luang-cli 0.2.0 → 0.3.2

package/lib/ws.js

@@ -0,0 +1,552 @@
+'use strict';
+
+// lib/ws.js — klien WebSocket (RFC 6455) minimal TANPA dependensi (Node >= 18).
+// Dipakai daemon `luang-cli agent` untuk mode realtime. Cakupan kecil namun solid:
+//   • handshake GET ws://|wss://… (path + headers, mis. X-CLI-Key) + verifikasi Sec-WebSocket-Accept
+//   • semua frame client→server SELALU dimask (wajib RFC); pesan berupa teks (JSON)
+//   • baca: text/continuation (join fragmentasi), ping→pong otomatis, pong, close
+//   • keepalive: ping berkala + deteksi koneksi mati (tidak ada frame masuk)
+//   • auto-reconnect eksponensial 1s→30s (dengan jitter); close beres saat diminta
+//   • batas pesan 1 MB (masuk maupun keluar)
+// Tidak diimplementasikan: permessage-deflate, subprotocol, TLS opsi lanjutan.
+
+const { EventEmitter } = require('events');
+const crypto = require('crypto');
+const net = require('net');
+const tls = require('tls');
+
+const WS_GUID = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';
+const MAX_PAYLOAD = 1024 * 1024; // 1 MB per pesan
+const HS_MAX_HEAD = 16384;       // batas header respons handshake
+const CONNECT_TIMEOUT_MS = 10000;
+const PING_INTERVAL_MS = 25000;  // ping keepalive klien
+const DEAD_AFTER_MS = 75000;     // tanpa frame masuk (incl. pong) → koneksi dianggap mati
+const BASE_BACKOFF_MS = 1000;
+const MAX_BACKOFF_MS = 30000;
+const CLOSE_TIMEOUT_MS = 1500;
+
+const OP = { CONT: 0, TEXT: 1, BINARY: 2, CLOSE: 8, PING: 9, PONG: 10 };
+
+// ── Util ─────────────────────────────────────────────────────────────────────
+
+function wsTarget(url) {
+  let u;
+  try {
+    u = new URL(String(url));
+  } catch (e) {
+    throw new Error(`URL WebSocket tidak valid: ${url}`);
+  }
+  const secure = u.protocol === 'wss:' || u.protocol === 'https:';
+  if (!secure && u.protocol !== 'ws:' && u.protocol !== 'http:') {
+    throw new Error(`Skema WebSocket tidak didukung: ${u.protocol}`);
+  }
+  return {
+    host: u.hostname,
+    port: u.port ? Number(u.port) : secure ? 443 : 80,
+    path: (u.pathname || '/') + (u.search || ''),
+    secure,
+  };
+}
+
+function acceptKey(key) {
+  return crypto.createHash('sha1').update(String(key) + WS_GUID).digest('base64');
+}
+
+function encodeClosePayload(code, reason) {
+  const r = Buffer.from(String(reason || '').slice(0, 100), 'utf8');
+  const out = Buffer.allocUnsafe(2 + r.length);
+  out.writeUInt16BE((code || 1000) & 0xffff, 0);
+  r.copy(out, 2);
+  return out;
+}
+
+// Buat frame client→server: FIN + opcode + MASK (wajib) + payload termask.
+function encodeFrame(opcode, payload) {
+  const len = payload.length;
+  let header;
+  if (len < 126) {
+    header = Buffer.allocUnsafe(2);
+    header[1] = 0x80 | len;
+  } else if (len < 65536) {
+    header = Buffer.allocUnsafe(4);
+    header[1] = 0x80 | 126;
+    header.writeUInt16BE(len, 2);
+  } else {
+    header = Buffer.allocUnsafe(10);
+    header[1] = 0x80 | 127;
+    header.writeBigUInt64BE(BigInt(len), 2);
+  }
+  header[0] = 0x80 | opcode;
+  const mask = crypto.randomBytes(4);
+  const body = Buffer.from(payload);
+  for (let i = 0; i < body.length; i++) body[i] ^= mask[i & 3];
+  return Buffer.concat([header, mask, body]);
+}
+
+// Ambil satu frame dari buffer. null = data belum lengkap; {error} = protocol error.
