labgate 0.5.3 → 0.5.5

package/dist/lib/ui.js

@@ -37,11 +37,30 @@ exports.startUI = startUI;
 const http_1 = require("http");
 const fs_1 = require("fs");
 const path_1 = require("path");
+const os_1 = require("os");
 const child_process_1 = require("child_process");
+const util_1 = require("util");
+const crypto_1 = require("crypto");
 const config_js_1 = require("./config.js");
+const container_js_1 = require("./container.js");
 const runtime_js_1 = require("./runtime.js");
+const audit_js_1 = require("./audit.js");
+const slurm_db_js_1 = require("./slurm-db.js");
+const slurm_poller_js_1 = require("./slurm-poller.js");
+const policy_js_1 = require("./policy.js");
+const license_js_1 = require("./license.js");
 const log = __importStar(require("./log.js"));
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 const HTML_PATH = (0, path_1.resolve)(__dirname, '..', 'lib', 'ui.html');
+const FONTS_DIR = (0, path_1.resolve)(__dirname, '..', '..', 'node_modules', 'geist', 'dist', 'fonts');
+const WRITE_TOKEN_PLACEHOLDER = '__LABGATE_WRITE_TOKEN__';
+const UI_WRITE_TOKEN = (0, crypto_1.randomBytes)(24).toString('hex');
+const UI_AUTH_COOKIE = 'labgate_ui_token';
+const LABGATE_INSTRUCTION_START = '<!-- LABGATE_SESSION_INSTRUCTION_START -->';
+const LABGATE_INSTRUCTION_END = '<!-- LABGATE_SESSION_INSTRUCTION_END -->';
+// ── SLURM module state (initialised in startUI when slurm.enabled) ──
+let slurmDB = null;
+let slurmPoller = null;
 function readBody(req) {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -54,9 +73,84 @@ function json(res, data, status = 200) {
     res.writeHead(status, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(data));
 }
+function getHeaderValue(req, name) {
+    const value = req.headers[name.toLowerCase()];
+    if (Array.isArray(value))
+        return value[0] || '';
+    return value || '';
+}
+function requireWriteToken(req, res) {
+    const token = getHeaderValue(req, 'x-labgate-token');
+    if (!token || token !== UI_WRITE_TOKEN) {
+        json(res, { ok: false, error: 'Forbidden' }, 403);
+        return false;
+    }
+    return true;
+}
+function getCookieValue(req, name) {
+    const rawCookie = getHeaderValue(req, 'cookie');
+    if (!rawCookie)
+        return '';
+    const parts = rawCookie.split(';');
+    for (const part of parts) {
+        const idx = part.indexOf('=');
+        if (idx <= 0)
+            continue;
+        const key = part.slice(0, idx).trim();
+        if (key !== name)
+            continue;
+        const value = part.slice(idx + 1).trim();
+        try {
+            return decodeURIComponent(value);
+        }
+        catch {
+            return value;
+        }
+    }
+    return '';
+}
+function isAuthorizedRequest(req, reqUrl, accessToken) {
+    if (!accessToken)
+        return { ok: true, tokenFromQuery: false };
+    const headerToken = getHeaderValue(req, 'x-labgate-auth').trim();
+    if (headerToken && headerToken === accessToken)
+        return { ok: true, tokenFromQuery: false };
+    const cookieToken = getCookieValue(req, UI_AUTH_COOKIE);
+    if (cookieToken && cookieToken === accessToken)
+        return { ok: true, tokenFromQuery: false };
+    const queryToken = (reqUrl.searchParams.get('token') || '').trim();
+    if (queryToken && queryToken === accessToken)
+        return { ok: true, tokenFromQuery: true };
+    return { ok: false, tokenFromQuery: false };
+}
+function serveFontFile(url, res) {
+    // Only allow specific font files from the geist package
+    const match = url.match(/^\/fonts\/([\w-]+\.woff2)$/);
+    if (!match) {
+        res.writeHead(404, { 'Content-Type': 'text/plain' });
+        res.end('Not found');
+        return;
+    }
+    const filename = match[1];
+    // Search across font subdirectories
+    for (const subdir of ['geist-pixel', 'geist-sans', 'geist-mono']) {
+        const fontPath = (0, path_1.join)(FONTS_DIR, subdir, filename);
+        if ((0, fs_1.existsSync)(fontPath)) {
+            const data = (0, fs_1.readFileSync)(fontPath);
+            res.writeHead(200, {
+                'Content-Type': 'font/woff2',
+                'Cache-Control': 'public, max-age=31536000, immutable',
+            });
+            res.end(data);
+            return;
+        }
+    }
+    res.writeHead(404, { 'Content-Type': 'text/plain' });
+    res.end('Font not found');
+}
 function serveHTML(res) {
     try {
-        const html = (0, fs_1.readFileSync)(HTML_PATH, 'utf-8');
+        const html = (0, fs_1.readFileSync)(HTML_PATH, 'utf-8').replaceAll(WRITE_TOKEN_PLACEHOLDER, UI_WRITE_TOKEN);
         res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
         res.end(html);
     }
@@ -66,8 +160,20 @@ function serveHTML(res) {
     }
 }
 function handleGetConfig(_req, res) {
-    const config = (0, config_js_1.loadConfig)();
-    json(res, config);
+    const effective = (0, config_js_1.loadEffectiveConfig)();
+    const response = { ...effective.config };
+    // Attach enterprise metadata so the frontend knows which fields to lock
+    if (effective.enterprise) {
+        response._enterprise = {
+            active: true,
+            institution: effective.institution,
+            isAdmin: effective.isAdmin,
+            lockedFields: [...effective.lockedFields],
+            lockedListItems: effective.lockedListItems,
+            constraints: effective.constraints,
+        };
+    }
+    json(res, response);
 }
 async function handlePostConfig(req, res) {
     try {
@@ -78,6 +184,37 @@ async function handlePostConfig(req, res) {
             json(res, { ok: false, errors }, 400);
             return;
         }
+        // Enforce enterprise policy: reject changes to locked fields
+        const effective = (0, config_js_1.loadEffectiveConfig)();
+        if (effective.enterprise && effective.lockedFields.size > 0) {
+            const violations = [];
+            const orig = effective.config;
+            if (effective.lockedFields.has('runtime') && incoming.runtime !== orig.runtime) {
+                violations.push('runtime');
+            }
+            if (effective.lockedFields.has('image') && incoming.image !== orig.image) {
+                violations.push('image');
+            }
+            if (effective.lockedFields.has('network.mode') && incoming.network?.mode !== orig.network.mode) {
+                violations.push('network.mode');
+            }
+            if (effective.lockedFields.has('audit.enabled') && incoming.audit?.enabled !== orig.audit.enabled) {
+                violations.push('audit.enabled');
+            }
+            if (effective.lockedFields.has('audit.log_dir') && incoming.audit?.log_dir !== orig.audit.log_dir) {
+                violations.push('audit.log_dir');
+            }
+            if (effective.lockedFields.has('slurm.enabled') && incoming.slurm?.enabled !== orig.slurm.enabled) {
+                violations.push('slurm.enabled');
+            }
+            if (violations.length > 0) {
+                json(res, {
+                    ok: false,
+                    errors: [`Cannot change admin-locked fields: ${violations.join(', ')}`],
+                }, 403);
+                return;
+            }
+        }
         const configPath = (0, config_js_1.getConfigPath)();
         // Read existing raw file and parse (strip comments)
         let obj = {};
@@ -101,11 +238,13 @@ async function handlePostConfig(req, res) {
         obj.filesystem = incoming.filesystem;
         obj.commands = incoming.commands;
         obj.network = incoming.network;
+        obj.datasets = incoming.datasets;
         obj.audit = incoming.audit;
         if (incoming.slurm)
             obj.slurm = incoming.slurm;
         const { writeFileSync } = await import('fs');
-        writeFileSync(configPath, JSON.stringify(obj, null, 2) + '\n', 'utf-8');
+        writeFileSync(configPath, JSON.stringify(obj, null, 2) + '\n', { encoding: 'utf-8', mode: config_js_1.PRIVATE_FILE_MODE });
+        (0, config_js_1.ensurePrivateFile)(configPath);
         json(res, { ok: true });
     }
     catch (err) {
@@ -115,150 +254,2028 @@ async function handlePostConfig(req, res) {
 function handleGetConfigPath(_req, res) {
     json(res, { path: (0, config_js_1.getConfigPath)() });
 }
-function handleGetSessions(_req, res) {
-    const config = (0, config_js_1.loadConfig)();
-    const check = (0, runtime_js_1.checkRuntime)(config.runtime);
-    if (!check.ok || !check.runtime) {
-        json(res, { sessions: [], message: 'No container runtime found' });
+const INSTRUCTION_FILE_MAP = {
+    'agent.md': 'AGENTS.md',
+    'agents.md': 'AGENTS.md',
+    'claude.md': 'CLAUDE.md',
+};
+function normalizeSessionId(raw) {
+    const sessionId = (raw || '').trim();
+    return /^[a-zA-Z0-9_-]{4,64}$/.test(sessionId) ? sessionId : null;
+}
+function normalizeInstructionName(raw) {
+    const key = (raw || '').trim().toLowerCase();
+    return INSTRUCTION_FILE_MAP[key] || null;
+}
+function getInstructionFileForAgent(agent) {
+    return (agent || '').toLowerCase() === 'claude' ? 'CLAUDE.md' : 'AGENTS.md';
+}
+function buildLabgateInstructionBlockForWorkdir(workdir) {
+    const lines = [
+        LABGATE_INSTRUCTION_START,
+        '## LabGate Sandbox Context (Auto-Managed)',
+        '- You are running inside a LabGate sandbox container.',
+        '- Path mapping:',
+        `  - Container \`/work\` maps to host \`${workdir}\``,
+        `  - Container \`/home/sandbox\` maps to host \`${(0, config_js_1.getSandboxHome)()}\``,
+    ];
+    let datasets = [];
+    try {
+        const config = (0, config_js_1.loadConfig)();
+        const extraPaths = Array.isArray(config.filesystem?.extra_paths) ? config.filesystem.extra_paths : [];
+        for (const mount of extraPaths) {
+            if (!mount || typeof mount !== 'object')
+                continue;
+            const rawPath = mount.path;
+            const mode = mount.mode;
+            if (typeof rawPath !== 'string')
+                continue;
+            const hostPath = rawPath.replace(/^~/, (0, os_1.homedir)());
+            const mountMode = typeof mode === 'string' ? mode : 'rw';
+            lines.push(`  - Container \`/mnt/${(0, path_1.basename)(hostPath)}\` maps to host \`${hostPath}\` (${mountMode})`);
+        }
+        datasets = Array.isArray(config.datasets) ? config.datasets : [];
+        for (const ds of datasets) {
+            if (!ds || typeof ds !== 'object')
+                continue;
+            const rawPath = ds.path;
+            const name = ds.name;
+            const mode = ds.mode;
+            if (typeof rawPath !== 'string' || typeof name !== 'string')
+                continue;
+            const hostPath = rawPath.replace(/^~/, (0, os_1.homedir)());
+            const mountMode = typeof mode === 'string' ? mode : 'ro';
+            lines.push(`  - Container \`/datasets/${name}\` maps to host \`${hostPath}\` (${mountMode})`);
+        }
+    }
+    catch {
+        // Keep the core mapping block even if config loading fails.
