pi-webdesk 0.1.0

package/dist/apps/daemon/src/server.js

@@ -0,0 +1,1662 @@
+// apps/daemon/src/server.ts
+import { realpathSync } from "node:fs";
+import { createServer } from "node:http";
+import path from "node:path";
+import { WebSocket, WebSocketServer } from "ws";
+import { z } from "zod";
+import {
+  PROTOCOL_VERSION,
+  continuePiSessionRequestSchema,
+  continuePiSessionResultSchema,
+  createTaskRequestSchema,
+  executeTaskCommitRequestSchema,
+  executeTaskMergeRequestSchema,
+  piAuthErrorSchema,
+  piAuthOperationSchema,
+  piAuthSnapshotSchema,
+  piConfigurationErrorSchema,
+  piConfigurationSnapshotSchema,
+  piSessionCatalogErrorSchema,
+  piSessionCatalogSnapshotSchema,
+  pitaPreferencesErrorSchema,
+  pitaPreferencesSnapshotSchema,
+  promptTaskRequestSchema,
+  registerRepositoryRequestSchema,
+  repositoryMergeSyncResultSchema,
+  repositoryMergeSyncRequestSchema,
+  respondPiAuthRequestSchema,
+  resolveTaskApprovalRequestSchema,
+  runTaskValidationRequestSchema,
+  safeParseClientMessage,
+  selectTaskModelRequestSchema,
+  serverControlMessageSchema,
+  serviceSessionSchema,
+  startPiAuthRequestSchema,
+  steerTaskRequestSchema,
+  taskArchiveRequestSchema,
+  taskCommitErrorSchema,
+  taskCommitPreflightRequestSchema,
+  taskCommitPreflightSchema,
+  taskCommitResultSchema,
+  taskMergeErrorSchema,
+  taskMergePreflightRequestSchema,
+  taskMergePreflightSchema,
+  taskMergeResultSchema,
+  taskReviewErrorSchema,
+  taskReviewSchema,
+  taskRuntimeErrorSchema,
+  taskRuntimeStatusSchema,
+  taskSessionTreeSchema,
+  taskValidationErrorSchema,
+  taskValidationSchema,
+  updatePitaPreferencesRequestSchema,
+  workspaceErrorSchema
+} from "../../../packages/protocol/src/index.js";
+import { createPiAuthManager } from "../../../packages/pi-bridge/src/index.js";
+import {
+  SESSION_COOKIE_NAME,
+  createSessionToken,
+  generateBootstrapToken,
+  readCookie,
+  tokensMatch,
+  verifySessionToken
+} from "./auth.js";
+import { loadOrCreateSessionSecret } from "./secret.js";
+import {
+  PitaPreferencesOperationError,
+  createPitaPreferencesService
+} from "./appearance-preferences.js";
+import {
+  PiAuthOperationError,
+  createPiAuthCoordinator
+} from "./pi-auth.js";
+import {
+  PiConfigurationOperationError,
+  createPiConfigurationService
+} from "./pi-resources.js";
+import {
+  PiSessionCatalogOperationError,
+  createPiSessionCatalogService
+} from "./pi-sessions.js";
+import { createTaskEventHub } from "./event-hub.js";
+import { createPiTaskRuntimeFactory } from "./pi-runtime-factory.js";
+import { acquireDaemonStateLock } from "./state-lock.js";
+import {
+  RuntimeProcessRecoveryError,
+  captureRuntimeProcess,
+  recoverRuntimeProcess
+} from "./runtime-process.js";
+import {
+  TaskReviewOperationError,
+  createTaskReviewService
+} from "./task-review.js";
+import {
+  TaskValidationOperationError,
+  createTaskValidationService
+} from "./task-validation.js";
+import {
+  TaskCommitOperationError,
+  createTaskCommitService
+} from "./task-commit.js";
+import {
+  TaskMergeOperationError,
+  createTaskMergeService
+} from "./task-merge.js";
+import { createTaskArchiveService } from "./task-archive.js";
+import { createStaticWebHandler } from "./static-web.js";
+import {
+  TaskRuntimeOperationError,
+  createTaskRuntimeCoordinator
+} from "./task-runtime.js";
+import {
+  WorkspaceOperationError,
+  createWorkspaceService
+} from "./workspace.js";
+var LOOPBACK_ADDRESS = "127.0.0.1";
+var MAX_BODY_BYTES = 4096;
+var MAX_PROMPT_BODY_BYTES = 128 * 1024;
+var DEFAULT_SESSION_TTL_MS = 12 * 60 * 60 * 1e3;
+var DEFAULT_BOOTSTRAP_TTL_MS = 15 * 60 * 1e3;
+var LOOPBACK_ORIGIN_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost"]);
+var DaemonConfigError = class extends Error {
+  name = "DaemonConfigError";
+};
+var bootstrapBodySchema = z.object({
+  token: z.string().min(1).max(256)
+});
+function createDaemonServer(options) {
+  const serveWeb = options.webDirectory === void 0 ? void 0 : createStaticWebHandler(options.webDirectory);
+  const port = options.port ?? 0;
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new DaemonConfigError("Daemon port must be an integer from 0 through 65535");
+  }
+  const sessionTtlMs = options.sessionTtlMs ?? DEFAULT_SESSION_TTL_MS;
+  if (!Number.isSafeInteger(sessionTtlMs) || sessionTtlMs < 1e3) {
+    throw new DaemonConfigError("Session TTL must be a safe integer of at least 1000ms");
+  }
+  const bootstrapTtlMs = options.bootstrapTtlMs ?? DEFAULT_BOOTSTRAP_TTL_MS;
+  if (!Number.isSafeInteger(bootstrapTtlMs) || bootstrapTtlMs < 1e3) {
+    throw new DaemonConfigError("Bootstrap TTL must be a safe integer of at least 1000ms");
+  }
+  let originUrl;
+  try {
+    originUrl = new URL(options.allowedOrigin);
+  } catch {
+    throw new DaemonConfigError("Allowed browser origin must be a valid loopback HTTP origin");
+  }
+  if (originUrl.protocol !== "http:" || originUrl.origin !== options.allowedOrigin || !LOOPBACK_ORIGIN_HOSTS.has(originUrl.hostname)) {
+    throw new DaemonConfigError(
+      "Allowed browser origin must be an exact http://localhost or http://127.0.0.1 origin"
+    );
+  }
+  const configuredStateDir = path.resolve(options.stateDir);
+  const secret = loadOrCreateSessionSecret(configuredStateDir);
+  const canonicalStateDir = realpathSync(configuredStateDir);
+  const workspace = options.workspaceService ?? createWorkspaceService({ stateDir: configuredStateDir });
+  const piAuth = options.piAuthCoordinator ?? createPiAuthCoordinator({ auth: createPiAuthManager() });
+  const piConfiguration = options.piConfigurationService ?? createPiConfigurationService({
+    getTask: async (taskId) => {
+      const snapshot = await workspace.snapshot();
+      return snapshot.state.tasks.find((task) => task.id === taskId) ?? null;
+    },
+    verifyTaskWorktree: (taskId) => workspace.verifyTaskWorktree(taskId)
+  });
+  const piSessions = options.piSessionCatalogService ?? createPiSessionCatalogService({ workspace });
+  const pitaPreferences = options.pitaPreferencesService ?? createPitaPreferencesService({ stateDir: configuredStateDir });
+  let taskArchive;
+  const taskReview = options.taskReviewService ?? createTaskReviewService({
+    getTask: async (taskId) => {
+      const snapshot = await workspace.snapshot();
+      return snapshot.state.tasks.find((task) => task.id === taskId) ?? null;
+    },
+    getRepository: async (repositoryId) => {
+      const snapshot = await workspace.snapshot();
+      return snapshot.state.repositories.find((repository) => repository.id === repositoryId) ?? null;
+    }
+  });
+  const taskValidation = options.taskValidationService ?? createTaskValidationService({
+    getTask: async (taskId) => {
+      const snapshot = await workspace.snapshot();
+      return snapshot.state.tasks.find((task) => task.id === taskId) ?? null;
+    },
+    getRepository: async (repositoryId) => {
+      const snapshot = await workspace.snapshot();
+      return snapshot.state.repositories.find((repository) => repository.id === repositoryId) ?? null;
+    },
+    recordValidation: (taskId, result) => workspace.recordTaskValidation(taskId, result),
+    // Late-bound reciprocal busy checks; taskCommit and taskMerge are
+    // declared below and only consulted once a run request arrives.
