conductor-remote 1.9.0 → 1.9.1

package/src/config.ts

@@ -1,81 +0,0 @@
-import crypto from 'node:crypto'
-import fs from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import type { WriteStrategy } from './writes.ts'
-
-const home = os.homedir()
-
-export interface Config {
-	/** Path to Conductor's live SQLite state DB (read-only source of truth for reads). */
-	dbPath: string
-	/** Root under which Conductor lays out per-workspace git worktrees. */
-	workspacesRoot: string
-	/** TCP port the relay listens on. */
-	port: number
-	/** Host to bind. Loopback by default; the tailnet-facing URL is fronted by `tailscale serve`. Override with RELAY_HOST. */
-	host: string
-	/** Shared secret required on every /api/* request. Auto-generated if unset. */
-	token: string
-	/** Prompt delivery strategy: 'applescript' (default, focused session) or 'sidecar' (precise per-session IPC). */
-	writeStrategy: WriteStrategy
-	/** Directory of built PWA assets to serve. */
-	publicDir: string
-}
-
-/** Where a generated token is persisted so a phone's saved URL stays valid across relay restarts. */
-function tokenStorePath(): string {
-	return path.join(home, 'Library', 'Application Support', 'conductor-remote', 'token')
-}
-
-/**
- * Stable shared secret. Explicit `RELAY_TOKEN` wins; otherwise reuse a persisted token (or mint and
- * persist one). Persistence matters for the daemon: a KeepAlive restart must not invalidate the URL
- * the user added to their home screen.
- */
-function resolveToken(): string {
-	if (process.env.RELAY_TOKEN) return process.env.RELAY_TOKEN
-	const file = tokenStorePath()
-	try {
-		const existing = fs.readFileSync(file, 'utf8').trim()
-		if (existing) return existing
-	} catch {
-		// no persisted token yet — mint one below
-	}
-	const token = crypto.randomBytes(16).toString('hex')
-	try {
-		fs.mkdirSync(path.dirname(file), { recursive: true })
-		fs.writeFileSync(file, token, { mode: 0o600 })
-	} catch (err) {
-		console.warn(`⚠ could not persist token (${err instanceof Error ? err.message : err}); it will rotate on restart`)
-	}
-	return token
-}
-
-/** The relay serves the Vite build. Warn early if it hasn't been built yet. */
-function resolvePublicDir(): string {
-	const dist = path.join(import.meta.dirname, '..', 'dist')
-	if (!fs.existsSync(path.join(dist, 'index.html'))) {
-		console.warn(
-			'⚠ dist/ not built — run `yarn build` (or `yarn preview`). The API works; the PWA will 404 until then.'
-		)
-	}
-	return dist
-}
-
-export function loadConfig(): Config {
-	// Bind loopback; `tailscale serve` (wired by `yarn deploy`) fronts it with a stable HTTPS tailnet URL.
-	const host = process.env.RELAY_HOST ?? '127.0.0.1'
-	const writeStrategy: WriteStrategy = process.env.WRITE_STRATEGY === 'sidecar' ? 'sidecar' : 'applescript'
-	return {
-		dbPath:
-			process.env.CONDUCTOR_DB ??
-			path.join(home, 'Library', 'Application Support', 'com.conductor.app', 'conductor.db'),
-		workspacesRoot: process.env.CONDUCTOR_WORKSPACES ?? path.join(home, 'conductor', 'workspaces'),
-		port: Number(process.env.RELAY_PORT ?? 8787),
-		host,
-		token: resolveToken(),
-		writeStrategy,
-		publicDir: resolvePublicDir()
-	}
-}

package/src/db.ts

@@ -1,38 +0,0 @@
-import { DatabaseSync } from 'node:sqlite'
-
-/**
- * Read-only handle to Conductor's SQLite DB.
- *
- * The desktop app holds the same file open in WAL mode; a second read-only
- * connection sees every committed write without blocking the app. We never
- * write through this handle — writes go through the actuator (see writes.ts).
