night-orch 0.1.0

package/dist/web/server.js

@@ -0,0 +1,1185 @@
+import { createServer } from 'node:http';
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { readFile, stat } from 'node:fs/promises';
+import { extname, resolve, dirname, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { WebSocket, WebSocketServer } from 'ws';
+import { handleToolCall } from '../mcp/tools/index.js';
+import { handleResourceRead } from '../mcp/resources/index.js';
+import { loadTuiStats } from '../state/stats.js';
+import { getBuildInfo } from '../utils/build-info.js';
+import { logger } from '../utils/logger.js';
+import { sanitizeError } from '../utils/sanitize-error.js';
+import { nowUtcIso } from '../utils/time.js';
+import { listRuntimeSettings, resolveConfigWithRuntimeSettings, RuntimeSettingInputError, } from '../settings/runtime.js';
+import { getSettingDefinition, resolveSettingYamlValue } from '../settings/registry.js';
+const ONE_MEGABYTE = 1024 * 1024;
+const DEFAULT_SNAPSHOT_INTERVAL_MS = 3000;
+const MUTATION_INTENT_HEADER = 'x-night-orch-intent';
+const MUTATION_INTENT_VALUE = 'mutate';
+const WEB_AUTH_TOKEN_HEADER = 'x-night-orch-web-token';
+const BUILD_INFO = getBuildInfo();
+const CONTENT_TYPES = {
+    '.css': 'text/css; charset=utf-8',
+    '.html': 'text/html; charset=utf-8',
+    '.ico': 'image/x-icon',
+    '.jpeg': 'image/jpeg',
+    '.jpg': 'image/jpeg',
+    '.js': 'text/javascript; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.map': 'application/json; charset=utf-8',
+    '.png': 'image/png',
+    '.svg': 'image/svg+xml; charset=utf-8',
+    '.txt': 'text/plain; charset=utf-8',
+    '.webmanifest': 'application/manifest+json; charset=utf-8',
+};
+export function resolveWebFrontendDistPath(explicitPath) {
+    if (explicitPath) {
+        return resolve(explicitPath);
+    }
+    const moduleDir = dirname(fileURLToPath(import.meta.url));
+    return resolve(moduleDir, '../../web/dist');
+}
+export async function startWebServer(deps, options) {
+    // Hard gate on non-loopback binds: the web server hands out a mutation
+    // token via `/api/session` to any same-origin caller and offers
+    // destructive endpoints (retry/cleanup/sync/etc) under that token. When
+    // bound to a non-loopback address, require an operator-supplied auth
+    // token env (`NIGHT_ORCH_WEB_AUTH_TOKEN`) so any single-origin XSS or
+    // local process cannot trivially escalate to full write access.
+    const bindHostName = normalizeHostname(options.host) ?? options.host;
+    const isLoopbackBind = bindHostName === '127.0.0.1'
+        || bindHostName === '::1'
+        || bindHostName === 'localhost'
+        || bindHostName === '';
+    if (!isLoopbackBind && !process.env['NIGHT_ORCH_WEB_AUTH_TOKEN']) {
+        throw new Error(`night-orch web refuses to bind to non-loopback host "${options.host}" without NIGHT_ORCH_WEB_AUTH_TOKEN set. `
+            + 'Either bind to 127.0.0.1 / ::1 or provide an out-of-band auth token via that env var.');
+    }
+    const security = createWebSecurityContext(deps, options);
+    const operationsEnabled = options.operationsEnabled ?? true;
+    const frontendDistPath = resolveWebFrontendDistPath(options.frontendDistPath);
+    const hasFrontendAssets = existsSync(resolve(frontendDistPath, 'index.html'));
+    if (!hasFrontendAssets) {
+        logger.warn({ frontendDistPath }, 'Web frontend assets not found. Build with `pnpm web:build` before starting `night-orch web`.');
+    }
+    const wsServer = new WebSocketServer({ noServer: true });
+    const clients = new Map();
+    const httpServer = createServer(async (req, res) => {
+        try {
+            const requestUrl = getRequestUrl(req);
+            if (requestUrl.pathname.startsWith('/api/')) {
+                if (!isAllowedRequestHost(req, security)) {
+                    writeJson(res, 403, { error: 'Forbidden host' });
+                    return;
+                }
+                await handleApiRequest(req, res, requestUrl, deps, security, operationsEnabled, options.rawConfig);
+                return;
+            }
+            if (requestUrl.pathname === '/ws') {
+                writeJson(res, 426, { error: 'Upgrade Required' });
+                return;
+            }
+            await serveFrontend(req, res, requestUrl.pathname, frontendDistPath, hasFrontendAssets);
+        }
+        catch (err) {
+            if (res.headersSent) {
+                return;
+            }
+            const sanitized = sanitizeError(err);
+            const status = isClientRequestError(sanitized.message)
+                ? 400
+                : isAuthorizationError(sanitized.message)
+                    ? 403
+                    : 500;
+            if (status >= 500) {
+                logger.warn({ err: sanitized }, 'Web request failed');
+            }
+            writeJson(res, status, { error: sanitized.message });
+        }
+    });
+    httpServer.on('upgrade', (req, socket, head) => {
+        let requestUrl;
+        try {
+            requestUrl = getRequestUrl(req);