+    isCommitActive: (taskId) => taskCommit.isBusy(taskId),
+    isMergeActive: (taskId) => taskMerge.isBusy(taskId),
+    isArchiveActive: (taskId) => taskArchive.isBusy(taskId),
+    isAgentWorking: async (taskId) => (await runtimeCoordinator.status(taskId)).working
+  });
+  const taskCommit = options.taskCommitService ?? createTaskCommitService({
+    getTask: async (taskId) => {
+      const snapshot = await workspace.snapshot();
+      return snapshot.state.tasks.find((task) => task.id === taskId) ?? null;
+    },
+    getRepository: async (repositoryId) => {
+      const snapshot = await workspace.snapshot();
+      return snapshot.state.repositories.find((repository) => repository.id === repositoryId) ?? null;
+    },
+    isValidationRunning: (taskId) => taskValidation.isRunning(taskId),
+    isMergeActive: (taskId) => taskMerge.isBusy(taskId),
+    isArchiveActive: (taskId) => taskArchive.isBusy(taskId),
+    // The runtime coordinator is declared below; a task with no live
+    // runtime reports an idle, non-working status.
+    isAgentWorking: async (taskId) => (await runtimeCoordinator.status(taskId)).working
+  });
+  const taskMerge = options.taskMergeService ?? createTaskMergeService({
+    getTask: async (taskId) => {
+      const snapshot = await workspace.snapshot();
+      return snapshot.state.tasks.find((task) => task.id === taskId) ?? null;
+    },
+    getRepository: async (repositoryId) => {
+      const snapshot = await workspace.snapshot();
+      return snapshot.state.repositories.find((repository) => repository.id === repositoryId) ?? null;
+    },
+    isValidationRunning: (taskId) => taskValidation.isRunning(taskId),
+    isCommitActive: (taskId) => taskCommit.isBusy(taskId),
+    isArchiveActive: (taskId) => taskArchive.isBusy(taskId),
+    isAgentWorking: async (taskId) => (await runtimeCoordinator.status(taskId)).working,
+    recordPendingMerge: (repositoryId, record) => workspace.recordPendingMerge(repositoryId, record),
+    clearPendingMerge: (repositoryId, preflightId, resolvedHead) => workspace.clearPendingMerge(repositoryId, preflightId, resolvedHead)
+  });
+  const runtimeRecoveryIssues = /* @__PURE__ */ new Map();
+  async function reconcileReadyTaskRuntimeProcess(task) {
+    const owner = task.runtimeProcess;
+    if (owner === void 0) {
+      runtimeRecoveryIssues.delete(task.id);
+      return;
+    }
+    try {
+      await recoverRuntimeProcess(owner, {
+        ...options.runtimeProcessInspector === void 0 ? {} : { inspector: options.runtimeProcessInspector },
+        ...options.runtimeProcessRecoveryGraceMs === void 0 ? {} : { graceMs: options.runtimeProcessRecoveryGraceMs }
+      });
+    } catch (error) {
+      const recoveryError = error instanceof RuntimeProcessRecoveryError ? error : new RuntimeProcessRecoveryError(
+        `Runtime process ${owner.pid} could not be inspected safely`,
+        { cause: error }
+      );
+      runtimeRecoveryIssues.set(task.id, recoveryError.message);
+      throw recoveryError;
+    }
+    await workspace.clearTaskRuntimeProcess(task.id, owner.runtimeGeneration, owner.pid);
+    runtimeRecoveryIssues.delete(task.id);
+  }
+  async function reconcileTaskRuntimeProcess(taskId) {
+    const current = (await workspace.snapshot()).state.tasks.find((task) => task.id === taskId);
+    if (current?.status === "ready") {
+      await reconcileReadyTaskRuntimeProcess(current);
+    }
+  }
+  const allowedOrigin = originUrl.origin;
+  const now = options.now ?? Date.now;
+  let bootstrapToken = generateBootstrapToken();
+  let pendingBootstrapToken = {
+    token: bootstrapToken,
+    expiresAt: now() + bootstrapTtlMs
+  };
+  const configuredPort = port > 0 ? port : null;
+  let boundPort = null;
+  let releaseStateLock = null;
+  let listenOperation = null;
+  let closeOperation = null;
+  let closed = false;
+  const wss = new WebSocketServer({ noServer: true, maxPayload: 4096 });
+  const sockets = /* @__PURE__ */ new Map();
+  const activeRequests = /* @__PURE__ */ new Set();
+  const eventHub = createTaskEventHub({
+    snapshot: (taskId) => runtimeCoordinator.snapshot(taskId)
+  });
+  function broadcastEvent(event) {
+    eventHub.publish(event);
+  }
+  const runtimeCoordinator = options.createRuntimeCoordinator !== void 0 ? options.createRuntimeCoordinator(broadcastEvent) : createTaskRuntimeCoordinator({
+    getTask: async (taskId) => {
+      const snapshot = await workspace.snapshot();
+      return snapshot.state.tasks.find((task) => task.id === taskId) ?? null;
+    },
+    recordTaskSession: (taskId, sessionFile) => workspace.recordTaskSession(taskId, sessionFile),
+    claimRuntimeGeneration: (taskId) => workspace.claimTaskRuntimeGeneration(taskId),
+    reconcileRuntimeProcess: reconcileTaskRuntimeProcess,
+    recordRuntimeProcess: async (taskId, generation, pid) => {
+      const identity = await captureRuntimeProcess(pid, options.runtimeProcessInspector);
+      await workspace.recordTaskRuntimeProcess(taskId, {
+        runtimeGeneration: generation,
+        ...identity,
+        recordedAtMs: now()
+      });
+    },
+    clearRuntimeProcess: (taskId, generation, pid) => workspace.clearTaskRuntimeProcess(taskId, generation, pid),
+    createRuntime: createPiTaskRuntimeFactory({
+      ...options.runtimeSupervisorIgnoreEofForTests === true ? { supervisorIgnoreEofForTests: true } : {}
+    }),
+    validateWorktree: (task) => workspace.verifyTaskWorktree(task.id),
+    isProviderAuthenticated: (providerId) => piAuth.isAuthenticated(providerId),
+    isTaskLifecycleBusy: (taskId) => taskValidation.isRunning(taskId) || taskCommit.isBusy(taskId) || taskMerge.isBusy(taskId) || taskArchive.isBusy(taskId),
+    isTaskArchiving: (taskId) => taskArchive.isBusy(taskId),
+    publish: broadcastEvent
+  });
+  taskArchive = options.taskArchiveService ?? createTaskArchiveService({
+    getTask: async (taskId) => {
+      const snapshot = await workspace.snapshot();
+      return snapshot.state.tasks.find((task) => task.id === taskId) ?? null;
+    },
+    getRepository: async (repositoryId) => {
+      const snapshot = await workspace.snapshot();
