pi2web 0.2.0

package/dist/server.js

@@ -0,0 +1,419 @@
+import http from 'node:http';
+import path from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { randomUUID } from 'node:crypto';
+import { WebSocketServer, WebSocket } from 'ws';
+import { AuthStore } from './auth.js';
+import { WorkspaceStore } from './workspaces.js';
+import { AgentManager } from './agents.js';
+import { TerminalManager } from './terminals.js';
+import { MetadataStore } from './metadata-store.js';
+import { SessionManager, VERSION as PI_VERSION } from '@earendil-works/pi-coding-agent';
+import pkg from '../package.json' with { type: 'json' };
+const json = (res, status, data) => { res.statusCode = status; res.setHeader('content-type', 'application/json'); res.end(JSON.stringify(data)); };
+const webRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../web'), require = createRequire(import.meta.url);
+const markedBrowser = path.join(path.dirname(require.resolve('marked/package.json')), 'lib', 'marked.umd.js');
+const webFiles = { '/': { file: 'index.html', type: 'text/html; charset=utf-8' }, '/index.html': { file: 'index.html', type: 'text/html; charset=utf-8' }, '/app.js': { file: 'app.js', type: 'text/javascript; charset=utf-8' }, '/styles.css': { file: 'styles.css', type: 'text/css; charset=utf-8' }, '/icon.svg': { file: 'icon.svg', type: 'image/svg+xml' }, '/favicon.ico': { file: 'icon.svg', type: 'image/svg+xml' }, '/vendor/xterm.js': { file: require.resolve('@xterm/xterm'), type: 'text/javascript; charset=utf-8' }, '/vendor/xterm.css': { file: require.resolve('@xterm/xterm/css/xterm.css'), type: 'text/css; charset=utf-8' }, '/vendor/addon-fit.js': { file: require.resolve('@xterm/addon-fit'), type: 'text/javascript; charset=utf-8' }, '/vendor/marked.js': { file: markedBrowser, type: 'text/javascript; charset=utf-8' }, '/vendor/dompurify.js': { file: require.resolve('dompurify/purify.min.js'), type: 'text/javascript; charset=utf-8' } };
+export class RemotePiServer {
+    server;
+    wss;
+    auth;
+    workspaces;
+    agents;
+    terminals;
+    metadata;
+    opts;
+    dataDir;
+    clients = new Set();
+    unsubscribeMetadata;
+    sessionIndexTimes = new Map();
+    sessionIndexJobs = new Map();
+    agentIndexJobs = new Map();
+    voice;
+    mailNotifier;
+    loginFailures = new Map();
+    loginWindowMs = 60_000;
+    loginMaxFailures = 10;
+    loginLockMs = 60_000;
+    loginMaxLockMs = 15 * 60_000;
+    constructor(options = {}) { this.opts = { host: options.host ?? '127.0.0.1', port: options.port ?? 11318 }; this.dataDir = options.dataDir ?? path.join(process.env.HOME ?? '.', '.pi', 'remote-pi'); this.auth = new AuthStore(this.dataDir); this.metadata = new MetadataStore(this.dataDir); this.workspaces = options.workspaces ?? new WorkspaceStore(); this.agents = options.agents ?? new AgentManager(this.workspaces); this.terminals = options.terminals ?? new TerminalManager(this.workspaces); this.voice = options.voice; this.mailNotifier = options.mailNotifier; this.server = http.createServer((req, res) => void this.handle(req, res)); this.wss = new WebSocketServer({ noServer: true, maxPayload: 2 * 1024 * 1024 }); this.server.on('upgrade', (req, socket, head) => void this.upgrade(req, socket, head)); this.wss.on('connection', (ws, req) => { const match = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`).pathname.match(/^\/api\/v1\/terminals\/([^/]+)\/ws$/); match ? this.terminalConnection(ws, decodeURIComponent(match[1])) : this.connection(ws, req); }); }
+    async start() { const first = await this.auth.init(); this.metadata.init(); if (this.mailNotifier) {
+        const settings = this.metadata.getSetting('mailNotifications');
+        if (settings)
+            try {
+                this.mailNotifier.updateSettings(settings);
+            }
+            catch (error) {
+                console.error(`Ignoring invalid stored mail notification settings: ${error.message}`);
+            }
+    } await this.loadMetadata(); this.unsubscribeMetadata = this.agents.subscribeAll((agentId, event) => { const record = this.agents.get(agentId).record; this.voice?.handleAgentEvent(agentId, event.event, { sessionName: record.sessionName, setSessionName: async (name) => { if (this.agents.get(agentId).record.sessionName?.trim())
+            return; await this.agents.setSessionName(agentId, name); } }); this.mailNotifier?.handleAgentEvent(agentId, event.event, { sessionName: record.sessionName, workspaceLabel: this.workspaces.get(record.workspaceId)?.label, cwd: record.cwd }); if (['message_end', 'agent_end', 'agent_settled', 'session_info_changed'].includes(String(event.event.type))) {
