letmeknow-cli 0.4.2 → 0.4.4

package/README.md

@@ -1,175 +1,76 @@
 # LetMeKnow
 
-LetMeKnow gives one agent and one human browser a temporary HTML and CSS workspace. The agent renders a page, receives normalized form and button actions, and responds with HTML fragments. A private browser WebSocket carries renders and actions; assets use ordinary HTTP.
+LetMeKnow gives an agent-managed folder a public, live Vite preview. The CLI runs Vite in middleware mode and makes only an outbound WebSocket connection to the relay; it does not listen on a network port.
 
-It is not a localhost proxy or a programmable frontend. Agents provide presentation and semantic actions, not JavaScript or HTTP handlers.
+## Start
 
-## CLI
-
-Node 22 or newer is required.
-
-```bash
-npx letmeknow-cli
-```
-
-The deployed service is used by default. Set `LETMEKNOW_URL` for local development:
+Node.js 22.12 or newer is required.
 
 ```bash
-LETMEKNOW_URL=http://localhost:8787 npx letmeknow-cli
-```
-
-stdin contains one compact JSON command per line. stdout contains one JSON event per line. Diagnostics go to stderr.
-
-```bash
-npx letmeknow-cli --skill
-```
-
-prints the agent instructions without connecting.
-
-## Example
-
-Open a session:
-
-```json
-{"type":"open","id":"open-1"}
+npx letmeknow-cli ./workspace
 ```
 
-The CLI emits its temporary URL:
+The CLI prints JSON lines to stdout. The first line contains the public preview URL:
 
 ```json
-{"type":"session","id":"open-1","url":"https://0123456789abcdef0123.letmeknow.dev/","expires_after_disconnect":600}
+{"type":"ready","url":"https://0123456789abcdef0123.letmeknow.dev/"}
 ```
 
-The URL serves a trusted shell immediately. Send HTML and optional CSS with `render`:
+Open that URL in one browser. The directory defaults to the current working directory. Set `LETMEKNOW_URL` to use another compatible relay:
 
-```json
-{"type":"render","id":"render-1","body":"<h1>Search invoices</h1><form id=\"search\" action=\"search\" method=\"post\" data-lmk-target=\"results\"><label>Customer<input name=\"customer\" required></label><button>Search</button></form><section id=\"results\"><p>Enter a customer.</p></section>","css":"#results { margin-top: 2rem; }"}
-```
-
-A connected browser receives the render immediately. The acknowledgement contains its revision:
-
-```json
-{"type":"ack","id":"render-1","render_id":"b87438c2-4f1c-44bd-9875-6cc64370b8aa"}
-```
-
-Submitting the form produces one normalized action:
-
-```json
-{"type":"action","id":"2ee81a6b-1035-40a7-a90d-c1e02f426baa","render_id":"b87438c2-4f1c-44bd-9875-6cc64370b8aa","action_id":"search","form_id":"search","target_id":"results","trigger":{"id":null,"name":null,"value":null},"values":{"customer":"Acme Ltd"}}
+```bash
+LETMEKNOW_URL=https://letmeknow.dev npx letmeknow-cli ./workspace
 ```
 
-Respond to that ID with HTML for the target's contents:
+There are no `--host` or `--port` options because the CLI intentionally has no listening network socket. Diagnostics go to stderr. `--skill` prints the agent instructions without starting a session.
 
-```json
-{"type":"response","id":"response-1","request_id":"2ee81a6b-1035-40a7-a90d-c1e02f426baa","body":"<table><tr><th>Invoice</th><th>Amount</th></tr><tr><td>INV-42</td><td>$800</td></tr></table>"}
-```
-
-The browser inserts the fragment into `#results`. Without `data-lmk-target`, the response replaces the whole workspace.
+## File workflow
 
-## HTML actions
+The CLI does not receive file commands. The agent reads and writes the directory directly. Keep a normal Vite entry point such as `index.html`; JavaScript, CSS, images, and other Vite-supported files can be requested through the relay.
 
-### Forms
+When a watched file changes, the browser receives an update. HTML changes replace the current document body without a page reload and preserve form values, focus, selection, and scroll position. CSS links are refreshed without navigating. Changes to a different HTML route do not disturb the current page.
 
-Interactive forms use standard HTML:
+An optional element can display submission status:
 
 ```html
-<form id="decision" action="decide" method="post">
-  <label>Comment<textarea name="comment"></textarea></label>
-  <button name="decision" value="approve" formaction="approve">Approve</button>
-  <button name="decision" value="reject" formaction="reject">Reject</button>
-</form>
+<p data-letmeknow-status aria-live="polite"></p>
 ```
 
-Forms require `method="post"`, a stable `id`, a relative action identifier, and meaningful control names. A submit button's `formaction` overrides the form's `action`. Native validation runs locally. `FormData(form, submitter)` is captured before controls are disabled, so selected controls and the clicked button are included. Repeated names become string arrays. File inputs are rejected.
+## Form submissions
 
-### Standalone actions
-
-A button can invoke an action without a form:
+Forms are submitted without navigation. GET and POST forms are sent through the relay to the CLI, which prints each submission as one JSON line on stdout. The agent can read that line and edit the folder in response.
 
 ```html
-<button type="button" data-lmk-action="refresh-status" data-lmk-target="status">Refresh</button>
+<form id="decision" action="/decide" method="post">
+  <label>Comment <textarea name="comment"></textarea></label>
+  <button name="decision" value="approve">Approve</button>
+  <button name="decision" value="reject">Reject</button>
+</form>
 ```
 
-Its event has `form_id: null`, empty `values`, and its optional `id`, `name`, and `value` in `trigger`.
-
-### Targeted updates
-
-`data-lmk-target` accepts one bare element ID. All updates use `innerHTML`. There are no alternate swap modes or selector targets. The default target is `lmk-view`, the whole workspace.
-
-Typing, focusing, expanding `<details>`, validation, scrolling, and other local browser behavior produce no agent events.
-
-## CSS
-
-`render` accepts page CSS in its `css` field. A `response` may include `css` to replace it; omitting `css` preserves it.
-
-Modern CSS is supported, including grid, flexbox, media queries, variables, transitions, and print styles. External stylesheets, `@import`, scripts, inline handlers, and inline `style` attributes are blocked. Local assets work in HTML and CSS. The built-in style is deliberately document-like and avoids decorative cards, gradients, shadows, and rounded controls.
-
-## One browser client
-
-At most one browser is active for a session. The first browser receives a private credential stored in that tab's `sessionStorage`.
-
-- Reloads and reconnects reuse the credential.
-- A competing browser triggers at most one liveness probe every five seconds.
-- If the active browser answers, the claimant sees “This session is open elsewhere.”
-- After a disconnect, the previous credential has a five-second exclusive reconnect period.
-- After five seconds, either the old browser or a new claimant may connect; first connection wins.
-- Laptop sleep does not invalidate the credential.
-
-The server sends a connecting browser one canonical snapshot of the current HTML, CSS, render ID, and pending actions. It does not replay user actions. The browser restores same-tab drafts from `sessionStorage`; drafts do not transfer to another browser.
-
-The server keeps committed page state and assets for the producer session. A full `render` replaces the page and clears old pending actions. A targeted response updates the canonical page. Browser disconnect alone does not delete state.
-
-## Assets
-
-`put` stores or replaces passive resources only under `/assets/`:
+Submitting `Approve` prints an event like:
 
