castle-web-cli 0.4.117 → 0.4.118

package/dist/ide.js

@@ -6,56 +6,55 @@
 // Backend pattern ported from castle-cli's `ide` branch: @lydell/node-pty for
 // the PTY, an @xterm/headless screen + @xterm/addon-serialize so a reconnecting
 // client gets a full replay of the current screen + scrollback.
-import * as fs from "fs";
-import * as path from "path";
-import picomatch from "picomatch";
-import { fileURLToPath } from "url";
-import { spawn as spawnPty } from "@lydell/node-pty";
-import headlessPkg from "@xterm/headless";
-import { SerializeAddon } from "@xterm/addon-serialize";
-import { WebSocketServer } from "ws";
-import { IMPORTS_DIR, importStatuses, updateImport } from "./imports.js";
-import { readEditorConfig, resolveFileTypes, } from "./editorConfig.js";
-import { UNSUPPORTED_MEDIA } from "./unsupportedMedia.js";
-import { IMPORT_API_PREFIX, handleImportApi } from "./importBrowse.js";
-import { readRequestBody, sendJson } from "./httpJson.js";
-import { envForUserShell, installCliShims } from "./byo-auth.js";
+import * as fs from 'fs';
+import * as path from 'path';
+import picomatch from 'picomatch';
+import { fileURLToPath } from 'url';
+import { spawn as spawnPty } from '@lydell/node-pty';
+import headlessPkg from '@xterm/headless';
+import { SerializeAddon } from '@xterm/addon-serialize';
+import { WebSocketServer } from 'ws';
+import { IMPORTS_DIR, importStatuses, updateImport } from './imports.js';
+import { readEditorConfig, resolveFileTypes, } from './editorConfig.js';
+import { UNSUPPORTED_MEDIA } from './unsupportedMedia.js';
+import { IMPORT_API_PREFIX, handleImportApi } from './importBrowse.js';
+import { readRequestBody, sendJson } from './httpJson.js';
+import { envForUserShell, installCliShims } from './byo-auth.js';
 const HeadlessTerminal = headlessPkg.Terminal;
 const DIST_DIR = path.dirname(fileURLToPath(import.meta.url));
 // The bundled shell app (vite build output). `/` serves its index.html and
 // `/__castle/ide/<asset>` serves its hashed bundle assets (the vite `base`).
-const SHELL_DIR = path.join(DIST_DIR, "shell");
-const PTY_TERM = "xterm-256color";
+const SHELL_DIR = path.join(DIST_DIR, 'shell');
+const PTY_TERM = 'xterm-256color';
 const INITIAL_COLS = 80;
 const INITIAL_ROWS = 24;
 const SCROLLBACK = 4000;
 const SHELL_MIME = {
-    ".html": "text/html; charset=utf-8",
-    ".js": "text/javascript; charset=utf-8",
-    ".mjs": "text/javascript; charset=utf-8",
-    ".css": "text/css; charset=utf-8",
-    ".json": "application/json; charset=utf-8",
-    ".svg": "image/svg+xml",
-    ".png": "image/png",
-    ".ico": "image/x-icon",
-    ".jpg": "image/jpeg",
-    ".woff": "font/woff",
-    ".woff2": "font/woff2",
-    ".ttf": "font/ttf",
-    ".map": "application/json; charset=utf-8",
+    '.html': 'text/html; charset=utf-8',
+    '.js': 'text/javascript; charset=utf-8',
+    '.mjs': 'text/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.ico': 'image/x-icon',
+    '.jpg': 'image/jpeg',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+    '.ttf': 'font/ttf',
+    '.map': 'application/json; charset=utf-8',
 };
 // Does the deck serve this root-level file itself? Vite serves both the deck
 // root and its `public/` dir at `/`, so either location counts.
 function deckHasFile(deckDir, name) {
-    return (fs.existsSync(path.join(deckDir, name)) ||
-        fs.existsSync(path.join(deckDir, "public", name)));
+    return (fs.existsSync(path.join(deckDir, name)) || fs.existsSync(path.join(deckDir, 'public', name)));
 }
 // Serve a file from the bundled shell dir, guarding against path traversal.