+        const record = this.agents.get(agentId).record;
+        this.metadata.scheduleAgent(record);
+        if (['agent_end', 'agent_settled', 'session_info_changed'].includes(String(event.event.type)))
+            void this.indexAgentSession(agentId);
+    } }); if (first.token)
+        console.log(`Remote Pi pairing code (shown once; save it securely): ${first.token}`); await new Promise(r => this.server.listen(this.opts.port, this.opts.host, r)); return this.address(); }
+    address() { const a = this.server.address(); return typeof a === 'object' && a ? { host: this.opts.host, port: a.port } : undefined; }
+    async stop() { this.unsubscribeMetadata?.(); this.unsubscribeMetadata = undefined; this.voice?.close(); await this.mailNotifier?.close(); await Promise.allSettled([...this.sessionIndexJobs.values(), ...this.agentIndexJobs.values()]); this.metadata.flush(); for (const c of this.clients)
+        c.close(); for (const a of this.agents.list())
+        await this.agents.dispose(a.agentId).catch(() => { }); this.terminals.closeAll(); this.wss.close(); await new Promise(r => this.server.close(() => r())); this.metadata.close(); }
+    async upgrade(req, socket, head) { const protocol = req.headers['sec-websocket-protocol']; const wsToken = Array.isArray(protocol) ? protocol.find(x => x.startsWith('access-token.'))?.slice(13) : protocol?.split(',').map(x => x.trim()).find(x => x.startsWith('access-token.'))?.slice(13); const pathname = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`).pathname, isSocket = pathname === '/api/v1/ws' || /^\/api\/v1\/terminals\/[^/]+\/ws$/.test(pathname); if (!isSocket) {
+        socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+        socket.destroy();
+        return;
+    } const key = this.clientKey(req), retryAfter = this.loginRetryAfterMs(key); if (retryAfter > 0) {
+        socket.write(`HTTP/1.1 429 Too Many Requests\r\nRetry-After: ${Math.ceil(retryAfter / 1000)}\r\n\r\n`);
+        socket.destroy();
+        return;
+    } if (!(await this.authorized(req.headers.authorization)) && !(wsToken && await this.auth.verify(wsToken))) {
+        this.recordLoginFailure(key);
+        socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+        socket.destroy();
+        return;
+    } this.loginFailures.delete(key); this.wss.handleUpgrade(req, socket, head, ws => this.wss.emit('connection', ws, req)); }
+    clientKey(req) { return req.socket.remoteAddress ?? 'unknown'; }
+    /** Rate limits pairing attempts per source address. Reverse proxies and tunnels share one bucket by design. */
+    loginRetryAfterMs(key) { const entry = this.loginFailures.get(key); if (!entry)
+        return 0; const now = Date.now(); if (entry.lockedUntil > now)
+        return entry.lockedUntil - now; if (entry.expiresAt <= now)
+        this.loginFailures.delete(key); return 0; }
+    recordLoginFailure(key) { const now = Date.now(); if (this.loginFailures.size > 1000)
+        for (const [id, value] of this.loginFailures)
+            if (value.expiresAt <= now && value.lockedUntil <= now)
+                this.loginFailures.delete(id); const entry = this.loginFailures.get(key); if (!entry || (entry.expiresAt <= now && entry.lockedUntil <= now)) {
+        this.loginFailures.set(key, { count: 1, expiresAt: now + this.loginWindowMs, lockedUntil: 0, lockLevel: 0 });
+        return 0;
+    } entry.count += 1; entry.expiresAt = now + this.loginWindowMs; if (entry.count < this.loginMaxFailures)
+        return 0; entry.count = 0; entry.lockLevel = Math.min(entry.lockLevel + 1, 5); entry.lockedUntil = now + Math.min(this.loginLockMs * 2 ** (entry.lockLevel - 1), this.loginMaxLockMs); entry.expiresAt = entry.lockedUntil + this.loginWindowMs; return entry.lockedUntil - now; }
+    connection(ws, _req) {
+        this.clients.add(ws);
+        const subscriptions = new Map();
+        const send = (message) => { if (ws.readyState === WebSocket.OPEN)
+            ws.send(JSON.stringify(message)); };
+        const unsubscribeVoice = this.voice?.subscribe((agentId, event) => { if (subscriptions.has('*') || subscriptions.has(agentId))
+            send({ type: 'voice_event', agentId, event }); });
+        ws.on('close', () => { this.clients.delete(ws); unsubscribeVoice?.(); for (const unsubscribe of subscriptions.values())
+            unsubscribe(); });