+      return snapshot.state.repositories.find((repository) => repository.id === repositoryId) ?? null;
+    },
+    archiveTask: (taskId) => workspace.archiveTask(taskId),
+    restoreTask: (taskId, archivedAtMs) => workspace.restoreTask(taskId, archivedAtMs),
+    disposeRuntime: (taskId) => runtimeCoordinator.stopForArchive(taskId),
+    isRuntimeMutating: (taskId) => runtimeCoordinator.isMutating(taskId),
+    isValidationRunning: (taskId) => taskValidation.isRunning(taskId),
+    isCommitActive: (taskId) => taskCommit.isBusy(taskId),
+    isMergeActive: (taskId) => taskMerge.isBusy(taskId),
+    isMergeRepositoryActive: (repositoryId) => taskMerge.isRepositoryBusy(repositoryId),
+    invalidateCommitPreflight: (taskId) => taskCommit.invalidate(taskId),
+    invalidateMergePreflight: (taskId) => taskMerge.invalidate(taskId)
+  });
+  function rotateBootstrapToken() {
+    bootstrapToken = generateBootstrapToken();
+    pendingBootstrapToken = {
+      token: bootstrapToken,
+      expiresAt: now() + bootstrapTtlMs
+    };
+    return bootstrapToken;
+  }
+  function hostAllowed(req) {
+    const expectedPort = boundPort ?? configuredPort;
+    if (expectedPort === null) {
+      return false;
+    }
+    const host = req.headers.host;
+    return host === `${LOOPBACK_ADDRESS}:${expectedPort}` || host === `localhost:${expectedPort}`;
+  }
+  function sessionFromRequest(req) {
+    const cookie = readCookie(req.headers.cookie, SESSION_COOKIE_NAME);
+    if (cookie === null) {
+      return null;
+    }
+    return verifySessionToken(secret, cookie, now());
+  }
+  function sendJson(res, status, body) {
+    const payload = JSON.stringify(body);
+    res.writeHead(status, {
+      "content-type": "application/json; charset=utf-8",
+      "content-length": Buffer.byteLength(payload),
+      "cache-control": "no-store",
+      "x-content-type-options": "nosniff"
+    });
+    res.end(payload);
+  }
+  function sendError(res, status, error) {
+    sendJson(res, status, { error });
+  }
+  function sendWorkspaceError(res, status, code, message) {
+    sendJson(
+      res,
+      status,
+      workspaceErrorSchema.parse({
+        protocol: PROTOCOL_VERSION,
+        type: "workspace-error",
+        code,
+        message
+      })
+    );
+  }
+  function sendTaskRuntimeError(res, status, code, message) {
+    sendJson(
+      res,
+      status,
+      taskRuntimeErrorSchema.parse({
+        protocol: PROTOCOL_VERSION,
+        type: "task-runtime-error",
+        code,
+        message
+      })
+    );
+  }
+  function sendTaskReviewError(res, status, code, message) {
+    sendJson(
+      res,
+      status,
+      taskReviewErrorSchema.parse({
+        protocol: PROTOCOL_VERSION,
+        type: "task-review-error",
+        code,
+        message
+      })
+    );
+  }
+  function sendTaskValidationError(res, status, code, message) {
+    sendJson(
+      res,
+      status,
+      taskValidationErrorSchema.parse({
+        protocol: PROTOCOL_VERSION,
+        type: "task-validation-error",
+        code,
+        message
+      })
+    );
+  }
+  function sendTaskCommitError(res, status, code, message) {
+    sendJson(
+      res,
+      status,
+      taskCommitErrorSchema.parse({
+        protocol: PROTOCOL_VERSION,
+        type: "task-commit-error",
+        code,
+        message
+      })
+    );
+  }
+  function sendTaskMergeError(res, status, code, message, conflict) {
+    sendJson(
+      res,
+      status,
+      taskMergeErrorSchema.parse({
+        protocol: PROTOCOL_VERSION,
+        type: "task-merge-error",
+        code,
+        message,
+        ...conflict?.conflictPaths === void 0 ? {} : {
+          conflictPaths: conflict.conflictPaths,
+          omittedConflictPaths: conflict.omittedConflictPaths ?? 0
+        }
+      })
+    );
+  }
+  function handleTaskMergeFailure(res, error) {
+    if (error instanceof TaskMergeOperationError) {
+      sendTaskMergeError(res, error.status, error.code, error.message, {
+        conflictPaths: error.conflictPaths,
+        omittedConflictPaths: error.omittedConflictPaths
+      });
+      return;
+    }
+    if (error instanceof WorkspaceOperationError) {
+      sendTaskMergeError(res, error.status, "invalid-request", error.message);
+      return;
+    }
+    sendTaskMergeError(
+      res,
+      503,
+      "merge-failed",
+      "The task merge service is unavailable. Check the daemon output for details."
+    );
+  }
+  function sendPiAuthError(res, status, code, message) {
+    sendJson(
+      res,
+      status,
+      piAuthErrorSchema.parse({
+        protocol: PROTOCOL_VERSION,
+        type: "pi-auth-error",
+        code,
+        message
+      })
+    );
+  }
+  function sendPiConfigurationError(res, status, code, message) {
+    sendJson(
+      res,
+      status,
+      piConfigurationErrorSchema.parse({
+        protocol: PROTOCOL_VERSION,
+        type: "pi-configuration-error",
+        code,
+        message
+      })
+    );
+  }
+  function sendPiSessionCatalogError(res, status, code, message) {
+    sendJson(
+      res,
+      status,
+      piSessionCatalogErrorSchema.parse({
+        protocol: PROTOCOL_VERSION,
+        type: "pi-session-catalog-error",
+        code,
+        message
+      })
+    );
+  }
+  function sendPitaPreferencesError(res, status, code, message) {
+    sendJson(
+      res,
+      status,
+      pitaPreferencesErrorSchema.parse({
+        protocol: PROTOCOL_VERSION,
+        type: "pita-preferences-error",
+        code,
+        message
+      })
+    );
+  }
+  async function handlePiAuthOperation(res, operation, successStatus = 200) {
+    try {
+      sendJson(res, successStatus, await operation());
+    } catch (error) {
+      if (error instanceof PiAuthOperationError) {
+        sendPiAuthError(res, error.status, error.code, error.message);
+        return;
+      }
+      if (error instanceof WorkspaceOperationError) {
+        sendPiAuthError(res, error.status, "invalid-request", error.message);
+        return;
+      }
+      sendPiAuthError(
+        res,
+        503,
+        "auth-unavailable",
+        "Pi authentication is unavailable. Check the daemon output for details."
