oh-my-agent-web 0.2.0

package/dist/server/request-inspector.js

@@ -0,0 +1,458 @@
+/**
+ * Local Responses API proxy and request/response recorder.
+ *
+ * Codex app-server talks to this loopback proxy when it is managed by the UI.
+ * The proxy forwards the request to the real Codex endpoint while keeping a
+ * redacted, thread-aware copy of the exchange for the session log drawer.
+ */
+import { createServer } from "node:http";
+import { chmod, mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+const DEFAULT_UPSTREAM = "https://chatgpt.com/backend-api/codex";
+const DEFAULT_MAX_BODY = 16 * 1024 * 1024;
+const HISTORY_LIMIT = 400;
+const REQUEST_TIMEOUT_MS = 15 * 60 * 1000;
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function asString(value) {
+    return typeof value === "string" ? value : "";
+}
+function headerValue(headers, name) {
+    const value = headers[name.toLowerCase()];
+    return Array.isArray(value) ? value.join(", ") : value ?? "";
+}
+function redactedHeaders(headers) {
+    const secret = /(authorization|cookie|token|secret|password|api[-_]?key)/i;
+    return Object.fromEntries(Object.entries(headers).map(([key, value]) => {
+        if (!secret.test(key))
+            return [key.toLowerCase(), value];
+        const redacted = key.toLowerCase() === "authorization" && value.length > 12 ? `${value.slice(0, 7)}****${value.slice(-4)}` : "[REDACTED]";
+        return [key.toLowerCase(), redacted];
+    }));
+}
+function incomingHeaders(headers) {
+    const result = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (value === undefined)
+            continue;
+        result[key.toLowerCase()] = Array.isArray(value) ? value.join(", ") : value;
+    }
+    return result;
+}
+function now() {
+    return new Date().toISOString();
+}
+function clip(value, max) {
+    if (value.length <= max)
+        return { value, truncated: false };
+    return { value: value.slice(0, max), truncated: true };
+}
+function parseJson(value) {
+    try {
+        const parsed = JSON.parse(value || "{}");
+        return isRecord(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function extractQuestion(body) {
+    const obj = parseJson(body);
+    const input = obj.input;
+    if (typeof input === "string")
+        return input.slice(0, 4000);
+    if (!Array.isArray(input))
+        return "";
+    for (let i = input.length - 1; i >= 0; i -= 1) {
+        const entry = input[i];
+        if (!isRecord(entry) || entry.role !== "user")
+            continue;
+        const content = entry.content;
+        let text = "";
+        if (typeof content === "string")
+            text = content;
+        else if (Array.isArray(content)) {
+            text = content
+                .filter(isRecord)
+                .map((item) => asString(item.text))
+                .join("");
+        }
+        text = text.trim();
+        if (text && !text.startsWith("<environment_context"))
+            return text.slice(0, 4000);
+    }
+    return "";
+}
+function extractIds(headers) {
+    let meta = {};
+    try {
+        const parsed = JSON.parse(headers["x-codex-turn-metadata"] ?? "{}");
+        if (isRecord(parsed))
+            meta = parsed;
+    }
+    catch {
+        /* metadata is optional */
+    }
+    const threadId = asString(meta.thread_id) || headers["thread-id"] || headers["session-id"] || "unknown-session";
+    const turnId = asString(meta.turn_id) || threadId;
+    const source = asString(meta.thread_source);
+    const trigger = asString(meta.turn_trigger);
+    return {
+        threadId,
+        turnId,
+        source,
+        trigger,
+        internal: Boolean(headers["x-openai-memgen-request"]) || source === "automation" || source === "memory_consolidation" || source === "guardian_review" || source === "system" || source === "thread_title" || trigger.startsWith("automation"),
+    };
+}
+function sseEvents(body) {
+    const events = [];
+    for (const block of body.split(/\n\s*\n/)) {
+        let data = "";
+        for (const line of block.split(/\r?\n/)) {
+            if (line.startsWith("data:"))
+                data = line.slice(5).trim();
+        }
+        if (!data || data === "[DONE]")
+            continue;
+        try {
+            const value = JSON.parse(data);
+            if (isRecord(value))
+                events.push(value);
+        }
+        catch {
+            /* An incomplete SSE event is normal while a request is streaming. */
+        }
+    }
+    return events;
+}
+function extractStream(body) {
+    const answer = [];
+    const reasoning = [];
+    const tools = [];
+    let usage = null;
+    for (const event of sseEvents(body)) {
+        const type = asString(event.type);
+        if (type === "response.output_text.delta")
+            answer.push(asString(event.delta));
+        else if (type === "response.reasoning_summary_text.delta")
+            reasoning.push(asString(event.delta));
+        else if (type === "response.output_item.done" && isRecord(event.item)) {
