lastlight 0.15.0 → 0.16.1

package/dist/admin/auth.js

@@ -1,121 +0,0 @@
-import crypto from "node:crypto";
-const TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30; // 30 days
-/**
- * Grace window past `exp` in which a token can still be *refreshed* (but not
- * used to authenticate a normal request). Lets an active user whose token
- * lapsed briefly slide their session forward via the refresh route instead of
- * being bounced back through a full login. Beyond this, they must re-login.
- */
-export const REFRESH_GRACE_SECONDS = 60 * 60 * 24 * 7; // 7 days
-export function createToken(secret, method) {
-    const payload = { exp: Math.floor(Date.now() / 1000) + TOKEN_TTL_SECONDS };
-    if (method)
-        payload.method = method;
-    const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
-    const sig = crypto.createHmac("sha256", secret).update(payloadB64).digest("base64url");
-    return `${payloadB64}.${sig}`;
-}
-/**
- * Verify the HMAC signature and return the decoded payload, or null if the
- * signature is invalid / the payload is unparseable. Does NOT check expiry —
- * that's the caller's job (strict for auth, lenient for refresh).
- */
-function verifySignature(token, secret) {
-    const parts = token.split(".");
-    if (parts.length !== 2)
-        return null;
-    const [payloadB64, sig] = parts;
-    const expectedSig = crypto.createHmac("sha256", secret).update(payloadB64).digest("base64url");
-    if (expectedSig.length !== sig.length ||
-        !crypto.timingSafeEqual(Buffer.from(expectedSig), Buffer.from(sig))) {
-        return null;
-    }
-    return decodeToken(token);
-}
-export function verifyToken(token, secret) {
-    const payload = verifySignature(token, secret);
-    if (!payload)
-        return false;
-    return Math.floor(Date.now() / 1000) < payload.exp;
-}
-/**
- * Like `verifyToken`, but also accepts a token that expired within the last
- * `REFRESH_GRACE_SECONDS`. Used ONLY by the refresh route so a briefly-lapsed
- * session can be renewed. The signature must still be valid (we minted it), so
- * this can't be forged.
- */
-export function verifyTokenForRefresh(token, secret) {
-    const payload = verifySignature(token, secret);
-    if (!payload)
-        return false;
-    return Math.floor(Date.now() / 1000) < payload.exp + REFRESH_GRACE_SECONDS;
-}
-/**
- * Decode a token's payload WITHOUT verifying its signature or expiry — used to
- * carry the login `method` across a refresh. Callers that need authenticity
- * must still gate on `verifyToken` (the refresh route runs behind
- * `authMiddleware`, which does exactly that). Returns null if unparseable.
- */
-export function decodeToken(token) {
-    const parts = token.split(".");
-    if (parts.length !== 2)
-        return null;
-    try {
-        const payload = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
-        if (typeof payload.exp !== "number")
-            return null;
-        const method = payload.method;
-        return {
-            exp: payload.exp,
-            method: method === "password" || method === "slack" || method === "github" ? method : undefined,
-        };
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Whether any login method is configured — an admin password OR a working OAuth
- * provider. The single source of truth for "is auth on", shared by the admin
- * dashboard and the `/api/*` trigger routes so they can't drift. The GitHub
- * gate, like the OAuth route, also requires an allowed-org to be set.
- */
-export function authIsEnabled(opts) {
-    const slack = Boolean(opts.slackOAuthClientId && opts.slackOAuthClientSecret);
-    const github = Boolean(opts.githubOAuthClientId && opts.githubOAuthClientSecret && opts.githubAllowedOrg);
-    return Boolean(opts.adminPassword) || slack || github;
-}
-/**
- * Gate the admin API. `enabled` should be true when ANY login method is
- * configured — an admin password OR a working OAuth provider. Gating only on
- * the password (the old behaviour) left the dashboard fully open whenever the
- * password was cleared, even with Slack/GitHub OAuth set up.
- */
-export function authMiddleware(enabled, secret) {
-    return async (c, next) => {
-        if (!enabled)
-            return next();
-        const path = new URL(c.req.url).pathname;
-        // Let login + health + OAuth routes through
-        if (path.endsWith("/login") ||
-            path.endsWith("/token/refresh") ||
-            path.endsWith("/health") ||
-            path.endsWith("/auth-required") ||
-            path.endsWith("/oauth/slack/authorize") ||
-            path.endsWith("/oauth/slack/callback") ||
-            path.endsWith("/oauth/github/authorize") ||
-            path.endsWith("/oauth/github/callback")) {
-            return next();
-        }
-        const header = c.req.header("Authorization");
-        let token = header?.startsWith("Bearer ") ? header.slice(7) : undefined;
-        // EventSource can't set headers — allow token via query param
-        if (!token)
-            token = c.req.query("token") ?? undefined;
-        if (!token || !verifyToken(token, secret)) {
-            return c.json({ error: "unauthorized" }, 401);
-        }
-        return next();
-    };
-}
-//# sourceMappingURL=auth.js.map