+    }
+    lines.push('- Treat other host paths as unavailable unless explicitly mounted.');
+    lines.push('- When reporting file paths to the user, prefer showing both container and host paths when helpful.');
+    if (datasets.length > 0) {
+        lines.push('');
+        lines.push('### Available Datasets');
+        lines.push('The following named datasets are mounted and available for analysis:');
+        for (const ds of datasets) {
+            if (!ds || typeof ds !== 'object')
+                continue;
+            const name = ds.name;
+            const mode = ds.mode || 'ro';
+            const desc = ds.description;
+            const descStr = typeof desc === 'string' && desc ? ` — ${desc}` : '';
+            lines.push(`- **${name}** at \`/datasets/${name}\` (${mode})${descStr}`);
+        }
+        lines.push('');
+        lines.push('Use these dataset paths directly when the user references data by name.');
+    }
+    lines.push(LABGATE_INSTRUCTION_END);
+    return lines.join('\n');
+}
+function hashText(content) {
+    return (0, crypto_1.createHash)('sha256').update(content, 'utf-8').digest('hex');
+}
+function splitInstructionContent(content) {
+    const startIdx = content.indexOf(LABGATE_INSTRUCTION_START);
+    if (startIdx < 0) {
+        return { managedPresent: false, managedBlock: '', userContent: content };
+    }
+    const endMarkerIdx = content.indexOf(LABGATE_INSTRUCTION_END, startIdx);
+    if (endMarkerIdx < 0) {
+        return { managedPresent: false, managedBlock: '', userContent: content };
+    }
+    const endIdx = endMarkerIdx + LABGATE_INSTRUCTION_END.length;
+    const managedBlock = content.slice(startIdx, endIdx).trimEnd();
+    const withoutManaged = `${content.slice(0, startIdx)}${content.slice(endIdx)}`;
+    const userContent = withoutManaged.replace(/^\n+/, '');
+    return {
+        managedPresent: true,
+        managedBlock,
+        userContent,
+    };
+}
+function buildInstructionContent(managedBlock, userContent) {
+    const normalizedUser = (userContent || '').replace(/^\n+/, '');
+    if (!managedBlock)
+        return normalizedUser;
+    if (!normalizedUser)
+        return `${managedBlock}\n`;
+    return `${managedBlock}\n\n${normalizedUser}`;
+}
+function getInstructionTemplate(name, agent) {
+    if (name === 'CLAUDE.md') {
+        return [
+            '# CLAUDE.md',
+            '',
+            '## Project Context',
+            '- Summarize the project purpose and constraints here.',
+            '',
+            '## Coding Guidelines',
+            '- Prefer minimal, focused changes.',
+            '- Keep tests updated for behavior changes.',
+            '',
+            '## Verification',
+            '- Run relevant unit and integration tests before finishing.',
+            '',
+        ].join('\n');
+    }
+    const agentNote = (agent || '').toLowerCase() === 'codex'
+        ? '- This project is frequently edited via Codex sessions.'
+        : '- This project may be edited by multiple agents.';
+    return [
+        '# AGENTS.md',
+        '',
+        '## Agent Instructions',
+        agentNote,
+        '- Keep edits scoped to the requested task.',
+        '- Do not introduce unrelated refactors.',
+        '',
+        '## Repository Conventions',
+        '- Preserve existing style and architecture.',
+        '- Add tests for new or changed behavior.',
+        '',
+    ].join('\n');
+}
+function getSessionRecord(sessionId) {
+    const sessionFile = (0, path_1.join)((0, config_js_1.getSessionsDir)(), `${sessionId}.json`);
+    if (!(0, fs_1.existsSync)(sessionFile))
+        return null;
+    try {
+        const data = JSON.parse((0, fs_1.readFileSync)(sessionFile, 'utf-8'));
+        const localHost = (0, os_1.hostname)();
+        if (data.node === localHost) {
+            try {
+                process.kill(data.pid, 0);
+            }
+            catch {
+                // Local session died — clean stale record
+                try {
+                    (0, fs_1.unlinkSync)(sessionFile);
+                }
+                catch { /* best effort */ }
+                return null;
+            }
+        }
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+function handleGetSessionInstructions(pathname, reqUrl, res) {
+    const match = pathname.match(/^\/api\/sessions\/([^/]+)\/instructions$/);
+    if (!match) {
+        json(res, { ok: false, error: 'Invalid path' }, 400);
+        return;
+    }
+    const sessionId = normalizeSessionId(decodeURIComponent(match[1]));
+    if (!sessionId) {
+        json(res, { ok: false, error: 'Invalid session id' }, 400);
+        return;
+    }
+    const name = normalizeInstructionName(reqUrl.searchParams.get('name') || '');
+    if (!name) {
+        json(res, { ok: false, error: 'Instruction name must be AGENTS.md or CLAUDE.md' }, 400);
+        return;
+    }
+    const session = getSessionRecord(sessionId);
+    if (!session) {
+        json(res, { ok: false, error: 'Session not found' }, 404);
         return;
     }
-    const runtime = check.runtime;
-    if ((0, runtime_js_1.isApptainerFamily)(runtime)) {
-        json(res, { sessions: [], message: 'Apptainer sessions run as processes. Use: ps aux | grep apptainer' });
+    if (!session.workdir || typeof session.workdir !== 'string') {
+        json(res, { ok: false, error: 'Session has no valid workdir' }, 400);
         return;
     }
+    const filePath = (0, path_1.join)(session.workdir, name);
+    let content = '';
+    let exists = false;
+    let mtimeMs = 0;
+    let autoCreated = false;
+    let managedInjected = false;
     try {
-        const output = (0, child_process_1.execFileSync)(runtime, [
-            'ps',
-            '--filter', 'name=labgate-',
-            '--format', '{{.Names}}\t{{.Status}}\t{{.RunningFor}}',
-        ], { encoding: 'utf-8', timeout: 5000 }).trim();
-        if (!output) {
-            json(res, { sessions: [] });
-            return;
+        if ((0, fs_1.existsSync)(filePath)) {
+            content = (0, fs_1.readFileSync)(filePath, 'utf-8');
+            exists = true;
+            mtimeMs = (0, fs_1.statSync)(filePath).mtimeMs;
+        }
+        const existedBefore = exists;
+        const defaultInstruction = getInstructionFileForAgent(String(session.agent || ''));
+        if (name === defaultInstruction) {
+            const parts = splitInstructionContent(content);
+            const managedBlock = parts.managedPresent ? parts.managedBlock : buildLabgateInstructionBlockForWorkdir(session.workdir);
+            const ensured = buildInstructionContent(managedBlock, parts.userContent);
+            if (!parts.managedPresent || !exists) {
+                if (ensured !== content || !exists) {
+                    (0, fs_1.writeFileSync)(filePath, ensured, 'utf-8');
+                    content = ensured;
+                    exists = true;
+                    mtimeMs = (0, fs_1.statSync)(filePath).mtimeMs;
+                }
+                autoCreated = !existedBefore;
+                managedInjected = !parts.managedPresent;
+            }
         }
-        const sessions = output.split('\n').map(line => {
-            const parts = line.split('\t');
-            return { name: parts[0] || '', status: parts[1] || '', running: parts[2] || '' };
-        });
-        json(res, { sessions });
     }
-    catch {
-        json(res, { sessions: [] });
+    catch (err) {
+        json(res, { ok: false, error: err.message ?? String(err) }, 500);
+        return;
     }
+    const parts = splitInstructionContent(content);
+    json(res, {
+        ok: true,
+        sessionId,
+        name,
+        path: filePath,
+        exists,
+        mtimeMs,
+        hash: hashText(content),
+        content,
+        userContent: parts.userContent,
+        managedPresent: parts.managedPresent,
+        managedText: parts.managedBlock,
+        autoCreated,
+        managedInjected,
+        template: getInstructionTemplate(name, String(session.agent || '')),
+    });
 }
-function handleGetLogs(_req, res) {
-    const config = (0, config_js_1.loadConfig)();
-    if (!config.audit.enabled) {
-        json(res, { entries: [], message: 'Audit logging is disabled' });
+async function handlePutSessionInstructions(pathname, req, res) {
+    const match = pathname.match(/^\/api\/sessions\/([^/]+)\/instructions$/);
+    if (!match) {
+        json(res, { ok: false, error: 'Invalid path' }, 400);
         return;
     }
-    const logDir = (0, config_js_1.getLogDir)(config);
-    if (!(0, fs_1.existsSync)(logDir)) {
-        json(res, { entries: [], message: 'No audit logs found yet' });
+    const sessionId = normalizeSessionId(decodeURIComponent(match[1]));
+    if (!sessionId) {
+        json(res, { ok: false, error: 'Invalid session id' }, 400);
         return;
     }
-    const files = (0, fs_1.readdirSync)(logDir)
-        .filter((f) => f.endsWith('.jsonl'))
-        .sort()
-        .reverse();
-    if (files.length === 0) {
-        json(res, { entries: [], message: 'No audit logs found yet' });
+    const session = getSessionRecord(sessionId);
+    if (!session) {
+        json(res, { ok: false, error: 'Session not found' }, 404);
+        return;
+    }
+    if (!session.workdir || typeof session.workdir !== 'string') {
+        json(res, { ok: false, error: 'Session has no valid workdir' }, 400);
         return;
     }
-    const logFile = (0, path_1.resolve)(logDir, files[0]);
     try {
-        const content = (0, fs_1.readFileSync)(logFile, 'utf-8').trim();
-        if (!content) {
-            json(res, { entries: [], message: 'Log file is empty' });
+        const body = JSON.parse(await readBody(req));
+        const name = normalizeInstructionName(body.name || '');
+        if (!name) {
+            json(res, { ok: false, error: 'Instruction name must be AGENTS.md or CLAUDE.md' }, 400);
             return;
         }
-        const allLines = content.split('\n');
-        const lines = allLines.slice(-50);
-        const entries = lines
-            .map(line => { try {
-            return JSON.parse(line);
+        const nextUserContent = typeof body.userContent === 'string'
+            ? body.userContent
+            : (typeof body.content === 'string' ? body.content : null);
+        if (nextUserContent === null) {
+            json(res, { ok: false, error: 'Instruction content must be a string' }, 400);
+            return;
         }
-        catch {
-            return null;
-        } })
-            .filter(Boolean)
-            .reverse();
-        json(res, { entries });
+        if (typeof body.expectedHash !== 'string') {
+            json(res, { ok: false, error: 'Missing expectedHash for conflict detection' }, 400);
+            return;
+        }
+        const filePath = (0, path_1.join)(session.workdir, name);
+        let currentContent = '';
+        try {
+            if ((0, fs_1.existsSync)(filePath))
+                currentContent = (0, fs_1.readFileSync)(filePath, 'utf-8');
+        }
+        catch (err) {
+            json(res, { ok: false, error: err.message ?? String(err) }, 500);
+            return;
+        }
+        const currentHash = hashText(currentContent);