+        ws.on('message', raw => {
+            void (async () => {
+                let m;
+                try {
+                    m = JSON.parse(raw.toString());
+                    if (m.type === 'subscribe_all') {
+                        subscriptions.get('*')?.();
+                        const forward = (agentId, e) => !subscriptions.has(agentId) && send({ type: 'agent_event', agentId, eventId: e.id, sequence: e.sequence, timestamp: e.timestamp, event: e.event });
+                        subscriptions.set('*', this.agents.subscribeAll(forward));
+                        send({ type: 'subscribed_all', protocolVersion: 1 });
+                        return;
+                    }
+                    if (m.type === 'subscribe') {
+                        subscriptions.get(m.agentId)?.();
+                        const forward = (e) => send({ type: 'agent_event', agentId: m.agentId, eventId: e.id, sequence: e.sequence, timestamp: e.timestamp, event: e.event });
+                        subscriptions.set(m.agentId, this.agents.subscribe(m.agentId, forward));
+                        send({ type: 'subscribed', agentId: m.agentId, protocolVersion: 1, currentSequence: this.agents.currentSequence(m.agentId) });
+                        if (m.fromNow === true)
+                            return;
+                        const last = Number(m.lastSequence ?? 0);
+                        if (this.agents.hasReplayGap(m.agentId, last)) {
+                            const messageLimit = m.messageLimit === undefined ? undefined : Number(m.messageLimit);
+                            send({ type: 'agent_snapshot', agentId: m.agentId, ...await this.agents.snapshot(m.agentId, Number.isFinite(messageLimit) ? messageLimit : undefined) });
+                        }
+                        else
+                            for (const e of this.agents.events(m.agentId, last))
+                                forward(e);
+                        return;
+                    }
+                    if (['prompt', 'steer', 'follow-up', 'abort'].includes(m.type)) {
+                        if (m.type !== 'abort')
+                            this.voice?.recordUserPrompt(m.agentId, String(m.message ?? ''));
+                        await this.agents.command(m.agentId, m.type, m.message);
+                        send({ type: 'command_result', requestId: m.requestId, success: true });
+                        return;
+                    }
+                    throw new Error('Unknown command');
+                }
+                catch (e) {
+                    send({ type: 'command_result', requestId: m?.requestId, success: false, error: { code: e.code ?? 'BAD_REQUEST', message: e instanceof SyntaxError ? 'Invalid JSON' : e.message } });
+                }
+            })();
+        });
+    }
+    terminalConnection(ws, terminalId) { this.clients.add(ws); let unsubscribe = () => { }; ws.on('close', () => { this.clients.delete(ws); unsubscribe(); }); try {
+        const send = (message) => { if (ws.readyState !== WebSocket.OPEN)
+            return; if (ws.bufferedAmount > 1024 * 1024) {
+            ws.close(1013, 'Terminal client is too slow');
+            return;
+        } ws.send(JSON.stringify(message)); };
+        unsubscribe = this.terminals.subscribe(terminalId, event => { send(event); if (event.type === 'exit')
+            setTimeout(() => ws.close(), 50); });
+        const snapshot = this.terminals.snapshot(terminalId);
+        send({ type: 'snapshot', data: snapshot.data, record: snapshot.record });
+        ws.on('message', raw => { try {
+            const message = JSON.parse(raw.toString());
+            if (message.type === 'input')
+                this.terminals.write(terminalId, message.data);
+            else if (message.type === 'resize')
+                this.terminals.resize(terminalId, Number(message.cols), Number(message.rows));
+            else
+                throw new Error('Unknown terminal command');
+        }
+        catch (error) {
+            send({ type: 'error', message: error.message });
+        } });
+    }
+    catch (error) {
+        ws.send(JSON.stringify({ type: 'error', message: error.message }));
+        ws.close();
+    } }
+    async loadMetadata() { let workspaces = this.metadata.listWorkspaces(); if (!workspaces.length) {
+        for (const workspace of this.workspaces.list())
+            this.metadata.saveWorkspace(workspace);
+        workspaces = this.metadata.listWorkspaces();
