conductor-oss 0.3.4 → 0.4.0

package/web/.next/standalone/packages/web/.next/static/chunks/{turbopack-57373a2ee9f56180.js → turbopack-49f4119854e8206e.js}

@@ -1,4 +1,4 @@
-(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,{otherChunks:["static/chunks/ba2aa8b54e912820.js","static/chunks/12d9b4273416fe9b.js","static/chunks/45bd2451c2b0790c.js","static/chunks/06bdd070b8d25946.js","static/chunks/72c822cfe5b6f4f2.js"],runtimeModuleIds:[94553]}]),(()=>{let e;if(!Array.isArray(globalThis.TURBOPACK))return;let t="/_next/",r=(self.TURBOPACK_CHUNK_SUFFIX??document?.currentScript?.getAttribute?.("src")?.replace(/^(.*(?=\?)|^.*$)/,""))||"",n=new WeakMap;function o(e,t){this.m=e,this.e=t}let l=o.prototype,i=Object.prototype.hasOwnProperty,s="u">typeof Symbol&&Symbol.toStringTag;function u(e,t,r){i.call(e,t)||Object.defineProperty(e,t,r)}function c(e,t){let r=e[t];return r||(r=a(t),e[t]=r),r}function a(e){return{exports:{},error:void 0,id:e,namespaceObject:void 0}}function f(e,t){u(e,"__esModule",{value:!0}),s&&u(e,s,{value:"Module"});let r=0;for(;r<t.length;){let n=t[r++],o=t[r++];if("number"==typeof o)if(0===o)u(e,n,{value:t[r++],enumerable:!0,writable:!1});else throw Error(`unexpected tag: ${o}`);else"function"==typeof t[r]?u(e,n,{get:o,set:t[r++],enumerable:!0}):u(e,n,{get:o,enumerable:!0})}Object.seal(e)}l.s=function(e,t){let r,n;null!=t?n=(r=c(this.c,t)).exports:(r=this.m,n=this.e),r.namespaceObject=n,f(n,e)},l.j=function(e,t){var r,o;let l,s,u;null!=t?s=(l=c(this.c,t)).exports:(l=this.m,s=this.e);let a=(r=l,o=s,(u=n.get(r))||(n.set(r,u=[]),r.exports=r.namespaceObject=new Proxy(o,{get(e,t){if(i.call(e,t)||"default"===t||"__esModule"===t)return Reflect.get(e,t);for(let e of u){let r=Reflect.get(e,t);if(void 0!==r)return r}},ownKeys(e){let t=Reflect.ownKeys(e);for(let e of u)for(let r of Reflect.ownKeys(e))"default"===r||t.includes(r)||t.push(r);return t}})),u);"object"==typeof e&&null!==e&&a.push(e)},l.v=function(e,t){(null!=t?c(this.c,t):this.m).exports=e},l.n=function(e,t){let r;(r=null!=t?c(this.c,t):this.m).exports=r.namespaceObject=e};let p=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,h=[null,p({}),p([]),p(p)];function d(e,t,r){let n=[],o=-1;for(let t=e;("object"==typeof t||"function"==typeof t)&&!h.includes(t);t=p(t))for(let r of Object.getOwnPropertyNames(t))n.push(r,function(e,t){return()=>e[t]}(e,r)),-1===o&&"default"===r&&(o=n.length-1);return r&&o>=0||(o>=0?n.splice(o,1,0,e):n.push("default",0,e)),f(t,n),t}function m(e){let t=B(e,this.m);if(t.namespaceObject)return t.namespaceObject;let r=t.exports;return t.namespaceObject=d(r,"function"==typeof r?function(...e){return r.apply(this,e)}:Object.create(null),r&&r.__esModule)}function b(e){let t=e.indexOf("#");-1!==t&&(e=e.substring(0,t));let r=e.indexOf("?");return -1!==r&&(e=e.substring(0,r)),e}function y(){let e,t;return{promise:new Promise((r,n)=>{t=n,e=r}),resolve:e,reject:t}}l.i=m,l.A=function(e){return this.r(e)(m.bind(this))},l.t="function"==typeof require?require:function(){throw Error("Unexpected use of runtime require")},l.r=function(e){return B(e,this.m).exports},l.f=function(e){function t(t){if(t=b(t),i.call(e,t))return e[t].module();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r}return t.keys=()=>Object.keys(e),t.resolve=t=>{if(t=b(t),i.call(e,t))return e[t].id();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r},t.import=async e=>await t(e),t};let O=Symbol("turbopack queues"),g=Symbol("turbopack exports"),w=Symbol("turbopack error");function C(e){e&&1!==e.status&&(e.status=1,e.forEach(e=>e.queueCount--),e.forEach(e=>e.queueCount--?e.queueCount++:e()))}l.a=function(e,t){let r=this.m,n=t?Object.assign([],{status:-1}):void 0,o=new Set,{resolve:l,reject:i,promise:s}=y(),u=Object.assign(s,{[g]:r.exports,[O]:e=>{n&&e(n),o.forEach(e),u.catch(()=>{})}}),c={get:()=>u,set(e){e!==u&&(u[g]=e)}};Object.defineProperty(r,"exports",c),Object.defineProperty(r,"namespaceObject",c),e(function(e){let t=e.map(e=>{if(null!==e&&"object"==typeof e){if(O in e)return e;if(null!