 function serveShellFile(res, asset) {
-    const rel = path.normalize(asset).replace(/^(\.\.[/\\])+/, "");
+    const rel = path.normalize(asset).replace(/^(\.\.[/\\])+/, '');
     const filePath = path.join(SHELL_DIR, rel);
     if (!filePath.startsWith(SHELL_DIR + path.sep) &&
-        filePath !== path.join(SHELL_DIR, "index.html")) {
+        filePath !== path.join(SHELL_DIR, 'index.html')) {
         res.writeHead(404).end();
         return true;
     }
@@ -64,8 +63,8 @@ function serveShellFile(res, asset) {
         return true;
     }
     res.writeHead(200, {
-        "content-type": SHELL_MIME[path.extname(filePath)] ?? "application/octet-stream",
-        "cache-control": "no-store",
+        'content-type': SHELL_MIME[path.extname(filePath)] ?? 'application/octet-stream',
+        'cache-control': 'no-store',
     });
     fs.createReadStream(filePath).pipe(res);
     return true;
@@ -74,34 +73,30 @@ function serveShellFile(res, asset) {
 // into the iframe at `/index.html`); `/__castle/ide/<asset>` are the shell's
 // static assets; `/__castle/pty` is the PTY WebSocket (handled via a direct
 // upgrade handler on Vite's HTTP server).
-export const IDE_ASSET_PREFIX = "/__castle/ide/";
-export const PTY_WS_PATH = "/__castle/pty";
+export const IDE_ASSET_PREFIX = '/__castle/ide/';
+export const PTY_WS_PATH = '/__castle/pty';
 // Castle's favicon (the same files castle.xyz serves), shipped in the shell
 // bundle and also served from the origin root so every page under the serve
 // gets it -- the shell at `/`, the deck page at `/index.html`, and the
 // browser's implicit `/favicon.ico` probe. The deck wins if it ships its own.
-export const FAVICON_FILES = [
-    "favicon.ico",
-    "favicon-16x16.png",
-    "favicon-32x32.png",
-];
+export const FAVICON_FILES = ['favicon.ico', 'favicon-16x16.png', 'favicon-32x32.png'];
 // `<link rel="icon">` tags for the root-served favicons, injected into the deck
 // page (see serve.ts). The shell's own tags live in `src/shell/index.html`.
 export const FAVICON_LINK_TAGS = [
     '<link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />',
     '<link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />',
     '<link rel="icon" href="/favicon.ico" sizes="any" />',
-].join("\n    ");
+].join('\n    ');
 // Builtin Files + code-editor panels talk to the deck through these endpoints
 // (the shell no longer routes file browsing / code editing through the kit
 // iframe). `list`/`read`/`write` operate on files within the deck dir;
 // `info` reports which extensions the kit owns a rich editor for (so the shell
 // hands those files to the kit iframe and keeps the builtin editor as the
 // default for everything else).
-export const FILES_API_PREFIX = "/__castle/files/";
+export const FILES_API_PREFIX = '/__castle/files/';
 // Directories never surfaced in the file list / never read or written through
 // the builtin editor: VCS, deck-private state, and dependency trees.
-const FILES_IGNORE_DIRS = new Set([".git", ".castle", "node_modules", "dist"]);
+const FILES_IGNORE_DIRS = new Set(['.git', '.castle', 'node_modules', 'dist']);
 // Ceiling on one uploaded file. A deck is saved whole (source tar + bundle), so
 // a huge asset is a problem for the deck long before it is a problem here --
 // refuse it at the door with a message rather than let it land and break `save`.
@@ -111,24 +106,24 @@ const MAX_UPLOAD_BYTES = 32 * 1024 * 1024;
 // which is text-only). Anything unlisted is served as opaque bytes -- a viewer
 // that asked for it knows what it is.
 const RAW_MIME = {
-    ".png": "image/png",
-    ".jpg": "image/jpeg",
-    ".jpeg": "image/jpeg",
-    ".gif": "image/gif",
-    ".webp": "image/webp",
-    ".avif": "image/avif",
-    ".bmp": "image/bmp",
-    ".svg": "image/svg+xml",
-    ".mp3": "audio/mpeg",
-    ".wav": "audio/wav",
-    ".ogg": "audio/ogg",
-    ".m4a": "audio/mp4",
-    ".aac": "audio/aac",
-    ".flac": "audio/flac",
-    ".webm": "video/webm",
-    ".mp4": "video/mp4",
-    ".m4v": "video/x-m4v",
-    ".mov": "video/quicktime",
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.webp': 'image/webp',
+    '.avif': 'image/avif',
+    '.bmp': 'image/bmp',
+    '.svg': 'image/svg+xml',
+    '.mp3': 'audio/mpeg',
+    '.wav': 'audio/wav',
+    '.ogg': 'audio/ogg',
+    '.m4a': 'audio/mp4',
+    '.aac': 'audio/aac',
+    '.flac': 'audio/flac',
+    '.webm': 'video/webm',
+    '.mp4': 'video/mp4',
+    '.m4v': 'video/x-m4v',
+    '.mov': 'video/quicktime',
 };
 // Files under `imports/` came from another deck. They are readable like any
 // other deck file -- the engine, editors and pickers all reference them -- but a
@@ -144,12 +139,12 @@ function isImportPath(rel) {
 // that are about to CHANGE the file pass `mutation`, which additionally refuses
 // anything a dependency owns.
