hypervibes 0.0.0-stage → 0.4.0

package/dist/web/agent-events.js

@@ -0,0 +1,418 @@
+import { HyperliquidError } from "../hyperliquid/errors.js";
+import { AgentError, agentId } from "../agents/agent-input.js";
+import { currentUserSession } from "../auth-user.js";
+const encoder = new TextEncoder();
+const heartbeatMs = 15_000;
+const maxFrameBytes = 2 * 1024 * 1024;
+const frame = (event, data) => encoder.encode(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+export const multiplexTopics = ["agent", "chat", "dashboard", "indicators", "chart-layouts", "subagents", "chart", "notifications"];
+const topicLimits = {
+    agent: 4096,
+    chat: maxFrameBytes,
+    dashboard: maxFrameBytes,
+    indicators: 4096,
+    notifications: 4096,
+    "chart-layouts": maxFrameBytes,
+    subagents: maxFrameBytes,
+    chart: maxFrameBytes,
+};
+/** HTTP subscriptions are app-owned, and closed before Fastify drains requests. */
+export class AgentEventStreams {
+    runtime;
+    kind;
+    stopping = false;
+    connections = new Set();
+    tasks = new Set();
+    users = new Map();
+    constructor(runtime, kind = "agent") {
+        this.runtime = runtime;
+        this.kind = kind;
+    }
+    async open(request, id, subagentId, runId) {
+        try {
+            this.runtime.status();
+            if (this.stopping)
+                throw new AgentError("Server is shutting down", 503);
+            if (request.method !== "GET")
+                return new Response(null, { status: 405, headers: { Allow: "GET" } });
+            if ((request.headers.get("origin") && request.headers.get("origin") !== this.runtime.origin)
+                || request.headers.get("sec-fetch-site") === "cross-site")
+                throw new AgentError("Invalid request origin", 403);
+            id = agentId(id);
+            const session = await currentUserSession(this.runtime, request.headers);
+            if (!session)
+                throw new AgentError("Sign in to view this agent", 401);
+            if (this.kind === "provider-login")
+                this.runtime.providers.status(session.user.id, id);
+            else
+                await this.runtime.agents.owned(session.user.id, id);
+            const params = new URL(request.url).searchParams;
+            if (this.kind === "agent") {
+                const raw = params.get("topics") ?? "";
+                const topics = [...new Set(raw.split(",").map((part) => part.trim()).filter(Boolean))];
+                if (!topics.length)
+                    throw new AgentError("Select at least one topic", 400);
+                for (const topic of topics) {
+                    if (!multiplexTopics.includes(topic))
+                        throw new AgentError(`Unknown topic: ${topic}`, 400);
+                }
+                const selection = topics.includes("chart")
+                    ? await this.runtime.hyperliquid.charts.selection(params.get("coin") ?? "", params.get("interval") ?? "")
+                    : undefined;
+                if (this.stopping || request.signal.aborted)
+                    throw new AgentError("Connection closed", 503);
+                const count = this.users.get(session.user.id) ?? 0;
+                if (count >= 10)
+                    throw new AgentError("Too many open event connections", 429);
+                this.users.set(session.user.id, count + 1);
+                return this.connectMultiplex(request, id, session.user.id, session.expiresAt, topics, selection);
+            }
+            const history = this.kind === "runs" ? { subagentId: subagentId ?? "", page: Number(params.get("page") ?? "1") } : undefined;
+            if (history)
+                await this.runtime.agents.subagents.history(session.user.id, id, history.subagentId, history.page);
+            const run = this.kind === "run" ? { subagentId: subagentId ?? "", runId: runId ?? "" } : undefined;
+            if (run)
+                await this.runtime.agents.subagents.ownedRun(session.user.id, id, run.subagentId, run.runId);
+            if (this.stopping || request.signal.aborted)
+                throw new AgentError("Connection closed", 503);
+            const count = this.users.get(session.user.id) ?? 0;
+            if (count >= 10)
+                throw new AgentError("Too many open event connections", 429);
+            this.users.set(session.user.id, count + 1);
+            return this.connect(request, id, session.user.id, session.expiresAt, history, run);
+        }
+        catch (error) {
+            const expected = error instanceof AgentError || error instanceof HyperliquidError;
+            const status = expected ? error.status : 503;
+            const message = expected ? error.message : "Agent event stream is unavailable";
+            return Response.json({ error: message }, { status, headers: { "Cache-Control": "no-store" } });
+        }
+    }
+    startTopic(topic, ctx) {
+        const publish = (snapshot) => ctx.publish(topic, snapshot);
+        switch (topic) {
+            case "agent": return this.runtime.agents.watchAgent(ctx.userId, ctx.id, ctx.signal, publish);