 ```json
-{"type":"put","id":"logo","path":"/assets/logo.png","content_type":"image/png","encoding":"base64","body":"iVBORw0KGgo..."}
+{"type":"submit","id":"…","method":"POST","action":"/decide","form_id":"decision","trigger":{"id":null,"name":"decision","value":"approve"},"values":{"comment":"Looks good","decision":"approve"}}
 ```
 
-Reference them relatively:
+Repeated field names become arrays. Native browser validation still runs before a submission is sent. File inputs and cross-origin form actions are not supported. Forms can use a submitter's standard `formaction`, `formmethod`, and `name`/`value` attributes.
 
-```html
-<img src="assets/logo.png" alt="Company logo">
-```
-
-Assets answer only `GET` and `HEAD`. Each body is limited to 1 MiB. A session accepts 100 assets and 10 MiB decoded asset data. There is no `delete`; assets disappear with the session.
-
-## Protocol
-
-Commands:
-
-- `open`: create the session; it must be first.
-- `render`: replace the committed HTML and CSS and push it to the browser.
-- `put`: store an asset under `/assets/`.
-- `response`: resolve one pending action with HTML and optional CSS.
-- `close`: destroy the session immediately.
-
-Events:
+The event ID identifies the submission. It is not a request/response handle: update the files and let the live preview show the result.
 
-- `session`: public URL and producer disconnect grace.
-- `action`: normalized form or standalone-button action.
-- `ack`: command completion.
-- `error`: invalid command or protocol state.
-- `closing`: explicit session destruction.
+## Security
 
-Actions remain pending until `response`, a superseding full `render`, or session close. One form or overlapping target can be pending at a time; independent regions may proceed concurrently. Match responses by action ID.
+The preview URL is a bearer capability. The relay receives the served files and submitted values. Do not put secrets in the preview folder or submit credentials unless that is intentional. The folder is trusted executable code from the browser's perspective.
 
-HTML, CSS, asset, and action bodies are each limited to 1 MiB. Up to 32 actions may be pending.
-
-## Security and lifecycle
-
-HTML fragments are sanitized. Scripts, style elements, inline handlers, HTMX attributes, frames, active metadata, external form actions, and invalid LetMeKnow attributes are removed. CSP blocks arbitrary browser connections and external resources.
-
-The URL is a bearer secret. Share it only with the intended human. Browser and producer reconnect credentials remain private and never appear in protocol output.
-
-If the producer disconnects, the current page remains visible, drafts are preserved, and actions are disabled. The CLI can reconnect for ten minutes. Browser traffic does not extend that grace. `close` or producer-grace expiry deletes page state, credentials, pending actions, and assets.
+The CLI's Vite configuration is disabled and its filesystem access is limited to the selected folder. The CLI itself still requires an outbound network connection to the relay. It does not accept inbound browser connections.
 
 ## Development
 
 ```bash
 npm install
-npm run dev
 npm test
+npm run dev
 npm run deploy
 ```
+
+`npm run dev` and `npm run deploy` operate the Cloudflare relay.

package/SKILL.md

@@ -1,166 +1,94 @@
 ---
 name: letmeknow
-description: Show one human a temporary HTML and CSS workspace and handle normalized form or button actions through the LetMeKnow NDJSON CLI.
+description: Give a human a live public preview of an agent-managed folder and receive browser form submissions as JSON lines.
 ---
 
 # LetMeKnow
 
-Use LetMeKnow when one human needs a temporary rich document, dashboard, report, preview, form, approval, quiz, table, or status view. The agent supplies semantic HTML and CSS. The browser sends only declared actions; typing and local UI state do not create events.
+Use LetMeKnow when one human needs to inspect or interact with a temporary page, report, dashboard, approval form, quiz, table, or status view. The agent owns the files in a folder. The CLI runs Vite in middleware mode, connects to the public relay over an outbound WebSocket, and reports browser submissions on stdout.
 
-LetMeKnow is not a localhost proxy, persistent application, or arbitrary JavaScript environment.
+The CLI does **not** listen on a local network port.
 
 ## Start
 
-Node.js 22 or newer is required.
+Run the CLI as a long-lived child process with the folder you will edit:
 
 ```bash
-npx letmeknow-cli
+npx letmeknow-cli ./workspace
 ```
 
-Run it as a long-lived child process. Write one compact JSON object per line to stdin, keep stdin open, and read one JSON event per line from stdout. Read stderr separately.
+Node.js 22.12 or newer is required. Read stdout and stderr separately. Stdout is JSONL; the first event is:
 