+            const itemType = asString(event.item.type);
+            if (["function_call", "custom_tool_call", "local_shell_call", "mcp_call"].includes(itemType)) {
+                tools.push(asString(event.item.name) || itemType);
+            }
+        }
+        else if (type === "response.completed" && isRecord(event.response) && isRecord(event.response.usage)) {
+            usage = event.response.usage;
+        }
+    }
+    return { answer: answer.join(""), reasoning: reasoning.join(""), tools, usage };
+}
+function tokenSummary(usage) {
+    const inputDetails = isRecord(usage?.input_tokens_details) ? usage.input_tokens_details : {};
+    const outputDetails = isRecord(usage?.output_tokens_details) ? usage.output_tokens_details : {};
+    const numberValue = (value) => (typeof value === "number" && Number.isFinite(value) ? value : 0);
+    return {
+        input: numberValue(usage?.input_tokens),
+        cached: numberValue(inputDetails.cached_tokens),
+        cacheWrite: numberValue(inputDetails.cache_write_tokens),
+        output: numberValue(usage?.output_tokens),
+        reasoning: numberValue(outputDetails.reasoning_tokens),
+    };
+}
+function modelFromBody(body) {
+    const value = parseJson(body).model;
+    return typeof value === "string" ? value : null;
+}
+function summarize(item) {
+    const stream = extractStream(item.responseBody);
+    return {
+        id: item.id,
+        startedAt: item.startedAt,
+        status: item.status,
+        model: item.model,
+        durationMs: item.durationMs,
+        requestBytes: item.requestBytes,
+        responseBytes: item.responseBytes,
+        error: item.error,
+        threadId: item._ids.threadId,
+        turnId: item._ids.turnId,
+        source: item._ids.source,
+        trigger: item._ids.trigger,
+        internal: item._ids.internal,
+        question: item._question,
+        answer: stream.answer.slice(-8000),
+        reasoning: stream.reasoning.slice(-4000),
+        tools: stream.tools,
+        usage: stream.usage,
+        tokens: tokenSummary(stream.usage),
+    };
+}
+function detail(item) {
+    return {
+        ...summarize(item),
+        requestHeaders: item.requestHeaders,
+        responseHeaders: item.responseHeaders,
+        requestBody: item.requestBody,
+        responseBody: item.responseBody,
+        responseTruncated: item.responseTruncated,
+    };
+}
+function exchangeFromJson(value) {
+    if (!isRecord(value) || typeof value.id !== "string")
+        return null;
+    const ids = isRecord(value._ids) ? value._ids : {};
+    return {
+        id: value.id,
+        startedAt: asString(value.startedAt) || asString(value.started_at),
+        method: asString(value.method) || "POST",
+        path: asString(value.path) || "/responses",
+        _ids: {
+            threadId: asString(ids.threadId) || asString(ids.thread_id) || asString(value.threadId) || asString(value.thread_id) || "unknown-session",
+            turnId: asString(ids.turnId) || asString(ids.turn_id) || asString(value.turnId) || asString(value.turn_id) || "",
+            source: asString(ids.source) || asString(value.source),
+            trigger: asString(ids.trigger) || asString(value.trigger),
+            internal: ids.internal === true || value.internal === true,
+        },
+        _question: asString(value._question) || asString(value.question),
+        requestHeaders: isRecord(value.requestHeaders) ? Object.fromEntries(Object.entries(value.requestHeaders).map(([k, v]) => [k, asString(v)])) : isRecord(value.request_headers) ? Object.fromEntries(Object.entries(value.request_headers).map(([k, v]) => [k, asString(v)])) : {},
+        requestBody: asString(value.requestBody) || asString(value.request_body),
+        requestBytes: typeof value.requestBytes === "number" ? value.requestBytes : typeof value.request_bytes === "number" ? value.request_bytes : 0,
+        status: typeof value.status === "number" ? value.status : null,
+        responseHeaders: isRecord(value.responseHeaders) ? Object.fromEntries(Object.entries(value.responseHeaders).map(([k, v]) => [k, asString(v)])) : isRecord(value.response_headers) ? Object.fromEntries(Object.entries(value.response_headers).map(([k, v]) => [k, asString(v)])) : {},
+        responseBody: asString(value.responseBody) || asString(value.response_body),
+        responseBytes: typeof value.responseBytes === "number" ? value.responseBytes : typeof value.response_bytes === "number" ? value.response_bytes : 0,
+        responseTruncated: value.responseTruncated === true || value.response_truncated === true,
+        durationMs: typeof value.durationMs === "number" ? value.durationMs : typeof value.duration_ms === "number" ? value.duration_ms : null,
+        error: typeof value.error === "string" ? value.error : null,
+        model: typeof value.model === "string" ? value.model : modelFromBody(asString(value.requestBody) || asString(value.request_body)),
+    };
+}
+async function readRequestBody(req) {
+    const chunks = [];