 function resolveDeckPath(deckDir, requestedPath, opts = {}) {
-    if (typeof requestedPath !== "string" || requestedPath.trim() === "") {
-        return { ok: false, error: "Missing file path." };
+    if (typeof requestedPath !== 'string' || requestedPath.trim() === '') {
+        return { ok: false, error: 'Missing file path.' };
     }
-    const normalized = path.normalize(requestedPath.replace(/\\/g, "/"));
-    if (normalized === "." ||
-        normalized === ".." ||
+    const normalized = path.normalize(requestedPath.replace(/\\/g, '/'));
+    if (normalized === '.' ||
+        normalized === '..' ||
         path.isAbsolute(normalized) ||
         normalized.startsWith(`..${path.sep}`)) {
         return { ok: false, error: `Path outside the deck: ${requestedPath}` };
@@ -160,10 +155,10 @@ function resolveDeckPath(deckDir, requestedPath, opts = {}) {
     }
     const abs = path.resolve(deckDir, normalized);
     const rel = path.relative(deckDir, abs);
-    if (rel.startsWith("..") || path.isAbsolute(rel)) {
+    if (rel.startsWith('..') || path.isAbsolute(rel)) {
         return { ok: false, error: `Path outside the deck: ${requestedPath}` };
     }
-    const relPosix = rel.split(path.sep).join("/");
+    const relPosix = rel.split(path.sep).join('/');
     if (opts.mutation && isImportPath(relPosix)) {
         return {
             ok: false,
@@ -185,7 +180,7 @@ function listDeckFiles(deckDir) {
             return;
         }
         for (const entry of entries) {
-            if (entry.name === ".DS_Store")
+            if (entry.name === '.DS_Store')
                 continue;
             const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
             if (entry.isDirectory()) {
@@ -198,7 +193,7 @@ function listDeckFiles(deckDir) {
             }
         }
     }
-    walk(deckDir, "");
+    walk(deckDir, '');
     out.sort((a, b) => a.localeCompare(b));
     return out;
 }
@@ -208,7 +203,7 @@ function listDeckFiles(deckDir) {
 // editors, and the builtin code editor renders everything.
 function kitEditorExtensions(config, fileTypes) {
     if (fileTypes) {
-        return fileTypes.filter((t) => t.editor === "kit").map((t) => t.ext);
+        return fileTypes.filter((t) => t.editor === 'kit').map((t) => t.ext);
     }
     // A deck saved before file types existed named its kit extensions directly.
     return config.extensions ?? [];
@@ -235,14 +230,14 @@ function filterDeckFiles(files, config) {
 function filterImportedFiles(deckDir, imported) {
     const byAlias = new Map();
     for (const file of imported) {
-        const [, alias, ...rest] = file.split("/");
+        const [, alias, ...rest] = file.split('/');
         if (!alias || rest.length === 0)
             continue;
         const list = byAlias.get(alias);
         if (list)
-            list.push(rest.join("/"));
+            list.push(rest.join('/'));
         else
-            byAlias.set(alias, [rest.join("/")]);
+            byAlias.set(alias, [rest.join('/')]);
     }
     const out = [];
     for (const [alias, relFiles] of byAlias) {
@@ -261,7 +256,7 @@ function readRequestBuffer(req, limit) {
         const chunks = [];
         let size = 0;
         let over = false;
-        req.on("data", (c) => {
+        req.on('data', (c) => {
             size += c.length;
             // Past the cap, keep draining but stop KEEPING the bytes. Destroying the
             // request here would reset the connection and the client would see a
@@ -273,8 +268,8 @@ function readRequestBuffer(req, limit) {
             }
             chunks.push(c);
         });
-        req.on("end", () => over ? reject(new RangeError("too large")) : resolve(Buffer.concat(chunks)));
-        req.on("error", reject);
+        req.on('end', () => over ? reject(new RangeError('too large')) : resolve(Buffer.concat(chunks)));
+        req.on('error', reject);
     });
 }
 function withJsonBody(req, res, handler) {