 ```json
-{"type":"open","id":"open-1"}
+{"type":"ready","url":"https://0123456789abcdef0123.letmeknow.dev/"}
 ```
 
-Wait for the session URL:
+Open the public URL for the human. The directory defaults to the current working directory. Set `LETMEKNOW_URL` to use another compatible relay. There are no host or port options: the CLI intentionally has no listening socket.
 
-```json
-{"type":"session","id":"open-1","url":"https://0123456789abcdef0123.letmeknow.dev/","expires_after_disconnect":600}
-```
-
-The URL immediately serves a shell with a waiting message. One browser may use it at a time.
-
-## Render HTML and CSS
-
-```json
-{"type":"render","id":"render-1","body":"<h1>Search invoices</h1><form id=\"search\" action=\"search\" method=\"post\" data-lmk-target=\"results\"><label>Customer<input name=\"customer\" required></label><button>Search</button></form><section id=\"results\"><p>Enter a customer.</p></section>","css":"#results { margin-top: 2rem; }"}
-```
-
-A connected browser receives the render immediately. Wait for its acknowledgement and retain the `render_id`:
-
-```json
-{"type":"ack","id":"render-1","render_id":"b87438c2-4f1c-44bd-9875-6cc64370b8aa"}
-```
-
-Use semantic HTML: headings, sections, paragraphs, lists, tables, `dl`, forms, labels, controls, buttons, `details`, progress, and images. Do not include `<html>`, `<head>`, `<body>`, `<main id="lmk-view">`, scripts, style elements, inline handlers, inline `style`, iframes, or HTMX attributes.
+Do not send file commands to stdin. Read and write the folder directly. Keep the process running while the human uses the page.
 
-The optional `css` field supports modern CSS, including grid, flexbox, media queries, variables, transitions, and print styles. External stylesheets, `@import`, and remote resources do not work. Use relative session assets.
+## Build the page
 
-Unless the human asks for a visual treatment, keep the page document-like: plain backgrounds, restrained typography, square corners, and simple borders. Avoid gradients, shadows, pill badges, rounded card grids, and decorative dashboard styling by default.
+Create an ordinary Vite page in the folder, usually `index.html`, plus any CSS, JavaScript, images, or other assets it needs. Use semantic HTML and accessible labels, headings, sections, tables, and controls.
 
-A full `render` intentionally replaces the current page, resets drafts, and cancels actions from the previous render. Use `response` rather than `render` after a user action.
+The relay is live:
 
-## Forms
+- HTML changes update the current document body without a full page reload.
+- Existing form values, focus, text selection, and scroll position are restored after an HTML update.
+- CSS links are refreshed without navigating.
+- Changes to another HTML route do not replace the current route.
 
-Interactive forms use standard HTML:
+An optional status element gives the human feedback after a form submission:
 
 ```html
-<form id="decision" action="decide" method="post">
-  <label>Reason<textarea name="reason" required></textarea></label>
-  <button name="decision" value="approve" formaction="approve">Approve</button>
-  <button name="decision" value="reject" formaction="reject">Reject</button>
-</form>
-```
-
-Rules:
-
-- Use `method="post"`.
-- Give each form a stable, unique `id`.
-- Give controls meaningful `name` values.
-- Use an action identifier containing letters, digits, `.`, `_`, `:`, or `-`.
-- A submit button's standard `formaction` may override the form action.
-- Native `required`, input types, ranges, and patterns validate locally.
-
-The runtime captures `FormData(form, submitter)` before disabling controls. Selected radios, checked boxes, ordinary controls, and the clicked submit button are included. Repeated names become string arrays. File inputs are rejected.
-
-## Standalone actions
-
-```html
-<button type="button" data-lmk-action="refresh-status" data-lmk-target="status">
-  Refresh
-</button>
+<p data-letmeknow-status aria-live="polite"></p>
 ```
 
-Use standalone actions for refresh, retry, cancel, generate, inspect, load-more, and export. Their events have `form_id: null`, empty `values`, and the button's optional `id`, `name`, and `value` in `trigger`.
-
-## Whole and partial updates
+## Receive form submissions
 
-Responses replace the whole workspace by default. To update a region, put `data-lmk-target="element-id"` on the form or action button:
+GET and POST forms are intercepted before navigation and sent through the relay to the CLI. Read stdout for a `submit` event:
 
 ```html
-<form id="search" action="search" method="post" data-lmk-target="results">
-  <input name="query">
-  <button>Search</button>
+<form id="search" action="/search" method="post">
+  <label>Query <input name="query" required></label>
+  <button name="scope" value="all">Search all</button>
 </form>
-<section id="results"></section>
-```
-
-The target is one bare element ID without `#`. Every update uses `innerHTML`. A submit button may override its form's target.
-
-## Handle actions
-
-```json
-{"type":"action","id":"2ee81a6b-1035-40a7-a90d-c1e02f426baa","render_id":"b87438c2-4f1c-44bd-9875-6cc64370b8aa","action_id":"search","form_id":"search","target_id":"results","trigger":{"id":null,"name":null,"value":null},"values":{"query":"quarterly report"}}
-```
-
-Use:
-
-- `id` to respond to this exact action.
-- `render_id` to identify the page revision that produced it.
-- `action_id` for user intent.
-- `form_id` and `target_id` for context.
-- `trigger` for the clicked button.
-- `values` for the submitted form snapshot.
-
-Validate actions and values. Treat values as untrusted and HTML-escape reflected text.
-
-Respond with HTML for the target contents:
-
-```json
-{"type":"response","id":"response-1","request_id":"2ee81a6b-1035-40a7-a90d-c1e02f426baa","body":"<table><tr><th>Invoice</th><th>Amount</th></tr><tr><td>INV-42</td><td>$800</td></tr></table>"}
 ```
 
-A response may include `css` to replace the page CSS. Omitting it preserves the existing CSS:
+The event is:
 
