conductor-remote 1.117.0 → 1.118.0

package/dist-node/src/{agent-config.js → agents/agent-config.js}

@@ -1,4 +1,4 @@
-import { agentTypeCanExposeEffort, agentTypeCanExposeFastMode, modelAgentType, modelLabel, modelPickerLabel, shortModel } from "./shared.js";
+import { agentTypeCanExposeEffort, agentTypeCanExposeFastMode, modelAgentType, modelLabel, modelPickerLabel, shortModel } from "../shared.js";
 function modelMatches(state, requested, allowPrefix = false) {
     const label = modelPickerLabel(requested).trim();
     const expectedAgentType = modelAgentType(label);

package/dist-node/src/{model-cache.js → agents/model-cache.js}

@@ -8,7 +8,7 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { modelPickerLabel } from "./shared.js";
+import { modelPickerLabel } from "../shared.js";
 function clean(models) {
     return [
         ...new Set(models

package/dist-node/src/{roles.js → agents/roles.js}

@@ -8,9 +8,9 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { stateDir } from "./config.js";
-import { currentModelCatalog, modelAgentType, modelPickerLabel } from "./shared.js";
-export { newestModelSnapshot } from "./shared.js";
+import { stateDir } from "../config.js";
+import { currentModelCatalog, modelAgentType, modelPickerLabel } from "../shared.js";
+export { newestModelSnapshot } from "../shared.js";
 const EFFORTS = new Set(['none', 'low', 'medium', 'high', 'xhigh', 'max', 'ultracode']);
 const ROLE_NAME = /^[a-z][a-z0-9_-]{0,63}$/;
 const MAX_ROLES = 32;

package/dist-node/src/db.js

@@ -6,7 +6,7 @@ const SLOW_QUERY_LOG_INTERVAL_MS = 60_000;
  *
  * The desktop app holds the same file open in WAL mode; a second read-only
  * connection sees every committed write without blocking the app. We never
- * write through this handle — writes go through the actuator (see writes.ts).
+ * write through this handle — writes go through the actuator (see src/writes/actuator.ts).
  */
 export class ConductorDb {
     dbPath;

package/dist-node/src/{parked.js → delivery/parked.js}

@@ -8,7 +8,7 @@
  * the lock hands its prompt to this queue and returns at once: the phone shows it
  * as a queued bubble in the chat (`workspace.parked_prompts` on `/api/state`),
  * the relay polls the lock and delivers when it lifts, and a push notification
- * says whether it landed. Same ownership story as `firstprompt.ts`: the relay is
+ * says whether it landed. Same ownership story as `src/delivery/firstprompt.ts`: the relay is
  * the only deliverer, the phone only watches and can dismiss.
  *
  * The same three properties hold it up:

package/dist-node/src/{dev-server.js → dev-server/controller.js}

@@ -3,7 +3,7 @@
  * the tailnet-only HTTPS port.
  *
  * The relay never spawns a repository command itself. Starting and stopping go
- * through Conductor's real Run button (`writes.ts`), which preserves its task
+ * through Conductor's real Run button (`src/writes/workspaces.ts`), which preserves its task
  * selection, environment, run-mode rules and process-group cleanup. This module
  * discovers that workspace's allocated `CONDUCTOR_PORT`, accepts complete URLs
  * from Conductor configuration or a running application, and gives each local
@@ -20,309 +20,26 @@
 import { execFile } from 'node:child_process';
 import crypto from 'node:crypto';
 import fs from 'node:fs';
-import http, {} from 'node:http';
-import net from 'node:net';
 import path from 'node:path';
 import { promisify } from 'node:util';
-import { stateDir } from "./config.js";
+import { stateDir } from "../config.js";
+import { magicDnsName, tailscaleBin } from "../host/tailscale.js";
+import { setRunTask } from "../writes/workspaces.js";
+import { chooseServePort, forwardUrl, localPreviewUrl, previewPath, serveProxyAt, tcpOpen, validPort, waitForPort } from "./ports.js";
 import { previewUrlSettings, resolvePreviewTargets } from "./preview-urls.js";
+import { PORT_SNAPSHOT_TTL_MS, processAlive, workspacePort } from "./processes.js";
+import { bridgeMatches, createDevProxy } from "./proxy.js";
 import { runConfigsFor } from "./run-configs.js";
-import { magicDnsName, tailscaleBin } from "./tailscale.js";
-import { setRunTask } from "./writes.js";
-const exec = promisify(execFile);
+export const exec = promisify(execFile);
 // Keep the receipt additive and version-1-readable: an installed relay and a
 // source `yarn dev` relay can briefly share this file during an update.
 const STORE_VERSION = 1;
 const PREVIEW_ADVERTISEMENT_VERSION = 1;
 const PORT_WAIT_MS = 15_000;
-const PORT_SNAPSHOT_TTL_MS = 5000;
 const MAX_PREVIEW_ADVERTISEMENT_BYTES = 64 * 1024;
 function recordKey(workspaceId, targetPort) {
     return `${workspaceId}:${targetPort}`;
 }
-function validPort(value) {
-    return Number.isInteger(value) && value > 0 && value <= 65535;
-}
-function processAlive(pid) {
-    if (!pid || !Number.isInteger(pid) || pid <= 0)
-        return false;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function bridgeMatches(record) {
-    if (!record.bridgeToken) {
-        // Compatibility for the first local prototype receipts. PID plus an open
-        // bridge is enough to avoid stealing one during this upgrade; every newly
-        // written receipt carries the unambiguous challenge below.
-        return processAlive(record.ownerPid) ? tcpOpen(record.bridgePort) : Promise.resolve(false);
-    }
-    return new Promise(resolve => {
-        let settled = false;
-        const finish = (matches) => {
-            if (settled)
-                return;
-            settled = true;
-            request.destroy();
-            resolve(matches);
-        };
-        const request = http.request({
-            host: '127.0.0.1',
-            port: record.bridgePort,
-            method: 'GET',
-            path: '/',
-            headers: { 'x-conductor-remote-bridge': record.bridgeToken }
-        }, response => {
-            response.resume();
-            finish(response.statusCode === 204);
-        });
-        request.setTimeout(500, () => finish(false));
-        request.once('error', () => finish(false));
-        request.end();
-    });
-}
-/**
- * Parse a macOS `ps eww -axo command=` snapshot without ever logging it: process
- * environments can contain credentials. Multiple processes are expected, but
- * conflicting ports for one workspace are not safe to guess through.
- */
-export function parseWorkspacePort(snapshot, workspaceId) {
-    const ports = new Set();
-    for (const line of snapshot.split('\n')) {
-        const id = line.match(/(?:^|\s)CONDUCTOR_WORKSPACE_ID=([^\s]+)/)?.[1];
-        if (id !== workspaceId)
-            continue;
-        const port = Number(line.match(/(?:^|\s)CONDUCTOR_PORT=(\d+)(?:\s|$)/)?.[1]);
-        if (validPort(port))
-            ports.add(port);
-    }
-    return ports.size === 1 ? [...ports][0] : null;
-}
-let portSnapshot = null;
-let portSnapshotInFlight = null;
-async function readProcesses() {
-    const { stdout } = await exec('ps', ['eww', '-axo', 'command='], {
-        encoding: 'utf8',
-        maxBuffer: 64 * 1024 * 1024,
-        timeout: 5000
-    });
-    portSnapshot = { at: Date.now(), text: stdout };
-    return stdout;
-}
-/**
- * One `ps` snapshot shared by every workspace. It carries every process
- * environment on the Mac (~650 kB here), and the phone polls this state every
- * 2.5s per open chat, so a read reuses a recent one and simultaneous readers
- * await the same child process. A workspace whose Run task is stopped has no
- * port to remember, which is why the miss path needs this and not just the hit
- * path. A start asks for `maxAgeMs` 0, because the task it just pressed is
- * younger than any cached snapshot.
- */
-function processSnapshot(maxAgeMs) {
-    if (maxAgeMs <= 0)
-        return readProcesses();
-    if (portSnapshot && Date.now() - portSnapshot.at <= maxAgeMs)
-        return Promise.resolve(portSnapshot.text);
-    portSnapshotInFlight ??= readProcesses().finally(() => {
-        portSnapshotInFlight = null;
-    });
-    return portSnapshotInFlight;
-}
-async function workspacePort(workspaceId, maxAgeMs = 0) {
-    try {
-        return parseWorkspacePort(await processSnapshot(maxAgeMs), workspaceId);
-    }
-    catch {
-        // Never reflect the error: `execFile` includes stdout, which is the process
-        // environment snapshot and may contain secrets.
-        return null;
-    }
-}
-function tcpOpen(port, timeoutMs = 300) {
-    return new Promise(resolve => {
-        const socket = net.connect({ host: '127.0.0.1', port });
-        const finish = (open) => {
-            socket.destroy();
-            resolve(open);
-        };
-        socket.setTimeout(timeoutMs);
-        socket.once('connect', () => finish(true));
-        socket.once('timeout', () => finish(false));
-        socket.once('error', () => finish(false));
-    });
-}
-async function waitForPort(port, open, timeoutMs) {
-    const deadline = Date.now() + timeoutMs;
-    do {
-        if ((await tcpOpen(port)) === open)
-            return true;
-        await new Promise(resolve => setTimeout(resolve, 250));
-    } while (Date.now() < deadline);