=e&&"object"==typeof e&&"then"in e&&"function"==typeof e.then){let t=Object.assign([],{status:0}),r={[g]:{},[O]:e=>e(t)};return e.then(e=>{r[g]=e,C(t)},e=>{r[w]=e,C(t)}),r}}return{[g]:e,[O]:()=>{}}}),r=()=>t.map(e=>{if(e[w])throw e[w];return e[g]}),{promise:l,resolve:i}=y(),s=Object.assign(()=>i(r),{queueCount:0});function u(e){e!==n&&!o.has(e)&&(o.add(e),e&&0===e.status&&(s.queueCount++,e.push(s)))}return t.map(e=>e[O](u)),s.queueCount?l:r()},function(e){e?i(u[w]=e):l(u[g]),C(n)}),n&&-1===n.status&&(n.status=0)};let U=function(e){let t=new URL(e,"x:/"),r={};for(let e in t)r[e]=t[e];for(let t in r.href=e,r.pathname=e.replace(/[?#].*/,""),r.origin=r.protocol="",r.toString=r.toJSON=(...t)=>e,r)Object.defineProperty(this,t,{enumerable:!0,configurable:!0,value:r[t]})};function j(e,t){throw Error(`Invariant: ${t(e)}`)}U.prototype=URL.prototype,l.U=U,l.z=function(e){throw Error("dynamic usage of require is not supported")},l.g=globalThis;let R=o.prototype;var k,_=((k=_||{})[k.Runtime=0]="Runtime",k[k.Parent=1]="Parent",k[k.Update=2]="Update",k);let v=new Map;l.M=v;let $=new Map,P=new Map;async function S(e,t,r){let n;if("string"==typeof r)return E(e,t,K(r));let o=r.included||[],l=o.map(e=>!!v.has(e)||$.get(e));if(l.length>0&&l.every(e=>e))return void await Promise.all(l);let i=r.moduleChunks||[],s=i.map(e=>P.get(e)).filter(e=>e);if(s.length>0){if(s.length===i.length)return void await Promise.all(s);let r=new Set;for(let e of i)P.has(e)||r.add(e);for(let n of r){let r=E(e,t,K(n));P.set(n,r),s.push(r)}n=Promise.all(s)}else{for(let o of(n=E(e,t,K(r.path)),i))P.has(o)||P.set(o,n)}for(let e of o)$.has(e)||$.set(e,n);await n}R.l=function(e){return S(1,this.m.id,e)};let T=Promise.resolve(void 0),A=new WeakMap;function E(t,r,n){let o=e.loadChunkCached(t,n),l=A.get(o);if(void 0===l){let e=A.set.bind(A,o,T);l=o.then(e).catch(e=>{let o;switch(t){case 0:o=`as a runtime dependency of chunk ${r}`;break;case 1:o=`from module ${r}`;break;case 2:o="from an HMR update";break;default:j(t,e=>`Unknown source type: ${e}`)}let l=Error(`Failed to load chunk ${n} ${o}${e?`: ${e}`:""}`,e?{cause:e}:void 0);throw l.name="ChunkLoadError",l}),A.set(o,l)}return l}function K(e){return`${t}${e.split("/").map(e=>encodeURIComponent(e)).join("/")}${r}`}R.L=function(e){return E(1,this.m.id,e)},R.R=function(e){let t=this.r(e);return t?.default??t},R.P=function(e){return`/ROOT/${e??""}`},R.b=function(e){let t=new Blob([`self.TURBOPACK_WORKER_LOCATION = ${JSON.stringify(location.origin)};
+(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,{otherChunks:["static/chunks/ba2aa8b54e912820.js","static/chunks/28eac764d6544827.js","static/chunks/06bdd070b8d25946.js","static/chunks/45bd2451c2b0790c.js","static/chunks/3770166bed1577ce.js"],runtimeModuleIds:[94553]}]),(()=>{let e;if(!Array.isArray(globalThis.TURBOPACK))return;let t="/_next/",r=(self.TURBOPACK_CHUNK_SUFFIX??document?.currentScript?.getAttribute?.("src")?.replace(/^(.*(?=\?)|^.*$)/,""))||"",n=new WeakMap;function o(e,t){this.m=e,this.e=t}let l=o.prototype,i=Object.prototype.hasOwnProperty,s="u">typeof Symbol&&Symbol.toStringTag;function u(e,t,r){i.call(e,t)||Object.defineProperty(e,t,r)}function c(e,t){let r=e[t];return r||(r=a(t),e[t]=r),r}function a(e){return{exports:{},error:void 0,id:e,namespaceObject:void 0}}function f(e,t){u(e,"__esModule",{value:!0}),s&&u(e,s,{value:"Module"});let r=0;for(;r<t.length;){let n=t[r++],o=t[r++];if("number"==typeof o)if(0===o)u(e,n,{value:t[r++],enumerable:!0,writable:!1});else throw Error(`unexpected tag: ${o}`);else"function"==typeof t[r]?u(e,n,{get:o,set:t[r++],enumerable:!0}):u(e,n,{get:o,enumerable:!0})}Object.seal(e)}l.s=function(e,t){let r,n;null!=t?n=(r=c(this.c,t)).exports:(r=this.m,n=this.e),r.namespaceObject=n,f(n,e)},l.j=function(e,t){var r,o;let l,s,u;null!=t?s=(l=c(this.c,t)).exports:(l=this.m,s=this.e);let a=(r=l,o=s,(u=n.get(r))||(n.set(r,u=[]),r.exports=r.namespaceObject=new Proxy(o,{get(e,t){if(i.call(e,t)||"default"===t||"__esModule"===t)return Reflect.get(e,t);for(let e of u){let r=Reflect.get(e,t);if(void 0!==r)return r}},ownKeys(e){let t=Reflect.ownKeys(e);for(let e of u)for(let r of Reflect.ownKeys(e))"default"===r||t.includes(r)||t.push(r);return t}})),u);"object"==typeof e&&null!==e&&a.push(e)},l.v=function(e,t){(null!=t?c(this.c,t):this.m).exports=e},l.n=function(e,t){let r;(r=null!