 ```json
-{"type":"response","id":"response-2","request_id":"event-2","body":"<h1 class=\"success\">Approved</h1>","css":".success { color: green; }"}
+{"type":"submit","id":"…","method":"POST","action":"/search","form_id":"search","trigger":{"id":null,"name":"scope","value":"all"},"values":{"query":"quarterly report","scope":"all"}}
 ```
 
-Wait for the acknowledgement and its new `render_id`. An action remains pending until `response`, a superseding full `render`, or session close. Independent regions may be pending concurrently, so always match by action ID.
-
-## One-browser behavior
-
-The first browser claims the session with a private credential. Reload and laptop wake reconnect automatically. A second browser cannot connect while the first is active.
-
-Liveness is checked only when another browser tries to claim, at most once every five seconds. After a browser disconnect, its credential has five seconds of exclusive reconnect priority. After that, the first old or new browser to connect wins.
-
-A reconnect receives one canonical snapshot of committed HTML, CSS, render ID, and pending actions. It does not replay old user actions. Same-tab drafts are restored from `sessionStorage`; drafts do not transfer during takeover.
-
-## Assets
+Rules:
 
-```json
-{"type":"put","id":"logo","path":"/assets/logo.png","content_type":"image/png","encoding":"base64","body":"iVBORw0KGgo..."}
-```
+- Give interactive forms a stable, meaningful `id`.
+- Give controls meaningful `name` values.
+- Use normal relative or same-origin actions.
+- Use `formaction` and `formmethod` on submitters when different buttons have different intents.
+- Native `required`, input types, ranges, and patterns validate in the browser before the event is sent.
+- Repeated names become string arrays.
+- File inputs and cross-origin actions are not supported.
 
-Store resources only under `/assets/` and reference them relatively:
+The event ID identifies the submission. There is no response packet. Validate its values, edit the files, and let the live preview show the result. Do not write JSON commands to stdin.
 
-```html
-<img src="assets/logo.png" alt="Company logo">
-```
+## Example response workflow
 
-`encoding` is `utf8` by default or `base64` for binary data. Assets answer only `GET` and `HEAD`. There is no `delete`; another `put` replaces an asset.
+1. Render the initial state in `index.html`.
+2. Wait for a `submit` event on stdout.
+3. Validate its `values` and `action`.
+4. Rewrite the relevant HTML or data file in the workspace.
+5. The browser updates in place through the relay.
 
-## Close and lifecycle
+Escape untrusted values before placing them in HTML. Treat browser input as untrusted even though the folder is local to the agent.
 
-```json
-{"type":"close","id":"close-1"}
-```
+## Security
 
-Wait for `ack` and `closing`. Closing stdin only disconnects the producer.
+The public URL is a bearer capability. The relay receives the served files and submitted values. Do not put secrets in the preview folder or submit credentials unless that is intentional. The folder is trusted executable code from the browser's perspective.
 
-If the producer disconnects, the page remains visible, drafts remain, and actions are disabled. The CLI has ten minutes to reconnect. Browser traffic does not extend that period. Explicit close or expiry deletes HTML, CSS, credentials, actions, and assets.
+The CLI disables Vite config discovery and limits filesystem access to the selected folder. It makes outbound relay connections only; it does not accept inbound browser connections.
 
-Limits: 1 MiB per HTML, CSS, asset, or action body; 100 assets; 10 MiB decoded asset storage; and 32 pending actions.
+## Stop
 
-Treat the URL as a bearer secret. Never expose either private reconnect credential.
+Send `SIGINT` or `SIGTERM` to stop the CLI. The relay session expires after producer disconnect. `--skill` prints these instructions without starting a session.

package/bin/letmeknow.js

@@ -1,299 +1,460 @@
 #!/usr/bin/env node
 
-import { readFileSync, writeSync } from "node:fs";
-import readline from "node:readline";
+import { createServer } from "vite";
+import { existsSync, readFileSync, statSync, writeSync } from "node:fs";
+import { relative, resolve, sep } from "node:path";
+import { Readable, Writable } from "node:stream";
 
-if (process.argv[2] === "--skill") {
-  if (process.argv.length !== 3) {
-    process.stderr.write("Usage: npx letmeknow-cli --skill\n");
-    process.exit(1);
-  }
-  writeSync(1, readFileSync(new URL("../SKILL.md", import.meta.url)));
-  process.exit(0);
-}
-
-const control = new URL(process.env.LETMEKNOW_URL || "https://letmeknow.dev");
-const graceSeconds = 10 * 60;
-const connectionAttemptTimeout = 10_000;
-const maxRetryDelay = 5_000;
-const subprotocolTokenPattern = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const MAX_BODY_BYTES = 1024 * 1024;
+const GRACE_SECONDS = 10 * 60;
+const CONNECTION_TIMEOUT = 10_000;
+const MAX_RETRY_DELAY = 5_000;
+const credentialPattern = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const clientPath = "/__letmeknow_client.js";
+const clientId = "\0letmeknow-client";
+const client = String.raw`
+const key="letmeknow-client:"+location.host+location.pathname;
+const draftKey="letmeknow-draft:"+location.host+location.pathname;
+let credential=sessionStorage.getItem(key);
 let socket;
-let input;
-let credential;
-let sessionUrl;
 let retryTimer;
-let connectionTimer;
-let retryDelay = 100;
-let stdinClosed = false;
-let signalRequested = false;
-let explicitSessionClosed = false;
-let closeCommandAccepted = false;
-let closeCommandSent = false;
-let retryUntil = 0;
-let connected = false;
-let finished = false;
-const queued = [];
-
-function endpoint() {
-  const url = new URL(control);
-  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-  url.pathname = "/v1/connect";
-  url.search = "";
-  url.hash = "";
-  if (credential && sessionUrl) {
-    const publicUrl = new URL(sessionUrl);
-    const hostCode = publicUrl.hostname.match(/^([a-f0-9]{20})\.letmeknow\.dev$/);
-    const pathCode = publicUrl.pathname.match(/^\/s\/([a-f0-9]{20})(?:\/|$)/);
-    const code = hostCode?.[1] || pathCode?.[1];
-    if (code) {
-      url.searchParams.set("code", code);
-    }
+let terminal=false;
+const stateKey=(control,index)=>control.id?"#"+control.id:(control.form?.id??"")+":"+control.name+":"+control.type+":"+index;
