nexus-agentd 0.2.3 → 0.2.6

package/dist/control-plane.js

@@ -188,7 +188,17 @@ export class AgentdControlPlane {
             if (!workspaceRoots.length) {
                 throw new ControlPlaneError(400, 'workspaceRoots must contain at least one path');
             }
-            await WorkspacePolicy.create(workspaceRoots);
+            const policy = await WorkspacePolicy.create(workspaceRoots);
+            for (const [id, agent] of Object.entries(this.config.agents)) {
+                if (agent.protocol === 'a2a' || !agent.workspace)
+                    continue;
+                try {
+                    await policy.resolve(agent.workspace);
+                }
+                catch {
+                    throw new ControlPlaneError(409, `Workspace change would exclude agent: ${id}`);
+                }
+            }
             const raw = await this.readRawConfig();
             raw.workspaceRoots = workspaceRoots;
             await this.persist(raw);

package/dist/index.d.ts

@@ -8,7 +8,7 @@ export declare function startAgentd(configPath: string): Promise<{
     sessions: SessionManager;
     runStore: RunStore;
     controlPlane: AgentdControlPlane;
-    close(): Promise<void>;
+    close: () => Promise<void>;
 }>;
 export declare function closeServer(server: Server, graceMs?: number): Promise<void>;
 export * from './config.js';

package/dist/index.js

@@ -16,17 +16,35 @@ export async function startAgentd(configPath) {
     sessions.startCleanup();
     const controlPlane = new AgentdControlPlane(absoluteConfigPath, config, sessions);
     const server = createAgentdServer(config, sessions, controlPlane);
-    await listen(server, config.listen.port, config.listen.host);
+    let closing;
+    const close = () => closing ??= (async () => {
+        const results = await Promise.allSettled([closeServer(server), sessions.shutdown()]);
+        await runStore.flush();
+        const failed = results.find((result) => result.status === 'rejected');
+        if (failed)
+            throw failed.reason;
+    })();
+    try {
+        await listen(server, config.listen.port, config.listen.host);
+    }
+    catch (error) {
+        await sessions.shutdown();
+        await runStore.flush();
+        throw error;
+    }
+    server.on('error', (error) => {
+        console.error(JSON.stringify({ level: 'error', event: 'server_failed', message: error.message }));
+        void close().catch((closeError) => {
+            console.error(JSON.stringify({ level: 'error', event: 'server_shutdown_failed', message: String(closeError) }));
+        });
+    });
     return {
         config,
         server,
         sessions,
         runStore,
         controlPlane,
-        async close() {
-            await Promise.all([closeServer(server), sessions.shutdown()]);
-            await runStore.flush();
-        }
+        close
     };
 }
 function listen(server, port, host) {

package/dist/run-store.d.ts

@@ -37,6 +37,11 @@ export declare class RunStore {
     list(query?: RunListQuery): {
         runs: AgentdRunView[];
         total: number;
+        stats: {
+            active: number;
+            completed: number;
+            failed: number;
+        };
     };
     flush(): Promise<void>;
     private load;

package/dist/run-store.js

@@ -144,8 +144,17 @@ export class RunStore {
             run.agentName.toLowerCase().includes(needle) ||
             run.id.toLowerCase().includes(needle));
         const total = matched.length;
+        const stats = { active: 0, completed: 0, failed: 0 };
+        for (const run of matched) {
+            if (isActive(run.state))
+                stats.active++;
+            if (run.state === 'completed')
+                stats.completed++;
+            if (run.state === 'failed')
+                stats.failed++;
+        }
         const runs = matched.slice(0, limit).map(publicView);
-        return { runs, total };
+        return { runs, total, stats };
     }
     async flush() {
         this.assertInitialized();

