
+     * connection is event-driven; tasks are appended directly in _onFrame().
+     */
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    pollAndAppend(_todoPath, _workspaceRoot) {
+        return Promise.resolve(false);
+    }
+    // ─── private ─────────────────────────────────────────────────────────────
+    _connect() {
+        if (this._destroyed) {
+            return;
+        }
+        const parsed = new URL(this.wsUrl);
+        const isSecure = parsed.protocol === 'wss:';
+        // On Windows, Node.js may resolve 'localhost' to ::1 (IPv6) but the WS server
+        // only binds to 0.0.0.0 (IPv4). Force 127.0.0.1 to avoid the mismatch.
+        const rawHost = parsed.hostname;
+        const host = (rawHost === 'localhost' || rawHost === '::1') ? '127.0.0.1' : rawHost;
+        const port = parsed.port ? parseInt(parsed.port, 10) : (isSecure ? 443 : 80);
+        // Build WebSocket upgrade path: preserve any existing path, append query params
+        const basePath = parsed.pathname || '/';
+        const qs = new URLSearchParams({ token: this.apiKey, endpoint: this.slug }).toString();
+        const upgradePath = `${basePath}?${qs}`;
+        const key = crypto.randomBytes(16).toString('base64');
+        const handshake = [
+            `GET ${upgradePath} HTTP/1.1`,
+            `Host: ${host}:${port}`,
+            'Upgrade: websocket',
+            'Connection: Upgrade',
+            `Sec-WebSocket-Key: ${key}`,
+            'Sec-WebSocket-Version: 13',
+            '',
+            '',
+        ].join('\r\n');
+        const sock = isSecure
+            ? tls.connect({ host, port, servername: host })
+            : net.createConnection({ host, port });
+        // For plain TCP, 'connect' is the ready signal.
+        // For TLS, 'secureConnect' fires after the TLS handshake; we skip the
+        // plain 'connect' event to avoid writing the HTTP upgrade too early.
+        if (isSecure) {
+            sock.once('secureConnect', () => {
+                sock.write(handshake);
+            });
+        }
+        else {
+            sock.once('connect', () => {
+                sock.write(handshake);
+            });
+        }
+        let headersDone = false;
+        let headerBuf = '';
+        sock.on('data', (chunk) => {
+            if (!headersDone) {
+                headerBuf += chunk.toString('binary');
+                const sep = headerBuf.indexOf('\r\n\r\n');
+                if (sep === -1) {
+                    return;
+                }
+                if (!headerBuf.includes('101 Switching Protocols')) {
+                    const statusLine = headerBuf.split('\r\n')[0] ?? '(no response)';
+                    this._log(`WS upgrade rejected by ${host}:${port}: "${statusLine}" — reconnecting in ${WebSocketPoller.RECONNECT_DELAY_MS}ms`);
+                    sock.destroy();
+                    this._scheduleReconnect();
+                    return;
+                }
+                headersDone = true;
+                this._connected = true;
+                this._log(`WS connected → ${host}:${port} (slug: ${this.slug})`);
+                // Flush any frames queued before the connection was established
+                const pending = this._pendingFrames.splice(0);
+                for (const frame of pending) {
+                    this._sendTextFrame(JSON.stringify(frame));
+                }
+                // Notify listener so caller can resend agent_online on reconnect
+                if (this._onConnect) {
+                    this._onConnect();
+                }
+                // Subscribe to the deliveries channel so the server pushes webhook events
+                this._sendTextFrame(JSON.stringify({ type: 'subscribe', data: { channels: ['deliveries'] } }));
+                // Start the WS-level keepalive (server drops idle conns after ~10 min)
+                this._startHeartbeat();
+                // Any bytes after the headers belong to the first WS frame
+                const remaining = Buffer.from(headerBuf.slice(sep + 4), 'binary');
+                if (remaining.length > 0) {
+                    this._buffer = remaining;
+                    this._processBuffer();
+                }
+                return;
+            }
+            this._buffer = Buffer.concat([this._buffer, chunk]);
+            this._processBuffer();
+        });
+        sock.on('error', (err) => {
+            this._log(`WS error (${host}:${port}): ${err.message} — reconnecting in ${WebSocketPoller.RECONNECT_DELAY_MS}ms`);
+            this._connected = false;
+            this._scheduleReconnect();
+        });
+        sock.on('close', () => {
+            if (this._connected) {
+                this._log(`WS disconnected from ${host}:${port} — reconnecting`);
+            }
+            this._connected = false;
+            this._scheduleReconnect();
+        });
+        this._socket = sock;
+    }
+    _closeSocket() {
+        if (this._socket) {
+            try {
+                // Send WebSocket close frame (opcode 0x8, masked, zero-length payload)
+                const mask = crypto.randomBytes(4);
+                this._socket.write(Buffer.from([0x88, 0x80, mask[0], mask[1], mask[2], mask[3]]));
+            }
+            catch { /* ignore */ }
+            this._socket.destroy();
+            this._socket = null;
+        }
+    }
+    _scheduleReconnect() {
+        this._stopHeartbeat();
+        this._stopAllVncSessions();
+        this._stopAllRdpSessions();
+        if (this._destroyed) {
+            return;
+        }
+        // If a reconnect is already scheduled, don't schedule another.
