mewkit 1.15.0 → 1.16.1

package/dist/orchviz/sanitize.js

@@ -1,38 +0,0 @@
-/**
- * Combined sanitization for events leaving the server (SSE / API).
- * - stripAnsi  → defense vs ANSI-injection (red-team Critical #1)
- * - scrubSecrets → defense vs key/PEM leak (red-team Medium #13 / Q3)
- * - newline scrubbing → defense vs SSE frame injection (red-team RT2 #2)
- *
- * Recursive: walks every string in nested objects/arrays.
- */
-import { stripAnsi } from "./parser/strip-ansi.js";
-import { scrubSecrets } from "./redact.js";
-function sanitizeString(s) {
-    // Strip ANSI, scrub secrets, then collapse \r\n / \n that would break SSE frames.
-    const cleaned = scrubSecrets(stripAnsi(s));
-    return cleaned.replace(/\r\n|\r|\n/g, " ");
-}
-function sanitizeValue(v) {
-    if (typeof v === "string")
-        return sanitizeString(v);
-    if (Array.isArray(v))
-        return v.map(sanitizeValue);
-    if (v && typeof v === "object") {
-        const out = {};
-        for (const [k, val] of Object.entries(v)) {
-            out[k] = sanitizeValue(val);
-        }
-        return out;
-    }
-    return v;
-}
-export function sanitizeEvent(event) {
-    return {
-        time: event.time,
-        type: event.type,
-        payload: sanitizeValue(event.payload),
-        ...(event.sessionId ? { sessionId: event.sessionId } : {}),
-    };
-}
-//# sourceMappingURL=sanitize.js.map

package/dist/orchviz/sanitize.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/orchviz/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,SAAS,cAAc,CAAC,CAAS;IAChC,kFAAkF;IAClF,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAChC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC9C,OAAO;QACN,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAA4B;QAChE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACH,CAAC"}

package/dist/orchviz/server/api-handlers.d.ts

@@ -1,55 +0,0 @@
-/**
- * /api/overlays + /api/plan + /api/plans — JSON endpoints backed by collectors.
- */
-import type { ServerResponse } from "node:http";
-import { PlanCollector, type PlanSnapshot } from "../plan/collector.js";
-export interface OverlayState {
-    gate1?: {
-        name: string;
-        approved: boolean;
-    } | null;
-    gate2?: {
-        name: string;
-        verdict: string;
-    } | null;
-    model?: string | null;
-    cost?: {
-        tokens: number;
-        usd: number;
-    } | null;
-    phase?: string | null;
-}
-export type OverlayProvider = () => OverlayState;
-export declare function writeJson(res: ServerResponse, status: number, body: unknown): void;
-export declare function handleOverlays(res: ServerResponse, provider: OverlayProvider): void;
-export declare const PLACEHOLDER_OVERLAYS: OverlayProvider;
-export declare function makeOverlayProvider(projectRoot: string): OverlayProvider;
-/**
- * PlanProvider now accepts an optional slug string.
- * PlanCollector.snapshot(slug?) maps to this signature.
- */
-export type PlanProvider = (slug?: string) => PlanSnapshot;
-/**
- * Handle GET /api/plan — optionally targeted by ?slug=<slug> query param.
- *
- * Error mapping (R2-8):
- *   snapshot.error === "invalid-slug"   → 400
- *   snapshot.error === "forbidden-path" → 403
- *   snapshot.error === "not-found"      → 404
- *   no error                            → 200
- */
-export declare function handlePlan(res: ServerResponse, provider: PlanProvider, query: URLSearchParams): void;
-export declare const PLACEHOLDER_PLAN: PlanProvider;
-export declare function makePlanProvider(projectRoot: string): PlanProvider;
-/**
- * Create a standalone PlanCollector instance for injection into the write handler.
- * The write handler calls collector.invalidate() after every successful write,
- * invalidating the cache so the next GET returns fresh data (R2-4).
- */
-export declare function makePlanCollector(projectRoot: string): PlanCollector;
-/**
- * Handle GET /api/plans — returns all non-archived plan summaries sorted mtime desc.
- * HTML-tag scrub applied to all string fields (red-team H2).
- */
-export declare function handlePlans(res: ServerResponse, projectRoot: string): void;
-//# sourceMappingURL=api-handlers.d.ts.map

