experimental-ash 0.7.5 → 0.8.0

package/dist/src/internal/application/package.js

@@ -6,7 +6,7 @@ import { ASH_PACKAGE_NAME } from "#package-name.js";
 let cachedPackageInfo;
 // The package build stamps the published version into `dist` so bundled
 // deployments can still report package metadata without resolving package.json.
-const BUNDLED_FALLBACK_PACKAGE_VERSION = "0.7.5";
+const BUNDLED_FALLBACK_PACKAGE_VERSION = "0.8.0";
 const BUNDLED_FALLBACK_PACKAGE_VERSION_PLACEHOLDER = "__ASH_PACKAGE_VERSION_PLACEHOLDER__";
 const WORKFLOW_MODULE_ALIASES = {
     "workflow/api": "src/compiled/@workflow/core/runtime.js",

package/dist/src/internal/attachments/url-refs.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Custom URL scheme for serializing `URL` objects in `FilePart.data`
+ * across the queue boundary.
+ *
+ * Route handlers place `new URL("https://...")` on `FilePart.data`.
+ * Before the message crosses the queue, `send()` rewrites these as
+ * `ash-url:https://...` strings. After the queue, the staging pipeline
+ * reconstitutes them back to `URL` objects so `instanceof URL` checks
+ * work reliably.
+ */
+export declare const ASH_URL_SCHEME = "ash-url:";
+export declare function serializeUrlFilePart(url: URL): string;
+export declare function isSerializedUrlFilePart(data: unknown): data is string;
+export declare function deserializeUrlFilePart(data: string): URL;

package/dist/src/internal/attachments/url-refs.js

@@ -0,0 +1,20 @@
+/**
+ * Custom URL scheme for serializing `URL` objects in `FilePart.data`
+ * across the queue boundary.
+ *
+ * Route handlers place `new URL("https://...")` on `FilePart.data`.
+ * Before the message crosses the queue, `send()` rewrites these as
+ * `ash-url:https://...` strings. After the queue, the staging pipeline
+ * reconstitutes them back to `URL` objects so `instanceof URL` checks
+ * work reliably.
+ */
+export const ASH_URL_SCHEME = "ash-url:";
+export function serializeUrlFilePart(url) {
+    return `${ASH_URL_SCHEME}${url.href}`;
+}
+export function isSerializedUrlFilePart(data) {
+    return typeof data === "string" && data.startsWith(ASH_URL_SCHEME);
+}
+export function deserializeUrlFilePart(data) {
+    return new URL(data.slice(ASH_URL_SCHEME.length));
+}

package/dist/src/internal/nitro/host/configure-nitro-routes.d.ts

@@ -5,6 +5,5 @@ import type { NitroBuildSurface, PreparedApplicationHost } from "#internal/nitro
  * SDK endpoints into one Nitro host instance.
  */
 export declare function configureNitroRoutes(nitro: Nitro, preparedHost: PreparedApplicationHost, input: {
-    homePageHtml: string;
     surface: NitroBuildSurface;
 }): Promise<void>;