package/dist/server.js

@@ -3,7 +3,7 @@ import http from 'node:http';
 import { AdminSessionStore } from './auth.js';
 import { ControlPlaneError } from './control-plane.js';
 import { RunNotFoundError, SessionNotFoundError, SessionRequestError } from './session.js';
-import { redirectToAgentdWebUi, writeAgentdWebUi } from './webui/index.js';
+import { redirectToAgentdWebUi, writeAgentdWebUi, writeAgentdWebUiModule } from './webui/index.js';
 const ADMIN_COOKIE = 'agent_nexus_admin';
 export function createAgentdServer(config, sessions, controlPlane) {
     const adminSessions = new AdminSessionStore(config.adminSessionTtlMs || 12 * 60 * 60 * 1000);
@@ -72,6 +72,10 @@ async function handleRequest(context) {
         writeAgentdWebUi(response);
         return;
     }
+    if (url.pathname.startsWith('/ui/') && request.method === 'GET') {
+        writeAgentdWebUiModule(response, url.pathname);
+        return;
+    }
     if (url.pathname === '/health' && request.method === 'GET') {
         writeJson(response, 200, {
             ok: true,
@@ -220,8 +224,13 @@ async function handleRequest(context) {
         assertAgentScope(principal, session.agentId);
         assertJsonContentType(request);
         const body = await readJsonBody(request, config.maxRequestBytes);
-        assertOnlyKeys(body, ['path']);
-        writeJson(response, 201, await sessions.publishFile(sessionId, requiredString(body.path, 'path')));
+        assertOnlyKeys(body, ['path', 'paths']);
+        const paths = normalizePublishPaths(body);
+        const result = await sessions.publishFile(sessionId, paths);
+        writeJson(response, 201, {
+            ...result.session,
+            publishedArtifacts: result.artifacts
+        });
         return;
     }
     const match = url.pathname.match(/^\/v1\/sessions\/([^/]+)(?:\/(message|cancel|events))?$/);
@@ -456,11 +465,12 @@ function streamEvents(request, response, sessions, sessionId, after, release) {
     for (const event of sessions.eventsAfter(sessionId, after))
         writeEvent(response, event);
     const unsubscribe = sessions.subscribe(sessionId, (event) => writeEvent(response, event));
-    const heartbeat = setInterval(() => {
-        if (!response.destroyed && !response.writableEnded)
-            response.write(': heartbeat\n\n');
-    }, 15_000);
-    heartbeat.unref?.();
+    // Give idle SSE clients ~90 s to react before Node's default socket timeout
+    // trips. Combined with the writableEnded check inside the heartbeat this
+    // guarantees stuck keep-alive sessions eventually release their slot even
+    // if the peer never sends a FIN.
+    const idleMs = 90_000;
+    request.socket.setTimeout?.(idleMs);
     let closed = false;
     const close = () => {
         if (closed)
@@ -468,10 +478,37 @@ function streamEvents(request, response, sessions, sessionId, after, release) {
         closed = true;
         clearInterval(heartbeat);
         unsubscribe();
+        // Ensure both ends of the socket are actually torn down so the SSE
+        // slot returns to the pool even when the peer stops reading without
+        // closing the TCP connection cleanly.
+        try {
+            if (!response.writableEnded)
+                response.end();
+        }
+        catch { }
+        try {
+            request.socket.destroy();
+        }
+        catch { }
         release();
     };
+    const heartbeat = setInterval(() => {
+        if (response.destroyed || response.writableEnded) {
+            close();
+            return;
+        }
+        try {
+            response.write(': heartbeat\n\n');
+        }
+        catch {
+            close();
+        }
+    }, 15_000);
+    heartbeat.unref?.();
     request.once('close', close);
     response.once('close', close);
+    request.socket.once('timeout', close);
+    request.socket.once('error', close);
 }
 function writeEvent(response, event) {
     if (response.destroyed || response.writableEnded)
@@ -644,6 +681,19 @@ function optionalAttachmentIds(value) {
     }
     return value.map((item) => requiredString(item, 'attachments'));
 }
+function normalizePublishPaths(body) {
+    const bodyPaths = body.paths;
+    if (bodyPaths !== undefined) {
+        if (!Array.isArray(bodyPaths) || bodyPaths.length === 0) {
+            throw new RequestError(400, 'paths must be a non-empty array of strings');
+        }
+        if (bodyPaths.length > 32) {
+            throw new RequestError(400, 'paths accepts at most 32 entries');
+        }
+        return bodyPaths.map((item) => requiredString(item, 'paths'));
+    }
+    return [requiredString(body.path, 'path')];
+}
 function normalizedMediaType(value) {
     const mediaType = stringHeader(value).split(';', 1)[0].trim().toLowerCase();
     return mediaType || undefined;