+            case "chat": return this.runtime.agents.watchChat(ctx.userId, ctx.id, ctx.signal, publish);
+            case "dashboard": return this.runtime.hyperliquid.watchDashboard(ctx.userId, ctx.id, ctx.signal, publish);
+            case "notifications": return this.runtime.notifications.watch(ctx.id, ctx.signal, publish);
+            case "indicators": return this.runtime.agents.indicators.watch(ctx.id, ctx.signal, publish);
+            case "chart-layouts": return this.runtime.agents.watchChartLayouts(ctx.userId, ctx.id, ctx.signal, publish);
+            case "subagents": return this.runtime.agents.subagents.watchDashboard(ctx.userId, ctx.id, ctx.signal, publish);
+            case "chart": return this.runtime.hyperliquid.charts.watch(ctx.selection, ctx.signal, publish);
+        }
+    }
+    connectMultiplex(request, id, userId, expiresAt, topics, selection) {
+        const abort = new AbortController();
+        let controller;
+        const pending = new Map();
+        const topicControllers = new Map();
+        for (const topic of topics)
+            topicControllers.set(topic, new AbortController());
+        abort.signal.addEventListener("abort", () => { for (const topicController of topicControllers.values())
+            topicController.abort(); });
+        let closed = false;
+        let expiry = expiresAt.getTime();
+        let heartbeat;
+        let deadline;
+        let checking = false;
+        let ticks = 0;
+        const flush = () => {
+            while (!closed && pending.size > 0 && (controller.desiredSize ?? 0) > 0) {
+                const first = pending.entries().next();
+                if (first.done)
+                    return;
+                const [, value] = first.value;
+                pending.delete(first.value[0]);
+                controller.enqueue(value);
+            }
+        };
+        const finish = (event, message, cancelled = false) => {
+            if (closed)
+                return;
+            closed = true;
+            pending.clear();
+            clearInterval(heartbeat);
+            clearTimeout(deadline);
+            request.signal.removeEventListener("abort", disconnect);
+            agentLifetime?.removeEventListener("abort", unavailable);
+            this.connections.delete(shutdown);
+            const remaining = (this.users.get(userId) ?? 1) - 1;
+            if (remaining > 0)
+                this.users.set(userId, remaining);
+            else
+                this.users.delete(userId);
+            abort.abort();
+            try {
+                if (!cancelled && event)
+                    controller.enqueue(frame(event, { message }));
+                // Always close: a disconnected consumer still awaits a definite end.
+                controller.close();
+            }
+            catch { /* The consumer already cancelled or the stream already ended. */ }
+        };
+        const agentLifetime = this.runtime.agents.signal(id);
+        const unavailable = () => finish("unavailable", "Agent is being deleted.");
+        const disconnect = () => finish(undefined, undefined, true);
+        const shutdown = () => finish("shutdown", "Server is restarting. Reconnecting…");
+        const scheduleExpiry = () => {
+            clearTimeout(deadline);
+            const remaining = expiry - Date.now();
+            if (remaining <= 0) {
+                finish("unauthorized", "Session expired. Please sign in again.");
+                return;
+            }
+            deadline = setTimeout(scheduleExpiry, Math.min(remaining, 2_147_483_647));
+            deadline.unref();
+        };
+        const revalidate = async () => {
+            if (closed || checking)
+                return;
+            checking = true;
+            try {
+                const session = await currentUserSession(this.runtime, request.headers);
+                if (closed)
+                    return;
+                if (!session || session.user.id !== userId) {
+                    finish("unauthorized", "Session ended. Please sign in again.");
+                    return;
+                }
+                await this.runtime.agents.owned(userId, id);
+                if (closed)
+                    return;
+                expiry = session.expiresAt.getTime();
+                scheduleExpiry();
+            }
+            catch {
+                finish("unavailable", "Unable to verify this session. Reconnecting…");
+            }
+            finally {
+                checking = false;
+            }
+        };
+        const failTopic = (topic, message) => {
+            if (closed)
+                return;
+            topicControllers.get(topic)?.abort();
+            try {
+                if ((controller.desiredSize ?? 0) > 0)
+                    controller.enqueue(frame("stream-error", { topic, message }));
+                else {
+                    // Backpressure: queue behind pending frames is unnecessary; stream-errors
+                    // are terminal for their topic and must not be dropped. Enqueue anyway;
+                    // the stream buffers until the consumer reads.