+      );
+    }
+  }
+  function readBoundedBody(req, maxBytes = MAX_BODY_BYTES) {
+    return new Promise((resolve, reject) => {
+      const chunks = [];
+      let size = 0;
+      let tooLarge = false;
+      let settled = false;
+      const settle = (body) => {
+        if (settled) return;
+        settled = true;
+        resolve(body);
+      };
+      req.on("data", (chunk) => {
+        if (tooLarge) return;
+        size += chunk.length;
+        if (size > maxBytes) {
+          tooLarge = true;
+          chunks.length = 0;
+          settle(null);
+          return;
+        }
+        chunks.push(chunk);
+      });
+      req.on("end", () => settle(tooLarge ? null : Buffer.concat(chunks)));
+      req.on("error", (error) => {
+        if (!settled) reject(error);
+      });
+    });
+  }
+  async function handleBootstrap(req, res) {
+    const body = await readBoundedBody(req);
+    if (body === null) {
+      sendError(res, 413, "body-too-large");
+      return;
+    }
+    let parsed;
+    try {
+      parsed = bootstrapBodySchema.parse(JSON.parse(body.toString("utf8")));
+    } catch {
+      sendError(res, 400, "invalid-body");
+      return;
+    }
+    if (pendingBootstrapToken === null || pendingBootstrapToken.expiresAt <= now() || !tokensMatch(pendingBootstrapToken.token, parsed.token)) {
+      sendError(res, 403, "invalid-bootstrap-token");
+      return;
+    }
+    pendingBootstrapToken = null;
+    const session = createSessionToken(secret, {
+      nowMs: now(),
+      ttlMs: sessionTtlMs
+    });
+    setSessionCookie(res, session);
+    res.writeHead(204);
+    res.end();
+  }
+  async function readJsonBody(req, maxBytes = MAX_BODY_BYTES) {
+    const body = await readBoundedBody(req, maxBytes);
+    if (body === null) {
+      throw new WorkspaceOperationError("invalid-request", "The request body is too large.", 413);
+    }
+    try {
+      return JSON.parse(body.toString("utf8"));
+    } catch {
+      throw new WorkspaceOperationError(
+        "invalid-request",
+        "The request body must be valid JSON.",
+        400
+      );
+    }
+  }
+  async function handleWorkspaceOperation(res, operation, successStatus = 200) {
+    try {
+      sendJson(res, successStatus, await operation());
+    } catch (error) {
+      if (error instanceof WorkspaceOperationError) {
+        sendWorkspaceError(res, error.status, error.code, error.message);
+        return;
+      }
+      sendWorkspaceError(
+        res,
+        503,
+        "workspace-unavailable",
+        "The local workspace is unavailable. Check the daemon output for details."
+      );
+    }
+  }
+  function setSessionCookie(res, session) {
+    res.setHeader(
+      "set-cookie",
+      `${SESSION_COOKIE_NAME}=${session.token}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${Math.floor(sessionTtlMs / 1e3)}`
+    );
+  }
+  function handleSession(res) {
+    const session = createSessionToken(secret, {
+      nowMs: now(),
+      ttlMs: sessionTtlMs
+    });
+    setSessionCookie(res, session);
+    sendJson(
+      res,
+      200,
+      serviceSessionSchema.parse({
+        protocol: PROTOCOL_VERSION,
+        type: "service-session",
+        authenticated: true,
+        sessionExpiresAt: session.expiresAt
+      })
+    );
+  }
+  async function handleRequest(req, res) {
+    res.setHeader("vary", "origin");
+    if (!hostAllowed(req)) {
+      sendError(res, 403, "forbidden-host");
+      return;
+    }
+    const origin = req.headers.origin;
+    if (origin !== void 0 && origin !== allowedOrigin) {
+      sendError(res, 403, "forbidden-origin");
+      return;
+    }
+    if (origin === allowedOrigin) {
+      res.setHeader("access-control-allow-origin", allowedOrigin);
+      res.setHeader("access-control-allow-credentials", "true");
+    }
+    if (serveWeb && await serveWeb(req, res)) return;
+    if (req.method === "OPTIONS") {
+      if (origin !== allowedOrigin) {
+        sendError(res, 403, "forbidden-origin");
+        return;
+      }
+      res.writeHead(204, {
+        "access-control-allow-methods": "GET, POST, OPTIONS",
+        "access-control-allow-headers": "content-type",
+        "access-control-max-age": "600"
+      });
+      res.end();
+      return;
+    }
+    const requestUrl = new URL(req.url ?? "/", `http://${LOOPBACK_ADDRESS}`);
+    const pathname = requestUrl.pathname;
+    if (pathname === "/api/auth/bootstrap" && req.method === "POST") {
+      if (origin !== allowedOrigin) {
+        sendError(res, 403, "origin-required");
+        return;
+      }
+      await handleBootstrap(req, res);
+      return;
+    }
+    if (pathname === "/api/session" && req.method === "GET") {
+      const claims = sessionFromRequest(req);
+      if (claims === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      handleSession(res);
+      return;
+    }
+    if (pathname === "/api/workspace" && req.method === "GET") {
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      await handleWorkspaceOperation(res, () => workspace.snapshot());
+      return;
+    }
+    if (pathname === "/api/preferences") {
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      const rawRepositoryId = requestUrl.searchParams.get("repositoryId");
+      const repositoryId = rawRepositoryId === null || rawRepositoryId === "" ? null : z.uuid().safeParse(rawRepositoryId);
+      if (repositoryId !== null && !repositoryId.success) {
+        sendPitaPreferencesError(
+          res,
+          400,
+          "invalid-request",
+          "Choose a known repository before loading appearance preferences."
+        );
+        return;
+      }
+      const selectedRepositoryId = repositoryId === null ? null : repositoryId.data;
+      try {
+        if (selectedRepositoryId !== null) {
+          const snapshot = await workspace.snapshot();
+          if (!snapshot.state.repositories.some((entry) => entry.id === selectedRepositoryId)) {
+            sendPitaPreferencesError(
+              res,
+              404,
+              "repository-not-found",
+              "The selected repository is no longer registered."
+            );
+            return;
+          }
+        }
+        if (req.method === "GET") {
+          sendJson(
+            res,
+            200,
+            pitaPreferencesSnapshotSchema.parse(
+              await pitaPreferences.snapshot(selectedRepositoryId)
+            )
+          );
+          return;
+        }
+        if (req.method === "POST") {
+          if (origin !== allowedOrigin) {
+            sendError(res, 403, "origin-required");
+            return;
+          }
+          const parsed = updatePitaPreferencesRequestSchema.safeParse(await readJsonBody(req));
+          if (!parsed.success || parsed.data.repositoryId !== selectedRepositoryId) {
+            sendPitaPreferencesError(
+              res,
+              400,
+              "invalid-request",
+              "The appearance request does not match the selected repository."
+            );
+            return;
+          }
+          if (parsed.data.scope === "repository" && selectedRepositoryId === null) {
+            sendPitaPreferencesError(
+              res,
+              400,
+              "invalid-request",
+              "Choose a repository before changing repository appearance."