package/dist/session-contract.d.ts

@@ -18,6 +18,7 @@ export interface AcpSessionSink extends AgentSessionSink {
     setAcpSessionId(id: string): void;
 }
 export interface AgentSessionRuntime {
+    isAvailable?(): boolean;
     start(workspace?: string): Promise<void>;
     prompt(message: string, attachments?: AgentdInputAttachment[]): Promise<void>;
     respondPending(response: AgentdPendingResponse | string, attachments?: AgentdInputAttachment[]): Promise<void>;

package/dist/session.d.ts

@@ -3,7 +3,7 @@ import { SessionEventLog } from './events.js';
 import { RunStore, type RunListQuery } from './run-store.js';
 import type { AcpSessionSink, AgentSessionRuntime, AgentSessionSink } from './session-contract.js';
 import type { AgentdAgentView, AgentdArtifact, AgentdConfig, AgentdEvent, AgentdEventType, AgentdInputAttachmentView, AgentdPendingRequest, AgentdPendingResponse, AgentdProtocol, AgentdSessionState, AgentdSessionView, AgentdTurnCompletionProof } from './types.js';
-import type { WorkspacePolicy } from './workspace.js';
+import { type WorkspacePolicy } from './workspace.js';
 export declare class ManagedSession implements AgentSessionSink, AcpSessionSink {
     readonly agentId: string;
     readonly protocol: AgentdProtocol;
@@ -37,6 +37,8 @@ export declare class ManagedSession implements AgentSessionSink, AcpSessionSink
     replaceOutput(text: string): void;
     addArtifact(artifact: AgentdArtifact): void;
     publishFile(filePath: string): Promise<AgentdArtifact>;
+    publishFiles(filePaths: string[]): Promise<AgentdArtifact[]>;
+    private publishSingleFile;
     setPending(request: AgentdPendingRequest): void;
     clearPending(): void;
     emit(type: AgentdEventType, data?: unknown): void;
@@ -58,6 +60,7 @@ export declare class SessionManager {
     private readonly runStore?;
     readonly instanceId: `${string}-${string}-${string}-${string}-${string}`;
     private sessions;
+    private sessionLocks;
     private cleanupTimer?;
     private readinessCache?;
     constructor(config: AgentdConfig, workspacePolicy: WorkspacePolicy, drivers: Map<string, AgentDriver>, runStore?: RunStore | undefined);
@@ -71,17 +74,26 @@ export declare class SessionManager {
     listRuns(query?: RunListQuery): {
         runs: import("./types.js").AgentdRunView[];
         total: number;
+        stats: {
+            active: number;
+            completed: number;
+            failed: number;
+        };
     };
     getRun(id: string): import("./types.js").AgentdRunDetail;
     message(id: string, message: string, attachmentIds?: string[]): Promise<AgentdSessionView>;
     resolvePending(id: string, response: AgentdPendingResponse, attachmentIds?: string[]): Promise<AgentdSessionView>;
     addInputAttachment(id: string, name: string, mediaType: string | undefined, bytes: Buffer): AgentdInputAttachmentView;
-    publishFile(id: string, path: string): Promise<AgentdSessionView>;
+    publishFile(id: string, paths: string[]): Promise<{
+        session: AgentdSessionView;
+        artifacts: AgentdArtifact[];
+    }>;
     cancel(id: string): Promise<AgentdSessionView>;
     close(id: string): Promise<AgentdSessionView>;
     eventsAfter(id: string, after?: string): AgentdEvent[];
     subscribe(id: string, listener: (event: AgentdEvent) => void): () => boolean;
     shutdown(): Promise<void>;
+    private withSessionLock;
     private require;
     private ensureCapacity;
     private cleanup;