+        const currentParts = splitInstructionContent(currentContent);
+        if (body.expectedHash !== currentHash) {
+            json(res, {
+                ok: false,
+                error: 'Instruction file changed on disk',
+                conflict: true,
+                currentHash,
+                currentContent,
+                currentUserContent: currentParts.userContent,
+                managedPresent: currentParts.managedPresent,
+                currentManagedText: currentParts.managedBlock,
+            }, 409);
+            return;
+        }
+        const defaultInstruction = getInstructionFileForAgent(String(session.agent || ''));
+        const managedBlock = currentParts.managedBlock || (name === defaultInstruction
+            ? buildLabgateInstructionBlockForWorkdir(session.workdir)
+            : '');
+        const nextContent = buildInstructionContent(managedBlock, nextUserContent);
+        const tmpPath = (0, path_1.join)(session.workdir, `.${name}.${process.pid}.${Date.now()}.tmp`);
+        try {
+            (0, fs_1.writeFileSync)(tmpPath, nextContent, 'utf-8');
+            (0, fs_1.renameSync)(tmpPath, filePath);
+        }
+        finally {
+            try {
+                if ((0, fs_1.existsSync)(tmpPath))
+                    (0, fs_1.unlinkSync)(tmpPath);
+            }
+            catch { /* best effort */ }
+        }
+        const writtenContent = (0, fs_1.readFileSync)(filePath, 'utf-8');
+        const writtenParts = splitInstructionContent(writtenContent);
+        const nextHash = hashText(writtenContent);
+        const mtimeMs = (0, fs_1.statSync)(filePath).mtimeMs;
+        try {
+            const effective = (0, config_js_1.loadEffectiveConfig)();
+            (0, audit_js_1.writeAuditEvent)(effective.config, {
+                timestamp: new Date().toISOString(),
+                session: sessionId,
+                event: 'instruction_updated',
+                filename: name,
+                bytes: Buffer.byteLength(writtenContent, 'utf-8'),
+                hash: nextHash,
+            }, { sharedAuditDir: effective.sharedAuditDir });
+        }
+        catch { /* do not fail save on audit errors */ }
+        json(res, {
+            ok: true,
+            sessionId,
+            name,
+            path: filePath,
+            exists: true,
+            mtimeMs,
+            hash: nextHash,
+            userContent: writtenParts.userContent,
+            managedPresent: writtenParts.managedPresent,
+            managedText: writtenParts.managedBlock,
+        });
     }
     catch (err) {
-        json(res, { entries: [], message: 'Could not read log file: ' + (err.message ?? String(err)) });
+        json(res, { ok: false, error: err.message ?? String(err) }, 400);
+    }
+}
+function extractTextContent(value) {
+    if (typeof value === 'string')
+        return value;
+    if (!value)
+        return '';
+    if (Array.isArray(value)) {
+        return value.map(v => extractTextContent(v)).join('\n');
+    }
+    if (typeof value === 'object') {
+        const obj = value;
+        const parts = [];
+        if (typeof obj.text === 'string')
+            parts.push(obj.text);
+        if (obj.content !== undefined)
+            parts.push(extractTextContent(obj.content));
+        return parts.join('\n');
+    }
+    return '';
+}
+function sanitizeTokenEdge(value) {
+    return value
+        .trim()
+        .replace(/^[("'`[{<]+/, '')
+        .replace(/[)"'`}\]>.,;!?]+$/, '');
+}
+function normalizeWebsiteUrl(rawUrl) {
+    const cleaned = sanitizeTokenEdge(rawUrl);
+    if (!cleaned)
+        return null;
+    const maybePrefixed = cleaned.startsWith('www.') ? `https://${cleaned}` : cleaned;
+    try {
+        const parsed = new URL(maybePrefixed);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+            return null;
+        parsed.hash = '';
+        parsed.search = '';
+        parsed.username = '';
+        parsed.password = '';
+        return parsed.toString();
+    }
+    catch {
+        return null;
+    }
+}
+function extractWebsiteUrlsFromText(text) {
+    if (!text)
+        return [];
+    const scan = text.length > 12_000 ? text.slice(0, 12_000) : text;
+    const matches = scan.match(/https?:\/\/[^\s"'`<>()\[\]{}]+/g) || [];
+    const normalized = new Set();
+    for (const raw of matches) {
+        const url = normalizeWebsiteUrl(raw);
+        if (url)
+            normalized.add(url);
+    }
+    return [...normalized];
+}
+function rememberTimestampedEntry(map, value, ts) {
+    if (!value)
+        return;
+    const existing = map.get(value) || 0;
+    if (ts >= existing)
+        map.set(value, ts);
+}
+function collectWebsiteUrls(value, accessedUrls, ts, keyHint = '') {
+    if (typeof value === 'string') {
+        for (const url of extractWebsiteUrlsFromText(value)) {
+            rememberTimestampedEntry(accessedUrls, url, ts);
+        }
+        if (/(^|_)(url|uri|href|website|link|domain|host)(_|$)/i.test(keyHint)) {
+            const direct = normalizeWebsiteUrl(value);
+            if (direct) {
+                rememberTimestampedEntry(accessedUrls, direct, ts);
+            }
+            else {
+                const bareDomain = sanitizeTokenEdge(value);
+                if (/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9-]{1,63})+(?:\/\S*)?$/i.test(bareDomain)) {
+                    const normalized = normalizeWebsiteUrl(`https://${bareDomain}`);
+                    if (normalized)
+                        rememberTimestampedEntry(accessedUrls, normalized, ts);
+                }
+            }
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            collectWebsiteUrls(item, accessedUrls, ts, keyHint);
+        }
+        return;
+    }
+    if (value && typeof value === 'object') {
+        const obj = value;
+        for (const [key, nested] of Object.entries(obj)) {
+            collectWebsiteUrls(nested, accessedUrls, ts, key);
+        }
     }
 }
 /**
- * Start the settings UI server.
- * Returns the HTTP server so callers can close it when done.
- * In standalone mode (`labgate ui`), pass standalone=true for extra logging.
+ * Tail-read the last ~16KB of a file and return the last parseable
+ * non-snapshot JSONL entry, last user prompt, and recently accessed files.
  */
-function startUI(port, standalone = true) {
-    const server = (0, http_1.createServer)(async (req, res) => {
-        const url = req.url ?? '/';
-        const method = req.method ?? 'GET';
-        res.setHeader('Access-Control-Allow-Origin', '*');
-        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
-        if (method === 'OPTIONS') {
-            res.writeHead(204);
-            res.end();
-            return;
+function tailLastJsonlEntry(filePath) {
+    try {
+        const st = (0, fs_1.statSync)(filePath);
+        if (st.size === 0)
+            return null;
+        const TAIL_SIZE = 16384;
+        const readSize = Math.min(TAIL_SIZE, st.size);
+        const buf = Buffer.alloc(readSize);
+        const fd = (0, fs_1.openSync)(filePath, 'r');
+        try {
+            (0, fs_1.readSync)(fd, buf, 0, readSize, st.size - readSize);
+        }
+        finally {
+            (0, fs_1.closeSync)(fd);
+        }
+        const text = buf.toString('utf-8');
+        const lines = text.split('\n').filter(l => l.trim().length > 0);
+        let lastEntry = null;
+        let lastUserPrompt = '';
+        const accessedFiles = new Map();
+        const accessedUrls = new Map();
+        // Walk backwards through all parseable lines
+        for (let i = lines.length - 1; i >= 0; i--) {
+            try {
+                const obj = JSON.parse(lines[i]);
+                if (obj.type === 'summary' || obj.type === 'snapshot' || obj.type === 'file-history-snapshot')
+                    continue;
+                if (!lastEntry)
+                    lastEntry = obj;
+                const parsed = obj.timestamp ? new Date(obj.timestamp).getTime() : 0;
+                const ts = (parsed && !isNaN(parsed)) ? parsed : Date.now();
+                // Collect file paths from tool_use entries
+                if (obj.type === 'assistant' && Array.isArray(obj.message?.content)) {
+                    for (const block of obj.message.content) {
+                        if (block.type !== 'tool_use' || !block.input)
+                            continue;
+                        const name = block.name || '';
+                        collectWebsiteUrls(block.input, accessedUrls, ts);
+                        // Direct file_path from Read/Edit/Write/Glob tools
+                        const fp = block.input.file_path || block.input.path || '';
+                        if (fp && !accessedFiles.has(fp)) {
+                            rememberTimestampedEntry(accessedFiles, fp, ts);
+                        }
+                        // Grep pattern → search path
+                        if ((name === 'Grep' || name === 'grep') && block.input.path) {
+                            rememberTimestampedEntry(accessedFiles, block.input.path, ts);
+                        }
+                        // Extract file paths from Bash commands
+                        if (name === 'Bash' || name === 'bash') {
+                            const cmd = block.input.command || '';
+                            // Absolute /work/ paths
+                            const absMatches = cmd.match(/\/work\/\S+/g);
+                            if (absMatches) {
+                                for (const p of absMatches) {
+                                    const clean = p.replace(/['"`;,)}\]]+$/, '');
+                                    rememberTimestampedEntry(accessedFiles, clean, ts);
+                                }
+                            }
+                            for (const url of extractWebsiteUrlsFromText(cmd)) {
+                                rememberTimestampedEntry(accessedUrls, url, ts);
+                            }
+                            // Relative paths from file-accessing commands (cat, head, tail, less, vi, etc.)
+                            // Also handles: python script.py, node file.js, chmod, cp, mv, rm, etc.
+                            const argMatches = cmd.match(/(?:cat|head|tail|less|more|vi|vim|nano|code|python3?|node|chmod|cp|mv|rm|touch|wc|diff|grep|rg|sed|awk|source|bash|sh)\s+(?:-\S+\s+)*([^\s|>&;]+)/g);
+                            if (argMatches) {
+                                for (const m of argMatches) {
+                                    // Extract the file argument (last non-flag token)
+                                    const tokens = m.split(/\s+/).filter((t) => !t.startsWith('-'));
+                                    const fileArg = tokens[tokens.length - 1] || '';
+                                    if (fileArg && !fileArg.startsWith('/') && !fileArg.startsWith('-') && (fileArg.includes('/') || fileArg.includes('.'))) {
+                                        const full = '/work/' + fileArg;
+                                        rememberTimestampedEntry(accessedFiles, full, ts);
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                // Also extract paths from tool_result content (file listings, etc.)