=t?c(this.c,t):this.m).exports=r.namespaceObject=e};let p=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,h=[null,p({}),p([]),p(p)];function d(e,t,r){let n=[],o=-1;for(let t=e;("object"==typeof t||"function"==typeof t)&&!h.includes(t);t=p(t))for(let r of Object.getOwnPropertyNames(t))n.push(r,function(e,t){return()=>e[t]}(e,r)),-1===o&&"default"===r&&(o=n.length-1);return r&&o>=0||(o>=0?n.splice(o,1,0,e):n.push("default",0,e)),f(t,n),t}function m(e){let t=B(e,this.m);if(t.namespaceObject)return t.namespaceObject;let r=t.exports;return t.namespaceObject=d(r,"function"==typeof r?function(...e){return r.apply(this,e)}:Object.create(null),r&&r.__esModule)}function b(e){let t=e.indexOf("#");-1!==t&&(e=e.substring(0,t));let r=e.indexOf("?");return -1!==r&&(e=e.substring(0,r)),e}function y(){let e,t;return{promise:new Promise((r,n)=>{t=n,e=r}),resolve:e,reject:t}}l.i=m,l.A=function(e){return this.r(e)(m.bind(this))},l.t="function"==typeof require?require:function(){throw Error("Unexpected use of runtime require")},l.r=function(e){return B(e,this.m).exports},l.f=function(e){function t(t){if(t=b(t),i.call(e,t))return e[t].module();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r}return t.keys=()=>Object.keys(e),t.resolve=t=>{if(t=b(t),i.call(e,t))return e[t].id();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r},t.import=async e=>await t(e),t};let O=Symbol("turbopack queues"),g=Symbol("turbopack exports"),w=Symbol("turbopack error");function C(e){e&&1!==e.status&&(e.status=1,e.forEach(e=>e.queueCount--),e.forEach(e=>e.queueCount--?e.queueCount++:e()))}l.a=function(e,t){let r=this.m,n=t?Object.assign([],{status:-1}):void 0,o=new Set,{resolve:l,reject:i,promise:s}=y(),u=Object.assign(s,{[g]:r.exports,[O]:e=>{n&&e(n),o.forEach(e),u.catch(()=>{})}}),c={get:()=>u,set(e){e!==u&&(u[g]=e)}};Object.defineProperty(r,"exports",c),Object.defineProperty(r,"namespaceObject",c),e(function(e){let t=e.map(e=>{if(null!==e&&"object"==typeof e){if(O in e)return e;if(null!=e&&"object"==typeof e&&"then"in e&&"function"==typeof e.then){let t=Object.assign([],{status:0}),r={[g]:{},[O]:e=>e(t)};return e.then(e=>{r[g]=e,C(t)},e=>{r[w]=e,C(t)}),r}}return{[g]:e,[O]:()=>{}}}),r=()=>t.map(e=>{if(e[w])throw e[w];return e[g]}),{promise:l,resolve:i}=y(),s=Object.assign(()=>i(r),{queueCount:0});function u(e){e!==n&&!o.has(e)&&(o.add(e),e&&0===e.status&&(s.queueCount++,e.push(s)))}return t.map(e=>e[O](u)),s.queueCount?l:r()},function(e){e?i(u[w]=e):l(u[g]),C(n)}),n&&-1===n.status&&(n.status=0)};let U=function(e){let t=new URL(e,"x:/"),r={};for(let e in t)r[e]=t[e];for(let t in r.href=e,r.pathname=e.replace(/[?#].*/,""),r.origin=r.protocol="",r.toString=r.toJSON=(...t)=>e,r)Object.defineProperty(this,t,{enumerable:!0,configurable:!0,value:r[t]})};function j(e,t){throw Error(`Invariant: ${t(e)}`)}U.prototype=URL.prototype,l.U=U,l.z=function(e){throw Error("dynamic usage of require is not supported")},l.g=globalThis;let R=o.prototype;var k,_=((k=_||{})[k.Runtime=0]="Runtime",k[k.Parent=1]="Parent",k[k.Update=2]="Update",k);let v=new Map;l.M=v;let $=new Map,P=new Map;async function S(e,t,r){let n;if("string"==typeof r)return E(e,t,K(r));let o=r.included||[],l=o.map(e=>!!v.has(e)||$.get(e));if(l.length>0&&l.every(e=>e))return void await Promise.all(l);let i=r.moduleChunks||[],s=i.map(e=>P.get(e)).filter(e=>e);if(s.length>0){if(s.length===i.length)return void await Promise.all(s);let r=new Set;for(let e of i)P.has(e)||r.add(e);for(let n of r){let r=E(e,t,K(n));P.set(n,r),s.push(r)}n=Promise.all(s)}else{for(let o of(n=E(e,t,K(r.path)),i))P.has(o)||P.set(o,n)}for(let e of o)$.has(e)||$.set(e,n);await n}R.l=function(e){return S(1,this.m.id,e)};let T=Promise.resolve(void 0),A=new WeakMap;function E(t,r,n){let o=e.loadChunkCached(t,n),l=A.get(o);if(void 0===l){let e=A.set.bind(A,o,T);l=o.then(e).catch(e=>{let o;switch(t){case 0:o=`as a runtime dependency of chunk ${r}`;break;case 1:o=`from module ${r}`;break;case 2:o="from an HMR update";break;default:j(t,e=>`Unknown source type: ${e}`)}let l=Error(`Failed to load chunk ${n} ${o}${e?`: ${e}`:""}`,e?{cause:e}:void 0);throw l.name="ChunkLoadError",l}),A.set(o,l)}return l}function K(e){return`${t}${e.split("/").map(e=>encodeURIComponent(e)).join("/")}${r}`}R.L=function(e){return E(1,this.m.id,e)},R.R=function(e){let t=this.r(e);return t?.default??t},R.P=function(e){return`/ROOT/${e??""}`},R.b=function(e){let t=new Blob([`self.TURBOPACK_WORKER_LOCATION = ${JSON.stringify(location.origin)};