+function extractFrame(buf) {
+  if (!buf || buf.length < 2) return null;
+  const b0 = buf[0];
+  const b1 = buf[1];
+  const fin = (b0 & 0x80) !== 0;
+  const opcode = b0 & 0x0f;
+  if (b0 & 0x70) return { error: new Error('Bit RSV ter-set tanpa ekstensi (RFC 6455)' + b0) };
+  const masked = (b1 & 0x80) !== 0;
+  let len = b1 & 0x7f;
+  let off = 2;
+  if (len === 126) {
+    if (buf.length < 4) return null;
+    len = buf.readUInt16BE(2);
+    off = 4;
+  } else if (len === 127) {
+    if (buf.length < 10) return null;
+    const big = buf.readBigUInt64BE(2);
+    len = Number(big);
+    off = 10;
+  }
+  if (len > MAX_PAYLOAD || !Number.isFinite(len)) return { error: new Error('Pesan melebihi batas 1 MB') };
+  const maskLen = masked ? 4 : 0;
+  const total = off + maskLen + len;
+  if (buf.length < total) return null;
+  const payload = Buffer.from(buf.subarray(off + maskLen, total));
+  if (masked) {
+    const mk = buf.subarray(off, off + 4);
+    for (let i = 0; i < payload.length; i++) payload[i] ^= mk[i & 3];
+  }
+  return { frame: { fin, opcode, payload }, rest: buf.subarray(total) };
+}
+
+// ── Klien ────────────────────────────────────────────────────────────────────
+
+class WsClient extends EventEmitter {
+  constructor(url, opts = {}) {
+    super();
+    this.url = String(url);
+    this.headers = opts.headers || {};
+    this.state = 'idle'; // idle | connecting | open | closing | closed | fatal
+    this.autoReconnect = opts.autoReconnect !== false;
+    this.pingIntervalMs = opts.pingIntervalMs || PING_INTERVAL_MS;
+    this.deadAfterMs = opts.deadAfterMs || DEAD_AFTER_MS;
+    this.baseBackoffMs = opts.baseBackoffMs || BASE_BACKOFF_MS;
+    this.maxBackoffMs = opts.maxBackoffMs || MAX_BACKOFF_MS;
+    this._sock = null;
+    this._buf = null;      // buffer frame masuk
+    this._hsBuf = null;    // buffer header handshake
+    this._frag = null;     // pesan terfragmentasi {opcode, parts, size}
+    this._queue = [];      // antrean kecil saat belum open / sedang reconnect
+    this._attempt = 0;
+    this._pendingKey = null;
+    this._lastRecvAt = 0;
+    this._connectErr = null;
+    this._pingTimer = null;
+    this._reconTimer = null;
+    this._closeTimer = null;
+    this._userClosed = false;
+  }
+
+  isOpen() {
+    return this.state === 'open';
+  }
+
+  connect() {
+    if (this._userClosed || this._reconTimer) return; // sudah jalan / dijadwalkan
+    if (this.state === 'open' || this.state === 'connecting') return;
+    if (this.state === 'fatal') return; // permanen gagal (401/403/404…/URL rusak)
+    this._userClosed = false;
+    this._connectNow();
+  }
+
+  // Kirim teks/objek (di-JSON-kan). false bila belum open → masuk antrean kecil.
+  send(data) {
+    let buf;
+    if (typeof data === 'string') buf = Buffer.from(data, 'utf8');
+    else if (Buffer.isBuffer(data)) buf = data;
+    else {
+      try {
+        buf = Buffer.from(JSON.stringify(data), 'utf8');
+      } catch (e) {
+        this.emit('error', new Error('Pesan tidak bisa diserialisasi: ' + e.message));
+        return false;
+      }
+    }
+    if (buf.length > MAX_PAYLOAD) {
+      this.emit('error', new Error(`Pesan ${buf.length} byte melebihi batas 1 MB`));
+      return false;
+    }
+    if (this.state === 'open' && this._sock) {
+      this._sendFrame(OP.TEXT, buf);
+      return true;
+    }
+    if (this._queue.length >= 100) this._queue.shift(); // buang terlama (heartbeat lama tak berharga)
+    this._queue.push(buf);
+    return false;
+  }
+
+  // Close beres: kirim frame close, tunggu sebentar, lalu hancurkan socket.
