rivet-design 0.23.1 → 0.24.0

package/dist/server.js

@@ -37,11 +37,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.startServer = exports.runServerShutdownTasks = exports.isRivetCorsOriginAllowed = exports.isRivetUiStaticAssetPath = exports.isEmbeddedAgentUiHost = exports.resolveEmbeddedAgentUiOrigin = exports.resolveRivetListenHost = exports.sendInactiveVariantsEventStream = exports.readRivetUiIndexHtml = exports.injectRivetUiBootstrap = exports.DIST_UI_PATH = exports.RIVET_CORS_ALLOWED_HEADERS = exports.INACTIVE_VARIANTS_EVENT_HEARTBEAT_MS = void 0;
+const editorSession_1 = require("./cli/editorSession");
+const editorAccess_1 = require("./routes/editorAccess");
+const editorAccess_2 = require("./utils/editorAccess");
 const RuntimeAdmission_1 = require("./services/RuntimeAdmission");
 const account_1 = require("./routes/account");
 const installRef_1 = require("./routes/installRef");
 const installationChannel_1 = require("./install/installationChannel");
 const Sentry = __importStar(require("@sentry/node"));
+const telemetryPolicy_1 = require("./config/telemetryPolicy");
+const telemetry_1 = require("./routes/telemetry");
 const express_1 = __importDefault(require("express"));
 const cors_1 = __importDefault(require("cors"));
 const crypto_1 = require("crypto");
@@ -53,7 +58,6 @@ const _1 = require(".");
 const integrations_1 = require("./routes/integrations");
 const referenceProfiles_1 = require("./routes/referenceProfiles");
 const WorktreeManager_1 = require("./services/WorktreeManager");
-const git_1 = require("./routes/git");
 const support_1 = require("./routes/support");
 const proxy_config_1 = require("./proxy-middleware/proxy-config");
 const StaticFileService_1 = require("./services/StaticFileService");
@@ -67,7 +71,7 @@ const cli_1 = require("./routes/cli");
 const agentVariants_1 = require("./routes/agentVariants");
 const inlineStartTracker_1 = require("./routes/inlineStartTracker");
 const serverHandshake_1 = require("./cli/serverHandshake");
-const telemetry_1 = require("./config/telemetry");
+const telemetry_2 = require("./config/telemetry");
 const HistoryReplayService_1 = require("./services/HistoryReplayService");
 const VariantHistoryService_1 = require("./services/VariantHistoryService");
 const RequestAuthContext_1 = require("./services/RequestAuthContext");
@@ -81,12 +85,13 @@ const RIVET_UI_INDEX_FILENAME = 'index.html';
 const EMBEDDED_AGENT_LISTEN_HOST = '127.0.0.1';
 const EMBEDDED_AGENT_PREVIEW_HOST = 'localhost';
 const OPAQUE_PREVIEW_ORIGIN = 'null';
-const PREVIEW_PORT_ALLOWED_API_RE = /^\/api\/variants\/(?:[^/]+\/static\/|history\/[^/]+\/[^/]+\/preview)/;
+const PREVIEW_PORT_ALLOWED_API_RE = /^\/api\/variants\/(?:[^/]+\/static\/|history\/[^/]+\/[^/]+\/(?:preview|site\/))/;
 exports.INACTIVE_VARIANTS_EVENT_HEARTBEAT_MS = 30_000;
 exports.RIVET_CORS_ALLOWED_HEADERS = [
     'Content-Type',
     'Authorization',
     'x-rivet-queue-token',
+    editorAccess_2.EDITOR_ACCESS_TOKEN_HEADER,
 ];
 const resolveUiPath = () => {
     const bundledPath = path_1.default.join(__dirname, 'ui/dist');
@@ -136,7 +141,7 @@ const sendInactiveVariantsEventStream = (req, res) => {
     });
 };
 exports.sendInactiveVariantsEventStream = sendInactiveVariantsEventStream;
-const resolveRivetListenHost = (agentApplyMode) => agentApplyMode === 'embedded' ? EMBEDDED_AGENT_LISTEN_HOST : undefined;
+const resolveRivetListenHost = (_agentApplyMode) => EMBEDDED_AGENT_LISTEN_HOST;
 exports.resolveRivetListenHost = resolveRivetListenHost;
 const resolveEmbeddedAgentUiOrigin = (port) => `http://${EMBEDDED_AGENT_LISTEN_HOST}:${port}`;
 exports.resolveEmbeddedAgentUiOrigin = resolveEmbeddedAgentUiOrigin;
@@ -198,16 +203,17 @@ exports.runServerShutdownTasks = runServerShutdownTasks;
 const startServer = async (options) => {
     const { userPort, userHost, telemetry, projectPath, framework, staticEntry, sessionBridge, mcpEditor, skipProcessHandlers, } = options;
     const agentApplyMode = options.agentApplyMode;
+    const editorAccessToken = (0, editorSession_1.createEditorAccessToken)();
+    const startedAt = new Date().toISOString();
     const userPortWithFallback = userPort ?? _1.DEFAULT_USER_PORT;
     const userHostWithFallback = userHost ?? 'localhost';
     const hasUserDevServer = typeof userPort === 'number' && Number.isInteger(userPort) && userPort > 0;
-    const isGitEnabled = options.isGitEnabled ?? true;
     const queueAccessToken = sessionBridge && agentApplyMode === 'embedded'