+                if (obj.type === 'user' && Array.isArray(obj.message?.content)) {
+                    for (const block of obj.message.content) {
+                        if (block.type !== 'tool_result')
+                            continue;
+                        const text = extractTextContent(block.content);
+                        // Look for /work/ paths in tool output
+                        const pathMatches = text.match(/\/work\/[^\s:]+/g);
+                        if (pathMatches) {
+                            for (const p of pathMatches.slice(0, 20)) { // cap to avoid perf issues
+                                const clean = p.replace(/['"`;,)}\]]+$/, '');
+                                rememberTimestampedEntry(accessedFiles, clean, ts);
+                            }
+                        }
+                        for (const url of extractWebsiteUrlsFromText(text).slice(0, 30)) {
+                            rememberTimestampedEntry(accessedUrls, url, ts);
+                        }
+                    }
+                }
+                // Find the last real user prompt
+                if (!lastUserPrompt && obj.type === 'user' && !obj.isMeta) {
+                    const content = obj.message?.content;
+                    if (typeof content === 'string' && content.length > 0) {
+                        if (!content.includes('<local-command-caveat>')) {
+                            lastUserPrompt = content.slice(0, 500);
+                        }
+                    }
+                    else if (Array.isArray(content)) {
+                        const textBlock = content.find((b) => b.type === 'text' && b.text);
+                        if (textBlock && !textBlock.text.includes('<local-command-caveat>')) {
+                            lastUserPrompt = textBlock.text.slice(0, 500);
+                        }
+                    }
+                }
+            }
+            catch {
+                // Line may be truncated at the start of our read window — skip it
+            }
         }
+        if (!lastEntry)
+            return null;
+        return { entry: lastEntry, lastUserPrompt, accessedFiles, accessedUrls, mtimeMs: st.mtimeMs };
+    }
+    catch {
+        return null;
+    }
+}
+/** Cache for JSONL file scanning (refreshed every 3s) */
+let jsonlCache = null;
+function getTranscriptRoots(agent, sandboxHome) {
+    if (agent === 'claude') {
+        return [(0, path_1.join)(sandboxHome, '.claude', 'projects')];
+    }
+    if (agent === 'codex') {
+        return [
+            (0, path_1.join)(sandboxHome, '.codex'),
+            (0, path_1.join)(sandboxHome, '.openai', 'codex'),
+            (0, path_1.join)(sandboxHome, '.config', 'codex'),
+        ];
+    }
+    return [];
+}
+function scanJsonlFiles(root, maxDepth = 4) {
+    const files = [];
+    const stack = [{ dir: root, depth: 0 }];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        if (!current)
+            continue;
         try {
-            if (url === '/' && method === 'GET') {
-                serveHTML(res);
+            const entries = (0, fs_1.readdirSync)(current.dir);
+            for (const entry of entries) {
+                const fullPath = (0, path_1.join)(current.dir, entry);
+                try {
+                    const st = (0, fs_1.statSync)(fullPath);
+                    if (st.isDirectory()) {
+                        if (current.depth < maxDepth) {
+                            stack.push({ dir: fullPath, depth: current.depth + 1 });
+                        }
+                        continue;
+                    }
+                    if (entry.endsWith('.jsonl')) {
+                        files.push({ path: fullPath, mtimeMs: st.mtimeMs, ctimeMs: st.ctimeMs });
+                    }
+                }
+                catch {
+                    // Skip unreadable entries
+                }
             }
-            else if (url === '/api/config' && method === 'GET') {
-                handleGetConfig(req, res);
+        }
+        catch {
+            // Skip unreadable directories
+        }
+    }
+    return files;
+}
+/**
+ * Scan sandbox home for agent conversation JSONL files.
+ * Results are cached for 3 seconds.
+ */
+function findProjectJsonlFiles(agent) {
+    const normalizedAgent = (agent || '').toLowerCase();
+    const now = Date.now();
+    if (jsonlCache &&
+        jsonlCache.agent === normalizedAgent &&
+        now - jsonlCache.ts < 2000) {
+        return jsonlCache.files;
+    }
+    const files = [];
+    const seen = new Set();
+    const sandboxHome = (0, config_js_1.getSandboxHome)();
+    const roots = getTranscriptRoots(normalizedAgent, sandboxHome);
+    for (const root of roots) {
+        if (!(0, fs_1.existsSync)(root))
+            continue;
+        for (const file of scanJsonlFiles(root)) {
+            if (seen.has(file.path))
+                continue;
+            seen.add(file.path);
+            files.push(file);
+        }
+    }
+    jsonlCache = { agent: normalizedAgent, files, ts: now };
+    return files;
+}
+/**
+ * Extract a human-readable detail string from a JSONL entry's tool_use blocks.
+ */
+function extractToolDetail(entry) {
+    if (!entry.message?.content)
+        return '';
+    const content = entry.message.content;
+    if (!Array.isArray(content))
+        return '';
+    for (const block of content) {
+        if (block.type === 'tool_use') {
+            const name = block.name || '';
+            const input = block.input || {};
+            if (name === 'Bash' || name === 'bash') {
+                const cmd = (input.command || '').slice(0, 60);
+                return cmd ? `Ran \`${cmd}\`` : `Running Bash`;
             }
-            else if (url === '/api/config' && method === 'POST') {
-                await handlePostConfig(req, res);
+            if (name === 'Edit' || name === 'edit') {
+                const file = (input.file_path || '').split('/').pop() || '';
+                return file ? `Edited ${file}` : 'Editing a file';
             }
-            else if (url === '/api/config/path' && method === 'GET') {
-                handleGetConfigPath(req, res);
+            if (name === 'Read' || name === 'read') {
+                const file = (input.file_path || '').split('/').pop() || '';
+                return file ? `Read ${file}` : 'Reading a file';
             }
-            else if (url === '/api/sessions' && method === 'GET') {
-                handleGetSessions(req, res);
+            if (name === 'Write' || name === 'write') {
+                const file = (input.file_path || '').split('/').pop() || '';
+                return file ? `Wrote ${file}` : 'Writing a file';
             }
-            else if (url === '/api/logs' && method === 'GET') {
-                handleGetLogs(req, res);
+            if (name === 'Grep' || name === 'grep') {
+                return `Searching for "${(input.pattern || '').slice(0, 40)}"`;
             }
-            else {
-                res.writeHead(404, { 'Content-Type': 'text/plain' });
-                res.end('Not found');
+            if (name === 'Glob' || name === 'glob') {
+                return `Finding files: ${(input.pattern || '').slice(0, 40)}`;
             }
+            if (name === 'Task' || name === 'task') {
+                return `Spawned subagent`;
+            }
+            return `Using ${name}`;
         }
-        catch (err) {
-            res.writeHead(500, { 'Content-Type': 'text/plain' });
-            res.end('Internal server error');
-        }
+    }
+    return '';
+}
+/** Cache for blocked events scan */
+let blockedCache = null;
+/**
+ * Scan JSONL files for blocked command events.
+ * Looks for tool_result entries containing "[labgate] Command blocked:".
+ * Reads up to 64KB from the tail of each file. Cached for 5 seconds.
+ */
+function scanBlockedEvents() {
+    const now = Date.now();
+    if (blockedCache && now - blockedCache.ts < 5000)
+        return blockedCache.events;
+    const events = [];
+    const seen = new Set();
+    const jsonlFiles = [...findProjectJsonlFiles('claude'), ...findProjectJsonlFiles('codex')]
+        .filter((f) => {
+        if (seen.has(f.path))
+            return false;
+        seen.add(f.path);
+        return true;
     });
-    server.on('error', (err) => {
-        if (err.code === 'EADDRINUSE') {
-            // Port busy — try next port (up to 3 attempts)
-            if (port < 7703) {
-                server.listen(port + 1, '127.0.0.1');
+    for (const file of jsonlFiles) {
+        try {
+            const st = (0, fs_1.statSync)(file.path);
+            if (st.size === 0)
+                continue;
+            const TAIL_SIZE = 65536;
+            const readSize = Math.min(TAIL_SIZE, st.size);
+            const buf = Buffer.alloc(readSize);
+            const fd = (0, fs_1.openSync)(file.path, 'r');
+            try {
+                (0, fs_1.readSync)(fd, buf, 0, readSize, st.size - readSize);
             }
-            else {
-                log.warn(`Settings UI: ports 7700-7703 all in use, skipping`);
+            finally {
+                (0, fs_1.closeSync)(fd);
+            }
+            const text = buf.toString('utf-8');
+            // Quick check before expensive line-by-line parsing
+            if (!text.includes('[labgate] Command blocked'))
+                continue;
+            const lines = text.split('\n');
+            for (const line of lines) {
+                if (!line.includes('[labgate] Command blocked'))
+                    continue;
+                try {
+                    const obj = JSON.parse(line);
+                    if (obj.type !== 'user')
+                        continue;
+                    const content = obj.message?.content;
+                    if (!Array.isArray(content))
+                        continue;
+                    for (const block of content) {
+                        if (block.type !== 'tool_result')
+                            continue;
+                        const resultText = extractTextContent(block.content);
+                        const match = resultText.match(/\[labgate\] Command blocked: (\S+)/);
+                        if (match) {
+                            events.push({
+                                command: match[1],
+                                timestamp: obj.timestamp || '',
+                                sessionId: obj.sessionId || '',
+                            });
+                        }
+                    }
+                }
+                catch { /* skip unparseable lines */ }
+            }
+        }
+        catch { /* skip inaccessible files */ }
+    }
+    // Sort newest first
+    events.sort((a, b) => (b.timestamp || '').localeCompare(a.timestamp || ''));
+    blockedCache = { events, ts: now };
+    return events;
+}
+// ── Per-session accumulated file history (persists across tail reads) ──
+/** sessionId → (path → most recent access timestamp) */
+const fileHistoryCache = new Map();
+const FILE_HISTORY_TTL = 60 * 60 * 1000; // 1 hour
+const websiteHistoryCache = new Map();
+const WEBSITE_HISTORY_TTL = 60 * 60 * 1000; // 1 hour
+/**
+ * Merge newly discovered file accesses into the persistent per-session cache.
+ * Entries older than 1 hour are evicted.
+ */
+function mergeFileHistory(sessionId, newAccessed) {
+    let history = fileHistoryCache.get(sessionId);
+    if (!history) {
+        history = new Map();
+        fileHistoryCache.set(sessionId, history);
+    }
+    // Merge new accesses (keep newest timestamp per path)
+    for (const [path, ts] of newAccessed) {
+        if (!ts || isNaN(ts))
+            continue;
+        const existing = history.get(path) || 0;
+        if (ts >= existing)
+            history.set(path, ts);
+    }
+    // Evict entries older than 1 hour
+    const cutoff = Date.now() - FILE_HISTORY_TTL;
+    for (const [path, ts] of history) {
+        if (ts < cutoff)
+            history.delete(path);
+    }
+    return history;
+}
+/**
+ * Merge newly discovered website accesses into the persistent per-session cache.
+ * Entries older than 1 hour are evicted.
+ */
+function mergeWebsiteHistory(sessionId, newAccessed) {
+    let history = websiteHistoryCache.get(sessionId);
+    if (!history) {
+        history = new Map();
+        websiteHistoryCache.set(sessionId, history);
+    }
+    for (const [url, ts] of newAccessed) {
+        if (!ts || isNaN(ts))
+            continue;
+        rememberTimestampedEntry(history, url, ts);
+    }
+    const cutoff = Date.now() - WEBSITE_HISTORY_TTL;
+    for (const [url, ts] of history) {
+        if (ts < cutoff)
+            history.delete(url);
+    }
+    return history;
+}
+/**
+ * Build file access list from accumulated access history.
+ * Only shows files/dirs that the agent actually touched — no directory listing.
+ * JSONL paths are container paths (/work/...) mapped to host relative paths.
