beehaven 0.8.16

package/dist/dashboard.js

@@ -0,0 +1,846 @@
+/**
+ * Dashboard — Local web dashboard for Beehaven observability.
+ *
+ * Serves a single-page HTML dashboard on localhost.
+ * Accepts WebSocket connections for real-time metric streaming.
+ * Accepts console log forwarding from browser clients.
+ *
+ *   const dashboard = new Dashboard({ port: 9800 });
+ *   dashboard.start();
+ *   dashboard.pushRadar(radarSnapshot);
+ *   dashboard.pushThreats(threats);
+ *   dashboard.pushEvent(event);
+ *   dashboard.pushConsoleLog(log);
+ */
+import { createServer } from 'node:http';
+import { readFileSync, existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { WebSocketServer } from 'ws';
+// ── Fallback HTML ───────────────────────────────────────────────────────────
+const FALLBACK_HTML = `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Beehaven Dashboard</title>
+  <style>
+    body { font-family: 'Inter', system-ui, sans-serif; background: #0A0A12; color: #e0e0e0; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; }
+    .container { text-align: center; max-width: 480px; padding: 2rem; }
+    h1 { color: #F5A623; font-family: 'Space Grotesk', system-ui, sans-serif; }
+    p { color: #888; line-height: 1.6; }
+    code { background: #1a1a2e; padding: 0.2em 0.5em; border-radius: 4px; font-family: 'JetBrains Mono', monospace; color: #7C3AED; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>Beehaven Dashboard</h1>
+    <p>Dashboard HTML not found. Place <code>dashboard.html</code> next to the compiled JS to enable the full UI.</p>
+    <p>The API endpoints are still available:</p>
+    <ul style="text-align:left;color:#888;">
+      <li><code>GET /api/state</code> — full state snapshot</li>
+      <li><code>GET /api/events</code> — recent events</li>
+      <li><code>GET /api/console</code> — console logs</li>
+      <li><code>GET /api/radar</code> — latest radar</li>
+      <li><code>GET /api/threats</code> — latest threats</li>
+      <li><code>WS /ws</code> — real-time stream</li>
+    </ul>
+  </div>
+</body>
+</html>`;
+// ── Implementation ──────────────────────────────────────────────────────────
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+export class Dashboard {
+    _config;
+    _server = null;
+    _wss = null;
+    _clients = new Set();
+    // Rolling buffers
+    _events = [];
+    _consoleLogs = [];
+    _latestRadar = null;
+    _latestThreats = null;
+    _latestMetrics = null;
+    // Cached HTML
+    _htmlContent = null;
+    _explorerHtmlContent = null;
+    // Stats
+    _startedAt = 0;
+    _totalEvents = 0;
+    _totalConsoleLogs = 0;
+    // Browser-runtime buildings — set externally via setBrowserBuildings.
+    // Keyed by app name → map of building key → absolute path to compiled JS.
+    // The dashboard serves these as text/javascript modules at
+    // http://127.0.0.1:9800/apps/<name>/buildings/<key>.js so browser-side
+    // hive runtime code can dynamic-import them.
+    _browserBuildings = new Map();
+    // Installed apps — set externally via setAppFrontends. Keyed by app name.
+    // `appRoot` is the .app extract root; `frontendEntry` is the relative
+    // path within it to serve when no sub-path is requested.
+    _appFrontends = new Map();
+    // Registered marketplace feed — optional static catalog of available apps
+    // to surface alongside installed ones.
+    _marketplaceCatalogProvider = null;
+    // Bridge to the IPC bus — set externally via setAppBridge. When present,
+    // /apps/ws WebSocket connections are forwarded into the bus as virtual
+    // IPC clients so the same pipeline/app-rpc handlers serve browsers too.