@@ -284,7 +279,7 @@ function withJsonBody(req, res, handler) {
             body = JSON.parse(await readRequestBody(req));
         }
         catch {
-            return sendJson(res, 400, { error: "Invalid JSON body." });
+            return sendJson(res, 400, { error: 'Invalid JSON body.' });
         }
         handler(body);
     })();
@@ -305,16 +300,16 @@ function sendFailure(res, action, rel, err) {
 }
 function handleFilesWrite(deckDir, req, res) {
     withMutationPath(deckDir, req, res, (target, body) => {
-        if (typeof body.contents !== "string") {
-            return sendJson(res, 400, { error: "File contents must be a string." });
+        if (typeof body.contents !== 'string') {
+            return sendJson(res, 400, { error: 'File contents must be a string.' });
         }
         try {
             fs.mkdirSync(path.dirname(target.abs), { recursive: true });
-            fs.writeFileSync(target.abs, body.contents, "utf8");
+            fs.writeFileSync(target.abs, body.contents, 'utf8');
             sendJson(res, 200, { ok: true, path: target.rel });
         }
         catch (err) {
-            sendFailure(res, "write", target.rel, err);
+            sendFailure(res, 'write', target.rel, err);
         }
     });
 }
@@ -329,16 +324,16 @@ function ensureVisiblePath(deckDir, rel) {
 // No-op if an existing glob already covers `probe`, a path the new glob would
 // match. Returns whether it wrote.
 function ensureVisibleGlob(deckDir, glob, probe) {
-    const file = path.join(deckDir, "castle.json");
+    const file = path.join(deckDir, 'castle.json');
     let data;
     try {
-        data = JSON.parse(fs.readFileSync(file, "utf8"));
+        data = JSON.parse(fs.readFileSync(file, 'utf8'));
     }
     catch {
         return false; // no castle.json yet (deck never saved) -> treat as not curated
     }
     const visible = data.editor && Array.isArray(data.editor.visiblePaths)
-        ? data.editor.visiblePaths.filter((v) => typeof v === "string")
+        ? data.editor.visiblePaths.filter((v) => typeof v === 'string')
         : null;
     if (!visible || visible.length === 0)
         return false; // not curated -> all visible
@@ -349,7 +344,7 @@ function ensureVisibleGlob(deckDir, glob, probe) {
     visible.push(glob);
     data.editor.visiblePaths = visible;
     try {
-        fs.writeFileSync(file, `${JSON.stringify(data, null, 2)}\n`, "utf8");
+        fs.writeFileSync(file, `${JSON.stringify(data, null, 2)}\n`, 'utf8');
         return true;
     }
     catch {
@@ -362,7 +357,7 @@ function handleFilesMkdir(deckDir, req, res) {
             fs.mkdirSync(target.abs, { recursive: true });
         }
         catch (err) {
-            return sendFailure(res, "create folder", target.rel, err);
+            return sendFailure(res, 'create folder', target.rel, err);
         }
         const visiblePathAdded = ensureVisiblePath(deckDir, target.rel);
         sendJson(res, 200, { ok: true, path: target.rel, visiblePathAdded });
@@ -378,8 +373,8 @@ function handleFilesMkdir(deckDir, req, res) {
 // the same way mkdir does -- otherwise an upload lands on disk and is invisible
 // in the very panel that put it there.
 function handleFilesUpload(deckDir, req, res) {
-    const url = new URL(req.url ?? "/", "http://localhost");
-    const target = resolveDeckPath(deckDir, url.searchParams.get("path"), {
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    const target = resolveDeckPath(deckDir, url.searchParams.get('path'), {
         mutation: true,
     });
     if (!target.ok)
@@ -402,24 +397,24 @@ function handleFilesUpload(deckDir, req, res) {
             fs.writeFileSync(target.abs, bytes);
         }
         catch (err) {
-            return sendFailure(res, "upload", target.rel, err);
+            return sendFailure(res, 'upload', target.rel, err);
         }
         const dir = path.posix.dirname(target.rel);
-        const visiblePathAdded = dir === "."
+        const visiblePathAdded = dir === '.'