package/dist/orchviz/server/api-handlers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-handlers.d.ts","sourceRoot":"","sources":["../../../src/orchviz/server/api-handlers.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAA0B,MAAM,sBAAsB,CAAC;AAyBhG,MAAM,WAAW,YAAY;IAC5B,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACnD,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjD,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9C,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC;AAEjD,wBAAgB,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAQlF;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAMnF;AAED,eAAO,MAAM,oBAAoB,EAAE,eAMjC,CAAC;AAEH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,CAGxE;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,KAAK,YAAY,CAAC;AAE3D;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CAapG;AAED,eAAO,MAAM,gBAAgB,EAAE,YAK7B,CAAC;AAEH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,CAGlE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,CAEpE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAQ1E"}

package/dist/orchviz/server/api-handlers.js

@@ -1,112 +0,0 @@
-/**
- * /api/overlays + /api/plan + /api/plans — JSON endpoints backed by collectors.
- */
-import { OverlayCollector } from "../overlay/collector.js";
-import { PlanCollector } from "../plan/collector.js";
-import { listPlans } from "../plan/list-plans.js";
-const PLAN_ERROR_HTTP = {
-    "invalid-slug": 400,
-    "forbidden-path": 403,
-    "not-found": 404,
-};
-const HTML_TAG_RE = /<[^>]*>/g;
-/** Recursively strip HTML tags from string fields. Defense-in-depth (red-team H2). */
-function stripHtmlDeep(value) {
-    if (typeof value === "string")
-        return value.replace(HTML_TAG_RE, "");
-    if (Array.isArray(value))
-        return value.map(stripHtmlDeep);
-    if (value && typeof value === "object") {
-        const out = {};
-        for (const [k, v] of Object.entries(value)) {
-            out[k] = stripHtmlDeep(v);
-        }
-        return out;
-    }
-    return value;
-}
-export function writeJson(res, status, body) {
-    const payload = JSON.stringify(body);
-    res.writeHead(status, {
-        "Content-Type": "application/json; charset=utf-8",
-        "Content-Length": String(Buffer.byteLength(payload)),
-        "Cache-Control": "no-cache",
-    });
-    res.end(payload);
-}
-export function handleOverlays(res, provider) {
-    try {
-        writeJson(res, 200, provider());
-    }
-    catch {
-        writeJson(res, 500, { error: "overlay-read-failed" });
-    }
-}
-export const PLACEHOLDER_OVERLAYS = () => ({
-    gate1: null,
-    gate2: null,
-    model: null,
-    cost: null,
-    phase: null,
-});
-export function makeOverlayProvider(projectRoot) {
-    const collector = new OverlayCollector(projectRoot);
-    return () => collector.snapshot();
-}
-/**
- * Handle GET /api/plan — optionally targeted by ?slug=<slug> query param.
- *
- * Error mapping (R2-8):
- *   snapshot.error === "invalid-slug"   → 400
- *   snapshot.error === "forbidden-path" → 403
- *   snapshot.error === "not-found"      → 404
- *   no error                            → 200
- */
-export function handlePlan(res, provider, query) {
-    try {
-        const slug = query.get("slug") ?? undefined;
-        const snapshot = provider(slug);
-        if (snapshot.error) {
-            writeJson(res, PLAN_ERROR_HTTP[snapshot.error], { error: snapshot.error });
-            return;
-        }
-        const safe = stripHtmlDeep(snapshot);
-        writeJson(res, 200, safe);
-    }
-    catch {
-        writeJson(res, 500, { error: "plan-read-failed" });
-    }
-}
-export const PLACEHOLDER_PLAN = () => ({
-    plan: null,
-    phaseEtags: null,
-    readonly: false,
-    generatedAt: new Date().toISOString(),
-});
-export function makePlanProvider(projectRoot) {
-    const collector = new PlanCollector(projectRoot);
-    return (slug) => collector.snapshot(slug);
-}
-/**
- * Create a standalone PlanCollector instance for injection into the write handler.
- * The write handler calls collector.invalidate() after every successful write,
- * invalidating the cache so the next GET returns fresh data (R2-4).
- */
-export function makePlanCollector(projectRoot) {
-    return new PlanCollector(projectRoot);
-}
-/**
- * Handle GET /api/plans — returns all non-archived plan summaries sorted mtime desc.
- * HTML-tag scrub applied to all string fields (red-team H2).
- */
-export function handlePlans(res, projectRoot) {
-    try {
-        const plans = listPlans(projectRoot);
-        const safe = stripHtmlDeep(plans);
-        writeJson(res, 200, { plans: safe, generatedAt: new Date().toISOString() });
-    }
-    catch {
-        writeJson(res, 500, { error: "plans-read-failed" });
-    }
-}
-//# sourceMappingURL=api-handlers.js.map

