crewdesk 0.1.0

package/apps/server/dist/cli.js

@@ -0,0 +1,2050 @@
+import { createRequire as __cr } from 'node:module'; const require = __cr(import.meta.url);
+
+// src/cli.ts
+import { exec, execSync } from "node:child_process";
+import fs8 from "node:fs";
+import path8 from "node:path";
+import readline from "node:readline/promises";
+import { fileURLToPath } from "node:url";
+
+// src/config.ts
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { z as z2 } from "zod";
+
+// ../../packages/shared/src/types.ts
+var AGENT_STATUSES = [
+  "STARTING",
+  "WORKING",
+  "WAITING",
+  "QUESTION",
+  "PERMISSION",
+  "ERROR",
+  "COMPLETED",
+  "OFFLINE"
+];
+var EVENT_TYPES = [
+  "session.started",
+  "session.updated",
+  "session.stopped",
+  "question.created",
+  "question.answered",
+  "question.cancelled",
+  "permission.created",
+  "permission.approved",
+  "permission.denied",
+  "prompt.created",
+  "prompt.sent",
+  "prompt.cancelled",
+  "notification.created",
+  "task.started",
+  "task.completed",
+  "task.failed"
+];
+var REQUEST_EVENT_TYPES = ["permission.created", "question.created", "prompt.created"];
+var EVENT_STATUSES = ["PENDING", "PROCESSING", "RESOLVED", "CANCELLED", "FAILED"];
+var PRIORITIES = ["LOW", "NORMAL", "HIGH", "CRITICAL"];
+var RESPONSE_ACTIONS = ["allow", "deny", "answer", "prompt", "dismiss"];
+
+// ../../packages/shared/src/schemas.ts
+import { z } from "zod";
+var SessionIdSchema = z.string().min(1).max(128).regex(/^[A-Za-z0-9_.:-]+$/, "invalid session id");
+var EventIdSchema = z.string().min(1).max(64).regex(/^evt_[0-9A-Z]{26}$/, "invalid event id");
+var AgentIdSchema = z.string().min(1).max(64).regex(/^agent_[0-9A-Z]{26}$/, "invalid agent id");
+var RegisterAgentSchema = z.object({
+  sessionId: SessionIdSchema,
+  name: z.string().min(1).max(100).optional(),
+  project: z.string().max(200).optional(),
+  cwd: z.string().max(1e3).optional(),
+  pid: z.number().int().positive().optional(),
+  account: z.string().max(200).optional(),
+  source: z.string().max(50).optional()
+});
+var UpdateAgentSchema = z.object({
+  name: z.string().min(1).max(100).optional(),
+  status: z.enum(AGENT_STATUSES).optional(),
+  activity: z.string().max(500).nullable().optional()
+}).strict();
+var HeartbeatSchema = z.object({
+  sessionId: SessionIdSchema,
+  status: z.enum(AGENT_STATUSES).optional(),
+  activity: z.string().max(500).nullable().optional()
+});
+var CreateEventSchema = z.object({
+  sessionId: SessionIdSchema,
+  type: z.enum(EVENT_TYPES),
+  message: z.string().max(2e4).optional(),
+  priority: z.enum(PRIORITIES).optional(),
+  payload: z.record(z.string(), z.unknown()).optional(),
+  /** Optional agent metadata so an event can implicitly register its session. */
+  agent: RegisterAgentSchema.omit({ sessionId: true }).optional()
+});
+var RespondSchema = z.object({
+  action: z.enum(RESPONSE_ACTIONS),
+  /** Must match the event's session when supplied (wrong-session protection). */
+  sessionId: SessionIdSchema.optional(),
+  response: z.string().max(2e4).optional(),
+  /** Alias accepted for compatibility with the spec's `answer` field. */
+  answer: z.string().max(2e4).optional(),
+  answers: z.record(z.string(), z.string().max(2e4)).optional(),
+  source: z.enum(["dashboard", "terminal", "policy", "system"]).optional(),
+  /** Required for destructive permissions when action=allow. */
+  confirm: z.boolean().optional()
+});
+var CancelSchema = z.object({
+  sessionId: SessionIdSchema.optional(),
+  reason: z.string().max(1e3).optional()
+});
+var ListEventsQuerySchema = z.object({
+  status: z.string().transform((s) => s.toUpperCase()).pipe(z.enum(EVENT_STATUSES)).optional(),
+  type: z.string().max(50).optional(),
+  agent: z.string().max(64).optional(),
+  session: SessionIdSchema.optional(),
+  project: z.string().max(200).optional(),
+  q: z.string().max(200).optional(),
+  limit: z.coerce.number().int().min(1).max(1e3).optional(),
+  before: z.string().max(64).optional()
+});
+var WaitQuerySchema = z.object({
+  sessionId: SessionIdSchema,
+  timeout: z.coerce.number().int().min(0).max(6e4).optional()
+});
+var PolicyRuleSchema = z.object({
+  /** Tool name glob, e.g. "Bash", "Write", "mcp__*". Defaults to any tool. */
+  tool: z.string().min(1).max(200).optional(),
+  /** Glob matched against the operation summary (the command for Bash, path for file tools). */
+  match: z.string().min(1).max(1e3),
+  action: z.enum(["allow", "deny", "ask"]),
+  reason: z.string().max(500).optional()
+});
+var PolicyFileSchema = z.object({
+  permissions: z.array(PolicyRuleSchema).default([])
+});
+
+// ../../packages/shared/src/operations.ts
+function globToRegExp(glob) {
+  let re = "";
+  for (const ch of glob) {
+    if (ch === "*") re += ".*";
+    else if (ch === "?") re += ".";
+    else re += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${re}$`, "s");
+}
+function globMatch(glob, value) {
+  return globToRegExp(glob).test(value);
+}
+
+// ../../packages/shared/src/index.ts
+var DEFAULT_PORT = 7777;
+var DEFAULT_HOST = "127.0.0.1";
+
+// src/config.ts
+var LOG_LEVELS = ["error", "warn", "info", "debug"];
+var ConfigFileSchema = z2.object({
+  port: z2.number().int().min(1).max(65535),
+  host: z2.string().min(1),
+  database: z2.string().min(1),
+  heartbeatTimeout: z2.number().int().min(1e3),
+  notifications: z2.boolean(),
+  sound: z2.boolean(),
+  logLevel: z2.enum(LOG_LEVELS),
+  /** How long (ms) a hook may be disconnected before its pending request is considered handled elsewhere. */
+  waiterGraceMs: z2.number().int().min(100),
+  /** Whether the Stop hook should wait for a follow-up prompt from the dashboard. */
+  idlePrompts: z2.boolean(),
+  /** Optional auto-expiry for pending permission requests (ms). 0 disables. */
+  permissionExpiryMs: z2.number().int().min(0)
+}).partial();
+function hubHome() {
+  return process.env.CREWDESK_HOME ?? path.join(os.homedir(), ".crewdesk");
+}
+function expandHome(p) {
+  if (p === "~") return os.homedir();
+  if (p.startsWith("~/") || p.startsWith("~\\")) return path.join(os.homedir(), p.slice(2));
+  return p;
+}
+function configPath(home = hubHome()) {
+  return path.join(home, "config.json");
+}
+function readConfigFile(home = hubHome()) {
+  const file = configPath(home);
+  if (!fs.existsSync(file)) return {};
+  try {
+    const parsed = ConfigFileSchema.safeParse(JSON.parse(fs.readFileSync(file, "utf8")));
+    if (parsed.success) return parsed.data;
+    process.stderr.write(`crewdesk: ignoring invalid config ${file}: ${parsed.error.message}
+`);
+  } catch (err) {
+    process.stderr.write(`crewdesk: cannot read config ${file}: ${err.message}
+`);
+  }
+  return {};
+}
+function envInt(name) {
+  const v = process.env[name];
+  if (v === void 0 || v === "") return void 0;
+  const n = Number(v);
+  return Number.isFinite(n) ? n : void 0;
+}
+function envBool(name) {
+  const v = process.env[name];
+  if (v === void 0 || v === "") return void 0;
+  return /^(1|true|yes|on)$/i.test(v);
+}
+function loadConfig(overrides = {}) {
+  const home = overrides.home ?? hubHome();
+  const file = readConfigFile(home);
+  const level = (process.env.LOG_LEVEL ?? process.env.CREWDESK_LOG_LEVEL)?.toLowerCase();
+  const cfg = {
+    home,
+    port: envInt("CREWDESK_PORT") ?? file.port ?? DEFAULT_PORT,
+    host: process.env.CREWDESK_HOST ?? file.host ?? DEFAULT_HOST,
+    database: expandHome(process.env.CREWDESK_DB ?? file.database ?? path.join(home, "data.db")),
+    heartbeatTimeout: envInt("CREWDESK_HEARTBEAT_TIMEOUT") ?? file.heartbeatTimeout ?? 3e4,
+    notifications: envBool("CREWDESK_NOTIFICATIONS") ?? file.notifications ?? true,
+    sound: envBool("CREWDESK_SOUND") ?? file.sound ?? true,
+    logLevel: LOG_LEVELS.includes(level ?? "") ? level : file.logLevel ?? "info",
+    waiterGraceMs: envInt("CREWDESK_WAITER_GRACE") ?? file.waiterGraceMs ?? 5e3,
+    idlePrompts: envBool("CREWDESK_IDLE_PROMPTS") ?? file.idlePrompts ?? true,
+    permissionExpiryMs: envInt("CREWDESK_PERMISSION_EXPIRY") ?? file.permissionExpiryMs ?? 0,
+    policyFile: path.join(home, "policies.yaml"),
+    webDir: null,
+    adminToken: null,
+    ...overrides
+  };
+  return cfg;
+}
+
+// src/cli/daemon.ts
+import { spawn } from "node:child_process";
+import crypto from "node:crypto";
+import fs6 from "node:fs";
+import path6 from "node:path";
+
+// src/logger.ts
+import fs2 from "node:fs";
+import path2 from "node:path";
+var ORDER = { error: 0, warn: 1, info: 2, debug: 3 };
+var Logger = class {
+  constructor(level, logFile2 = null, toConsole = true) {
+    this.level = level;
+    this.toConsole = toConsole;
+    if (logFile2) {
+      fs2.mkdirSync(path2.dirname(logFile2), { recursive: true });
+      this.stream = fs2.createWriteStream(logFile2, { flags: "a" });
+    }
+  }
+  level;
+  toConsole;
+  stream = null;
+  error(msg, fields) {
+    this.write("error", msg, fields);
+  }
+  warn(msg, fields) {
+    this.write("warn", msg, fields);
+  }
+  info(msg, fields) {
+    this.write("info", msg, fields);
+  }
+  debug(msg, fields) {
+    this.write("debug", msg, fields);
+  }
+  write(level, msg, fields) {
+    if (ORDER[level] > ORDER[this.level]) return;
+    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    const ids = [fields?.sessionId, fields?.eventId].filter(Boolean).join(" ");
+    const extra = fields ? Object.entries(fields).filter(([k, v]) => k !== "sessionId" && k !== "eventId" && v !== void 0).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(" ") : "";
+    const line = `${ts} ${level.toUpperCase().padEnd(5)} ${msg}${ids ? " " + ids : ""}${extra ? " " + extra : ""}`;
+    if (this.toConsole) (level === "error" ? process.stderr : process.stdout).write(line + "\n");
+    this.stream?.write(line + "\n");
+  }
+  close() {
+    this.stream?.end();
+  }
+};
+
+// src/server.ts
+import fs5 from "node:fs";
+import path5 from "node:path";
+import Fastify from "fastify";
+import fastifyStatic from "@fastify/static";
+import fastifyWebsocket from "@fastify/websocket";
+
+// src/api/agents.ts
+import { z as z3 } from "zod";
+
+// src/services/errors.ts
+var HubError = class extends Error {