+    } this.workspaces.replace(workspaces); let agents = this.metadata.listAgents(); if (!agents.length) {
+        for (const agent of this.agents.list())
+            this.metadata.saveAgent(agent);
+        agents = this.metadata.listAgents();
+    } await this.agents.restore(agents); }
+    async ensureSessionIndex(workspace, cwd, force = false) { const key = `${workspace.id}:${cwd}`, last = this.sessionIndexTimes.get(key) ?? 0; if (!force && Date.now() - last < 30000)
+        return; const existing = this.sessionIndexJobs.get(key); if (existing)
+        return existing; const job = (async () => { const sessions = await SessionManager.list(cwd); this.metadata.syncSessions(workspace.id, cwd, sessions); this.sessionIndexTimes.set(key, Date.now()); })().finally(() => this.sessionIndexJobs.delete(key)); this.sessionIndexJobs.set(key, job); return job; }
+    async indexAgentSession(agentId) { const existing = this.agentIndexJobs.get(agentId); if (existing)
+        return existing; const job = (async () => { try {
+        const record = this.agents.get(agentId).record, summary = await this.agents.sessionInfo(agentId);
+        this.metadata.upsertSessionFromAgent(record, summary);
+        this.metadata.scheduleAgent(record);
+    }
+    catch { /* Session files may not exist until the first assistant response is persisted. */ } })().finally(() => this.agentIndexJobs.delete(agentId)); this.agentIndexJobs.set(agentId, job); return job; }
+    async authorized(value) { return !!value && value.startsWith('Bearer ') && this.auth.verify(value.slice(7)); }
+    async serveWeb(pathname, res) { const asset = webFiles[pathname]; if (!asset)
+        return false; try {
+        const content = await readFile(path.isAbsolute(asset.file) ? asset.file : path.join(webRoot, asset.file));
+        res.statusCode = 200;
+        res.setHeader('content-type', asset.type);
+        res.setHeader('cache-control', 'no-cache');
+        res.setHeader('x-content-type-options', 'nosniff');
+        res.end(content);
+    }
+    catch {
+        json(res, 500, { error: { code: 'WEB_UI_UNAVAILABLE', message: 'Web UI files are missing. Reinstall the pi2web package.' } });
+    } return true; }
+    /** Reads a JSON body as bytes so the size limit applies while streaming and multi-byte characters are never split across chunks. */
+    async body(req, maxBytes = 2 * 1024 * 1024) { const raw = await this.binaryBody(req, maxBytes); return raw.length ? JSON.parse(raw.toString('utf8')) : {}; }
+    async binaryBody(req, maxBytes = 25 * 1024 * 1024) { const chunks = []; let size = 0; for await (const value of req) {
+        const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value);
+        size += chunk.length;
+        if (size > maxBytes)
+            throw Object.assign(new Error('Request too large'), { code: 'REQUEST_TOO_LARGE' });
+        chunks.push(chunk);
+    } return Buffer.concat(chunks); }
+    async handle(req, res) { const requestId = randomUUID(); res.setHeader('x-request-id', requestId); res.setHeader('access-control-allow-origin', '*'); res.setHeader('access-control-allow-headers', 'Authorization,Content-Type,X-Audio-Filename'); res.setHeader('access-control-allow-methods', 'GET,POST,DELETE,OPTIONS'); try {
+        if (req.method === 'OPTIONS') {
+            res.statusCode = 204;
+            return res.end();
+        }
+        const u = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+        if (req.method === 'GET' && await this.serveWeb(u.pathname, res))
+            return;
+        if (req.method === 'GET' && u.pathname === '/health')
+            return json(res, 200, { data: { status: 'ok' } });
+        const parts = u.pathname.split('/').filter(Boolean);
+        if (req.method === 'POST' && u.pathname === '/api/v1/auth/login') {
+            const key = this.clientKey(req), retryAfter = this.loginRetryAfterMs(key);
+            if (retryAfter > 0) {
+                res.setHeader('retry-after', String(Math.ceil(retryAfter / 1000)));
+                return json(res, 429, { error: { code: 'TOO_MANY_ATTEMPTS', message: `Too many failed pairing attempts. Retry in ${Math.ceil(retryAfter / 1000)} seconds`, requestId } });
+            }
+            const b = await this.body(req);
+            if (await this.auth.verify(String(b.token ?? ''))) {
+                this.loginFailures.delete(key);
+                return json(res, 200, { data: { authenticated: true } });
+            }
+            const lockedFor = this.recordLoginFailure(key);