+        if (this._reconnectTimer) {
+            return;
+        }
+        // Detach and destroy the old socket so its stale event listeners (close/error)
+        // can't trigger another _scheduleReconnect() call after we've already queued one.
+        const oldSocket = this._socket;
+        this._socket = null;
+        this._connected = false;
+        this._buffer = Buffer.alloc(0);
+        if (oldSocket) {
+            oldSocket.removeAllListeners('data');
+            oldSocket.removeAllListeners('close');
+            oldSocket.removeAllListeners('error');
+            oldSocket.destroy();
+        }
+        this._reconnectTimer = setTimeout(() => {
+            this._reconnectTimer = null;
+            this._connect();
+        }, WebSocketPoller.RECONNECT_DELAY_MS);
+    }
+    /** Parse and consume complete WebSocket frames from _buffer. */
+    _processBuffer() {
+        while (true) {
+            const frame = this._parseFrame();
+            if (!frame) {
+                break;
+            }
+            this._onFrame(frame.opcode, frame.payload);
+        }
+    }
+    _parseFrame() {
+        if (this._buffer.length < 2) {
+            return null;
+        }
+        const byte1 = this._buffer[0];
+        const byte2 = this._buffer[1];
+        const opcode = byte1 & 0x0f;
+        const isMasked = (byte2 & 0x80) !== 0;
+        let payloadLen = byte2 & 0x7f;
+        let offset = 2;
+        if (payloadLen === 126) {
+            if (this._buffer.length < offset + 2) {
+                return null;
+            }
+            payloadLen = this._buffer.readUInt16BE(offset);
+            offset += 2;
+        }
+        else if (payloadLen === 127) {
+            if (this._buffer.length < offset + 8) {
+                return null;
+            }
+            // Use only the lower 32 bits (messages won't be >4 GB)
+            payloadLen = this._buffer.readUInt32BE(offset + 4);
+            offset += 8;
+        }
+        const maskBytes = isMasked ? 4 : 0;
+        if (this._buffer.length < offset + maskBytes + payloadLen) {
+            return null;
+        }
+        const mask = isMasked ? this._buffer.slice(offset, offset + 4) : null;
+        offset += maskBytes;
+        let payload = this._buffer.slice(offset, offset + payloadLen);
+        if (mask) {
+            payload = Buffer.from(payload);
+            for (let i = 0; i < payload.length; i++) {
+                payload[i] ^= mask[i % 4];
+            }
+        }
+        // Consume frame from buffer
+        this._buffer = this._buffer.slice(offset + payloadLen);
+        return { opcode, payload };
+    }
+    _onFrame(opcode, payload) {
+        if (opcode === 0x9) {
+            // Ping from server — reply with pong + treat as proof of life
+            this._sendPong(payload);
+            this._lastPongAt = Date.now();
+            return;
+        }
+        if (opcode === 0xa) {
+            // Pong from server (reply to one of our pings) — heartbeat alive
+            this._lastPongAt = Date.now();
+            return;
+        }
+        if (opcode === 0x8) {
+            // Close — reconnect
+            this._connected = false;
+            this._scheduleReconnect();
+            return;
+        }
+        if (opcode !== 0x1) {
+            return;
+        } // only handle text frames
+        let msg;
+        try {
+            msg = JSON.parse(payload.toString('utf8'));
+        }
+        catch {
+            return;
+        }
+        const msgType = msg['type'];
+        // ── VNC frames from pixel-office ─────────────────────────────────────────
+        // ── MCP update from pixel-office ─────────────────────────────────────────
+        if (msgType === 'mcp_update') {
+            const entries = msg['mcpServers'];
+            if (entries && typeof entries === 'object') {
+                this._onMcpUpdate?.(entries);
+            }
+            return;
+        }
+        // ── Export / restore requests from pixel-office ───────────────────────────