+        }
+        catch {
+            rejectUpgrade(socket, 400, 'Bad Request');
+            return;
+        }
+        if (requestUrl.pathname !== '/ws') {
+            socket.destroy();
+            return;
+        }
+        if (!isAllowedRequestHost(req, security)) {
+            rejectUpgrade(socket, 403, 'Forbidden');
+            return;
+        }
+        if (!hasAllowedOrigin(req, security, false)) {
+            rejectUpgrade(socket, 403, 'Forbidden');
+            return;
+        }
+        wsServer.handleUpgrade(req, socket, head, (ws) => {
+            wsServer.emit('connection', ws);
+        });
+    });
+    wsServer.on('connection', (ws) => {
+        const state = { runSubscriptions: new Map() };
+        clients.set(ws, state);
+        sendWebsocket(ws, {
+            type: 'connected',
+            payload: { timestamp: nowUtcIso() },
+        });
+        ws.on('message', (raw) => {
+            const decoded = decodeWsMessage(raw);
+            if (decoded === null) {
+                sendWebsocket(ws, { type: 'error', error: 'Unsupported websocket payload type' });
+                return;
+            }
+            void handleWsMessage(ws, state, decoded, deps);
+        });
+        ws.on('close', () => {
+            clients.delete(ws);
+        });
+    });
+    const snapshotIntervalMs = Math.max(1000, Math.floor(options.snapshotIntervalMs ?? DEFAULT_SNAPSHOT_INTERVAL_MS));
+    let tickInFlight = false;
+    const publishTick = async () => {
+        if (tickInFlight)
+            return;
+        tickInFlight = true;
+        try {
+            const snapshot = await buildDashboardSnapshot(deps);
+            const snapshotMessage = JSON.stringify({ type: 'snapshot', payload: snapshot });
+            for (const ws of clients.keys()) {
+                if (ws.readyState !== WebSocket.OPEN)
+                    continue;
+                ws.send(snapshotMessage);
+            }
+            for (const [ws, state] of clients.entries()) {
+                if (ws.readyState !== WebSocket.OPEN)
+                    continue;
+                await publishRunSubscriptions(ws, state, deps);
+            }
+        }
+        catch (err) {
+            logger.warn({ err }, 'Failed to publish websocket snapshot tick');
+        }
+        finally {
+            tickInFlight = false;
+        }
+    };
+    const interval = setInterval(() => {
+        void publishTick();
+    }, snapshotIntervalMs);
+    interval.unref();
+    httpServer.on('close', () => {
+        clearInterval(interval);
+        for (const ws of wsServer.clients) {
+            ws.close();
+        }
+        wsServer.close();
+    });
+    await new Promise((resolveStart, rejectStart) => {
+        httpServer.once('error', rejectStart);
+        httpServer.listen(options.port, options.host, () => {
+            httpServer.off('error', rejectStart);
+            logger.info({ host: options.host, port: options.port }, 'Web server started');
+            resolveStart();
+        });
+    });
+    await publishTick();
+    return httpServer;
+}
+async function handleApiRequest(req, res, requestUrl, deps, security, operationsEnabled, rawConfig) {
+    const method = req.method ?? 'GET';
+    const { pathname, searchParams } = requestUrl;
+    const runtimeDeps = {
+        ...deps,
+        config: resolveConfigWithRuntimeSettings(deps.config, deps.db),
+    };
+    if (method === 'POST' && pathname.startsWith('/api/operations/')) {
+        // Update is a supervisor operation — always allowed regardless of attach/standalone mode
+        if (!operationsEnabled && pathname !== '/api/operations/update') {
+            writeJson(res, 409, { error: 'Web operations are disabled by server policy.' });
+            return;
+        }
+        const guardFailure = validateMutationRequest(req, security);
+        if (guardFailure) {
+            writeJson(res, guardFailure.statusCode, { error: guardFailure.error });
+            return;
+        }
+    }
+    if (method === 'GET' && pathname === '/api/health') {
+        writeJson(res, 200, { status: 'ok', now: nowUtcIso() });
+        return;
+    }
+    if (method === 'GET' && pathname === '/api/dashboard') {
+        const snapshot = await buildDashboardSnapshot(runtimeDeps);
+        writeJson(res, 200, snapshot);
+        return;
+    }
+    if (method === 'GET' && pathname === '/api/projects') {
+        const snapshot = buildProjectsSnapshot(runtimeDeps);
+        writeJson(res, 200, snapshot);
+        return;
+    }
+    if (method === 'GET' && pathname === '/api/settings') {
+        const snapshot = buildSettingsSnapshot(deps, rawConfig);
+        writeJson(res, 200, snapshot);
+        return;
+    }
+    if (method === 'GET' && pathname === '/api/session') {
+        // When the server is bound to a non-loopback address with an operator-
+        // supplied auth token, we must NOT hand it out via HTTP — the client
+        // must provide it out-of-band. For loopback, disclosure is low-risk.