package/dist/src/internal/nitro/host/configure-nitro-routes.js

@@ -1,6 +1,6 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import { dirname, join, relative } from "node:path";
-import { ASH_HEALTH_ROUTE_PATH, ASH_HOME_ROUTE_PATH } from "#protocol/routes.js";
+import { ASH_HEALTH_ROUTE_PATH, ASH_INFO_ROUTE_PATH } from "#protocol/routes.js";
 import { normalizeEsmImportSpecifier, stringifyEsmImportSpecifier, } from "#internal/application/import-specifier.js";
 import { resolvePackageRoot, resolvePackageSourceFilePath, resolveWorkflowModulePath, } from "#internal/application/package.js";
 import { WorkflowBundleBuilder } from "#internal/workflow-bundle/builder.js";
@@ -118,7 +118,12 @@ function buildWorkflowFileHandlerSource(input) {
 }
 /**
  * Registers a virtual Nitro handler for a framework route that needs
- * build-time config values (e.g. homePageHtml, appRoot) baked in.
+ * build-time config values (e.g. `appRoot`) baked in.
+ *
+ * The generated handler is invoked by Nitro with `(event)` and forwards
+ * `event.req` as the trailing argument to `${handlerExport}`, so the
+ * handler can run request-time auth, header inspection, etc. on top of
+ * its baked-in config.
  */
 function addFrameworkVirtualHandler(nitro, input) {
     const virtualId = `#ash-route${input.route}`;
@@ -130,7 +135,7 @@ function addFrameworkVirtualHandler(nitro, input) {
     });
     nitro.options.virtual[virtualId] = [
         `import { ${input.handlerExport} } from ${modulePath};`,
-        `export default () => ${input.handlerExport}(${input.args});`,
+        `export default async (event) => ${input.handlerExport}(${input.args}, event.req);`,
     ].join("\n");
 }
 /**
@@ -183,28 +188,30 @@ export async function configureNitroRoutes(nitro, preparedHost, input) {
         dev: nitro.options.dev,
     });
     if (includesApplicationRoutes(input.surface)) {
-        // Framework routes that need build-time config are registered as virtual
-        // handlers so the values are baked in — no global runtime config store.
-        addFrameworkVirtualHandler(nitro, {
-            args: JSON.stringify({ homePageHtml: input.homePageHtml }),
-            handlerExport: "handleHomePageRequest",
+        // Framework routes that need no build-time config use physical handler
+        // files directly. The home page is a fully static, build-time-baked HTML
+        // string with no agent metadata, so it does not need to round-trip
+        // through the virtual-handler args plumbing.
+        registerHandler(nitro, {
+            handlerPath: resolvePackageSourceFilePath("src/internal/nitro/routes/index.ts"),
             method: "GET",
-            modulePath: resolvePackageSourceFilePath("src/internal/nitro/routes/index.ts"),
             route: "/",
         });
-        addFrameworkVirtualHandler(nitro, {
-            args: JSON.stringify({ appRoot: artifactsConfig.appRoot }),
-            handlerExport: "handleHomePageDataRequest",
-            method: "GET",
-            modulePath: resolvePackageSourceFilePath("src/internal/nitro/routes/home.ts"),
-            route: ASH_HOME_ROUTE_PATH,
-        });
-        // Framework routes that need no config use physical handler files directly.
         registerHandler(nitro, {
             handlerPath: resolvePackageSourceFilePath("src/internal/nitro/routes/health.ts"),
             method: "GET",
             route: ASH_HEALTH_ROUTE_PATH,
         });
+        // The agent info endpoint needs `appRoot` baked at build time (used by
+        // the disk-source fallback in dev) and runs request-time auth, so it
+        // stays a virtual handler.
+        addFrameworkVirtualHandler(nitro, {
+            args: JSON.stringify({ appRoot: artifactsConfig.appRoot }),
+            handlerExport: "handleAgentInfoRequest",
+            method: "GET",
+            modulePath: resolvePackageSourceFilePath("src/internal/nitro/routes/info.ts"),
+            route: ASH_INFO_ROUTE_PATH,
+        });
         registerHandler(nitro, {
             handlerPath: resolvePackageSourceFilePath("src/internal/nitro/routes/workflow-runs.ts"),
             method: "GET",