package/dist/orchviz/server/api-handlers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-handlers.js","sourceRoot":"","sources":["../../../src/orchviz/server/api-handlers.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAA6C,MAAM,sBAAsB,CAAC;AAChG,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,eAAe,GAAsC;IAC1D,cAAc,EAAE,GAAG;IACnB,gBAAgB,EAAE,GAAG;IACrB,WAAW,EAAE,GAAG;CAChB,CAAC;AAEF,MAAM,WAAW,GAAG,UAAU,CAAC;AAE/B,sFAAsF;AACtF,SAAS,aAAa,CAAI,KAAQ;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAiB,CAAC;IACrF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAiB,CAAC;IAC1E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,GAAmB,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAYD,MAAM,UAAU,SAAS,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACrB,cAAc,EAAE,iCAAiC;QACjD,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACpD,eAAe,EAAE,UAAU;KAC3B,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAmB,EAAE,QAAyB;IAC5E,IAAI,CAAC;QACJ,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACvD,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAoB,GAAG,EAAE,CAAC,CAAC;IAC3D,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,IAAI;IACX,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,IAAI;CACX,CAAC,CAAC;AAEH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACtD,MAAM,SAAS,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACpD,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;AACnC,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,GAAmB,EAAE,QAAsB,EAAE,KAAsB;IAC7F,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,SAAS,CAAC,GAAG,EAAE,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3E,OAAO;QACR,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACpD,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAiB,GAAG,EAAE,CAAC,CAAC;IACpD,IAAI,EAAE,IAAI;IACV,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,KAAK;IACf,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IACnD,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,CAAC,IAAa,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACpD,OAAO,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAmB,EAAE,WAAmB;IACnE,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAClC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACR,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACrD,CAAC;AACF,CAAC"}

package/dist/orchviz/server/index.d.ts

@@ -1,36 +0,0 @@
-/**
- * OrchvizServer — node:http server bound 127.0.0.1 with SSE relay + static UI.
- *
- * Architecture ported from patoles/agent-flow @ 59ccf4e (app/src/server.ts +
- * scripts/relay.ts SSE block). License Apache-2.0 (see ../../NOTICE).
- */
-import { EventEmitter } from "node:events";
-import { type OverlayProvider, type PlanProvider } from "./api-handlers.js";
-import type { PlanCollector } from "../plan/collector.js";
-export interface OrchvizServerOptions {
-    port?: number;
-    staticDir: string;
-    eventSource: EventEmitter;
-    overlayProvider?: OverlayProvider;
-    planProvider?: PlanProvider;
-    /** Required for /api/plans endpoint. Falls back to no-op if absent. */
-    projectRoot?: string;
-    /** Required for POST /api/plan/todo cache invalidation (red-team M4 / R2-4). */
-    planCollector?: PlanCollector;
-    verbose?: boolean;
-}
-export declare class OrchvizServer {
-    private server;
-    private readonly relay;
-    private actualPort;
-    private readonly opts;
-    private readonly forwardEvent;
-    constructor(opts: OrchvizServerOptions);
-    get port(): number;
-    get url(): string;
-    start(onListening?: (url: string) => void): Promise<string>;
-    stop(): Promise<void>;
-    private routeRequest;
-    private isHostAllowed;
-}
-//# sourceMappingURL=index.d.ts.map