+const controls=root=>[...root.querySelectorAll("input,select,textarea")];
+const snapshot=()=>{
+  const state=new Map();
+  let activeKey;
+  for(const [index,control] of controls(document).entries()){
+    const key=stateKey(control,index);
+    state.set(key,{value:control.value,checked:control.checked,selected:control instanceof HTMLSelectElement?[...control.options].filter(option=>option.selected).map(option=>option.value):undefined,start:typeof control.selectionStart==="number"?control.selectionStart:undefined,end:typeof control.selectionEnd==="number"?control.selectionEnd:undefined});
+    if(control===document.activeElement)activeKey=key;
   }
-  return url;
-}
+  return {state,activeKey,x:scrollX,y:scrollY};
+};
+const restore=saved=>{
+  let active;
+  for(const [index,control] of controls(document).entries()){
+    const state=saved.state.get(stateKey(control,index));
+    if(!state)continue;
+    if(control instanceof HTMLSelectElement&&state.selected)for(const option of control.options)option.selected=state.selected.includes(option.value);
+    else if(control.type==="checkbox"||control.type==="radio")control.checked=state.checked;
+    else{control.value=state.value;if(typeof state.start==="number"&&typeof control.setSelectionRange==="function")control.setSelectionRange(state.start,state.end)}
+    if(stateKey(control,index)===saved.activeKey)active=control;
+  }
+  active?.focus();
+  scrollTo(saved.x,saved.y);
+};
+const status=message=>{const element=document.querySelector("[data-letmeknow-status]");if(element)element.textContent=message};
+const sessionPrefix=location.pathname.match(/^\/s\/[a-f0-9]{20}\//)?.[0];
+const currentPath=()=>{const path=sessionPrefix?location.pathname.slice(sessionPrefix.length-1)||"/":location.pathname;return path.endsWith("/")?path+"index.html":path};
+const refresh=async()=>{
+  const saved=snapshot();
+  const response=await fetch(location.href,{cache:"no-store",headers:{Accept:"text/html"}});
+  if(!response.ok)throw new Error("page refresh failed");
+  const next=new DOMParser().parseFromString(await response.text(),"text/html");
+  document.title=next.title;
+  document.body.replaceChildren(...[...next.body.childNodes].filter(node=>!(node instanceof HTMLScriptElement&&node.hasAttribute("data-letmeknow-client"))));
+  const links=[...document.head.querySelectorAll("link[rel=stylesheet]")];
+  for(const link of links){const url=new URL(link.href);url.searchParams.set("_letmeknow",crypto.randomUUID());link.href=url}
+  restore(saved);
+};
+const update=path=>{if(path===currentPath()||path?.endsWith(".css"))refresh().catch(()=>status("The page could not be refreshed"))};
+const connect=()=>{
+  clearTimeout(retryTimer);retryTimer=undefined;
+  const url=new URL("_letmeknow/client",location.href);url.protocol=url.protocol==="https:"?"wss:":"ws:";
+  socket=credential?new WebSocket(url,credential):new WebSocket(url);
+  socket.onmessage=event=>{
+    const message=JSON.parse(event.data);
+    if(message.type==="credential"){credential=message.credential;sessionStorage.setItem(key,credential);return}
+    if(message.type==="challenge"){socket.send(JSON.stringify({type:"alive",nonce:message.nonce}));return}
+    if(message.type==="busy"){status("This session is open elsewhere");retryTimer=setTimeout(connect,message.retry_after*1000);return}
+    if(message.type==="file_update"){update(message.path);return}
+    if(message.type==="closed"){terminal=true;sessionStorage.removeItem(key);sessionStorage.removeItem(draftKey);status(message.message)}
+  };
+  socket.onclose=()=>{if(!terminal&&!retryTimer){status("Reconnecting…");retryTimer=setTimeout(connect,1000)}};
+  socket.onerror=()=>{};
+};
+document.addEventListener("submit",async event=>{
+  const form=event.target;
+  if(!(form instanceof HTMLFormElement))return;
+  event.preventDefault();
+  const submitter=event.submitter;
+  const method=(submitter?.getAttribute("formmethod")??form.getAttribute("method")??"get").toLowerCase();
+  if(method!=="get"&&method!=="post"){status("Only GET and POST forms are supported");return}
+  if(!form.checkValidity()){form.reportValidity();return}
+  let target;
+  try{target=new URL(submitter?.getAttribute("formaction")??form.getAttribute("action")??location.href,location.href)}catch{status("Invalid form action");return}
+  if(target.origin!==location.origin){status("Form actions must stay on this site");return}
+  if(sessionPrefix&&!target.pathname.startsWith(sessionPrefix))target.pathname=(sessionPrefix+target.pathname.replace(/^\//,""));
+  const values=new URLSearchParams();
+  for(const [name,value] of new FormData(form,submitter)){if(typeof value!=="string"){status("File inputs are not supported");return}values.append(name,value)}
+  const actionPath=sessionPrefix?target.pathname.slice(sessionPrefix.length-1)||"/":target.pathname;
+  const metadata={id:crypto.randomUUID(),form_id:form.id||null,action:actionPath+target.search,trigger:{id:submitter?.id||null,name:submitter?.getAttribute("name"),value:submitter?.getAttribute("value")}};
+  const headers={"X-LetMeKnow-Submission":"1","X-LetMeKnow-ID":encodeURIComponent(metadata.id),"X-LetMeKnow-Form-ID":encodeURIComponent(metadata.form_id??""),"X-LetMeKnow-Action":encodeURIComponent(metadata.action),"X-LetMeKnow-Trigger-ID":encodeURIComponent(metadata.trigger.id??""),"X-LetMeKnow-Trigger-Name":encodeURIComponent(metadata.trigger.name??""),"X-LetMeKnow-Trigger-Value":encodeURIComponent(metadata.trigger.value??"")};
+  if(method==="get")for(const [name,value] of values)target.searchParams.append(name,value);
+  try{const response=await fetch(target,{method:method.toUpperCase(),headers,...(method==="post"?{body:values}:{})});if(!response.ok)throw new Error();status("Submitted")}catch{status("The submission failed")}
+});
+connect();
+`;
 
-function clearConnectionTimer() {
-  if (connectionTimer) clearTimeout(connectionTimer);
-  connectionTimer = undefined;
+function encodedHeader(request, name) {
+  const value = request.headers[name];
+  if (typeof value !== "string" || value === "") return null;
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return null;
+  }
 }
 
-function finish(code) {
-  if (finished) return;
-  finished = true;
-  if (retryTimer) clearTimeout(retryTimer);
-  clearConnectionTimer();
-  input?.close();
-  process.exitCode = code;