+        writeJson(res, 200, {
+            mutationToken: security.operatorAuthMode ? null : security.webMutationToken,
+            operationsEnabled,
+            requiresExternalAuth: security.operatorAuthMode,
+        });
+        return;
+    }
+    if (method === 'GET' && pathname === '/api/status') {
+        const repo = searchParams.get('repo') ?? undefined;
+        const result = await handleToolCall('night-orch-status', { repo }, runtimeDeps);
+        writeJson(res, 200, result);
+        return;
+    }
+    if (method === 'GET' && pathname === '/api/runs') {
+        const repo = searchParams.get('repo') ?? undefined;
+        const status = searchParams.get('status') ?? undefined;
+        const limit = toBoundedInt(searchParams.get('limit'), 50, 1, 500);
+        const result = await handleToolCall('night-orch-list-runs', { repo, status, limit }, runtimeDeps);
+        writeJson(res, 200, result);
+        return;
+    }
+    if (method === 'GET' && pathname === '/api/cost') {
+        const days = toBoundedInt(searchParams.get('days'), 7, 1, 30);
+        const result = await handleToolCall('night-orch-cost-report', { days }, runtimeDeps);
+        writeJson(res, 200, result);
+        return;
+    }
+    if (method === 'GET' && pathname === '/api/stats') {
+        writeJson(res, 200, loadTuiStats(runtimeDeps.db, { costModel: runtimeDeps.config.cost.model }));
+        return;
+    }
+    if (method === 'GET' && pathname === '/api/config') {
+        const result = await handleResourceRead('night-orch://config', runtimeDeps);
+        writeJson(res, 200, result);
+        return;
+    }
+    if (method === 'GET') {
+        const runDetailMatch = pathname.match(/^\/api\/runs\/([^/]+)$/);
+        if (runDetailMatch) {
+            const runId = decodeURIComponent(runDetailMatch[1] ?? '');
+            const result = await handleToolCall('night-orch-run-detail', { runId }, runtimeDeps);
+            writeJson(res, 200, result);
+            return;
+        }
+        const runEventsMatch = pathname.match(/^\/api\/runs\/([^/]+)\/events$/);
+        if (runEventsMatch) {
+            const runId = decodeURIComponent(runEventsMatch[1] ?? '');
+            const since = toBoundedInt(searchParams.get('since'), 0, 0, Number.MAX_SAFE_INTEGER);
+            const limit = toBoundedInt(searchParams.get('limit'), 100, 1, 200);
+            const result = await handleToolCall('night-orch-stream-events', { runId, since, limit }, runtimeDeps);
+            writeJson(res, 200, result);
+            return;
+        }
+        const repoIssuesMatch = pathname.match(/^\/api\/repos\/([^/]+)\/issues$/);
+        if (repoIssuesMatch) {
+            const repo = decodeURIComponent(repoIssuesMatch[1] ?? '');
+            const filter = searchParams.get('filter') ?? 'all';
+            const result = await handleToolCall('night-orch-list-issues', { repo, filter }, runtimeDeps);
+            writeJson(res, 200, result);
+            return;
+        }
+    }
+    if (method === 'POST' && pathname === '/api/operations/poll') {
+        const body = await readJsonBody(req);
+        const result = await handleToolCall('night-orch-poll', withMcpMutationAuth({ dryRun: Boolean(body['dryRun']) }, security), runtimeDeps);
+        writeJson(res, 200, result);
+        return;
+    }
+    if (method === 'POST' && pathname === '/api/operations/sync') {
+        const body = await readJsonBody(req);
+        const result = await handleToolCall('night-orch-sync', withMcpMutationAuth({ dryRun: Boolean(body['dryRun']) }, security), runtimeDeps);
+        writeJson(res, 200, result);
+        return;
+    }
+    if (method === 'POST' && pathname === '/api/operations/cleanup') {
+        const body = await readJsonBody(req);
+        const result = await handleToolCall('night-orch-cleanup', withMcpMutationAuth({ dryRun: Boolean(body['dryRun']) }, security), runtimeDeps);
+        writeJson(res, 200, result);
+        return;
+    }
+    if (method === 'POST' && pathname === '/api/operations/labels-init') {
+        const body = await readJsonBody(req);
+        const repo = toNonEmptyString(body['repo']);
+        if (!repo) {
+            writeJson(res, 400, { error: 'repo is required' });
+            return;
+        }
+        const result = await handleToolCall('night-orch-labels-init', withMcpMutationAuth({
+            repo,
+            dryRun: Boolean(body['dryRun']),
+        }, security), runtimeDeps);
+        writeJson(res, 200, result);
+        return;
+    }
+    if (method === 'POST' && pathname === '/api/operations/retry') {
+        const body = await readJsonBody(req);
+        const repo = toNonEmptyString(body['repo']);
+        const issueNumber = toBoundedInt(body['issueNumber'], NaN, 1, Number.MAX_SAFE_INTEGER);
+        if (!repo || Number.isNaN(issueNumber)) {
+            writeJson(res, 400, { error: 'repo and issueNumber are required' });
+            return;
+        }
+        const result = await handleToolCall('night-orch-retry', withMcpMutationAuth({
+            repo,
+            issueNumber,
+            resetPlan: Boolean(body['resetPlan']),
+            fresh: Boolean(body['fresh']),
+        }, security), runtimeDeps);
+        writeJson(res, 200, result);
+        return;
+    }
+    if (method === 'POST' && pathname === '/api/operations/rebase') {
+        const body = await readJsonBody(req);
+        const repo = toNonEmptyString(body['repo']);
+        const issueNumber = toBoundedInt(body['issueNumber'], NaN, 1, Number.MAX_SAFE_INTEGER);
+        if (!repo || Number.isNaN(issueNumber)) {
+            writeJson(res, 400, { error: 'repo and issueNumber are required' });
+            return;
+        }
+        const result = await handleToolCall('night-orch-rebase', withMcpMutationAuth({
+            repo,
+            issueNumber,
+            check: body['check'] === undefined ? true : Boolean(body['check']),
+        }, security), runtimeDeps);
+        writeJson(res, 200, result);
+        return;
+    }
+    if (method === 'POST' && pathname === '/api/operations/continue') {
+        const body = await readJsonBody(req);
+        const repo = toNonEmptyString(body['repo']);
+        const issueNumber = toBoundedInt(body['issueNumber'], NaN, 1, Number.MAX_SAFE_INTEGER);
+        if (!repo || Number.isNaN(issueNumber)) {
+            writeJson(res, 400, { error: 'repo and issueNumber are required' });
+            return;
+        }
+        const result = await handleToolCall('night-orch-continue', withMcpMutationAuth({
+            repo,
+            issueNumber,
+        }, security), runtimeDeps);
+        writeJson(res, 200, result);
+        return;
+    }
+    if (method === 'POST' && pathname === '/api/operations/delete-entry') {
+        const body = await readJsonBody(req);
+        const repo = toNonEmptyString(body['repo']);
+        const issueNumber = toBoundedInt(body['issueNumber'], NaN, 1, Number.MAX_SAFE_INTEGER);
+        if (!repo || Number.isNaN(issueNumber)) {
+            writeJson(res, 400, { error: 'repo and issueNumber are required' });