 self.TURBOPACK_CHUNK_SUFFIX = ${JSON.stringify(r)};
 self.TURBOPACK_NEXT_CHUNK_URLS = ${JSON.stringify(e.reverse().map(K),null,2)};
 importScripts(...self.TURBOPACK_NEXT_CHUNK_URLS.map(c => self.TURBOPACK_WORKER_LOCATION + c).reverse());`],{type:"text/javascript"});return URL.createObjectURL(t)};let x=/\.js(?:\?[^#]*)?(?:#.*)?$/,N=/\.css(?:\?[^#]*)?(?:#.*)?$/;function M(e){return N.test(e)}l.w=function(t,r,n){return e.loadWebAssembly(1,this.m.id,t,r,n)},l.u=function(t,r){return e.loadWebAssemblyModule(1,this.m.id,t,r)};let L={};l.c=L;let B=(e,t)=>{let r=L[e];if(r){if(r.error)throw r.error;return r}return q(e,_.Parent,t.id)};function q(e,t,r){let n=v.get(e);if("function"!=typeof n)throw Error(function(e,t,r){let n;switch(t){case 0:n=`as a runtime entry of chunk ${r}`;break;case 1:n=`because it was required from module ${r}`;break;case 2:n="because of an HMR update";break;default:j(t,e=>`Unknown source type: ${e}`)}return`Module ${e} was instantiated ${n}, but the module factory is not available.`}(e,t,r));let l=a(e),i=l.exports;L[e]=l;let s=new o(l,i);try{n(s,l,i)}catch(e){throw l.error=e,e}return l.namespaceObject&&l.exports!==l.namespaceObject&&d(l.exports,l.namespaceObject),l}function I(r){let n,o=function(e){if("string"==typeof e)return e;let r=decodeURIComponent(("u">typeof TURBOPACK_NEXT_CHUNK_URLS?TURBOPACK_NEXT_CHUNK_URLS.pop():e.getAttribute("src")).replace(/[?#].*$/,""));return r.startsWith(t)?r.slice(t.length):r}(r[0]);return 2===r.length?n=r[1]:(n=void 0,!function(e,t,r,n){let o=1;for(;o<e.length;){let t=e[o],n=o+1;for(;n<e.length&&"function"!=typeof e[n];)n++;if(n===e.length)throw Error("malformed chunk format, expected a factory function");if(!r.has(t)){let l=e[n];for(Object.defineProperty(l,"name",{value:"module evaluation"});o<n;o++)t=e[o],r.set(t,l)}o=n+1}}(r,0,v)),e.registerChunk(o,n)}let W=new Map;function H(e){let t=W.get(e);if(!t){let r,n;t={resolved:!1,loadingStarted:!1,promise:new Promise((e,t)=>{r=e,n=t}),resolve:()=>{t.resolved=!0,r()},reject:n},W.set(e,t)}return t}e={async registerChunk(e,t){if(H(K(e)).resolve(),null!=t){for(let e of t.otherChunks)H(K("string"==typeof e?e:e.path));if(await Promise.all(t.otherChunks.map(t=>S(0,e,t))),t.runtimeModuleIds.length>0)for(let r of t.runtimeModuleIds)!function(e,t){let r=L[t];if(r){if(r.error)throw r.error;return}q(t,_.Runtime,e)}(e,r)}},loadChunkCached:(e,t)=>(function(e,t){let r=H(t);if(r.loadingStarted)return r.promise;if(e===_.Runtime)return r.loadingStarted=!0,M(t)&&r.resolve(),r.promise;if("function"==typeof importScripts)if(M(t));else if(x.test(t))self.TURBOPACK_NEXT_CHUNK_URLS.push(t),importScripts(TURBOPACK_WORKER_LOCATION+t);else throw Error(`can't infer type of chunk from URL ${t} in worker`);else{let e=decodeURI(t);if(M(t))if(document.querySelectorAll(`link[rel=stylesheet][href="${t}"],link[rel=stylesheet][href^="${t}?"],link[rel=stylesheet][href="${e}"],link[rel=stylesheet][href^="${e}?"]`).length>0)r.resolve();else{let e=document.createElement("link");e.rel="stylesheet",e.href=t,e.onerror=()=>{r.reject()},e.onload=()=>{r.resolve()},document.head.appendChild(e)}else if(x.test(t)){let n=document.querySelectorAll(`script[src="${t}"],script[src^="${t}?"],script[src="${e}"],script[src^="${e}?"]`);if(n.length>0)for(let e of Array.from(n))e.addEventListener("error",()=>{r.reject()});else{let e=document.createElement("script");e.src=t,e.onerror=()=>{r.reject()},document.head.appendChild(e)}}else throw Error(`can't infer type of chunk from URL ${t}`)}return r.loadingStarted=!0,r.promise})(e,t),async loadWebAssembly(e,t,r,n,o){let l=fetch(K(r)),{instance:i}=await WebAssembly.instantiateStreaming(l,o);return i.exports},async loadWebAssemblyModule(e,t,r,n){let o=fetch(K(r));return await WebAssembly.compileStreaming(o)}};let F=globalThis.TURBOPACK;globalThis.TURBOPACK={push:I},F.forEach(I)})();