+function addValue(values, name, value) {
+  if (Object.prototype.hasOwnProperty.call(values, name)) {
+    values[name] = Array.isArray(values[name]) ? [...values[name], value] : [values[name], value];
+  } else {
+    values[name] = value;
+  }
 }
 
-function validCredential(value) {
-  return typeof value === "string" && subprotocolTokenPattern.test(value);
+function readBody(request) {
+  return new Promise((resolveBody, reject) => {
+    const chunks = [];
+    let size = 0;
+    let tooLarge = false;
+    request.on("data", chunk => {
+      if (tooLarge) return;
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      size += buffer.byteLength;
+      if (size > MAX_BODY_BYTES) {
+        tooLarge = true;
+        request.resume();
+        reject(new Error("submission is too large"));
+        return;
+      }
+      chunks.push(buffer);
+    });
+    request.on("end", () => resolveBody(Buffer.concat(chunks)));
+    request.on("error", reject);
+  });
 }
 
-function validSessionUrl(value) {
-  if (typeof value !== "string") return false;
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return false;
+async function submission(request, response) {
+  const url = new URL(request.url || "/", "http://localhost");
+  const method = (request.method || "GET").toUpperCase();
+  const values = Object.create(null);
+  if (method === "GET") {
+    for (const [name, value] of url.searchParams) addValue(values, name, value);
+  } else if (method === "POST") {
+    const body = await readBody(request);
+    const contentType = request.headers["content-type"]?.split(";", 1)[0].trim();
+    if (contentType !== "application/x-www-form-urlencoded") throw new Error("unsupported submission encoding");
+    for (const [name, value] of new URLSearchParams(body.toString("utf8"))) addValue(values, name, value);
+  } else {
+    throw new Error("unsupported submission method");
   }
-  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
-  if (/^[a-f0-9]{20}\.letmeknow\.dev$/.test(url.hostname)) return true;
-  return /^\/s\/[a-f0-9]{20}(?:\/|$)/.test(url.pathname);
+  const event = {
+    type: "submit",
+    id: encodedHeader(request, "x-letmeknow-id"),
+    method,
+    action: encodedHeader(request, "x-letmeknow-action") || url.pathname,
+    form_id: encodedHeader(request, "x-letmeknow-form-id"),
+    trigger: {
+      id: encodedHeader(request, "x-letmeknow-trigger-id"),
+      name: encodedHeader(request, "x-letmeknow-trigger-name"),
+      value: encodedHeader(request, "x-letmeknow-trigger-value")
+    },
+    values
+  };
+  process.stdout.write(`${JSON.stringify(event)}\n`);
+  response.statusCode = 204;
+  response.setHeader("Cache-Control", "no-store");
+  response.end();
 }
 
-function isCloseCommand(line) {
-  try {
-    const packet = JSON.parse(line);
-    return packet !== null
-      && typeof packet === "object"
-      && !Array.isArray(packet)
-      && packet.type === "close"
-      && (packet.id === undefined || typeof packet.id === "string");
-  } catch {
-    return false;
+class RelayRequest extends Readable {
+  constructor(packet) {
+    super();
+    this.method = packet.method;
+    this.url = packet.path;
+    this.originalUrl = packet.path;
+    this.headers = packet.headers || {};
+    this.httpVersion = "1.1";
+    this.httpVersionMajor = 1;
+    this.httpVersionMinor = 1;
+    this.socket = { encrypted: false, remoteAddress: "127.0.0.1" };
+    this.body = Buffer.from(packet.body || "", "base64");
+    this.sent = false;
   }
-}
 
-function send(line) {
-  if (!socket || !connected || socket.readyState !== WebSocket.OPEN) return false;
-  try {
-    socket.send(line);
-    if (isCloseCommand(line)) closeCommandSent = true;
-    return true;
-  } catch {
-    try {
-      socket.close();
-    } catch {
-      // The close event still determines whether reconnect is needed.
-    }
-    return false;
+  _read() {
+    if (this.sent) return;
+    this.sent = true;
+    this.push(this.body);
+    this.push(null);
   }
 }
 
-function sendOrQueue(line) {
-  if (finished || closeCommandAccepted) return;
-  if (isCloseCommand(line)) closeCommandAccepted = true;
-  if (!send(line)) queued.push(line);
-}
-
-function flush() {
-  if (finished) return;
-  while (queued.length && !closeCommandSent) {
-    if (!send(queued[0])) break;
-    queued.shift();
+class RelayResponse extends Writable {
+  constructor() {
+    super();
+    this.statusCode = 200;
+    this.headers = new Map();
+    this.chunks = [];
   }
-  if (closeCommandSent) queued.length = 0;
-  if (!queued.length && stdinClosed && !closeCommandSent && socket && connected) {
-    socket.close(1000, "stdin closed");
+
+  setHeader(name, value) {
+    this.headers.set(name.toLowerCase(), Array.isArray(value) ? value.join(", ") : String(value));
+    return this;
   }
-}
 
-function protocolFailure(message) {
-  if (finished) return;
-  process.stderr.write(`letmeknow: server protocol error: ${message}\n`);
-  const current = socket;
-  if (current) {
-    try {
-      current.close(1000, "protocol error");
-    } catch {
-      // The process still exits below.
-    }
+  getHeader(name) {
+    return this.headers.get(name.toLowerCase());
   }
-  finish(1);
-}
 
-function handleMessage(event) {
-  if (finished) return;
-  if (typeof event.data !== "string") {
-    protocolFailure("binary WebSocket frame");
-    return;
+  getHeaders() {
+    return Object.fromEntries(this.headers);
   }
-  const text = event.data;
-  let packet;
-  try {
-    packet = JSON.parse(text);
-  } catch {
-    protocolFailure("invalid JSON");
-    return;
+
+  hasHeader(name) {
+    return this.headers.has(name.toLowerCase());
   }
-  if (!packet || typeof packet !== "object" || Array.isArray(packet)) {
-    protocolFailure("packet must be a JSON object");
-    return;
+
+  removeHeader(name) {
+    this.headers.delete(name.toLowerCase());
   }
-  if (typeof packet.type !== "string") {
-    protocolFailure("packet type is required");
-    return;
+
+  writeHead(status, headers) {
+    this.statusCode = status;
+    if (headers) for (const [name, value] of Object.entries(headers)) this.setHeader(name, value);
+    return this;
   }
-  if (packet.type === "credential") {
-    if (!validCredential(packet.credential)) {
-      protocolFailure("invalid credential");
-      return;
-    }
-    credential = packet.credential;
-    return;