+            return;
+        }
+        const result = await handleToolCall('night-orch-delete-entry', withMcpMutationAuth({
+            repo,
+            issueNumber,
+            force: Boolean(body['force']),
+            dryRun: Boolean(body['dryRun']),
+        }, security), runtimeDeps);
+        writeJson(res, 200, result);
+        return;
+    }
+    if (method === 'POST' && pathname === '/api/operations/daily-cost-override/set') {
+        const body = await readJsonBody(req);
+        const amountUsd = toFiniteNumber(body['amountUsd']);
+        if (amountUsd === null || amountUsd <= 0) {
+            writeJson(res, 400, { error: 'amountUsd must be a positive finite number' });
+            return;
+        }
+        try {
+            const result = await handleToolCall('night-orch-daily-cost-override', withMcpMutationAuth({ amountUsd }, security), runtimeDeps);
+            writeJson(res, 200, result);
+        }
+        catch (err) {
+            writeJson(res, 400, { error: err.message });
+        }
+        return;
+    }
+    if (method === 'POST' && pathname === '/api/operations/daily-cost-override/clear') {
+        try {
+            const result = await handleToolCall('night-orch-daily-cost-override', withMcpMutationAuth({ clear: true }, security), runtimeDeps);
+            writeJson(res, 200, result);
+        }
+        catch (err) {
+            writeJson(res, 400, { error: err.message });
+        }
+        return;
+    }
+    if (method === 'POST' && pathname === '/api/operations/cost-override/set') {
+        const body = await readJsonBody(req);
+        const repo = toNonEmptyString(body['repo']);
+        const issueNumber = toBoundedInt(body['issueNumber'], NaN, 1, Number.MAX_SAFE_INTEGER);
+        const amountUsd = toFiniteNumber(body['amountUsd']);
+        if (!repo || Number.isNaN(issueNumber)) {
+            writeJson(res, 400, { error: 'repo and issueNumber are required' });
+            return;
+        }
+        if (amountUsd === null || amountUsd <= 0) {
+            writeJson(res, 400, { error: 'amountUsd must be a positive finite number' });
+            return;
+        }
+        try {
+            const result = await handleToolCall('night-orch-cost-override', withMcpMutationAuth({ repo, issueNumber, amountUsd }, security), runtimeDeps);
+            writeJson(res, 200, result);
+        }
+        catch (err) {
+            writeJson(res, 400, { error: err.message });
+        }
+        return;
+    }
+    if (method === 'POST' && pathname === '/api/operations/cost-override/clear') {
+        const body = await readJsonBody(req);
+        const repo = toNonEmptyString(body['repo']);
+        const issueNumber = toBoundedInt(body['issueNumber'], NaN, 1, Number.MAX_SAFE_INTEGER);
+        if (!repo || Number.isNaN(issueNumber)) {
+            writeJson(res, 400, { error: 'repo and issueNumber are required' });
+            return;
+        }
+        try {
+            const result = await handleToolCall('night-orch-cost-override', withMcpMutationAuth({ repo, issueNumber, clear: true }, security), runtimeDeps);
+            writeJson(res, 200, result);
+        }
+        catch (err) {
+            writeJson(res, 400, { error: err.message });
+        }
+        return;
+    }
+    if (method === 'POST' && pathname === '/api/operations/settings/set') {
+        const body = await readJsonBody(req);
+        const key = toNonEmptyString(body['key']);
+        const value = body['value'];
+        if (!key || value === undefined) {
+            writeJson(res, 400, { error: 'key and value are required' });
+            return;
+        }
+        try {
+            const result = await handleToolCall('night-orch-set-setting', withMcpMutationAuth({ key, value }, security), deps);
+            writeJson(res, 200, result);
+        }
+        catch (err) {
+            if (isRuntimeSettingInputError(err)) {
+                writeJson(res, 400, { error: err.message });
+                return;
+            }
+            throw err;
+        }
+        return;
+    }
+    if (method === 'POST' && pathname === '/api/operations/settings/clear') {
+        const body = await readJsonBody(req);
+        const key = toNonEmptyString(body['key']);
+        if (!key) {
+            writeJson(res, 400, { error: 'key is required' });
+            return;
+        }
+        try {
+            const result = await handleToolCall('night-orch-clear-setting', withMcpMutationAuth({ key }, security), deps);
+            writeJson(res, 200, result);
+        }
+        catch (err) {
+            if (isRuntimeSettingInputError(err)) {
+                writeJson(res, 400, { error: err.message });
+                return;
+            }
+            throw err;
+        }
+        return;
+    }
+    if (method === 'GET' && pathname === '/api/update-status') {
+        const statusPath = resolve(homedir(), '.config', 'night-orch', 'update-status.json');
+        try {
+            const parsed = JSON.parse(readFileSync(statusPath, 'utf-8'));
+            const status = {
+                state: typeof parsed['state'] === 'string' ? parsed['state'] : 'idle',
+                ...(typeof parsed['error'] === 'string' ? { error: parsed['error'] } : {}),
+            };
+            writeJson(res, 200, status);
+        }
+        catch {
+            writeJson(res, 200, { state: 'idle' });
+        }
+        return;
+    }
+    if (method === 'POST' && pathname === '/api/operations/update') {
+        // Try IPC first (running under supervisor)
+        if (typeof process.send === 'function') {
+            process.send({ type: 'update-requested' });
+            writeJson(res, 200, { accepted: true, method: 'ipc' });
+            return;
+        }
+        // Fallback: trigger file
+        const dataDir = resolve(homedir(), '.config', 'night-orch');
+        const triggerPath = resolve(dataDir, 'update-requested');
+        mkdirSync(dataDir, { recursive: true });
+        writeFileSync(triggerPath, nowUtcIso());
+        writeJson(res, 200, { accepted: true, method: 'trigger-file' });
+        return;
+    }
+    writeJson(res, 404, { error: `Unknown API route: ${method} ${pathname}` });
+}
+async function serveFrontend(req, res, pathname, frontendDistPath, hasFrontendAssets) {
+    const method = req.method ?? 'GET';
+    if (method !== 'GET' && method !== 'HEAD') {
+        writeJson(res, 405, { error: 'Method not allowed' });
+        return;
+    }
+    if (!hasFrontendAssets) {
+        writeJson(res, 503, {
+            error: 'Frontend assets not available',
+            hint: 'Run `pnpm web:build` to build the frontend assets.',
+        });
+        return;
+    }
+    const relativePath = pathname === '/' ? '/index.html' : pathname;
+    const targetPath = resolve(frontendDistPath, `.${relativePath}`);
+    // Path-traversal guard: `targetPath.startsWith(frontendDistPath)` alone
+    // is insufficient — a sibling directory such as `frontendDistPath` +
+    // "-stash" would pass. Require exact match or a true subdirectory path.