package/web/.next/standalone/packages/web/package.json

@@ -6,7 +6,7 @@
   "license": "MIT",
   "type": "module",
   "scripts": {
-    "dev": "next dev -p ${PORT:-3000}",
+    "dev": "next dev --webpack -p ${PORT:-3000}",
     "build": "next build",
     "start": "next start",
     "typecheck": "tsc --noEmit",
@@ -46,6 +46,7 @@
     "jose": "^6.1.3",
     "lucide-react": "^0.576.0",
     "next": "^16.1.6",
+    "puppeteer": "^24.37.5",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
     "react-icons": "^5.6.0",

package/web/.next/standalone/packages/web/src/app/api/agents/route.ts

@@ -1,5 +1,199 @@
-import { guardedProxyRoute } from "@/lib/proxyRoutes";
+import { NextResponse } from "next/server";
+import { guardApiAccess } from "@/lib/auth";
+import { normalizeAgentName } from "@/lib/agentUtils";
+import { buildForwardedAccessHeaders } from "@/lib/guardedRustProxy";
+import {
+  getKnownAgent,
+  getKnownAgentOrderIndex,
+  KNOWN_AGENTS,
+} from "@/lib/knownAgents";
+import type { RuntimeAgentModelCatalog } from "@/lib/runtimeAgentModelsShared";
+import { getRuntimeAgentModelCatalog } from "@/lib/runtimeAgentModels";
+import { hasRustBackend, proxyToRust } from "@/lib/rustBackendProxy";
 
 export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
 
-export const GET = guardedProxyRoute("/api/agents", { role: "viewer" });
+type AgentResponse = {
+  name: string;
+  label?: string;
+  description: string;
+  installed: boolean;
+  configured: boolean;
+  ready: boolean;
+  homepage: string | null;
+  iconUrl: string | null;
+  installHint: string | null;
+  installUrl: string | null;
+  setupUrl: string | null;
+  version: string | null;
+  binary: string | null;
+  runtimeModelCatalog: RuntimeAgentModelCatalog | null;
+};
+
+type BackendAgentResponse = Partial<AgentResponse> & {
+  name?: string;
+  runtimeModelCatalog?: unknown;
+};
+
+function toObject(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return value as Record<string, unknown>;
+}
+
+function normalizeAgentsPayload(value: unknown): BackendAgentResponse[] {
+  if (Array.isArray(value)) {
+    return value as BackendAgentResponse[];
+  }
+
+  const root = toObject(value);
+  if (Array.isArray(root["agents"])) {
+    return root["agents"] as BackendAgentResponse[];
+  }
+
+  return [];
+}
+
+function normalizeRuntimeModelCatalog(value: unknown): RuntimeAgentModelCatalog | null {
+  const record = toObject(value);
+  return typeof record["agent"] === "string"
+    ? value as RuntimeAgentModelCatalog
+    : null;
+}
+
+function resolveConfiguredState(
+  installed: boolean,
+  backendConfigured: boolean | undefined,
+  backendReady: boolean | undefined,
+) {
+  if (!installed) {
+    return { configured: false, ready: false };
+  }
+
+  const configured = backendConfigured !== false;
+  const ready = backendReady !== false && configured;
+  return { configured, ready };
+}
+
+async function loadRuntimeCatalogs() {
+  const entries = await Promise.all(
+    KNOWN_AGENTS.map(async (agent) => {
+      const catalog = await getRuntimeAgentModelCatalog(agent.name);
+      return [normalizeAgentName(agent.name), catalog] as const;
+    }),
+  );
+
+  return new Map(entries);
+}
+
+function sortAgents(left: AgentResponse, right: AgentResponse) {
+  const leftOrder = getKnownAgentOrderIndex(left.name);
+  const rightOrder = getKnownAgentOrderIndex(right.name);
+  if (leftOrder !== rightOrder) return leftOrder - rightOrder;
+  return (left.label ?? left.name).localeCompare(right.label ?? right.name);
+}
+
+export async function GET(request: Request): Promise<Response> {
+  const denied = await guardApiAccess(request, "viewer");
+  if (denied) return denied;
+
+  if (!hasRustBackend()) {
+    return NextResponse.json(
+      { error: "Rust backend URL is not configured" },
+      { status: 503 },
+    );
+  }
+
+  let backendResponse: Response;
+  try {
+    backendResponse = await proxyToRust(request, "/api/agents", {
+      headers: await buildForwardedAccessHeaders(request),
+    });
+  } catch (error) {
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : "Failed to reach Rust backend" },
+      { status: 502 },
+    );
+  }
+
+  if (!backendResponse.ok) {
+    return backendResponse;
+  }
+
+  const payload = await backendResponse.json().catch(() => null);
+  const backendAgents = normalizeAgentsPayload(payload);
+  const runtimeCatalogs = await loadRuntimeCatalogs();
+  const merged = new Map<string, AgentResponse>();
+
+  for (const known of KNOWN_AGENTS) {
+    merged.set(normalizeAgentName(known.name), {
+      name: known.name,
+      label: known.label,
+      description: known.description,
+      installed: false,
+      configured: false,
+      ready: false,
+      homepage: known.homepage,
+      iconUrl: known.iconUrl,
+      installHint: known.installHint ?? null,
+      installUrl: known.installUrl ?? known.homepage,
+      setupUrl: known.setupUrl ?? known.homepage,
+      version: null,
+      binary: null,
+      runtimeModelCatalog: runtimeCatalogs.get(normalizeAgentName(known.name)) ?? null,
+    });
+  }
+
+  for (const entry of backendAgents) {
+    if (typeof entry.name !== "string" || entry.name.trim().length === 0) {
+      continue;
+    }
+
+    const normalizedName = normalizeAgentName(entry.name);
+    const known = getKnownAgent(normalizedName);
+    const canonicalName = known?.name ?? normalizedName;
+    const normalizedCanonical = normalizeAgentName(canonicalName);
+    const runtimeModelCatalog = normalizeRuntimeModelCatalog(entry.runtimeModelCatalog)
+      ?? runtimeCatalogs.get(normalizedCanonical)
+      ?? null;
+    const installed = entry.installed !== false;
+    const resolvedState = resolveConfiguredState(
+      installed,
+      entry.configured,
+      entry.ready,
+    );
+
+    merged.set(normalizedCanonical, {
+      name: canonicalName,
+      label: known?.label ?? (typeof entry.label === "string" ? entry.label : undefined),
+      description: typeof entry.description === "string" && entry.description.trim().length > 0
+        ? entry.description
+        : known?.description ?? "Agent metadata not available.",
+      installed,
+      configured: resolvedState.configured,
+      ready: resolvedState.ready,
+      homepage: typeof entry.homepage === "string" && entry.homepage.trim().length > 0
+        ? entry.homepage
+        : known?.homepage ?? null,
+      iconUrl: typeof entry.iconUrl === "string" && entry.iconUrl.trim().length > 0
+        ? entry.iconUrl
+        : known?.iconUrl ?? null,
+      installHint: known?.installHint ?? null,
+      installUrl: known?.installUrl ?? known?.homepage ?? null,
+      setupUrl: known?.setupUrl ?? known?.homepage ?? null,
+      version: typeof entry.version === "string" && entry.version.trim().length > 0
+        ? entry.version
+        : null,
+      binary: typeof entry.binary === "string" && entry.binary.trim().length > 0
+        ? entry.binary
+        : null,
+      runtimeModelCatalog,
+    });
+  }
+
+  return NextResponse.json({
+    agents: [...merged.values()].sort(sortAgents),
+  });
+}