             ? ensureVisibleGlob(deckDir, target.rel, target.rel)
             : ensureVisiblePath(deckDir, dir);
         sendJson(res, 200, { ok: true, path: target.rel, visiblePathAdded });
     }, (err) => {
         if (err instanceof RangeError)
             return tooBig();
-        sendFailure(res, "upload", target.rel, err);
+        sendFailure(res, 'upload', target.rel, err);
     });
 }
 // Serve a deck file as bytes. `read` returns UTF-8 text in JSON, which mangles
 // anything binary; the shell's image/audio viewers read through this instead.
 function handleFilesRaw(deckDir, req, res) {
-    const url = new URL(req.url ?? "/", "http://localhost");
-    const resolved = resolveDeckPath(deckDir, url.searchParams.get("path"));
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    const resolved = resolveDeckPath(deckDir, url.searchParams.get('path'));
     if (!resolved.ok)
         return sendJson(res, 400, { error: resolved.error });
     let stat;
@@ -433,44 +428,43 @@ function handleFilesRaw(deckDir, req, res) {
         return sendJson(res, 404, { error: `Not a file: ${resolved.rel}` });
     }
     const headers = {
-        "content-type": RAW_MIME[path.extname(resolved.abs).toLowerCase()] ??
-            "application/octet-stream",
-        "cache-control": "no-store",
+        'content-type': RAW_MIME[path.extname(resolved.abs).toLowerCase()] ?? 'application/octet-stream',
+        'cache-control': 'no-store',
         // Seeking an <audio>/<video> is a range request; without this the browser
         // won't scrub (it re-requests from 0 and the playhead snaps back).
-        "accept-ranges": "bytes",
+        'accept-ranges': 'bytes',
     };
     const range = parseByteRange(req.headers.range, stat.size);
-    if (range === "unsatisfiable") {
-        res.writeHead(416, { "content-range": `bytes */${stat.size}` }).end();
+    if (range === 'unsatisfiable') {
+        res.writeHead(416, { 'content-range': `bytes */${stat.size}` }).end();
         return;
     }
     if (!range) {
-        res.writeHead(200, { ...headers, "content-length": String(stat.size) });
+        res.writeHead(200, { ...headers, 'content-length': String(stat.size) });
         fs.createReadStream(resolved.abs).pipe(res);
         return;
     }
     res.writeHead(206, {
         ...headers,
-        "content-length": String(range.end - range.start + 1),
-        "content-range": `bytes ${range.start}-${range.end}/${stat.size}`,
+        'content-length': String(range.end - range.start + 1),
+        'content-range': `bytes ${range.start}-${range.end}/${stat.size}`,
     });
     fs.createReadStream(resolved.abs, { start: range.start, end: range.end }).pipe(res);
 }
 // A single `Range: bytes=<start>-<end>` (the only form a media element sends).
 // null = serve the whole file; 'unsatisfiable' = a range past the end.
 function parseByteRange(header, size) {
-    const match = /^bytes=(\d*)-(\d*)$/.exec((header ?? "").trim());
+    const match = /^bytes=(\d*)-(\d*)$/.exec((header ?? '').trim());
     if (!match || size === 0)
         return null;
     const [, rawStart, rawEnd] = match;
-    if (rawStart === "" && rawEnd === "")
+    if (rawStart === '' && rawEnd === '')
         return null;
     // `bytes=-N`: the last N bytes.
-    const start = rawStart === "" ? Math.max(0, size - Number(rawEnd)) : Number(rawStart);
-    const end = rawStart === "" || rawEnd === "" ? size - 1 : Math.min(Number(rawEnd), size - 1);
+    const start = rawStart === '' ? Math.max(0, size - Number(rawEnd)) : Number(rawStart);
+    const end = rawStart === '' || rawEnd === '' ? size - 1 : Math.min(Number(rawEnd), size - 1);
     if (!Number.isFinite(start) || start > end || start >= size)
-        return "unsatisfiable";
+        return 'unsatisfiable';
     return { start, end };
 }
 // A NUL byte near the start is the practical test for "not text": no text file
@@ -500,7 +494,7 @@ function handleFilesCopy(deckDir, req, res) {
             sendJson(res, 200, { ok: true, path: to.rel });
         }
         catch (err) {
-            sendFailure(res, "copy", from.rel, err);
+            sendFailure(res, 'copy', from.rel, err);
         }
     });
 }
@@ -531,9 +525,7 @@ function handleFilesRename(deckDir, req, res) {
         // filesystem (default on macOS/Windows) `to` can "exist" only because it is
         // `from` under a different case -- a case-only rename like bounce.jsx ->
         // Bounce.jsx. Allow that by treating same-inode as not-a-collision.