+            if (lockedFor > 0)
+                res.setHeader('retry-after', String(Math.ceil(lockedFor / 1000)));
+            return json(res, 401, { error: { code: 'UNAUTHORIZED', message: 'Invalid token', requestId } });
+        }
+        if (!(await this.authorized(req.headers.authorization)))
+            return json(res, 401, { error: { code: 'UNAUTHORIZED', message: 'Authentication required', requestId } });
+        if (req.method === 'GET' && u.pathname === '/api/v1/system/status')
+            return json(res, 200, { data: { version: pkg.version, protocolVersion: 1, piVersion: PI_VERSION, nodeVersion: process.version, uptimeSeconds: Math.floor(process.uptime()), agentCount: this.agents.list().length, terminalCount: this.terminals.list().length, webSocketConnections: this.clients.size, voiceEnabled: !!this.voice, voiceCapabilities: this.voice?.capabilities() ?? { tts: false, stt: false }, mailNotificationsConfigured: !!this.mailNotifier, mailNotificationsEnabled: this.mailNotifier?.getSettings().enabled ?? false } });
+        if (req.method === 'GET' && u.pathname === '/api/v1/mail-notifications')
+            return json(res, 200, { data: { available: !!this.mailNotifier, settings: this.mailNotifier?.getSettings() ?? null } });
+        if (req.method === 'POST' && u.pathname === '/api/v1/mail-notifications') {
+            if (!this.mailNotifier)
+                throw Object.assign(new Error('MailDispatch is not configured at server startup'), { code: 'MAIL_NOTIFICATIONS_DISABLED' });
+            const b = await this.body(req), patch = {};
+            if ('enabled' in b) {
+                if (typeof b.enabled !== 'boolean')
+                    throw Object.assign(new Error('enabled must be a boolean'), { code: 'INVALID_MAIL_NOTIFICATION_SETTINGS' });
+                patch.enabled = b.enabled;
+            }
+            if ('aggregationDelaySeconds' in b)
+                patch.aggregationDelaySeconds = Number(b.aggregationDelaySeconds);
+            if ('includeResponse' in b) {
+                if (typeof b.includeResponse !== 'boolean')
+                    throw Object.assign(new Error('includeResponse must be a boolean'), { code: 'INVALID_MAIL_NOTIFICATION_SETTINGS' });
+                patch.includeResponse = b.includeResponse;
+            }
+            if ('includeSessionDetails' in b) {
+                if (typeof b.includeSessionDetails !== 'boolean')
+                    throw Object.assign(new Error('includeSessionDetails must be a boolean'), { code: 'INVALID_MAIL_NOTIFICATION_SETTINGS' });
+                patch.includeSessionDetails = b.includeSessionDetails;
+            }
+            const settings = this.mailNotifier.updateSettings(patch);
+            this.metadata.setSetting('mailNotifications', settings);
+            return json(res, 200, { data: { available: true, settings } });
+        }
+        if (req.method === 'GET' && u.pathname === '/api/v1/workspaces')
+            return json(res, 200, { data: this.workspaces.list() });
+        if (req.method === 'POST' && u.pathname === '/api/v1/workspaces') {
+            const b = await this.body(req);
+            if (typeof b.label !== 'string' || typeof b.rootPath !== 'string')
+                return json(res, 400, { error: { code: 'INVALID_REQUEST', message: 'label and rootPath required', requestId } });
+            const workspace = this.workspaces.add(b.label, b.rootPath);
+            this.metadata.saveWorkspace(workspace);
+            return json(res, 201, { data: workspace });
+        }
+        if (parts[2] === 'workspaces' && parts[4] === 'tree' && req.method === 'GET')
+            return json(res, 200, { data: await this.workspaces.tree(parts[3], u.searchParams.get('path') ?? '.') });
+        if (parts[2] === 'workspaces' && parts[4] === 'file' && req.method === 'GET')
+            return json(res, 200, { data: await this.workspaces.file(parts[3], u.searchParams.get('path') ?? '', Number(u.searchParams.get('offset') ?? 0), Number(u.searchParams.get('limit') ?? 1048576)) });
+        if (parts[2] === 'workspaces' && parts[4] === 'stat' && req.method === 'GET')
+            return json(res, 200, { data: await this.workspaces.stat(parts[3], u.searchParams.get('path') ?? '.') });
+        if (req.method === 'GET' && u.pathname === '/api/v1/sessions') {
+            const workspace = this.workspaces.get(u.searchParams.get('workspaceId') ?? '');
+            if (!workspace)
+                throw Object.assign(new Error('Workspace not found'), { code: 'WORKSPACE_NOT_FOUND' });