package/web/.next/standalone/packages/web/src/app/api/app-update/route.ts

@@ -0,0 +1,6 @@
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
+
+export const dynamic = "force-dynamic";
+
+export const GET = guardedProxyRoute("/api/app-update", { role: "viewer" });
+export const POST = guardedProxyRoute("/api/app-update", { role: "admin", requireActionGuard: true });

package/web/.next/standalone/packages/web/src/app/api/auth/session/route.ts

@@ -1,6 +1,41 @@
-import { openProxyRoute } from "@/lib/proxyRoutes";
+import { type NextRequest, NextResponse } from "next/server";
+import { guardApiActionAccess } from "@/lib/auth";
+import {
+  BUILTIN_REMOTE_SESSION_COOKIE,
+  getBuiltinRemoteSessionCookieOptions,
+} from "@/lib/remoteAuth";
 
 export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
 
-export const POST = openProxyRoute("/api/auth/session");
-export const DELETE = openProxyRoute("/api/auth/session");
+function isSecureRequest(request: NextRequest): boolean {
+  const forwardedProto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim().toLowerCase();
+  if (forwardedProto === "https") return true;
+  if (forwardedProto === "http") return false;
+  return request.nextUrl.protocol === "https:";
+}
+
+export async function POST(request: NextRequest): Promise<Response> {
+  const denied = guardApiActionAccess(request);
+  if (denied) return denied;
+  return NextResponse.json(
+    { error: "Public share-link remote access has been removed. Use the private Tailscale link or a protected enterprise URL instead." },
+    { status: 410 },
+  );
+}
+
+export function DELETE(request: NextRequest): Response {
+  const denied = guardApiActionAccess(request);
+  if (denied) return denied;
+
+  const response = NextResponse.json({ ok: true });
+  response.cookies.set(
+    BUILTIN_REMOTE_SESSION_COOKIE,
+    "",
+    {
+      ...getBuiltinRemoteSessionCookieOptions(isSecureRequest(request)),
+      maxAge: 0,
+    },
+  );
+  return response;
+}

package/web/.next/standalone/packages/web/src/app/api/boards/comments/route.ts

@@ -0,0 +1,8 @@
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
+
+export const dynamic = "force-dynamic";
+
+export const POST = guardedProxyRoute("/api/boards/comments", {
+  role: "operator",
+  requireActionGuard: true,
+});

package/web/.next/standalone/packages/web/src/app/api/boards/route.ts

@@ -4,3 +4,4 @@ export const dynamic = "force-dynamic";
 
 export const GET = guardedProxyRoute("/api/boards", { role: "viewer" });
 export const POST = guardedProxyRoute("/api/boards", { role: "operator", requireActionGuard: true });
+export const PATCH = guardedProxyRoute("/api/boards", { role: "operator", requireActionGuard: true });

package/web/.next/standalone/packages/web/src/app/api/context-files/open/route.ts