- */
-export class ConductorDb {
-	private readonly dbPath: string
-	private db: DatabaseSync
-
-	constructor(dbPath: string) {
-		this.dbPath = dbPath
-		this.db = this.open()
-	}
-
-	private open(): DatabaseSync {
-		const db = new DatabaseSync(this.dbPath, { readOnly: true })
-		try {
-			db.exec('PRAGMA busy_timeout = 2000')
-		} catch {
-			// read-only connections may reject some pragmas; harmless
-		}
-		return db
-	}
-
-	query<T = Record<string, unknown>>(sql: string, params: unknown[] = []): T[] {
-		try {
-			return this.db.prepare(sql).all(...(params as never[])) as T[]
-		} catch {
-			// If the DB file was swapped underneath us (app update), reopen once.
-			this.db = this.open()
-			return this.db.prepare(sql).all(...(params as never[])) as T[]
-		}
-	}
-}

package/src/git.ts

@@ -1,116 +0,0 @@
-import { execFile } from 'node:child_process'
-import { promisify } from 'node:util'
-
-const exec = promisify(execFile)
-
-export interface DiffFile {
-	path: string
-	added: number
-	removed: number
-}
-
-export interface WorkspaceDiff {
-	base: string
-	mergeBase: string | null
-	files: DiffFile[]
-	patch: string
-	truncated: boolean
-}
-
-const MAX_PATCH_BYTES = 400_000
-
-async function git(cwd: string, args: string[]): Promise<string> {
-	const { stdout } = await exec('git', ['-C', cwd, ...args], {
-		encoding: 'utf8',
-		maxBuffer: 8 * 1024 * 1024,
-		timeout: 15000
-	})
-	return stdout
-}
-
-/**
- * Patch for untracked files. `git diff` ignores them, but a reviewer wants to
- * see new files — so we synthesize a "new file" diff via `--no-index` against
- * /dev/null. This never touches the index (no `add -N`), so the live worktree
- * the agent is using is left untouched.
- */
-async function untrackedDiff(cwd: string): Promise<{ files: DiffFile[]; patch: string }> {
-	let listing = ''
-	try {
-		listing = await git(cwd, ['ls-files', '--others', '--exclude-standard'])
-	} catch {
-		return { files: [], patch: '' }
-	}
-	const paths = listing.split('\n').filter(Boolean)
-	const files: DiffFile[] = []
-	const patches: string[] = []
-	for (const p of paths) {
-		try {
-			// --no-index exits 1 when files differ, so read stdout from the error.
-			await exec('git', ['-C', cwd, 'diff', '--no-index', '--no-color', '--', '/dev/null', p], {
-				encoding: 'utf8',
-				maxBuffer: 4 * 1024 * 1024,
-				timeout: 10000
-			})
-		} catch (err) {
-			const out = (err as { stdout?: string }).stdout ?? ''
-			if (!out) continue
-			const added = out.split('\n').filter(l => l.startsWith('+') && !l.startsWith('+++')).length
-			files.push({ path: p, added, removed: 0 })
-			patches.push(out)
-		}
-	}
-	return { files, patch: patches.join('') }
-}
-
-/** Resolve the base ref, preferring the remote-tracking form if it exists. */
-async function resolveBase(cwd: string, base: string): Promise<string> {
-	for (const ref of [`origin/${base}`, base]) {
-		try {
-			await git(cwd, ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`])
-			return ref
-		} catch {
-			// try next
-		}
-	}
-	return base
-}
-
-/**
- * Everything the workspace changed relative to its target branch — committed
- * plus uncommitted — which is what a reviewer wants to see. Computed straight
- * from the worktree, so it's independent of Conductor entirely.