+    for await (const chunk of req)
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    return Buffer.concat(chunks);
+}
+function copyableHeaders(headers) {
+    return Object.fromEntries(Object.entries(headers).filter(([key]) => !["host", "connection", "content-length", "transfer-encoding"].includes(key.toLowerCase())));
+}
+function jsonResponse(res, status, value) {
+    const body = Buffer.from(JSON.stringify(value));
+    res.statusCode = status;
+    res.setHeader("content-type", "application/json; charset=utf-8");
+    res.setHeader("content-length", body.length);
+    res.end(body);
+}
+export class RequestInspector {
+    upstream;
+    dataDir;
+    maxBody;
+    live = new Map();
+    server = null;
+    baseUrl = "";
+    constructor(options) {
+        this.upstream = (options.upstream || process.env.OMAW_CODEX_UPSTREAM || DEFAULT_UPSTREAM).replace(/\/$/, "");
+        this.dataDir = options.dataDir;
+        this.maxBody = options.maxBody ?? Number(process.env.OMAW_LOG_MAX_BODY ?? DEFAULT_MAX_BODY);
+    }
+    async start(host = "127.0.0.1") {
+        if (this.server)
+            return this.baseUrl;
+        await mkdir(this.dataDir, { recursive: true, mode: 0o700 });
+        this.server = createServer((req, res) => {
+            void this.handle(req, res).catch((error) => {
+                if (!res.headersSent)
+                    jsonResponse(res, 502, { error: error instanceof Error ? error.message : String(error) });
+                else
+                    res.destroy();
+            });
+        });
+        await new Promise((resolve, reject) => {
+            this.server?.once("error", reject);
+            this.server?.listen(0, host, resolve);
+        });
+        const address = this.server.address();
+        if (!address || typeof address === "string")
+            throw new Error("request inspector failed to bind");
+        this.baseUrl = `http://${host}:${address.port}`;
+        return this.baseUrl;
+    }
+    async close() {
+        const server = this.server;
+        this.server = null;
+        if (!server)
+            return;
+        await new Promise((resolve) => server.close(() => resolve()));
+    }
+    url() {
+        return this.baseUrl;
+    }
+    async list(threadId, limit = HISTORY_LIMIT) {
+        const rows = [];
+        for (const item of this.live.values()) {
+            if (!threadId || item._ids.threadId === threadId)
+                rows.push(item);
+        }
+        try {
+            const days = (await readdir(this.dataDir)).sort().reverse();
+            for (const day of days) {
+                const folder = join(this.dataDir, day);
+                if (!(await stat(folder).catch(() => null))?.isDirectory())
+                    continue;
+                const names = (await readdir(folder)).filter((name) => name.endsWith(".json")).sort().reverse();
+                for (const name of names) {
+                    const parsed = exchangeFromJson(JSON.parse(await readFile(join(folder, name), "utf8")));
+                    if (parsed && (!threadId || parsed._ids.threadId === threadId))
+                        rows.push(parsed);
+                }
+            }
+        }
+        catch {
+            /* The log directory may not exist yet. */
+        }
+        return rows
+            .sort((a, b) => b.startedAt.localeCompare(a.startedAt))
+            .slice(0, Math.max(1, Math.min(limit, HISTORY_LIMIT)))
+            .map(summarize);
+    }
+    async get(id) {
+        const live = this.live.get(id);
+        if (live)
+            return detail(live);
+        try {
+            const days = (await readdir(this.dataDir)).sort().reverse();
+            for (const day of days) {
+                const file = join(this.dataDir, day, `${id}.json`);
+                if (!(await stat(file).catch(() => null))?.isFile())
+                    continue;
+                const parsed = exchangeFromJson(JSON.parse(await readFile(file, "utf8")));
+                return parsed ? detail(parsed) : null;
+            }
+        }
+        catch {
+            return null;
+        }
+        return null;
+    }
+    async handle(req, res) {
+        const parsed = new URL(req.url ?? "/", this.baseUrl || "http://127.0.0.1");
+        if (req.method === "OPTIONS") {
+            res.statusCode = 204;
+            res.end();
+            return;
+        }
+        if (req.method !== "GET" && req.method !== "POST") {
+            jsonResponse(res, 405, { error: "method not allowed" });
+            return;
+        }
+        let body = Buffer.alloc(0);
+        if (req.method === "POST")
+            body = await readRequestBody(req);
+        const target = `${this.upstream}${parsed.pathname}${parsed.search}`;
+        const headers = incomingHeaders(req.headers);
+        const requestHeaders = redactedHeaders(headers);
+        // GET /models and similar discovery calls are proxied but not recorded as
+        // session exchanges; only POST responses contain a user turn.