+                    controller.enqueue(frame("stream-error", { topic, message }));
+                }
+            }
+            catch { /* The consumer already cancelled or the stream already ended. */ }
+        };
+        const publish = (topic, snapshot) => {
+            if (closed || topicControllers.get(topic)?.signal.aborted)
+                return;
+            if (Date.now() >= expiry) {
+                finish("unauthorized", "Session expired. Please sign in again.");
+                return;
+            }
+            const value = frame(topic, snapshot);
+            if (value.byteLength > topicLimits[topic]) {
+                failTopic(topic, topic === "indicators"
+                    ? "Indicator updates are too large to stream. Reload the page."
+                    : "Snapshot is too large to stream. Reload the page to view it.");
+                return;
+            }
+            // Keep one newest pending snapshot per topic, not an unbounded queue of token events.
+            pending.set(topic, value);
+            flush();
+        };
+        const stream = new ReadableStream({
+            start(value) { controller = value; controller.enqueue(encoder.encode("retry: 3000\n\n")); },
+            pull: flush,
+            cancel: disconnect,
+        }, { highWaterMark: 1 });
+        this.connections.add(shutdown);
+        request.signal.addEventListener("abort", disconnect, { once: true });
+        agentLifetime?.addEventListener("abort", unavailable, { once: true });
+        if (agentLifetime?.aborted)
+            unavailable();
+        scheduleExpiry();
+        if (request.signal.aborted)
+            disconnect();
+        if (!closed) {
+            heartbeat = setInterval(() => {
+                if (closed)
+                    return;
+                if ((controller.desiredSize ?? 0) > 0 && pending.size === 0)
+                    controller.enqueue(encoder.encode(": keepalive\n\n"));
+                // Security checks only: no conversation reads or chat polling. Bound the
+                // lifetime of a revoked session even when no new chat updates arrive.
+                if (++ticks % 4 === 0)
+                    void revalidate();
+            }, heartbeatMs);
+            heartbeat.unref();
+            const watchers = topics.map((topic) => {
+                const signal = topicControllers.get(topic).signal;
+                return this.startTopic(topic, { userId, id, signal, selection, publish })
+                    .catch(() => { failTopic(topic, "Agent event stream interrupted. Reconnecting…"); });
+            });
+            const task = Promise.all(watchers)
+                .then(() => { if (!closed)
+                shutdown(); })
+                .finally(() => { this.tasks.delete(task); });
+            this.tasks.add(task);
+        }
+        return new Response(stream, { headers: {
+                "Content-Type": "text/event-stream; charset=utf-8",
+                "Cache-Control": "no-store",
+                "X-Accel-Buffering": "no",
+                "X-Content-Type-Options": "nosniff",
+            } });
+    }
+    connect(request, id, userId, expiresAt, history, run) {
+        const abort = new AbortController();
+        let controller;
+        let pending;
+        let closed = false;
+        let expiry = expiresAt.getTime();
+        let heartbeat;
+        let deadline;
+        let checking = false;
+        let ticks = 0;
+        const flush = () => {
+            if (!closed && pending && (controller.desiredSize ?? 0) > 0) {
+                const value = pending;
+                pending = undefined;
+                controller.enqueue(value);
+            }
+        };
+        const finish = (event, message, cancelled = false) => {
+            if (closed)
+                return;
+            closed = true;
+            pending = undefined;
+            clearInterval(heartbeat);
+            clearTimeout(deadline);
+            request.signal.removeEventListener("abort", disconnect);
+            agentLifetime?.removeEventListener("abort", unavailable);
+            this.connections.delete(shutdown);
+            const remaining = (this.users.get(userId) ?? 1) - 1;
+            if (remaining > 0)
+                this.users.set(userId, remaining);
+            else
+                this.users.delete(userId);
+            abort.abort();
+            try {
+                if (!cancelled && event)
+                    controller.enqueue(frame(event, { message }));
+                // Always close: a disconnected consumer still awaits a definite end.