- */
-export async function workspaceDiff(worktree: string, base: string): Promise<WorkspaceDiff> {
-	const ref = await resolveBase(worktree, base)
-	let mergeBase: string | null = null
-	try {
-		mergeBase = (await git(worktree, ['merge-base', ref, 'HEAD'])).trim()
-	} catch {
-		mergeBase = null
-	}
-	const against = mergeBase ?? ref
-
-	const numstat = await git(worktree, ['diff', '--numstat', against]).catch(() => '')
-	const files: DiffFile[] = numstat
-		.split('\n')
-		.filter(Boolean)
-		.map(line => {
-			const [added, removed, ...rest] = line.split('\t')
-			return {
-				path: rest.join('\t'),
-				added: added === '-' ? 0 : Number(added),
-				removed: removed === '-' ? 0 : Number(removed)
-			}
-		})
-
-	const trackedPatch = await git(worktree, ['diff', against]).catch(() => '')
-	const untracked = await untrackedDiff(worktree)
-	files.push(...untracked.files)
-
-	let patch = trackedPatch + untracked.patch
-	const truncated = patch.length > MAX_PATCH_BYTES
-	if (truncated) patch = `${patch.slice(0, MAX_PATCH_BYTES)}\n\n… diff truncated (${patch.length} bytes) …`
-
-	return { base: ref, mergeBase, files, patch, truncated }
-}

package/src/icons.ts

@@ -1,66 +0,0 @@
-import fs from 'node:fs'
-import path from 'node:path'
-
-/**
- * Repo-icon resolution, mirroring Conductor's own logic so the phone sidebar shows
- * the same avatar as the desktop app. Conductor looks for a known icon filename in
- * the repository root and uses the first match — see
- * https://www.conductor.build/docs/faq#where-does-conductor-get-the-repo-icon
- *
- * This reads from the repo's root checkout (the shared, canonical tree), not a
- * per-workspace worktree, so every workspace of a repo resolves to one icon.
- */
-const ICON_CANDIDATES = [
-	'public/apple-touch-icon.png',
-	'apple-touch-icon.png',
-	'public/favicon.svg',
-	'favicon.svg',
-	'public/favicon.png',
-	'public/icon.png',
-	'public/logo.png',
-	'favicon.png',
-	'app/icon.png',
-	'src/app/icon.png',
-	'public/favicon.ico',
-	'favicon.ico',
-	'app/favicon.ico',
-	'static/favicon.ico',
-	'src-tauri/icons/icon.png',
-	'assets/icon.png',
-	'src/assets/icon.png'
-]
-
-const CONTENT_TYPES: Record<string, string> = {
-	'.png': 'image/png',
-	'.svg': 'image/svg+xml',
-	'.ico': 'image/x-icon'
-}
-
-export interface ResolvedIcon {
-	/** Absolute path to the icon file on disk. */
-	path: string
-	contentType: string
-}
-
-// Icons rarely change; a short TTL keeps the 2.5s state poll from stat-storming the
-// disk while still picking up a freshly-added icon within a tick or two.