+  constructor(statusCode, code, message, details) {
+    super(message);
+    this.statusCode = statusCode;
+    this.code = code;
+    this.details = details;
+  }
+  statusCode;
+  code;
+  details;
+};
+var notFound = (code, message) => new HubError(404, code, message);
+var conflict = (code, message) => new HubError(409, code, message);
+var forbidden = (code, message) => new HubError(403, code, message);
+var unprocessable = (code, message, details) => new HubError(422, code, message, details);
+
+// src/api/validate.ts
+function parse(schema, value) {
+  const result = schema.safeParse(value ?? {});
+  if (!result.success) {
+    throw new HubError(
+      400,
+      "VALIDATION_ERROR",
+      "Request validation failed.",
+      result.error.issues.map((i) => ({ path: i.path.join("."), message: i.message }))
+    );
+  }
+  return result.data;
+}
+
+// src/api/agents.ts
+var IdParams = z3.object({ id: AgentIdSchema });
+function registerAgentRoutes(app, hub) {
+  app.post("/api/agents/register", async (req, reply) => {
+    const input = parse(RegisterAgentSchema, req.body);
+    const { agent, created } = hub.agents.register(input);
+    if (created) {
+      hub.events.create({ sessionId: agent.sessionId, type: "session.started", message: `${agent.name} started` });
+    }
+    reply.code(created ? 201 : 200);
+    return { success: true, agentId: agent.id, agent: hub.agents.get(agent.id) };
+  });
+  app.post("/api/agents/heartbeat", async (req) => {
+    const input = parse(HeartbeatSchema, req.body);
+    const agent = hub.agents.getBySession(input.sessionId);
+    const status = agent.status === "OFFLINE" ? input.status ?? "WORKING" : input.status;
+    return { success: true, agent: hub.agents.touch(input.sessionId, status, input.activity) };
+  });
+  app.get("/api/agents", async () => ({ agents: hub.agents.list() }));
+  app.get("/api/agents/:id", async (req) => {
+    const { id } = parse(IdParams, req.params);
+    const agent = hub.agents.get(id);
+    const events = hub.events.list({ session: agent.sessionId, limit: 100 });
+    return { agent, events };
+  });
+  app.patch("/api/agents/:id", async (req) => {
+    const { id } = parse(IdParams, req.params);
+    return { agent: hub.agents.update(id, parse(UpdateAgentSchema, req.body)) };
+  });
+  app.delete("/api/agents/:id", async (req) => {
+    const { id } = parse(IdParams, req.params);
+    const agent = hub.agents.get(id);
+    hub.events.cancelAllForSession(agent.sessionId, "Agent removed from the dashboard.");
+    hub.agents.remove(id);
+    return { success: true };
+  });
+}
+
+// src/api/events.ts
+import { z as z4 } from "zod";
+var IdParams2 = z4.object({ id: EventIdSchema });
+function registerEventRoutes(app, hub) {
+  app.post("/api/events", async (req, reply) => {
+    const input = parse(CreateEventSchema, req.body);
+    const ev = hub.events.create(input);
+    if (ev.status === "PENDING" && input.payload?.transport === "hook") hub.routing.hook.armIdleTimer(ev.id);
+    reply.code(201);
+    return { id: ev.id, status: ev.status, event: ev };
+  });
+  app.get("/api/events", async (req) => {
+    const q = parse(ListEventsQuerySchema, req.query);
+    return { events: hub.events.list(q) };
+  });
+  app.get("/api/events/pending", async () => ({ events: hub.events.pending() }));
+  app.get("/api/events/:id", async (req) => {
+    const { id } = parse(IdParams2, req.params);
+    return { event: hub.events.get(id) };
+  });
+  app.post("/api/events/:id/respond", async (req) => {
+    const { id } = parse(IdParams2, req.params);
+    const input = parse(RespondSchema, req.body);
+    const ev = await hub.events.respond(id, input);
+    return { success: true, eventId: ev.id, status: ev.status, event: ev };
+  });
+  app.post("/api/events/:id/cancel", async (req) => {
+    const { id } = parse(IdParams2, req.params);
+    const input = parse(CancelSchema, req.body);
+    const ev = hub.events.cancel(id, input.reason ?? "Cancelled.", input.sessionId);
+    return { success: true, eventId: ev.id, status: ev.status, event: ev };
+  });
+  app.delete("/api/events/:id", async (req) => {
+    const { id } = parse(IdParams2, req.params);
+    hub.events.deleteEvent(id);
+    return { success: true };
+  });
+  app.get("/api/events/:id/wait", async (req) => {
+    const { id } = parse(IdParams2, req.params);
+    const q = parse(WaitQuerySchema, req.query);
+    const result = await hub.routing.wait(id, q.sessionId, q.timeout ?? 25e3, (fn) => {
+      req.raw.once("close", fn);
+    });
+    return result;
+  });
+  app.get("/api/policies", async () => hub.policies.list());
+}
+
+// src/version.ts
+var VERSION = "0.1.0";
+
+// src/api/health.ts
+function registerHealthRoutes(app, hub) {
+  const health2 = async () => {
+    let database = "ok";
+    try {
+      hub.db.prepare("SELECT 1").get();
+    } catch {
+      database = "error";
+    }
+    return {
+      status: "ok",
+      database,
+      websocket: "ok",
+      uptime: Math.round((Date.now() - hub.startedAt) / 1e3),
+      version: VERSION,
+      pid: process.pid
+    };
+  };
+  app.get("/health", health2);
+  app.get("/api/health", health2);
+  app.get("/api/settings", async () => ({
+    notifications: hub.config.notifications,
+    sound: hub.config.sound,
+    idlePrompts: hub.config.idlePrompts,
+    heartbeatTimeout: hub.config.heartbeatTimeout,
+    version: VERSION
+  }));
+  app.post("/api/admin/shutdown", async (req, reply) => {
+    const token = req.headers["x-hub-token"];
+    if (!hub.config.adminToken || token !== hub.config.adminToken) {
+      return reply.code(401).send({ error: { code: "UNAUTHORIZED", message: "Invalid admin token." } });
+    }
+    setTimeout(() => void app.close().then(() => process.exit(0)), 50);
+    return { success: true };
+  });
+}
+
+// src/db/database.ts
+import fs3 from "node:fs";
+import path3 from "node:path";
+import { DatabaseSync } from "node:sqlite";
+
+// src/db/migrations.ts
+var MIGRATIONS = [
+  `
+  CREATE TABLE agents (
+    id TEXT PRIMARY KEY,
+    session_id TEXT UNIQUE NOT NULL,
+    name TEXT NOT NULL,
+    project_name TEXT,
+    cwd TEXT,
+    pid INTEGER,
+    account TEXT,
+    status TEXT NOT NULL,
+    activity TEXT,
+    created_at TEXT NOT NULL,
+    last_seen_at TEXT NOT NULL
+  );
+
+  CREATE TABLE events (
+    id TEXT PRIMARY KEY,
+    session_id TEXT NOT NULL,
+    type TEXT NOT NULL,
+    status TEXT NOT NULL,
+    priority TEXT NOT NULL DEFAULT 'NORMAL',
+    message TEXT,
+    payload TEXT,
+    created_at TEXT NOT NULL,
+    resolved_at TEXT,
+    FOREIGN KEY(session_id) REFERENCES agents(session_id)
+  );
+  CREATE INDEX idx_events_session ON events(session_id, created_at);
+  CREATE INDEX idx_events_status ON events(status, created_at);
+
+  CREATE TABLE responses (
+    id TEXT PRIMARY KEY,
+    event_id TEXT NOT NULL,
+    session_id TEXT NOT NULL,
+    action TEXT NOT NULL,
+    response TEXT,
+    answers TEXT,
+    source TEXT NOT NULL DEFAULT 'dashboard',
+    created_at TEXT NOT NULL,
+    FOREIGN KEY(event_id) REFERENCES events(id)
+  );
+  CREATE UNIQUE INDEX idx_responses_event ON responses(event_id);
+  `
+];
+function migrate(db) {
+  const row = db.prepare("PRAGMA user_version").get();
+  let version = row.user_version;
+  while (version < MIGRATIONS.length) {
+    db.exec("BEGIN");
+    try {
+      db.exec(MIGRATIONS[version]);
+      version += 1;
+      db.exec(`PRAGMA user_version = ${version}`);
+      db.exec("COMMIT");
+    } catch (err) {
+      db.exec("ROLLBACK");
+      throw err;
+    }
+  }
+  return version;
+}
+
+// src/db/database.ts
+function openDatabase(file) {
+  if (file !== ":memory:") fs3.mkdirSync(path3.dirname(file), { recursive: true });
+  const db = new DatabaseSync(file);
+  db.exec("PRAGMA journal_mode = WAL;");
+  db.exec("PRAGMA foreign_keys = ON;");
+  db.exec("PRAGMA busy_timeout = 5000;");
+  migrate(db);
+  return db;
+}
+
+// src/services/agent.service.ts
+import path4 from "node:path";
+import { ulid } from "ulid";
+var PENDING_SQL = `(SELECT COUNT(*) FROM events e WHERE e.session_id = a.session_id AND e.status IN ('PENDING','PROCESSING'))`;
+function toAgent(r) {
+  return {
+    id: r.id,
+    sessionId: r.session_id,
+    name: r.name,
+    projectName: r.project_name,
+    cwd: r.cwd,
+    pid: r.pid,
+    account: r.account,
+    status: r.status,
+    activity: r.activity,
+    createdAt: r.created_at,
+    lastSeenAt: r.last_seen_at,
+    pendingCount: r.pending_count ?? 0
+  };
+}
+var now = () => (/* @__PURE__ */ new Date()).toISOString();
+var AgentService = class {
+  constructor(db, bus, log) {
+    this.db = db;
+    this.bus = bus;
+    this.log = log;
+  }
+  db;
+  bus;
+  log;
+  list() {
+    const rows = this.db.prepare(`SELECT a.*, ${PENDING_SQL} AS pending_count FROM agents a ORDER BY a.created_at`).all();
+    return rows.map(toAgent);
+  }
+  get(id) {
+    const row = this.db.prepare(`SELECT a.*, ${PENDING_SQL} AS pending_count FROM agents a WHERE a.id = ?`).get(id);
+    if (!row) throw notFound("AGENT_NOT_FOUND", "Agent was not found.");
+    return toAgent(row);
+  }
+  findBySession(sessionId) {
+    const row = this.db.prepare(`SELECT a.*, ${PENDING_SQL} AS pending_count FROM agents a WHERE a.session_id = ?`).get(sessionId);
+    return row ? toAgent(row) : null;
+  }
+  getBySession(sessionId) {
+    const agent = this.findBySession(sessionId);
+    if (!agent) throw notFound("SESSION_NOT_FOUND", "Session is not registered.");
+    return agent;
+  }
+  /** Pick "<project> #N" with the smallest N not used by another online agent of that project. */
+  defaultName(project) {
+    const rows = this.db.prepare(`SELECT name FROM agents WHERE project_name = ? AND status != 'OFFLINE'`).all(project);
+    const taken = new Set(rows.map((r) => r.name));
+    for (let n = 1; ; n++) {
+      const candidate = `${project} #${n}`;
+      if (!taken.has(candidate)) return candidate;
+    }
+  }
+  /**
+   * Register (or re-register) a session. Idempotent per session id: a reconnecting session keeps its
+   * agent id and name, fills in missing metadata and comes back from OFFLINE.