+    _appBridge = null;
+    _appWss = null;
+    constructor(config) {
+        this._config = {
+            port: config?.port ?? 9800,
+            host: config?.host ?? '127.0.0.1',
+            maxEvents: config?.maxEvents ?? 500,
+            maxConsoleLogs: config?.maxConsoleLogs ?? 1000,
+            explorerTarget: config?.explorerTarget ?? 'http://127.0.0.1:8787',
+            explorerSecret: config?.explorerSecret || this._resolveExplorerSecret(config?.projectDir) || '',
+            projectDir: config?.projectDir ?? '',
+        };
+    }
+    /**
+     * Resolve the Explorer admin secret from .dev.vars or process.env.
+     * Wrangler reads .dev.vars automatically during `wrangler dev` — we mirror
+     * that behavior so the dashboard proxy can authenticate to the same Worker.
+     */
+    _resolveExplorerSecret(projectDir) {
+        // 1. Try .dev.vars in the project directory (same file wrangler reads)
+        const dirs = [projectDir, process.cwd()].filter(Boolean);
+        for (const dir of dirs) {
+            const devVarsPath = join(dir, '.dev.vars');
+            if (existsSync(devVarsPath)) {
+                try {
+                    const content = readFileSync(devVarsPath, 'utf8');
+                    for (const line of content.split('\n')) {
+                        const trimmed = line.trim();
+                        if (trimmed.startsWith('#') || !trimmed.includes('='))
+                            continue;
+                        const eqIdx = trimmed.indexOf('=');
+                        const key = trimmed.slice(0, eqIdx).trim();
+                        if (key === 'ADMIN_SECRET') {
+                            const val = trimmed
+                                .slice(eqIdx + 1)
+                                .trim()
+                                .replace(/^["']|["']$/g, '');
+                            if (val)
+                                return val;
+                        }
+                    }
+                }
+                catch {
+                    /* ignore read errors */
+                }
+            }
+        }
+        // 2. Fall back to process.env
+        if (process.env.ADMIN_SECRET)
+            return process.env.ADMIN_SECRET;
+        return '';
+    }
+    // ── Lifecycle ─────────────────────────────────────────────────────────────
+    async start() {
+        if (this._server)
+            return;
+        this._startedAt = Date.now();
+        this._loadHTML();
+        this._server = createServer((req, res) => this._handleHTTP(req, res));
+        // One WebSocketServer for the whole HTTP server. We don't use the
+        // { path } filter because attaching a SECOND WSS with a different
+        // path causes the ws library to 400 mismatched upgrades from the
+        // first WSS's listener — both listeners fire on every upgrade event.
+        // Instead we accept all upgrades and route by req.url in the
+        // connection handler.
+        this._wss = new WebSocketServer({ server: this._server });
+        this._wss.on('connection', (ws, req) => {
+            const url = req.url ?? '';
+            if (url.startsWith('/apps/ws')) {
+                this._handleAppWsConnection(ws);
+            }
+            else if (url.startsWith('/ws')) {
+                this._handleWSConnection(ws, req);
+            }
+            else {
+                try {
+                    ws.close(1008, `unknown path: ${url}`);
+                }
+                catch { }
+            }
+        });
+        this._wss.on('error', (err) => {
+            // Suppress ECONNRESET and similar transient errors
+            if (err.code !== 'ECONNRESET') {
+                console.error('[dashboard] WebSocket server error:', err.message);
+            }
+        });
+        // `_appWss` is no longer a separate server — routing is unified above.