-const TTL_MS = 30_000
-const cache = new Map<string, { at: number; icon: ResolvedIcon | null }>()
-
-/** First matching icon under `repoRoot`, or null if the repo has none. Cached per root. */
-export function resolveRepoIcon(repoRoot: string): ResolvedIcon | null {
-	const now = Date.now()
-	const hit = cache.get(repoRoot)
-	if (hit && now - hit.at < TTL_MS) return hit.icon
-
-	let icon: ResolvedIcon | null = null
-	for (const rel of ICON_CANDIDATES) {
-		const abs = path.join(repoRoot, rel)
-		if (fs.existsSync(abs)) {
-			icon = { path: abs, contentType: CONTENT_TYPES[path.extname(abs).toLowerCase()] ?? 'application/octet-stream' }
-			break
-		}
-	}
-	cache.set(repoRoot, { at: now, icon })
-	return icon
-}

package/src/reads.ts

@@ -1,178 +0,0 @@
-import { execFileSync } from 'node:child_process'
-import fs from 'node:fs'
-import path from 'node:path'
-import type { ConductorDb } from './db.ts'
-import { type ResolvedIcon, resolveRepoIcon } from './icons.ts'
-import { parseMessage, type TranscriptEntry } from './transcript.ts'
-
-export interface WorkspaceRow {
-	id: string
-	directory_name: string | null
-	workspace_name: string | null
-	branch: string | null
-	derived_status: string | null
-	manual_status: string | null
-	created_at: string
-	updated_at: string
-	unread: number | null
-	pinned_at: string | null
-	active_session_id: string | null
-	intended_target_branch: string | null
-	repo_name: string | null
-	repo_root: string | null
-	default_branch: string | null
-	session_status: string | null
-	session_title: string | null
-	model: string | null
-	context_used_percent: number | null
-}
-
-export interface SessionRow {
-	id: string
-	status: string | null
-	title: string | null
-	model: string | null
-	permission_mode: string | null
-	context_used_percent: number | null
-	unread_count: number | null
-	created_at: string
-	updated_at: string
-	last_user_message_at: string | null
-}
-
-export interface Workspace extends WorkspaceRow {
-	/** Absolute path to the git worktree on disk, or null if it can't be resolved. */
-	worktree: string | null
-	baseBranch: string
-	/** Whether the repo has a resolvable icon (fetch it from `/api/repos/:name/icon`). */
-	hasRepoIcon: boolean
-}
-
-const worktreeCache = new Map<string, string | null>()
-
-/**
- * Resolve a workspace's worktree path. Conductor lays worktrees out as
- * `<workspacesRoot>/<repoName>/<directoryName>`, but we verify against
- * `git worktree list` (matched by branch) so a layout change can't silently
- * point us at the wrong tree.
- */
-function resolveWorktree(
-	workspacesRoot: string,
-	repoName: string | null,
-	directoryName: string | null,
-	branch: string | null,
-	repoRoot: string | null
-): string | null {
-	if (repoName && directoryName) {
-		const guess = path.join(workspacesRoot, repoName, directoryName)
-		if (fs.existsSync(path.join(guess, '.git'))) return guess
-	}
-	if (!(repoRoot && branch)) return null
-	const cacheKey = repoRoot
-	let listing = worktreeCache.get(cacheKey)
-	if (listing === undefined) {
-		try {
-			listing = execFileSync('git', ['-C', repoRoot, 'worktree', 'list', '--porcelain'], {
-				encoding: 'utf8',
-				timeout: 5000
-			})
-		} catch {
-			listing = null
-		}
-		worktreeCache.set(cacheKey, listing)
-	}
-	if (!listing) return null
-	// Porcelain: blocks of "worktree <path>" / "branch refs/heads/<name>"
-	const blocks = listing.split('\n\n')
-	for (const block of blocks) {
-		if (block.includes(`refs/heads/${branch}`)) {
-			const m = block.match(/^worktree (.+)$/m)
-			if (m) return m[1]
-		}
-	}
-	return null
-}
-
-export class Reads {
-	private readonly db: ConductorDb