+        if (req.method !== "POST") {
+            await this.forward(target, req.method, headers, body, res);
+            return;
+        }
+        const requestBody = body.toString("utf8");
+        const clippedRequest = clip(requestBody, this.maxBody);
+        const ids = extractIds(headers);
+        const id = `${new Date().toISOString().replace(/[-:.TZ]/g, "").slice(0, 12)}-${randomUUID().slice(0, 6)}`;
+        const item = {
+            id,
+            startedAt: now(),
+            method: req.method,
+            path: parsed.pathname,
+            _ids: ids,
+            _question: extractQuestion(requestBody),
+            requestHeaders,
+            requestBody: clippedRequest.value,
+            requestBytes: body.length,
+            status: null,
+            responseHeaders: {},
+            responseBody: "",
+            responseBytes: 0,
+            responseTruncated: false,
+            durationMs: null,
+            error: null,
+            model: modelFromBody(requestBody),
+        };
+        this.live.set(id, item);
+        try {
+            await this.forward(target, req.method, headers, body, res, item);
+        }
+        catch (error) {
+            item.status = 502;
+            item.error = error instanceof Error ? error.message : String(error);
+            if (!res.headersSent)
+                jsonResponse(res, 502, { error: item.error });
+        }
+        finally {
+            item.durationMs = Date.now() - Date.parse(item.startedAt);
+            this.live.delete(id);
+            await this.persist(item);
+        }
+    }
+    async forward(target, method, headers, body, res, item) {
+        const response = await fetch(target, {
+            method,
+            headers: copyableHeaders(headers),
+            body: method === "POST" ? new Uint8Array(body) : undefined,
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+        if (item) {
+            item.status = response.status;
+            response.headers.forEach((value, key) => { item.responseHeaders[key] = value; });
+        }
+        res.statusCode = response.status;
+        response.headers.forEach((value, key) => {
+            if (!["content-length", "transfer-encoding", "connection", "content-encoding"].includes(key.toLowerCase()))
+                res.setHeader(key, value);
+        });
+        res.flushHeaders();
+        if (!response.body) {
+            res.end();
+            return;
+        }
+        const reader = response.body.getReader();
+        const captured = [];
+        let capturedBytes = 0;
+        try {
+            while (true) {
+                const next = await reader.read();
+                if (next.done)
+                    break;
+                const chunk = Buffer.from(next.value);
+                res.write(chunk);
+                if (item) {
+                    item.responseBytes += chunk.length;
+                    if (capturedBytes < this.maxBody) {
+                        const part = chunk.subarray(0, Math.max(0, this.maxBody - capturedBytes));
+                        captured.push(part);
+                        capturedBytes += part.length;
+                        item.responseBody = Buffer.concat(captured).toString("utf8");
+                        item.responseTruncated = item.responseTruncated || capturedBytes < item.responseBytes;
+                    }
+                }
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+        res.end();
+    }
+    async persist(item) {
+        const folder = join(this.dataDir, new Date().toISOString().slice(0, 10));
+        await mkdir(folder, { recursive: true, mode: 0o700 });
+        const path = join(folder, `${item.id}.json`);
+        await writeFile(path, JSON.stringify(item, null, 2), { encoding: "utf8", mode: 0o600 });
+        await chmod(path, 0o600).catch(() => undefined);
+    }
+}

package/dist/shared/protocol.js

@@ -0,0 +1,112 @@
+/**
+ * oh-my-agent-web — browser <-> server wire protocol.