-    return false;
-}
-function externalOrigin(req) {
-    const forwardedProto = String(req.headers['x-forwarded-proto'] ?? 'https')
-        .split(',')[0]
-        .trim();
-    const forwardedHost = String(req.headers['x-forwarded-host'] ?? req.headers.host ?? '')
-        .split(',')[0]
-        .trim();
-    return `${forwardedProto || 'https'}://${forwardedHost}`;
-}
-function localOrigin(targetPort) {
-    return `http://127.0.0.1:${targetPort}`;
-}
-function proxyHeaders(req, targetPort) {
-    const headers = { ...req.headers };
-    const publicHost = String(req.headers['x-forwarded-host'] ?? req.headers.host ?? '');
-    headers.host = `127.0.0.1:${targetPort}`;
-    if (publicHost)
-        headers['x-forwarded-host'] = publicHost;
-    headers['x-forwarded-proto'] = String(req.headers['x-forwarded-proto'] ?? 'https');
-    // Framework dev servers commonly apply the same allowlist to WebSocket Origin
-    // that they apply to Host. Present the local origin they were configured for.
-    if (headers.origin)
-        headers.origin = localOrigin(targetPort);
-    if (headers.referer) {
-        try {
-            const ref = new URL(headers.referer);
-            headers.referer = `${localOrigin(targetPort)}${ref.pathname}${ref.search}`;
-        }
-        catch {
-            // Preserve an unusual Referer rather than inventing one.
-        }
-    }
-    return headers;
-}
-function rewriteLocation(location, req, targetPort) {
-    if (!location)
-        return undefined;
-    const local = new RegExp(`^https?://(?:127\\.0\\.0\\.1|localhost)(?::${targetPort})?`, 'i');
-    return location.replace(local, externalOrigin(req));
-}
-function writeUpgradeRequest(upstream, req, head, targetPort) {
-    const headers = proxyHeaders(req, targetPort);
-    const lines = [`${req.method ?? 'GET'} ${req.url ?? '/'} HTTP/${req.httpVersion}`];
-    for (const [name, value] of Object.entries(headers)) {
-        if (value === undefined)
-            continue;
-        if (Array.isArray(value)) {
-            for (const item of value)
-                lines.push(`${name}: ${item}`);
-        }
-        else {
-            lines.push(`${name}: ${value}`);
-        }
-    }
-    upstream.write(`${lines.join('\r\n')}\r\n\r\n`);
-    if (head.length)
-        upstream.write(head);
-}
-/** Loopback reverse proxy with raw WebSocket tunnelling for Vite-style HMR. */
-export function createDevProxy(targetPort) {
-    return new Promise((resolve, reject) => {
-        const token = crypto.randomBytes(16).toString('hex');
-        const sockets = new Set();
-        const server = http.createServer((req, res) => {
-            if (req.headers['x-conductor-remote-bridge'] === token) {
-                res.writeHead(204);
-                return res.end();
-            }
-            const upstream = http.request({
-                host: '127.0.0.1',
-                port: targetPort,
-                method: req.method,
-                path: req.url,
-                headers: proxyHeaders(req, targetPort)
-            }, upstreamRes => {
-                const headers = { ...upstreamRes.headers };
-                const location = rewriteLocation(upstreamRes.headers.location, req, targetPort);
-                if (location)
-                    headers.location = location;
-                res.writeHead(upstreamRes.statusCode ?? 502, headers);
-                upstreamRes.pipe(res);
-            });
-            upstream.once('error', () => {
-                if (!res.headersSent)
-                    res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' });
-                res.end('Dev server is not reachable');
-            });
-            req.pipe(upstream);
-        });
-        server.on('connection', socket => {
-            sockets.add(socket);
-            socket.once('close', () => sockets.delete(socket));
-        });
-        server.on('upgrade', (req, socket, head) => {
-            const upstream = net.connect({ host: '127.0.0.1', port: targetPort }, () => {
-                writeUpgradeRequest(upstream, req, head, targetPort);
-                socket.pipe(upstream).pipe(socket);
-            });
-            sockets.add(upstream);
-            upstream.once('close', () => sockets.delete(upstream));
-            upstream.once('error', () => socket.destroy());
-            socket.once('error', () => upstream.destroy());
-        });
-        server.once('error', reject);
-        server.listen(0, '127.0.0.1', () => {
-            const address = server.address();
-            if (!address || typeof address === 'string') {
-                server.close();
-                return reject(new Error('could not allocate the dev-server bridge port'));
-            }
-            resolve({
-                port: address.port,
-                token,
-                close: () => new Promise(done => {
-                    for (const socket of sockets)
-                        socket.destroy();
-                    server.close(() => done());
-                })
-            });
-        });
-    });
-}
-export function serveProxyAt(status, port) {
-    for (const [origin, web] of Object.entries(status.Web ?? {})) {
-        if (!origin.endsWith(`:${port}`))
-            continue;
-        return web.Handlers?.['/']?.Proxy ?? null;
-    }
-    return null;
-}
-function servePorts(status) {
-    return new Set(Object.keys(status.TCP ?? {})
-        .map(Number)
-        .filter(validPort));
-}
-function chooseServePort(status, targetPort, reserved = new Set()) {
-    const used = servePorts(status);
-    for (let offset = 0; offset < 10; offset++) {
-        const candidate = targetPort + offset;
-        if (validPort(candidate) && !used.has(candidate) && !reserved.has(candidate))
-            return candidate;
-    }
-    for (let candidate = 49152; candidate <= 65535; candidate++) {
-        if (!used.has(candidate) && !reserved.has(candidate))
-            return candidate;
-    }
-    return null;
-}
-function previewPath(previewUrl) {
-    const url = new URL(previewUrl);
-    return `${url.pathname || '/'}${url.search}${url.hash}`;
-}
-function localPreviewUrl(port, suffix = '/') {
-    return `http://localhost:${port}${suffix}`;
-}
-function forwardUrl(record, previewUrl) {
-    const suffix = previewUrl ? previewPath(previewUrl) : record.path || '/';
-    return `https://${record.host}${record.servePort === 443 ? '' : `:${record.servePort}`}${suffix}`;
-}
 export class DevServerController {
     storeFile;
     advertisementDir;