-	private readonly workspacesRoot: string
-
-	constructor(db: ConductorDb, workspacesRoot: string) {
-		this.db = db
-		this.workspacesRoot = workspacesRoot
-	}
-
-	listWorkspaces(): Workspace[] {
-		const rows = this.db.query<WorkspaceRow>(
-			`SELECT w.id, w.directory_name, w.workspace_name, w.branch, w.derived_status, w.manual_status,
-			        w.created_at, w.updated_at, w.unread, w.pinned_at, w.active_session_id, w.intended_target_branch,
-			        r.name AS repo_name, r.root_path AS repo_root, r.default_branch AS default_branch,
-			        s.status AS session_status, s.title AS session_title, s.model AS model,
-			        s.context_used_percent AS context_used_percent
-			 FROM workspaces w
-			 LEFT JOIN repos r ON r.id = w.repository_id
-			 LEFT JOIN sessions s ON s.id = w.active_session_id
-			 WHERE w.state = 'ready'
-			 ORDER BY (w.pinned_at IS NULL), w.updated_at DESC`
-		)
-		return rows.map(r => ({
-			...r,
-			worktree: resolveWorktree(this.workspacesRoot, r.repo_name, r.directory_name, r.branch, r.repo_root),
-			baseBranch: r.intended_target_branch || r.default_branch || 'main',
-			hasRepoIcon: !!(r.repo_root && resolveRepoIcon(r.repo_root))
-		}))
-	}
-
-	getWorkspace(id: string): Workspace | null {
-		return this.listWorkspaces().find(w => w.id === id) ?? null
-	}
-
-	/** Resolve a repo's icon by its name (the sidebar avatar) — null if the repo or icon is unknown. */
-	resolveRepoIcon(repoName: string): ResolvedIcon | null {
-		const rows = this.db.query<{ root_path: string | null }>('SELECT root_path FROM repos WHERE name = ? LIMIT 1', [
-			repoName
-		])
-		const root = rows[0]?.root_path
-		return root ? resolveRepoIcon(root) : null
-	}
-
-	listSessions(workspaceId: string): SessionRow[] {
-		// created_at ASC keeps tab order stable (matches the desktop app) instead of jumping on activity.
-		return this.db.query<SessionRow>(
-			`SELECT id, status, title, model, permission_mode, context_used_percent, unread_count,
-			        created_at, updated_at, last_user_message_at
-			 FROM sessions
-			 WHERE workspace_id = ? AND COALESCE(is_hidden, 0) = 0
-			 ORDER BY created_at ASC`,
-			[workspaceId]
-		)
-	}
-
-	/** Incremental transcript fetch. `afterRowid` is the cursor from a prior call. */
-	getMessages(sessionId: string, afterRowid = 0): { entries: TranscriptEntry[]; cursor: number } {
-		const rows = this.db.query<{
-			rowid: number
-			id: string
-			role: string | null
-			content: string | null
-			full_message: string | null
-			created_at: string
-			sent_at: string | null
-			queue_order: number | null
-		}>(
-			`SELECT rowid, id, role, content, full_message, created_at, sent_at, queue_order
-			 FROM session_messages
-			 WHERE session_id = ? AND rowid > ?
-			 ORDER BY rowid ASC`,
-			[sessionId, afterRowid]
-		)
-		const entries: TranscriptEntry[] = []
-		let cursor = afterRowid
-		for (const row of rows) {
-			cursor = row.rowid
-			const entry = parseMessage(row)
-			if (entry) entries.push(entry)
-		}
-		return { entries, cursor }
-	}
-}

package/src/server.ts

@@ -1,194 +0,0 @@
-import crypto from 'node:crypto'
-import fs from 'node:fs'
-import http from 'node:http'
-import path from 'node:path'
-import { startAutoUpdate, updateStatus } from './autoupdate.ts'
-import { loadConfig } from './config.ts'
-import { ConductorDb } from './db.ts'
-import { workspaceDiff } from './git.ts'
-import { Reads } from './reads.ts'
-import { describeActuator, newChat, pickActuator } from './writes.ts'
-
-const cfg = loadConfig()
-const db = new ConductorDb(cfg.dbPath)
-const reads = new Reads(db, cfg.workspacesRoot)
-const actuator = pickActuator(cfg.writeStrategy)
-