+            );
+            return;
+          }
+          sendJson(
+            res,
+            200,
+            pitaPreferencesSnapshotSchema.parse(await pitaPreferences.update(parsed.data))
+          );
+          return;
+        }
+        sendError(res, 404, "not-found");
+      } catch (error) {
+        if (error instanceof PitaPreferencesOperationError) {
+          sendPitaPreferencesError(res, error.status, error.code, error.message);
+          return;
+        }
+        sendPitaPreferencesError(
+          res,
+          503,
+          "preferences-unavailable",
+          "Webdesk appearance preferences are unavailable. Check the daemon output for details."
+        );
+      }
+      return;
+    }
+    if (pathname === "/api/pi/auth" && req.method === "GET") {
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      await handlePiAuthOperation(
+        res,
+        async () => piAuthSnapshotSchema.parse(await piAuth.snapshot())
+      );
+      return;
+    }
+    if (pathname === "/api/pi/sessions") {
+      if (req.method !== "GET") {
+        sendError(res, 404, "not-found");
+        return;
+      }
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      try {
+        sendJson(res, 200, piSessionCatalogSnapshotSchema.parse(await piSessions.refresh()));
+      } catch (error) {
+        if (error instanceof PiSessionCatalogOperationError) {
+          sendPiSessionCatalogError(res, error.status, error.code, error.message);
+          return;
+        }
+        sendPiSessionCatalogError(
+          res,
+          503,
+          "session-unavailable",
+          "Pi sessions could not be inspected. Check the daemon output for details."
+        );
+      }
+      return;
+    }
+    if (pathname === "/api/pi/sessions/continue") {
+      if (req.method !== "POST") {
+        sendError(res, 404, "not-found");
+        return;
+      }
+      if (origin !== allowedOrigin) {
+        sendError(res, 403, "origin-required");
+        return;
+      }
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      try {
+        const parsed = continuePiSessionRequestSchema.safeParse(await readJsonBody(req));
+        if (!parsed.success) {
+          throw new PiSessionCatalogOperationError(
+            "invalid-request",
+            "Choose an existing Pi session, repository, task title, and base revision.",
+            400
+          );
+        }
+        sendJson(
+          res,
+          201,
+          continuePiSessionResultSchema.parse(
+            await piSessions.continueInNewTask(parsed.data)
+          )
+        );
+      } catch (error) {
+        if (error instanceof PiSessionCatalogOperationError) {
+          sendPiSessionCatalogError(res, error.status, error.code, error.message);
+          return;
+        }
+        if (error instanceof WorkspaceOperationError) {
+          sendPiSessionCatalogError(
+            res,
+            error.status,
+            "continuation-unavailable",
+            error.message
+          );
+          return;
+        }
+        sendPiSessionCatalogError(
+          res,
+          503,
+          "continuation-unavailable",
+          "The isolated task could not be created from this Pi session. Check the daemon output for details."
+        );
+      }
+      return;
+    }
+    const piConfigurationRoute = /^\/api\/tasks\/([^/]+)\/pi-configuration$/.exec(pathname);
+    if (piConfigurationRoute !== null) {
+      if (req.method !== "GET") {
+        sendError(res, 404, "not-found");
+        return;
+      }
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      const taskId = z.uuid().safeParse(piConfigurationRoute[1] ?? "");
+      if (!taskId.success) {
+        sendPiConfigurationError(res, 400, "invalid-request", "Choose a known task.");
+        return;
+      }
+      try {
+        sendJson(
+          res,
+          200,
+          piConfigurationSnapshotSchema.parse(await piConfiguration.inspect(taskId.data))
+        );
+      } catch (error) {
+        if (error instanceof PiConfigurationOperationError) {
+          sendPiConfigurationError(res, error.status, error.code, error.message);
+          return;
+        }
+        sendPiConfigurationError(
+          res,
+          503,
+          "inspection-failed",
+          "Pi configuration could not be inspected. Check the daemon output for details."
+        );
+      }
+      return;
+    }
+    if (pathname === "/api/pi/auth/login" && req.method === "POST") {
+      if (origin !== allowedOrigin) {
+        sendError(res, 403, "origin-required");
+        return;
+      }
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      await handlePiAuthOperation(
+        res,
+        async () => {
+          const parsed = startPiAuthRequestSchema.safeParse(await readJsonBody(req));
+          if (!parsed.success) {
+            throw new PiAuthOperationError(
+              "invalid-request",
+              "Choose a Pi provider and sign-in method.",
+              400
+            );
+          }
+          return piAuthOperationSchema.parse(
+            piAuth.startLogin(parsed.data.providerId, parsed.data.method)
+          );
+        },
+        201
+      );
+      return;
+    }
+    const piAuthOperationRoute = /^\/api\/pi\/auth\/operations\/([^/]+)(?:\/(respond|cancel))?$/.exec(pathname);
+    if (piAuthOperationRoute !== null) {
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      const operationId = z.uuid().safeParse(piAuthOperationRoute[1] ?? "");
+      if (!operationId.success) {
+        sendPiAuthError(res, 400, "invalid-request", "Choose a known Pi login operation.");
+        return;
+      }
+      const action = piAuthOperationRoute[2];
+      if (action === void 0 && req.method === "GET") {
+        await handlePiAuthOperation(
+          res,
+          () => piAuthOperationSchema.parse(piAuth.operation(operationId.data))
+        );
+        return;
+      }
+      if (req.method === "POST" && (action === "respond" || action === "cancel")) {
+        if (origin !== allowedOrigin) {
+          sendError(res, 403, "origin-required");
+          return;
+        }
+        await handlePiAuthOperation(res, async () => {
+          if (action === "cancel") {
+            return piAuthOperationSchema.parse(piAuth.cancel(operationId.data));
+          }
+          const parsed = respondPiAuthRequestSchema.safeParse(
+            await readJsonBody(req, MAX_PROMPT_BODY_BYTES)
+          );
+          if (!parsed.success) {
+            throw new PiAuthOperationError(
+              "invalid-request",
+              "Provide a response for the active Pi login prompt.",
+              400
+            );
+          }
+          return piAuthOperationSchema.parse(
+            piAuth.respond(operationId.data, parsed.data.promptId, parsed.data.value)
+          );
+        });
+        return;
+      }
+    }
+    if (pathname === "/api/repositories" && req.method === "POST") {
+      if (origin !== allowedOrigin) {
+        sendError(res, 403, "origin-required");
+        return;
+      }
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      await handleWorkspaceOperation(res, async () => {
+        const parsed = registerRepositoryRequestSchema.safeParse(await readJsonBody(req));
+        if (!parsed.success) {
+          throw new WorkspaceOperationError(
+            "invalid-request",
+            "Choose an absolute local repository path.",
+            400
+          );
+        }
+        return workspace.registerRepository(parsed.data);
+      });
+      return;
+    }
+    if (pathname === "/api/tasks" && req.method === "POST") {
+      if (origin !== allowedOrigin) {
+        sendError(res, 403, "origin-required");
+        return;
+      }
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      await handleWorkspaceOperation(
+        res,
+        async () => {
+          const parsed = createTaskRequestSchema.safeParse(await readJsonBody(req));
+          if (!parsed.success) {
+            throw new WorkspaceOperationError(
+              "invalid-request",