+                controller.close();
+            }
+            catch { /* The consumer already cancelled or the stream already ended. */ }
+        };
+        const agentLifetime = this.kind === "provider-login" ? undefined : this.runtime.agents.signal(id);
+        const unavailable = () => finish("unavailable", "Agent is being deleted.");
+        const disconnect = () => finish(undefined, undefined, true);
+        const shutdown = () => finish("shutdown", "Server is restarting. Reconnecting…");
+        const scheduleExpiry = () => {
+            clearTimeout(deadline);
+            const remaining = expiry - Date.now();
+            if (remaining <= 0) {
+                finish("unauthorized", "Session expired. Please sign in again.");
+                return;
+            }
+            deadline = setTimeout(scheduleExpiry, Math.min(remaining, 2_147_483_647));
+            deadline.unref();
+        };
+        const revalidate = async () => {
+            if (closed || checking)
+                return;
+            checking = true;
+            try {
+                const session = await currentUserSession(this.runtime, request.headers);
+                if (closed)
+                    return;
+                if (!session || session.user.id !== userId) {
+                    finish("unauthorized", "Session ended. Please sign in again.");
+                    return;
+                }
+                if (this.kind === "provider-login")
+                    this.runtime.providers.status(userId, id);
+                else
+                    await this.runtime.agents.owned(userId, id);
+                if (closed)
+                    return;
+                expiry = session.expiresAt.getTime();
+                scheduleExpiry();
+            }
+            catch {
+                finish("unavailable", "Unable to verify this session. Reconnecting…");
+            }
+            finally {
+                checking = false;
+            }
+        };
+        const publish = (snapshot) => {
+            if (closed)
+                return;
+            if (Date.now() >= expiry) {
+                finish("unauthorized", "Session expired. Please sign in again.");
+                return;
+            }
+            const value = frame(this.kind, snapshot);
+            if (value.byteLength > maxFrameBytes) {
+                finish("stream-error", "Snapshot is too large to stream. Reload the page to view it.");
+                return;
+            }
+            // Keep one newest pending snapshot, not an unbounded queue of token events.
+            pending = value;
+            flush();
+        };
+        const stream = new ReadableStream({
+            start(value) { controller = value; controller.enqueue(encoder.encode("retry: 3000\n\n")); },
+            pull: flush,
+            cancel: disconnect,
+        }, { highWaterMark: 1 });
+        this.connections.add(shutdown);
+        request.signal.addEventListener("abort", disconnect, { once: true });
+        agentLifetime?.addEventListener("abort", unavailable, { once: true });
+        if (agentLifetime?.aborted)
+            unavailable();
+        scheduleExpiry();
+        if (request.signal.aborted)
+            disconnect();
+        if (!closed) {
+            heartbeat = setInterval(() => {
+                if (closed)
+                    return;
+                if ((controller.desiredSize ?? 0) > 0 && !pending)
+                    controller.enqueue(encoder.encode(": keepalive\n\n"));
+                // Security checks only: no conversation reads or chat polling. Bound the
+                // lifetime of a revoked session even when no new chat updates arrive.