-const MIME: Record<string, string> = {
-	'.html': 'text/html; charset=utf-8',
-	'.js': 'text/javascript; charset=utf-8',
-	'.css': 'text/css; charset=utf-8',
-	'.json': 'application/json; charset=utf-8',
-	'.webmanifest': 'application/manifest+json; charset=utf-8',
-	'.svg': 'image/svg+xml',
-	'.png': 'image/png'
-}
-
-function json(res: http.ServerResponse, status: number, body: unknown): void {
-	const payload = JSON.stringify(body)
-	res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
-	res.end(payload)
-}
-
-/** Constant-time string compare — the token is the sole internet-facing gate when exposed via Funnel. */
-function tokenEq(candidate: string | null): boolean {
-	if (candidate == null) return false
-	const a = Buffer.from(candidate)
-	const b = Buffer.from(cfg.token)
-	return a.length === b.length && crypto.timingSafeEqual(a, b)
-}
-
-function authed(req: http.IncomingMessage): boolean {
-	const auth = req.headers.authorization
-	if (auth?.startsWith('Bearer ')) return tokenEq(auth.slice('Bearer '.length))
-	const url = new URL(req.url ?? '/', 'http://x')
-	return tokenEq(url.searchParams.get('token'))
-}
-
-async function readBody(req: http.IncomingMessage): Promise<string> {
-	const chunks: Buffer[] = []
-	for await (const c of req) chunks.push(c as Buffer)
-	return Buffer.concat(chunks).toString('utf8')
-}
-
-/** Hashed Vite assets are immutable and cache-forever; the shell/SW must never go stale. */
-function cacheControl(rel: string): string {
-	if (rel.startsWith('assets/')) return 'public, max-age=31536000, immutable'
-	return 'no-cache'
-}
-
-function serveStatic(_req: http.IncomingMessage, res: http.ServerResponse, pathname: string): void {
-	const rel = pathname === '/' ? 'index.html' : pathname.replace(/^\/+/, '')
-	const filePath = path.join(cfg.publicDir, rel)
-	// Contain to publicDir.
-	if (!filePath.startsWith(cfg.publicDir)) {
-		res.writeHead(403).end()
-		return
-	}
-	fs.readFile(filePath, (err, data) => {
-		if (err) {
-			// SPA fallback to shell.
-			fs.readFile(path.join(cfg.publicDir, 'index.html'), (e2, shell) => {
-				if (e2) return void res.writeHead(404).end('not found')
-				res.writeHead(200, { 'content-type': MIME['.html'], 'cache-control': 'no-cache' })
-				res.end(shell)
-			})
-			return
-		}
-		const ext = path.extname(filePath)
-		res.writeHead(200, { 'content-type': MIME[ext] ?? 'application/octet-stream', 'cache-control': cacheControl(rel) })
-		res.end(data)
-	})
-}
-
-const server = http.createServer(async (req, res) => {
-	const url = new URL(req.url ?? '/', 'http://x')
-	const { pathname } = url
-
-	if (!pathname.startsWith('/api/')) return serveStatic(req, res, pathname)
-
-	// Everything under /api requires the shared secret.
-	if (!authed(req)) return json(res, 401, { error: 'unauthorized' })
-
-	try {
-		// GET /api/state — workspace list with active-session status
-		if (req.method === 'GET' && pathname === '/api/state') {
-			const update = updateStatus()
-			return json(res, 200, {
-				workspaces: reads.listWorkspaces(),
-				actuator: await describeActuator(actuator),
-				version: update.current,
-				update
-			})
-		}
-
-		// GET /api/repos/:name/icon — the repo's resolved sidebar icon (see src/icons.ts)
-		let m = pathname.match(/^\/api\/repos\/([^/]+)\/icon$/)
-		if (req.method === 'GET' && m) {
-			const icon = reads.resolveRepoIcon(decodeURIComponent(m[1]))
-			if (!icon) return json(res, 404, { error: 'no icon' })
-			return void fs.readFile(icon.path, (err, data) => {
-				if (err) return void json(res, 404, { error: 'no icon' })
-				// Cache briefly on the phone; the resolver itself refreshes within ~30s of an icon change.