+   */
+  register(input, initialStatus = "STARTING") {
+    const existing = this.findBySession(input.sessionId);
+    const ts = now();
+    if (existing) {
+      const status = existing.status === "OFFLINE" || initialStatus !== "STARTING" ? initialStatus : existing.status;
+      this.db.prepare(
+        `UPDATE agents SET
+             name = COALESCE(?, name),
+             project_name = COALESCE(?, project_name),
+             cwd = COALESCE(?, cwd),
+             pid = COALESCE(?, pid),
+             account = COALESCE(?, account),
+             status = ?,
+             last_seen_at = ?
+           WHERE session_id = ?`
+      ).run(
+        input.name ?? null,
+        input.project ?? null,
+        input.cwd ?? null,
+        input.pid ?? null,
+        input.account ?? null,
+        status,
+        ts,
+        input.sessionId
+      );
+      const agent2 = this.getBySession(input.sessionId);
+      if (existing.status === "OFFLINE") this.log.info("Agent reconnected", { sessionId: input.sessionId });
+      this.bus.publish({ type: "agent.updated", agent: agent2 });
+      return { agent: agent2, created: false };
+    }
+    const project = input.project ?? (input.cwd ? path4.basename(input.cwd) : "unknown");
+    const agent = {
+      id: `agent_${ulid()}`,
+      sessionId: input.sessionId,
+      name: input.name ?? this.defaultName(project),
+      projectName: project,
+      cwd: input.cwd ?? null,
+      pid: input.pid ?? null,
+      account: input.account ?? null,
+      status: initialStatus,
+      activity: null,
+      createdAt: ts,
+      lastSeenAt: ts,
+      pendingCount: 0
+    };
+    this.db.prepare(
+      `INSERT INTO agents (id, session_id, name, project_name, cwd, pid, account, status, activity, created_at, last_seen_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(
+      agent.id,
+      agent.sessionId,
+      agent.name,
+      agent.projectName,
+      agent.cwd,
+      agent.pid,
+      agent.account,
+      agent.status,
+      null,
+      ts,
+      ts
+    );
+    this.log.info("Agent registered", { sessionId: agent.sessionId, name: agent.name });
+    this.bus.publish({ type: "agent.created", agent });
+    return { agent, created: true };
+  }
+  update(id, patch) {
+    const current = this.get(id);
+    this.db.prepare(`UPDATE agents SET name = ?, status = ?, activity = ? WHERE id = ?`).run(
+      patch.name ?? current.name,
+      patch.status ?? current.status,
+      patch.activity === void 0 ? current.activity : patch.activity,
+      id
+    );
+    const agent = this.get(id);
+    this.bus.publish({ type: "agent.updated", agent });
+    return agent;
+  }
+  /** Record activity from a session: bumps last_seen_at and optionally changes status/activity. */
+  touch(sessionId, status, activity) {
+    const current = this.findBySession(sessionId);
+    if (!current) return null;
+    this.db.prepare(`UPDATE agents SET last_seen_at = ?, status = ?, activity = ? WHERE session_id = ?`).run(
+      now(),
+      status ?? current.status,
+      activity === void 0 ? current.activity : activity,
+      sessionId
+    );
+    const agent = this.getBySession(sessionId);
+    this.bus.publish({ type: "agent.updated", agent });
+    return agent;
+  }
+  /** Re-broadcast an agent (e.g. after its pending count changed). */
+  refresh(sessionId) {
+    const agent = this.findBySession(sessionId);
+    if (agent) this.bus.publish({ type: "agent.updated", agent });
+  }
+  remove(id) {
+    const agent = this.get(id);
+    this.db.exec("BEGIN");
+    try {
+      this.db.prepare(`DELETE FROM responses WHERE session_id = ?`).run(agent.sessionId);
+      this.db.prepare(`DELETE FROM events WHERE session_id = ?`).run(agent.sessionId);
+      this.db.prepare(`DELETE FROM agents WHERE id = ?`).run(id);
+      this.db.exec("COMMIT");
+    } catch (err) {
+      this.db.exec("ROLLBACK");
+      throw err;
+    }
+    this.bus.publish({ type: "agent.removed", agentId: id });
+  }
+};
+
+// src/services/bus.ts
+var EventBus = class {
+  listeners = /* @__PURE__ */ new Set();
+  subscribe(fn) {
+    this.listeners.add(fn);
+    return () => this.listeners.delete(fn);
+  }
+  publish(msg) {
+    for (const fn of this.listeners) {
+      try {
+        fn(msg);
+      } catch {
+      }
+    }
+  }
+  get size() {
+    return this.listeners.size;
+  }
+};
+
+// src/services/event.service.ts
+import { ulid as ulid2 } from "ulid";
+var SELECT = `
+  SELECT e.*, a.id AS agent_id,
+         r.id AS r_id, r.action AS r_action, r.response AS r_response, r.answers AS r_answers,
+         r.source AS r_source, r.created_at AS r_created_at
+  FROM events e
+  LEFT JOIN agents a ON a.session_id = e.session_id
+  LEFT JOIN responses r ON r.event_id = e.id`;
+function parseJson(s) {
+  if (s == null) return null;
+  try {
+    return JSON.parse(s);
+  } catch {
+    return null;
+  }
+}
+function toEvent(r) {
+  const response = r.r_id ? {
+    id: r.r_id,
+    eventId: r.id,
+    sessionId: r.session_id,
+    action: r.r_action,
+    response: r.r_response,
+    answers: parseJson(r.r_answers),
+    source: r.r_source ?? "dashboard",
+    createdAt: r.r_created_at
+  } : null;
+  return {
+    id: r.id,
+    sessionId: r.session_id,
+    agentId: r.agent_id,
+    type: r.type,
+    status: r.status,
+    priority: r.priority,
+    message: r.message,
+    payload: parseJson(r.payload),
+    createdAt: r.created_at,
+    resolvedAt: r.resolved_at,
+    response
+  };
+}
+var isRequestType = (t) => REQUEST_EVENT_TYPES.includes(t);
+var ATTENTION_INFO_TYPES = /* @__PURE__ */ new Set(["notification.created", "task.failed"]);
+var STATUS_ON_CREATE = {
+  "session.started": "WAITING",
+  "session.stopped": "OFFLINE",
+  "permission.created": "PERMISSION",
+  "question.created": "QUESTION",
+  "prompt.created": "WAITING",
+  "task.started": "WORKING",
+  "task.completed": "COMPLETED",
+  "task.failed": "ERROR"
+};
+function resolutionType(ev, action) {
+  if (ev.type === "permission.created") return action === "allow" ? "permission.approved" : "permission.denied";
+  if (ev.type === "question.created") return "question.answered";
+  if (ev.type === "prompt.created") return action === "prompt" ? "prompt.sent" : null;
+  return null;
+}
+function cancelType(ev) {
+  if (ev.type === "question.created") return "question.cancelled";
+  if (ev.type === "prompt.created") return "prompt.cancelled";
+  return null;
+}
+var EventService = class {
+  constructor(db, bus, agents, policies, log) {
+    this.db = db;
+    this.bus = bus;
+    this.agents = agents;
+    this.policies = policies;
+    this.log = log;
+  }
+  db;
+  bus;
+  agents;
+  policies;
+  log;
+  delivery = null;
+  setDelivery(d) {
+    this.delivery = d;
+  }
+  get(id) {
+    const row = this.db.prepare(`${SELECT} WHERE e.id = ?`).get(id);
+    if (!row) throw notFound("EVENT_NOT_FOUND", "Event was not found.");
+    return toEvent(row);
+  }
+  list(q = {}) {
+    const where = [];
+    const params = [];
+    if (q.status) {
+      where.push("e.status = ?");
+      params.push(q.status);
+    }
+    if (q.type) {
+      if (q.type.includes(".")) {
+        where.push("e.type = ?");
+        params.push(q.type);
+      } else {
+        where.push("e.type LIKE ?");
+        params.push(`${q.type}.%`);
+      }
+    }
+    if (q.agent) {
+      where.push("a.id = ?");
+      params.push(q.agent);
+    }
+    if (q.session) {
+      where.push("e.session_id = ?");
+      params.push(q.session);
+    }
+    if (q.project) {
+      where.push("a.project_name = ?");
+      params.push(q.project);
+    }
+    if (q.q) {
+      const like = `%${q.q.replace(/[%_\\]/g, (c2) => "\\" + c2)}%`;
+      where.push(
+        `(e.message LIKE ? ESCAPE '\\' OR e.payload LIKE ? ESCAPE '\\' OR e.type LIKE ? ESCAPE '\\' OR a.name LIKE ? ESCAPE '\\' OR a.project_name LIKE ? ESCAPE '\\')`
+      );
+      params.push(like, like, like, like, like);
+    }
+    if (q.before) {
+      where.push("e.id < ?");
+      params.push(q.before);
+    }
+    const sql = `${SELECT} ${where.length ? "WHERE " + where.join(" AND ") : ""} ORDER BY e.id DESC LIMIT ?`;
+    params.push(q.limit ?? 200);
+    return this.db.prepare(sql).all(...params).map(toEvent);
+  }
+  /** Every event still waiting on a human, oldest first. */
+  pending() {
+    return this.db.prepare(`${SELECT} WHERE e.status IN ('PENDING','PROCESSING') ORDER BY e.id ASC`).all().map(toEvent);
+  }
+  insert(sessionId, type, status, priority, message, payload) {
+    const id = `evt_${ulid2()}`;
+    const ts = now();
+    const terminal = status !== "PENDING" && status !== "PROCESSING";
+    this.db.prepare(
+      `INSERT INTO events (id, session_id, type, status, priority, message, payload, created_at, resolved_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(id, sessionId, type, status, priority, message, payload ? JSON.stringify(payload) : null, ts, terminal ? ts : null);
+    return this.get(id);