package/dist/orchviz/server/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/orchviz/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAM3C,OAAO,EAON,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,MAAM,WAAW,oBAAoB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,YAAY,CAAC;IAC1B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,aAAa;IACzB,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;gBAE3C,IAAI,EAAE,oBAAoB;IAOtC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,IAAI,GAAG,IAAI,MAAM,CAEhB;IAEK,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAoC3D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB3B,OAAO,CAAC,YAAY;IAqDpB,OAAO,CAAC,aAAa;CAOrB"}

package/dist/orchviz/server/index.js

@@ -1,144 +0,0 @@
-/**
- * OrchvizServer — node:http server bound 127.0.0.1 with SSE relay + static UI.
- *
- * Architecture ported from patoles/agent-flow @ 59ccf4e (app/src/server.ts +
- * scripts/relay.ts SSE block). License Apache-2.0 (see ../../NOTICE).
- */
-import * as http from "node:http";
-import { BIND_HOST, SSE_DRAIN_GRACE_MS } from "../constants.js";
-import { sanitizeEvent } from "../sanitize.js";
-import { SseRelay } from "./sse-handler.js";
-import { serveStatic } from "./static-handler.js";
-import { handleOverlays, handlePlan, handlePlans, writeJson, PLACEHOLDER_OVERLAYS, PLACEHOLDER_PLAN, } from "./api-handlers.js";
-import { handleTodoWrite, handleTodoPreflight } from "./write-handlers.js";
-export class OrchvizServer {
-    server = null;
-    relay = new SseRelay();
-    actualPort = 0;
-    opts;
-    forwardEvent;
-    constructor(opts) {
-        this.opts = opts;
-        this.forwardEvent = (e) => {
-            this.relay.publish(sanitizeEvent(e));
-        };
-    }
-    get port() {
-        return this.actualPort;
-    }
-    get url() {
-        return `http://${BIND_HOST}:${this.actualPort}`;
-    }
-    async start(onListening) {
-        this.relay.start();
-        this.opts.eventSource.on("event", this.forwardEvent);
-        const desiredPort = this.opts.port ?? 0;
-        const tryListen = (port) => new Promise((resolve, reject) => {
-            const server = http.createServer((req, res) => this.routeRequest(req, res));
-            // All errors reject — caller distinguishes EADDRINUSE / EACCES for fallback.
-            server.on("error", reject);
-            server.listen(port, BIND_HOST, () => {
-                this.server = server;
-                const addr = server.address();
-                this.actualPort = typeof addr === "object" && addr ? addr.port : port;
-                resolve();
-            });
-        });
-        try {
-            await tryListen(desiredPort);
-        }
-        catch (err) {
-            const e = err;
-            if (desiredPort !== 0 && (e.code === "EADDRINUSE" || e.code === "EACCES")) {
-                if (this.opts.verbose) {
-                    process.stderr.write(`[orchviz] port ${desiredPort} unavailable (${e.code}); falling back to random\n`);
-                }
-                await tryListen(0);
-            }
-            else {
-                throw err;
-            }