package/dist/src/internal/nitro/host/create-application-nitro.js

@@ -3,7 +3,6 @@ import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createNitro } from "nitro/builder";
 import { ASH_PACKAGE_NAME } from "#package-name.js";
-import { ASH_HOME_PAGE_UI_ROUTE_PREFIX } from "#protocol/routes.js";
 import { resolvePackageSourceDirectoryPath, resolvePackageSourceFilePath, resolveWorkflowModulePath, } from "#internal/application/package.js";
 import { prepareAshVersionedCacheDirectory, writeAshVersionedCacheMetadata, } from "#internal/application/cache-metadata.js";
 import { resolveNitroBuildDirectory } from "#internal/application/paths.js";
@@ -11,7 +10,6 @@ import { createNitroArtifactsConfig, } from "#internal/nitro/host/artifacts-conf
 import { createCompiledSandboxBackendPrunePlugin } from "#internal/nitro/host/compiled-sandbox-backend-prune-plugin.js";
 import { configureNitroRoutes } from "#internal/nitro/host/configure-nitro-routes.js";
 import { applyAshCronHandlerRoute } from "#internal/nitro/host/cron-handler-route.js";
-import { loadHomePageWebAssets, } from "#internal/nitro/host/load-home-page-web-assets.js";
 import { createNitroBundlerConfig } from "#internal/nitro/host/nitro-bundler-config.js";
 import { addNitroRoutingImportSpecifierPlugin } from "#internal/nitro/host/nitro-routing-import-specifier-plugin.js";
 import { registerScheduleTaskHandlers } from "#internal/nitro/host/schedule-task-routes.js";
@@ -371,7 +369,6 @@ function patchWorkflowTransformExcludePath(nitro, workflowBuildDir) {
  */
 export async function createApplicationNitro(preparedHost, dev, options = {}) {
     const surface = options.surface ?? "all";
-    const homePageWebAssets = await loadHomePageWebAssets();
     // In dev mode, schedules are skipped unless explicitly enabled via
     // `ash dev --schedules`. Production builds always register schedules.
     const schedulesAllowed = !dev || options.schedules === true;
@@ -406,9 +403,7 @@ export async function createApplicationNitro(preparedHost, dev, options = {}) {
             },
         preset,
         plugins: nitroPlugins,
-        publicAssets: includesApplicationSurface(surface)
-            ? createHomePagePublicAssetEntries(homePageWebAssets)
-            : [],
+        publicAssets: [],
         scanDirs: includesWorkflowStepRegistrations(surface)
             ? [resolvePackageSourceDirectoryPath("src/execution")]
             : undefined,
@@ -487,7 +482,6 @@ export async function createApplicationNitro(preparedHost, dev, options = {}) {
         });
     }
     await configureNitroRoutes(nitro, preparedHost, {
-        homePageHtml: homePageWebAssets.homePageHtml,
         surface,
     });
     if (includesWorkflowStepRegistrations(surface)) {
@@ -495,12 +489,3 @@ export async function createApplicationNitro(preparedHost, dev, options = {}) {
     }
     return nitro;
 }
-function createHomePagePublicAssetEntries(homePageWebAssets) {
-    return [
-        {
-            baseURL: ASH_HOME_PAGE_UI_ROUTE_PREFIX,
-            dir: homePageWebAssets.assetsDirectoryPath,
-            maxAge: 60 * 60 * 24 * 365,
-        },
-    ];
-}

package/dist/src/internal/nitro/routes/agent-info/build-agent-info-response.d.ts

@@ -0,0 +1,87 @@
+import type { AgentInfoData } from "#internal/nitro/routes/agent-info/load-agent-info-data.js";
+/**
+ * One summary count shown in the agent info overview.
+ */
+export interface AgentInfoSummaryCount {
+    readonly label: string;
+    readonly value: number;
+}
+/**
+ * One source-backed row in the agent info tables.
+ */
+export interface AgentInfoSourceRow {
+    readonly details: string;
+    readonly logicalPath: string;
+    readonly name: string;
+    readonly sourceKind: string;
+}
+/**
+ * One schedule row in the agent info schedule table.
+ */
+export interface AgentInfoScheduleRow {
+    readonly cron: string;
+    readonly logicalPath: string;
+    readonly name: string;
+    readonly preview: string;
+}
+/**
+ * One subagent row in the agent info subagent table.
+ */
+export interface AgentInfoSubagentRow {
+    readonly details: string;
+    readonly kind: "Local";
+    readonly logicalPath: string;
+    readonly name: string;
+}
+/**
+ * One endpoint row in the agent info endpoint table.
+ */
+export interface AgentInfoEndpointRow {
+    readonly method: "GET" | "POST";
+    readonly name: string;
+    readonly notes: string;
+    readonly path: string;
+}
+/**
+ * Runtime overview section returned by the agent info route.
+ */
+export interface AgentInfoOverview {
+    readonly configMetadata: Readonly<Record<string, string>>;
+    readonly configSource: string;
+    readonly discoveryErrors: number;
+    readonly discoveryWarnings: number;
+    readonly modelId: string;
+    readonly subagentCount: number;
+    readonly instructionsPromptSource: string;
+}
+/**
+ * Instructions prompt section returned by the agent info route.
+ */
+export interface AgentInfoInstructionsPrompt {
+    readonly logicalPath: string;
+    readonly markdownPreview: string;
+}
+/**
+ * Full response payload returned by `GET /ash/v1/info`.
+ */
+export interface AgentInfoResponse {
+    readonly agentId: string;
+    readonly endpointRows: readonly AgentInfoEndpointRow[];
+    readonly heroSummary: string;
+    readonly messageRequestExample: string;
+    readonly overview: AgentInfoOverview;
+    readonly pageDescription: string;
+    readonly pageTitle: string;
+    readonly sandbox: AgentInfoSourceRow | null;
+    readonly schedules: readonly AgentInfoScheduleRow[];
+    readonly skills: readonly AgentInfoSourceRow[];
+    readonly subagents: readonly AgentInfoSubagentRow[];
+    readonly summaryCounts: readonly AgentInfoSummaryCount[];
+    readonly instructions: AgentInfoSourceRow | null;
+    readonly instructionsPrompt: AgentInfoInstructionsPrompt;
+    readonly tools: readonly AgentInfoSourceRow[];
+}
+/**
+ * Builds the JSON payload served by `GET /ash/v1/info`.
+ */
+export declare function buildAgentInfoResponse(data: AgentInfoData): AgentInfoResponse;