+              "Provide a repository, task title, and base revision.",
+              400
+            );
+          }
+          return workspace.createTask(parsed.data);
+        },
+        201
+      );
+      return;
+    }
+    const taskArchiveRoute = /^\/api\/tasks\/([^/]+)\/(archive|restore)$/.exec(pathname);
+    if (taskArchiveRoute !== null) {
+      if (req.method !== "POST") {
+        sendError(res, 404, "not-found");
+        return;
+      }
+      if (origin !== allowedOrigin) {
+        sendError(res, 403, "origin-required");
+        return;
+      }
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      const taskId = z.uuid().safeParse(taskArchiveRoute[1] ?? "");
+      if (!taskId.success) {
+        await handleWorkspaceOperation(res, async () => {
+          throw new WorkspaceOperationError("invalid-request", "Choose a known task.", 400);
+        });
+        return;
+      }
+      await handleWorkspaceOperation(res, async () => {
+        const request = taskArchiveRequestSchema.safeParse(await readJsonBody(req));
+        if (!request.success) {
+          throw new WorkspaceOperationError(
+            "invalid-request",
+            "Archive and restore requests do not accept additional options.",
+            400
+          );
+        }
+        return taskArchiveRoute[2] === "archive" ? taskArchive.archive(taskId.data) : taskArchive.restore(taskId.data);
+      });
+      return;
+    }
+    const taskCommitRoute = /^\/api\/tasks\/([^/]+)\/commit(?:\/(preflight))?$/.exec(pathname);
+    if (taskCommitRoute !== null) {
+      if (req.method !== "POST") {
+        sendError(res, 404, "not-found");
+        return;
+      }
+      if (origin !== allowedOrigin) {
+        sendError(res, 403, "origin-required");
+        return;
+      }
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      const taskId = z.uuid().safeParse(taskCommitRoute[1] ?? "");
+      if (!taskId.success) {
+        sendTaskCommitError(res, 400, "invalid-request", "Choose a known task.");
+        return;
+      }
+      try {
+        if (taskCommitRoute[2] === "preflight") {
+          const parsed2 = taskCommitPreflightRequestSchema.safeParse(
+            await readJsonBody(req, MAX_PROMPT_BODY_BYTES)
+          );
+          if (!parsed2.success) {
+            throw new TaskCommitOperationError(
+              "invalid-request",
+              "Provide a non-empty commit message within Webdesk's length bound and without unsafe invisible characters.",
+              400
+            );
+          }
+          sendJson(
+            res,
+            200,
+            taskCommitPreflightSchema.parse(
+              await taskCommit.preflight(taskId.data, parsed2.data.message)
+            )
+          );
+          return;
+        }
+        const parsed = executeTaskCommitRequestSchema.safeParse(await readJsonBody(req));
+        if (!parsed.success) {
+          throw new TaskCommitOperationError(
+            "invalid-request",
+            "Provide the current commit preflight and an explicit validation acknowledgement.",
+            400
+          );
+        }
+        sendJson(
+          res,
+          200,
+          taskCommitResultSchema.parse(await taskCommit.execute(taskId.data, parsed.data))
+        );
+      } catch (error) {
+        if (error instanceof TaskCommitOperationError) {
+          sendTaskCommitError(res, error.status, error.code, error.message);
+          return;
+        }
+        if (error instanceof WorkspaceOperationError) {
+          sendTaskCommitError(res, error.status, "invalid-request", error.message);
+          return;
+        }
+        sendTaskCommitError(
+          res,
+          503,
+          "commit-failed",
+          "The task commit service is unavailable. Check the daemon output for details."
+        );
+      }
+      return;
+    }
+    const taskMergeRoute = /^\/api\/tasks\/([^/]+)\/merge(?:\/(preflight))?$/.exec(pathname);
+    if (taskMergeRoute !== null) {
+      if (req.method !== "POST") {
+        sendError(res, 404, "not-found");
+        return;
+      }
+      if (origin !== allowedOrigin) {
+        sendError(res, 403, "origin-required");
+        return;
+      }
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      const taskId = z.uuid().safeParse(taskMergeRoute[1] ?? "");
+      if (!taskId.success) {
+        sendTaskMergeError(res, 400, "invalid-request", "Choose a known task.");
+        return;
+      }
+      try {
+        if (taskMergeRoute[2] === "preflight") {
+          const parsed2 = taskMergePreflightRequestSchema.safeParse(
+            await readJsonBody(req, MAX_PROMPT_BODY_BYTES)
+          );
+          if (!parsed2.success) {
+            throw new TaskMergeOperationError(
+              "invalid-request",
+              "Provide an optional merge message within Webdesk's length bound and without unsafe invisible characters.",
+              400
+            );
+          }
+          sendJson(
+            res,
+            200,
+            taskMergePreflightSchema.parse(await taskMerge.preflight(taskId.data, parsed2.data))
+          );
+          return;
+        }
+        const parsed = executeTaskMergeRequestSchema.safeParse(await readJsonBody(req));
+        if (!parsed.success) {
+          throw new TaskMergeOperationError(
+            "invalid-request",
+            "Provide the current merge preflight and an explicit validation acknowledgement.",
+            400
+          );
+        }
+        sendJson(
+          res,
+          200,
+          taskMergeResultSchema.parse(await taskMerge.execute(taskId.data, parsed.data))
+        );
+      } catch (error) {
+        handleTaskMergeFailure(res, error);
+      }
+      return;
+    }
+    const repositoryMergeSyncRoute = /^\/api\/repositories\/([^/]+)\/merge-sync$/.exec(pathname);
+    if (repositoryMergeSyncRoute !== null) {
+      if (req.method !== "POST") {
+        sendError(res, 404, "not-found");
+        return;
+      }
+      if (origin !== allowedOrigin) {
+        sendError(res, 403, "origin-required");
+        return;
+      }
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      const repositoryId = z.uuid().safeParse(repositoryMergeSyncRoute[1] ?? "");
+      if (!repositoryId.success) {
+        sendTaskMergeError(res, 400, "invalid-request", "Choose a known repository.");
+        return;
+      }
+      try {
+        const request = repositoryMergeSyncRequestSchema.safeParse(await readJsonBody(req));
+        if (!request.success) {
+          throw new TaskMergeOperationError(
+            "invalid-request",
+            "Choose whether an inspected externally moved target should dismiss merge recovery.",
+            400
+          );
+        }
+        sendJson(
+          res,
+          200,
+          repositoryMergeSyncResultSchema.parse(
+            await taskMerge.syncRepository(repositoryId.data, request.data)
+          )
+        );
+      } catch (error) {
+        handleTaskMergeFailure(res, error);
+      }
+      return;
+    }
+    const taskRuntimeRoute = /^\/api\/tasks\/([^/]+)\/(runtime|restart|model|prompt|steer|abort|approval|session-tree|review|validation)$/.exec(
+      pathname
+    );
+    if (taskRuntimeRoute !== null && taskRuntimeRoute[2] === "review" && req.method === "GET") {
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      const taskId = z.uuid().safeParse(taskRuntimeRoute[1] ?? "");
+      if (!taskId.success) {
+        sendTaskReviewError(res, 400, "invalid-request", "Choose a known task.");
+        return;
+      }
+      try {
+        sendJson(res, 200, taskReviewSchema.parse(await taskReview.review(taskId.data)));
+      } catch (error) {
+        if (error instanceof TaskReviewOperationError) {
+          sendTaskReviewError(res, error.status, error.code, error.message);
+          return;
+        }
+        sendTaskReviewError(
+          res,
+          503,
+          "review-failed",
+          "The task review service is unavailable. Check the daemon output for details."