+        this._appWss = this._wss;
+        return new Promise((resolve, reject) => {
+            const server = this._server;
+            const onError = (err) => {
+                server.removeListener('listening', onListening);
+                this._server = null;
+                this._wss = null;
+                reject(err);
+            };
+            const onListening = () => {
+                server.removeListener('error', onError);
+                resolve();
+            };
+            server.once('error', onError);
+            server.once('listening', onListening);
+            server.listen(this._config.port, this._config.host);
+        });
+    }
+    async stop() {
+        if (!this._server)
+            return;
+        // Close all WebSocket clients
+        for (const client of this._clients) {
+            try {
+                client.close(1001, 'Dashboard shutting down');
+            }
+            catch {
+                // Ignore errors during shutdown
+            }
+        }
+        this._clients.clear();
+        // Close WebSocket server
+        if (this._wss) {
+            await new Promise((resolve) => {
+                this._wss.close(() => resolve());
+            });
+            this._wss = null;
+        }
+        // Close HTTP server
+        await new Promise((resolve, reject) => {
+            this._server.close((err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve();
+            });
+        });
+        this._server = null;
+    }
+    // ── Push methods ──────────────────────────────────────────────────────────
+    pushRadar(snapshot) {
+        this._latestRadar = snapshot;
+        this._broadcast({ type: 'radar', data: snapshot });
+    }
+    pushThreats(data) {
+        this._latestThreats = data;
+        this._broadcast({ type: 'threats', data });
+    }
+    pushMetrics(data) {
+        this._latestMetrics = data;
+        this._broadcast({ type: 'metrics', data });
+    }
+    pushEvent(event) {
+        this._events.push(event);
+        if (this._events.length > this._config.maxEvents) {
+            this._events.shift();
+        }
+        this._totalEvents++;
+        this._broadcast({ type: 'event', data: event });
+    }
+    pushConsoleLog(entry) {
+        this._consoleLogs.push(entry);
+        if (this._consoleLogs.length > this._config.maxConsoleLogs) {
+            this._consoleLogs.shift();
+        }
+        this._totalConsoleLogs++;
+        this._broadcast({ type: 'console-log', data: entry });
+    }
+    // ── Getters ───────────────────────────────────────────────────────────────
+    get url() {
+        return `http://${this._config.host}:${this._config.port}`;
+    }
+    get port() {
+        return this._config.port;
+    }
+    get running() {
+        return this._server !== null;
+    }
+    get clientCount() {
+        return this._clients.size;
+    }
+    // ── HTTP handler ──────────────────────────────────────────────────────────
+    _handleHTTP(req, res) {
+        const url = req.url ?? '/';
+        const method = req.method ?? 'GET';
+        // Handle CORS preflight
+        if (method === 'OPTIONS') {
+            res.writeHead(204, {
+                'Access-Control-Allow-Origin': '*',
+                'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+                'Access-Control-Allow-Headers': 'Content-Type',
+                'Access-Control-Max-Age': '86400',
+            });
+            res.end();
+            return;
+        }
+        try {
+            // Explorer API proxy — forward /api/explorer/* to the Worker
+            if (url.startsWith('/api/explorer')) {
+                this._proxyExplorer(req, res, url);
+                return;
+            }
+            // Browser-runtime building JS modules: /apps/<name>/buildings/<key>.js
+            // These are runtime: 'browser' buildings declared in a hive's
+            // app.json — the daemon serves their compiled entry as a static
+            // module so the user's browser can dynamic-import + dispatch via
+            // the hive runtime (`hive.call(<hive>, <action>, ...)`).
+            // Matched BEFORE the general /apps/<name>/... static route so a
+            // hive's frontend can't accidentally shadow a building's URL.
+            if (method === 'GET') {
+                const buildingMatch = url.match(/^\/apps\/([^\/]+)\/buildings\/([^\/]+)\.js$/);
+                if (buildingMatch) {
+                    this._serveBrowserBuilding(res, buildingMatch[1], buildingMatch[2]);
+                    return;
+                }
+            }
+            // App frontend static files: /apps/<name>/...  →  <app.frontendDir>/...