+ */
+function getAccessedFiles(accessedFiles, workdir) {
+    if (accessedFiles.size === 0)
+        return [];
+    const files = [];
+    const seen = new Set();
+    for (const [p, ts] of accessedFiles) {
+        const rel = p.startsWith('/work/') ? p.slice(6) : p;
+        if (!rel || seen.has(rel))
+            continue;
+        seen.add(rel);
+        let isDir = false;
+        if (p.startsWith('/work/')) {
+            const hostPath = (0, path_1.join)(workdir, rel);
+            try {
+                isDir = (0, fs_1.statSync)(hostPath).isDirectory();
+            }
+            catch {
+                // Fall back to a conservative heuristic when the file no longer exists
+                const base = rel.split('/').pop() || '';
+                isDir = !base.includes('.');
             }
         }
         else {
-            log.warn(`Settings UI failed: ${err.message}`);
+            const normalized = rel.endsWith('/') ? rel.slice(0, -1) : rel;
+            const base = normalized.split('/').pop() || normalized;
+            isDir = !base.includes('.');
         }
-    });
-    server.listen(port, '127.0.0.1', () => {
-        const actualPort = server.address()?.port ?? port;
-        log.step(`Settings: http://localhost:${actualPort}`);
-        if (standalone) {
-            log.step('Press Ctrl+C to stop');
+        files.push({
+            name: rel,
+            path: p,
+            accessedAt: ts,
+            isDir,
+        });
+    }
+    // Sort by recency (most recently accessed first)
+    files.sort((a, b) => (b.accessedAt || 0) - (a.accessedAt || 0));
+    return files.slice(0, 60);
+}
+function getAccessedWebsites(accessedUrls) {
+    if (accessedUrls.size === 0)
+        return [];
+    const websites = [];
+    for (const [url, ts] of accessedUrls) {
+        let host = '';
+        try {
+            host = new URL(url).hostname;
         }
-    });
-    // Don't keep the process alive just for the UI server
-    server.unref();
+        catch {
+            host = url;
+        }
+        websites.push({
+            url,
+            host,
+            accessedAt: ts,
+        });
+    }
+    websites.sort((a, b) => (b.accessedAt || 0) - (a.accessedAt || 0));
+    return websites.slice(0, 30);
+}
+/**
+ * Determine an agent session's current activity by reading transcript JSONL.
+ * Correlates session → JSONL by matching session start time with file creation time.
+ */
+function getAgentActivity(session) {
+    const emptyFiles = [];
+    const emptyWebsites = [];
+    const unknown = {
+        status: 'unknown',
+        label: '',
+        detail: '',
+        prompt: '',
+        since: 0,
+        lastActive: 0,
+        files: emptyFiles,
+        websites: emptyWebsites,
+    };
+    const agent = String(session.agent || '').toLowerCase();
+    const jsonlFiles = findProjectJsonlFiles(agent);
+    if (jsonlFiles.length === 0) {
+        return { ...unknown, files: [], websites: [] };
+    }
+    const sessionStartMs = session.started ? new Date(session.started).getTime() : 0;
+    if (!sessionStartMs)
+        return unknown;
+    const sorted = [...jsonlFiles].sort((a, b) => b.mtimeMs - a.mtimeMs);
+    let bestFile = sorted.find(f => Math.abs(f.ctimeMs - sessionStartMs) < 5 * 60 * 1000);
+    if (!bestFile) {
+        bestFile = sorted.find(f => f.mtimeMs >= sessionStartMs);
+    }
+    if (!bestFile)
+        return unknown;
+    const result = tailLastJsonlEntry(bestFile.path);
+    if (!result)
+        return unknown;
+    const { entry, lastUserPrompt, accessedFiles, accessedUrls, mtimeMs } = result;
+    const age = Date.now() - mtimeMs;
+    const type = entry.type || '';
+    const entryTs = entry.timestamp ? new Date(entry.timestamp).getTime() : mtimeMs;
+    // Merge tail-read file accesses into persistent per-session history
+    const mergedHistory = mergeFileHistory(session.id || '', accessedFiles);
+    const files = getAccessedFiles(mergedHistory, session.workdir || '');
+    const mergedWebHistory = mergeWebsiteHistory(session.id || '', accessedUrls);
+    const websites = getAccessedWebsites(mergedWebHistory);
+    // Build the activity result, then attach files
+    let activity;
+    if (age > 60_000) {
+        activity = { status: 'idle', label: 'Idle', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+    }
+    else if (type === 'user') {
+        const content = entry.message?.content;
+        if (Array.isArray(content) && content.some((b) => b.type === 'tool_result')) {
+            activity = { status: 'thinking', label: 'Processing...', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+        }
+        else {
+            activity = { status: 'thinking', label: 'Thinking...', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+        }
+    }
+    else if (type === 'human') {
+        activity = { status: 'thinking', label: 'Thinking...', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+    }
+    else if (type === 'assistant') {
+        const content = entry.message?.content;
+        if (Array.isArray(content)) {
+            const hasToolUse = content.some((b) => b.type === 'tool_use');
+            if (hasToolUse) {
+                const detail = extractToolDetail(entry);
+                const toolBlock = content.find((b) => b.type === 'tool_use');
+                const toolName = toolBlock?.name || 'tool';
+                activity = { status: 'tool_use', label: `Running ${toolName}...`, detail, prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+            }
+            else if (content.some((b) => b.type === 'thinking')) {
+                activity = { status: 'thinking', label: 'Thinking...', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+            }
+            else {
+                activity = { status: 'waiting', label: 'Waiting for input', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+            }
+        }
+        else {
+            activity = { status: 'waiting', label: 'Waiting for input', detail: '', prompt: lastUserPrompt, since: entryTs, lastActive: mtimeMs, files, websites };
+        }
+    }
+    else {
+        activity = { ...unknown, files, websites };
+    }
+    return activity;
+}
+function getSessionStatus(workdir) {
+    try {
+        const st = (0, fs_1.statSync)(workdir);
+        const age = Date.now() - st.mtimeMs;
+        return age < 60_000 ? 'active' : 'idle';
+    }
+    catch {
+        // workdir inaccessible (e.g. remote NFS not mounted)
+        return 'running';
+    }
+}
+async function handleGetSessions(_req, res) {
+    const dir = (0, config_js_1.getSessionsDir)();
+    if (!(0, fs_1.existsSync)(dir)) {
+        json(res, { sessions: [] });
+        return;
+    }
+    const localHost = (0, os_1.hostname)();
+    const files = (0, fs_1.readdirSync)(dir).filter((f) => f.endsWith('.json'));
+    const sessions = [];
+    for (const file of files) {
+        try {
+            const data = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(dir, file), 'utf-8'));
+            // Check if the process is still alive (local node only)
+            if (data.node === localHost) {
+                try {
+                    process.kill(data.pid, 0);
+                }
+                catch {
+                    // Process is dead — clean up stale file
+                    try {
+                        (0, fs_1.unlinkSync)((0, path_1.join)(dir, file));
+                    }
+                    catch { /* best effort */ }
+                    continue;
+                }
+            }
+            data.status = getSessionStatus(data.workdir);
+            data.activity = getAgentActivity(data);
+            sessions.push(data);
+        }
+        catch { /* skip unparseable files */ }
+    }
+    // Collect container resource stats
+    const sessionIds = sessions.map((s) => s.id).filter(Boolean);
+    try {
+        const stats = await collectContainerStats(sessionIds);
+        for (const session of sessions) {
+            const s = stats.get(session.id);
+            if (s)
+                session.stats = s;
+        }
+    }
+    catch { /* stats unavailable */ }
+    // Annotate sessions with restart-required status
+    annotateRestartRequired(sessions);
+    json(res, { sessions });
+}
+/**
+ * Compare each session's config fingerprint against the current config.
+ * Annotates sessions with `restartRequired` and `restartReasons` when they
+ * are running with a stale mount configuration.
+ */
+function annotateRestartRequired(sessions) {
+    const config = (0, config_js_1.loadConfig)();
+    const currentFingerprint = (0, container_js_1.computeMountFingerprint)(config);
+    for (const session of sessions) {
+        if (session.configFingerprint && session.configFingerprint !== currentFingerprint) {
+            session.restartRequired = true;
+            const reasons = [];
+            if (session.image !== config.image)
+                reasons.push('Container image changed');
+            if (session.network !== config.network.mode)
+                reasons.push('Network mode changed');
+            if (reasons.length === 0)
+                reasons.push('Mount config changed (datasets or paths)');
+            session.restartReasons = reasons;
+        }
+        else {
+            session.restartRequired = false;
+        }
+    }
+}
+function handleGetSecurity(_req, res) {
+    const config = (0, config_js_1.loadConfig)();
+    const blockedEvents = scanBlockedEvents();
+    json(res, {
+        blockedCommands: blockedEvents.slice(0, 20),
+        blockedCount: blockedEvents.length,
+        protection: {
+            blacklistedCommands: config.commands.blacklist.length,
+            blockedPatterns: config.filesystem.blocked_patterns.length,
+            networkMode: config.network.mode,
+        },
+    });
+}
+async function handleStopSession(req, res) {
+    try {
+        const body = await readBody(req);
+        const { id } = JSON.parse(body);
+        if (!id) {
+            json(res, { ok: false, error: 'Missing session id' }, 400);
+            return;
+        }
+        const dir = (0, config_js_1.getSessionsDir)();
+        const localHost = (0, os_1.hostname)();
+        const sessionFile = (0, path_1.join)(dir, id + '.json');
+        if (!(0, fs_1.existsSync)(sessionFile)) {
+            json(res, { ok: false, error: 'Session not found' }, 404);
+            return;
+        }
+        const data = JSON.parse((0, fs_1.readFileSync)(sessionFile, 'utf-8'));
+        if (data.node !== localHost) {
+            json(res, { ok: false, error: 'Session is on a different node (' + data.node + ')' }, 400);
+            return;
+        }
+        try {
+            process.kill(data.pid, 'SIGTERM');
+        }
+        catch {
+            // Process already dead — clean up
+            try {
+                (0, fs_1.unlinkSync)(sessionFile);
+            }
+            catch { /* best effort */ }
+            json(res, { ok: true });
+            return;
+        }
+        json(res, { ok: true });
+    }
+    catch (err) {
+        json(res, { ok: false, error: err.message ?? String(err) }, 500);
+    }
+}
+/**
+ * Validate a host path: exists, is a directory, and is readable.
+ * Returns { valid: true/false, error?, path? } — advisory only, does not block.