+  close(code, reason) {
+    this._userClosed = true;
+    if (this._reconTimer) {
+      clearTimeout(this._reconTimer);
+      this._reconTimer = null;
+    }
+    const sock = this._sock;
+    if (!sock) {
+      this._clearPing();
+      this.state = 'closed';
+      this.emit('close', { code: code || 1000, expected: true });
+      return;
+    }
+    if (this.state === 'open') {
+      this.state = 'closing';
+      this._sendFrame(OP.CLOSE, encodeClosePayload(code || 1000, reason));
+      this._clearPing();
+      this._closeTimer = setTimeout(() => {
+        try {
+          if (this._sock) this._sock.destroy();
+        } catch (e) { /* abaikan */ }
+      }, CLOSE_TIMEOUT_MS);
+      this._closeTimer.unref();
+    } else {
+      // connecting → bongkar langsung tanpa reconnect
+      this._clearPing();
+      this.state = 'closed';
+      try { sock.destroy(); } catch (e) { /* abaikan */ }
+      this.emit('close', { code: code || 1000, expected: true });
+    }
+  }
+
+  // ── internal ──
+
+  _clearPing() {
+    if (this._pingTimer) {
+      clearInterval(this._pingTimer);
+      this._pingTimer = null;
+    }
+  }
+
+  _scheduleReconnect(reason) {
+    if (this._userClosed || !this.autoReconnect || this._reconTimer) return;
+    const n = Math.max(0, this._attempt - 1);
+    let delay = Math.min(this.maxBackoffMs, this.baseBackoffMs * 2 ** n);
+    delay += Math.floor(Math.random() * 300); // jitter
+    this.emit('reconnecting', { attempt: this._attempt, delay, reason });
+    this._reconTimer = setTimeout(() => {
+      this._reconTimer = null;
+      if (!this._userClosed) this._connectNow();
+    }, delay);
+  }
+
+  _connectNow() {
+    if (this._userClosed || this.state === 'open') return;
+    this.state = 'connecting';
+    this._connectErr = null;
+    let target;
+    try {
+      target = wsTarget(this.url);
+    } catch (e) {
+      this.state = 'fatal';
+      this.emit('fatal', e);
+      return;
+    }
+    let sock;
+    try {
+      sock = target.secure
+        ? tls.connect({ host: target.host, port: target.port, servername: target.host }, () => this._onConnected(target))
+        : net.connect({ host: target.host, port: target.port }, () => this._onConnected(target));
+    } catch (e) {
+      this.state = 'closed';
+      this._connectErr = e;
+      this._onSockClose();
+      return;
+    }
+    sock.setNoDelay(true);
+    sock.setTimeout(CONNECT_TIMEOUT_MS, () => {
+      if (this.state === 'connecting') {
+        const err = new Error(`Waktu habis ${CONNECT_TIMEOUT_MS / 1000}s saat handshake`);
+        err.handshakeStatus = 0;
+        this._connectErr = err;
+        try { sock.destroy(); } catch (e2) { /* abaikan */ }
+      }
+    });
+    sock.on('data', (chunk) => this._onData(chunk));
+    sock.on('error', (e) => this._onSockError(e));
+    sock.on('close', () => this._onSockClose());
+    this._sock = sock;
+  }
+
+  _onConnected(target) {
+    const sock = this._sock;
+    if (!sock || this.state !== 'connecting') return;
+    const defaultPort = target.secure ? 443 : 80;
+    const hostHeader = target.port === defaultPort ? target.host : `${target.host}:${target.port}`;
+    const key = crypto.randomBytes(16).toString('base64');
+    this._pendingKey = key;
+    const lines = [
+      `GET ${target.path} HTTP/1.1`,
+      `Host: ${hostHeader}`,
+      'Upgrade: websocket',
+      'Connection: Upgrade',
+      `Sec-WebSocket-Key: ${key}`,
+      'Sec-WebSocket-Version: 13',
+    ];
+    for (const [k, v] of Object.entries(this.headers)) {
+      const kl = String(k).toLowerCase();
+      if (kl.startsWith('sec-websocket') || kl === 'connection' || kl === 'upgrade' || kl === 'host') continue;
+      lines.push(`${k}: ${v}`);
+    }
+    sock.write(lines.join('\r\n') + '\r\n\r\n', 'utf8');
+  }
+
+  _onData(chunk) {
+    if (this.state === 'open') {
+      this._lastRecvAt = Date.now();
+      this._feed(chunk);
+      return;
+    }
+    // masih handshaking
+    this._hsBuf = this._hsBuf ? Buffer.concat([this._hsBuf, chunk]) : chunk;
+    const idx = this._hsBuf.indexOf('\r\n\r\n');
+    if (idx === -1) {
+      if (this._hsBuf.length > HS_MAX_HEAD) {
+        const err = new Error('Header handshake terlalu besar');
+        err.handshakeStatus = 0;