+        if (msgType === 'export_request') {
+            const agentId = msg['agentId'];
+            if (agentId) {
+                this._onExportRequest?.(agentId);
+            }
+            return;
+        }
+        if (msgType === 'restore_request') {
+            const agentId = msg['agentId'];
+            const downloadUrl = msg['downloadUrl'];
+            if (agentId && downloadUrl) {
+                this._onRestoreRequest?.(agentId, downloadUrl);
+            }
+            return;
+        }
+        if (msgType === 'export_config') {
+            const exportEnabled = !!msg['exportEnabled'];
+            const exportDailyBackup = !!msg['exportDailyBackup'];
+            const agentId = msg['agentId'] ?? '';
+            this._onExportConfig?.(exportEnabled, exportDailyBackup, agentId);
+            return;
+        }
+        // ── File browser requests from server ─────────────────────────────────────
+        if (msgType === 'fb_request') {
+            const requestId = msg['requestId'];
+            const action = msg['action'];
+            const relPath = msg['path'] ?? '';
+            const content = msg['content'];
+            const newPath = msg['newPath'];
+            const query = msg['query'];
+            if (requestId && action) {
+                this._handleFbRequest(requestId, action, relPath, content, newPath, query);
+            }
+            return;
+        }
+        if (msgType === 'git_request') {
+            const requestId = msg['requestId'];
+            const action = msg['action'];
+            if (requestId && action) {
+                this._handleGitRequest(requestId, action, msg['path'], msg['staged'], msg['message'], msg['branch'], msg['hash']);
+            }
+            return;
+        }
+        if (msgType === 'vnc_session') {
+            const action = msg['action'];
+            if (action === 'start') {
+                const sessionId = msg['sessionId'];
+                const port = Number(msg['port'] ?? 5900);
+                // Prefer password from server frame; fall back to locally-configured password
+                const password = msg['password'] || this._vncPassword;
+                this._log(`VNC session start: ${sessionId} → port ${port}`);
+                const session = new vnc_1.VncSession(sessionId, (frame) => this.sendFrame(frame));
+                this._vncSessions.set(sessionId, session);
+                session.start(port, password).catch((err) => {
+                    this._log(`VNC session ${sessionId} failed to start: ${err.message}`);
+                    this._vncSessions.delete(sessionId);
+                    this.sendFrame({ type: 'vnc_close', sessionId, reason: err.message });
+                });
+            }
+            return;
+        }
+        if (msgType === 'vnc_input') {
+            const sessionId = msg['sessionId'];
+            const event = msg['event'];
+            if (sessionId && event) {
+                this._vncSessions.get(sessionId)?.handleInput(event);
+            }
+            return;
+        }
+        if (msgType === 'vnc_close') {
+            const sessionId = msg['sessionId'];
+            if (sessionId) {
+                this._log(`VNC session closed: ${sessionId}`);
+                this._vncSessions.get(sessionId)?.stop();
+                this._vncSessions.delete(sessionId);
+            }
+            return;
+        }
+        // ── RDP frames from pixel-office ─────────────────────────────────────────
+        if (msgType === 'rdp_session') {
+            const action = msg['action'];
+            if (action === 'start') {
+                const sessionId = msg['sessionId'];
+                const opts = {
+                    // Local settings take priority: the server-sent host is pixel-office's own IP,
+                    // not the target RDP server. Use local rdpHost setting, or default to 127.0.0.1
+                    // (xrdp always runs on the same machine as the extension).