+    if (targetPath !== frontendDistPath && !targetPath.startsWith(frontendDistPath + sep)) {
+        writeJson(res, 403, { error: 'Forbidden path' });
+        return;
+    }
+    const candidatePath = await pickExistingFile(targetPath);
+    if (!candidatePath && extname(relativePath) !== '') {
+        writeJson(res, 404, { error: 'Not found' });
+        return;
+    }
+    const filePath = candidatePath ?? resolve(frontendDistPath, 'index.html');
+    try {
+        const body = await readFile(filePath);
+        const contentType = CONTENT_TYPES[extname(filePath)] ?? 'application/octet-stream';
+        const isIndex = filePath.endsWith('/index.html');
+        const cacheControl = isIndex ? 'no-cache' : 'public, max-age=31536000, immutable';
+        res.writeHead(200, {
+            'Content-Type': contentType,
+            'Cache-Control': cacheControl,
+        });
+        if (method === 'HEAD') {
+            res.end();
+            return;
+        }
+        res.end(body);
+    }
+    catch (err) {
+        logger.warn({ err, filePath }, 'Failed to serve frontend asset');
+        writeJson(res, 500, { error: 'Failed to read frontend asset' });
+    }
+}
+async function pickExistingFile(path) {
+    try {
+        const metadata = await stat(path);
+        if (metadata.isFile()) {
+            return path;
+        }
+    }
+    catch {
+        // not found
+    }
+    return null;
+}
+async function readJsonBody(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += buffer.length;
+        if (size > ONE_MEGABYTE) {
+            throw new Error('Request body too large');
+        }
+        chunks.push(buffer);
+    }
+    if (chunks.length === 0) {
+        return {};
+    }
+    const body = Buffer.concat(chunks).toString('utf-8').trim();
+    if (!body) {
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(body);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error('JSON body must be an object');
+        }
+        return parsed;
+    }
+    catch (err) {
+        throw new Error(`Invalid JSON body: ${err.message}`);
+    }
+}
+function getRequestUrl(req) {
+    return new URL(req.url ?? '/', 'http://localhost');
+}
+function validateMutationRequest(req, security) {
+    if (!isAllowedRequestHost(req, security)) {
+        return { statusCode: 403, error: 'Forbidden host' };
+    }
+    if (!hasAllowedOrigin(req, security, true)) {
+        return { statusCode: 403, error: 'Forbidden origin' };
+    }
+    const intent = getSingleHeaderValue(req.headers[MUTATION_INTENT_HEADER]);
+    if (intent !== MUTATION_INTENT_VALUE) {
+        return { statusCode: 403, error: `Missing required header: ${MUTATION_INTENT_HEADER}` };
+    }
+    const contentType = getSingleHeaderValue(req.headers['content-type']);
+    if (!contentType || !isJsonContentType(contentType)) {
+        return { statusCode: 415, error: 'Content-Type must be application/json' };
+    }
+    const webToken = getSingleHeaderValue(req.headers[WEB_AUTH_TOKEN_HEADER]);
+    if (!webToken) {
+        return { statusCode: 401, error: `Missing required header: ${WEB_AUTH_TOKEN_HEADER}` };
+    }
+    if (!isMatchingToken(webToken, security.webMutationToken)) {
+        return { statusCode: 403, error: 'Invalid web auth token' };
+    }
+    return null;
+}
+function hasAllowedOrigin(req, security, allowMissingOrigin) {
+    const originHeader = getSingleHeaderValue(req.headers.origin);
+    if (!originHeader) {
+        return allowMissingOrigin;
+    }
+    let originUrl;
+    try {
+        originUrl = new URL(originHeader);
+    }
+    catch {
+        return false;
+    }
+    if (originUrl.protocol !== 'http:' && originUrl.protocol !== 'https:') {
+        return false;
+    }
+    return security.allowedHostnames.has(originUrl.hostname.toLowerCase());
+}
+function isJsonContentType(contentType) {
+    const normalized = contentType.split(';')[0]?.trim().toLowerCase();
+    return normalized === 'application/json';
+}
+function getSingleHeaderValue(value) {
+    if (Array.isArray(value)) {
+        return value[0]?.trim() || null;
+    }
+    if (typeof value === 'string') {
+        const trimmed = value.trim();
+        return trimmed.length > 0 ? trimmed : null;
+    }
+    return null;
+}
+function withMcpMutationAuth(args, security) {
+    if (!security.mcpMutationAuthToken) {
+        return args;
+    }
+    return {
+        ...args,
+        authToken: security.mcpMutationAuthToken,
+    };
+}
+function createWebSecurityContext(deps, options) {
+    // When bound to a non-loopback address, the operator-supplied env var
+    // IS the mutation token. The startup guard in startWebServer() ensures
+    // the env var is set before we get here. Using it directly means the
+    // /api/session endpoint can refuse to disclose it — the operator gives
+    // the token to trusted clients out-of-band (browser extension, curl
+    // header, etc).
+    //
+    // For loopback binds, keep the random-per-process token and disclose it
+    // via /api/session as before — the risk is low when only local processes
+    // can reach the server.