package/dist-node/src/dev-server/ports.js

@@ -0,0 +1,63 @@
+import net from 'node:net';
+export function validPort(value) {
+    return Number.isInteger(value) && value > 0 && value <= 65535;
+}
+export function tcpOpen(port, timeoutMs = 300) {
+    return new Promise(resolve => {
+        const socket = net.connect({ host: '127.0.0.1', port });
+        const finish = (open) => {
+            socket.destroy();
+            resolve(open);
+        };
+        socket.setTimeout(timeoutMs);
+        socket.once('connect', () => finish(true));
+        socket.once('timeout', () => finish(false));
+        socket.once('error', () => finish(false));
+    });
+}
+export async function waitForPort(port, open, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    do {
+        if ((await tcpOpen(port)) === open)
+            return true;
+        await new Promise(resolve => setTimeout(resolve, 250));
+    } while (Date.now() < deadline);
+    return false;
+}
+export function serveProxyAt(status, port) {
+    for (const [origin, web] of Object.entries(status.Web ?? {})) {
+        if (!origin.endsWith(`:${port}`))
+            continue;
+        return web.Handlers?.['/']?.Proxy ?? null;
+    }
+    return null;
+}
+function servePorts(status) {
+    return new Set(Object.keys(status.TCP ?? {})
+        .map(Number)
+        .filter(validPort));
+}
+export function chooseServePort(status, targetPort, reserved = new Set()) {
+    const used = servePorts(status);
+    for (let offset = 0; offset < 10; offset++) {
+        const candidate = targetPort + offset;
+        if (validPort(candidate) && !used.has(candidate) && !reserved.has(candidate))
+            return candidate;
+    }
+    for (let candidate = 49152; candidate <= 65535; candidate++) {
+        if (!used.has(candidate) && !reserved.has(candidate))
+            return candidate;
+    }
+    return null;
+}
+export function previewPath(previewUrl) {
+    const url = new URL(previewUrl);
+    return `${url.pathname || '/'}${url.search}${url.hash}`;
+}
+export function localPreviewUrl(port, suffix = '/') {
+    return `http://localhost:${port}${suffix}`;
+}
+export function forwardUrl(record, previewUrl) {
+    const suffix = previewUrl ? previewPath(previewUrl) : record.path || '/';
+    return `https://${record.host}${record.servePort === 443 ? '' : `:${record.servePort}`}${suffix}`;
+}