+        this._connectErr = err;
+        try { this._sock.destroy(); } catch (e) { /* abaikan */ }
+      }
+      return;
+    }
+    const head = this._hsBuf.subarray(0, idx).toString('utf8');
+    const rest = this._hsBuf.subarray(idx + 4);
+    this._hsBuf = null;
+    this._finishHandshake(head, rest);
+  }
+
+  _finishHandshake(head, rest) {
+    const lines = head.split('\r\n');
+    const m = /^HTTP\/1\.\d\s+(\d{3})(?:\s+(.*))?$/.exec(String(lines[0] || '').trim());
+    const status = m ? Number(m[1]) : 0;
+    if (status !== 101) {
+      const err = new Error(`Handshake WebSocket ditolak (HTTP ${status})`);
+      err.handshakeStatus = status;
+      this._connectErr = err;
+      try { this._sock.destroy(); } catch (e) { /* abaikan */ }
+      return;
+    }
+    const headers = {};
+    for (const line of lines.slice(1)) {
+      const ci = line.indexOf(':');
+      if (ci > 0) headers[line.slice(0, ci).trim().toLowerCase()] = line.slice(ci + 1).trim();
+    }
+    if (!this._pendingKey || headers['sec-websocket-accept'] !== acceptKey(this._pendingKey)) {
+      const err = new Error('Sec-WebSocket-Accept tidak valid — server bukan WebSocket RFC 6455');
+      err.handshakeStatus = 101;
+      this._connectErr = err;
+      try { this._sock.destroy(); } catch (e) { /* abaikan */ }
+      return;
+    }
+    // 101 + accept valid → open
+    const sock = this._sock;
+    this.state = 'open';
+    this._attempt = 0;
+    this._frag = null;
+    this._pendingKey = null;
+    this._lastRecvAt = Date.now();
+    if (sock) sock.setTimeout(0);
+    this._startPing();
+    this.emit('open');
+    if (rest && rest.length) this._feed(rest);
+    const q = this._queue.splice(0);
+    for (const b of q) {
+      if (this.state === 'open') this._sendFrame(OP.TEXT, b);
+    }
+  }
+
+  _startPing() {
+    this._clearPing();
+    this._pingTimer = setInterval(() => {
+      if (this.state !== 'open' || !this._sock) return;
+      const now = Date.now();
+      if (this._lastRecvAt && now - this._lastRecvAt > this.deadAfterMs) {
+        this.emit('error', new Error(`Koneksi diam > ${Math.round(this.deadAfterMs / 1000)}s tanpa frame — diputus untuk sambung ulang`));
+        try { this._sock.destroy(); } catch (e) { /* abaikan */ }
+        return;
+      }
+      this._sendFrame(OP.PING, crypto.randomBytes(4));
+    }, this.pingIntervalMs);
+  }
+
+  _onSockError(e) {
+    if (this.state === 'open') {
+      this.emit('error', e);
+      try { this._sock.destroy(); } catch (e2) { /* abaikan */ }
+      return;
+    }
+    if (this.state === 'connecting') {
+      if (e && e.handshakeStatus === undefined) {
+        const err = e instanceof Error ? e : new Error(String(e));
+        err.handshakeStatus = 0;
+        this._connectErr = err;
+      }
+      try { this._sock.destroy(); } catch (e2) { /* abaikan */ }
+    }
+    // state 'closing'/'closed': socket error diabaikan — kita memang sedang memutus
+  }
+
+  _onSockClose() {
+    if (this._closeTimer) {
+      clearTimeout(this._closeTimer);
+      this._closeTimer = null;
+    }
+    this._clearPing();
+    const was = this.state;
+    this.state = 'closed';
+    this._sock = null;
+    this._buf = null;
+    this._hsBuf = null;
+    this._frag = null;
+    if (this._userClosed || was === 'closing') {
+      this.emit('close', { code: 1000, expected: true });
+      return;
+    }
+    if (was === 'open') {
+      this.emit('close', { code: 1006, expected: false });
+      this._scheduleReconnect('koneksi terputus');
+      return;
+    }
+    if (was === 'connecting') {
+      const err = this._connectErr || new Error('Gagal terhubung');
+      this._connectErr = null;
+      const st = Number(err.handshakeStatus || 0);
+      const permanent = st >= 400 && st < 500 && st !== 408 && st !== 429;
+      if (permanent) {
+        this.state = 'fatal';
+        this.emit('fatal', err);
+        return;
+      }
+      this.emit('error', err);
+      this._attempt += 1;
+      this._scheduleReconnect(err.message);
+    }
+  }
+
+  _protocolFail(err) {
+    this.emit('error', err);
+    const code = /1 MB/.test(err.message) ? 1009 : 1002;
+    if (this._sock && this.state === 'open') {
+      try { this._sock.write(encodeFrame(OP.CLOSE, encodeClosePayload(code, err.message))); } catch (e) { /* abaikan */ }