package/dist/admin/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/admin/auth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS;AAEhE,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,MAAwC;IAClF,MAAM,OAAO,GAAqC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,iBAAiB,EAAE,CAAC;IAC7G,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACvF,OAAO,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAa,EAAE,MAAc;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,KAAyB,CAAC;IACpD,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/F,IACE,WAAW,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QACjC,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACnE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAc;IACvD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAc;IACjE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,GAAG,qBAAqB,CAAC;AAC7E,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACjF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,MAAM,EACJ,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC1F,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAO7B;IACC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC1G,OAAO,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,MAAc;IAC7D,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,EAAE,CAAC;QAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACzC,4CAA4C;QAC5C,IACE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EACvC,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7C,IAAI,KAAK,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,8DAA8D;QAC9D,IAAI,CAAC,KAAK;YAAE,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;QAEtD,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/admin/chat-session-reader.d.ts

@@ -1,39 +0,0 @@
-import type { StateDb } from "../state/db.js";
-import { SessionLog, type JsonlMessage } from "../session-log.js";
-import type { SessionSource, SessionMeta } from "./sessions.js";
-/**
- * DB-backed chat-session reader. Drop-in replacement for SessionReader on
- * the chat path: same public surface (`mountSessionRoutes` works against it
- * unchanged), but listing comes from the executions table grouped by Slack
- * thread, and message reads target the single jsonl file owned by that
- * thread's pi-ai session id. SessionLog owns the on-disk CHAT_PROJECT_SLUG
- * path resolution, so this reader does not scan unrelated `agent-*.jsonl`
- * sidechain files from other in-process Agent SDK runs.
- *
- * Conceptual mapping:
- * - SessionMeta.id      ← messaging_session.id (= Slack thread / executions.trigger_id)
- * - jsonl on disk       ← SessionLog CHAT_PROJECT_SLUG file for
- *                         messaging_sessions.agent_session_id
- */
-export declare class ChatSessionReader implements SessionSource {
-    private db;
-    private sessionLog;
-    constructor(db: StateDb, sessionsHomeDir: string);
-    constructor(db: StateDb, sessionLog: SessionLog);
-    /** All chat thread ids (= Slack threads) that have at least one chat execution. */
-    listSessionIds(): string[];
-    exists(id: string): boolean;
-    getSessionMeta(id: string): Promise<SessionMeta | null>;
-    read(id: string): Promise<Array<{
-        index: number;
-        msg: JsonlMessage;
-    }>>;
-    /**
-     * Resolve a thread id to its on-disk Agent SDK jsonl. Returns null if
-     * the thread has no agent_session_id yet (pre-resume) or the jsonl file
-     * doesn't exist on disk (deleted, rotated, or written by a different
-     * Agent SDK installation).
-     */
-    getFilePath(id: string): string | null;
-    normalizeRawLine(raw: Record<string, unknown>): JsonlMessage[];
-}