+  }
+  /** Log a purely informational activity entry. */
+  logActivity(sessionId, type, message, payload = null) {
+    const ev = this.insert(sessionId, type, "RESOLVED", "LOW", message, payload);
+    this.bus.publish({ type: "event.created", event: ev });
+    return ev;
+  }
+  defaultPriority(input) {
+    if (input.priority) return input.priority;
+    if (input.type === "permission.created") return input.payload?.destructive ? "CRITICAL" : "HIGH";
+    if (input.type === "question.created" || input.type === "task.failed") return "HIGH";
+    if (input.type === "prompt.created" || input.type === "notification.created") return "NORMAL";
+    return "LOW";
+  }
+  create(input) {
+    let agent = this.agents.findBySession(input.sessionId);
+    if (!agent || agent.status === "OFFLINE" || input.type === "session.started") {
+      agent = this.agents.register({ sessionId: input.sessionId, ...input.agent }).agent;
+    }
+    const payload = input.payload ?? null;
+    let status = isRequestType(input.type) || ATTENTION_INFO_TYPES.has(input.type) ? "PENDING" : "RESOLVED";
+    if (input.type === "notification.created" && payload?.silent) status = "RESOLVED";
+    const priority = this.defaultPriority(input);
+    if (input.type === "task.started") {
+      this.cancelSession(input.sessionId, ["prompt.created"], "User continued in the terminal.");
+      this.dismissInfo(input.sessionId);
+    }
+    if (input.type === "session.stopped") {
+      this.cancelSession(input.sessionId, null, "Session ended.");
+    }
+    if (input.type === "prompt.created") {
+      this.cancelSession(input.sessionId, ["prompt.created"], "Superseded by a newer idle prompt.");
+    }
+    const ev = this.insert(input.sessionId, input.type, status, priority, input.message ?? null, payload);
+    this.log.info(`Event ${input.type}`, { sessionId: ev.sessionId, eventId: ev.id });
+    this.bus.publish({ type: "event.created", event: ev });
+    const nextStatus = STATUS_ON_CREATE[input.type];
+    const activity = input.type === "task.started" ? (input.message ?? null)?.slice(0, 200) ?? null : input.type === "session.stopped" ? null : void 0;
+    if (input.type === "notification.created" && payload?.notificationType === "idle_prompt") {
+      this.agents.touch(input.sessionId, "WAITING");
+    } else if (nextStatus) {
+      this.agents.touch(input.sessionId, nextStatus, activity);
+    } else {
+      this.agents.touch(input.sessionId);
+    }
+    if (input.type === "permission.created") return this.applyPolicy(ev);
+    return this.get(ev.id);
+  }
+  applyPolicy(ev) {
+    const p = ev.payload ?? {};
+    const decision = this.policies.evaluate(
+      String(p.toolName ?? ""),
+      String(p.summary ?? ""),
+      Boolean(p.destructive)
+    );
+    if (!decision || decision.action === "ask") return ev;
+    this.log.info(`Policy ${decision.action}`, { eventId: ev.id, match: decision.rule.match });
+    return this.resolve(ev, {
+      action: decision.action,
+      response: decision.rule.reason ?? `Matched policy "${decision.rule.match}"`,
+      source: "policy"
+    });
+  }
+  /** Validate and record a human decision, then hand it to the transport. */
+  async respond(id, input) {
+    const ev = this.get(id);
+    if (input.sessionId && input.sessionId !== ev.sessionId) {
+      throw forbidden("SESSION_MISMATCH", "Event does not belong to the given session.");
+    }
+    if (ev.status !== "PENDING") {
+      throw conflict("EVENT_NOT_PENDING", `Event is already ${ev.status}.`);
+    }
+    const text = input.response ?? input.answer;
+    const allowed = {
+      "permission.created": ["allow", "deny"],
+      "question.created": ["answer", "dismiss"],
+      "prompt.created": ["prompt", "dismiss"],
+      "notification.created": ["dismiss"],
+      "task.failed": ["dismiss"]
+    };
+    const actions = allowed[ev.type];
+    if (!actions) throw unprocessable("EVENT_NOT_ACTIONABLE", `Events of type ${ev.type} cannot be responded to.`);
+    if (!actions.includes(input.action)) {
+      throw unprocessable("INVALID_ACTION", `Action "${input.action}" is not valid for ${ev.type}. Use: ${actions.join(", ")}.`);
+    }
+    if (ev.type === "permission.created" && input.action === "allow" && ev.payload?.destructive && !input.confirm) {
+      throw unprocessable("CONFIRMATION_REQUIRED", "This operation may be destructive; resend with confirm=true.");
+    }
+    if (input.action === "answer" && !text && !(input.answers && Object.keys(input.answers).length)) {
+      throw unprocessable("ANSWER_REQUIRED", "Provide an answer.");
+    }
+    if (input.action === "prompt" && !text?.trim()) {
+      throw unprocessable("PROMPT_REQUIRED", "Provide the instruction to send.");
+    }
+    const resolved = this.resolve(ev, {
+      action: input.action,
+      response: text ?? null,
+      answers: input.answers ?? null,
+      source: input.source ?? "dashboard"
+    });
+    return this.deliver(resolved);
+  }
+  /** Record the response row and move the event to PROCESSING (awaiting delivery). */
+  resolve(ev, r) {
+    const responseId = `resp_${ulid2()}`;
+    const ts = now();
+    const infoOnly = ATTENTION_INFO_TYPES.has(ev.type);
+    const status = infoOnly ? "RESOLVED" : "PROCESSING";
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const res = this.db.prepare(`UPDATE events SET status = ?, resolved_at = ? WHERE id = ? AND status = 'PENDING'`).run(status, infoOnly ? ts : null, ev.id);
+      if (res.changes === 0) throw conflict("EVENT_NOT_PENDING", "Event is no longer pending.");
+      this.db.prepare(
+        `INSERT INTO responses (id, event_id, session_id, action, response, answers, source, created_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+      ).run(responseId, ev.id, ev.sessionId, r.action, r.response ?? null, r.answers ? JSON.stringify(r.answers) : null, r.source, ts);
+      this.db.exec("COMMIT");
+    } catch (err) {
+      this.db.exec("ROLLBACK");
+      throw err;
+    }
+    this.log.info("Response received", { sessionId: ev.sessionId, eventId: ev.id, action: r.action, source: r.source });
+    const updated = this.get(ev.id);
+    this.bus.publish({ type: infoOnly ? "event.resolved" : "event.updated", event: updated });
+    const logType = resolutionType(ev, r.action);
+    if (logType) {
+      const summary = ev.type === "permission.created" ? String(ev.payload?.summary ?? ev.message ?? "") : r.action === "prompt" ? r.response ?? "" : ev.message ?? "";
+      this.logActivity(ev.sessionId, logType, summary.slice(0, 500), { requestId: ev.id, source: r.source });
+    }
+    if (!infoOnly) this.recomputeAgentStatus(ev.sessionId, "WORKING");
+    else this.agents.refresh(ev.sessionId);
+    return updated;
+  }
+  /** Try to push a PROCESSING event's response to the live session endpoint. */
+  async deliver(ev) {
+    if (ev.status !== "PROCESSING" || !ev.response || !this.delivery) return ev;
+    const delivered = await this.delivery.deliver(ev, ev.response);
+    return delivered ? this.markDelivered(ev.id) : ev;
+  }
+  /** The session endpoint received the response. */
+  markDelivered(id) {
+    const res = this.db.prepare(`UPDATE events SET status = 'RESOLVED', resolved_at = ? WHERE id = ? AND status = 'PROCESSING'`).run(now(), id);
+    const ev = this.get(id);
+    if (res.changes > 0) {
+      this.log.info("Event resolved", { sessionId: ev.sessionId, eventId: id });
+      this.bus.publish({ type: "event.resolved", event: ev });
+      this.agents.refresh(ev.sessionId);
+    }
+    return ev;
+  }
+  cancel(id, reason = "Cancelled.", sessionId) {
+    const ev = this.get(id);
+    if (sessionId && sessionId !== ev.sessionId) {
+      throw forbidden("SESSION_MISMATCH", "Event does not belong to the given session.");
+    }
+    if (ev.status !== "PENDING" && ev.status !== "PROCESSING") {
+      throw conflict("EVENT_NOT_PENDING", `Event is already ${ev.status}.`);
+    }
+    return this.finish(ev, "CANCELLED", reason);
+  }
+  /** Close an event without a delivered decision (cancelled, expired, delivery failed). */
+  finish(ev, status, reason) {
+    const payload = { ...ev.payload ?? {}, closeReason: reason };
+    const res = this.db.prepare(
+      `UPDATE events SET status = ?, resolved_at = ?, payload = ? WHERE id = ? AND status IN ('PENDING','PROCESSING')`
+    ).run(status, now(), JSON.stringify(payload), ev.id);
+    const updated = this.get(ev.id);
+    if (res.changes === 0) return updated;
+    this.delivery?.withdraw(updated, reason);
+    this.log.info(`Event ${status.toLowerCase()}`, { sessionId: ev.sessionId, eventId: ev.id, reason });
+    this.bus.publish({ type: "event.resolved", event: updated });
+    const log = status === "CANCELLED" ? cancelType(ev) : null;
+    if (log) this.logActivity(ev.sessionId, log, reason, { requestId: ev.id });
+    this.recomputeAgentStatus(ev.sessionId);
+    return updated;
+  }
+  /** The hook endpoint for this event vanished: Claude Code resolved it some other way. */