+            if (method === 'GET' && url.startsWith('/apps/')) {
+                if (url === '/hives' || url === '/apps/') {
+                    this._serveAppIndex(res);
+                    return;
+                }
+                this._serveAppStatic(res, url);
+                return;
+            }
+            if (method === 'GET') {
+                switch (url) {
+                    case '/':
+                    case '/index.html':
+                        this._serveHTML(res);
+                        return;
+                    case '/explorer':
+                    case '/explorer/':
+                        this._serveExplorerHTML(res);
+                        return;
+                    case '/api/state':
+                        this._serveJSON(res, this._getState());
+                        return;
+                    case '/api/events':
+                        this._serveJSON(res, this._events);
+                        return;
+                    case '/api/console':
+                        this._serveJSON(res, this._consoleLogs);
+                        return;
+                    case '/api/radar':
+                        this._serveJSON(res, this._latestRadar);
+                        return;
+                    case '/api/threats':
+                        this._serveJSON(res, this._latestThreats);
+                        return;
+                    case '/api/metrics':
+                        this._serveJSON(res, this._latestMetrics);
+                        return;
+                    case '/api/marketplace':
+                    case '/api/marketplace/':
+                        this._serveMarketplace(res);
+                        return;
+                    default:
+                        res.writeHead(404, {
+                            'Content-Type': 'text/plain',
+                            'Access-Control-Allow-Origin': '*',
+                        });
+                        res.end('Not Found');
+                        return;
+                }
+            }
+            if (method === 'POST' && url === '/api/console') {
+                this._handleConsolePost(req, res);
+                return;
+            }
+            res.writeHead(405, { 'Content-Type': 'text/plain', 'Access-Control-Allow-Origin': '*' });
+            res.end('Method Not Allowed');
+        }
+        catch (err) {
+            console.error('[dashboard] HTTP error:', err);
+            res.writeHead(500, { 'Content-Type': 'text/plain', 'Access-Control-Allow-Origin': '*' });
+            res.end('Internal Server Error');
+        }
+    }
+    _handleConsolePost(req, res) {
+        const chunks = [];
+        req.on('data', (chunk) => {
+            chunks.push(chunk);
+            // Guard against oversized payloads (1MB limit)
+            const totalSize = chunks.reduce((sum, c) => sum + c.length, 0);
+            if (totalSize > 1_048_576) {
+                res.writeHead(413, { 'Content-Type': 'text/plain', 'Access-Control-Allow-Origin': '*' });
+                res.end('Payload Too Large');
+                req.destroy();
+            }
+        });
+        req.on('end', () => {
+            try {
+                const body = Buffer.concat(chunks).toString('utf8');
+                const parsed = JSON.parse(body);
+                // Accept single entry or array
+                const entries = Array.isArray(parsed) ? parsed : [parsed];
+                for (const entry of entries) {
+                    if (entry && typeof entry.level === 'string' && Array.isArray(entry.args)) {
+                        const normalized = {
+                            level: entry.level,
+                            args: entry.args,
+                            timestamp: entry.timestamp ?? Date.now(),
+                            source: entry.source,
+                            url: entry.url,
+                            sessionId: entry.sessionId,
+                            userId: entry.userId,
+                        };
+                        this.pushConsoleLog(normalized);
+                    }
+                }
+                res.writeHead(200, {
+                    'Content-Type': 'application/json',
+                    'Access-Control-Allow-Origin': '*',
+                });
+                res.end(JSON.stringify({ ok: true, accepted: entries.length }));
+            }
+            catch {
+                res.writeHead(400, { 'Content-Type': 'text/plain', 'Access-Control-Allow-Origin': '*' });
+                res.end('Bad Request: invalid JSON');
+            }
+        });
+        req.on('error', () => {
+            res.writeHead(400, { 'Content-Type': 'text/plain', 'Access-Control-Allow-Origin': '*' });
+            res.end('Bad Request');
+        });
+    }