+ */
+async function handleValidatePath(req, res) {
+    try {
+        const body = await readBody(req);
+        const { path: rawPath } = JSON.parse(body);
+        if (!rawPath || typeof rawPath !== 'string') {
+            json(res, { valid: false, error: 'Missing path' }, 400);
+            return;
+        }
+        const resolved = rawPath.replace(/^~/, (0, os_1.homedir)());
+        if (!(0, fs_1.existsSync)(resolved)) {
+            json(res, { valid: false, error: 'Path does not exist', path: resolved });
+            return;
+        }
+        const st = (0, fs_1.statSync)(resolved);
+        if (!st.isDirectory()) {
+            json(res, { valid: false, error: 'Path is not a directory', path: resolved });
+            return;
+        }
+        try {
+            (0, fs_1.readdirSync)(resolved);
+        }
+        catch {
+            json(res, { valid: false, error: 'Path is not readable', path: resolved });
+            return;
+        }
+        json(res, { valid: true, path: resolved });
+    }
+    catch (err) {
+        json(res, { valid: false, error: err.message ?? String(err) }, 400);
+    }
+}
+function handleGetLogs(_req, res) {
+    const config = (0, config_js_1.loadConfig)();
+    if (!config.audit.enabled) {
+        json(res, { entries: [], message: 'Audit logging is disabled' });
+        return;
+    }
+    const logDir = (0, config_js_1.getLogDir)(config);
+    if (!(0, fs_1.existsSync)(logDir)) {
+        json(res, { entries: [], message: 'No audit logs found yet' });
+        return;
+    }
+    const files = (0, fs_1.readdirSync)(logDir)
+        .filter((f) => f.endsWith('.jsonl'))
+        .sort()
+        .reverse();
+    if (files.length === 0) {
+        json(res, { entries: [], message: 'No audit logs found yet' });
+        return;
+    }
+    const logFile = (0, path_1.resolve)(logDir, files[0]);
+    try {
+        const content = (0, fs_1.readFileSync)(logFile, 'utf-8').trim();
+        if (!content) {
+            json(res, { entries: [], message: 'Log file is empty' });
+            return;
+        }
+        const allLines = content.split('\n');
+        const lines = allLines.slice(-50);
+        const entries = lines
+            .map(line => { try {
+            return JSON.parse(line);
+        }
+        catch {
+            return null;
+        } })
+            .filter(Boolean)
+            .reverse();
+        json(res, { entries });
+    }
+    catch (err) {
+        json(res, { entries: [], message: 'Could not read log file: ' + (err.message ?? String(err)) });
+    }
+}
+let containerStatsCache = new Map();
+let containerStatsCacheTs = 0;
+const STATS_CACHE_TTL = 3000;
+/** Parse Docker's human-readable memory (e.g., "123.4MiB", "1.2GiB") to MB */
+function parseMemString(str) {
+    if (!str)
+        return 0;
+    const match = str.match(/([\d.]+)\s*(KiB|MiB|GiB|B)/i);
+    if (!match)
+        return 0;
+    const num = parseFloat(match[1]);
+    switch (match[2].toLowerCase()) {
+        case 'gib': return Math.round(num * 1024);
+        case 'mib': return Math.round(num);
+        case 'kib': return Math.round(num / 1024);
+        default: return Math.round(num / (1024 * 1024));
+    }
+}
+async function collectContainerStats(sessionIds) {
+    const now = Date.now();
+    if (now - containerStatsCacheTs < STATS_CACHE_TTL)
+        return containerStatsCache;
+    if (sessionIds.length === 0) {
+        containerStatsCacheTs = now;
+        containerStatsCache = new Map();
+        return containerStatsCache;
+    }
+    const config = (0, config_js_1.loadConfig)();
+    let runtimeType;
+    try {
+        const runtimeCheck = (0, runtime_js_1.checkRuntime)(config.runtime === 'auto' ? undefined : config.runtime);
+        if (!runtimeCheck.ok || !runtimeCheck.runtime) {
+            containerStatsCacheTs = now;
+            containerStatsCache = new Map();
+            return containerStatsCache;
+        }
+        runtimeType = runtimeCheck.runtime;
+    }
+    catch {
+        containerStatsCacheTs = now;
+        containerStatsCache = new Map();
+        return containerStatsCache;
+    }
+    if ((0, runtime_js_1.isApptainerFamily)(runtimeType)) {
+        containerStatsCacheTs = now;
+        containerStatsCache = new Map();
+        return containerStatsCache;
+    }
+    const containerNames = sessionIds.map(id => `labgate-${id}`);
+    const stats = new Map();
+    try {
+        // Docker: use tab-separated format
+        const result = await execFileAsync(runtimeType, [
+            'stats', '--no-stream',
+            '--format', '{{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.MemPerc}}',
+            ...containerNames
+        ], { timeout: 5000 });
+        const lines = result.stdout.trim().split('\n');
+        for (const line of lines) {
+            const parts = line.split('\t');
+            if (parts.length < 4)
+                continue;
+            const name = parts[0].trim();
+            if (!name.startsWith('labgate-'))
+                continue;
+            const sessionId = name.slice('labgate-'.length);
+            const memParts = parts[2].split('/');
+            stats.set(sessionId, {
+                cpuPercent: parseFloat(parts[1].replace('%', '').trim()) || 0,
+                memUsageMB: parseMemString(memParts[0]?.trim() || ''),
+                memLimitMB: parseMemString(memParts[1]?.trim() || ''),
+                memPercent: parseFloat(parts[3].replace('%', '').trim()) || 0,
+            });
+        }
+    }
+    catch { /* stats unavailable — return empty map */ }
+    containerStatsCacheTs = now;
+    containerStatsCache = stats;
+    return stats;
+}
+// ── SLURM API handlers ──────────────────────────────────────
+function handleGetSlurmJobs(reqUrl, res) {
+    if (!slurmDB) {
+        json(res, { ok: false, error: 'SLURM tracking not enabled' }, 400);
+        return;
+    }
+    const state = reqUrl.searchParams.get('state') || undefined;
+    const session_id = reqUrl.searchParams.get('session_id') || undefined;
+    const search = reqUrl.searchParams.get('search') || undefined;
+    const parsedLimit = parseInt(reqUrl.searchParams.get('limit') || '50', 10);
+    const parsedOffset = parseInt(reqUrl.searchParams.get('offset') || '0', 10);
+    const limit = Number.isFinite(parsedLimit) ? Math.min(500, Math.max(1, parsedLimit)) : 50;
+    const offset = Number.isFinite(parsedOffset) ? Math.max(0, parsedOffset) : 0;
+    const jobs = slurmDB.listJobs({ state, session_id, search, limit, offset });
+    json(res, { ok: true, jobs });
+}
+function handleGetSlurmJob(pathname, res) {
+    if (!slurmDB) {
+        json(res, { ok: false, error: 'SLURM tracking not enabled' }, 400);
+        return;
+    }
+    const jobId = pathname.match(/\/api\/slurm\/jobs\/([^/]+)$/)?.[1];
+    if (!jobId) {
+        json(res, { ok: false, error: 'Invalid job ID' }, 400);
+        return;
+    }
+    const job = slurmDB.getJob(decodeURIComponent(jobId));
+    if (!job) {
+        json(res, { ok: false, error: 'Job not found' }, 404);
+        return;
+    }
+    json(res, { ok: true, job });
+}
+function handleGetSlurmJobOutput(pathname, reqUrl, res) {
+    if (!slurmDB) {
+        json(res, { ok: false, error: 'SLURM tracking not enabled' }, 400);
+        return;
+    }
+    const jobId = pathname.match(/\/api\/slurm\/jobs\/([^/]+)\/output$/)?.[1];
+    if (!jobId) {
+        json(res, { ok: false, error: 'Invalid job ID' }, 400);
+        return;
+    }
+    const job = slurmDB.getJob(decodeURIComponent(jobId));
+    if (!job) {
+        json(res, { ok: false, error: 'Job not found' }, 404);
+        return;
+    }
+    const streamParam = reqUrl.searchParams.get('stream') || 'stdout';
+    if (streamParam !== 'stdout' && streamParam !== 'stderr') {
+        json(res, { ok: false, error: 'Invalid stream. Use "stdout" or "stderr".' }, 400);
+        return;
+    }
+    const stream = streamParam;
+    const parsedTail = parseInt(reqUrl.searchParams.get('tail') || '100', 10);
+    const tailLines = Number.isFinite(parsedTail) ? Math.min(5000, Math.max(1, parsedTail)) : 100;
+    const filePath = stream === 'stderr' ? job.stderr_path : job.stdout_path;
+    if (!filePath) {
+        json(res, { ok: true, content: '', exists: false, size: 0, lines: 0 });
+        return;
+    }
+    if (!(0, fs_1.existsSync)(filePath)) {
+        json(res, { ok: true, content: '', exists: false, size: 0, lines: 0 });
+        return;
+    }
+    try {
+        const st = (0, fs_1.statSync)(filePath);
+        // Tail-read: read last chunk and extract last N lines
+        const maxBytes = 1_048_576; // 1MB cap
+        const readSize = Math.min(st.size, maxBytes);
+        let fd = null;
+        const buf = Buffer.alloc(readSize);
+        try {
+            fd = (0, fs_1.openSync)(filePath, 'r');
+            (0, fs_1.readSync)(fd, buf, 0, readSize, Math.max(0, st.size - readSize));
+        }
+        finally {
+            if (fd !== null) {
+                try {
+                    (0, fs_1.closeSync)(fd);
+                }
+                catch { /* best effort */ }
+            }
+        }
+        let text = buf.toString('utf-8');
+        if (st.size > readSize) {
+            const firstNewline = text.indexOf('\n');
+            if (firstNewline >= 0)
+                text = text.slice(firstNewline + 1);
+        }
+        const allLines = text.split('\n');
+        const sliced = allLines.slice(-tailLines);
+        const lines = sliced.join('\n');
+        json(res, { ok: true, content: lines, exists: true, size: st.size, lines: sliced.length });
+    }
+    catch (err) {
+        json(res, { ok: false, error: `Failed to read output: ${err.message}` }, 500);
+    }
+}
+async function handleCancelSlurmJob(pathname, res) {
+    if (!slurmDB) {
+        json(res, { ok: false, error: 'SLURM tracking not enabled' }, 400);
+        return;
+    }
+    const jobId = pathname.match(/\/api\/slurm\/jobs\/([^/]+)\/cancel$/)?.[1];
+    if (!jobId) {
+        json(res, { ok: false, error: 'Invalid job ID' }, 400);
+        return;
+    }
+    const decodedId = decodeURIComponent(jobId);
+    const job = slurmDB.getJob(decodedId);
+    if (!job) {
+        json(res, { ok: false, error: 'Job not found' }, 404);
+        return;
+    }
+    if (slurm_db_js_1.TERMINAL_STATES.has(job.state)) {
+        json(res, { ok: false, error: `Job is already ${job.state}` }, 400);
+        return;
+    }
+    try {
+        await execFileAsync('scancel', [decodedId], { timeout: 10_000 });
+        slurmDB.upsertJob({ job_id: decodedId, state: 'CANCELLED' });
+        json(res, { ok: true, message: `Job ${decodedId} cancelled` });
+    }
+    catch (err) {
+        json(res, { ok: false, error: `scancel failed: ${err.message}` }, 500);
+    }
+}
+async function handleUpdateSlurmJobNotes(pathname, req, res) {
+    if (!slurmDB) {
+        json(res, { ok: false, error: 'SLURM tracking not enabled' }, 400);
+        return;
+    }
+    const jobId = pathname.match(/\/api\/slurm\/jobs\/([^/]+)\/notes$/)?.[1];
+    if (!jobId) {
+        json(res, { ok: false, error: 'Invalid job ID' }, 400);
+        return;
+    }
+    const decodedId = decodeURIComponent(jobId);
+    const job = slurmDB.getJob(decodedId);
+    if (!job) {
+        json(res, { ok: false, error: 'Job not found' }, 404);
+        return;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(await readBody(req));
+    }
+    catch {
+        json(res, { ok: false, error: 'Invalid JSON' }, 400);
+        return;
+    }
+    if (parsed.notes !== null && typeof parsed.notes !== 'string') {
+        json(res, { ok: false, error: 'notes must be a string or null' }, 400);
+        return;
+    }
+    slurmDB.updateJobNotes(decodedId, parsed.notes);
+    json(res, { ok: true });
+}
+function handleGetSlurmStats(res) {
+    if (!slurmDB) {
+        json(res, { ok: false, error: 'SLURM tracking not enabled' }, 400);
+        return;
+    }
+    json(res, {