+                    host: this._rdpSettings.host || msg['host'] || '127.0.0.1',
+                    port: msg['port'] ? Number(msg['port']) : (this._rdpSettings.port ?? 3389),
+                    // credentials never sent from server — always use local settings
+                    username: this._rdpSettings.username || msg['username'],
+                    password: this._rdpSettings.password || msg['password'],
+                    domain: this._rdpSettings.domain || msg['domain'],
+                    width: msg['width'] ? Number(msg['width']) : undefined,
+                    height: msg['height'] ? Number(msg['height']) : undefined,
+                    colorDepth: msg['colorDepth'] ? Number(msg['colorDepth']) : undefined,
+                };
+                this._log(`RDP session start: ${sessionId} → ${opts.host}:${opts.port ?? 3389}`);
+                // Send Guacamole token to browser so it can connect via guacamole-lite
+                // (guacd + guacamole-lite must be running on the same host as xrdp, port 4567)
+                if (opts.username || opts.password) {
+                    const guacSettings = {
+                        hostname: opts.host,
+                        port: String(opts.port ?? 3389),
+                        'ignore-cert': true,
+                    };
+                    if (opts.username) {
+                        guacSettings['username'] = opts.username;
+                    }
+                    if (opts.password) {
+                        guacSettings['password'] = opts.password;
+                    }
+                    if (opts.domain) {
+                        guacSettings['domain'] = opts.domain;
+                    }
+                    if (opts.width) {
+                        guacSettings['width'] = opts.width;
+                    }
+                    if (opts.height) {
+                        guacSettings['height'] = opts.height;
+                    }
+                    guacSettings['color-depth'] = opts.colorDepth ?? 24;
+                    const tokenPayload = JSON.stringify({ connection: { type: 'rdp', settings: guacSettings } });
+                    const token = Buffer.from(tokenPayload).toString('base64');
+                    // Use configured WSS URL (for HTTPS frontends), else fall back to plain WS on port 4567
+                    const guacWsUrl = this._rdpSettings.guacWsUrl || `ws://${opts.host}:4567`;
+                    this.sendFrame({
+                        type: 'rdp_guac_token',
+                        sessionId,
+                        wsUrl: guacWsUrl,
+                        token,
+                        width: opts.width ?? 1280,
+                        height: opts.height ?? 800,
+                    });
+                    this._log(`RDP guac token sent for session ${sessionId} → ${guacWsUrl}`);
+                }
+                const session = new rdp_1.RdpSession(sessionId, (frame) => this.sendFrame(frame), (msg) => this._log(msg));
+                this._rdpSessions.set(sessionId, session);
+                session.start(opts).catch((err) => {
+                    this._log(`RDP session ${sessionId} failed to start: ${err.message}`);
+                    this._rdpSessions.delete(sessionId);
+                    this.sendFrame({ type: 'rdp_close', sessionId, reason: err.message });
+                });
+            }
+            return;
+        }
+        if (msgType === 'rdp_input') {
+            const sessionId = msg['sessionId'];
+            const event = msg['event'];
+            if (sessionId && event) {
+                this._rdpSessions.get(sessionId)?.handleInput(event);
+            }
+            return;
+        }
+        if (msgType === 'rdp_close') {
+            const sessionId = msg['sessionId'];
+            if (sessionId) {
+                this._log(`RDP session closed: ${sessionId}`);
+                this._rdpSessions.get(sessionId)?.stop();
+                this._rdpSessions.delete(sessionId);
+            }
+            return;
+        }
+        // ── A2A task frame ────────────────────────────────────────────────────────
+        // A2A task frame: { task: { id, contextId, status: { state }, metadata: { event, task, parts } } }
+        if (msg['task']) {
+            const t = msg['task'];
+            const state = t['status']?.['state'];
+            if (state !== 'TASK_STATE_SUBMITTED') {
+                return;
+            }
+            // Deduplicate by task ID so the same delivery isn't re-processed on reconnect,
+            // but a new task with identical text is still accepted.