+      try { this._sock.end(); } catch (e2) { /* abaikan */ }
+      setTimeout(() => {
+        try { if (this._sock) this._sock.destroy(); } catch (e3) { /* abaikan */ }
+      }, 250).unref();
+    }
+  }
+
+  _feed(chunk) {
+    this._buf = this._buf ? Buffer.concat([this._buf, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)]) : chunk;
+    for (;;) {
+      const r = extractFrame(this._buf);
+      if (r === null) break;
+      if (r.error) {
+        this._protocolFail(r.error);
+        return;
+      }
+      this._buf = r.rest;
+      this._onFrame(r.frame);
+      if (this.state !== 'open') return;
+    }
+    if (this._buf && this._buf.length > MAX_PAYLOAD + 16) {
+      this._protocolFail(new Error('Buffer frame melebihi batas 1 MB'));
+    }
+  }
+
+  _onFrame({ fin, opcode, payload }) {
+    switch (opcode) {
+      case OP.TEXT:
+      case OP.BINARY: {
+        if (this._frag) {
+          this._protocolFail(new Error('Frame teks baru saat fragmentasi belum selesai'));
+          return;
+        }
+        if (fin) {
+          this._deliver(opcode, payload);
+          return;
+        }
+        this._frag = { opcode, parts: [payload], size: payload.length };
+        return;
+      }
+      case OP.CONT: {
+        if (!this._frag) {
+          this._protocolFail(new Error('Continuation tanpa pesan induk'));
+          return;
+        }
+        this._frag.parts.push(payload);
+        this._frag.size += payload.length;
+        if (this._frag.size > MAX_PAYLOAD) {
+          const err = new Error('Pesan gabungan melebihi batas 1 MB');
+          this._frag = null;
+          this._protocolFail(err);
+          return;
+        }
+        if (fin) {
+          const { opcode: op, parts } = this._frag;
+          this._frag = null;
+          this._deliver(op, Buffer.concat(parts));
+        }
+        return;
+      }
+      case OP.PING: {
+        if (payload.length > 125) {
+          this._protocolFail(new Error('Ping > 125 byte'));
+          return;
+        }
+        this._sendFrame(OP.PONG, payload);
+        return;
+      }
+      case OP.PONG:
+        return;
+      case OP.CLOSE: {
+        let code = 1005;
+        let reason = '';
+        if (payload.length >= 2) {
+          code = payload.readUInt16BE(0);
+          reason = payload.subarray(2).toString('utf8');
+        }
+        // echo close lalu biarkan event 'close' yang memutus (reconnect bila perlu)
+        if (this._sock && this.state === 'open') {
+          try { this._sock.write(encodeFrame(OP.CLOSE, encodeClosePayload(code === 1005 ? 1000 : code, ''))); } catch (e) { /* abaikan */ }
+        }
+        setImmediate(() => {
+          try { if (this._sock) this._sock.destroy(); } catch (e) { /* abaikan */ }
+        });
+        return;
+      }
+      default:
+        this._protocolFail(new Error(`Opcode tidak dikenal: ${opcode}`));
+    }
+  }
+
+  _deliver(opcode, payload) {
+    if (opcode === OP.TEXT) {
+      let s = '';
+      try { s = payload.toString('utf8'); } catch (e) { s = ''; }
+      this.emit('message', s);
+    } else {
+      this.emit('binary', payload); // tidak dipakai CLI, tapi tetap tersedia
+    }
+  }
+
+  _sendFrame(opcode, payload) {
+    const sock = this._sock;
+    if (!sock || this.state !== 'open' || !sock.writable) return false;
+    try {
+      sock.write(encodeFrame(opcode, payload));
+      return true;
+    } catch (e) {
+      this.emit('error', e);
+      try { sock.destroy(); } catch (e2) { /* abaikan */ }
+      return false;
+    }
+  }
+}
+
+module.exports = { WsClient, MAX_PAYLOAD, acceptKey, encodeFrame, extractFrame, wsTarget };

package/package.json

@@ -1,11 +1,14 @@
 {
   "name": "luang-cli",
-  "version": "0.2.0",
+  "version": "0.3.2",
   "description": "CLI Agent Orchestration Luang — login device flow, sinkronisasi provider AI, daemon tugas, dan manajemen task dari terminal. Zero-dependency, Node >= 18.",
   "license": "MIT",
   "bin": {
     "luang-cli": "bin/luang-cli.js"
   },
+  "scripts": {
+    "test": "node test/run-e2e.js"
+  },
   "engines": {
     "node": ">=18"
   },

package/test/bin/opencode

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Stub provider untuk E2E offline luang-cli.