+    const operatorToken = process.env['NIGHT_ORCH_WEB_AUTH_TOKEN'];
+    const bindHostName = normalizeHostname(options.host) ?? options.host;
+    const isLoopback = bindHostName === '127.0.0.1'
+        || bindHostName === '::1'
+        || bindHostName === 'localhost'
+        || bindHostName === '';
+    const operatorAuthMode = !isLoopback && !!operatorToken;
+    return {
+        allowedHostnames: resolveAllowedHostnames(options.host, options.allowedHosts ?? []),
+        webMutationToken: operatorAuthMode ? operatorToken : randomBytes(24).toString('base64url'),
+        mcpMutationAuthToken: resolveMcpMutationAuthToken(deps),
+        operatorAuthMode,
+    };
+}
+function resolveAllowedHostnames(bindHost, configuredAllowedHosts) {
+    const hostnames = new Set();
+    const bindHostName = normalizeHostname(bindHost);
+    if (bindHostName && bindHostName !== '0.0.0.0' && bindHostName !== '::') {
+        addAllowedHostname(hostnames, bindHostName);
+    }
+    for (const rawHost of configuredAllowedHosts) {
+        const normalized = normalizeHostname(rawHost);
+        if (!normalized)
+            continue;
+        addAllowedHostname(hostnames, normalized);
+    }
+    if (hostnames.size === 0) {
+        throw new Error('No allowed web hosts configured. Use a concrete --host or provide one or more --allowed-host values.');
+    }
+    return hostnames;
+}
+function addAllowedHostname(allowedHostnames, hostname) {
+    if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1') {
+        allowedHostnames.add('localhost');
+        allowedHostnames.add('127.0.0.1');
+        allowedHostnames.add('::1');
+        return;
+    }
+    allowedHostnames.add(hostname);
+}
+function normalizeHostname(value) {
+    const trimmed = value.trim();
+    if (trimmed.length === 0) {
+        return null;
+    }
+    const candidates = trimmed.includes('://')
+        ? [trimmed]
+        : [
+            `http://${trimmed}`,
+            ...(trimmed.includes(':') && !trimmed.startsWith('[') ? [`http://[${trimmed}]`] : []),
+        ];
+    for (const candidate of candidates) {
+        try {
+            const parsed = new URL(candidate);
+            const hostname = parsed.hostname.toLowerCase();
+            if (hostname.length > 0) {
+                return hostname;
+            }
+        }
+        catch {
+            // try next parse candidate
+        }
+    }
+    return null;
+}
+function isAllowedRequestHost(req, security) {
+    const hostHeader = getSingleHeaderValue(req.headers.host);
+    if (!hostHeader) {
+        return false;
+    }
+    const hostname = normalizeHostname(hostHeader);
+    if (!hostname) {
+        return false;
+    }
+    return security.allowedHostnames.has(hostname);
+}
+function resolveMcpMutationAuthToken(deps) {
+    const tokenEnv = deps.config.mcp.authTokenEnv;
+    if (!tokenEnv) {
+        return undefined;
+    }
+    const token = process.env[tokenEnv];
+    if (!token) {
+        throw new Error(`MCP auth token env var ${tokenEnv} is configured but not set`);
+    }
+    return token;
+}
+function isMatchingToken(providedToken, expectedToken) {
+    const providedHash = createHash('sha256').update(providedToken).digest();
+    const expectedHash = createHash('sha256').update(expectedToken).digest();
+    return timingSafeEqual(providedHash, expectedHash);
+}
+function rejectUpgrade(socket, statusCode, message) {
+    const payload = `${message}\n`;
+    socket.write(`HTTP/1.1 ${statusCode} ${message}\r\n` +
+        'Connection: close\r\n' +
+        'Content-Type: text/plain; charset=utf-8\r\n' +
+        `Content-Length: ${Buffer.byteLength(payload)}\r\n` +
+        '\r\n' +
+        payload);
+    socket.destroy();
+}
+function writeJson(res, status, payload) {
+    res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify(payload));
+}
+function toBoundedInt(value, fallback, min, max) {
+    const parsed = typeof value === 'number'
+        ? value
+        : typeof value === 'string'
+            ? Number.parseInt(value, 10)
+            : NaN;
+    if (!Number.isFinite(parsed)) {
+        return fallback;
+    }
+    return Math.max(min, Math.min(max, Math.floor(parsed)));
+}
+function toNonEmptyString(value) {
+    if (typeof value !== 'string') {
+        return null;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+function toFiniteNumber(value) {
+    const parsed = typeof value === 'number'
+        ? value
+        : typeof value === 'string'
+            ? Number.parseFloat(value)
+            : NaN;
+    return Number.isFinite(parsed) ? parsed : null;
+}
+async function buildDashboardSnapshot(deps) {
+    const runtimeConfig = resolveConfigWithRuntimeSettings(deps.config, deps.db);
+    const runtimeDeps = {
+        ...deps,
+        config: runtimeConfig,
+    };
+    const [status, runs, cost] = await Promise.all([
+        handleToolCall('night-orch-status', {}, runtimeDeps),
+        handleToolCall('night-orch-list-runs', { limit: 100 }, runtimeDeps),
+        handleToolCall('night-orch-cost-report', { days: 7 }, runtimeDeps),
+    ]);
+    return {
+        generatedAt: nowUtcIso(),
+        status,
+        runs,
+        cost,
+        build: BUILD_INFO,
+        config: {
+            repos: runtimeConfig.repos.map((repo) => repo.repo),
+            pollIntervalSeconds: runtimeConfig.github.pollIntervalSeconds,
+        },
+        stats: loadTuiStats(runtimeDeps.db, { costModel: runtimeConfig.cost.model }),
+    };
+}
+function buildProjectsSnapshot(deps) {
+    return {
+        generatedAt: nowUtcIso(),
+        githubDefaults: {
+            tokenEnv: deps.config.github.tokenEnv,
+            apiBaseUrl: deps.config.github.apiBaseUrl,
+        },
+        workerProfiles: Object.fromEntries(Object.entries(deps.config.workerProfiles).map(([name, profile]) => [
+            name,
+            sanitizeWorkerProfile(profile),
+        ])),