+    // ── WebSocket handler ─────────────────────────────────────────────────────
+    _handleWSConnection(ws, _req) {
+        this._clients.add(ws);
+        // Send initial state
+        try {
+            ws.send(JSON.stringify({ type: 'init', data: this._getState() }));
+        }
+        catch {
+            // Client may have disconnected immediately
+            this._clients.delete(ws);
+            return;
+        }
+        ws.on('message', (raw) => {
+            try {
+                const msg = JSON.parse(typeof raw === 'string' ? raw : raw.toString('utf8'));
+                switch (msg.type) {
+                    case 'console-log': {
+                        if (msg.data && typeof msg.data.level === 'string' && Array.isArray(msg.data.args)) {
+                            const entry = {
+                                level: msg.data.level,
+                                args: msg.data.args,
+                                timestamp: msg.data.timestamp ?? Date.now(),
+                                source: msg.data.source,
+                                url: msg.data.url,
+                                sessionId: msg.data.sessionId,
+                                userId: msg.data.userId,
+                            };
+                            this.pushConsoleLog(entry);
+                        }
+                        break;
+                    }
+                    case 'ping': {
+                        ws.send(JSON.stringify({ type: 'pong' }));
+                        break;
+                    }
+                    default:
+                        // Unknown message type — ignore silently
+                        break;
+                }
+            }
+            catch {
+                // Malformed message — ignore
+            }
+        });
+        ws.on('close', () => {
+            this._clients.delete(ws);
+        });
+        ws.on('error', () => {
+            this._clients.delete(ws);
+        });
+    }
+    // ── Private helpers ───────────────────────────────────────────────────────
+    _broadcast(message) {
+        if (this._clients.size === 0)
+            return;
+        const json = JSON.stringify(message);
+        for (const client of this._clients) {
+            if (client.readyState === 1) {
+                // WebSocket.OPEN
+                try {
+                    client.send(json);
+                }
+                catch {
+                    // Remove broken clients
+                    this._clients.delete(client);
+                }
+            }
+        }
+    }
+    _getState() {
+        return {
+            radar: this._latestRadar,
+            threats: this._latestThreats,
+            metrics: this._latestMetrics,
+            events: this._events.slice(-100),
+            consoleLogs: this._consoleLogs.slice(-100),
+            stats: {
+                startedAt: this._startedAt,
+                uptime: Date.now() - this._startedAt,
+                totalEvents: this._totalEvents,
+                totalConsoleLogs: this._totalConsoleLogs,
+                dashboardClients: this._clients.size,
+            },
+        };
+    }
+    _loadHTML() {
+        try {
+            const htmlPath = join(__dirname, 'dashboard.html');
+            this._htmlContent = readFileSync(htmlPath, 'utf8');
+        }
+        catch {
+            this._htmlContent = null;
+        }
+        try {
+            const explorerPath = join(__dirname, 'explorer.html');
+            this._explorerHtmlContent = readFileSync(explorerPath, 'utf8');
+        }
+        catch {
+            this._explorerHtmlContent = null;
+        }
+    }
+    _serveHTML(res) {
+        const html = this._htmlContent ?? FALLBACK_HTML;
+        res.writeHead(200, {
+            'Content-Type': 'text/html; charset=utf-8',
+            'Cache-Control': 'no-cache',
+            'Access-Control-Allow-Origin': '*',
+        });
+        res.end(html);
+    }
+    _serveExplorerHTML(res) {
+        if (this._explorerHtmlContent) {
+            res.writeHead(200, {
+                'Content-Type': 'text/html; charset=utf-8',
+                'Cache-Control': 'no-cache',
+                'Access-Control-Allow-Origin': '*',
+            });
+            res.end(this._explorerHtmlContent);
+        }
+        else {
+            res.writeHead(200, {
+                'Content-Type': 'text/html; charset=utf-8',
+                'Cache-Control': 'no-cache',
+                'Access-Control-Allow-Origin': '*',
+            });
+            res.end(`<!DOCTYPE html><html><head><title>Beehaven Explorer</title>
+<style>body{font-family:Inter,system-ui;background:#0A0A12;color:#e0e0e0;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}
+.c{text-align:center;max-width:480px;padding:2rem}h1{color:#F5A623}code{background:#1a1a2e;padding:.2em .5em;border-radius:4px;color:#7C3AED}</style>