@@ -0,0 +1,8 @@
+import { guardedProxyRoute } from "@/lib/proxyRoutes";
+
+export const dynamic = "force-dynamic";
+
+export const POST = guardedProxyRoute("/api/context-files/open", {
+  role: "operator",
+  requireActionGuard: true,
+});

package/web/.next/standalone/packages/web/src/app/api/github/webhook/route.ts

@@ -0,0 +1,5 @@
+import { openProxyRoute } from "@/lib/proxyRoutes";
+
+export const dynamic = "force-dynamic";
+
+export const POST = openProxyRoute("/api/github/webhook");

package/web/.next/standalone/packages/web/src/app/api/remote-access/route.ts

@@ -0,0 +1,115 @@
+import { type NextRequest, NextResponse } from "next/server";
+import {
+  getDashboardConfigSnapshot,
+  guardApiAccess,
+  guardApiActionAccess,
+} from "@/lib/auth";
+import {
+  disableManagedRemoteAccess,
+  enableManagedRemoteAccess,
+  getManagedRemoteAccessStatus,
+  type ManagedRemoteAccessStatus,
+} from "@/lib/remoteAccessManager";
+import {
+  resolveRemoteAccessSummary,
+  resolveRequestPublicUrl,
+} from "@/lib/remoteAccess";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+
+type RemoteAccessAction = "enable";
+
+function buildRemoteAccessPayload(
+  request: Request,
+  remoteStatus: ManagedRemoteAccessStatus,
+): Record<string, unknown> {
+  const dashboardConfig = getDashboardConfigSnapshot();
+  const runtimeState = remoteStatus.state;
+  const summary = resolveRemoteAccessSummary({
+    access: dashboardConfig.access,
+    clerkConfigured: Boolean(
+      process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY && process.env.CLERK_SECRET_KEY,
+    ),
+    configuredPublicUrl: runtimeState?.publicUrl
+      || process.env.CONDUCTOR_PUBLIC_DASHBOARD_URL?.trim()
+      || (
+        dashboardConfig.access?.trustedHeaders?.enabled === true
+        && dashboardConfig.access?.trustedHeaders?.provider !== "generic"
+        && dashboardConfig.access?.trustedHeaders?.teamDomain?.trim()
+        && dashboardConfig.access?.trustedHeaders?.audience?.trim()
+          ? dashboardConfig.dashboardUrl
+          : null
+      ),
+    managedProvider: runtimeState?.provider ?? null,
+    observedPublicUrl: resolveRequestPublicUrl(request),
+    preferredProvider: remoteStatus.recommendedProvider,
+    preferredProviderConnected: remoteStatus.connected,
+  });
+
+  return {
+    ...summary,
+    status: runtimeState?.status ?? "disabled",
+    provider: runtimeState?.provider ?? null,
+    recommendedProvider: remoteStatus.recommendedProvider,
+    localUrl: runtimeState?.localUrl ?? null,
+    managed: runtimeState?.provider === "tailscale",
+    installed: remoteStatus.installed,
+    connected: remoteStatus.connected,
+    canAutoInstall: remoteStatus.canAutoInstall,
+    autoInstallMethod: remoteStatus.autoInstallMethod,
+    lastError: runtimeState?.lastError ?? null,
+    startedAt: runtimeState?.startedAt ?? null,
+    updatedAt: runtimeState?.updatedAt ?? null,
+  };
+}
+
+export async function GET(request: Request): Promise<Response> {
+  const denied = await guardApiAccess(request, "admin");
+  if (denied) return denied;
+
+  const remoteStatus = await getManagedRemoteAccessStatus();
+  return NextResponse.json(buildRemoteAccessPayload(request, remoteStatus));
+}
+
+export async function POST(request: NextRequest): Promise<Response> {
+  const denied = await guardApiAccess(request, "admin");
+  if (denied) return denied;
+  const deniedAction = guardApiActionAccess(request);
+  if (deniedAction) return deniedAction;
+
+  const payload = await request.json().catch(() => null) as { action?: unknown } | null;
+  const action = payload?.action;
+  if (action !== "enable") {
+    return NextResponse.json(
+      { error: "Unsupported remote access action." },
+      { status: 400 },
+    );
+  }
+  try {
+    const nextStatus = await enableManagedRemoteAccess();
+    return NextResponse.json(buildRemoteAccessPayload(request, nextStatus));
+  } catch (error) {
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : "Remote access action failed." },
+      { status: 500 },
+    );
+  }
+}
+
+export async function DELETE(request: NextRequest): Promise<Response> {
+  const denied = await guardApiAccess(request, "admin");
+  if (denied) return denied;
+  const deniedAction = guardApiActionAccess(request);
+  if (deniedAction) return deniedAction;
+
+  try {
+    const remoteStatus = await disableManagedRemoteAccess();
+    return NextResponse.json(buildRemoteAccessPayload(request, remoteStatus));
+  } catch (error) {
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : "Remote access action failed." },
+      { status: 500 },
+    );
+  }
+}

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/feed/stream/route.ts

@@ -0,0 +1,8 @@
+import { guardedProxyParamRoute } from "@/lib/proxyRoutes";
+
+export const dynamic = "force-dynamic";
+
+export const GET = guardedProxyParamRoute(
+  ({ id }) => `/api/sessions/${encodeURIComponent(id ?? "")}/feed/stream`,
+  { role: "viewer" },
+);

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/interrupt/route.ts

@@ -0,0 +1,8 @@
+import { guardedProxyParamRoute } from "@/lib/proxyRoutes";
+
+export const dynamic = "force-dynamic";
+
+export const POST = guardedProxyParamRoute(
+  ({ id }) => `/api/sessions/${encodeURIComponent(id ?? "")}/interrupt`,
+  { role: "operator", requireActionGuard: true },
+);