-        }
-        const url = this.url;
-        if (onListening)
-            onListening(url);
-        return url;
-    }
-    async stop() {
-        this.opts.eventSource.off("event", this.forwardEvent);
-        this.relay.stop();
-        if (!this.server)
-            return;
-        const srv = this.server;
-        this.server = null;
-        await new Promise((resolve) => {
-            const timer = setTimeout(() => resolve(), SSE_DRAIN_GRACE_MS);
-            if (typeof timer.unref === "function")
-                timer.unref();
-            srv.close(() => {
-                clearTimeout(timer);
-                resolve();
-            });
-        });
-    }
-    routeRequest(req, res) {
-        // Host header guard — defense vs DNS rebinding (red-team RT2 #1).
-        if (!this.isHostAllowed(req)) {
-            res.writeHead(403, { "Content-Type": "text/plain" });
-            res.end("Forbidden");
-            return;
-        }
-        const url = new URL(req.url ?? "/", `http://${BIND_HOST}:${this.actualPort}`);
-        const pathname = url.pathname;
-        // Route /api/plan/todo BEFORE the GET/HEAD method gate (spec step 14).
-        if (pathname === "/api/plan/todo") {
-            const writeCtx = {
-                projectRoot: this.opts.projectRoot ?? "",
-                port: this.actualPort,
-                planCollector: this.opts.planCollector,
-            };
-            if (req.method === "OPTIONS") {
-                handleTodoPreflight(req, res, this.actualPort);
-                return;
-            }
-            void handleTodoWrite(req, res, writeCtx);
-            return;
-        }
-        if (req.method !== "GET" && req.method !== "HEAD") {
-            res.writeHead(405, { Allow: "GET, HEAD", "Content-Type": "text/plain" });
-            res.end("Method Not Allowed");
-            return;
-        }
-        if (pathname === "/events") {
-            this.relay.handle(req, res);
-            return;
-        }
-        if (pathname === "/api/overlays") {
-            handleOverlays(res, this.opts.overlayProvider ?? PLACEHOLDER_OVERLAYS);
-            return;
-        }
-        if (pathname === "/api/plans") {
-            if (this.opts.projectRoot) {
-                handlePlans(res, this.opts.projectRoot);
-            }
-            else {
-                writeJson(res, 200, { plans: [], generatedAt: new Date().toISOString() });
-            }
-            return;
-        }
-        if (pathname === "/api/plan") {
-            handlePlan(res, this.opts.planProvider ?? PLACEHOLDER_PLAN, url.searchParams);
-            return;
-        }
-        serveStatic(req, res, this.opts.staticDir);
-    }
-    isHostAllowed(req) {
-        const host = req.headers.host;
-        if (!host)
-            return false;
-        const expected = new Set([`${BIND_HOST}:${this.actualPort}`, `localhost:${this.actualPort}`]);
-        // Allow stable port match too in case actualPort still 0 during fallback.
-        return expected.has(host) || host === BIND_HOST || host === "localhost";
-    }
-}
-//# sourceMappingURL=index.js.map