+  abandoned(id) {
+    let ev;
+    try {
+      ev = this.get(id);
+    } catch {
+      return;
+    }
+    if (ev.status === "PENDING") {
+      const reason = ev.type === "prompt.created" ? "Session resumed from the terminal." : "Handled in the terminal (or the hook timed out).";
+      this.finish(ev, "CANCELLED", reason);
+    } else if (ev.status === "PROCESSING") {
+      this.finish(ev, "FAILED", "The session stopped waiting before the decision was delivered.");
+    }
+  }
+  cancelSession(sessionId, types, reason) {
+    const rows = this.db.prepare(`SELECT id, type FROM events WHERE session_id = ? AND status IN ('PENDING','PROCESSING')`).all(sessionId);
+    for (const r of rows) {
+      if (types && !types.includes(r.type)) continue;
+      if (!types && ATTENTION_INFO_TYPES.has(r.type)) continue;
+      this.finish(this.get(r.id), "CANCELLED", reason);
+    }
+  }
+  /** Auto-dismiss stale notifications once a session is busy again. */
+  dismissInfo(sessionId) {
+    const rows = this.db.prepare(`SELECT id FROM events WHERE session_id = ? AND status = 'PENDING' AND type = 'notification.created'`).all(sessionId);
+    for (const r of rows) {
+      const ev = this.get(r.id);
+      this.resolve(ev, { action: "dismiss", response: "Session resumed.", source: "system" });
+    }
+  }
+  cancelAllForSession(sessionId, reason) {
+    this.cancelSession(sessionId, null, reason);
+  }
+  /** Derive the agent's status from what it is still waiting on. */
+  recomputeAgentStatus(sessionId, fallback) {
+    const agent = this.agents.findBySession(sessionId);
+    if (!agent) return;
+    const rows = this.db.prepare(`SELECT type FROM events WHERE session_id = ? AND status = 'PENDING'`).all(sessionId);
+    const types = new Set(rows.map((r) => r.type));
+    let status;
+    if (types.has("permission.created")) status = "PERMISSION";
+    else if (types.has("question.created")) status = "QUESTION";
+    else if (types.has("prompt.created")) status = "WAITING";
+    else if (agent.status === "PERMISSION" || agent.status === "QUESTION") status = fallback ?? "WORKING";
+    else if (fallback && agent.status !== "OFFLINE") status = fallback;
+    this.agents.touch(sessionId, status);
+  }
+  /** Expire pending permissions older than maxAgeMs (optional feature). */
+  expirePermissions(maxAgeMs) {
+    if (maxAgeMs <= 0) return;
+    const cutoff = new Date(Date.now() - maxAgeMs).toISOString();
+    const rows = this.db.prepare(`SELECT id FROM events WHERE type = 'permission.created' AND status = 'PENDING' AND created_at < ?`).all(cutoff);
+    for (const r of rows) this.finish(this.get(r.id), "CANCELLED", "Permission request expired.");
+  }
+  deleteEvent(id) {
+    const ev = this.get(id);
+    if (ev.status === "PENDING" || ev.status === "PROCESSING") {
+      throw new HubError(409, "EVENT_PENDING", "Cancel the event before deleting it.");
+    }
+    this.db.prepare(`DELETE FROM responses WHERE event_id = ?`).run(id);
+    this.db.prepare(`DELETE FROM events WHERE id = ?`).run(id);
+    this.bus.publish({ type: "event.deleted", eventId: id });
+  }
+};
+
+// src/services/policy.service.ts
+import fs4 from "node:fs";
+import YAML from "yaml";
+var PolicyService = class {
+  constructor(file, log) {
+    this.file = file;
+    this.log = log;
+  }
+  file;
+  log;
+  rules = [];
+  mtimeMs = -1;
+  error = null;
+  reloadIfChanged() {
+    let mtime = -2;
+    try {
+      mtime = fs4.statSync(this.file).mtimeMs;
+    } catch {
+    }
+    if (mtime === this.mtimeMs) return;
+    this.mtimeMs = mtime;
+    this.rules = [];
+    this.error = null;
+    if (mtime < 0) return;
+    try {
+      const raw = YAML.parse(fs4.readFileSync(this.file, "utf8")) ?? {};
+      const parsed = PolicyFileSchema.safeParse(raw);
+      if (!parsed.success) {
+        this.error = parsed.error.message;
+        this.log.warn("Ignoring invalid policy file", { file: this.file, error: this.error });
+        return;
+      }
+      this.rules = parsed.data.permissions;
+      this.log.info("Loaded permission policies", { count: this.rules.length });
+    } catch (err) {
+      this.error = err.message;
+      this.log.warn("Cannot read policy file", { file: this.file, error: this.error });
+    }
+  }
+  list() {
+    this.reloadIfChanged();
+    return { file: this.file, rules: this.rules, error: this.error };
+  }
+  /**
+   * @param destructive when true an `allow` rule is downgraded to `ask`: destructive operations always
+   *   reach a human.
+   */
+  evaluate(toolName, summary, destructive = false) {
+    this.reloadIfChanged();
+    for (const rule of this.rules) {
+      if (rule.tool && !globMatch(rule.tool, toolName)) continue;
+      if (!globMatch(rule.match, summary)) continue;
+      if (rule.action === "allow" && (destructive || chainsCommands(toolName, summary))) {
+        return { action: "ask", rule };
+      }
+      return { action: rule.action, rule };
+    }
+    return null;
+  }
+};
+function chainsCommands(toolName, summary) {
+  if (toolName !== "Bash" && toolName !== "PowerShell") return false;
+  return /&&|\|\||[;|`\n]|\$\(|>|</.test(summary);
+}
+
+// src/transport/hook.transport.ts
+var HookTransport = class {
+  /**
+   * @param onAbandoned called when every waiter for an event has gone away and none came back within the
+   *   grace period, i.e. the hook exited: Claude Code resolved the request some other way.
+   */
+  constructor(graceMs, onAbandoned) {
+    this.graceMs = graceMs;
+    this.onAbandoned = onAbandoned;
+  }
+  graceMs;
+  onAbandoned;
+  name = "hook";
+  waiters = /* @__PURE__ */ new Map();
+  idleTimers = /* @__PURE__ */ new Map();
+  /** Register a waiter; returns a disposer that removes it (on timeout or client disconnect). */
+  addWaiter(eventId, waiter) {
+    this.clearIdleTimer(eventId);
+    let set = this.waiters.get(eventId);
+    if (!set) this.waiters.set(eventId, set = /* @__PURE__ */ new Set());
+    set.add(waiter);
+    return () => {
+      const current = this.waiters.get(eventId);
+      if (!current?.delete(waiter)) return;
+      if (current.size === 0) {
+        this.waiters.delete(eventId);
+        this.armIdleTimer(eventId);
+      }
+    };
+  }
+  /** Start the abandonment clock for an event that has no waiters (used after restart too). */
+  armIdleTimer(eventId, graceMs = this.graceMs) {
+    this.clearIdleTimer(eventId);
+    const t = setTimeout(() => {
+      this.idleTimers.delete(eventId);
+      if (!this.waiters.has(eventId)) this.onAbandoned(eventId);
+    }, graceMs);
+    t.unref?.();
+    this.idleTimers.set(eventId, t);
+  }
+  clearIdleTimer(eventId) {
+    const t = this.idleTimers.get(eventId);
+    if (t) clearTimeout(t);
+    this.idleTimers.delete(eventId);
+  }
+  settle(eventId, result) {
+    const set = this.waiters.get(eventId);
+    this.waiters.delete(eventId);
+    this.clearIdleTimer(eventId);
+    if (!set || set.size === 0) return false;
+    for (const w of set) w.settle(result);
+    return true;
+  }
+  async sendResponse(sessionId, response) {
+    const set = this.waiters.get(response.eventId);
+    if (!set) return false;
+    for (const w of set) if (w.sessionId !== sessionId) set.delete(w);
+    return this.settle(response.eventId, { state: "resolved", response });
+  }
+  cancel(_sessionId, eventId, reason) {
+    this.settle(eventId, { state: "cancelled", reason });
+  }
+  isWaiting(eventId) {
+    return (this.waiters.get(eventId)?.size ?? 0) > 0;
+  }
+  sessionHasWaiters(sessionId) {
+    for (const set of this.waiters.values()) for (const w of set) if (w.sessionId === sessionId) return true;
+    return false;
+  }
+  close() {
+    for (const t of this.idleTimers.values()) clearTimeout(t);
+    this.idleTimers.clear();
+    for (const [eventId] of this.waiters) this.settle(eventId, { state: "pending" });
+  }
+};
+
+// src/services/routing.service.ts
+var RoutingService = class {
+  constructor(events, log, graceMs) {
+    this.events = events;
+    this.log = log;
+    this.hook = new HookTransport(graceMs, (eventId) => this.events.abandoned(eventId));
+    this.transports = [this.hook];
+    events.setDelivery({
+      deliver: async (ev, response) => {
+        for (const t of this.transports) {
+          if (await t.sendResponse(ev.sessionId, response)) {
+            this.log.debug("Delivered", { sessionId: ev.sessionId, eventId: ev.id, transport: t.name });
+            return true;
+          }
+        }
+        return false;
+      },
+      withdraw: (ev, reason) => {
+        for (const t of this.transports) t.cancel(ev.sessionId, ev.id, reason);
+      }
+    });
+  }
+  events;
+  log;
+  hook;
+  transports;
+  /**
+   * Long-poll from a hook. Resolves as soon as the event is decided or withdrawn, or with
+   * `pending` after timeoutMs. `onClose` must be wired to the HTTP request's close event so a
+   * disconnected hook stops counting as a waiter.