-        if (from.abs !== to.abs &&
-            fs.existsSync(to.abs) &&
-            !isSameFile(from.abs, to.abs)) {
+        if (from.abs !== to.abs && fs.existsSync(to.abs) && !isSameFile(from.abs, to.abs)) {
             return sendJson(res, 409, { error: `Already exists: ${to.rel}` });
         }
         try {
@@ -542,7 +534,7 @@ function handleFilesRename(deckDir, req, res) {
             sendJson(res, 200, { ok: true, path: to.rel });
         }
         catch (err) {
-            sendFailure(res, "rename", from.rel, err);
+            sendFailure(res, 'rename', from.rel, err);
         }
     });
 }
@@ -556,7 +548,7 @@ function handleFilesDelete(deckDir, req, res) {
             sendJson(res, 200, { ok: true, path: target.rel });
         }
         catch (err) {
-            sendFailure(res, "delete", target.rel, err);
+            sendFailure(res, 'delete', target.rel, err);
         }
     });
 }
@@ -565,7 +557,7 @@ function handleFilesDelete(deckDir, req, res) {
 // rejects traversal and protected dirs.
 function handleFilesApi(deckDir, req, res, reqPath) {
     const action = reqPath.slice(FILES_API_PREFIX.length);
-    if (action === "info") {
+    if (action === 'info') {
         const config = readEditorConfig(deckDir);
         // File types come from the deck AND its imports (a kit is an imported deck,
         // so importing one is what gives a deck scenes and drawings); everything
@@ -587,7 +579,7 @@ function handleFilesApi(deckDir, req, res, reqPath) {
         });
         return true;
     }
-    if (action === "imports") {
+    if (action === 'imports') {
         // Reports only: whether each import is behind the version its deck has now.
         // Taking the update is a deliberate act (`castle-web update-import`), never
         // something that happens to a deck while it is open.
@@ -596,7 +588,7 @@ function handleFilesApi(deckDir, req, res, reqPath) {
             .catch(() => sendJson(res, 200, { imports: [] }));
         return true;
     }
-    if (action === "update-import") {
+    if (action === 'update-import') {
         // Takes the update for one import. Deliberate by construction: the editor
         // asks first, and this is the only path from the panel that changes what a
         // dependency contains.
@@ -606,10 +598,10 @@ function handleFilesApi(deckDir, req, res, reqPath) {
                 body = JSON.parse(await readRequestBody(req));
             }
             catch {
-                return sendJson(res, 400, { error: "Invalid JSON body." });
+                return sendJson(res, 400, { error: 'Invalid JSON body.' });
             }
-            if (typeof body.alias !== "string" || !body.alias) {
-                return sendJson(res, 400, { error: "Missing import name." });
+            if (typeof body.alias !== 'string' || !body.alias) {
+                return sendJson(res, 400, { error: 'Missing import name.' });
             }
             try {
                 await updateImport(deckDir, { alias: body.alias });
@@ -621,14 +613,14 @@ function handleFilesApi(deckDir, req, res, reqPath) {
         })();
         return true;
     }
-    if (action === "list") {
+    if (action === 'list') {
         // `?all=1` returns the unfiltered listing (the "show hidden files & folders"
         // toggle) -- still minus the always-ignored dirs (node_modules/.castle/...),
         // just without the deck's visible/hidden path curation.
-        const url = new URL(req.url ?? "/", "http://localhost");
+        const url = new URL(req.url ?? '/', 'http://localhost');
         const listed = listDeckFiles(deckDir);
         let files = listed;
-        if (url.searchParams.get("all") !== "1") {
+        if (url.searchParams.get('all') !== '1') {
             // Each deck curates its own files. The importing deck's visible/hidden
             // paths name its own dirs (a kit's name scenes/, drawings/ ...), so
             // applying them to imports would hide every import by omission -- an
@@ -643,9 +635,9 @@ function handleFilesApi(deckDir, req, res, reqPath) {
         sendJson(res, 200, { files });
         return true;
     }
-    if (action === "read") {
-        const url = new URL(req.url ?? "/", "http://localhost");
-        const resolved = resolveDeckPath(deckDir, url.searchParams.get("path"));
+    if (action === 'read') {
+        const url = new URL(req.url ?? '/', 'http://localhost');
+        const resolved = resolveDeckPath(deckDir, url.searchParams.get('path'));
         if (!resolved.ok)
             return (sendJson(res, 400, { error: resolved.error }), true);
         try {
@@ -656,13 +648,13 @@ function handleFilesApi(deckDir, req, res, reqPath) {
             if (isBinary(bytes)) {
                 sendJson(res, 200, {
                     path: resolved.rel,
-                    contents: "",
+                    contents: '',
                     binary: true,
                     size: bytes.length,