+                if (++ticks % 4 === 0)
+                    void revalidate();
+            }, heartbeatMs);
+            heartbeat.unref();
+            const watching = Promise.resolve().then(() => this.kind === "provider-login"
+                ? this.runtime.providers.watchLogin(userId, id, abort.signal, publish)
+                : run ? this.runtime.agents.subagents.watchRun(userId, id, run.subagentId, run.runId, abort.signal, publish)
+                    : history ? this.runtime.agents.subagents.watchHistory(userId, id, history.subagentId, history.page, abort.signal, publish)
+                        : this.runtime.hyperliquid.watchDashboard(userId, id, abort.signal, publish));
+            const task = watching
+                .then(() => { if (!closed)
+                shutdown(); })
+                .catch(() => finish("unavailable", "Agent event stream interrupted. Reconnecting…"))
+                .finally(() => { this.tasks.delete(task); });
+            this.tasks.add(task);
+        }
+        return new Response(stream, { headers: {
+                "Content-Type": "text/event-stream; charset=utf-8",
+                "Cache-Control": "no-store",
+                "X-Accel-Buffering": "no",
+                "X-Content-Type-Options": "nosniff",
+            } });
+    }
+    async close() {
+        this.stopping = true;
+        for (const finish of [...this.connections])
+            finish();
+        await Promise.all(this.tasks);
+    }
+}

package/dist/web/app.js

@@ -0,0 +1,206 @@
+import fastifyStatic from "@fastify/static";
+import Fastify from "fastify";
+import { basename, isAbsolute, join, relative, sep } from "node:path";
+import { CurrencyLogoCache } from "../hyperliquid/logo-cache.js";
+import { isPerpetualLogoSymbol } from "../hyperliquid/currency-logo.js";
+import { ProviderLogoCache, isProviderSlug } from "../providers/provider-logo.js";
+import { NodeRequest, sendNodeResponse } from "srvx/node";
+import { defaultCacheDirectory } from "../config.js";
+import { createRuntime } from "../runtime.js";
+import { AgentEventStreams } from "./agent-events.js";
+import { artifactDownloads } from "./artifact-downloads.js";
+import { runMiddleware } from "./middleware.js";
+import { loadStart } from "./start.js";
+/** Constructs a single embedded runtime and web host, without opening a listener. */
+export async function createApp(config, options = {}) {
+    for (const publicDir of [config.staticDir, join(config.buildDir, "client")]) {
+        const location = relative(publicDir, config.databasePath);
+        if (!isAbsolute(location) && location !== ".." && !location.startsWith(`..${sep}`)) {
+            throw new Error("APP_SQLITE_PATH must be outside public static and client directories");
+        }
+    }
+    const app = Fastify({
+        logger: options.logger ? {
+            level: options.development ? "debug" : "info",
+            redact: ["req.headers.cookie", "req.headers.authorization", "res.headers.set-cookie"],
+            // Colorize only on a real console; journald/piped output stays plain.
+            transport: { target: "pino-pretty", options: { colorize: process.stdout.isTTY === true, singleLine: true, translateTime: "HH:MM:ss.l", ignore: "pid,hostname" } },
+        } : false,
+    });
+    const cacheDir = config.cacheDir ?? defaultCacheDirectory(process.env);
+    const logos = new CurrencyLogoCache(cacheDir, options.logoFetcher);
+    const providerLogos = new ProviderLogoCache(cacheDir, options.logoFetcher);
+    const origin = new URL(config.authOrigin);
+    app.addHook("onRequest", async (request, reply) => {
+        let host;
+        try {
+            host = new URL(`${origin.protocol}//${request.headers.host ?? ""}`).host;
+        }
+        catch { /* Reject malformed hosts below. */ }
+        if (host !== origin.host)
+            return reply.code(400).send({ error: "Invalid request host" });
+    });
+    const runtime = await createRuntime(config, { logger: app.log });
+    const multiplex = new AgentEventStreams(runtime, "agent");
+    const providerLogins = new AgentEventStreams(runtime, "provider-login");
+    const runs = new AgentEventStreams(runtime, "runs");
+    const runDetails = new AgentEventStreams(runtime, "run");
+    let web;
+    // SSE responses must finish before Fastify waits for active HTTP connections.
+    app.addHook("preClose", async () => { await Promise.all([multiplex.close(), providerLogins.close(), runs.close(), runDetails.close(), logos.close(), providerLogos.close()]); });
+    app.addHook("onClose", async () => {
+        try {
+            await web?.close();
+        }
+        finally {
+            await runtime.close(options.forceShutdown);
+        }
+    });
+    let shuttingDown;
+    app.decorate("shutdown", () => shuttingDown ??= (async () => {
+        try {
+            await runtime.agents.drain(options.forceShutdown);
+        }
+        finally {
+            await app.close();
+        }
+    })());
+    try {
+        const development = options.development ?? false;
+        web = await (options.loadWeb ?? loadStart)(config, development);
+        const start = web;
+        app.register(fastifyStatic, {
+            root: config.staticDir,
+            prefix: "/static/",
+            dotfiles: "deny",
+            index: false,
+            cacheControl: false,
+            setHeaders(response, path) {
+                if (relative(config.staticDir, path).startsWith(`dist${sep}`)) {
+                    response.header("Cache-Control", "no-store");
+                }
+            },
+        });
+        if (!development) {
+            app.register(fastifyStatic, {
+                root: join(config.buildDir, "client", "assets"),
+                prefix: "/assets/",
+                decorateReply: false,
+                dotfiles: "deny",
+                index: false,
+                setHeaders(response, path) {
+                    // Vite's client output uses [name]-[hash].[ext], with an 8-character
+                    // base64url hash. Keep HTML and non-hashed files on the default policy.