package/dist/admin/chat-session-reader.js

@@ -1,84 +0,0 @@
-import { CHAT_PROJECT_SLUG, SessionLog, } from "../session-log.js";
-/**
- * DB-backed chat-session reader. Drop-in replacement for SessionReader on
- * the chat path: same public surface (`mountSessionRoutes` works against it
- * unchanged), but listing comes from the executions table grouped by Slack
- * thread, and message reads target the single jsonl file owned by that
- * thread's pi-ai session id. SessionLog owns the on-disk CHAT_PROJECT_SLUG
- * path resolution, so this reader does not scan unrelated `agent-*.jsonl`
- * sidechain files from other in-process Agent SDK runs.
- *
- * Conceptual mapping:
- * - SessionMeta.id      ← messaging_session.id (= Slack thread / executions.trigger_id)
- * - jsonl on disk       ← SessionLog CHAT_PROJECT_SLUG file for
- *                         messaging_sessions.agent_session_id
- */
-export class ChatSessionReader {
-    db;
-    sessionLog;
-    constructor(db, sessionsHomeDirOrLog) {
-        this.db = db;
-        this.sessionLog = typeof sessionsHomeDirOrLog === "string"
-            ? new SessionLog(sessionsHomeDirOrLog)
-            : sessionsHomeDirOrLog;
-    }
-    /** All chat thread ids (= Slack threads) that have at least one chat execution. */
-    listSessionIds() {
-        // Soft cap at 500 — anything older than that almost certainly won't be
-        // surfaced after the dashboard's per-tab filters anyway.
-        return this.db.executions.listChatThreads(500).map((t) => t.triggerId);
-    }
-    exists(id) {
-        return this.db.executions.getChatThread(id) !== null;
-    }
-    async getSessionMeta(id) {
-        const t = this.db.executions.getChatThread(id);
-        if (!t)
-            return null;
-        const startedAt = new Date(t.firstStartedAt).getTime() / 1000;
-        const lastMessageAt = new Date(t.lastActivityAt).getTime() / 1000;
-        // sessionType "chat" lets the dashboard SessionFilters show a chat
-        // chip and gives the user a meaningful label.
-        return {
-            id,
-            source: "chat",
-            sessionType: "chat",
-            model: null,
-            started_at: Number.isNaN(startedAt) ? Date.now() / 1000 : startedAt,
-            last_message_at: Number.isNaN(lastMessageAt) ? null : lastMessageAt,
-            message_count: t.turnCount,
-            tool_call_count: 0,
-            conversation_message_count: t.turnCount,
-            last_assistant_content: t.lastAssistantContent,
-            agentIds: [],
-            platform: t.platform,
-        };
-    }
-    async read(id) {
-        const thread = this.db.executions.getChatThread(id);
-        if (!thread?.agentSessionId)
-            return [];
-        return this.sessionLog.readNormalizedSession("chat", thread.agentSessionId, {
-            includeAgents: false,
-            skipEmptySystem: true,
-        });
-    }
-    /**
-     * Resolve a thread id to its on-disk Agent SDK jsonl. Returns null if
-     * the thread has no agent_session_id yet (pre-resume) or the jsonl file
-     * doesn't exist on disk (deleted, rotated, or written by a different
-     * Agent SDK installation).
-     */
-    getFilePath(id) {
-        const thread = this.db.executions.getChatThread(id);
-        if (!thread || !thread.agentSessionId)
-            return null;
-        return this.sessionLog.pathForProject(CHAT_PROJECT_SLUG, thread.agentSessionId, {
-            requireExists: true,
-        });
-    }
-    normalizeRawLine(raw) {
-        return this.sessionLog.normalizeLine(raw);
-    }
-}
-//# sourceMappingURL=chat-session-reader.js.map

package/dist/admin/chat-session-reader.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chat-session-reader.js","sourceRoot":"","sources":["../../src/admin/chat-session-reader.ts"],"names":[],"mappings":"AACA,OAAO,EACL,iBAAiB,EACjB,UAAU,GAEX,MAAM,mBAAmB,CAAC;AAG3B;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAiB;IACpB,EAAE,CAAU;IACZ,UAAU,CAAa;IAI/B,YAAY,EAAW,EAAE,oBAAyC;QAChE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,UAAU,GAAG,OAAO,oBAAoB,KAAK,QAAQ;YACxD,CAAC,CAAC,IAAI,UAAU,CAAC,oBAAoB,CAAC;YACtC,CAAC,CAAC,oBAAoB,CAAC;IAC3B,CAAC;IAED,mFAAmF;IACnF,cAAc;QACZ,uEAAuE;QACvE,yDAAyD;QACzD,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,CAAC,EAAU;QACf,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAC9D,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;QAClE,mEAAmE;QACnE,8CAA8C;QAC9C,OAAO;YACL,EAAE;YACF,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,MAAM;YACnB,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;YACnE,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa;YACnE,aAAa,EAAE,CAAC,CAAC,SAAS;YAC1B,eAAe,EAAE,CAAC;YAClB,0BAA0B,EAAE,CAAC,CAAC,SAAS;YACvC,sBAAsB,EAAE,CAAC,CAAC,oBAAoB;YAC9C,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,cAAc;YAAE,OAAO,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE;YAC1E,aAAa,EAAE,KAAK;YACpB,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,EAAU;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,EAAE;YAC9E,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,GAA4B;QAC3C,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/admin/docker.d.ts