package/dist/orchviz/server/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/orchviz/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACN,cAAc,EACd,UAAU,EACV,WAAW,EACX,SAAS,EACT,oBAAoB,EACpB,gBAAgB,GAGhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAA4B,MAAM,qBAAqB,CAAC;AAgBrG,MAAM,OAAO,aAAa;IACjB,MAAM,GAAuB,IAAI,CAAC;IACzB,KAAK,GAAG,IAAI,QAAQ,EAAE,CAAC;IAChC,UAAU,GAAG,CAAC,CAAC;IACN,IAAI,CAAuB;IAC3B,YAAY,CAA0B;IAEvD,YAAY,IAA0B;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAa,EAAQ,EAAE;YAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC;IACH,CAAC;IAED,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,UAAU,CAAC;IACxB,CAAC;IAED,IAAI,GAAG;QACN,OAAO,UAAU,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAAmC;QAC9C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QAExC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAiB,EAAE,CACjD,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAC5E,6EAA6E;YAC7E,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;gBACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC,UAAU,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBACtE,OAAO,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEJ,IAAI,CAAC;YACJ,MAAM,SAAS,CAAC,WAAW,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,GAA4B,CAAC;YACvC,IAAI,WAAW,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC3E,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,WAAW,iBAAiB,CAAC,CAAC,IAAI,6BAA6B,CAAC,CAAC;gBACzG,CAAC;gBACD,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACP,MAAM,GAAG,CAAC;YACX,CAAC;QACF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,WAAW;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,IAAI;QACT,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAC9D,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACrD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;gBACd,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,GAAyB,EAAE,GAAwB;QACvE,kEAAkE;QAClE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACR,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE9B,uEAAuE;QACvE,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAwB;gBACrC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE;gBACxC,IAAI,EAAE,IAAI,CAAC,UAAU;gBACrB,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;aACtC,CAAC;YACF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9B,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC/C,OAAO;YACR,CAAC;YACD,KAAK,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACzE,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAC9B,OAAO;QACR,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5B,OAAO;QACR,CAAC;QACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YAClC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,oBAAoB,CAAC,CAAC;YACvE,OAAO;QACR,CAAC;QACD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC3B,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACP,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO;QACR,CAAC;QACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC9B,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,gBAAgB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9E,OAAO;QACR,CAAC;QACD,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAEO,aAAa,CAAC,GAAyB;QAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,aAAa,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC9F,0EAA0E;QAC1E,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW,CAAC;IACzE,CAAC;CACD"}

package/dist/orchviz/server/sse-handler.d.ts

@@ -1,28 +0,0 @@
-/**
- * SSE handler — replay buffer, heartbeat, Last-Event-ID, client cap.
- */
-import type { IncomingMessage, ServerResponse } from "node:http";
-import type { AgentEvent } from "../protocol.js";
-export interface BufferedEvent {
-    id: number;
-    event: AgentEvent;
-}
-export declare class SseRelay {
-    private readonly clients;
-    private readonly buffer;
-    private readonly agentRegistry;
-    private readonly pauseRegistry;
-    private readonly pauseDebounce;
-    private nextId;
-    private heartbeat;
-    start(): void;
-    stop(): void;
-    clientCount(): number;
-    publish(event: AgentEvent): void;
-    private publishImmediately;
-    handle(req: IncomingMessage, res: ServerResponse): void;
-    private broadcast;
-    private writeOne;
-    private sendHeartbeat;
-}
-//# sourceMappingURL=sse-handler.d.ts.map

package/dist/orchviz/server/sse-handler.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sse-handler.d.ts","sourceRoot":"","sources":["../../../src/orchviz/server/sse-handler.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAA4D,MAAM,gBAAgB,CAAC;AAO3G,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,UAAU,CAAC;CAClB;AAeD,qBAAa,QAAQ;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAK9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoC;IAIlE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoC;IAIlE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyC;IACvE,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,SAAS,CAA+B;IAEhD,KAAK,IAAI,IAAI;IAMb,IAAI,IAAI,IAAI;IAeZ,WAAW,IAAI,MAAM;IAIrB,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAyChC,OAAO,CAAC,kBAAkB;IA+B1B,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IA4CvD,OAAO,CAAC,SAAS;IAmBjB,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,aAAa;CAcrB"}