+                    const filename = basename(path);
+                    if (/^.+-[A-Za-z0-9_-]{8}\.[A-Za-z0-9]+$/.test(filename) && !/\.html?$/i.test(filename)) {
+                        response.header("Cache-Control", "public, max-age=31536000, immutable");
+                    }
+                },
+            });
+        }
+        app.get("/currency/:file", async (request, reply) => {
+            const file = request.params.file;
+            const symbol = file.endsWith(".svg") ? file.slice(0, -4) : "";
+            if (!isPerpetualLogoSymbol(symbol))
+                return reply.code(400).type("text/plain").send("Invalid currency logo filename");
+            return reply.type("image/svg+xml; charset=utf-8")
+                .header("Cache-Control", "public, max-age=86400")
+                .header("X-Content-Type-Options", "nosniff")
+                .header("Content-Security-Policy", "sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src 'none'; base-uri 'none'; form-action 'none'")
+                .send(await logos.get(symbol));
+        });
+        app.get("/model-catalog/logos/:file", async (request, reply) => {
+            const file = request.params.file;
+            const provider = file.endsWith(".svg") ? file.slice(0, -4) : "";
+            if (!isProviderSlug(provider))
+                return reply.code(400).type("text/plain").send("Invalid provider logo filename");
+            return reply.type("image/svg+xml; charset=utf-8")
+                .header("Cache-Control", "public, max-age=2592000")
+                .header("X-Content-Type-Options", "nosniff")
+                .header("Content-Security-Policy", "sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src 'none'; base-uri 'none'; form-action 'none'")
+                .send(await providerLogos.get(provider));
+        });
+        artifactDownloads(app, runtime);
+        app.get("/healthz", async () => {
+            runtime.status();
+            await runtime.database.get("SELECT 1");
+            return { status: "ok" };
+        });
+        // Provider sign-in prompts, progress and completion are pushed, with no polling.
+        app.get("/api/providers/logins/:id/events", async (request, reply) => {
+            reply.hijack();
+            const webRequest = new NodeRequest({ req: request.raw, res: reply.raw, maxRequestBodySize: 1024 * 1024 });
+            webRequest.headers.set("x-hv-client-ip", request.ip);
+            const response = await providerLogins.open(webRequest, request.params.id);
+            await sendNodeResponse(reply.raw, response);
+        });
+        // One multiplexed Server-Sent Events subscription per agent page: chat,
+        // dashboard, chart, layouts, indicators and sub-agents share a single
+        // browser connection, with no polling.
+        app.get("/api/agents/:id/stream", async (request, reply) => {
+            reply.hijack();
+            const webRequest = new NodeRequest({ req: request.raw, res: reply.raw, maxRequestBodySize: 1024 * 1024 });
+            webRequest.headers.set("x-hv-client-ip", request.ip);
+            const response = await multiplex.open(webRequest, request.params.id);
+            response.headers.set("Cache-Control", "no-store");
+            await sendNodeResponse(reply.raw, response);
+        });
+        app.get("/api/agents/:id/sub-agents/:subagentId/runs/events", async (request, reply) => {
+            reply.hijack();
+            const webRequest = new NodeRequest({ req: request.raw, res: reply.raw, maxRequestBodySize: 1024 * 1024 });
+            webRequest.headers.set("x-hv-client-ip", request.ip);
+            const response = await runs.open(webRequest, request.params.id, request.params.subagentId);
+            await sendNodeResponse(reply.raw, response);
+        });
+        app.get("/api/agents/:id/sub-agents/:subagentId/runs/:runId/events", async (request, reply) => {
+            reply.hijack();
+            const webRequest = new NodeRequest({ req: request.raw, res: reply.raw, maxRequestBodySize: 1024 * 1024 });
+            webRequest.headers.set("x-hv-client-ip", request.ip);
+            const response = await runDetails.open(webRequest, request.params.id, request.params.subagentId, request.params.runId);
+            await sendNodeResponse(reply.raw, response);
+        });
+        // Leave request streams unread for Start (JSON, FormData, etc.). The Node
+        // adapter enforces a body limit when Start reads buffered or streamed input.