+        );
+      }
+      return;
+    }
+    if (taskRuntimeRoute !== null && taskRuntimeRoute[2] === "validation") {
+      if (req.method !== "GET" && req.method !== "POST") {
+        sendError(res, 404, "not-found");
+        return;
+      }
+      if (req.method === "POST" && origin !== allowedOrigin) {
+        sendError(res, 403, "origin-required");
+        return;
+      }
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      const taskId = z.uuid().safeParse(taskRuntimeRoute[1] ?? "");
+      if (!taskId.success) {
+        sendTaskValidationError(res, 400, "invalid-request", "Choose a known task.");
+        return;
+      }
+      try {
+        if (req.method === "GET") {
+          sendJson(res, 200, taskValidationSchema.parse(await taskValidation.status(taskId.data)));
+          return;
+        }
+        const parsed = runTaskValidationRequestSchema.safeParse(
+          await readJsonBody(req, MAX_PROMPT_BODY_BYTES)
+        );
+        if (!parsed.success) {
+          throw new TaskValidationOperationError(
+            "invalid-request",
+            "Provide a non-empty validation command within Webdesk's length bound and without unsafe invisible characters.",
+            400
+          );
+        }
+        sendJson(
+          res,
+          200,
+          taskValidationSchema.parse(await taskValidation.run(taskId.data, parsed.data.command))
+        );
+      } catch (error) {
+        if (error instanceof TaskValidationOperationError) {
+          sendTaskValidationError(res, error.status, error.code, error.message);
+          return;
+        }
+        if (error instanceof WorkspaceOperationError) {
+          sendTaskValidationError(res, error.status, "invalid-request", error.message);
+          return;
+        }
+        sendTaskValidationError(
+          res,
+          503,
+          "validation-failed",
+          "The task validation service is unavailable. Check the daemon output for details."
+        );
+      }
+      return;
+    }
+    if (taskRuntimeRoute !== null && (taskRuntimeRoute[2] === "runtime" || taskRuntimeRoute[2] === "session-tree") && req.method === "GET") {
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      const taskId = z.uuid().safeParse(taskRuntimeRoute[1] ?? "");
+      if (!taskId.success) {
+        sendTaskRuntimeError(res, 400, "invalid-request", "Choose a known task.");
+        return;
+      }
+      try {
+        if (taskRuntimeRoute[2] === "session-tree") {
+          sendJson(
+            res,
+            200,
+            taskSessionTreeSchema.parse(await runtimeCoordinator.sessionTree(taskId.data))
+          );
+        } else {
+          const status = await runtimeCoordinator.status(taskId.data);
+          const recoveryIssue = runtimeRecoveryIssues.get(taskId.data);
+          sendJson(
+            res,
+            200,
+            taskRuntimeStatusSchema.parse(
+              recoveryIssue === void 0 || status.state !== "idle" && status.state !== "exited" && status.state !== "failed" ? status : {
+                ...status,
+                detail: `Runtime recovery required: ${recoveryIssue} Stop any remaining task processes, then choose Start Pi to retry.`
+              }
+            )
+          );
+        }
+      } catch (error) {
+        if (error instanceof TaskRuntimeOperationError) {
+          sendTaskRuntimeError(res, error.status, error.code, error.message);
+          return;
+        }
+        sendTaskRuntimeError(
+          res,
+          503,
+          "runtime-unavailable",
+          "The task runtime service is unavailable. Check the daemon output for details."
+        );
+      }
+      return;
+    }
+    if (taskRuntimeRoute !== null && taskRuntimeRoute[2] !== "session-tree" && taskRuntimeRoute[2] !== "review" && req.method === "POST") {
+      if (origin !== allowedOrigin) {
+        sendError(res, 403, "origin-required");
+        return;
+      }
+      if (sessionFromRequest(req) === null) {
+        sendError(res, 401, "unauthenticated");
+        return;
+      }
+      const taskId = z.uuid().safeParse(taskRuntimeRoute[1] ?? "");
+      if (!taskId.success) {
+        sendTaskRuntimeError(res, 400, "invalid-request", "Choose a known task.");
+        return;
+      }
+      const action = taskRuntimeRoute[2];
+      try {
+        let status;
+        if (action === "runtime") {
+          status = await runtimeCoordinator.ensure(taskId.data);
+        } else if (action === "restart") {
+          status = await runtimeCoordinator.restart(taskId.data);
+        } else if (action === "model") {
+          const parsed = selectTaskModelRequestSchema.safeParse(await readJsonBody(req));
+          if (!parsed.success) {
+            throw new TaskRuntimeOperationError(
+              "invalid-request",
+              "Choose an available Pi model.",
+              400
+            );
+          }
+          status = await runtimeCoordinator.setModel(
+            taskId.data,
+            parsed.data.provider,
+            parsed.data.modelId
+          );
+        } else if (action === "prompt") {
+          const parsed = promptTaskRequestSchema.safeParse(
+            await readJsonBody(req, MAX_PROMPT_BODY_BYTES)
+          );
+          if (!parsed.success) {
+            throw new TaskRuntimeOperationError(
+              "invalid-request",
+              "Provide a non-empty prompt message.",
+              400
+            );
+          }
+          if (taskValidation.isRunning(taskId.data) || taskCommit.isBusy(taskId.data) || taskMerge.isBusy(taskId.data)) {
+            throw new TaskRuntimeOperationError(
+              "runtime-busy",
+              "A validation, commit, or merge operation is active for this task. Wait for it to finish before prompting Pi.",
+              409
+            );
+          }
+          status = await runtimeCoordinator.prompt(taskId.data, parsed.data.message);
+        } else if (action === "steer") {
+          const parsed = steerTaskRequestSchema.safeParse(
+            await readJsonBody(req, MAX_PROMPT_BODY_BYTES)
+          );
+          if (!parsed.success) {
+            throw new TaskRuntimeOperationError(
+              "invalid-request",
+              "Provide a non-empty steering message.",
+              400
+            );
+          }
+          status = await runtimeCoordinator.steer(taskId.data, parsed.data.message);
+        } else if (action === "approval") {
+          const parsed = resolveTaskApprovalRequestSchema.safeParse(await readJsonBody(req));
+          if (!parsed.success) {
+            throw new TaskRuntimeOperationError(
+              "invalid-request",
+              "Choose the current approval and an explicit decision.",
+              400
+            );
+          }
+          status = await runtimeCoordinator.resolveApproval(
+            taskId.data,
+            parsed.data.approvalId,
+            parsed.data.decision
+          );
+        } else {
+          status = await runtimeCoordinator.abort(taskId.data);
+        }
+        sendJson(res, 200, taskRuntimeStatusSchema.parse(status));
+      } catch (error) {
+        if (error instanceof TaskRuntimeOperationError) {
+          sendTaskRuntimeError(res, error.status, error.code, error.message);
+          return;
+        }
+        if (error instanceof WorkspaceOperationError) {
+          sendTaskRuntimeError(res, error.status, "invalid-request", error.message);
+          return;
+        }
+        sendTaskRuntimeError(
+          res,
+          503,
+          "runtime-unavailable",
+          "The task runtime service is unavailable. Check the daemon output for details."