package/dist/src/internal/nitro/routes/{home-page/build-home-page-response.js → agent-info/build-agent-info-response.js}

@@ -1,4 +1,4 @@
-import { ASH_CONTINUE_SESSION_ROUTE_PATTERN, ASH_CREATE_SESSION_ROUTE_PATH, ASH_HEALTH_ROUTE_PATH, ASH_HOME_ROUTE_PATH, ASH_MESSAGE_STREAM_ROUTE_PATTERN, } from "#protocol/routes.js";
+import { ASH_CONTINUE_SESSION_ROUTE_PATTERN, ASH_CREATE_SESSION_ROUTE_PATH, ASH_HEALTH_ROUTE_PATH, ASH_INFO_ROUTE_PATH, ASH_MESSAGE_STREAM_ROUTE_PATTERN, } from "#protocol/routes.js";
 function pluralize(count, noun) {
     return `${count} ${noun}${count === 1 ? "" : "s"}`;
 }
@@ -90,9 +90,9 @@ function renderEndpointRows() {
         },
         {
             method: "GET",
-            name: "Home data",
-            notes: "Inspection JSON consumed by the static home page.",
-            path: ASH_HOME_ROUTE_PATH,
+            name: "Agent info",
+            notes: "Inspection JSON for the deployed agent. Requires Vercel OIDC auth on Vercel.",
+            path: ASH_INFO_ROUTE_PATH,
         },
         {
             method: "POST",
@@ -115,9 +115,9 @@ function renderEndpointRows() {
     ];
 }
 /**
- * Builds the JSON payload served to Ash's static Nitro home page.
+ * Builds the JSON payload served by `GET /ash/v1/info`.
  */
-export function buildHomePageResponse(data) {
+export function buildAgentInfoResponse(data) {
     const instructions = data.agent.instructions;
     const requestExample = `POST ${ASH_CREATE_SESSION_ROUTE_PATH}
 content-type: application/json

package/dist/src/internal/nitro/routes/{home-page/load-home-page-data.d.ts → agent-info/load-agent-info-data.d.ts}

@@ -2,25 +2,25 @@ import type { CompiledAgentManifest, CompiledSubagentNode } from "#compiler/mani
 import { type RuntimeCompiledArtifactsSource } from "#runtime/compiled-artifacts-source.js";
 import type { ResolvedAgent, ResolvedSandboxDefinition, ResolvedSchedule, ResolvedSkillDefinition, ResolvedInstructions } from "#runtime/types.js";
 /**
- * Runtime data needed to build the package-owned Nitro homepage.
+ * Runtime data needed to build the package-owned `GET /ash/v1/info`
+ * inspection JSON.
  */
-export interface HomePageData {
+export interface AgentInfoData {
     readonly agent: ResolvedAgent;
     readonly manifest: CompiledAgentManifest;
     readonly schedules: readonly ResolvedSchedule[];
 }
 /**
- * Loads the resolved runtime data displayed on Ash's package-owned Nitro
- * homepage.
+ * Loads the resolved runtime data projected by `GET /ash/v1/info`.
  */
-export declare function loadHomePageData(input: {
+export declare function loadAgentInfoData(input: {
     readonly compiledArtifactsSource: RuntimeCompiledArtifactsSource;
-}): Promise<HomePageData>;
+}): Promise<AgentInfoData>;
 /**
  * Resolves the explicit runtime artifact source used by the package-owned
- * Nitro home page.
+ * `GET /ash/v1/info` handler.
  */
-export declare function resolveHomePageCompiledArtifactsSource(input?: {
+export declare function resolveAgentInfoCompiledArtifactsSource(input?: {
     readonly appRoot?: string;
 }): RuntimeCompiledArtifactsSource;
 export type { CompiledAgentManifest, CompiledSubagentNode, ResolvedSandboxDefinition, ResolvedSchedule, ResolvedSkillDefinition, ResolvedInstructions, };

package/dist/src/internal/nitro/routes/{home-page/load-home-page-data.js → agent-info/load-agent-info-data.js}