+ *
+ * The browser talks to OUR server (not directly to codex). Our server is a thin,
+ * transparent proxy in front of `codex app-server --listen ws://127.0.0.1:25258`:
+ *
+ *   browser  <--ws /ws-->  oh-my-agent-web server  <--ws-->  codex app-server
+ *
+ * Because the proxy is transparent, the browser may invoke ANY codex app-server
+ * JSON-RPC method by name (`thread/start`, `turn/start`, `model/list`, ...) and
+ * receives every codex notification verbatim. The names/types below therefore
+ * mirror codex's own protocol; only the *envelope* is ours.
+ *
+ * Codex types can be regenerated with:
+ *   codex app-server generate-ts --out shared/codex-ts
+ *
+ * Envelope rules
+ * --------------
+ * client -> server:
+ *   { type: "rpc", requestId, method, params }   invoke a codex method (or `omaw/*`)
+ *   { type: "reply", id, result }                answer a serverRequest (approval, user input)
+ *   { type: "reply", id, error }                 reject a serverRequest
+ *   { type: "ping" }
+ *
+ * server -> client:
+ *   { type: "welcome", ... }                     handshake, sent once per connection
+ *   { type: "status", codex }                    supervisor state, on change
+ *   { type: "rpcResult", requestId, ok, ... }    answer to our rpc
+ *   { type: "event", method, params }            codex notification (verbatim)
+ *   { type: "serverRequest", id, method, params }codex -> client request (verbatim)
+ *   { type: "pong" }
+ */
+export const PROTOCOL_VERSION = 1;
+/* ------------------------------------------------------------------ */
+/* local (`omaw/*`) methods — handled by OUR server, not proxied         */
+/* ------------------------------------------------------------------ */
+export const LOCAL_METHODS = {
+    /** -> { status: CodexStatus } */
+    codexStatus: "omaw/codex/status",
+    /** -> { ok: true } — kill + respawn the app-server */
+    codexRestart: "omaw/codex/restart",
+    /** -> { lines: string[] } — tail of the app-server log */
+    codexLog: "omaw/codex/log",
+    /** { threadId?: string, limit?: number } -> request/response summaries */
+    requestLogsList: "omaw/request-logs/list",
+    /** { id: string } -> one full request/response exchange */
+    requestLogsDetail: "omaw/request-logs/detail",
+    /** { path?: string } -> { path, entries: [{name,path,kind,size,mtime}] } */
+    fsList: "omaw/fs/list",
+    /** { path: string, maxBytes?: number } -> { path, text, truncated } */
+    fsRead: "omaw/fs/read",
+    /** -> { cwd, home, codexHome } */
+    paths: "omaw/paths",
+};
+/* ------------------------------------------------------------------ */
+/* codex method names we rely on — kept loose on purpose               */
+/* ------------------------------------------------------------------ */
+export const CODEX = {
+    initialize: "initialize",
+    threadStart: "thread/start",
+    threadResume: "thread/resume",
+    threadRead: "thread/read",
+    threadList: "thread/list",
+    threadDelete: "thread/delete",
+    threadArchive: "thread/archive",
+    threadUnarchive: "thread/unarchive",
+    threadFork: "thread/fork",
+    threadSetName: "thread/name/set",
+    threadTurnsList: "thread/turns/list",
+    threadItemsList: "thread/items/list",
+    turnStart: "turn/start",
+    turnSteer: "turn/steer",
+    turnInterrupt: "turn/interrupt",
+    modelList: "model/list",
+    accountRead: "account/read",
+    accountRateLimits: "account/rateLimits/read",
+    getAuthStatus: "getAuthStatus",
+    configRead: "config/read",
+    fsReadFile: "fs/readFile",
+    fsReadDirectory: "fs/readDirectory",