package/dist/session.js

@@ -1,9 +1,10 @@
 import { randomUUID } from 'node:crypto';
-import { open, realpath } from 'node:fs/promises';
-import { basename, extname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { realpath } from 'node:fs/promises';
+import { extname } from 'node:path';
 import { AcpProcessRuntime } from './acp/runtime.js';
 import { A2AClientRuntime, probeA2AAgent } from './a2a/runtime.js';
 import { SessionEventLog } from './events.js';
+import { ContainedReadError, readContainedFile } from './workspace.js';
 const MAX_SESSION_ARTIFACTS = 64;
 const MAX_ARTIFACT_BASE64_CHARS = 16 * 1024 * 1024;
 const MAX_SESSION_BASE64_CHARS = 32 * 1024 * 1024;
@@ -167,47 +168,47 @@ export class ManagedSession {
         });
     }
     async publishFile(filePath) {
-        const requestedPath = String(filePath || '').trim();
-        if (!requestedPath) {
+        return (await this.publishFiles([filePath]))[0];
+    }
+    async publishFiles(filePaths) {
+        const requested = filePaths
+            .map((value) => String(value || '').trim())
+            .filter(Boolean);
+        if (!requested.length) {
             throw new SessionRequestError(400, 'path is required');
         }
+        if (requested.length > 32) {
+            throw new SessionRequestError(400, 'A single publish request accepts at most 32 files');
+        }
         if (!this.workspace) {
             throw new SessionRequestError(400, 'This session does not have a local workspace');
         }
-        let handle;
+        const seen = new Set();
+        const artifacts = [];
+        for (const requestedPath of requested) {
+            if (seen.has(requestedPath))
+                continue;
+            seen.add(requestedPath);
+            artifacts.push(await this.publishSingleFile(requestedPath));
+        }
+        return artifacts;
+    }
+    async publishSingleFile(requestedPath) {
         try {
             const workspaceRoot = await realpath(this.workspace);
-            const unresolved = resolve(workspaceRoot, requestedPath);
-            const target = await realpath(unresolved);
-            assertWorkspacePath(workspaceRoot, target);
-            handle = await open(target, 'r');
-            // Resolve again after opening so a swapped symlink cannot silently
-            // redirect a publish request outside the configured workspace.
-            const verifiedTarget = await realpath(unresolved);
-            assertWorkspacePath(workspaceRoot, verifiedTarget);
-            if (verifiedTarget !== target) {
-                throw new SessionRequestError(409, 'Published file changed while it was being opened');
-            }
-            const stats = await handle.stat();
-            if (!stats.isFile()) {
-                throw new SessionRequestError(400, 'Only regular files can be published');
-            }
-            if (stats.size > MAX_PUBLISHED_FILE_BYTES) {
-                throw new SessionRequestError(413, `Published file exceeds the ${MAX_PUBLISHED_FILE_BYTES} byte limit`);
-            }
-            const bytes = await handle.readFile();
-            const filename = basename(verifiedTarget);
-            const workspacePath = relative(workspaceRoot, verifiedTarget).split(sep).join('/');
+            const file = await readContainedFile([workspaceRoot], requestedPath, {
+                maxBytes: MAX_PUBLISHED_FILE_BYTES
+            });
             const artifact = {
                 id: `published:${randomUUID()}`,
-                name: filename,
-                filename,
-                mediaType: mediaTypeForPath(filename),
-                bytesBase64: bytes.toString('base64'),
+                name: file.filename,
+                filename: file.filename,
+                mediaType: mediaTypeForPath(file.filename),
+                bytesBase64: file.bytes.toString('base64'),
                 metadata: {
                     source: 'workspace_publish',
-                    path: workspacePath,
-                    size: bytes.length
+                    path: file.relative,
+                    size: file.size
                 }
             };
             this.addArtifact(artifact);
@@ -217,6 +218,8 @@ export class ManagedSession {
         catch (error) {
             if (error instanceof SessionRequestError)
                 throw error;
+            if (error instanceof ContainedReadError)
+                throw publishFailure(error);
             const code = error?.code;
             if (code === 'ENOENT') {
                 throw new SessionRequestError(404, 'Published file was not found');
@@ -226,9 +229,6 @@ export class ManagedSession {
             }
             throw error;
         }
-        finally {
-            await handle?.close();
-        }
     }
     setPending(request) {
         this.completion = undefined;
@@ -278,7 +278,7 @@ export class ManagedSession {
         return attachmentView(attachment);
     }
     async message(message, attachmentIds = []) {
-        if (!this.runtime)
+        if (!this.runtime || this.runtime.isAvailable?.() === false)
             throw new SessionRequestError(409, 'Agent runtime is unavailable');