+</head><body><div class="c"><h1>Beehaven Explorer</h1>
+<p style="color:#888">Explorer HTML not found. Place <code>explorer.html</code> next to the compiled JS.</p>
+</div></body></html>`);
+        }
+    }
+    async _proxyExplorer(req, res, url) {
+        // Strip /api/explorer prefix → forward to Worker's /explorer/* endpoints
+        const path = url.replace('/api/explorer', '/explorer');
+        const target = this._config.explorerTarget + path;
+        const method = req.method ?? 'GET';
+        // Collect request body for POST/PUT
+        let body;
+        if (method === 'POST' || method === 'PUT') {
+            const chunks = [];
+            for await (const chunk of req) {
+                chunks.push(chunk);
+            }
+            body = Buffer.concat(chunks).toString('utf8');
+        }
+        try {
+            const headers = {
+                'Content-Type': 'application/json',
+            };
+            // Inject admin secret for auth
+            if (this._config.explorerSecret) {
+                headers['Authorization'] = `Bearer ${this._config.explorerSecret}`;
+            }
+            const upstream = await fetch(target, {
+                method,
+                headers,
+                body: method !== 'GET' && method !== 'HEAD' ? body : undefined,
+            });
+            const responseBody = await upstream.text();
+            res.writeHead(upstream.status, {
+                'Content-Type': upstream.headers.get('Content-Type') || 'application/json',
+                'Access-Control-Allow-Origin': '*',
+                'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
+                'Access-Control-Allow-Headers': 'Content-Type',
+            });
+            res.end(responseBody);
+        }
+        catch (err) {
+            res.writeHead(502, {
+                'Content-Type': 'application/json',
+                'Access-Control-Allow-Origin': '*',
+            });
+            res.end(JSON.stringify({
+                error: `Cannot reach Explorer API at ${this._config.explorerTarget}: ${err.message}`,
+            }));
+        }
+    }
+    _serveJSON(res, data) {
+        res.writeHead(200, {
+            'Content-Type': 'application/json',
+            'Access-Control-Allow-Origin': '*',
+        });
+        res.end(JSON.stringify(data));
+    }
+    // ── App frontend hosting ──────────────────────────────────────────────
+    //
+    // The daemon calls setAppFrontends after loadInstalledApps resolves,
+    // giving the dashboard the map of app name → absolute frontend dir.
+    // Requests to /apps/<name>/<path> are served as static files from that
+    // directory (mime-typed, path-escaped, scoped so "../" can't escape).
+    /**
+     * Register installed apps with the dashboard so their frontends + assets
+     * are served under /apps/<name>/. We serve from the app ROOT (not just
+     * the frontend dir) so a UI can fetch its own recipe JSONs and assets
+     * via stable /apps/<name>/... paths. The default response for a bare
+     * /apps/<name>/ hits the declared frontend.entry.
+     */
+    setAppFrontends(frontends) {
+        this._appFrontends.clear();
+        for (const f of frontends) {
+            if (!f.manifest?.frontend)
+                continue;
+            const frontendDir = f.manifest.frontend.dir ?? '';
+            const entry = f.manifest.frontend.entry ?? 'index.html';
+            // Resolve the frontend entry to a path relative to the app root.
+            const frontendEntry = frontendDir ? `${frontendDir.replace(/\/$/, '')}/${entry}` : entry;
+            this._appFrontends.set(f.name, { appRoot: f.appRoot, frontendEntry, manifest: f.manifest });
+        }
+    }
+    /**
+     * Register browser-runtime buildings with the dashboard. The daemon's
+     * LocalAppManager calls this after loadInstalledApps finishes, passing
+     * absolute file paths for each `runtime: "browser"` building. The
+     * dashboard then serves each as a JS module at
+     * /apps/<name>/buildings/<key>.js for the user's browser to fetch.
+     */
+    setBrowserBuildings(items) {
+        this._browserBuildings.clear();
+        for (const item of items) {
+            let appMap = this._browserBuildings.get(item.appName);
+            if (!appMap) {
+                appMap = new Map();
+                this._browserBuildings.set(item.appName, appMap);
+            }
+            appMap.set(item.buildingKey, item.absolutePath);
+        }
+    }
+    /**
+     * Serve a browser-runtime building's JS module. Path validated against
+     * registered absolute paths so there's no traversal risk — the URL only
+     * looks up an entry that was explicitly registered by the daemon at
+     * boot, no arbitrary filesystem read possible.