@@ -5,26 +5,25 @@ import { loadCompiledModuleMap } from "#runtime/loaders/module-map.js";
 import { resolveAgent } from "#runtime/resolve-agent.js";
 import { resolveSchedules } from "#runtime/schedules/resolve-schedule.js";
 /**
- * Loads the resolved runtime data displayed on Ash's package-owned Nitro
- * homepage.
+ * Loads the resolved runtime data projected by `GET /ash/v1/info`.
  */
-export async function loadHomePageData(input) {
-    return await loadHomePageDataFromArtifacts(input.compiledArtifactsSource);
+export async function loadAgentInfoData(input) {
+    return await loadAgentInfoDataFromArtifacts(input.compiledArtifactsSource);
 }
 /**
  * Resolves the explicit runtime artifact source used by the package-owned
- * Nitro home page.
+ * `GET /ash/v1/info` handler.
  */
-export function resolveHomePageCompiledArtifactsSource(input = {}) {
+export function resolveAgentInfoCompiledArtifactsSource(input = {}) {
     if (readBundledCompiledArtifacts() !== null) {
         return createBundledRuntimeCompiledArtifactsSource();
     }
     if (input.appRoot !== undefined) {
         return createDiskRuntimeCompiledArtifactsSource(input.appRoot);
     }
-    throw new Error("Ash home page runtime data requires bundled artifacts or an app root.");
+    throw new Error("Ash agent info runtime data requires bundled artifacts or an app root.");
 }
-async function loadHomePageDataFromArtifacts(compiledArtifactsSource) {
+async function loadAgentInfoDataFromArtifacts(compiledArtifactsSource) {
     const [manifest, moduleMap] = await Promise.all([
         loadCompiledManifest({
             compiledArtifactsSource,

package/dist/src/internal/nitro/routes/index.d.ts

@@ -1,7 +1,12 @@
+import type { H3Event } from "nitro";
 /**
- * Builds the package-owned home page response for one resolved application.
+ * Builds the barebones home page response for one request. Exposed
+ * for tests so callers can supply a real {@link Request}; production
+ * traffic flows through the Nitro {@link H3Event} default export.
  */
-export declare function handleHomePageRequest(input: {
-    agentInfoOnlyMode?: boolean;
-    homePageHtml: string;
-}): Promise<Response>;
+export declare function buildHomePageResponse(request: Request): Response;
+/**
+ * Nitro route handler for `GET /`. Adapts the Nitro event shape into
+ * {@link buildHomePageResponse}.
+ */
+export default function handleHomePageRequest(event: H3Event): Response;