         const attachments = this.inputAttachmentsFor(attachmentIds);
         if (this.pendingRequest) {
@@ -307,13 +307,14 @@ export class ManagedSession {
             task: message,
             inputAttachmentCount: attachments.length
         }).id;
+        this.setState('running');
         void this.runtime.prompt(message, attachments).catch((error) => {
             if (this.state !== 'canceled')
                 this.setState('failed', errorMessage(error));
         });
     }
     async resolvePending(response, attachmentIds = []) {
-        if (!this.runtime) {
+        if (!this.runtime || this.runtime.isAvailable?.() === false) {
             throw new SessionRequestError(409, 'Agent runtime is unavailable');
         }
         const pending = this.pendingRequest;
@@ -330,11 +331,31 @@ export class ManagedSession {
         await this.runtime.respondPending(response, attachments);
     }
     async cancel() {
-        await this.runtime?.cancel();
+        const runtime = this.runtime;
+        this.runtime = undefined;
+        this.clearPending();
+        this.setState('canceled');
+        try {
+            await runtime?.cancel();
+        }
+        finally {
+            try {
+                await runtime?.dispose();
+            }
+            finally {
+                this.inputAttachments.clear();
+            }
+        }
     }
     async dispose() {
-        await this.runtime?.dispose();
-        this.inputAttachments.clear();
+        const runtime = this.runtime;
+        this.runtime = undefined;
+        try {
+            await runtime?.dispose();
+        }
+        finally {
+            this.inputAttachments.clear();
+        }
     }
     snapshot() {
         return {
@@ -399,6 +420,7 @@ export class SessionManager {
     runStore;
     instanceId = randomUUID();
     sessions = new Map();
+    sessionLocks = new Map();
     cleanupTimer;
     readinessCache;
     constructor(config, workspacePolicy, drivers, runStore) {
@@ -515,7 +537,7 @@ export class SessionManager {
         const session = new ManagedSession(agentId, config.protocol === 'a2a' ? 'a2a' : 'acp', workspace, ownerKeyId, this.config.maxEventsPerSession, this.config.maxOutputChars, config.name || agentId, this.runStore, this.instanceId);
         const runtime = config.protocol === 'a2a'
             ? new A2AClientRuntime(config, session, this.config.promptTimeoutMs || 30 * 60_000)
-            : new AcpProcessRuntime(driver, session, this.config.maxOutputChars, this.config.promptTimeoutMs || 30 * 60_000);
+            : new AcpProcessRuntime(driver, session, this.config.maxOutputChars, this.config.promptTimeoutMs || 30 * 60_000, this.workspacePolicy.listRoots());
         this.sessions.set(session.id, session);
         session.attach(runtime);
         try {
@@ -524,8 +546,15 @@ export class SessionManager {
         }
         catch (error) {
             session.setState('failed', errorMessage(error));
-            await session.dispose();
-            this.sessions.delete(session.id);
+            try {
+                await session.dispose();
+            }
+            catch (cleanupError) {
+                console.error(JSON.stringify({ level: 'error', event: 'session_start_cleanup_failed', sessionId: session.id, message: errorMessage(cleanupError) }));
+            }
+            finally {
+                this.sessions.delete(session.id);
+            }
             throw new SessionRequestError(502, `Agent failed to start: ${errorMessage(error)}`);
         }
     }
@@ -539,7 +568,7 @@ export class SessionManager {
         return this.sessions.size;
     }
     listRuns(query = {}) {
-        return this.runStore?.list(query) || { runs: [], total: 0 };
+        return this.runStore?.list(query) || { runs: [], total: 0, stats: { active: 0, completed: 0, failed: 0 } };
     }
     getRun(id) {
         const run = this.runStore?.get(id);
@@ -551,37 +580,47 @@ export class SessionManager {
         const text = String(message || '');
         if (!text.trim())
             throw new SessionRequestError(400, 'message is required');
-        const session = this.require(id);
-        await session.message(text, attachmentIds);
-        return session.snapshot();
+        return this.withSessionLock(id, async () => {
+            const session = this.require(id);
+            await session.message(text, attachmentIds);
+            return session.snapshot();
+        });
     }
     async resolvePending(id, response, attachmentIds = []) {
-        const session = this.require(id);
-        await session.resolvePending(response, attachmentIds);
-        return session.snapshot();
+        return this.withSessionLock(id, async () => {
+            const session = this.require(id);
+            await session.resolvePending(response, attachmentIds);
+            return session.snapshot();
+        });
     }
     addInputAttachment(id, name, mediaType, bytes) {
         const session = this.require(id);
         return session.addInputAttachment(name, mediaType, bytes);
     }
-    async publishFile(id, path) {
-        const session = this.require(id);
-        await session.publishFile(path);