                 });
             }
             else {
-                sendJson(res, 200, { path: resolved.rel, contents: bytes.toString("utf8") });
+                sendJson(res, 200, { path: resolved.rel, contents: bytes.toString('utf8') });
             }
         }
         catch {
@@ -670,51 +662,45 @@ function handleFilesApi(deckDir, req, res, reqPath) {
         }
         return true;
     }
-    if (action === "copy") {
+    if (action === 'copy') {
         handleFilesCopy(deckDir, req, res);
         return true;
     }
-    if (action === "write") {
+    if (action === 'write') {
         handleFilesWrite(deckDir, req, res);
         return true;
     }
-    if (action === "rename") {
+    if (action === 'rename') {
         handleFilesRename(deckDir, req, res);
         return true;
     }
-    if (action === "delete") {
+    if (action === 'delete') {
         handleFilesDelete(deckDir, req, res);
         return true;
     }
-    if (action === "mkdir") {
+    if (action === 'mkdir') {
         handleFilesMkdir(deckDir, req, res);
         return true;
     }
-    if (action === "upload") {
+    if (action === 'upload') {
         handleFilesUpload(deckDir, req, res);
         return true;
     }
-    if (action === "raw") {
+    if (action === 'raw') {
         handleFilesRaw(deckDir, req, res);
         return true;
     }
-    return (sendJson(res, 404, { error: `Unknown files action: ${action}` }),
-        true);
+    return (sendJson(res, 404, { error: `Unknown files action: ${action}` }), true);
 }
 function defaultShell() {
-    if (process.platform === "win32") {
-        return { command: process.env.COMSPEC ?? "cmd.exe", args: [] };
+    if (process.platform === 'win32') {
+        return { command: process.env.COMSPEC ?? 'cmd.exe', args: [] };
     }
     // Pick the first shell that actually exists: $SHELL (dev), then zsh (macOS),
     // then bash / sh. The cloud sandbox image is Debian-based (node:22) with no
     // zsh and no $SHELL set, so a bare `/bin/zsh` fallback fails with execvp
     // ENOENT and the terminal never gets a shell.
-    const candidates = [
-        process.env.SHELL,
-        "/bin/zsh",
-        "/bin/bash",
-        "/bin/sh",
-    ].filter((c) => Boolean(c));
+    const candidates = [process.env.SHELL, '/bin/zsh', '/bin/bash', '/bin/sh'].filter((c) => Boolean(c));
     const command = candidates.find((c) => {
         try {
             return fs.existsSync(c);
@@ -722,18 +708,18 @@ function defaultShell() {
         catch {
             return false;
         }
-    }) ?? "/bin/sh";
-    return { command, args: ["-l"] };
+    }) ?? '/bin/sh';
+    return { command, args: ['-l'] };
 }
 function ptyEnv(shimDir) {
     const env = {
         ...envForUserShell(process.env),
         TERM: PTY_TERM,
-        COLORTERM: "truecolor",
-        CLICOLOR: "1",
-        CLICOLOR_FORCE: "1",
-        FORCE_COLOR: process.env.FORCE_COLOR === "0" ? "3" : (process.env.FORCE_COLOR ?? "3"),
-        TERM_PROGRAM: "castle-web-ide",
+        COLORTERM: 'truecolor',
+        CLICOLOR: '1',
+        CLICOLOR_FORCE: '1',
+        FORCE_COLOR: process.env.FORCE_COLOR === '0' ? '3' : (process.env.FORCE_COLOR ?? '3'),
+        TERM_PROGRAM: 'castle-web-ide',
     };
     delete env.NO_COLOR;
     delete env.NODE_DISABLE_COLORS;
@@ -750,10 +736,10 @@ function clampSize(value, fallback) {
 }
 export function rawDataToString(data) {
     if (Array.isArray(data))
-        return Buffer.concat(data).toString("utf8");
+        return Buffer.concat(data).toString('utf8');
     if (Buffer.isBuffer(data))
-        return data.toString("utf8");
-    return Buffer.from(new Uint8Array(data)).toString("utf8");
+        return data.toString('utf8');
+    return Buffer.from(new Uint8Array(data)).toString('utf8');
 }
 function send(socket, body) {
     if (socket.readyState === socket.OPEN)
@@ -765,7 +751,7 @@ function queueScreenOp(session, op) {
     session.renderQueue = session.renderQueue
         .catch(() => undefined)
         .then(op)
-        .catch((err) => console.error("[ide] screen render failed", err));
+        .catch((err) => console.error('[ide] screen render failed', err));
 }
 async function waitForStableScreen(session) {
     while (true) {
@@ -815,16 +801,16 @@ export function createIdeServer(opts) {
         };
         pty.onData((data) => {
             queueScreenOp(s, () => new Promise((done) => s.screen.write(data, done)));
-            broadcast(s, { type: "output", data });
+            broadcast(s, { type: 'output', data });
         });
         pty.onExit(({ exitCode, signal }) => {
             s.exited = { exitCode, signal };
-            broadcast(s, { type: "exit", exitCode, signal });
+            broadcast(s, { type: 'exit', exitCode, signal });
             // Clients get the `exit` message above (which disables their reconnect),
             // then we close the sockets so they don't sit half-open.