package/dist/src/internal/nitro/routes/index.js

@@ -1,31 +1,238 @@
-function resolveAgentInfoOnlyMode(configuredAgentInfoOnlyMode) {
-    if (typeof configuredAgentInfoOnlyMode === "boolean") {
-        return configuredAgentInfoOnlyMode;
+/**
+ * Public docs URL surfaced from the barebones home page. Kept in source
+ * so the deployment output is a fully static, build-time-baked HTML
+ * response that performs no runtime resolution.
+ */
+const ASH_DOCS_URL = "https://ash.labs.vercel.dev/";
+const DEPLOYMENT_URL_PLACEHOLDER = "{{DEPLOYMENT_URL}}";
+/**
+ * Barebones HTML served at `GET /`.
+ *
+ * Reveals no information about the deployed agent — no name, no model,
+ * no instructions, no list of skills or schedules, no API endpoint paths.
+ * This is intentional: the root URL of a deployment is reachable by
+ * anyone on the public internet, and the deployment must not advertise
+ * its agent's configuration to unauthenticated callers. Inspection JSON
+ * (model id, instructions preview, skills, etc.) lives behind default
+ * Vercel OIDC auth on `/ash/v1/info`.
+ *
+ * The page also loads zero external assets — no fonts, no scripts, no
+ * images, no analytics beacons — so it cannot leak the deployment's
+ * origin to a third party simply by being visited.
+ *
+ * `{{DEPLOYMENT_URL}}` is the only request-time substitution: the page
+ * echoes the visitor's own request origin back into the `$ ash dev …`
+ * hint so they can copy-paste it without typing the URL by hand. We
+ * don't read any other request state.
+ */
+const HOME_PAGE_HTML_TEMPLATE = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="robots" content="noindex">
+<meta name="referrer" content="no-referrer">
+<title>ash</title>
+<style>
+  :root {
+    color-scheme: light dark;
+    --bg: #fff;
+    --fg: #0a0a0a;
+    --muted: #6b6b6b;
+    --faint: #999;
+    --border: rgba(0, 0, 0, 0.09);
+    --surface: rgba(0, 0, 0, 0.025);
+    --accent: #00c46a;
+    --accent-glow: rgba(0, 196, 106, 0.18);
+    --button-bg: #0a0a0a;
+    --button-fg: #fff;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --bg: #000;
+      --fg: #ededed;
+      --muted: #8f8f8f;
+      --faint: #666;
+      --border: rgba(255, 255, 255, 0.1);
+      --surface: rgba(255, 255, 255, 0.035);
+      --accent: #46d4a4;
+      --accent-glow: rgba(70, 212, 164, 0.22);
+      --button-bg: #fff;
+      --button-fg: #000;
     }
-    return process.env.VERCEL === "1";
+  }
+  * { box-sizing: border-box; }
+  html, body { height: 100%; margin: 0; }
+  body {
+    background: var(--bg);
+    color: var(--fg);
+    font-family: ui-sans-serif, -apple-system, BlinkMacSystemFont, "Segoe UI",
+      Roboto, "Helvetica Neue", Arial, sans-serif;
+    font-feature-settings: "cv11", "ss01";
+    font-size: 15px;
+    line-height: 1.55;
+    -webkit-font-smoothing: antialiased;
+    -moz-osx-font-smoothing: grayscale;
+    text-rendering: optimizeLegibility;
+    display: grid;
+    place-items: center;
+    padding: 2rem;
+  }
+  .mono {
+    font-family: ui-monospace, "SF Mono", "Menlo", "JetBrains Mono",
+      "Cascadia Code", Consolas, "Liberation Mono", monospace;
+    font-feature-settings: "zero", "ss01";
+  }
+  main {
+    width: 100%;
+    max-width: 32rem;
+    text-align: center;
+  }
+  .status {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.5rem;
+    padding: 0.3125rem 0.75rem;
+    background: var(--surface);
+    border: 1px solid var(--border);
+    border-radius: 9999px;
+    font-size: 0.75rem;
+    color: var(--muted);
+    margin: 0 0 2rem;
+  }
+  .status-dot {
+    width: 6px;
+    height: 6px;
+    border-radius: 50%;
+    background: var(--accent);
+    box-shadow: 0 0 0 3px var(--accent-glow);
+    flex-shrink: 0;
+  }
+  h1 {
+    margin: 0 0 0.875rem;
+    font-size: clamp(2.5rem, 9vw, 3.25rem);
+    font-weight: 500;
+    letter-spacing: -0.05em;
+    line-height: 1;
+  }
+  .lede {
+    margin: 0 0 1.5rem;
+    color: var(--muted);
+    font-size: 0.9375rem;
+  }
+  .lede a {
+    color: var(--fg);
+    text-decoration: underline;
+    text-decoration-thickness: 1px;
+    text-underline-offset: 3px;
+    text-decoration-color: var(--border);
+    transition: text-decoration-color 0.15s ease;
+    white-space: nowrap;
+  }
+  .lede a:hover { text-decoration-color: var(--fg); }
+  .lede-arrow {
+    display: inline-block;
+    margin-left: 0.125rem;
+    transition: transform 0.15s ease;
+  }
+  .lede a:hover .lede-arrow { transform: translateX(2px); }
+  .terminal {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.625rem;
+    width: 100%;
+    max-width: 28rem;
+    padding: 0.75rem 1rem;
+    background: var(--surface);
+    border: 1px solid var(--border);