+        repos: deps.config.repos.map((repo) => sanitizeProjectRepo(repo)),
+    };
+}
+function buildSettingsSnapshot(deps, rawConfig) {
+    const runtimeSettings = listRuntimeSettings(deps.config, deps.db);
+    return {
+        generatedAt: nowUtcIso(),
+        settings: runtimeSettings.map((setting) => {
+            const definition = getSettingDefinition(setting.key);
+            if (!definition) {
+                return {
+                    ...setting,
+                    hasYamlValue: false,
+                    yamlValue: null,
+                };
+            }
+            const { hasYamlValue, yamlValue } = resolveSettingYamlValue(definition, rawConfig, deps.config);
+            return {
+                ...setting,
+                hasYamlValue,
+                yamlValue,
+            };
+        }),
+    };
+}
+function sanitizeWorkerProfile(profile) {
+    return {
+        type: profile.type,
+        command: profile.command,
+        args: [...profile.args],
+        workerTimeoutSeconds: profile.workerTimeoutSeconds,
+        minimalEnv: profile.minimalEnv,
+        runtimeWrapper: profile.runtimeWrapper,
+        envKeys: Object.keys(profile.env),
+    };
+}
+function sanitizeProjectRepo(repo) {
+    return {
+        repo: repo.repo,
+        forge: repo.forge,
+        linkedProjects: [...repo.linkedProjects],
+        apiBaseUrl: repo.apiBaseUrl,
+        tokenEnv: repo.tokenEnv,
+        maxConcurrentRuns: repo.maxConcurrentRuns,
+        localPath: repo.localPath,
+        baseBranch: repo.baseBranch,
+        branchPrefix: repo.branchPrefix,
+        labels: sanitizeLabels(repo.labels),
+        ...(repo.kanban
+            ? {
+                kanban: {
+                    triggerLabel: repo.kanban.triggerLabel,
+                    labels: sanitizeLabels(repo.kanban.labels),
+                },
+            }
+            : {}),
+        labelConfig: Object.fromEntries(Object.entries(repo.labelConfig).map(([label, config]) => [
+            label,
+            {
+                ...(config.color ? { color: config.color } : {}),
+                ...(config.description ? { description: config.description } : {}),
+            },
+        ])),
+        defaults: {
+            planner: repo.defaults.planner,
+            coder: repo.defaults.coder,
+            reviewer: repo.defaults.reviewer,
+            doneMode: repo.defaults.doneMode,
+            notifyPriority: repo.defaults.notifyPriority,
+            prMentions: [...repo.defaults.prMentions],
+        },
+        ...(repo.environment ? { environment: sanitizeEnvironment(repo.environment) } : {}),
+        verify: repo.verify.map((command) => copyCommandSpec(command)),
+        prompts: {
+            plannerSystem: Boolean(repo.prompts?.plannerSystem),
+            coderSystem: Boolean(repo.prompts?.coderSystem),
+            reviewerSystem: Boolean(repo.prompts?.reviewerSystem),
+        },
+        planning: {
+            prdDirectory: repo.planning.prdDirectory,
+        },
+        selectors: {
+            includeLabelsAny: [...repo.selectors.includeLabelsAny],
+            excludeLabelsAny: [...repo.selectors.excludeLabelsAny],
+        },
+        agents: { ...repo.agents },
+        ...(repo.workflow ? { workflow: repo.workflow } : {}),
+        ...(repo.workflowByTriage ? { workflowByTriage: { ...repo.workflowByTriage } } : {}),
+        mergeQueue: {
+            enabled: repo.mergeQueue.enabled,
+            batchSize: repo.mergeQueue.batchSize,
+            mergeMethod: repo.mergeQueue.mergeMethod,
+            retryFlakyOnce: repo.mergeQueue.retryFlakyOnce,
+            requireApproval: repo.mergeQueue.requireApproval,
+            stagingBranchPrefix: repo.mergeQueue.stagingBranchPrefix,
+        },
+    };
+}
+function sanitizeEnvironment(environment) {
+    return {
+        defaultMode: environment.defaultMode,
+        ...(environment.dedicated
+            ? {
+                dedicated: {
+                    compose: {
+                        file: environment.dedicated.compose.file,
+                        services: [...environment.dedicated.compose.services],
+                        projectName: environment.dedicated.compose.projectName,
+                    },
+                    env: {
+                        copyFrom: environment.dedicated.env.copyFrom,
+                        overrideKeys: Object.keys(environment.dedicated.env.overrides),
+                        overrideFiles: [...environment.dedicated.env.overrideFiles],
+                    },
+                    ...(environment.dedicated.healthcheck
+                        ? { healthcheck: copyCommandSpec(environment.dedicated.healthcheck) }
+                        : {}),
+                    teardownOnComplete: environment.dedicated.teardownOnComplete,
+                },
+            }
+            : {}),
+        ...(environment.shared
+            ? {
+                shared: {
+                    requireRunning: environment.shared.requireRunning,
+                    ...(environment.shared.healthcheck
+                        ? { healthcheck: copyCommandSpec(environment.shared.healthcheck) }
+                        : {}),
+                },
+            }
+            : {}),
+        bootstrap: environment.bootstrap.map((step) => ({
+            when: step.when,
+            command: copyCommandSpec(step.command),
+            ...(step.failureHints && step.failureHints.length > 0
+                ? {
+                    failureHints: step.failureHints.map((hint) => ({
+                        contains: hint.contains,
+                        message: hint.message,
+                        output: hint.output,
+                    })),
+                }
+                : {}),
+        })),
+        cleanup: environment.cleanup.map((step) => ({
+            when: step.when,
+            command: copyCommandSpec(step.command),