+        );
+      }
+      return;
+    }
+    sendError(res, 404, "not-found");
+  }
+  function rejectUpgrade(socket, status, reason) {
+    socket.end(`HTTP/1.1 ${status} ${reason}\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+  }
+  function handleUpgrade(req, socket, head) {
+    socket.on("error", () => socket.destroy());
+    const pathname = new URL(req.url ?? "/", `http://${LOOPBACK_ADDRESS}`).pathname;
+    if (pathname !== "/api/events") {
+      rejectUpgrade(socket, 404, "Not Found");
+      return;
+    }
+    if (!hostAllowed(req)) {
+      rejectUpgrade(socket, 403, "Forbidden");
+      return;
+    }
+    if (req.headers.origin !== allowedOrigin) {
+      rejectUpgrade(socket, 403, "Forbidden");
+      return;
+    }
+    const claims = sessionFromRequest(req);
+    if (claims === null) {
+      rejectUpgrade(socket, 401, "Unauthorized");
+      return;
+    }
+    wss.handleUpgrade(req, socket, head, (ws) => {
+      ws.on("error", () => ws.terminate());
+      const expiryDelayMs = Math.max(0, claims.expiresAt - now());
+      const expiryTimer = setTimeout(() => {
+        if (sockets.has(ws)) {
+          ws.close(4001, "session-expired");
+        }
+      }, expiryDelayMs);
+      expiryTimer.unref?.();
+      sockets.set(ws, expiryTimer);
+      const channel = eventHub.connect((message) => {
+        if (ws.readyState === WebSocket.OPEN) {
+          ws.send(JSON.stringify(message));
+        }
+      });
+      ws.on("message", (data, isBinary) => {
+        let parsed;
+        try {
+          parsed = safeParseClientMessage(JSON.parse(isBinary ? "" : String(data)));
+        } catch {
+          ws.close(1008, "invalid-message");
+          return;
+        }
+        if (!parsed.success) {
+          ws.close(1008, "invalid-message");
+          return;
+        }
+        channel.subscribe(parsed.data);
+      });
+      ws.on("close", () => {
+        channel.close();
+        const timer = sockets.get(ws);
+        if (timer !== void 0) {
+          clearTimeout(timer);
+        }
+        sockets.delete(ws);
+      });
+      ws.send(
+        JSON.stringify(
+          serverControlMessageSchema.parse({
+            protocol: PROTOCOL_VERSION,
+            type: "service-ready",
+            timestamp: now(),
+            sessionExpiresAt: claims.expiresAt
+          })
+        )
+      );
+    });
+  }
+  const httpServer = createServer((req, res) => {
+    const operation = handleRequest(req, res).catch(() => {
+      if (!res.headersSent) {
+        sendError(res, 500, "internal-error");
+      } else {
+        res.end();
+      }
+    });
+    activeRequests.add(operation);
+    void operation.then(
+      () => activeRequests.delete(operation),
+      () => activeRequests.delete(operation)
+    );
+  });
+  httpServer.on("upgrade", handleUpgrade);
+  return {
+    get bootstrapToken() {
+      return bootstrapToken;
+    },
+    rotateBootstrapToken,
+    listen() {
+      if (closed) {
+        return Promise.reject(new DaemonConfigError("Daemon server is closed"));
+      }
+      if (listenOperation !== null || releaseStateLock !== null || httpServer.listening) {
+        return Promise.reject(
+          new DaemonConfigError("Daemon server is already starting or listening")
+        );
+      }
+      const operation = (async () => {
+        let acquiredLock = null;
+        try {
+          acquiredLock = await acquireDaemonStateLock(canonicalStateDir);
+          if (closed) throw new DaemonConfigError("Daemon server is closed");
+          releaseStateLock = acquiredLock;
+          await workspace.initialize();
+          if (closed) throw new DaemonConfigError("Daemon server is closed");
+          const startupSnapshot = await workspace.snapshot();
+          for (const task of startupSnapshot.state.tasks) {
+            if (task.status !== "ready" || task.runtimeProcess === void 0) continue;
+            try {
+              await reconcileReadyTaskRuntimeProcess(task);
+            } catch (error) {
+              if (error instanceof RuntimeProcessRecoveryError) continue;
+              throw error;
+            }
+          }
+          if (closed) throw new DaemonConfigError("Daemon server is closed");
+          return await new Promise((resolve, reject) => {
+            const onError = (error) => reject(error);
+            httpServer.once("error", onError);
+            httpServer.listen(port, LOOPBACK_ADDRESS, () => {
+              httpServer.removeListener("error", onError);
+              if (closed) {
+                httpServer.close(() => reject(new DaemonConfigError("Daemon server is closed")));
+                httpServer.closeAllConnections();
+                return;
+              }
+              const address = httpServer.address();
+              if (address === null || typeof address === "string") {
+                reject(new Error("daemon server did not bind to a TCP port"));
+                return;
+              }
+              boundPort = address.port;
+              resolve({ address: address.address, port: address.port });
+            });
+          });
+        } catch (error) {
+          if (releaseStateLock === acquiredLock) {
+            releaseStateLock = null;
+          }
+          await acquiredLock?.().catch(() => void 0);
+          throw error;
+        }
+      })();
+      listenOperation = operation;
+      void operation.then(
+        () => {
+          if (listenOperation === operation) listenOperation = null;
+        },
+        () => {
+          if (listenOperation === operation) listenOperation = null;
+        }
+      );
+      return operation;
+    },
+    close() {
+      if (closeOperation !== null) return closeOperation;
+      closed = true;
+      const pendingListen = listenOperation;
+      closeOperation = (async () => {
+        await pendingListen?.catch(() => void 0);
+        for (const [ws, timer] of sockets) {
+          clearTimeout(timer);
+          ws.terminate();
+        }
+        sockets.clear();
+        wss.close();
+        const runtimeDisposal = runtimeCoordinator.disposeAll();
+        const validationDisposal = taskValidation.disposeAll();
+        piAuth.dispose();
+        if (httpServer.listening) {
+          await new Promise((resolve, reject) => {
+            httpServer.close((error) => {
+              if (error) {
+                reject(error);
+              } else {
+                resolve();
+              }
+            });
+            httpServer.closeAllConnections();
+          });
+        }
+        await runtimeDisposal;
+        await validationDisposal;
+        await Promise.allSettled([...activeRequests]);
+        boundPort = null;
+        const release = releaseStateLock;
+        releaseStateLock = null;
+        await release?.();
+      })();
+      return closeOperation;
+    },
+    injectConnection(socket) {
+      if (closed) {
+        socket.destroy();
+        return;
+      }
+      httpServer.emit("connection", socket);
+    }
+  };
+}
+export {
+  DaemonConfigError,
+  createDaemonServer
+};