             for (const socket of s.clients) {
                 try {
-                    socket.close(1000, "shell exited");
+                    socket.close(1000, 'shell exited');
                 }
                 catch {
                     /* ignore */
@@ -863,12 +849,12 @@ export function createIdeServer(opts) {
                 if (socket.readyState !== socket.OPEN)
                     return;
                 send(socket, {
-                    type: "replay",
+                    type: 'replay',
                     data: s.serializeAddon.serialize({ scrollback: SCROLLBACK }),
                 });
                 if (s.exited) {
                     send(socket, {
-                        type: "exit",
+                        type: 'exit',
                         exitCode: s.exited.exitCode,
                         signal: s.exited.signal,
                     });
@@ -876,8 +862,8 @@ export function createIdeServer(opts) {
             }
             catch (err) {
                 send(socket, {
-                    type: "error",
-                    error: err instanceof Error ? err.message : "could not restore screen",
+                    type: 'error',
+                    error: err instanceof Error ? err.message : 'could not restore screen',
                 });
             }
             finally {
@@ -885,7 +871,7 @@ export function createIdeServer(opts) {
                     s.clients.add(socket);
             }
         })();
-        socket.on("message", (raw) => {
+        socket.on('message', (raw) => {
             let msg;
             try {
                 msg = JSON.parse(rawDataToString(raw));
@@ -893,21 +879,21 @@ export function createIdeServer(opts) {
             catch {
                 return;
             }
-            if (msg.type === "input" && typeof msg.data === "string") {
+            if (msg.type === 'input' && typeof msg.data === 'string') {
                 if (!s.exited)
                     s.pty.write(msg.data);
             }
-            else if (msg.type === "resize") {
+            else if (msg.type === 'resize') {
                 resizeSession(s, Number(msg.cols), Number(msg.rows));
             }
         });
-        socket.on("close", () => {
+        socket.on('close', () => {
             s.clients.delete(socket);
         });
     }
     const wss = new WebSocketServer({ noServer: true });
     function handleUpgrade(req, socket, head) {
-        const url = new URL(req.url ?? "/", "http://localhost");
+        const url = new URL(req.url ?? '/', 'http://localhost');
         if (url.pathname !== PTY_WS_PATH)
             return false;
         wss.handleUpgrade(req, socket, head, (ws) => attachClient(ws));
@@ -915,8 +901,8 @@ export function createIdeServer(opts) {
     }
     function handleHttpRequest(req, res, reqPath) {
         // `/` -> the shell's index.html; `/__castle/ide/<asset>` -> bundle assets.
-        if (reqPath === "/")
-            return serveShellFile(res, "index.html");
+        if (reqPath === '/')
+            return serveShellFile(res, 'index.html');
         // Root-served favicons, unless the deck ships its own (then fall through
         // to Vite, which serves the deck's file).
         const favicon = FAVICON_FILES.find((name) => reqPath === `/${name}`);
@@ -924,13 +910,13 @@ export function createIdeServer(opts) {
             return serveShellFile(res, favicon);
         }
         if (reqPath.startsWith(IDE_ASSET_PREFIX)) {
-            return serveShellFile(res, reqPath.slice(IDE_ASSET_PREFIX.length) || "index.html");
+            return serveShellFile(res, reqPath.slice(IDE_ASSET_PREFIX.length) || 'index.html');
         }
         if (reqPath.startsWith(FILES_API_PREFIX)) {
             return handleFilesApi(deckDir, req, res, reqPath);
         }
         if (reqPath.startsWith(IMPORT_API_PREFIX)) {
-            return handleImportApi(deckDir, req, res, reqPath);
+            return handleImportApi(deckDir, req, res, reqPath, opts.restart);
         }
         return false;
     }
@@ -944,7 +930,7 @@ export function createIdeServer(opts) {
             }
             for (const socket of session.clients) {
                 try {
-                    socket.close(1001, "serve shutting down");
+                    socket.close(1001, 'serve shutting down');
                 }
                 catch {
                     /* ignore */