+            const cwd = await this.workspaces.resolve(workspace, u.searchParams.get('path') ?? '.');
+            await this.ensureSessionIndex(workspace, cwd, u.searchParams.get('refresh') === 'true');
+            const limit = u.searchParams.has('limit') ? Number(u.searchParams.get('limit')) : undefined, offset = Number(u.searchParams.get('offset') ?? 0);
+            return json(res, 200, { data: this.metadata.listSessions(cwd, limit, offset) });
+        }
+        if (req.method === 'GET' && u.pathname === '/api/v1/terminals')
+            return json(res, 200, { data: this.terminals.list() });
+        if (req.method === 'POST' && u.pathname === '/api/v1/terminals') {
+            const b = await this.body(req);
+            const terminal = await this.terminals.create(String(b.workspaceId ?? ''), String(b.relativeCwd ?? '.'), Number(b.cols ?? 80), Number(b.rows ?? 24));
+            return json(res, 201, { data: terminal });
+        }
+        if (parts[2] === 'terminals') {
+            const id = parts[3];
+            if (req.method === 'GET' && parts.length === 4)
+                return json(res, 200, { data: this.terminals.get(id).record });
+            if (req.method === 'DELETE' && parts.length === 4) {
+                this.terminals.close(id);
+                return json(res, 200, { data: { closed: true } });
+            }
+        }
+        if (req.method === 'GET' && u.pathname === '/api/v1/agents')
+            return json(res, 200, { data: this.agents.list() });
+        if (req.method === 'POST' && u.pathname === '/api/v1/agents') {
+            const b = await this.body(req);
+            let sessionFile;
+            if (b.sessionFile) {
+                const workspace = this.workspaces.get(b.workspaceId);
+                if (!workspace)
+                    throw Object.assign(new Error('Workspace not found'), { code: 'WORKSPACE_NOT_FOUND' });
+                const cwd = await this.workspaces.resolve(workspace, b.relativeCwd ?? '.');
+                await this.ensureSessionIndex(workspace, cwd);
+                if (!this.metadata.hasSession(cwd, b.sessionFile))
+                    throw Object.assign(new Error('Session is not valid for cwd'), { code: 'SESSION_NOT_FOUND' });
+                sessionFile = b.sessionFile;
+            }
+            const agent = await this.agents.create(b.workspaceId, b.relativeCwd ?? '.', sessionFile);
+            this.metadata.saveAgent(agent);
+            return json(res, 201, { data: agent });
+        }
+        if (parts[2] === 'agents') {
+            const id = parts[3];
+            if (req.method === 'GET' && parts.length === 4)
+                return json(res, 200, { data: this.agents.get(id).record });
+            if (req.method === 'DELETE' && parts.length === 4) {
+                await this.agents.dispose(id);
+                this.metadata.saveAgent(this.agents.get(id).record);
+                return json(res, 200, { data: { stopped: true } });
+            }
+            if (req.method === 'POST' && parts[4] === 'archive') {
+                const record = await this.agents.archive(id);
+                this.metadata.archiveAgent(record);
+                return json(res, 200, { data: { archived: true } });
+            }
+            if (req.method === 'GET' && parts[4] === 'state')
+                return json(res, 200, { data: await this.agents.state(id) });
+            if (req.method === 'GET' && parts[4] === 'messages') {
+                const hasPaging = u.searchParams.has('limit') || u.searchParams.has('before');
+                if (!hasPaging)
+                    return json(res, 200, { data: await this.agents.messages(id) });
+                const limit = Number(u.searchParams.get('limit') ?? 25), before = u.searchParams.has('before') ? Number(u.searchParams.get('before')) : undefined;
+                return json(res, 200, { data: await this.agents.messagePage(id, limit, before) });
+            }
+            if (req.method === 'GET' && parts[4] === 'capabilities')
+                return json(res, 200, { data: await this.agents.capabilities(id) });
+            if (req.method === 'GET' && parts[4] === 'session')
+                return json(res, 200, { data: u.searchParams.get('summary') === 'true' ? await this.agents.sessionInfo(id) : await this.agents.session(id) });
+            if (req.method === 'POST' && parts[4] === 'compact') {
+                const b = await this.body(req);