+     */
+    _serveBrowserBuilding(res, appName, buildingKey) {
+        const appMap = this._browserBuildings.get(appName);
+        if (!appMap) {
+            res.writeHead(404, { 'Content-Type': 'text/plain', 'Access-Control-Allow-Origin': '*' });
+            res.end(`App "${appName}" has no browser buildings registered`);
+            return;
+        }
+        const filePath = appMap.get(buildingKey);
+        if (!filePath) {
+            res.writeHead(404, { 'Content-Type': 'text/plain', 'Access-Control-Allow-Origin': '*' });
+            res.end(`Browser building "${buildingKey}" not found in app "${appName}"`);
+            return;
+        }
+        let data;
+        try {
+            data = readFileSync(filePath);
+        }
+        catch {
+            res.writeHead(500, { 'Content-Type': 'text/plain', 'Access-Control-Allow-Origin': '*' });
+            res.end(`Failed to read browser building file`);
+            return;
+        }
+        res.writeHead(200, {
+            'Content-Type': 'text/javascript; charset=utf-8',
+            'Access-Control-Allow-Origin': '*',
+            // Short cache so dev rebuilds picked up quickly.
+            'Cache-Control': 'no-cache',
+        });
+        res.end(data);
+    }
+    /**
+     * Give the dashboard a bridge to the IPC bus. Once set, /apps/ws
+     * WebSocket connections become virtual IPC clients — the browser can
+     * send `app-rpc`, `pipeline`, `subscribe`, `ping` messages just like
+     * a local Unix-socket client and receive broadcasts the same way.
+     *
+     * The /apps/ws WebSocketServer itself is started inside start() so
+     * connections work even if they arrive before the bridge is set.
+     */
+    setAppBridge(bridge) {
+        this._appBridge = bridge;
+    }
+    /**
+     * Register a provider that returns the full marketplace catalog
+     * (installed + available for install). Used by /api/marketplace.
+     * Daemon calls this during startup with a closure over the app
+     * manager + any cloud catalog it can reach.
+     */
+    setMarketplaceCatalogProvider(provider) {
+        this._marketplaceCatalogProvider = provider;
+    }
+    async _serveMarketplace(res) {
+        const payload = this._marketplaceCatalogProvider
+            ? await this._marketplaceCatalogProvider()
+            : { installed: [], available: [] };
+        this._serveJSON(res, payload);
+    }
+    _handleAppWsConnection(ws) {
+        if (!this._appBridge) {
+            ws.close(1011, 'app bridge not configured');
+            return;
+        }
+        const bridge = this._appBridge;
+        // Bind a virtual client whose outgoing messages forward to this ws.
+        const send = (msg) => {
+            if (ws.readyState !== 1)
+                return;
+            try {
+                ws.send(JSON.stringify(msg));
+            }
+            catch { }
+        };
+        // Subscribe broadly by default — browser UIs usually want to see
+        // everything (pipeline:*, broadcast:*, etc.). Clients can tighten this
+        // by sending their own { type: 'subscribe', patterns: [...] } message.