+
+  flushHeaders() {}
+
+  _write(chunk, _encoding, callback) {
+    this.chunks.push(Buffer.from(chunk));
+    callback();
   }
-  if (packet.type === "session") {
-    if (!validSessionUrl(packet.url)) {
-      protocolFailure("invalid session URL");
-      return;
-    }
-    if (typeof packet.expires_after_disconnect !== "number"
-      || !Number.isFinite(packet.expires_after_disconnect)
-      || packet.expires_after_disconnect <= 0) {
-      protocolFailure("invalid session expiration");
-      return;
-    }
-    sessionUrl = packet.url;
-    retryDelay = 100;
+
+  body() {
+    return Buffer.concat(this.chunks);
   }
-  if (packet.type === "closing") explicitSessionClosed = true;
-  process.stdout.write(`${text}\n`);
 }
 
-function retry() {
-  if (finished || signalRequested || explicitSessionClosed || closeCommandSent || (stdinClosed && !queued.length) || Date.now() >= retryUntil) {
-    finish(explicitSessionClosed || signalRequested || closeCommandSent || (stdinClosed && !queued.length) ? 0 : 1);
-    return;
-  }
-  retryTimer = setTimeout(() => {
-    retryTimer = undefined;
-    start();
-  }, retryDelay);
-  retryDelay = Math.min(retryDelay * 2, maxRetryDelay);
+function middlewareResponse(response) {
+  const body = response.body();
+  if (body.byteLength > MAX_BODY_BYTES) throw new Error("response body is too large");
+  return {
+    type: "http_response",
+    request_id: response.requestId,
+    status: response.statusCode,
+    headers: response.getHeaders(),
+    body: body.toString("base64")
+  };
 }
 
-function start() {
-  if (finished || signalRequested || explicitSessionClosed || closeCommandSent) return;
-  const reconnecting = Boolean(credential && sessionUrl);
-  const current = socket = reconnecting
-    ? new WebSocket(endpoint(), credential)
-    : new WebSocket(endpoint());
-  connectionTimer = setTimeout(() => {
-    if (socket !== current || connected || finished) return;
-    clearConnectionTimer();
-    process.stderr.write("letmeknow: WebSocket connection attempt timed out\n");
+async function handleRequest(server, packet, send) {
+  const request = new RelayRequest(packet);
+  const response = new RelayResponse();
+  response.requestId = packet.request_id;
+  await new Promise((resolveRequest, rejectRequest) => {
+    response.once("finish", resolveRequest);
+    response.once("error", rejectRequest);
     try {
-      current.close();
-    } catch {
-      // The close event is not available when construction failed.
+      server.middlewares(request, response, () => {
+        if (!response.writableEnded) {
+          response.statusCode = 404;
+          response.end("Not found");
+        }
+      });
+    } catch (cause) {
+      rejectRequest(cause);
     }
-    socket = undefined;
-    connected = false;
-    if (reconnecting) retry();
-    else finish(1);
-  }, connectionAttemptTimeout);
-  current.addEventListener("message", handleMessage);
-  current.addEventListener("error", () => {
-    if (!finished) process.stderr.write("letmeknow: WebSocket connection failed; retrying\n");
-  });
-  current.addEventListener("open", () => {
-    if (socket !== current || finished) return;
-    clearConnectionTimer();
-    connected = true;
-    retryDelay = 100;
-    if (reconnecting) retryUntil = 0;
-    flush();
-  });
-  current.addEventListener("close", (event) => {
-    if (socket !== current) return;
-    clearConnectionTimer();
-    connected = false;
-    if (finished) return;
-    socket = undefined;
-    if (closeCommandSent || signalRequested || explicitSessionClosed || (stdinClosed && !queued.length)) {
-      finish(0);
-      return;
-    }
-    if (!credential || !sessionUrl) {
-      process.stderr.write(`letmeknow: connection closed (${event.code}${event.reason ? `: ${event.reason}` : ""})\n`);
-      finish(1);
-      return;
-    }
-    if (!retryUntil) retryUntil = Date.now() + graceSeconds * 1_000;
-    retry();
   });
+  send(middlewareResponse(response));
 }
 
-input = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });
-input.on("line", (line) => {
-  if (!finished && line.trim() && !closeCommandAccepted) sendOrQueue(line);
-});
-input.on("close", () => {
-  if (finished) return;
-  stdinClosed = true;
-  if (!socket) {
-    if (!queued.length) finish(0);
-    return;
+function options(args) {
+  let root;
+  for (const argument of args) {
+    if (argument.startsWith("-")) throw new Error(`unknown option: ${argument}`);
+    if (root !== undefined) throw new Error("only one directory may be provided");
+    root = resolve(argument);
   }
-  if (connected) flush();
-  else if (!queued.length) {
-    const current = socket;
-    clearConnectionTimer();
-    try {
-      current.close();
-    } catch {
-      // The process still exits below.
-    }
-    socket = undefined;
-    finish(0);
+  root = root || process.cwd();
+  if (!existsSync(root) || !statSync(root).isDirectory()) throw new Error(`directory does not exist: ${root}`);
+  return { root };
+}
+
+function endpoint(control, credential, sessionUrl) {
+  const url = new URL(control);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  url.pathname = "/v1/connect";
+  url.search = "";
+  url.hash = "";
+  if (credential && sessionUrl) {
+    const publicUrl = new URL(sessionUrl);
+    const hostCode = publicUrl.hostname.match(/^([a-f0-9]{20})\.letmeknow\.dev$/);
+    const pathCode = publicUrl.pathname.match(/^\/s\/([a-f0-9]{20})(?:\/|$)/);
+    const code = hostCode?.[1] || pathCode?.[1];
+    if (code) url.searchParams.set("code", code);
   }
-});
+  return url;
+}
 
-for (const signal of ["SIGINT", "SIGTERM"]) {
-  process.on(signal, () => {
-    signalRequested = true;
-    clearConnectionTimer();
-    if (socket) {
-      try {
-        socket.close(1000, signal);
-      } catch {
-        // The process still exits below.
+function validSessionUrl(value) {
+  if (typeof value !== "string") return false;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+  if (/^[a-f0-9]{20}\.letmeknow\.dev$/.test(url.hostname)) return true;
+  return /^\/s\/[a-f0-9]{20}(?:\/|$)/.test(url.pathname);
+}
+
+async function start(args) {
+  const { root } = options(args);
+  const control = process.env.LETMEKNOW_URL || "https://letmeknow.dev";
+  let send = () => false;
+  const vite = await createServer({
+    root,
+    configFile: false,
+    appType: "spa",