+            const taskId = t['id'];
+            if (taskId) {
+                if (this._seenTaskIds.has(taskId)) {
+                    this._log(`WS task already processed (id=${taskId}), skipping`);
+                    return;
+                }
+                this._seenTaskIds.add(taskId);
+                // Bound the set to avoid unbounded growth over long-running sessions
+                if (this._seenTaskIds.size > 1000) {
+                    const oldest = this._seenTaskIds.values().next().value;
+                    if (oldest) {
+                        this._seenTaskIds.delete(oldest);
+                    }
+                }
+            }
+            const meta = t['metadata'] ?? {};
+            if (meta['event'] !== 'user_message') {
+                return;
+            }
+            const taskObj = meta['task'];
+            let taskText = typeof taskObj?.['text'] === 'string' ? taskObj['text'] : '';
+            // Handle A2A parts — extract text parts and save file parts as attachments
+            // Pre-generate task ID so all attachments share the same prefix
+            const wsTaskId = (0, todo_1.shortId)();
+            const rawParts = meta['parts'];
+            const textParts = [];
+            const attRefs = [];
+            if (rawParts) {
+                for (const part of rawParts) {
+                    if (part['kind'] === 'text') {
+                        const t = part['text'] ?? '';
+                        if (t) {
+                            textParts.push(t);
+                        }
+                    }
+                    else if (part['kind'] === 'file' && this._workspaceRoot) {
+                        const file = part['file'];
+                        if (file) {
+                            const name = file['name'] ?? 'attachment';
+                            const bytesB64 = file['bytes'];
+                            if (bytesB64) {
+                                const buf = Buffer.from(bytesB64, 'base64');
+                                const rel = (0, messageBuilder_1.saveAttachment)(this._workspaceRoot, name, buf, wsTaskId);
+                                attRefs.push(rel);
+                            }
+                            else if (typeof file['uri'] === 'string') {
+                                attRefs.push(file['uri']);
+                            }
+                        }
+                    }
+                }
+            }
+            // Use parts text only as fallback when task.text is absent
+            if (!taskText && textParts.length > 0) {
+                taskText = textParts.join(' ');
+            }
+            if (!taskText) {
+                return;
+            }
+            // Collapse newlines so the entire message becomes a single TODO.md line
+            taskText = taskText.replace(/\r\n|\r|\n/g, ' ').trim();
+            const fullText = attRefs.length > 0
+                ? taskText + ' ' + attRefs.map(p => `[attachment: ${p}]`).join(' ')
+                : taskText;
+            this._log(`WS task received: "${taskText}"${attRefs.length > 0 ? ` (+${attRefs.length} attachment(s))` : ''}`);
+            // Handle slash commands — don't append as tasks
+            if (fullText.startsWith('/')) {
+                this._onCommand?.(fullText);
+                return;
+            }
+            if (!this._todoPath) {
+                this._log('WS failed to append task to TODO.md: todoPath is empty');
+                return;
+            }
+            todoWriteManager_1.todoWriter.append(this._todoPath, fullText, wsTaskId)
+                .then(() => { this._onTaskAppend?.(); })
+                .catch(err => { this._log(`WS failed to append task to TODO.md: ${err}`); });
+        }
+    }
+    /** Handle a file-browser request from the server (originated by the browser UI). */
+    _handleFbRequest(requestId, action, relPath, content, newPath, query) {
+        const respond = (ok, extra) => {
+            this.sendFrame({ type: 'fb_response', requestId, ok, ...extra });
+        };
+        const root = this._workspaceRoot;
+        if (!root) {
+            respond(false, { error: 'No workspace root configured' });
+            return;
+        }
+        // Resolve and validate path is within workspace root
+        const resolveSafe = (rel) => {
+            const resolved = path.resolve(root, rel);
+            return resolved.startsWith(root + path.sep) || resolved === root ? resolved : null;
+        };
+        const absPath = resolveSafe(relPath);
+        if (!absPath) {
+            respond(false, { error: 'Path outside workspace' });
+            return;
+        }
+        try {
+            switch (action) {
+                case 'list': {
+                    const entries = fs.readdirSync(absPath, { withFileTypes: true }).map(e => {
+                        const stat = (() => { try {
+                            return fs.statSync(path.join(absPath, e.name));
+                        }
+                        catch {