+    border-radius: 0.5rem;
+    text-align: left;
+    font-size: 0.8125rem;
+    margin: 0 auto;
+    overflow-x: auto;
+    white-space: nowrap;
+  }
+  .terminal-prompt {
+    color: var(--faint);
+    user-select: none;
+    flex-shrink: 0;
+  }
+  .terminal-cmd { color: var(--fg); }
+</style>
+</head>
+<body>
+<main>
+  <span class="status mono">
+    <span class="status-dot" aria-hidden="true"></span>
+    running
+  </span>
+  <h1 class="mono">ash</h1>
+  <p class="lede">The agent is up and accepting messages. <a href="${ASH_DOCS_URL}">Read the docs<span class="lede-arrow" aria-hidden="true">&nbsp;&rarr;</span></a></p>
+  <div class="terminal mono" role="group" aria-label="Send a message from your terminal">
+    <span class="terminal-prompt" aria-hidden="true">$</span>
+    <span class="terminal-cmd">ash dev ${DEPLOYMENT_URL_PLACEHOLDER}</span>
+  </div>
+</main>
+</body>
+</html>
+`;
+function escapeHtml(value) {
+    return value
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
 }
-function injectHomePageRuntimeFlags(input) {
-    const runtimeFlagsScript = `<script>globalThis.__ASH_UI_AGENT_INFO_ONLY_MODE__=${input.agentInfoOnlyMode ? "true" : "false"};</script>`;
-    if (input.homePageHtml.includes("</head>")) {
-        return input.homePageHtml.replace("</head>", `${runtimeFlagsScript}</head>`);
+function pickFirstForwardedValue(value) {
+    if (value === null) {
+        return undefined;
     }
-    if (input.homePageHtml.includes("</body>")) {
-        return input.homePageHtml.replace("</body>", `${runtimeFlagsScript}</body>`);
+    const first = value.split(",")[0]?.trim();
+    if (first === undefined || first.length === 0) {
+        return undefined;
     }
-    return `${runtimeFlagsScript}${input.homePageHtml}`;
+    return first;
 }
 /**
- * Builds the package-owned home page response for one resolved application.
+ * Resolves the public origin a visitor is using to reach the deployment.
+ *
+ * Prefers the `x-forwarded-host` / `x-forwarded-proto` headers set by
+ * Vercel's edge so the rendered URL matches the address the visitor
+ * actually typed (including custom domains), then falls back to the
+ * `host` header, then to `request.url` for local `ash dev` runs that
+ * skip the proxy chain. Comma-separated forwarded values are split and
+ * the first hop is used — that is the public-facing entry, the rest are
+ * internal forwarder hostnames.
  */
-export async function handleHomePageRequest(input) {
-    const homePageHtml = injectHomePageRuntimeFlags({
-        agentInfoOnlyMode: resolveAgentInfoOnlyMode(input.agentInfoOnlyMode),
-        homePageHtml: input.homePageHtml,
-    });
-    return new Response(homePageHtml, {
+function resolveDeploymentUrl(request) {
+    const headers = request.headers;
+    const requestUrl = new URL(request.url);
+    const forwardedHost = pickFirstForwardedValue(headers.get("x-forwarded-host"));
+    const forwardedProto = pickFirstForwardedValue(headers.get("x-forwarded-proto"));
+    const host = forwardedHost ?? headers.get("host") ?? requestUrl.host;
+    const proto = forwardedProto ?? requestUrl.protocol.replace(/:$/, "");
+    return `${proto}://${host}`;
+}
+/**
+ * Builds the barebones home page response for one request. Exposed
+ * for tests so callers can supply a real {@link Request}; production
+ * traffic flows through the Nitro {@link H3Event} default export.
+ */
+export function buildHomePageResponse(request) {
+    const deploymentUrl = resolveDeploymentUrl(request);
+    const html = HOME_PAGE_HTML_TEMPLATE.replace(DEPLOYMENT_URL_PLACEHOLDER, escapeHtml(deploymentUrl));
+    return new Response(html, {
         headers: {
             "cache-control": "no-store",
             "content-type": "text/html; charset=utf-8",
         },
     });
 }
+/**
+ * Nitro route handler for `GET /`. Adapts the Nitro event shape into
+ * {@link buildHomePageResponse}.
+ */
+export default function handleHomePageRequest(event) {
+    return buildHomePageResponse(event.req);
+}

package/dist/src/internal/nitro/routes/info.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Builds the package-owned JSON inspection response for the current
+ * agent (model id, instructions preview, skills, schedules, subagents,
+ * tools, sandbox, endpoint catalog).
+ *
+ * The route is gated by {@link resolveAgentInfoAuth} so the deployed URL
+ * does not expose agent metadata to anonymous callers. The same-project
+ * bypass on `vercelOidc()` keeps the route reachable to in-deployment
+ * callers (`apps/nextjs-ash`-style consumers) without any additional
+ * setup.
+ */
+export declare function handleAgentInfoRequest(input: {
+    appRoot?: string;
+}, request: Request): Promise<Response>;