+        app.removeAllContentTypeParsers();
+        app.addContentTypeParser("*", (_request, payload, done) => done(null, payload));
+        app.all("/*", async (request, reply) => {
+            reply.hijack();
+            try {
+                if (start.middleware && await runMiddleware(start.middleware, request.raw, reply.raw))
+                    return;
+                const webRequest = new NodeRequest({ req: request.raw, res: reply.raw, maxRequestBodySize: 1024 * 1024 });
+                // Set this on the Web Request, whose headers may be reconstructed from
+                // Node rawHeaders rather than Fastify's normalized header object.
+                webRequest.headers.set("x-hv-client-ip", request.ip);
+                const response = new URL(webRequest.url).pathname.startsWith("/api/auth/")
+                    ? await runtime.auth.handler(webRequest)
+                    : await start.fetch(webRequest, { context: { runtime } });
+                if (reply.raw.destroyed) {
+                    await response.body?.cancel();
+                    return;
+                }
+                // Never cache cookie-sensitive HTML, server functions or auth responses.
+                response.headers.set("Cache-Control", "no-store");
+                await sendNodeResponse(reply.raw, response);
+            }
+            catch (error) {
+                if (error instanceof Error && error.name === "AbortError" && (request.raw.aborted || reply.raw.destroyed))
+                    return;
+                request.log.error(error, "Web request failed");
+                if (reply.raw.headersSent)
+                    reply.raw.destroy();
+                else {
+                    reply.raw.writeHead(500, { "Content-Type": "text/plain" });
+                    reply.raw.end("Internal Server Error");
+                }
+            }
+        });
+        await app.ready();
+        runtime.start();
+        return app;
+    }
+    catch (error) {
+        await app.close();
+        throw error;
+    }
+}

package/dist/web/artifact-downloads.js

@@ -0,0 +1,23 @@
+import { currentUser } from "../auth-user.js";
+import { AgentError } from "../agents/agent-input.js";
+export function artifactDownloads(app, runtime) {
+    app.get("/api/agents/:agentId/artifacts/:id/content", async (request, reply) => {
+        reply.header("Cache-Control", "no-store").header("X-Content-Type-Options", "nosniff").header("Content-Security-Policy", "sandbox; default-src 'none'; base-uri 'none'");
+        const user = await currentUser(runtime, new Headers({ cookie: request.headers.cookie ?? "" }));
+        if (!user)
+            return reply.code(401).send({ error: "Authentication required" });
+        try {
+            await runtime.agents.owned(user.id, request.params.agentId);
+            const item = await runtime.agents.research.artifacts.get(request.params.agentId, request.params.id);
+            const extension = { "text/markdown": "md", "text/plain": "txt", "text/csv": "csv", "application/json": "json", "image/png": "png", "image/jpeg": "jpg", "image/webp": "webp" }[item.mediaType] ?? "bin";
+            const filename = `${item.title.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 80)}.${extension}`;
+            const disposition = request.query.inline === "1" && item.mediaType.startsWith("image/") ? "inline" : "attachment";
+            return reply.type(item.mediaType).header("Content-Disposition", `${disposition}; filename="${filename}"`).send(item.payload);
+        }
+        catch (error) {
+            if (error instanceof AgentError)
+                return reply.code(error.status).send({ error: error.message });
+            throw error;
+        }
+    });
+}

package/dist/web/middleware.js

@@ -0,0 +1,25 @@
+/** Resolves whether middleware sent a response, including streaming/disconnects. */
+export function runMiddleware(middleware, request, response) {
+    return new Promise((resolve, reject) => {
+        const cleanup = () => {
+            response.off("finish", handled);
+            response.off("close", handled);
+        };
+        const handled = () => { cleanup(); resolve(true); };
+        response.once("finish", handled);
+        response.once("close", handled);
+        try {
+            middleware(request, response, (error) => {
+                cleanup();
+                if (error)
+                    reject(error);
+                else
+                    resolve(false);
+            });
+        }
+        catch (error) {
+            cleanup();
+            reject(error);
+        }
+    });
+}