+                return json(res, 200, { data: await this.agents.compact(id, b.instructions) });
+            }
+            if (req.method === 'POST' && parts[4] === 'model') {
+                const b = await this.body(req);
+                await this.agents.setModel(id, b.provider, b.modelId);
+                return json(res, 200, { data: await this.agents.capabilities(id) });
+            }
+            if (req.method === 'POST' && parts[4] === 'thinking') {
+                const b = await this.body(req);
+                await this.agents.setThinkingLevel(id, b.level);
+                return json(res, 200, { data: await this.agents.capabilities(id) });
+            }
+            if (req.method === 'POST' && parts[4] === 'session-name') {
+                const b = await this.body(req);
+                await this.agents.setSessionName(id, b.name);
+                const summary = await this.agents.sessionInfo(id), record = this.agents.get(id).record;
+                this.metadata.saveAgent(record);
+                this.metadata.upsertSessionFromAgent(record, summary);
+                return json(res, 200, { data: summary });
+            }
+            if (req.method === 'POST' && parts[4] === 'navigate') {
+                const b = await this.body(req);
+                return json(res, 200, { data: await this.agents.navigate(id, b.entryId) });
+            }
+            if (req.method === 'POST' && parts[4] === 'fork') {
+                const b = await this.body(req);
+                const agent = await this.agents.fork(id, b.entryId);
+                this.metadata.saveAgent(agent.agent);
+                return json(res, 201, { data: agent });
+            }
+            if (req.method === 'POST' && parts[4] === 'extension-response') {
+                const b = await this.body(req);
+                await this.agents.extensionResponse(id, b.requestId, b.value);
+                return json(res, 200, { data: { success: true } });
+            }
+            if (req.method === 'POST' && parts[4] === 'transcribe') {
+                if (!this.voice)
+                    throw Object.assign(new Error('Voice service is disabled'), { code: 'VOICE_DISABLED' });
+                this.agents.get(id);
+                const audio = await this.binaryBody(req), mime = String(req.headers['content-type'] ?? 'audio/webm').split(';')[0], filename = String(req.headers['x-audio-filename'] ?? 'recording.webm');
+                return json(res, 200, { data: await this.voice.transcribe(audio, mime, filename) });
+            }
+            if (req.method === 'POST' && ['prompt', 'steer', 'follow-up', 'abort'].includes(parts[4])) {
+                const b = await this.body(req);
+                if (parts[4] !== 'abort')
+                    this.voice?.recordUserPrompt(id, String(b.message ?? ''));
+                await this.agents.command(id, parts[4], b.message ?? '');
+                const record = this.agents.get(id).record;
+                this.metadata.scheduleAgent(record);
+                if (parts[4] === 'prompt')
+                    void this.indexAgentSession(id);
+                return json(res, 200, { data: { success: true } });
+            }
+        }
+        return json(res, 404, { error: { code: 'NOT_FOUND', message: 'Not found', requestId } });
+    }
+    catch (e) {
+        const x = e;
+        return json(res, x.code === 'WORKSPACE_PATH_OUTSIDE_ROOT' ? 403 : x.code === 'FILE_TOO_LARGE' || x.code === 'REQUEST_TOO_LARGE' ? 413 : x.code === 'VOICE_DISABLED' || x.code === 'VOICE_STT_DISABLED' || x.code === 'MAIL_NOTIFICATIONS_DISABLED' ? 503 : x.code?.endsWith('NOT_FOUND') ? 404 : 400, { error: { code: x.code ?? 'BAD_REQUEST', message: x.message ?? 'Request failed', requestId } });
+    } }
+}

package/dist/terminals.js

@@ -0,0 +1,70 @@
+import path from 'node:path';
+import { stat } from 'node:fs/promises';
+import { EventEmitter } from 'node:events';
+import { randomUUID } from 'node:crypto';
+import * as pty from 'node-pty';
+const defaultFactory = (cwd, cols, rows) => {
+    const windows = process.platform === 'win32';
+    const shell = windows ? (process.env.COMSPEC || 'cmd.exe') : (process.env.SHELL || '/bin/sh');
+    const env = Object.fromEntries(Object.entries(process.env).filter((entry) => entry[1] !== undefined));
+    return pty.spawn(shell, [], { name: 'xterm-256color', cwd, cols, rows, env, useConpty: windows });
+};
+export class TerminalManager {
+    workspaces;
+    factory;
+    maxRunning;
+    maxBuffer;