@@ -1,61 +0,0 @@
-export interface ContainerInfo {
-    id: string;
-    name: string;
-    status: string;
-    created: string;
-    taskId: string | null;
-    image: string;
-}
-export interface ContainerStats {
-    name: string;
-    cpuPercent: number;
-    memUsageBytes: number;
-    memLimitBytes: number;
-    memPercent: number;
-}
-export declare function killContainer(containerName: string): Promise<void>;
-/**
- * Snapshot CPU/memory for every container whose name starts with `lastlight-`
- * (the agent itself plus any active sandboxes). Uses `docker stats --no-stream`
- * so each call is one read of cgroup counters — slower than a metadata lookup
- * but still ~sub-second on a small fleet.
- */
-export declare function getContainerStats(): Promise<ContainerStats[]>;
-export declare function listRunningContainers(): Promise<ContainerInfo[]>;
-export interface ServerContainer {
-    name: string;
-    /** Short label derived from the compose name: lastlight-<service>-<n>. */
-    service: string;
-    status: string;
-    image: string;
-}
-/**
- * Every `lastlight-*` container (the agent plus the egress sidecars,
- * otel-collector, dozzle, and any live sandboxes) — running or stopped. Used
- * by the server-logs endpoints so an operator can read the harness/docker logs
- * over the admin API instead of SSHing to the host.
- */
-export declare function listServerContainers(): Promise<ServerContainer[]>;
-/**
- * Resolve a requested container (by full name OR short service label) to a real
- * `lastlight-*` container name, validated against the live list. Returns null
- * if nothing matches — callers reject the request, so an arbitrary container
- * name can never reach `docker logs`. With no request, defaults to the agent.
- */
-export declare function resolveServerContainer(requested?: string): Promise<string | null>;
-/**
- * One-shot `docker logs` for a container, newest `tail` lines. `--timestamps`
- * lets us interleave the container's stdout and stderr (captured on separate
- * fds) back into chronological order — RFC3339 prefixes sort lexically.
- */
-export declare function getContainerLogs(name: string, opts?: {
-    tail?: number;
-    since?: string;
-}): Promise<string[]>;
-/**
- * Follow `docker logs -f` for a container, invoking `onLine` per line from both
- * stdout and stderr. Returns a stop function that kills the child process.
- */
-export declare function streamContainerLogs(name: string, opts: {
-    tail?: number;
-}, onLine: (line: string) => void): () => void;