+   */
+  wait(eventId, sessionId, timeoutMs, onClose) {
+    const ev = this.events.get(eventId);
+    if (ev.sessionId !== sessionId) throw forbidden("SESSION_MISMATCH", "Event does not belong to the given session.");
+    const immediate = this.settled(ev);
+    if (immediate) return Promise.resolve(immediate);
+    return new Promise((resolve) => {
+      let done = false;
+      let dispose = () => {
+      };
+      const finish = (result) => {
+        if (done) return;
+        done = true;
+        clearTimeout(timer);
+        dispose();
+        if (result.state === "resolved") this.events.markDelivered(eventId);
+        resolve(result);
+      };
+      const timer = setTimeout(() => finish({ state: "pending" }), timeoutMs);
+      dispose = this.hook.addWaiter(eventId, { sessionId, settle: finish });
+      onClose(() => {
+        if (done) return;
+        done = true;
+        clearTimeout(timer);
+        dispose();
+      });
+      const late = this.settled(this.events.get(eventId));
+      if (late) finish(late);
+    });
+  }
+  settled(ev) {
+    if ((ev.status === "PROCESSING" || ev.status === "RESOLVED") && ev.response) {
+      if (ev.status === "PROCESSING") this.events.markDelivered(ev.id);
+      return { state: "resolved", response: ev.response };
+    }
+    if (ev.status === "CANCELLED" || ev.status === "FAILED") {
+      return { state: "cancelled", reason: String(ev.payload?.closeReason ?? ev.status) };
+    }
+    return null;
+  }
+  /** After a restart, hook-backed pending requests get a (longer) window to re-attach before being abandoned. */
+  armRecovered(pending, graceMs) {
+    for (const ev of pending) {
+      if (ev.payload?.transport === "hook") this.hook.armIdleTimer(ev.id, graceMs);
+    }
+  }
+  sessionHasWaiters(sessionId) {
+    return this.transports.some((t) => t.sessionHasWaiters(sessionId));
+  }
+  close() {
+    this.hook.close();
+  }
+};
+
+// src/util/process.ts
+function isPidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+
+// src/hub.ts
+var Hub = class {
+  constructor(config, log) {
+    this.config = config;
+    this.log = log;
+    this.db = openDatabase(config.database);
+    this.agents = new AgentService(this.db, this.bus, log);
+    this.policies = new PolicyService(config.policyFile, log);
+    this.events = new EventService(this.db, this.bus, this.agents, this.policies, log);
+    this.routing = new RoutingService(this.events, log, config.waiterGraceMs);
+  }
+  config;
+  log;
+  db;
+  bus = new EventBus();
+  agents;
+  events;
+  policies;
+  routing;
+  startedAt = Date.now();
+  sweeper = null;
+  start(sweepIntervalMs = 5e3) {
+    this.routing.armRecovered(this.events.pending(), Math.max(this.config.waiterGraceMs, 3e4));
+    this.sweeper = setInterval(() => this.sweep(), sweepIntervalMs);
+    this.sweeper.unref?.();
+  }
+  /** Mark dead sessions OFFLINE and expire stale permissions. */
+  sweep() {
+    const nowMs = Date.now();
+    for (const agent of this.agents.list()) {
+      if (agent.status === "OFFLINE") continue;
+      let offline = false;
+      if (agent.pid) {
+        offline = !isPidAlive(agent.pid);
+      } else if (!this.routing.sessionHasWaiters(agent.sessionId)) {
+        const idleMs = nowMs - Date.parse(agent.lastSeenAt);
+        const limit = agent.status === "WORKING" ? this.config.heartbeatTimeout * 10 : this.config.heartbeatTimeout;
+        offline = idleMs > limit;
+      }
+      if (offline) {
+        this.log.info("Agent offline", { sessionId: agent.sessionId });
+        this.events.cancelAllForSession(agent.sessionId, "Session went offline.");
+        this.agents.touch(agent.sessionId, "OFFLINE");
+      }
+    }
+    this.events.expirePermissions(this.config.permissionExpiryMs);
+  }
+  close() {
+    if (this.sweeper) clearInterval(this.sweeper);
+    this.routing.close();
+    this.db.close();
+  }
+};
+
+// src/websocket/websocket.ts
+function registerWebSocket(app, hub) {
+  app.get("/ws", { websocket: true }, (socket) => {
+    const send = (msg) => {
+      if (socket.readyState === socket.OPEN) socket.send(JSON.stringify(msg));
+    };
+    send({ type: "hello", agents: hub.agents.list(), pending: hub.events.pending() });
+    const unsubscribe = hub.bus.subscribe(send);
+    const ping = setInterval(() => socket.readyState === socket.OPEN && socket.ping(), 2e4);
+    socket.on("close", () => {
+      clearInterval(ping);
+      unsubscribe();
+    });
+    socket.on("error", () => socket.close());
+    socket.on("message", () => {
+    });
+  });
+}
+
+// src/server.ts
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
+function hostOf(value) {
+  return value.startsWith("[") ? value.slice(0, value.indexOf("]") + 1) : value.split(":")[0];
+}
+async function buildServer(config, log) {
+  const hub = new Hub(config, log);
+  const app = Fastify({ logger: false, bodyLimit: 1024 * 1024, forceCloseConnections: true });
+  const loopbackOnly = LOOPBACK_HOSTS.has(config.host) || config.host === "::1";
+  app.addHook("onRequest", async (req, reply) => {
+    if (!loopbackOnly) return;
+    const host = req.headers.host;
+    if (host && !LOOPBACK_HOSTS.has(hostOf(host))) {
+      return reply.code(403).send({ error: { code: "FORBIDDEN_HOST", message: "Host not allowed." } });
+    }
+    const origin = req.headers.origin;
+    if (origin && origin !== "null") {
+      let ok = false;
+      try {
+        ok = LOOPBACK_HOSTS.has(hostOf(new URL(origin).host));
+      } catch {
+        ok = false;
+      }
+      if (!ok) {
+        return reply.code(403).send({ error: { code: "FORBIDDEN_ORIGIN", message: "Cross-origin requests are not allowed." } });
+      }
+    }
+  });
+  app.setErrorHandler((err, _req, reply) => {
+    if (err instanceof HubError) {
+      return reply.code(err.statusCode).send({ error: { code: err.code, message: err.message, details: err.details } });
+    }
+    const e = err;
+    if (e.statusCode && e.statusCode >= 400 && e.statusCode < 500) {
+      const code = e.code === "FST_ERR_CTP_INVALID_MEDIA_TYPE" ? "UNSUPPORTED_MEDIA_TYPE" : e.code?.startsWith("FST_ERR_CTP") || /JSON/i.test(e.message) ? "MALFORMED_JSON" : "BAD_REQUEST";
+      return reply.code(e.statusCode).send({ error: { code, message: e.message } });
+    }
+    log.error("Unhandled error", { error: e.message });
+    return reply.code(500).send({ error: { code: "INTERNAL_ERROR", message: "Internal server error." } });
+  });
+  await app.register(fastifyWebsocket, { options: { maxPayload: 64 * 1024 } });
+  registerHealthRoutes(app, hub);
+  registerAgentRoutes(app, hub);
+  registerEventRoutes(app, hub);
+  registerWebSocket(app, hub);
+  const webDir2 = config.webDir;
+  if (webDir2 && fs5.existsSync(path5.join(webDir2, "index.html"))) {
+    await app.register(fastifyStatic, { root: webDir2, wildcard: false });
+    app.setNotFoundHandler((req, reply) => {
+      if (req.method === "GET" && !req.url.startsWith("/api") && !req.url.startsWith("/ws")) {
+        return reply.type("text/html").sendFile("index.html");
+      }
+      return reply.code(404).send({ error: { code: "NOT_FOUND", message: "Route not found." } });
+    });
+  } else {
+    app.setNotFoundHandler(
+      (_req, reply) => reply.code(404).send({ error: { code: "NOT_FOUND", message: "Route not found." } })
+    );
+  }
+  app.addHook("onClose", async () => hub.close());
+  return { app, hub };
+}
+
+// src/cli/daemon.ts
+var pidFile = (cfg) => path6.join(cfg.home, "hub.pid");
+var tokenFile = (cfg) => path6.join(cfg.home, "hub.token");
+var logFile = (cfg) => path6.join(cfg.home, "logs", "hub.log");
+var baseUrl = (cfg) => `http://${cfg.host === "0.0.0.0" ? "127.0.0.1" : cfg.host}:${cfg.port}`;
+function readPid(cfg) {
+  try {
+    const pid = Number(fs6.readFileSync(pidFile(cfg), "utf8").trim());
+    return pid > 0 && isPidAlive(pid) ? pid : null;
+  } catch {
+    return null;
+  }
+}
+async function health(cfg, timeoutMs = 1500) {
+  try {
+    const res = await fetch(`${baseUrl(cfg)}/health`, { signal: AbortSignal.timeout(timeoutMs) });
+    return res.ok ? await res.json() : null;
+  } catch {
+    return null;
+  }
+}
+async function runForeground(cfg, opts) {
+  fs6.mkdirSync(cfg.home, { recursive: true });
+  const token = crypto.randomBytes(24).toString("hex");
+  const log = new Logger(cfg.logLevel, opts.daemon ? logFile(cfg) : null, !opts.daemon);
+  const { app, hub } = await buildServer({ ...cfg, adminToken: token }, log);
+  hub.start();
+  try {
+    await app.listen({ port: cfg.port, host: cfg.host });
+  } catch (err) {
+    log.error("Failed to start", { error: err.message });
+    hub.close();
+    process.exit(1);
+  }
+  fs6.writeFileSync(pidFile(cfg), String(process.pid));
+  fs6.writeFileSync(tokenFile(cfg), token, { mode: 384 });
+  log.info("Server started", { url: baseUrl(cfg), database: cfg.database });
+  let closing = false;
+  const shutdown = async () => {
+    if (closing) return;
+    closing = true;
+    log.info("Shutting down");
+    await app.close();
+    cleanupPid(cfg);
+    log.close();
+    process.exit(0);
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+  process.on("exit", () => cleanupPid(cfg));
+  return { app, hub };
+}
+function cleanupPid(cfg) {
+  try {
+    if (fs6.readFileSync(pidFile(cfg), "utf8").trim() === String(process.pid)) {
+      fs6.rmSync(pidFile(cfg), { force: true });
+      fs6.rmSync(tokenFile(cfg), { force: true });
+    }
+  } catch {
+  }
+}
+async function startDaemon(cfg, cliScript2) {
+  const running = readPid(cfg);
+  if (running && await health(cfg)) return { pid: running, already: true };
+  if (await health(cfg)) throw new Error(`port ${cfg.port} is already serving another hub or program`);
+  fs6.mkdirSync(path6.dirname(logFile(cfg)), { recursive: true });
+  const out = fs6.openSync(logFile(cfg), "a");
+  const child = spawn(process.execPath, [cliScript2, "start", "--foreground", "--daemon"], {
+    detached: true,
+    stdio: ["ignore", out, out],
+    windowsHide: true,
+    env: { ...process.env, CREWDESK_HOME: cfg.home, CREWDESK_PORT: String(cfg.port), CREWDESK_HOST: cfg.host }
+  });
+  child.unref();
+  const deadline = Date.now() + 15e3;