-        return session.snapshot();
+    async publishFile(id, paths) {
+        return this.withSessionLock(id, async () => {
+            const session = this.require(id);
+            const artifacts = await session.publishFiles(paths);
+            return { session: session.snapshot(), artifacts };
+        });
     }
     async cancel(id) {
-        const session = this.require(id);
-        await session.cancel();
-        return session.snapshot();
+        return this.withSessionLock(id, async () => {
+            const session = this.require(id);
+            await session.cancel();
+            return session.snapshot();
+        });
     }
     async close(id) {
-        const session = this.require(id);
-        if (isActive(session.state))
-            await session.cancel();
-        const snapshot = session.snapshot();
-        await session.dispose();
-        this.sessions.delete(id);
-        return snapshot;
+        return this.withSessionLock(id, async () => {
+            const session = this.require(id);
+            if (isActive(session.state))
+                await session.cancel();
+            const snapshot = session.snapshot();
+            await session.dispose();
+            this.sessions.delete(id);
+            return snapshot;
+        });
     }
     eventsAfter(id, after) {
         return this.require(id).events.after(after);
@@ -599,6 +638,28 @@ export class SessionManager {
         }));
         this.sessions.clear();
     }
+    async withSessionLock(id, operation) {
+        // Serialise mutating operations per session so that concurrent
+        // message / resolvePending / cancel / close / publish requests cannot
+        // observe half-updated state (e.g. artifacts reset in the middle of
+        // publishFile).
+        const previous = this.sessionLocks.get(id) || Promise.resolve();
+        let release;
+        const gate = new Promise((resolve) => {
+            release = resolve;
+        });
+        const tail = previous.then(() => gate);
+        this.sessionLocks.set(id, tail);
+        try {
+            await previous;
+            return await operation();
+        }
+        finally {
+            release();
+            if (this.sessionLocks.get(id) === tail)
+                this.sessionLocks.delete(id);
+        }
+    }
     require(id) {
         const session = this.sessions.get(id);
         if (!session)
@@ -626,17 +687,29 @@ export class SessionManager {
         for (const [id, session] of this.sessions) {
             if (session.updatedAt > cutoff)
                 continue;
-            if (!isTerminal(session.state)) {
-                session.setState('failed', 'Session expired after exceeding its lifetime');
-            }
-            await session.dispose();
-            this.sessions.delete(id);
+            await this.withSessionLock(id, async () => {
+                if (this.sessions.get(id) !== session || session.updatedAt > cutoff)
+                    return;
+                if (!isTerminal(session.state))
+                    session.setState('failed', 'Session expired after exceeding its lifetime');
+                try {
+                    await session.dispose();
+                }
+                catch (error) {
+                    console.error(JSON.stringify({ level: 'error', event: 'session_cleanup_failed', sessionId: id, message: errorMessage(error) }));
+                }
+                finally {
+                    this.sessions.delete(id);
+                }
+            });
         }
     }
     restartCleanup() {
         if (this.cleanupTimer)
             clearInterval(this.cleanupTimer);
-        this.cleanupTimer = setInterval(() => void this.cleanup(), this.config.cleanupIntervalMs || 60_000);
+        this.cleanupTimer = setInterval(() => void this.cleanup().catch((error) => {
+            console.error(JSON.stringify({ level: 'error', event: 'session_cleanup_failed', message: errorMessage(error) }));
+        }), this.config.cleanupIntervalMs || 60_000);
         this.cleanupTimer.unref?.();
     }
     defaultWorkspace(agentId) {
@@ -694,10 +767,16 @@ function runArtifact(artifact) {
         metadata: artifact.metadata ? structuredClone(artifact.metadata) : undefined
     };
 }
-function assertWorkspacePath(workspaceRoot, target) {
-    const child = relative(workspaceRoot, target);
-    if (child === '..' || child.startsWith(`..${sep}`) || isAbsolute(child)) {
-        throw new SessionRequestError(403, 'Published files must stay inside the session workspace');
+function publishFailure(error) {
+    switch (error.failure) {
+        case 'swapped':
+            return new SessionRequestError(409, 'Published file changed while it was being opened');
+        case 'not-a-file':
+            return new SessionRequestError(400, 'Only regular files can be published');
+        case 'too-large':
+            return new SessionRequestError(413, `Published file exceeds the ${MAX_PUBLISHED_FILE_BYTES} byte limit`);
+        case 'outside':
+            return new SessionRequestError(403, 'Published files must stay inside the session workspace');
     }
 }
 function mediaTypeForPath(path) {