package/dist/admin/docker.js

@@ -1,187 +0,0 @@
-import { execFile, spawn } from "node:child_process";
-import { promisify } from "node:util";
-const exec = promisify(execFile);
-export async function killContainer(containerName) {
-    await exec("docker", ["rm", "-f", containerName]);
-}
-/**
- * Snapshot CPU/memory for every container whose name starts with `lastlight-`
- * (the agent itself plus any active sandboxes). Uses `docker stats --no-stream`
- * so each call is one read of cgroup counters — slower than a metadata lookup
- * but still ~sub-second on a small fleet.
- */
-export async function getContainerStats() {
-    try {
-        const { stdout } = await exec("docker", [
-            "stats",
-            "--no-stream",
-            "--format", "{{json .}}",
-        ]);
-        if (!stdout.trim())
-            return [];
-        return stdout
-            .trim()
-            .split("\n")
-            .map((line) => JSON.parse(line))
-            .filter((c) => (c.Name ?? "").startsWith("lastlight"))
-            .map((c) => {
-            const name = c.Name ?? "";
-            const cpuPercent = parsePercent(c.CPUPerc);
-            const memPercent = parsePercent(c.MemPerc);
-            const [usage, limit] = parseMemUsage(c.MemUsage);
-            return {
-                name,
-                cpuPercent,
-                memUsageBytes: usage,
-                memLimitBytes: limit,
-                memPercent,
-            };
-        });
-    }
-    catch {
-        return [];
-    }
-}
-function parsePercent(raw) {
-    if (!raw)
-        return 0;
-    const n = parseFloat(raw.replace("%", "").trim());
-    return Number.isFinite(n) ? n : 0;
-}
-// Docker formats memory like "123.4MiB / 7.7GiB" — convert each side to bytes.
-function parseMemUsage(raw) {
-    if (!raw)
-        return [0, 0];
-    const parts = raw.split("/").map((p) => p.trim());
-    return [parseSize(parts[0] ?? ""), parseSize(parts[1] ?? "")];
-}
-function parseSize(raw) {
-    const m = raw.match(/^([\d.]+)\s*([KMGT]?i?B)$/i);
-    if (!m)
-        return 0;
-    const value = parseFloat(m[1]);
-    const unit = m[2].toLowerCase();
-    const multipliers = {
-        b: 1,
-        kb: 1e3, mb: 1e6, gb: 1e9, tb: 1e12,
-        kib: 1024, mib: 1024 ** 2, gib: 1024 ** 3, tib: 1024 ** 4,
-    };
-    return value * (multipliers[unit] ?? 1);
-}
-export async function listRunningContainers() {
-    try {
-        const { stdout } = await exec("docker", [
-            "ps",
-            "--filter", "name=lastlight-sandbox",
-            "--format", "{{json .}}",
-        ]);
-        if (!stdout.trim())
-            return [];
-        return stdout
-            .trim()
-            .split("\n")
-            .map((line) => {
-            const c = JSON.parse(line);
-            const name = c.Names ?? c.Name ?? "";
-            // Parse taskId from: lastlight-sandbox-{taskId}-{uuid}
-            const match = name.match(/^lastlight-sandbox-(.+?)-[a-f0-9]{8}$/);
-            return {
-                id: c.ID ?? "",
-                name,
-                status: c.Status ?? "",
-                created: c.CreatedAt ?? c.RunningFor ?? "",
-                taskId: match?.[1] ?? null,
-                image: c.Image ?? "",
-            };
-        });
-    }
-    catch {
-        return [];
-    }
-}
-/**
- * Every `lastlight-*` container (the agent plus the egress sidecars,
- * otel-collector, dozzle, and any live sandboxes) — running or stopped. Used
- * by the server-logs endpoints so an operator can read the harness/docker logs
- * over the admin API instead of SSHing to the host.
- */
-export async function listServerContainers() {
-    try {
-        const { stdout } = await exec("docker", [
-            "ps", "-a",
-            "--filter", "name=lastlight-",
-            "--format", "{{json .}}",
-        ]);
-        if (!stdout.trim())
-            return [];
-        return stdout.trim().split("\n").map((line) => {
-            const c = JSON.parse(line);
-            const name = c.Names ?? c.Name ?? "";
-            return {
-                name,
-                service: name.replace(/^lastlight-/, "").replace(/-\d+$/, ""),
-                status: c.Status ?? "",
-                image: c.Image ?? "",
-            };
-        });
-    }
-    catch {
-        return [];
-    }
-}
-/**
- * Resolve a requested container (by full name OR short service label) to a real
- * `lastlight-*` container name, validated against the live list. Returns null
- * if nothing matches — callers reject the request, so an arbitrary container
- * name can never reach `docker logs`. With no request, defaults to the agent.
- */
-export async function resolveServerContainer(requested) {
-    const containers = await listServerContainers();
-    if (requested) {
-        const hit = containers.find((c) => c.name === requested || c.service === requested);
-        return hit?.name ?? null;
-    }
-    const agent = containers.find((c) => c.service === "agent" || c.name.includes("-agent-"));
-    return agent?.name ?? containers[0]?.name ?? null;
-}
-/**
- * One-shot `docker logs` for a container, newest `tail` lines. `--timestamps`
- * lets us interleave the container's stdout and stderr (captured on separate
- * fds) back into chronological order — RFC3339 prefixes sort lexically.
- */
-export async function getContainerLogs(name, opts = {}) {
-    const args = ["logs", "--timestamps", "--tail", String(opts.tail ?? 200)];
-    if (opts.since)
-        args.push("--since", opts.since);
-    args.push(name);
-    const { stdout, stderr } = await exec("docker", args, { maxBuffer: 32 * 1024 * 1024 });
-    const lines = [
-        ...(stdout ? stdout.split("\n") : []),
-        ...(stderr ? stderr.split("\n") : []),
-    ].filter((l) => l.length > 0);
-    lines.sort((a, b) => a.slice(0, 30).localeCompare(b.slice(0, 30)));
-    return lines;
-}
-/**
- * Follow `docker logs -f` for a container, invoking `onLine` per line from both
- * stdout and stderr. Returns a stop function that kills the child process.
- */
-export function streamContainerLogs(name, opts, onLine) {
-    const child = spawn("docker", [
-        "logs", "-f", "--timestamps", "--tail", String(opts.tail ?? 200), name,
-    ]);
-    const handle = (buf) => {
-        for (const line of buf.toString().split("\n"))
-            if (line)
-                onLine(line);
-    };
-    child.stdout?.on("data", handle);
-    child.stderr?.on("data", handle);
-    return () => {
-        try {
-            child.kill("SIGKILL");
-        }
-        catch { /* already dead */ }
-    };
-}
-//# sourceMappingURL=docker.js.map