+# Ganti binary `opencode` di PATH uji — TIDAK memanggil opencode/claude/gemini asli.
+if [ "$1" = "models" ]; then
+  # Dipakai skenario `luang-cli models` (deteksi dinamis opencode).
+  printf '%s\n' '["stub-model-a","stub-model-b","stub-model-c"]'
+  exit 0
+fi
+printf 'PROVIDER-RUN %s\n' "$*"
+exit 0

package/test/http-stub.js

@@ -0,0 +1,77 @@
+'use strict';
+
+// test/http-stub.js — stub server HTTP minimal untuk E2E offline luang-cli.
+// Berjalan sebagai proses TERPISAH (di-fork oleh run-e2e.js) supaya event loop
+// induk tidak diblokir spawnSync saat CLI menghubungi /api/v1/agent/me.
+// Flag telemetry_enabled di-toggle lewat pesan IPC: { telemetry_enabled: true }.
+// Bukan bagian dari paket npm; hanya alat uji.
+
+const http = require('http');
+
+let telemetryEnabled = false;
+let lastHeartbeat = null;
+let workspace = '';
+
+process.on('message', (msg) => {
+  if (msg && typeof msg === 'object' && 'telemetry_enabled' in msg) {
+    telemetryEnabled = msg.telemetry_enabled === true;
+  }
+  if (msg && typeof msg === 'object' && 'workspace' in msg) {
+    workspace = String(msg.workspace || '');
+  }
+  if (msg && msg.cmd === 'get_heartbeat') {
+    if (typeof process.send === 'function') process.send({ cmd: 'heartbeat', body: lastHeartbeat });
+  }
+  if (msg && msg.cmd === 'exit') {
+    process.exit(0);
+  }
+});
+
+const server = http.createServer((req, res) => {
+  if (req.url.startsWith('/api/v1/agent/me')) {
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({
+      success: true,
+      data: { name: 'Sesi Uji', key_id: 'k3', telemetry_enabled: telemetryEnabled, workspace, can_update_tasks: true },
+    }));
+    return;
+  }
+  if (req.url.startsWith('/api/v1/agent/workspace') && req.method === 'POST') {
+    let raw = '';
+    req.on('data', (d) => { raw += d; });
+    req.on('end', () => {
+      try {
+        const b = JSON.parse(raw);
+        workspace = typeof b.workspace === 'string' ? b.workspace : workspace;
+      } catch (e) { /* abaikan */ }
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ success: true, message: 'Workspace disimpan', data: { workspace } }));
+    });
+    return;
+  }
+  if (req.url.startsWith('/api/v1/agent/heartbeat') && req.method === 'POST') {
+    let raw = '';
+    req.on('data', (d) => { raw += d; });
+    req.on('end', () => {
+      try {
+        lastHeartbeat = JSON.parse(raw);
+      } catch (e) {
+        lastHeartbeat = null;
+      }
+      // Kirim payload ke induk supaya E2E bisa memeriksa kontrak `providers[].models`.
+      if (typeof process.send === 'function') process.send({ cmd: 'heartbeat', body: lastHeartbeat });
+      const n = (lastHeartbeat && Array.isArray(lastHeartbeat.providers) ? lastHeartbeat.providers : []).length;
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ success: true, data: { providers_count: n } }));
+    });
+    return;
+  }
+  res.writeHead(404, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify({ success: false, message: 'not found' }));
+});
+
+server.listen(0, '127.0.0.1', () => {
+  if (typeof process.send === 'function') {
+    process.send({ cmd: 'listening', port: server.address().port });
+  }
+});