+                            return null;
+                        } })();
+                        return {
+                            name: e.name,
+                            type: e.isDirectory() ? 'dir' : 'file',
+                            size: stat?.size ?? 0,
+                            mtime: stat?.mtimeMs ?? 0,
+                        };
+                    });
+                    // Dirs first, then files; both alphabetical
+                    entries.sort((a, b) => {
+                        if (a.type !== b.type) {
+                            return a.type === 'dir' ? -1 : 1;
+                        }
+                        return a.name.localeCompare(b.name);
+                    });
+                    respond(true, { entries });
+                    break;
+                }
+                case 'read': {
+                    const stat = fs.statSync(absPath);
+                    const MAX_BYTES = 1_048_576; // 1 MB
+                    if (stat.size > MAX_BYTES) {
+                        respond(false, { error: `File too large (${stat.size} bytes, limit 1 MB)` });
+                        break;
+                    }
+                    // Binary detection: read first 512 bytes and check for null bytes
+                    const sample = Buffer.allocUnsafe(Math.min(512, stat.size));
+                    const fd = fs.openSync(absPath, 'r');
+                    fs.readSync(fd, sample, 0, sample.length, 0);
+                    fs.closeSync(fd);
+                    const isBinary = sample.includes(0x00);
+                    if (isBinary) {
+                        respond(false, { error: 'Binary file — cannot display' });
+                        break;
+                    }
+                    const fileContent = fs.readFileSync(absPath, 'utf8');
+                    respond(true, { content: fileContent });
+                    break;
+                }
+                case 'write': {
+                    if (content === undefined) {
+                        respond(false, { error: 'No content provided' });
+                        break;
+                    }
+                    fs.writeFileSync(absPath, content, 'utf8');
+                    respond(true);
+                    break;
+                }
+                case 'delete': {
+                    fs.rmSync(absPath, { recursive: true, force: true });
+                    respond(true);
+                    break;
+                }
+                case 'rename': {
+                    if (!newPath) {
+                        respond(false, { error: 'No newPath provided' });
+                        break;
+                    }
+                    const absNewPath = resolveSafe(newPath);
+                    if (!absNewPath) {
+                        respond(false, { error: 'newPath outside workspace' });
+                        break;
+                    }
+                    fs.renameSync(absPath, absNewPath);
+                    respond(true);
+                    break;
+                }
+                case 'download': {
+                    const buf = fs.readFileSync(absPath);
+                    respond(true, { base64: buf.toString('base64') });
+                    break;
+                }
+                case 'mkdir': {
+                    fs.mkdirSync(absPath, { recursive: true });
+                    respond(true);
+                    break;
+                }
+                case 'search': {
+                    const rawQuery = (query ?? '').toLowerCase().trim();
+                    if (!rawQuery) {
+                        respond(true, { results: [] });
+                        break;
+                    }
+                    const results = [];
+                    const walk = (dir, relDir, depth) => {
+                        if (depth > 8 || results.length >= 300)
+                            return;
+                        let dirents;
+                        try {
+                            dirents = fs.readdirSync(dir, { withFileTypes: true });
+                        }
+                        catch {
+                            return;
+                        }
+                        for (const e of dirents) {
+                            if (results.length >= 300)
+                                break;
+                            const rel = relDir ? `${relDir}/${e.name}` : e.name;
+                            if (e.name.toLowerCase().includes(rawQuery)) {
+                                results.push({ path: rel, name: e.name, type: e.isDirectory() ? 'dir' : 'file' });
+                            }
+                            if (e.isDirectory() && !e.name.startsWith('.') && e.name !== 'node_modules' && e.name !== 'vendor') {
+                                walk(path.join(dir, e.name), rel, depth + 1);
+                            }
+                        }
+                    };
+                    walk(absPath, '', 0);
+                    respond(true, { results });
+                    break;
+                }