package/dist/orchviz/server/sse-handler.js

@@ -1,217 +0,0 @@
-/**
- * SSE handler — replay buffer, heartbeat, Last-Event-ID, client cap.
- */
-import { MAX_SSE_BUFFER, MAX_SSE_CLIENTS, SSE_HEARTBEAT_MS, PAUSE_MIN_DURATION_MS } from "../constants.js";
-const SPAWN_TYPE = "agent_spawn";
-const PAUSE_STARTED = "pause_started";
-const PAUSE_CLEARED = "pause_cleared";
-function pauseKey(event) {
-    const payload = event.payload;
-    const session = event.sessionId ?? "_";
-    const agent = payload?.agent ?? "_";
-    const tid = payload?.toolUseId ?? "*";
-    return `${session}:${agent}:${tid}`;
-}
-export class SseRelay {
-    clients = new Set();
-    buffer = [];
-    // Persistent registry of agent_spawn events keyed by `${sessionId}:${name}`.
-    // The ring buffer evicts old events, but a browser that reconnects mid-session
-    // still needs to know which agents exist — otherwise tool_call_* events drop
-    // silently because their target agent was never spawned in the client view.
-    agentRegistry = new Map();
-    // [red-team #6] Parallel registry for pause_started so reconnecting clients
-    // see active pauses even after the ring buffer has evicted the originating
-    // event. Cleared on pause_cleared.
-    pauseRegistry = new Map();
-    // [red-team #8] Pause debouncer with explicit cancellation handle.
-    // Buffers `pause_started` for PAUSE_MIN_DURATION_MS so a `pause_cleared`
-    // arriving inside the window cancels both events (no UI flicker).
-    pauseDebounce = new Map();
-    nextId = 1;
-    heartbeat = null;
-    start() {
-        if (this.heartbeat)
-            return;
-        this.heartbeat = setInterval(() => this.sendHeartbeat(), SSE_HEARTBEAT_MS);
-        if (typeof this.heartbeat.unref === "function")
-            this.heartbeat.unref();
-    }
-    stop() {
-        if (this.heartbeat)
-            clearInterval(this.heartbeat);
-        this.heartbeat = null;
-        for (const entry of this.pauseDebounce.values())
-            clearTimeout(entry.timer);
-        this.pauseDebounce.clear();
-        for (const c of this.clients) {
-            try {
-                c.end();
-            }
-            catch {
-                // ignore
-            }
-        }
-        this.clients.clear();
-    }
-    clientCount() {
-        return this.clients.size;
-    }
-    publish(event) {
-        // Pause debouncer: buffer pause_started for PAUSE_MIN_DURATION_MS.
-        // If pause_cleared arrives in the window, drop both. Otherwise emit on timer fire.
-        if (event.type === PAUSE_STARTED) {
-            const key = pauseKey(event);
-            // Cancel a prior buffered pause_started for the same key — a duplicate
-            // shouldn't double-emit; latest wins.
-            const prior = this.pauseDebounce.get(key);
-            if (prior)
-                clearTimeout(prior.timer);
-            const timer = setTimeout(() => {
-                this.pauseDebounce.delete(key);
-                this.publishImmediately(event);
-            }, PAUSE_MIN_DURATION_MS);
-            if (typeof timer.unref === "function")
-                timer.unref();
-            this.pauseDebounce.set(key, { timer, bufferedEvent: event });
-            return;
-        }
-        if (event.type === PAUSE_CLEARED) {
-            const key = pauseKey(event);
-            const pending = this.pauseDebounce.get(key);
-            if (pending) {
-                clearTimeout(pending.timer);
-                this.pauseDebounce.delete(key);
-                return; // sub-window pause cancelled — drop both events
-            }
-            // No exact-key match — fallback search by `${session}:${agent}:*` so a
-            // pause_cleared for permission_request (no toolUseId) still cancels
-            // any pending heuristic pause for the same agent.
-            const sessionAgentPrefix = key.replace(/:[^:]*$/, ":");
-            for (const [k, entry] of this.pauseDebounce) {
-                if (k.startsWith(sessionAgentPrefix)) {
-                    clearTimeout(entry.timer);
-                    this.pauseDebounce.delete(k);
-                    return;
-                }
-            }
-            // Otherwise fall through and publish pause_cleared normally.
-        }
-        this.publishImmediately(event);
-    }
-    publishImmediately(event) {
-        const id = this.nextId++;
-        const buffered = { id, event };
-        this.buffer.push(buffered);