+        ok: true,
+        stats: {
+            pending: slurmDB.getJobCount('PENDING'),
+            running: slurmDB.getJobCount('RUNNING'),
+            completed: slurmDB.getJobCount('COMPLETED'),
+            failed: slurmDB.getJobCount('FAILED'),
+            cancelled: slurmDB.getJobCount('CANCELLED'),
+            timeout: slurmDB.getJobCount('TIMEOUT'),
+            total: slurmDB.getJobCount(),
+        },
+    });
+}
+// ── SSE: Server-Sent Events for real-time dashboard updates ──
+const sseClients = new Set();
+function handleSSE(_req, res) {
+    res.writeHead(200, {
+        'Content-Type': 'text/event-stream',
+        'Cache-Control': 'no-cache',
+        'Connection': 'keep-alive',
+        'Access-Control-Allow-Origin': '*',
+    });
+    res.write(':\n\n'); // comment to establish connection
+    sseClients.add(res);
+    res.on('close', () => sseClients.delete(res));
+}
+function broadcastSSE(event, data) {
+    const payload = `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
+    for (const client of sseClients) {
+        try {
+            client.write(payload);
+        }
+        catch {
+            sseClients.delete(client);
+        }
+    }
+}
+// Push session updates to all connected SSE clients every 2 seconds
+let sseInterval = null;
+function startSSEBroadcast() {
+    if (sseInterval)
+        return;
+    sseInterval = setInterval(async () => {
+        if (sseClients.size === 0)
+            return;
+        // Reuse handleGetSessions logic
+        const dir = (0, config_js_1.getSessionsDir)();
+        const sessions = [];
+        if ((0, fs_1.existsSync)(dir)) {
+            const localHost = (0, os_1.hostname)();
+            const files = (0, fs_1.readdirSync)(dir).filter((f) => f.endsWith('.json'));
+            for (const file of files) {
+                try {
+                    const data = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(dir, file), 'utf-8'));
+                    if (data.node === localHost) {
+                        try {
+                            process.kill(data.pid, 0);
+                        }
+                        catch {
+                            try {
+                                (0, fs_1.unlinkSync)((0, path_1.join)(dir, file));
+                            }
+                            catch { /* best effort */ }
+                            continue;
+                        }
+                    }
+                    data.status = getSessionStatus(data.workdir);
+                    data.activity = getAgentActivity(data);
+                    sessions.push(data);
+                }
+                catch { /* skip */ }
+            }
+        }
+        // Collect container resource stats
+        const sessionIds = sessions.map((s) => s.id).filter(Boolean);
+        try {
+            const stats = await collectContainerStats(sessionIds);
+            for (const session of sessions) {
+                const s = stats.get(session.id);
+                if (s)
+                    session.stats = s;
+            }
+        }
+        catch { /* stats unavailable */ }
+        // Annotate sessions with restart-required status
+        annotateRestartRequired(sessions);
+        broadcastSSE('sessions', { sessions });
+        // Also broadcast security data
+        const config = (0, config_js_1.loadConfig)();
+        const blockedEvents = scanBlockedEvents();
+        broadcastSSE('security', {
+            blockedCommands: blockedEvents.slice(0, 20),
+            blockedCount: blockedEvents.length,
+            protection: {
+                blacklistedCommands: config.commands.blacklist.length,
+                blockedPatterns: config.filesystem.blocked_patterns.length,
+                networkMode: config.network.mode,
+            },
+        });
+        // Broadcast SLURM job data when enabled
+        if (slurmDB) {
+            try {
+                const jobs = slurmDB.listJobs({ limit: 100 });
+                broadcastSSE('slurm', {
+                    jobs,
+                    stats: {
+                        pending: slurmDB.getJobCount('PENDING'),
+                        running: slurmDB.getJobCount('RUNNING'),
+                        completed: slurmDB.getJobCount('COMPLETED'),
+                        failed: slurmDB.getJobCount('FAILED'),
+                        cancelled: slurmDB.getJobCount('CANCELLED'),
+                        timeout: slurmDB.getJobCount('TIMEOUT'),
+                        total: slurmDB.getJobCount(),
+                    },
+                });
+            }
+            catch { /* slurm DB unavailable */ }
+        }
+    }, 2000);
+    sseInterval.unref?.();
+}
+function getAdminAccessContext() {
+    const effective = (0, config_js_1.loadEffectiveConfig)();
+    return {
+        effective,
+        currentUser: (0, os_1.userInfo)().username,
+        // Enterprise license is valid, but no valid policy is currently loaded.
+        bootstrapPolicySetup: effective.enterprise && !effective.policy,
+    };
+}
+function requireAdmin(res, opts) {
+    const context = getAdminAccessContext();
+    const { effective } = context;
+    if (!effective.enterprise) {
+        json(res, { ok: false, error: 'Forbidden: enterprise license required' }, 403);
+        return null;
+    }
+    if (effective.isAdmin)
+        return context;
+    if (opts?.allowBootstrapPolicySetup && context.bootstrapPolicySetup) {
+        return context;
+    }
+    json(res, { ok: false, error: 'Forbidden: admin access required' }, 403);
+    return null;
+}
+function buildBootstrapPolicyTemplate(context) {
+    return {
+        version: 1,
+        institution: context.effective.institution ?? 'Your Institution',
+        admins: { usernames: [context.currentUser] },
+        force: {},
+        constraints: {},
+    };
+}
+function handleGetEnterprise(_req, res) {
+    const context = getAdminAccessContext();
+    const { effective } = context;
+    json(res, {
+        enterprise: effective.enterprise,
+        institution: effective.institution ?? null,
+        isAdmin: effective.isAdmin,
+        bootstrapPolicySetup: context.bootstrapPolicySetup,
+        bootstrapUser: context.bootstrapPolicySetup ? context.currentUser : null,
+        lockedFields: [...effective.lockedFields],
+        lockedListItems: effective.lockedListItems,
+        constraints: effective.constraints,
+        licenseStatus: effective.licenseStatus
+            ? {
+                valid: effective.licenseStatus.valid,
+                daysRemaining: effective.licenseStatus.daysRemaining,
+                error: effective.licenseStatus.error,
+            }
+            : null,
+    });
+}
+function handleGetAdminPolicy(_req, res) {
+    const context = requireAdmin(res, { allowBootstrapPolicySetup: true });
+    if (!context)
+        return;
+    const policy = (0, policy_js_1.loadPolicy)();
+    if (policy) {
+        json(res, { ok: true, policy, bootstrap: false });
+        return;
+    }
+    if (context.bootstrapPolicySetup) {
+        json(res, {
+            ok: true,
+            bootstrap: true,
+            policy: buildBootstrapPolicyTemplate(context),
+            message: `No policy is configured yet. Saving this file will make "${context.currentUser}" the initial admin.`,
+        });
+        return;
+    }
+    json(res, { ok: false, error: 'No policy file found' }, 404);
+}
+async function handlePostAdminPolicy(req, res) {
+    const context = requireAdmin(res, { allowBootstrapPolicySetup: true });
+    if (!context)
+        return;
+    try {
+        const body = await readBody(req);
+        const incoming = JSON.parse(body);
+        const errors = (0, policy_js_1.validatePolicy)(incoming);
+        if (errors.length > 0) {
+            json(res, { ok: false, errors }, 400);
+            return;
+        }
+        let policy = incoming;
+        let addedBootstrapAdmin = false;
+        // First-time setup guard: ensure the bootstrap user cannot lock themselves out.
+        if (context.bootstrapPolicySetup) {
+            const names = Array.isArray(policy.admins?.usernames) ? policy.admins.usernames : [];
+            const alreadyIncluded = names.includes(context.currentUser);
+            policy = {
+                ...policy,
+                admins: {
+                    usernames: [...new Set([context.currentUser, ...names])],
+                },
+            };
+            addedBootstrapAdmin = !alreadyIncluded;
+        }
+        (0, policy_js_1.savePolicy)(policy);
+        json(res, {
+            ok: true,
+            bootstrapCompleted: context.bootstrapPolicySetup,
+            addedBootstrapAdmin,
+        });
+    }
+    catch (err) {
+        json(res, { ok: false, errors: [err.message ?? String(err)] }, 400);
+    }
+}
+function handleGetAdminUsers(_req, res) {
+    if (!requireAdmin(res))
+        return;
+    const effective = (0, config_js_1.loadEffectiveConfig)();
+    const sharedDir = effective.sharedSessionsDir;
+    // Collect sessions from shared dir or fall back to local sessions
+    const sessionsDir = sharedDir && (0, fs_1.existsSync)(sharedDir) ? sharedDir : (0, config_js_1.getSessionsDir)();
+    const sessions = [];
+    if ((0, fs_1.existsSync)(sessionsDir)) {
+        const files = (0, fs_1.readdirSync)(sessionsDir).filter((f) => f.endsWith('.json'));
+        for (const f of files) {
+            try {
+                const data = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(sessionsDir, f), 'utf-8'));
+                sessions.push(data);
+            }
+            catch {
+                // Skip malformed session files
+            }
+        }
+    }
+    // Group by user (sessions have a 'user' field when written to shared dir)
+    const userMap = new Map();
+    for (const s of sessions) {
+        const user = s.user ?? 'unknown';
+        if (!userMap.has(user)) {
+            userMap.set(user, { sessions: [], lastActivity: '' });
+        }
+        const entry = userMap.get(user);
+        entry.sessions.push(s);
+        const started = s.started ?? '';
+        if (started > entry.lastActivity)
+            entry.lastActivity = started;
+    }
+    const users = [...userMap.entries()].map(([username, data]) => ({
+        username,
+        activeSessions: data.sessions.length,
+        lastActivity: data.lastActivity,
+        sessions: data.sessions,
+    }));
+    json(res, { ok: true, users });
+}
+function handleGetAdminLogs(_req, res) {
+    if (!requireAdmin(res))
+        return;
+    const effective = (0, config_js_1.loadEffectiveConfig)();
+    const logDir = effective.sharedAuditDir && (0, fs_1.existsSync)(effective.sharedAuditDir)
+        ? effective.sharedAuditDir
+        : (0, config_js_1.getLogDir)(effective.config);
+    if (!(0, fs_1.existsSync)(logDir)) {
+        json(res, { ok: true, logs: [] });
+        return;
+    }
+    const files = (0, fs_1.readdirSync)(logDir)
+        .filter((f) => f.endsWith('.jsonl'))
+        .sort()
+        .reverse();
+    const logs = [];
+    const maxEntries = 100;
+    for (const f of files) {
+        if (logs.length >= maxEntries)
+            break;
+        try {
+            const content = (0, fs_1.readFileSync)((0, path_1.join)(logDir, f), 'utf-8');
+            const lines = content.split('\n').filter(l => l.trim());
+            for (const line of lines.reverse()) {
+                if (logs.length >= maxEntries)
+                    break;
+                try {
+                    logs.push(JSON.parse(line));
+                }
+                catch { /* skip malformed lines */ }
+            }
+        }
+        catch { /* skip unreadable files */ }
+    }
+    json(res, { ok: true, logs });
+}
+function handleGetAdminLicense(_req, res) {
+    if (!requireAdmin(res))
+        return;
+    const status = (0, license_js_1.validateLicense)();
+    json(res, { ok: true, license: status });
+}
+/**
+ * Start the settings UI server.