+        const virtId = bridge.createVirtualClient(send, ['*']);
+        ws.on('message', (raw) => {
+            let msg;
+            try {
+                msg = JSON.parse(typeof raw === 'string' ? raw : raw.toString('utf8'));
+            }
+            catch {
+                send({ type: 'error', error: 'invalid JSON' });
+                return;
+            }
+            try {
+                bridge.injectMessage(virtId, msg);
+            }
+            catch (err) {
+                send({ type: 'error', error: err?.message ?? String(err) });
+            }
+        });
+        const close = () => {
+            try {
+                bridge.releaseVirtualClient(virtId);
+            }
+            catch { }
+        };
+        ws.on('close', close);
+        ws.on('error', close);
+    }
+    _serveAppIndex(res) {
+        const list = Array.from(this._appFrontends.entries()).map(([name, h]) => ({
+            name,
+            version: h.manifest.version,
+            title: h.manifest.frontend?.title ?? h.manifest.name,
+            icon: h.manifest.frontend?.icon ?? '',
+            description: h.manifest.description ?? '',
+            url: `/apps/${name}/`,
+        }));
+        const body = `<!doctype html><html><head><meta charset="utf-8"><title>Hives</title>
+<style>body{font-family:-apple-system,system-ui,sans-serif;background:#0a0a0a;color:#eee;padding:40px;max-width:720px;margin:auto}
+a{color:#6af;text-decoration:none}h1{font-weight:300;letter-spacing:0.5px}
+ul{list-style:none;padding:0}li{padding:16px;border:1px solid #222;border-radius:8px;margin:12px 0}
+li .title{font-size:18px;font-weight:500}li .meta{color:#888;font-size:13px}</style>
+</head><body><h1>Installed Hives</h1>${list.length === 0
+            ? '<p style="color:#888">No apps installed. Run <code>beehaven app install &lt;path&gt;</code>.</p>'
+            : `<ul>${list.map((l) => `<li><a href="${l.url}"><div class="title">${l.icon ? l.icon + ' ' : ''}${l.title}</div><div class="meta">${l.name}@${l.version}</div><div>${l.description}</div></a></li>`).join('')}</ul>`}</body></html>`;
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        res.end(body);
+    }
+    _serveAppStatic(res, url) {
+        // /apps/<name>/<...path>   — extract name + relative path
+        const match = url.match(/^\/hives\/([^\/]+)(\/.*)?$/);
+        if (!match) {
+            res.writeHead(404);
+            res.end('Not Found');
+            return;
+        }
+        const [, name, rawPath] = match;
+        const appEntry = this._appFrontends.get(name);
+        if (!appEntry) {
+            res.writeHead(404, { 'Content-Type': 'text/plain' });
+            res.end(`App "${name}" not installed or has no frontend`);
+            return;
+        }
+        // Default to the app's frontend entry file when no sub-path is requested.
+        let relPath = rawPath && rawPath !== '/' ? rawPath : `/${appEntry.frontendEntry}`;
+        relPath = relPath.replace(/[?#].*$/, '');
+        const normalized = relPath
+            .split('/')
+            .filter((p) => p && p !== '.')
+            .join('/');
+        if (normalized.split('/').includes('..')) {
+            res.writeHead(400, { 'Content-Type': 'text/plain' });
+            res.end('Bad Request');
+            return;
+        }
+        const filePath = join(appEntry.appRoot, normalized);
+        // Defense against path escape — readFileSync doesn't enforce this for us.
+        if (!filePath.startsWith(appEntry.appRoot)) {
+            res.writeHead(400, { 'Content-Type': 'text/plain' });
+            res.end('Bad Request');
+            return;
+        }
+        let data;
+        try {
+            data = readFileSync(filePath);
+        }
+        catch {
+            // SPA fallback — unknown path returns the frontend entry so client-side
+            // routers work, but this also means 404s for missing assets look like
+            // HTML. Acceptable trade-off for dev.
+            try {
+                data = readFileSync(join(appEntry.appRoot, appEntry.frontendEntry));
+            }
+            catch {
+                res.writeHead(404, { 'Content-Type': 'text/plain' });
+                res.end('Not Found');
+                return;
+            }
+        }
+        const ext = (normalized.split('.').pop() ?? '').toLowerCase();
+        const type = {
+            html: 'text/html; charset=utf-8',
+            htm: 'text/html; charset=utf-8',
+            js: 'text/javascript; charset=utf-8',
+            mjs: 'text/javascript; charset=utf-8',
+            css: 'text/css; charset=utf-8',
+            json: 'application/json; charset=utf-8',
+            svg: 'image/svg+xml',
+            png: 'image/png',
+            jpg: 'image/jpeg',
+            jpeg: 'image/jpeg',
+            gif: 'image/gif',
+            ico: 'image/x-icon',
+            webp: 'image/webp',
+            woff: 'font/woff',
+            woff2: 'font/woff2',
+        }[ext] ?? 'application/octet-stream';
+        res.writeHead(200, {
+            'Content-Type': type,
+            'Access-Control-Allow-Origin': '*',
+            // Short cache so hot reloads pick up edits.
+            'Cache-Control': 'no-cache',
+        });
+        res.end(data);
+    }
+}