package/dist-node/src/dev-server/processes.js

@@ -0,0 +1,73 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { validPort } from "./ports.js";
+const exec = promisify(execFile);
+export const PORT_SNAPSHOT_TTL_MS = 5000;
+export function processAlive(pid) {
+    if (!pid || !Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Parse a macOS `ps eww -axo command=` snapshot without ever logging it: process
+ * environments can contain credentials. Multiple processes are expected, but
+ * conflicting ports for one workspace are not safe to guess through.
+ */
+export function parseWorkspacePort(snapshot, workspaceId) {
+    const ports = new Set();
+    for (const line of snapshot.split('\n')) {
+        const id = line.match(/(?:^|\s)CONDUCTOR_WORKSPACE_ID=([^\s]+)/)?.[1];
+        if (id !== workspaceId)
+            continue;
+        const port = Number(line.match(/(?:^|\s)CONDUCTOR_PORT=(\d+)(?:\s|$)/)?.[1]);
+        if (validPort(port))
+            ports.add(port);
+    }
+    return ports.size === 1 ? [...ports][0] : null;
+}
+let portSnapshot = null;
+let portSnapshotInFlight = null;
+async function readProcesses() {
+    const { stdout } = await exec('ps', ['eww', '-axo', 'command='], {
+        encoding: 'utf8',
+        maxBuffer: 64 * 1024 * 1024,
+        timeout: 5000
+    });
+    portSnapshot = { at: Date.now(), text: stdout };
+    return stdout;
+}
+/**
+ * One `ps` snapshot shared by every workspace. It carries every process
+ * environment on the Mac (~650 kB here), and the phone polls this state every
+ * 2.5s per open chat, so a read reuses a recent one and simultaneous readers
+ * await the same child process. A workspace whose Run task is stopped has no
+ * port to remember, which is why the miss path needs this and not just the hit
+ * path. A start asks for `maxAgeMs` 0, because the task it just pressed is
+ * younger than any cached snapshot.
+ */
+function processSnapshot(maxAgeMs) {
+    if (maxAgeMs <= 0)
+        return readProcesses();
+    if (portSnapshot && Date.now() - portSnapshot.at <= maxAgeMs)
+        return Promise.resolve(portSnapshot.text);
+    portSnapshotInFlight ??= readProcesses().finally(() => {
+        portSnapshotInFlight = null;
+    });
+    return portSnapshotInFlight;
+}
+export async function workspacePort(workspaceId, maxAgeMs = 0) {
+    try {
+        return parseWorkspacePort(await processSnapshot(maxAgeMs), workspaceId);
+    }
+    catch {
+        // Never reflect the error: `execFile` includes stdout, which is the process
+        // environment snapshot and may contain secrets.
+        return null;
+    }
+}