+  while (Date.now() < deadline) {
+    if (child.exitCode !== null) break;
+    if (await health(cfg, 500)) return { pid: child.pid, already: false };
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  throw new Error(`hub did not start; see ${logFile(cfg)}`);
+}
+async function stopDaemon(cfg) {
+  const pid = readPid(cfg);
+  let token = "";
+  try {
+    token = fs6.readFileSync(tokenFile(cfg), "utf8").trim();
+  } catch {
+  }
+  if (token) {
+    try {
+      await fetch(`${baseUrl(cfg)}/api/admin/shutdown`, { method: "POST", headers: { "x-hub-token": token }, signal: AbortSignal.timeout(2e3) });
+    } catch {
+    }
+  }
+  if (!pid) return Boolean(token);
+  const deadline = Date.now() + 5e3;
+  while (Date.now() < deadline && isPidAlive(pid)) await new Promise((r) => setTimeout(r, 100));
+  if (isPidAlive(pid)) {
+    try {
+      process.kill(pid);
+    } catch {
+    }
+  }
+  fs6.rmSync(pidFile(cfg), { force: true });
+  fs6.rmSync(tokenFile(cfg), { force: true });
+  return true;
+}
+
+// src/cli/hooks-config.ts
+import fs7 from "node:fs";
+import os2 from "node:os";
+import path7 from "node:path";
+var HOOK_MARKER = "crewdesk-hook";
+var HOOK_PLAN = [
+  { event: "SessionStart", sub: "register", timeout: 30, async: true },
+  { event: "UserPromptSubmit", sub: "prompt", timeout: 10, async: true },
+  { event: "Notification", sub: "notification", timeout: 10, async: true },
+  { event: "PermissionRequest", sub: "permission", timeout: 86400 },
+  { event: "PreToolUse", sub: "question", matcher: "AskUserQuestion", timeout: 86400 },
+  { event: "Stop", sub: "stop", timeout: 86400 },
+  { event: "SessionEnd", sub: "session-end", timeout: 5 }
+];
+var fwd = (p) => p.replace(/\\/g, "/");
+function hookCommand(hookScript2, sub, nodePath = process.execPath) {
+  return `"${fwd(nodePath)}" "${fwd(hookScript2)}" ${sub}`;
+}
+function isOurs(h) {
+  return typeof h.command === "string" && h.command.includes(HOOK_MARKER);
+}
+function detectConfigDirs(home = os2.homedir(), env = process.env) {
+  const dirs = /* @__PURE__ */ new Set();
+  const add = (d) => dirs.add(path7.resolve(d));
+  add(path7.join(home, ".claude"));
+  const accounts = path7.join(home, ".claude-accounts");
+  if (fs7.existsSync(accounts)) {
+    for (const entry of fs7.readdirSync(accounts, { withFileTypes: true })) {
+      if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
+      const d = path7.join(accounts, entry.name);
+      if (fs7.existsSync(path7.join(d, "settings.json")) || fs7.existsSync(path7.join(d, ".claude.json"))) add(d);
+    }
+  }
+  if (env.CLAUDE_CONFIG_DIR) add(env.CLAUDE_CONFIG_DIR);
+  return [...dirs];
+}
+function readSettings(file) {
+  if (!fs7.existsSync(file)) return {};
+  const text = fs7.readFileSync(file, "utf8").replace(/^/, "");
+  if (!text.trim()) return {};
+  const parsed = JSON.parse(text);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${file} is not a JSON object`);
+  return parsed;
+}
+function describeTarget(dir, home = os2.homedir()) {
+  const settingsFile = path7.join(dir, "settings.json");
+  let installed = false;
+  try {
+    const hooks = readSettings(settingsFile).hooks ?? {};
+    installed = Object.values(hooks).some((groups) => Array.isArray(groups) && groups.some((g) => g?.hooks?.some?.(isOurs)));
+  } catch {
+  }
+  const rel = path7.relative(home, dir);
+  return {
+    dir,
+    label: rel && !rel.startsWith("..") ? `~/${fwd(rel)}` : dir,
+    settingsFile,
+    exists: fs7.existsSync(dir),
+    installed
+  };
+}
+function stripOurHooks(hooks) {
+  const out = {};
+  for (const [event, groups] of Object.entries(hooks)) {
+    if (!Array.isArray(groups)) {
+      out[event] = groups;
+      continue;
+    }
+    const kept = [];
+    for (const g of groups) {
+      if (!g || !Array.isArray(g.hooks)) {
+        kept.push(g);
+        continue;
+      }
+      const remaining = g.hooks.filter((h) => !isOurs(h));
+      if (remaining.length === g.hooks.length) kept.push(g);
+      else if (remaining.length > 0) kept.push({ ...g, hooks: remaining });
+    }
+    if (kept.length > 0) out[event] = kept;
+  }
+  return out;
+}
+function mergeOurHooks(hooks, hookScript2, nodePath = process.execPath) {
+  const out = stripOurHooks(hooks);
+  for (const p of HOOK_PLAN) {
+    const hook = { type: "command", command: hookCommand(hookScript2, p.sub, nodePath), timeout: p.timeout };
+    if (p.async) hook.async = true;
+    const group = p.matcher ? { matcher: p.matcher, hooks: [hook] } : { hooks: [hook] };
+    out[p.event] = [...out[p.event] ?? [], group];
+  }
+  return out;
+}
+function timestamp(d = /* @__PURE__ */ new Date()) {
+  const p = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}`;
+}
+function backupSettings(target, backupDir) {
+  if (!fs7.existsSync(target.settingsFile)) return null;
+  fs7.mkdirSync(backupDir, { recursive: true });
+  const name = `${path7.basename(target.dir).replace(/^\./, "") || "claude"}-settings-${timestamp()}.json`;
+  let dest = path7.join(backupDir, name);
+  for (let i = 1; fs7.existsSync(dest); i++) dest = path7.join(backupDir, name.replace(/\.json$/, `-${i}.json`));
+  fs7.copyFileSync(target.settingsFile, dest);
+  return dest;
+}
+function writeValidated(file, data, backup) {
+  const tmp = `${file}.crewdesk-${process.pid}.tmp`;
+  try {
+    fs7.mkdirSync(path7.dirname(file), { recursive: true });
+    fs7.writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n");
+    JSON.parse(fs7.readFileSync(tmp, "utf8"));
+    fs7.renameSync(tmp, file);
+    const check = readSettings(file);
+    if (JSON.stringify(check) !== JSON.stringify(data)) throw new Error("written settings do not match");
+  } catch (err) {
+    fs7.rmSync(tmp, { force: true });
+    if (backup) fs7.copyFileSync(backup, file);
+    throw new Error(`failed to update ${file} (${err.message}); original restored`);
+  }
+}
+function installHooks(target, hookScript2, backupDir, dryRun = false) {
+  const settings = readSettings(target.settingsFile);
+  const before = JSON.stringify(settings.hooks ?? {});
+  const hooks = mergeOurHooks(settings.hooks ?? {}, hookScript2);
+  const changed = JSON.stringify(hooks) !== before;
+  if (dryRun || !changed) return { target, backup: null, changed };
+  const backup = backupSettings(target, backupDir);
+  writeValidated(target.settingsFile, { ...settings, hooks }, backup);
+  return { target, backup, changed };
+}
+function uninstallHooks(target, backupDir, dryRun = false) {
+  if (!fs7.existsSync(target.settingsFile)) return { target, backup: null, changed: false };
+  const settings = readSettings(target.settingsFile);
+  const current = settings.hooks ?? {};
+  const hooks = stripOurHooks(current);
+  const changed = JSON.stringify(hooks) !== JSON.stringify(current);
+  if (dryRun || !changed) return { target, backup: null, changed };
+  const backup = backupSettings(target, backupDir);
+  const next = { ...settings };
+  if (Object.keys(hooks).length) next.hooks = hooks;
+  else delete next.hooks;
+  writeValidated(target.settingsFile, next, backup);
+  return { target, backup, changed };
+}
+
+// src/cli.ts
+var here = path8.dirname(fileURLToPath(import.meta.url));
+var root = path8.resolve(here, "../../..");
+var cliScript = process.env.CREWDESK_CLI_SCRIPT ?? path8.join(root, "bin", "crewdesk.mjs");
+var hookScript = process.env.CREWDESK_HOOK_SCRIPT ?? path8.join(root, "bin", "crewdesk-hook.mjs");
+var webDir = process.env.CREWDESK_WEB_DIR ?? path8.join(root, "apps", "web", "dist");
+var c = {
+  ok: (s) => `\x1B[32m\u2713\x1B[0m ${s}`,
+  bad: (s) => `\x1B[31m\u2717\x1B[0m ${s}`,
+  warn: (s) => `\x1B[33m!\x1B[0m ${s}`,
+  bold: (s) => `\x1B[1m${s}\x1B[0m`,
+  dim: (s) => `\x1B[2m${s}\x1B[0m`
+};
+var HELP = `Crewdesk ${VERSION}
+
+Usage: crewdesk <command> [options]
+
+Commands:
+  start [--foreground]   Start the hub (background daemon by default)
+  stop                   Stop the hub
+  restart                Restart the hub
+  status                 Show hub status, agents and pending requests
+  open                   Open the dashboard in the browser
+  logs [-f] [-n N]       Show the hub log
+  configure              Install Claude Code hooks (backs up settings first)
+      --all | --dir <path> ...   choose config dirs non-interactively
+      --dry-run                  show what would change
+  doctor                 Diagnose the installation
+  uninstall              Remove hooks and optionally the database
+
+Environment: CREWDESK_HOME, CREWDESK_PORT, CREWDESK_HOST, CREWDESK_DB,
+             CREWDESK_HEARTBEAT_TIMEOUT, LOG_LEVEL
+`;
+function flag(args, name) {
+  return args.includes(name);
+}
+function flagValues(args, name) {
+  const out = [];
+  args.forEach((a, i) => {
+    if (a === name && args[i + 1]) out.push(args[i + 1]);
+  });
+  return out;
+}
+async function ask(question) {
+  if (!process.stdin.isTTY) return "";
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return (await rl.question(question)).trim();
+  } finally {
+    rl.close();
+  }
+}
+async function confirm(question, dflt = true) {
+  const a = (await ask(`${question} ${dflt ? "[Y/n]" : "[y/N]"} `)).toLowerCase();
+  if (!a) return dflt;
+  return a.startsWith("y");
+}
+function openBrowser(url) {
+  const cmd = process.platform === "win32" ? `start "" "${url}"` : process.platform === "darwin" ? `open "${url}"` : `xdg-open "${url}"`;
+  console.log(`Opening ${url}`);
+  exec(cmd, (err) => {
+    if (err) console.log(`Could not open a browser. Visit ${url}`);
+  });
+}
+async function cmdStart(cfg, args) {
+  if (flag(args, "--foreground")) {
+    const daemon = flag(args, "--daemon");
+    if (!daemon) console.log(c.bold("Crewdesk"));
+    await runForeground({ ...cfg, webDir }, { daemon });
+    if (!daemon) {
+      console.log(`
+Dashboard:
+${baseUrl(cfg)}
+
+Waiting for Claude Code sessions... (Ctrl+C to stop)`);
+    }
+    return;
+  }
+  const { pid, already } = await startDaemon(cfg, cliScript);
+  console.log(c.bold("Crewdesk\n"));
+  if (already) console.log(c.ok(`Already running (pid ${pid})`));
+  else {
+    console.log(c.ok("Server started"));
+    console.log(c.ok("Database ready"));