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/preview/dom/route.ts

@@ -0,0 +1,37 @@
+import { NextRequest, NextResponse } from "next/server";
+import { guardApiAccess } from "@/lib/auth";
+import { getPreviewBrowserManager } from "@/lib/devPreviewBrowser";
+import { buildForwardedAccessHeaders } from "@/lib/guardedRustProxy";
+import { loadPreviewSessionContext } from "@/lib/previewSession";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+type RouteParams = { params: Promise<{ id: string }> };
+
+export async function GET(request: NextRequest, context: RouteParams): Promise<Response> {
+  const denied = await guardApiAccess(request, "viewer");
+  if (denied) return denied;
+
+  const { id } = await context.params;
+  const previewContext = await loadPreviewSessionContext(id, {
+    headers: await buildForwardedAccessHeaders(request),
+  });
+  if (!previewContext.session && !previewContext.error) {
+    return NextResponse.json({ error: `Session ${id} not found` }, { status: 404 });
+  }
+
+  const frameId = request.nextUrl.searchParams.get("frameId");
+  const interactiveOnly = request.nextUrl.searchParams.get("interactiveOnly") === "1";
+  const manager = getPreviewBrowserManager();
+
+  try {
+    const payload = await manager.inspectDom(id, frameId, interactiveOnly);
+    return NextResponse.json(payload, { headers: { "Cache-Control": "no-store" } });
+  } catch (error) {
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : "Failed to inspect DOM" },
+      { status: 400 },
+    );
+  }
+}

package/web/.next/standalone/packages/web/src/app/api/sessions/[id]/preview/route.test.ts

@@ -0,0 +1,141 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { NextRequest } from "next/server";
+import { clearRemoteAccessRuntimeState } from "@/lib/remoteAccessRuntime";
+import { GET } from "./route";
+
+const originalBackendUrl = process.env.CONDUCTOR_BACKEND_URL;
+const originalConfigPath = process.env.CO_CONFIG_PATH;
+const originalWorkspace = process.env.CONDUCTOR_WORKSPACE;
+const originalRequireAuth = process.env.CONDUCTOR_REQUIRE_AUTH;
+const originalFetch = global.fetch;
+
+function resetEnv(): void {
+  delete process.env.CONDUCTOR_BACKEND_URL;
+  process.env.CO_CONFIG_PATH = "/tmp/conductor-preview-route-test-config-does-not-exist.yaml";
+  process.env.CONDUCTOR_WORKSPACE = "";
+  process.env.CONDUCTOR_REQUIRE_AUTH = "";
+  clearRemoteAccessRuntimeState();
+}
+
+test.afterEach(() => {
+  resetEnv();
+});
+
+test.after(() => {
+  if (originalBackendUrl === undefined) {
+    delete process.env.CONDUCTOR_BACKEND_URL;
+  } else {
+    process.env.CONDUCTOR_BACKEND_URL = originalBackendUrl;
+  }
+
+  if (originalConfigPath === undefined) {
+    delete process.env.CO_CONFIG_PATH;
+  } else {
+    process.env.CO_CONFIG_PATH = originalConfigPath;
+  }
+
+  if (originalWorkspace === undefined) {
+    delete process.env.CONDUCTOR_WORKSPACE;
+  } else {
+    process.env.CONDUCTOR_WORKSPACE = originalWorkspace;
+  }
+
+  if (originalRequireAuth === undefined) {
+    delete process.env.CONDUCTOR_REQUIRE_AUTH;
+  } else {
+    process.env.CONDUCTOR_REQUIRE_AUTH = originalRequireAuth;
+  }
+
+  global.fetch = originalFetch;
+
+  clearRemoteAccessRuntimeState();
+});
+
+test("GET returns disconnected preview state when backend lookup is unavailable", async () => {
+  resetEnv();
+
+  const response = await GET(
+    new NextRequest("http://127.0.0.1:3000/api/sessions/session-1/preview"),
+    { params: Promise.resolve({ id: "session-1" }) },
+  );
+
+  assert.equal(response.status, 200);
+
+  const payload = await response.json() as {
+    connected: boolean;
+    candidateUrls: string[];
+    currentUrl: string | null;
+    lastError: string | null;
+  };
+
+  assert.equal(payload.connected, false);
+  assert.deepEqual(payload.candidateUrls, []);
+  assert.equal(payload.currentUrl, null);
+  assert.equal(payload.lastError, "Rust backend URL is not configured");
+});
+
+test("GET forwards dashboard access headers to backend preview lookups", async () => {
+  resetEnv();
+  process.env.CONDUCTOR_BACKEND_URL = "http://127.0.0.1:4749";
+
+  const seenAuthHeaders: string[] = [];
+
+  global.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+    const url = typeof input === "string" || input instanceof URL
+      ? String(input)
+      : input.url;
+    const headers = new Headers(init?.headers);
+    seenAuthHeaders.push(headers.get("x-conductor-proxy-authorized") ?? "missing");
+
+    if (url.endsWith("/api/sessions/session-1")) {
+      return new Response(JSON.stringify({
+        id: "session-1",
+        projectId: "demo",
+        status: "working",
+        activity: "active",
+        branch: "feature/demo",
+        issueId: null,
+        summary: null,
+        createdAt: new Date().toISOString(),
+        lastActivityAt: new Date().toISOString(),
+        pr: null,
+        metadata: {},
+      }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+
+    if (url.includes("/api/sessions/session-1/output?lines=400")) {
+      return new Response(JSON.stringify({
+        output: "ready on http://localhost:3000",
+      }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    }
+
+    return new Response("not found", { status: 404 });
+  }) as typeof fetch;
+
+  try {
+    const response = await GET(
+      new NextRequest("http://127.0.0.1:3000/api/sessions/session-1/preview"),
+      { params: Promise.resolve({ id: "session-1" }) },
+    );
+
+    assert.equal(response.status, 200);
+    assert.deepEqual(seenAuthHeaders, ["true", "true"]);
+
+    const payload = await response.json() as {
+      candidateUrls: string[];
+      lastError: string | null;
+    };
+
+    assert.deepEqual(payload.candidateUrls, ["http://localhost:3000/"]);
+    assert.equal(payload.lastError, null);
+  } finally {
+    global.fetch = originalFetch;
+  }
+});