package/dist-node/src/dev-server/proxy.js

@@ -0,0 +1,158 @@
+import crypto from 'node:crypto';
+import http, {} from 'node:http';
+import net from 'node:net';
+import { tcpOpen } from "./ports.js";
+import { processAlive } from "./processes.js";
+export function bridgeMatches(record) {
+    if (!record.bridgeToken) {
+        // Compatibility for the first local prototype receipts. PID plus an open
+        // bridge is enough to avoid stealing one during this upgrade; every newly
+        // written receipt carries the unambiguous challenge below.
+        return processAlive(record.ownerPid) ? tcpOpen(record.bridgePort) : Promise.resolve(false);
+    }
+    return new Promise(resolve => {
+        let settled = false;
+        const finish = (matches) => {
+            if (settled)
+                return;
+            settled = true;
+            request.destroy();
+            resolve(matches);
+        };
+        const request = http.request({
+            host: '127.0.0.1',
+            port: record.bridgePort,
+            method: 'GET',
+            path: '/',
+            headers: { 'x-conductor-remote-bridge': record.bridgeToken }
+        }, response => {
+            response.resume();
+            finish(response.statusCode === 204);
+        });
+        request.setTimeout(500, () => finish(false));
+        request.once('error', () => finish(false));
+        request.end();
+    });
+}
+function externalOrigin(req) {
+    const forwardedProto = String(req.headers['x-forwarded-proto'] ?? 'https')
+        .split(',')[0]
+        .trim();
+    const forwardedHost = String(req.headers['x-forwarded-host'] ?? req.headers.host ?? '')
+        .split(',')[0]
+        .trim();
+    return `${forwardedProto || 'https'}://${forwardedHost}`;
+}
+function localOrigin(targetPort) {
+    return `http://127.0.0.1:${targetPort}`;
+}
+function proxyHeaders(req, targetPort) {
+    const headers = { ...req.headers };
+    const publicHost = String(req.headers['x-forwarded-host'] ?? req.headers.host ?? '');
+    headers.host = `127.0.0.1:${targetPort}`;
+    if (publicHost)
+        headers['x-forwarded-host'] = publicHost;
+    headers['x-forwarded-proto'] = String(req.headers['x-forwarded-proto'] ?? 'https');
+    // Framework dev servers commonly apply the same allowlist to WebSocket Origin
+    // that they apply to Host. Present the local origin they were configured for.
+    if (headers.origin)
+        headers.origin = localOrigin(targetPort);
+    if (headers.referer) {
+        try {
+            const ref = new URL(headers.referer);
+            headers.referer = `${localOrigin(targetPort)}${ref.pathname}${ref.search}`;
+        }
+        catch {
+            // Preserve an unusual Referer rather than inventing one.
+        }
+    }
+    return headers;
+}
+function rewriteLocation(location, req, targetPort) {
+    if (!location)
+        return undefined;
+    const local = new RegExp(`^https?://(?:127\\.0\\.0\\.1|localhost)(?::${targetPort})?`, 'i');
+    return location.replace(local, externalOrigin(req));
+}
+function writeUpgradeRequest(upstream, req, head, targetPort) {
+    const headers = proxyHeaders(req, targetPort);
+    const lines = [`${req.method ?? 'GET'} ${req.url ?? '/'} HTTP/${req.httpVersion}`];
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined)
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                lines.push(`${name}: ${item}`);
+        }
+        else {
+            lines.push(`${name}: ${value}`);
+        }
+    }
+    upstream.write(`${lines.join('\r\n')}\r\n\r\n`);
+    if (head.length)
+        upstream.write(head);
+}
+/** Loopback reverse proxy with raw WebSocket tunnelling for Vite-style HMR. */
+export function createDevProxy(targetPort) {
+    return new Promise((resolve, reject) => {
+        const token = crypto.randomBytes(16).toString('hex');
+        const sockets = new Set();
+        const server = http.createServer((req, res) => {
+            if (req.headers['x-conductor-remote-bridge'] === token) {
+                res.writeHead(204);
+                return res.end();
+            }
+            const upstream = http.request({
+                host: '127.0.0.1',
+                port: targetPort,
+                method: req.method,
+                path: req.url,
+                headers: proxyHeaders(req, targetPort)
+            }, upstreamRes => {
+                const headers = { ...upstreamRes.headers };
+                const location = rewriteLocation(upstreamRes.headers.location, req, targetPort);
+                if (location)
+                    headers.location = location;
+                res.writeHead(upstreamRes.statusCode ?? 502, headers);
+                upstreamRes.pipe(res);
+            });
+            upstream.once('error', () => {
+                if (!res.headersSent)
+                    res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' });
+                res.end('Dev server is not reachable');
+            });
+            req.pipe(upstream);
+        });
+        server.on('connection', socket => {
+            sockets.add(socket);
+            socket.once('close', () => sockets.delete(socket));
+        });
+        server.on('upgrade', (req, socket, head) => {
+            const upstream = net.connect({ host: '127.0.0.1', port: targetPort }, () => {
+                writeUpgradeRequest(upstream, req, head, targetPort);
+                socket.pipe(upstream).pipe(socket);
+            });
+            sockets.add(upstream);
+            upstream.once('close', () => sockets.delete(upstream));
+            upstream.once('error', () => socket.destroy());
+            socket.once('error', () => upstream.destroy());
+        });
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            if (!address || typeof address === 'string') {
+                server.close();
+                return reject(new Error('could not allocate the dev-server bridge port'));
+            }
+            resolve({
+                port: address.port,
+                token,
+                close: () => new Promise(done => {
+                    for (const socket of sockets)
+                        socket.destroy();
+                    server.close(() => done());
+                })
+            });
+        });
+    });
+}