+    console.log(c.ok("WebSocket ready"));
+  }
+  if (!fs8.existsSync(path8.join(webDir, "index.html"))) console.log(c.warn("Web UI not built \u2014 run `pnpm build`"));
+  console.log(`
+Dashboard:
+${baseUrl(cfg)}
+`);
+  if (!already) console.log("Waiting for Claude Code sessions...");
+}
+async function cmdStatus(cfg) {
+  const h = await health(cfg);
+  if (!h) {
+    console.log(c.bad(`Hub is not running on ${baseUrl(cfg)}`));
+    process.exitCode = 1;
+    return;
+  }
+  console.log(c.ok(`Hub running (pid ${h.pid}, up ${h.uptime}s, v${h.version}) \u2014 ${baseUrl(cfg)}`));
+  const [agents, pending] = await Promise.all([
+    fetch(`${baseUrl(cfg)}/api/agents`).then((r) => r.json()),
+    fetch(`${baseUrl(cfg)}/api/events/pending`).then((r) => r.json())
+  ]);
+  const online = agents.agents.filter((a) => a.status !== "OFFLINE");
+  console.log(`
+${online.length} active agent(s), ${pending.events.length} need attention
+`);
+  for (const a of agents.agents) {
+    console.log(`  ${a.status.padEnd(10)} ${a.name.padEnd(28)} ${c.dim(a.cwd ?? "")}${a.pendingCount ? `  (${a.pendingCount} pending)` : ""}`);
+  }
+}
+async function cmdLogs(cfg, args) {
+  const file = logFile(cfg);
+  if (!fs8.existsSync(file)) {
+    console.log(`No log yet at ${file}`);
+    return;
+  }
+  const n = Number(flagValues(args, "-n")[0] ?? 100);
+  const lines = fs8.readFileSync(file, "utf8").split(/\r?\n/);
+  process.stdout.write(lines.slice(-n - 1).join("\n"));
+  if (!flag(args, "-f")) return;
+  let size = fs8.statSync(file).size;
+  fs8.watchFile(file, { interval: 500 }, (cur) => {
+    if (cur.size < size) size = 0;
+    if (cur.size === size) return;
+    const fd = fs8.openSync(file, "r");
+    const buf = Buffer.alloc(cur.size - size);
+    fs8.readSync(fd, buf, 0, buf.length, size);
+    fs8.closeSync(fd);
+    size = cur.size;
+    process.stdout.write(buf.toString("utf8"));
+  });
+  await new Promise(() => {
+  });
+}
+async function chooseTargets(args, purpose) {
+  const explicit = flagValues(args, "--dir");
+  if (explicit.length) return explicit.map((d) => describeTarget(path8.resolve(d)));
+  const all = detectConfigDirs().map((d) => describeTarget(d));
+  const candidates = purpose === "remove" ? all.filter((t) => t.installed) : all;
+  if (flag(args, "--all") || flag(args, "--yes") || !process.stdin.isTTY) return candidates;
+  if (candidates.length === 0) return [];
+  console.log(`Detected Claude Code configuration directories:
+`);
+  candidates.forEach(
+    (t, i) => console.log(`  [${i + 1}] ${t.label.padEnd(40)} ${t.installed ? c.dim("(hooks installed)") : t.exists ? "" : c.dim("(new)")}`)
+  );
+  const answer = await ask(`
+Which should ${purpose === "install" ? "get" : "lose"} the hooks? (e.g. 1,3 \u2014 Enter for all, 0 for none) `);
+  if (!answer) return candidates;
+  if (answer === "0") return [];
+  const picked = new Set(answer.split(/[ ,]+/).map((s) => Number(s) - 1));
+  return candidates.filter((_, i) => picked.has(i));
+}
+async function cmdConfigure(cfg, args) {
+  fs8.mkdirSync(cfg.home, { recursive: true });
+  if (!fs8.existsSync(configPath(cfg.home))) {
+    const initial = { port: cfg.port, host: cfg.host, heartbeatTimeout: cfg.heartbeatTimeout, notifications: true, sound: true };
+    fs8.writeFileSync(configPath(cfg.home), JSON.stringify(initial, null, 2) + "\n");
+    console.log(c.ok(`Created ${configPath(cfg.home)}`));
+  }
+  const policy = cfg.policyFile;
+  if (!fs8.existsSync(policy)) {
+    fs8.writeFileSync(
+      policy,
+      `# Permission policies for Crewdesk. First matching rule wins.
+# action: allow | deny | ask. Destructive or chained commands are never auto-allowed.
+permissions: []
+#  - tool: "Bash"
+#    match: "git status"
+#    action: allow
+`
+    );
+  }
+  if (!fs8.existsSync(hookScript)) console.log(c.warn(`Hook script not found at ${hookScript} \u2014 run \`pnpm build\``));
+  const targets = await chooseTargets(args, "install");
+  if (targets.length === 0) {
+    console.log("No configuration directories selected.");
+    return;
+  }
+  const dry = flag(args, "--dry-run");
+  const backups = path8.join(cfg.home, "backups");
+  for (const t of targets) {
+    try {
+      const r = installHooks(t, hookScript, backups, dry);
+      const note = !r.changed ? "already up to date" : dry ? "would install hooks" : "hooks installed";
+      console.log(c.ok(`${t.label}: ${note}${r.backup ? c.dim(` (backup ${path8.basename(r.backup)})`) : ""}`));
+    } catch (err) {
+      console.log(c.bad(`${t.label}: ${err.message}`));
+      process.exitCode = 1;
+    }
+  }
+  if (!dry) console.log(`
+Restart running Claude Code sessions (or run /hooks) to pick up the new hooks.`);
+}
+async function cmdUninstall(cfg, args) {
+  const targets = await chooseTargets(args, "remove");
+  const backups = path8.join(cfg.home, "backups");
+  for (const t of targets) {
+    try {
+      const r = uninstallHooks(t, backups, flag(args, "--dry-run"));
+      console.log(c.ok(`${t.label}: ${r.changed ? "hooks removed" : "no hooks found"}`));
+    } catch (err) {
+      console.log(c.bad(`${t.label}: ${err.message}`));
+    }
+  }
+  if (readPid(cfg)) {
+    await stopDaemon(cfg);
+    console.log(c.ok("Hub stopped"));
+  }
+  const deleteDb = flag(args, "--delete-data") || !flag(args, "--keep-data") && await confirm("Delete the database and event history?", false);
+  if (deleteDb) {
+    for (const f of [cfg.database, `${cfg.database}-wal`, `${cfg.database}-shm`]) fs8.rmSync(f, { force: true });
+    console.log(c.ok("Database deleted"));
+  } else console.log(c.ok(`Database kept at ${cfg.database}`));
+  console.log(`
+To remove the application: npm rm -g crewdesk (or pnpm unlink --global).`);
+}
+async function cmdDoctor(cfg) {
+  console.log(c.bold("Crewdesk Doctor\n"));
+  let problems = 0;
+  const check = (ok, label, hint) => {
+    console.log(ok ? c.ok(label) : c.bad(`${label}${hint ? c.dim(` \u2014 ${hint}`) : ""}`));
+    if (!ok) problems++;
+  };
+  const [major, minor] = process.versions.node.split(".").map(Number);
+  check(major > 22 || major === 22 && minor >= 13, `Node.js ${process.versions.node}`, "Node >= 22.13 required (node:sqlite)");
+  let sqliteOk = false;
+  try {
+    const { DatabaseSync: DatabaseSync2 } = await import("node:sqlite");
+    new DatabaseSync2(":memory:").close();
+    sqliteOk = true;
+  } catch {
+  }
+  check(sqliteOk, "SQLite");
+  let dbOk = false;
+  try {
+    fs8.mkdirSync(path8.dirname(cfg.database), { recursive: true });
+    fs8.accessSync(path8.dirname(cfg.database), fs8.constants.W_OK);
+    dbOk = true;
+  } catch {
+  }
+  check(dbOk, `Database ${cfg.database}`, "directory not writable");
+  const h = await health(cfg);
+  check(Boolean(h), `Server ${baseUrl(cfg)}`, "not running \u2014 `crewdesk start`");
+  if (h) check(h.database === "ok", `Port ${cfg.port} (hub pid ${h.pid})`);
+  else {
+    const net = await import("node:net");
+    const free = await new Promise((resolve) => {
+      const s = net.createServer().once("error", () => resolve(false)).once("listening", () => s.close(() => resolve(true)));
+      s.listen(cfg.port, cfg.host);
+    });
+    check(free, `Port ${cfg.port}`, "in use by another program");
+  }
+  let claudeVersion = "";
+  try {
+    claudeVersion = execSync("claude --version", { encoding: "utf8", timeout: 1e4, stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+  }
+  check(Boolean(claudeVersion), `Claude Code detected${claudeVersion ? ` (${claudeVersion})` : ""}`, "`claude` not on PATH");
+  const targets = detectConfigDirs().map((d) => describeTarget(d));
+  const installed = targets.filter((t) => t.installed);
+  check(installed.length > 0, `Hook configuration (${installed.map((t) => t.label).join(", ") || "none"})`, "run `crewdesk configure`");
+  for (const t of targets.filter((t2) => !t2.installed)) console.log(c.dim(`    not installed in ${t.label}`));
+  check(fs8.existsSync(hookScript) && fs8.existsSync(path8.join(root, "packages", "hook", "dist", "hook.js")), "Hook executable", "run `pnpm build`");
+  check(fs8.existsSync(path8.join(webDir, "index.html")), "Web UI build", "run `pnpm build`");
+  console.log(problems ? `
+${problems} problem(s) found.` : "\nEverything looks good.");
+  if (problems) process.exitCode = 1;
+}
+async function firstRun(cfg) {
+  console.log(c.bold("Welcome to Crewdesk\n"));
+  console.log("This will:\n");
+  console.log("  \u2713 Create a local database");
+  console.log("  \u2713 Configure Claude Code hooks");
+  console.log("  \u2713 Start the local server");
+  console.log("  \u2713 Open the dashboard\n");
+  if (!await confirm("Continue?")) return;
+  await cmdConfigure(cfg, []);
+  await cmdStart(cfg, []);
+  openBrowser(baseUrl(cfg));
+}
+async function main(argv = process.argv.slice(2)) {
+  const [cmd, ...args] = argv;
+  const cfg = loadConfig();
+  switch (cmd) {
+    case "start":
+      return cmdStart(cfg, args);
+    case "stop":
+      console.log(await stopDaemon(cfg) ? c.ok("Hub stopped") : "Hub is not running.");
+      return;
+    case "restart":
+      await stopDaemon(cfg);
+      return cmdStart(cfg, args);
+    case "status":
+      return cmdStatus(cfg);
+    case "open":
+      if (!await health(cfg)) await cmdStart(cfg, []);
+      openBrowser(baseUrl(cfg));
+      return;
+    case "logs":
+      return cmdLogs(cfg, args);
+    case "configure":
+      return cmdConfigure(cfg, args);
+    case "doctor":
+      return cmdDoctor(cfg);
+    case "uninstall":
+      return cmdUninstall(cfg, args);
+    case "--version":
+    case "-v":
+      console.log(VERSION);
+      return;
+    case void 0:
+      if (!fs8.existsSync(configPath(cfg.home)) && process.stdin.isTTY) return firstRun(cfg);
+      console.log(HELP);
+      return;
+    default:
+      console.log(HELP);
+      if (cmd !== "help" && cmd !== "--help" && cmd !== "-h") process.exitCode = 1;
+  }
+}
+var invokedDirectly = process.argv[1] && path8.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (invokedDirectly || process.env.CREWDESK_RUN_CLI === "1") {
+  main().catch((err) => {
+    console.error(c.bad(err.message));
+    process.exit(1);
+  });
+}
+export {
+  main
+};