-				res.writeHead(200, { 'content-type': icon.contentType, 'cache-control': 'public, max-age=300' })
-				res.end(data)
-			})
-		}
-
-		// GET /api/workspaces/:id/sessions
-		m = pathname.match(/^\/api\/workspaces\/([^/]+)\/sessions$/)
-		if (req.method === 'GET' && m) {
-			return json(res, 200, { sessions: reads.listSessions(decodeURIComponent(m[1])) })
-		}
-
-		// POST /api/workspaces/:id/sessions — open a new chat (Cmd+T) in the workspace
-		if (req.method === 'POST' && m) {
-			const workspaceId = decodeURIComponent(m[1])
-			const ws = reads.getWorkspace(workspaceId)
-			if (!ws) return json(res, 404, { error: 'workspace not found' })
-			const before = new Set(reads.listSessions(workspaceId).map(s => s.id))
-			const result = await newChat(ws)
-			if (!result.ok) return json(res, 502, result)
-			// The new session lands in the DB a beat after Cmd+T — poll for the fresh id.
-			let sessionId: string | null = null
-			for (let i = 0; i < 12 && !sessionId; i++) {
-				await new Promise(r => setTimeout(r, 500))
-				sessionId = reads.listSessions(workspaceId).find(s => !before.has(s.id))?.id ?? null
-			}
-			return json(res, 200, { ok: true, sessionId })
-		}
-
-		// GET /api/workspaces/:id/diff
-		m = pathname.match(/^\/api\/workspaces\/([^/]+)\/diff$/)
-		if (req.method === 'GET' && m) {
-			const ws = reads.getWorkspace(decodeURIComponent(m[1]))
-			if (!ws) return json(res, 404, { error: 'workspace not found' })
-			if (!ws.worktree) return json(res, 409, { error: 'worktree path unresolved' })
-			const diff = await workspaceDiff(ws.worktree, ws.baseBranch)
-			return json(res, 200, diff)
-		}
-
-		// GET /api/sessions/:id/messages?after=<rowid>
-		m = pathname.match(/^\/api\/sessions\/([^/]+)\/messages$/)
-		if (req.method === 'GET' && m) {
-			const after = Number(url.searchParams.get('after') ?? 0)
-			return json(res, 200, reads.getMessages(decodeURIComponent(m[1]), Number.isFinite(after) ? after : 0))
-		}
-
-		// POST /api/sessions/:id/prompt  { text }
-		m = pathname.match(/^\/api\/sessions\/([^/]+)\/prompt$/)
-		if (req.method === 'POST' && m) {
-			const sessionId = decodeURIComponent(m[1])
-			const body = JSON.parse((await readBody(req)) || '{}') as { text?: string; workspaceId?: string }
-			const text = (body.text ?? '').trim()
-			if (!text) return json(res, 400, { error: 'empty prompt' })
-			const ws = body.workspaceId
-				? reads.getWorkspace(body.workspaceId)
-				: (reads.listWorkspaces().find(w => w.active_session_id === sessionId) ?? null)
-			if (!ws) return json(res, 404, { error: 'workspace for session not found' })
-			const result = await actuator.send({ workspace: ws, sessionId }, text)
-			return json(res, result.ok ? 200 : 502, result)
-		}
-
-		return json(res, 404, { error: 'no route', pathname })
-	} catch (err) {
-		return json(res, 500, { error: err instanceof Error ? err.message : String(err) })
-	}
-})
-
-server.listen(cfg.port, cfg.host, () => {
-	console.info(
-		[
-			'conductor-remote relay up',
-			`  db:         ${cfg.dbPath}`,
-			`  worktrees:  ${cfg.workspacesRoot}`,
-			`  actuator:   ${actuator.name}`,
-			`  bound:      ${cfg.host}:${cfg.port}`,
-			'',
-			`  Local:  http://${cfg.host}:${cfg.port}/#token=${cfg.token}`,
-			'  Phone:  fronted by `tailscale funnel`/`serve` — run `yarn service status` for the HTTPS URL'
-		].join('\n')
-	)
-	// Keep the managed global daemon current — no-ops for dev checkouts / unmanaged runs (see autoupdate.ts).
-	startAutoUpdate()
-})