+    maxRetained;
+    terminals = new Map();
+    constructor(workspaces, factory = defaultFactory, maxRunning = 8, maxBuffer = 512 * 1024, maxRetained = 50) {
+        this.workspaces = workspaces;
+        this.factory = factory;
+        this.maxRunning = maxRunning;
+        this.maxBuffer = maxBuffer;
+        this.maxRetained = maxRetained;
+    }
+    list() { return [...this.terminals.values()].map(x => ({ ...x.record })).sort((a, b) => b.lastActiveAt.localeCompare(a.lastActiveAt)); }
+    get(id) { const entry = this.terminals.get(id); if (!entry)
+        throw Object.assign(new Error('Terminal not found'), { code: 'TERMINAL_NOT_FOUND' }); return entry; }
+    async create(workspaceId, relativeCwd = '.', cols = 80, rows = 24) {
+        this.pruneExited();
+        if (this.list().filter(x => x.status === 'running').length >= this.maxRunning)
+            throw Object.assign(new Error(`At most ${this.maxRunning} terminals may run at once`), { code: 'TERMINAL_LIMIT' });
+        const workspace = this.workspaces.get(workspaceId);
+        if (!workspace)
+            throw Object.assign(new Error('Workspace not found'), { code: 'WORKSPACE_NOT_FOUND' });
+        const cwd = await this.workspaces.resolve(workspace, relativeCwd);
+        if (!(await stat(cwd)).isDirectory())
+            throw Object.assign(new Error('cwd is not a directory'), { code: 'NOT_A_DIRECTORY' });
+        const terminalId = `terminal-${randomUUID()}`, now = new Date().toISOString(), process = this.factory(cwd, this.dimension(cols, 80), this.dimension(rows, 24));
+        const record = { terminalId, workspaceId, cwd, title: path.basename(cwd) || cwd, status: 'running', createdAt: now, lastActiveAt: now };
+        const entry = { record, process, emitter: new EventEmitter(), buffer: '' };
+        this.terminals.set(terminalId, entry);
+        entry.dataSubscription = process.onData(data => { entry.buffer = (entry.buffer + data).slice(-this.maxBuffer); entry.record.lastActiveAt = new Date().toISOString(); entry.emitter.emit('event', { type: 'output', data }); });
+        const exitSubscription = process.onExit(event => { entry.record.status = 'exited'; entry.record.exitCode = event.exitCode; entry.record.lastActiveAt = new Date().toISOString(); entry.emitter.emit('event', { type: 'exit', exitCode: event.exitCode }); this.disposeProcessListeners(entry); this.pruneExited(); });
+        if (entry.record.status === 'exited')
+            exitSubscription.dispose();
+        else
+            entry.exitSubscription = exitSubscription;
+        return { ...record };
+    }
+    snapshot(id) { const entry = this.get(id); return { record: { ...entry.record }, data: entry.buffer }; }
+    write(id, data) { const entry = this.get(id); if (entry.record.status !== 'running')
+        throw Object.assign(new Error('Terminal has exited'), { code: 'TERMINAL_EXITED' }); if (typeof data !== 'string' || data.length > 64 * 1024)
+        throw Object.assign(new Error('Invalid terminal input'), { code: 'INVALID_REQUEST' }); entry.process.write(data); entry.record.lastActiveAt = new Date().toISOString(); }
+    resize(id, cols, rows) { const entry = this.get(id); if (entry.record.status === 'running')
+        entry.process.resize(this.dimension(cols, 80), this.dimension(rows, 24)); }
+    subscribe(id, listener) { const entry = this.get(id); entry.emitter.on('event', listener); return () => entry.emitter.off('event', listener); }
+    close(id) { const entry = this.get(id); this.terminals.delete(id); if (entry.record.status === 'running')
+        entry.emitter.emit('event', { type: 'exit', exitCode: -1 }); this.disposeProcessListeners(entry); if (entry.record.status === 'running')
+        try {
+            entry.process.kill();
+        }
+        catch { } entry.emitter.removeAllListeners(); }
+    closeAll() { for (const id of [...this.terminals.keys()])
+        this.close(id); }
+    disposeProcessListeners(entry) { entry.dataSubscription?.dispose(); entry.exitSubscription?.dispose(); entry.dataSubscription = undefined; entry.exitSubscription = undefined; }
+    pruneExited() { const exited = [...this.terminals.entries()].reverse().filter(([, entry]) => entry.record.status === 'exited').sort((a, b) => b[1].record.lastActiveAt.localeCompare(a[1].record.lastActiveAt)); for (const [id] of exited.slice(this.maxRetained))
+        this.close(id); }
+    dimension(value, fallback) { return Number.isInteger(value) && value > 0 && value <= 1000 ? value : fallback; }
+}