+                default:
+                    respond(false, { error: `Unknown action: ${action}` });
+            }
+        }
+        catch (err) {
+            respond(false, { error: String(err) });
+        }
+    }
+    _handleGitRequest(requestId, action, filePath, staged, message, branch, hash) {
+        const respond = (ok, data, error) => {
+            this.sendFrame({ type: 'git_response', requestId, ok, ...(data ?? {}), ...(error ? { error } : {}) });
+        };
+        const root = this._workspaceRoot;
+        if (!root) {
+            respond(false, undefined, 'No workspace root');
+            return;
+        }
+        if (!this._gitEnabled) {
+            respond(false, undefined, 'Git not enabled');
+            return;
+        }
+        (async () => {
+            try {
+                switch (action) {
+                    case 'status': {
+                        const status = await gitService.getStatus(root);
+                        respond(true, { status });
+                        break;
+                    }
+                    case 'log': {
+                        const commits = await gitService.getLog(root);
+                        respond(true, { commits });
+                        break;
+                    }
+                    case 'diff': {
+                        const diff = await gitService.getDiff(root, filePath ?? '', staged ?? false);
+                        respond(true, { diff });
+                        break;
+                    }
+                    case 'commit_diff': {
+                        const diff = await gitService.getCommitDiff(root, hash ?? '', filePath);
+                        respond(true, { diff });
+                        break;
+                    }
+                    case 'stage': {
+                        if (filePath)
+                            await gitService.stageFile(root, filePath);
+                        else
+                            await gitService.stageAll(root);
+                        respond(true);
+                        break;
+                    }
+                    case 'unstage': {
+                        if (!filePath) {
+                            respond(false, undefined, 'path required');
+                            break;
+                        }
+                        await gitService.unstageFile(root, filePath);
+                        respond(true);
+                        break;
+                    }
+                    case 'commit': {
+                        if (!message) {
+                            respond(false, undefined, 'message required');
+                            break;
+                        }
+                        const commitHash = await gitService.commit(root, message);
+                        respond(true, { hash: commitHash });
+                        break;
+                    }
+                    case 'fetch': {
+                        await gitService.fetchOrigin(root);
+                        respond(true);
+                        break;
+                    }
+                    case 'branches': {
+                        const branches = await gitService.getBranches(root);
+                        respond(true, { branches });
+                        break;
+                    }
+                    case 'checkout': {
+                        if (!branch) {
+                            respond(false, undefined, 'branch required');
+                            break;
+                        }
+                        await gitService.checkoutBranch(root, branch);
+                        respond(true);
+                        break;
+                    }
+                    default:
+                        respond(false, undefined, `Unknown git action: ${action}`);
+                }
+            }
+            catch (err) {
+                respond(false, undefined, String(err));
+            }
+        })();
+    }
+    /** Stop all active VNC sessions (called on destroy/reconnect). */
+    _stopAllVncSessions() {
+        for (const [id, session] of this._vncSessions) {
+            this._log(`VNC session terminated (disconnect): ${id}`);
+            session.stop();
+        }
+        this._vncSessions.clear();
+    }
+    /** Stop all active RDP sessions (called on destroy/reconnect). */
+    _stopAllRdpSessions() {
+        for (const [id, session] of this._rdpSessions) {
+            this._log(`RDP session terminated (disconnect): ${id}`);
+            session.stop();
+        }
+        this._rdpSessions.clear();
+    }
+    /** Update the VNC password used for incoming vnc_session requests. */
+    setVncPassword(password) {
+        this._vncPassword = password;
+    }
+    setGitEnabled(enabled) {
+        this._gitEnabled = enabled;
+    }
+    setRdpSettings(s) {
+        this._rdpSettings = s;
+    }
+    /**
+     * Send a JSON payload to the server over the WebSocket connection.
+     * Queues the frame if not yet connected — always returns true (accepted).