+    fuzzyFileSearch: "fuzzyFileSearch",
+};
+/** codex notification methods that the UI cares about most. */
+export const CODEX_EVENTS = {
+    threadStarted: "thread/started",
+    threadStatusChanged: "thread/status/changed",
+    threadNameUpdated: "thread/name/updated",
+    turnStarted: "turn/started",
+    turnCompleted: "turn/completed",
+    turnDiffUpdated: "turn/diff/updated",
+    turnPlanUpdated: "turn/plan/updated",
+    itemStarted: "item/started",
+    itemCompleted: "item/completed",
+    agentMessageDelta: "item/agentMessage/delta",
+    reasoningSummaryDelta: "item/reasoning/summaryTextDelta",
+    reasoningTextDelta: "item/reasoning/textDelta",
+    planDelta: "item/plan/delta",
+    commandOutputDelta: "item/commandExecution/outputDelta",
+    fileChangeDelta: "item/fileChange/outputDelta",
+    mcpProgress: "item/mcpToolCall/progress",
+    tokenUsage: "thread/tokenUsage/updated",
+    error: "error",
+};
+/** codex server -> client request methods (need a `reply`). */
+export const CODEX_REQUESTS = {
+    commandApproval: "item/commandExecution/requestApproval",
+    fileChangeApproval: "item/fileChange/requestApproval",
+    permissionsApproval: "item/permissions/requestApproval",
+    toolInput: "item/tool/requestUserInput",
+    elicitation: "mcpServer/elicitation/request",
+    dynamicToolCall: "item/tool/call",
+};

package/package.json

@@ -0,0 +1,82 @@
+{
+	"name": "oh-my-agent-web",
+	"version": "0.2.0",
+	"description": "Browser cockpit for the Codex CLI app-server — chat, tool calls, diffs and approvals in one tab",
+	"license": "MIT",
+	"type": "module",
+	"author": "duzhenxun",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/duzhenxun/oh-my-agent-web.git"
+	},
+	"homepage": "https://github.com/duzhenxun/oh-my-agent-web#readme",
+	"bugs": {
+		"url": "https://github.com/duzhenxun/oh-my-agent-web/issues"
+	},
+	"keywords": [
+		"codex",
+		"codex-cli",
+		"openai",
+		"app-server",
+		"web-ui",
+		"ai",
+		"chat",
+		"cli"
+	],
+	"bin": {
+		"oh-my-agent-web": "bin/oh-my-agent-web.mjs",
+		"omaw": "bin/oh-my-agent-web.mjs"
+	},
+	"main": "bin/oh-my-agent-web.mjs",
+	"files": [
+		"bin/",
+		"dist/",
+		"web/dist/",
+		"scripts/",
+		"shared/protocol.ts",
+		"README.md"
+	],
+	"engines": {
+		"node": ">=22.19.0"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"scripts": {
+		"dev": "cross-env OMAW_DEV_WEB=1 tsx watch server/index.ts",
+		"dev:web": "vite --config web/vite.config.ts",
+		"build": "npm run build:web && npm run build:server",
+		"build:web": "vite build --config web/vite.config.ts",
+		"build:server": "tsc -p tsconfig.server.json",
+		"prepack": "npm run build",
+		"start": "node bin/oh-my-agent-web.mjs",
+		"ws": "node bin/oh-my-agent-web.mjs ws",
+		"omaw": "node scripts/omaw.mjs",
+		"stop": "node scripts/manage-server.mjs stop",
+		"restart": "node scripts/manage-server.mjs restart",
+		"smoke": "tsx test/smoke.ts",
+		"typecheck": "tsc -p tsconfig.server.json --noEmit && tsc -p web/tsconfig.json --noEmit"
+	},
+	"dependencies": {
+		"express": "^4.21.2",
+		"ws": "^8.18.3"
+	},
+	"devDependencies": {
+		"@types/express": "^4.17.23",
+		"@types/node": "^22.15.3",
+		"@types/react": "^19.1.2",
+		"@types/react-dom": "^19.1.2",
+		"@types/ws": "^8.18.1",
+		"@vitejs/plugin-react": "^4.4.1",
+		"cross-env": "^7.0.3",
+		"highlight.js": "^11.11.1",
+		"react": "^19.1.0",
+		"react-dom": "^19.1.0",
+		"react-markdown": "^10.1.0",
+		"rehype-highlight": "^7.0.2",
+		"remark-gfm": "^4.0.1",
+		"tsx": "^4.19.4",
+		"typescript": "^5.8.3",
+		"vite": "^6.3.4"
+	}
+}