+            ...(step.failureHints && step.failureHints.length > 0
+                ? {
+                    failureHints: step.failureHints.map((hint) => ({
+                        contains: hint.contains,
+                        message: hint.message,
+                        output: hint.output,
+                    })),
+                }
+                : {}),
+        })),
+    };
+}
+function sanitizeLabels(labels) {
+    return {
+        ready: [...labels.ready],
+        running: labels.running,
+        blocked: normalizeLabelValue(labels.blocked),
+        needsHuman: labels.needsHuman,
+        reviewReady: labels.reviewReady,
+        error: labels.error,
+        retry: labels.retry,
+        planning: labels.planning,
+        mergeQueued: labels.mergeQueued,
+        merging: labels.merging,
+        mergeFailed: labels.mergeFailed,
+    };
+}
+function normalizeLabelValue(value) {
+    if (typeof value === 'string')
+        return value;
+    if (Array.isArray(value)) {
+        return value.find((entry) => typeof entry === 'string') ?? '';
+    }
+    return '';
+}
+function copyCommandSpec(command) {
+    if (Array.isArray(command)) {
+        return [...command];
+    }
+    return command;
+}
+async function handleWsMessage(ws, state, rawMessage, deps) {
+    let command;
+    try {
+        command = JSON.parse(rawMessage);
+    }
+    catch {
+        sendWebsocket(ws, { type: 'error', error: 'Invalid JSON message' });
+        return;
+    }
+    if (command.type === 'subscribe-run-events') {
+        const runId = typeof command.runId === 'string' ? command.runId : '';
+        if (!runId) {
+            sendWebsocket(ws, { type: 'error', error: 'runId is required for subscribe-run-events' });
+            return;
+        }
+        const cursor = Number.isFinite(command.since) ? Math.max(0, Math.floor(command.since ?? 0)) : 0;
+        state.runSubscriptions.set(runId, cursor);
+        sendWebsocket(ws, { type: 'subscribed', payload: { runId, since: cursor } });
+        return;
+    }
+    if (command.type === 'unsubscribe-run-events') {
+        const runId = typeof command.runId === 'string' ? command.runId : '';
+        if (!runId) {
+            sendWebsocket(ws, { type: 'error', error: 'runId is required for unsubscribe-run-events' });
+            return;
+        }
+        state.runSubscriptions.delete(runId);
+        sendWebsocket(ws, { type: 'unsubscribed', payload: { runId } });
+        return;
+    }
+    if (command.type === 'refresh') {
+        const snapshot = await buildDashboardSnapshot(deps);
+        sendWebsocket(ws, { type: 'snapshot', payload: snapshot });
+        return;
+    }
+    sendWebsocket(ws, { type: 'error', error: 'Unknown command type' });
+}
+async function publishRunSubscriptions(ws, state, deps) {
+    for (const [runId, since] of state.runSubscriptions.entries()) {
+        try {
+            const result = await handleToolCall('night-orch-stream-events', { runId, since, limit: 200 }, deps);
+            const eventPayload = toRunEventPayload(result);
+            if (!eventPayload) {
+                continue;
+            }
+            state.runSubscriptions.set(runId, eventPayload.lastEventId);
+            if (eventPayload.events.length === 0) {
+                continue;
+            }
+            sendWebsocket(ws, {
+                type: 'run-events',
+                payload: {
+                    runId,
+                    events: eventPayload.events,
+                    lastEventId: eventPayload.lastEventId,
+                },
+            });
+        }
+        catch (err) {
+            sendWebsocket(ws, {
+                type: 'error',
+                error: `Failed to stream events for ${runId}: ${err.message}`,
+            });
+        }
+    }
+}
+function toRunEventPayload(input) {
+    if (!input || typeof input !== 'object')
+        return null;
+    const maybeEvents = input.events;
+    const maybeLastEventId = input.lastEventId;
+    if (!Array.isArray(maybeEvents))
+        return null;
+    if (typeof maybeLastEventId !== 'number' || !Number.isFinite(maybeLastEventId))
+        return null;
+    return {
+        events: maybeEvents,
+        lastEventId: Math.max(0, Math.floor(maybeLastEventId)),
+    };
+}
+function sendWebsocket(ws, payload) {
+    if (ws.readyState !== WebSocket.OPEN)
+        return;
+    ws.send(JSON.stringify(payload));
+}
+function isClientRequestError(message) {
+    return message.startsWith('Invalid JSON body') || message === 'Request body too large';
+}
+function isAuthorizationError(message) {
+    return message.startsWith('Unauthorized:');
+}
+function isRuntimeSettingInputError(err) {
+    if (err instanceof RuntimeSettingInputError) {
+        return true;
+    }
+    return err instanceof Error && err.name === 'RuntimeSettingInputError';
+}
+function decodeWsMessage(raw) {
+    if (typeof raw === 'string') {
+        return raw;
+    }
+    if (raw instanceof Buffer) {
+        return raw.toString('utf-8');
+    }
+    if (raw instanceof ArrayBuffer) {
+        return Buffer.from(raw).toString('utf-8');
+    }
+    if (ArrayBuffer.isView(raw)) {
+        return Buffer.from(raw.buffer, raw.byteOffset, raw.byteLength).toString('utf-8');
+    }
+    if (Array.isArray(raw)) {
+        const buffers = raw
+            .map((item) => {
+            if (item instanceof Buffer)
+                return item;
+            if (item instanceof ArrayBuffer)
+                return Buffer.from(item);
+            if (ArrayBuffer.isView(item))
+                return Buffer.from(item.buffer, item.byteOffset, item.byteLength);
+            return null;
+        })
+            .filter((item) => item !== null);
+        if (buffers.length === 0)
+            return null;
+        return Buffer.concat(buffers).toString('utf-8');
+    }
+    return null;
+}
+//# sourceMappingURL=server.js.map