+     */
+    static MAX_PENDING_FRAMES = 200;
+    sendFrame(payload) {
+        if (!this._connected || !this._socket) {
+            // Cap the queue to prevent unbounded growth during a long reconnect loop.
+            if (this._pendingFrames.length >= WebSocketPoller.MAX_PENDING_FRAMES) {
+                this._pendingFrames.shift(); // drop oldest frame
+            }
+            this._pendingFrames.push(payload);
+            return true; // accepted into queue
+        }
+        this._sendTextFrame(JSON.stringify(payload));
+        return true;
+    }
+    /** Send a masked WebSocket text frame. */
+    _sendTextFrame(text) {
+        if (!this._socket) {
+            return;
+        }
+        const data = Buffer.from(text, 'utf8');
+        const len = data.length;
+        const mask = crypto.randomBytes(4);
+        let header;
+        if (len <= 125) {
+            header = Buffer.alloc(6);
+            header[0] = 0x81;
+            header[1] = len | 0x80;
+            mask.copy(header, 2);
+        }
+        else if (len <= 65535) {
+            header = Buffer.alloc(8);
+            header[0] = 0x81;
+            header[1] = 126 | 0x80;
+            header.writeUInt16BE(len, 2);
+            mask.copy(header, 4);
+        }
+        else {
+            header = Buffer.alloc(14);
+            header[0] = 0x81;
+            header[1] = 127 | 0x80;
+            header.writeBigUInt64BE(BigInt(len), 2);
+            mask.copy(header, 10);
+        }
+        const masked = Buffer.from(data);
+        for (let i = 0; i < masked.length; i++) {
+            masked[i] ^= mask[i % 4];
+        }
+        this._socket.write(Buffer.concat([header, masked]));
+    }
+    _sendPong(payload) {
+        if (!this._socket) {
+            return;
+        }
+        const mask = crypto.randomBytes(4);
+        const len = payload.length;
+        const header = Buffer.alloc(2 + 4);
+        header[0] = 0x8a; // FIN + pong opcode
+        header[1] = (len & 0x7f) | 0x80; // masked, length (assumes len <= 125)
+        mask.copy(header, 2);
+        const maskedPayload = Buffer.from(payload);
+        for (let i = 0; i < maskedPayload.length; i++) {
+            maskedPayload[i] ^= mask[i % 4];
+        }
+        this._socket.write(Buffer.concat([header, maskedPayload]));
+    }
+    /** Send a zero-payload Ping frame. Server's WS server replies with Pong. */
+    _sendPing() {
+        if (!this._socket || !this._connected) {
+            return;
+        }
+        try {
+            // FIN + opcode 0x9 (ping), masked, zero-length payload
+            const mask = crypto.randomBytes(4);
+            this._socket.write(Buffer.from([0x89, 0x80, mask[0], mask[1], mask[2], mask[3]]));
+        }
+        catch { /* socket may be dead — close handler will reconnect */ }
+    }
+    /** Start the heartbeat. Cleared automatically on close/destroy/reconnect. */
+    _startHeartbeat() {
+        this._stopHeartbeat();
+        this._lastPongAt = Date.now();
+        this._pingTimer = setInterval(() => {
+            // If the server hasn't responded in PONG_GRACE_MS, the link is dead
+            // even though TCP still thinks we're connected (proxy/NAT timeout).
+            const silence = Date.now() - this._lastPongAt;
+            if (silence > WebSocketPoller.PONG_GRACE_MS) {
+                this._log(`WS heartbeat timeout (no pong for ${Math.round(silence / 1000)}s) — forcing reconnect`);
+                this._connected = false;
+                this._scheduleReconnect();
+                return;
+            }
+            this._sendPing();
+        }, WebSocketPoller.PING_INTERVAL_MS);
+    }
+    _stopHeartbeat() {
+        if (this._pingTimer) {
+            clearInterval(this._pingTimer);
+            this._pingTimer = null;
+        }
+    }
+}
+exports.WebSocketPoller = WebSocketPoller;
+//# sourceMappingURL=webSocketPoller.js.map