-        if (this.buffer.length > MAX_SSE_BUFFER)
-            this.buffer.shift();
-        if (event.type === SPAWN_TYPE) {
-            const name = event.payload?.name ?? "unknown";
-            this.agentRegistry.set(`${event.sessionId ?? "_"}:${name}`, buffered);
-        }
-        if (event.type === PAUSE_STARTED || event.type === PAUSE_CLEARED) {
-            // [code-review fix] Align pauseRegistry key to pauseKey() so multiple
-            // pauses on the same (session, agent) but different toolUseIds don't
-            // collide. Two-part key would silently overwrite the older entry on
-            // a second concurrent pause, dropping it from reconnect replay.
-            const key = pauseKey(event);
-            if (event.type === PAUSE_STARTED) {
-                this.pauseRegistry.set(key, buffered);
-            }
-            else {
-                this.pauseRegistry.delete(key);
-                // Also clear any wildcard-toolUseId variant so a heuristic
-                // permission_request clear that omits toolUseId removes the entry
-                // previously written by the same heuristic pause_started.
-                const prefix = key.replace(/:[^:]*$/, ":");
-                for (const k of this.pauseRegistry.keys()) {
-                    if (k.startsWith(prefix))
-                        this.pauseRegistry.delete(k);
-                }
-            }
-        }
-        this.broadcast(id, event);
-    }
-    handle(req, res) {
-        if (this.clients.size >= MAX_SSE_CLIENTS) {
-            res.writeHead(503, { "Content-Type": "text/plain" });
-            res.end("Too many SSE clients");
-            return;
-        }
-        res.writeHead(200, {
-            "Content-Type": "text/event-stream",
-            "Cache-Control": "no-cache, no-transform",
-            Connection: "keep-alive",
-            "X-Accel-Buffering": "no",
-        });
-        res.write(": connected\n\n");
-        const lastIdHeader = req.headers["last-event-id"];
-        const lastId = typeof lastIdHeader === "string" ? parseInt(lastIdHeader, 10) || 0 : 0;
-        // Replay agent_spawn registry first so the client knows which agents exist
-        // before any tool_call_* / message events arrive that reference them. Skip
-        // any agent_spawn already inside the ring buffer (avoid duplicate).
-        const bufferedIds = new Set(this.buffer.map((b) => b.id));
-        for (const buffered of this.agentRegistry.values()) {
-            if (buffered.id > lastId && !bufferedIds.has(buffered.id)) {
-                this.writeOne(res, buffered.id, buffered.event);
-            }
-        }
-        // [red-team #6] Replay pause_started events whose pauses are still active.
-        for (const buffered of this.pauseRegistry.values()) {
-            if (buffered.id > lastId && !bufferedIds.has(buffered.id)) {
-                this.writeOne(res, buffered.id, buffered.event);
-            }
-        }
-        for (const buffered of this.buffer) {
-            if (buffered.id > lastId)
-                this.writeOne(res, buffered.id, buffered.event);
-        }
-        this.clients.add(res);
-        const cleanup = () => {
-            this.clients.delete(res);
-        };
-        req.on("close", cleanup);
-        req.on("error", cleanup);
-        res.on("error", cleanup);
-    }
-    broadcast(id, event) {
-        for (const res of this.clients) {
-            try {
-                const ok = this.writeOne(res, id, event);
-                if (!ok) {
-                    // Slow client; backpressure → drop further events for it but keep alive.
-                    continue;
-                }
-            }
-            catch {
-                this.clients.delete(res);
-                try {
-                    res.end();
-                }
-                catch {
-                    // ignore
-                }
-            }
-        }
-    }
-    writeOne(res, id, event) {
-        return res.write(`id: ${id}\ndata: ${JSON.stringify(event)}\n\n`);
-    }
-    sendHeartbeat() {
-        for (const res of this.clients) {
-            try {
-                res.write(": ping\n\n");
-            }
-            catch {
-                this.clients.delete(res);
-                try {
-                    res.end();
-                }
-                catch {
-                    // ignore
-                }
-            }
-        }
-    }
-}
-//# sourceMappingURL=sse-handler.js.map