package/dist/admin/docker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/admin/docker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAmBjC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,aAAqB;IACvD,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;YACtC,OAAO;YACP,aAAa;YACb,UAAU,EAAE,YAAY;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAE9B,OAAO,MAAM;aACV,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;aACzD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;aACrD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACjD,OAAO;gBACL,IAAI;gBACJ,UAAU;gBACV,aAAa,EAAE,KAAK;gBACpB,aAAa,EAAE,KAAK;gBACpB,UAAU;aACX,CAAC;QACJ,CAAC,CAAC,CAAC;IACP,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,GAAuB;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,WAAW,GAA2B;QAC1C,CAAC,EAAE,CAAC;QACJ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI;QACnC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,CAAC;KAC1D,CAAC;IACF,OAAO,KAAK,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;YACtC,IAAI;YACJ,UAAU,EAAE,wBAAwB;YACpC,UAAU,EAAE,YAAY;SACzB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAE9B,OAAO,MAAM;aACV,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;YACrD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YACrC,uDAAuD;YACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAClE,OAAO;gBACL,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;gBACd,IAAI;gBACJ,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;gBACtB,OAAO,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE;gBAC1C,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI;gBAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;aACrB,CAAC;QACJ,CAAC,CAAC,CAAC;IACP,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;YACtC,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,iBAAiB;YAC7B,UAAU,EAAE,YAAY;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2B,CAAC;YACrD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YACrC,OAAO;gBACL,IAAI;gBACJ,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;gBACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;aACrB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAkB;IAC7D,MAAM,UAAU,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAChD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;QACpF,OAAO,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC;IAC3B,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1F,OAAO,KAAK,EAAE,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,OAA0C,EAAE;IAE5C,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,IAAuB,EACvB,MAA8B;IAE9B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE;QAC5B,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI;KACvE,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;QAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,GAAG,EAAE;QACV,IAAI,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC"}

package/dist/admin/index.d.ts

@@ -1,9 +0,0 @@
-import { Hono } from "hono";
-import type { StateDb } from "../state/db.js";
-import { type AdminConfig } from "./routes.js";
-export { type AdminConfig } from "./routes.js";
-/**
- * Mount admin routes and dashboard static files onto the given Hono app.
- * This mounts directly so paths like /admin/assets/* resolve correctly.
- */
-export declare function mountAdmin(app: Hono, db: StateDb, config: AdminConfig): void;