+ * Returns the HTTP server so callers can close it when done.
+ * In standalone mode (`labgate ui`), pass standalone=true for extra logging.
+ */
+function startUI(optsOrPort = {}, standaloneArg = true) {
+    const options = typeof optsOrPort === 'number'
+        ? { port: optsOrPort, standalone: standaloneArg }
+        : optsOrPort;
+    const standalone = options.standalone ?? true;
+    const socketPath = options.socketPath || (0, config_js_1.getUiSocketPath)();
+    const tcpPort = Number.isFinite(options.port) ? Math.floor(options.port) : null;
+    const useTcp = tcpPort !== null;
+    const requestedPort = tcpPort ?? 0;
+    const maxPort = requestedPort + 3;
+    const uiAccessToken = useTcp ? (0, crypto_1.randomBytes)(24).toString('hex') : '';
+    let listenPort = requestedPort;
+    let started = false;
+    (0, config_js_1.ensurePrivateDir)((0, path_1.dirname)((0, config_js_1.getConfigPath)()));
+    if (!useTcp) {
+        (0, config_js_1.ensurePrivateDir)((0, path_1.dirname)(socketPath));
+    }
+    const server = (0, http_1.createServer)(async (req, res) => {
+        const url = req.url ?? '/';
+        const reqUrl = new URL(url, 'http://localhost');
+        const pathname = reqUrl.pathname;
+        const method = req.method ?? 'GET';
+        if (useTcp) {
+            const auth = isAuthorizedRequest(req, reqUrl, uiAccessToken);
+            if (!auth.ok) {
+                if (pathname.startsWith('/api/')) {
+                    json(res, { ok: false, error: 'Unauthorized' }, 401);
+                }
+                else {
+                    res.writeHead(401, { 'Content-Type': 'text/plain; charset=utf-8' });
+                    res.end('Unauthorized. Open the UI with the full URL (including ?token=...).');
+                }
+                return;
+            }
+            if (auth.tokenFromQuery) {
+                res.setHeader('Set-Cookie', `${UI_AUTH_COOKIE}=${uiAccessToken}; HttpOnly; SameSite=Strict; Path=/; Max-Age=28800`);
+            }
+        }
+        if (method === 'OPTIONS') {
+            if (pathname.startsWith('/api/')) {
+                json(res, { ok: false, error: 'Not found' }, 404);
+            }
+            else {
+                res.writeHead(204);
+                res.end();
+            }
+            return;
+        }
+        try {
+            if (pathname.startsWith('/api/') &&
+                method !== 'GET' &&
+                method !== 'HEAD' &&
+                !requireWriteToken(req, res)) {
+                return;
+            }
+            if (pathname === '/' && method === 'GET') {
+                serveHTML(res);
+            }
+            else if (pathname === '/api/config' && method === 'GET') {
+                handleGetConfig(req, res);
+            }
+            else if (pathname === '/api/config' && method === 'POST') {
+                await handlePostConfig(req, res);
+            }
+            else if (pathname === '/api/config/path' && method === 'GET') {
+                handleGetConfigPath(req, res);
+            }
+            else if (pathname === '/api/sessions' && method === 'GET') {
+                await handleGetSessions(req, res);
+            }
+            else if (pathname === '/api/sessions/stop' && method === 'POST') {
+                await handleStopSession(req, res);
+            }
+            else if (pathname === '/api/validate-path' && method === 'POST') {
+                await handleValidatePath(req, res);
+            }
+            else if (/^\/api\/sessions\/[^/]+\/instructions$/.test(pathname) && method === 'GET') {
+                handleGetSessionInstructions(pathname, reqUrl, res);
+            }
+            else if (/^\/api\/sessions\/[^/]+\/instructions$/.test(pathname) && method === 'PUT') {
+                await handlePutSessionInstructions(pathname, req, res);
+            }
+            else if (pathname === '/api/logs' && method === 'GET') {
+                handleGetLogs(req, res);
+            }
+            else if (pathname === '/api/security' && method === 'GET') {
+                handleGetSecurity(req, res);
+            }
+            else if (pathname === '/api/events' && method === 'GET') {
+                handleSSE(req, res);
+                // ── SLURM API ──
+            }
+            else if (pathname === '/api/slurm/jobs' && method === 'GET') {
+                handleGetSlurmJobs(reqUrl, res);
+            }
+            else if (/^\/api\/slurm\/jobs\/([^/]+)$/.test(pathname) && method === 'GET') {
+                handleGetSlurmJob(pathname, res);
+            }
+            else if (/^\/api\/slurm\/jobs\/([^/]+)\/output$/.test(pathname) && method === 'GET') {
+                handleGetSlurmJobOutput(pathname, reqUrl, res);
+            }
+            else if (/^\/api\/slurm\/jobs\/([^/]+)\/cancel$/.test(pathname) && method === 'POST') {
+                await handleCancelSlurmJob(pathname, res);
+            }
+            else if (/^\/api\/slurm\/jobs\/([^/]+)\/notes$/.test(pathname) && method === 'PUT') {
+                await handleUpdateSlurmJobNotes(pathname, req, res);
+            }
+            else if (pathname === '/api/slurm/stats' && method === 'GET') {
+                handleGetSlurmStats(res);
+                // ── Enterprise / Admin API ──
+            }
+            else if (pathname === '/api/enterprise' && method === 'GET') {
+                handleGetEnterprise(req, res);
+            }
+            else if (pathname === '/api/admin/policy' && method === 'GET') {
+                handleGetAdminPolicy(req, res);
+            }
+            else if (pathname === '/api/admin/policy' && method === 'POST') {
+                await handlePostAdminPolicy(req, res);
+            }
+            else if (pathname === '/api/admin/users' && method === 'GET') {
+                handleGetAdminUsers(req, res);
+            }
+            else if (pathname === '/api/admin/logs' && method === 'GET') {
+                handleGetAdminLogs(req, res);
+            }
+            else if (pathname === '/api/admin/license' && method === 'GET') {
+                handleGetAdminLicense(req, res);
+            }
+            else if (pathname.startsWith('/fonts/') && method === 'GET') {
+                serveFontFile(pathname, res);
+            }
+            else {
+                if (pathname.startsWith('/api/')) {
+                    json(res, { ok: false, error: 'Not found' }, 404);
+                }
+                else {
+                    res.writeHead(404, { 'Content-Type': 'text/plain' });
+                    res.end('Not found');
+                }
+            }
+        }
+        catch (err) {
+            if (pathname.startsWith('/api/')) {
+                json(res, { ok: false, error: 'Internal server error' }, 500);
+            }
+            else {
+                res.writeHead(500, { 'Content-Type': 'text/plain' });
+                res.end('Internal server error');
+            }
+        }
+    });
+    const bindTcp = (nextPort) => {
+        listenPort = nextPort;
+        server.listen(listenPort, '127.0.0.1');
+    };
+    const bindUnixSocket = () => {
+        try {
+            if ((0, fs_1.existsSync)(socketPath))
+                (0, fs_1.unlinkSync)(socketPath);
+        }
+        catch {
+            // Best effort cleanup of stale socket file.
+        }
+        server.listen(socketPath);
+    };
+    server.on('listening', () => {
+        if (started)
+            return;
+        started = true;
+        if (useTcp) {
+            const actualPort = server.address()?.port ?? listenPort;
+            log.step(`Settings: http://localhost:${actualPort}/?token=${uiAccessToken}`);
+        }
+        else {
+            try {
+                (0, fs_1.chmodSync)(socketPath, config_js_1.PRIVATE_FILE_MODE);
+            }
+            catch {
+                // Best effort on platforms that do not support chmod on sockets.
+            }
+            log.step(`Settings socket: ${socketPath}`);
+            log.step('Use `labgate ui --port 7700` for browser access on localhost.');
+        }
+        if (standalone) {
+            log.step('Press Ctrl+C to stop');
+        }
+        // Initialise SLURM tracking if enabled
+        const slurmConfig = (0, config_js_1.loadConfig)();
+        if (slurmConfig.slurm.enabled && !slurmDB) {
+            try {
+                slurmDB = new slurm_db_js_1.SlurmJobDB((0, config_js_1.getSlurmDbPath)());
+                slurmPoller = new slurm_poller_js_1.SlurmPoller({
+                    db: slurmDB,
+                    pollIntervalMs: slurmConfig.slurm.poll_interval_seconds * 1000,
+                    sacctLookbackHours: slurmConfig.slurm.sacct_lookback_hours,
+                });
+                slurmPoller.start();
+                log.step('SLURM job tracking enabled');
+            }
+            catch (err) {
+                log.warn(`SLURM tracking unavailable: ${err.message}`);
+            }
+        }
+        startSSEBroadcast();
+    });
+    server.on('error', (err) => {
+        if (!useTcp && err.code === 'EADDRINUSE') {
+            try {
+                (0, fs_1.unlinkSync)(socketPath);
+                bindUnixSocket();
+                return;
+            }
+            catch {
+                // fall through to warning path
+            }
+        }
+        if (useTcp && err.code === 'EADDRINUSE') {
+            // Port busy — try next port (up to 3 attempts)
+            if (listenPort < maxPort) {
+                bindTcp(listenPort + 1);
+            }
+            else {
+                log.warn(`Settings UI: ports ${requestedPort}-${maxPort} all in use, skipping`);
+            }
+        }
+        else {
+            log.warn(`Settings UI failed: ${err.message}`);
+        }
+    });
+    if (useTcp) {
+        bindTcp(requestedPort);
+    }
+    else {
+        bindUnixSocket();
+    }
+    // Don't keep the process alive just for the UI server
+    server.unref();
+    server.on('close', () => {
+        if (!useTcp) {
+            try {
+                if ((0, fs_1.existsSync)(socketPath))
+                    (0, fs_1.unlinkSync)(socketPath);
+            }
+            catch {
+                // Best effort cleanup.
+            }
+        }
+        // Cleanup SLURM resources
+        if (slurmPoller) {
+            slurmPoller.stop();
+            slurmPoller = null;
+        }
+        if (slurmDB) {
+            try {
+                slurmDB.close();
+            }
+            catch { }
+            slurmDB = null;
+        }
+    });
     return server;
 }
 //# sourceMappingURL=ui.js.map