+    css: { postcss: false },
+    logLevel: "silent",
+    server: { middlewareMode: true, hmr: false, ws: false, fs: { strict: true, allow: [root], deny: ["**/.env", "**/.env.*", "**/.git/**", "**/*.key", "**/*.pem", "**/*.p12", "**/*.sqlite", "**/*.db"] } },
+    plugins: [{
+      name: "letmeknow-relay",
+      resolveId(id) { return id === clientPath ? clientId : undefined; },
+      load(id) { return id === clientId ? client : undefined; },
+      configureServer(server) {
+        server.middlewares.use((request, response, next) => {
+          if (request.headers["x-letmeknow-submission"] !== "1") {
+            next();
+            return;
+          }
+          submission(request, response).catch(cause => {
+            response.statusCode = cause instanceof Error && cause.message === "submission is too large" ? 413 : 400;
+            response.setHeader("Content-Type", "text/plain; charset=utf-8");
+            response.end(cause instanceof Error ? cause.message : "invalid submission");
+          });
+        });
+        const update = file => send({ type: "file_update", path: "/" + relative(root, file).split(sep).join("/") });
+        server.watcher.on("change", update);
+        server.watcher.on("add", update);
+        server.watcher.on("unlink", update);
+      },
+      transformIndexHtml(html) {
+        const script = `<script type="module" src="${clientPath}" data-letmeknow-client></script>`;
+        return html.includes("</body>") ? html.replace("</body>", `${script}</body>`) : `${html}${script}`;
       }
-    }
-    finish(0);
+    }]
   });
+
+  let socket;
+  let credential;
+  let sessionUrl;
+  let retryTimer;
+  let connectionTimer;
+  let retryDelay = 100;
+  let retryUntil = 0;
+  let stopped = false;
+  let ready = false;
+  const stop = async code => {
+    if (stopped) return;
+    stopped = true;
+    clearTimeout(retryTimer);
+    clearTimeout(connectionTimer);
+    try { socket?.close(); } catch {}
+    await vite.close();
+    process.exit(code);
+  };
+  process.once("SIGINT", () => void stop(0));
+  process.once("SIGTERM", () => void stop(0));
+
+  const retry = () => {
+    if (stopped || Date.now() >= retryUntil) return void stop(1);
+    retryTimer = setTimeout(() => {
+      retryTimer = undefined;
+      connect();
+    }, retryDelay);
+    retryDelay = Math.min(retryDelay * 2, MAX_RETRY_DELAY);
+  };
+
+  const connect = () => {
+    if (stopped) return;
+    const reconnecting = Boolean(credential && sessionUrl);
+    const current = socket = reconnecting ? new WebSocket(endpoint(control, credential, sessionUrl), credential) : new WebSocket(endpoint(control));
+    connectionTimer = setTimeout(() => {
+      if (socket !== current || current.readyState === WebSocket.OPEN || stopped) return;
+      try { current.close(); } catch {}
+      if (reconnecting) retry(); else void stop(1);
+    }, CONNECTION_TIMEOUT);
+    current.addEventListener("open", () => {
+      if (socket !== current || stopped) return;
+      clearTimeout(connectionTimer);
+      retryDelay = 100;
+      if (reconnecting) retryUntil = 0;
+      send = packet => {
+        if (current.readyState !== WebSocket.OPEN) return false;
+        try { current.send(JSON.stringify(packet)); return true; } catch { return false; }
+      };
+      if (!reconnecting) send({ type: "open" });
+    });
+    current.addEventListener("message", event => {
+      if (typeof event.data !== "string") return;
+      let packet;
+      try { packet = JSON.parse(event.data); } catch { return; }
+      if (packet.type === "credential") {
+        if (typeof packet.credential !== "string" || !credentialPattern.test(packet.credential)) return void stop(1);
+        credential = packet.credential;
+      } else if (packet.type === "session") {
+        if (!validSessionUrl(packet.url)) return void stop(1);
+        sessionUrl = packet.url;
+        retryDelay = 100;
+        if (!ready) {
+          ready = true;
+          process.stdout.write(`${JSON.stringify({ type: "ready", url: sessionUrl })}\n`);
+        }
+      } else if (packet.type === "http_request") {
+        void handleRequest(vite, packet, response => send(response)).catch(() => send({ type: "http_response", request_id: packet.request_id, status: 500, headers: { "Content-Type": "text/plain; charset=utf-8" }, body: Buffer.from("preview request failed").toString("base64") }));
+      } else if (packet.type === "closed") {
+        void stop(0);
+      } else if (packet.type === "error") {
+        void stop(1);
+      }
+    });
+    current.addEventListener("error", () => {});
+    current.addEventListener("close", () => {
+      if (socket !== current || stopped) return;
+      clearTimeout(connectionTimer);
+      send = () => false;
+      socket = undefined;
+      if (!credential || !sessionUrl) return void stop(1);
+      if (!retryUntil) retryUntil = Date.now() + GRACE_SECONDS * 1_000;
+      retry();
+    });
+  };
+
+  connect();
+  await new Promise(() => {});
 }
 
-start();
+if (process.argv[2] === "--skill") {
+  if (process.argv.length !== 3) {
+    process.stderr.write("Usage: npx letmeknow-cli --skill\n");
+    process.exit(1);
+  }
+  writeSync(1, readFileSync(new URL("../SKILL.md", import.meta.url)));
+} else if (process.argv.slice(2).includes("--help") || process.argv.slice(2).includes("-h")) {
+  process.stdout.write("Usage: npx letmeknow-cli [directory]\n\nServe a folder through the hosted LetMeKnow relay. The CLI does not listen on a network port. Form submissions are JSON lines on stdout.\n");
+} else {
+  try {
+    await start(process.argv.slice(2));
+  } catch (cause) {
+    process.stderr.write(`letmeknow: ${cause instanceof Error ? cause.message : "server failed"}\n`);
+    process.exitCode = 1;
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "letmeknow-cli",
-  "version": "0.4.2",
-  "description": "A temporary interactive web surface for agents.",
+  "version": "0.4.4",
+  "description": "A live Vite preview with agent-readable form submissions.",
   "files": [
     "bin",
     "SKILL.md"
@@ -11,7 +11,7 @@
     "letmeknow": "bin/letmeknow.js"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=22.12.0"
   },
   "scripts": {
     "dev": "wrangler dev",
@@ -27,5 +27,8 @@
     "vitest": "^4.1.11",
     "wrangler": "^4.126.0",
     "ws": "^8.21.3"
+  },
+  "dependencies": {
+    "vite": "^7.3.6"
   }
 }