package/dist/admin/index.js

@@ -1,59 +0,0 @@
-import { serveStatic } from "@hono/node-server/serve-static";
-import { SessionReader } from "./sessions.js";
-import { ChatSessionReader } from "./chat-session-reader.js";
-import { createAdminRoutes, binaryMimeForArtifact, rangeResponse } from "./routes.js";
-import { SessionLog } from "../session-log.js";
-import { BuildAssetStore } from "../state/build-assets.js";
-/**
- * Mount admin routes and dashboard static files onto the given Hono app.
- * This mounts directly so paths like /admin/assets/* resolve correctly.
- */
-export function mountAdmin(app, db, config) {
-    const sessionLog = new SessionLog(config.sessionsDir);
-    const sessions = new SessionReader(sessionLog, "sandbox");
-    // Chat is DB-backed: list comes from `executions` grouped by trigger_id
-    // (the Slack thread), and message reads target the single jsonl owned by
-    // that thread's agent_session_id rather than scanning every file in -app.
-    const chatSessions = new ChatSessionReader(db, sessionLog);
-    const apiRoutes = createAdminRoutes(db, sessions, chatSessions, config);
-    // PUBLIC, unauthenticated, MEDIA-ONLY artifact route — registered on the
-    // PARENT app BEFORE the `/admin/api` sub-app so it never enters that sub-app's
-    // `authMiddleware`. Browser-QA screenshots AND `/demo` videos embedded in a
-    // GitHub comment must be fetchable with no login: GitHub's image proxy fetches
-    // <img> screenshots, and a viewer's browser streams <video> (sending `Range`
-    // requests — hence rangeResponse). Non-media docs 404, so text handoff docs
-    // (architect-plan.md, status.md, …) are NEVER exposed here — they stay behind
-    // auth at `/admin/api/artifacts/*`. `BuildAssetStore`'s per-segment validation
-    // blocks path traversal on every param.
-    // NOTE: this makes screenshots/videos of the served app publicly reachable by
-    // URL — acceptable for public repos; revisit (visibility check / signed token)
-    // before enabling for private repos.
-    const publicArtifactStore = config.buildAssetsDir
-        ? new BuildAssetStore(config.buildAssetsDir)
-        : null;
-    app.get("/admin/api/public/artifacts/:owner/:repo/:key/:doc", (c) => {
-        if (!publicArtifactStore)
-            return c.json({ error: "build-assets store not configured" }, 404);
-        const { owner, repo, key, doc } = c.req.param();
-        const mime = binaryMimeForArtifact(doc);
-        if (!mime)
-            return c.json({ error: `not found: ${doc}` }, 404); // media-only gate
-        try {
-            const buf = publicArtifactStore.readBuffer({ owner, repo, issueKey: key }, doc);
-            if (buf === undefined)
-                return c.json({ error: `not found: ${doc}` }, 404);
-            return rangeResponse(c.req.header("range"), buf, mime, "public, max-age=300");
-        }
-        catch (err) {
-            return c.json({ error: err instanceof Error ? err.message : String(err) }, 400);
-        }
-    });
-    // API at /admin/api/*
-    app.route("/admin/api", apiRoutes);
-    // Static dashboard assets at /admin/*
-    app.use("/admin/*", serveStatic({ root: "dashboard/dist", rewriteRequestPath: (p) => p.replace(/^\/admin/, "") }));
-    // SPA fallback — serve index.html for any /admin/* that didn't match above
-    app.get("/admin/*", serveStatic({ root: "dashboard/dist", path: "index.html" }));
-    app.get("/admin", serveStatic({ root: "dashboard/dist", path: "index.html" }));
-}
-//# sourceMappingURL=index.js.map

package/dist/admin/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,aAAa,EAAoB,MAAM,aAAa,CAAC;AACxG,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAI3D;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAS,EAAE,EAAW,EAAE,MAAmB;IACpE,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC1D,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,YAAY,GAAG,IAAI,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAExE,yEAAyE;IACzE,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,wCAAwC;IACxC,8EAA8E;IAC9E,+EAA+E;IAC/E,qCAAqC;IACrC,MAAM,mBAAmB,GAAG,MAAM,CAAC,cAAc;QAC/C,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC;IACT,GAAG,CAAC,GAAG,CAAC,oDAAoD,EAAE,CAAC,CAAC,EAAE,EAAE;QAClE,IAAI,CAAC,mBAAmB;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7F,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,kBAAkB;QACjF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,mBAAmB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;YAChF,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1E,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,sBAAsB;IACtB,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAEnC,sCAAsC;IACtC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnH,2EAA2E;IAC3E,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IACjF,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;AACjF,CAAC"}