         ? (0, crypto_1.randomBytes)(QUEUE_ACCESS_TOKEN_BYTES).toString('base64url')
         : null;
     const variantsOrchestrator = options.variantsRuntime?.orchestrator ?? options.agentVariantsOrchestrator;
     const inlineStartTracker = (0, inlineStartTracker_1.createInlineStartTracker)();
-    const runtimeAdmission = new RuntimeAdmission_1.RuntimeAdmission(telemetry_1.RIVET_VERSION);
+    const runtimeAdmission = new RuntimeAdmission_1.RuntimeAdmission(telemetry_2.RIVET_VERSION);
     const variantsBridge = options.variantsRuntime?.bridge ?? sessionBridge;
     const variantRunService = options.variantsRuntime?.runService ?? options.variantRunService;
     const variantHistory = variantsOrchestrator
@@ -222,65 +228,41 @@ const startServer = async (options) => {
                 : undefined,
         })
         : null;
-    if (process.env.SENTRY_DSN) {
+    if (process.env.SENTRY_DSN && (0, telemetryPolicy_1.getTelemetryMode)() === 'full') {
         Sentry.init({
             dsn: process.env.SENTRY_DSN,
             environment: process.env.NODE_ENV ?? 'development',
         });
     }
-    const sessionService = new index_core_1.SessionService(projectPath, isGitEnabled, 'main');
-    try {
-        await sessionService.initializeSession();
-        log.info('Git session initialized successfully');
-    }
-    catch (error) {
-        log.warn('Failed to initialize git session, continuing without git tracking:', error);
-    }
     let staticService = null;
     if (framework === 'static') {
         const entryPoint = staticEntry || 'index.html';
         staticService = new StaticFileService_1.StaticFileService(projectPath, entryPoint);
     }
-    if (!skipProcessHandlers) {
-        const shutdownAndExit = async (code) => {
-            log.info('Server shutting down, cleaning up...');
-            (0, WorktreeManager_1.cleanupOrphanedWorktrees)();
-            const results = await Promise.allSettled([
-                options.beforeShutdown?.(),
-                telemetry?.shutdown(),
-                (0, FeatureFlagService_1.getFeatureFlagService)().shutdown(),
-            ]);
-            const labels = ['shutdown hook', 'telemetry', 'feature flags'];
-            for (let i = 0; i < results.length; i++) {
-                if (results[i].status === 'rejected') {
-                    log.error(`Failed to cleanup ${labels[i]}:`, results[i].reason);
-                }
-            }
-            (0, serverHandshake_1.removeHandshake)(projectPath, process.pid);
-            process.exit(code);
-        };
-        process.on('SIGINT', () => shutdownAndExit(0));
-        process.on('SIGTERM', () => shutdownAndExit(0));
-        process.on('uncaughtException', (err) => {
-            log.error('Uncaught exception:', err);
-            telemetry?.captureException(err, 'uncaught_exception');
-            shutdownAndExit(1);
-        });
-        process.on('unhandledRejection', (reason) => {
-            log.error('Unhandled rejection:', reason);
-            telemetry?.captureException(reason, 'unhandled_rejection');
-            shutdownAndExit(1);
-        });
-    }
-    const listenPort = options.rivetPort ?? _1.DEFAULT_PORT;
-    const previewPort = agentApplyMode === 'embedded' ? options.previewPort : undefined;
-    const previewOrigin = previewPort !== undefined
+    let listenPort = options.rivetPort ?? _1.DEFAULT_PORT;
+    const previewPort = options.previewPort;
+    let previewOrigin = previewPort !== undefined
         ? `http://${EMBEDDED_AGENT_LISTEN_HOST}:${previewPort}`
-        : null;
+        : `http://${EMBEDDED_AGENT_PREVIEW_HOST}:${listenPort}`;
+    let userDevProxy = null;
     const app = (0, express_1.default)();
-    const corsOrigins = new Set(agentApplyMode === 'embedded'
-        ? [(0, exports.resolveEmbeddedAgentUiOrigin)(listenPort)]
-        : [`http://localhost:${listenPort}`, `http://127.0.0.1:${listenPort}`]);
+    const requireEditorAccess = (0, editorAccess_1.authenticateEditor)(editorAccessToken);
+    app.use(editorAccess_2.EDITOR_ACCOUNT_PATHS, requireEditorAccess);
+    const editorHost = () => `${EMBEDDED_AGENT_LISTEN_HOST}:${listenPort}`;
+    const isPreviewRequest = (req) => req.headers.host === new URL(previewOrigin).host &&
+        (previewPort === undefined || req.socket.localPort === previewPort);
+    app.use((req, res, next) => {
+        const requestHost = req.headers.host;
+        const isEditorRequest = requestHost === editorHost() && req.socket.localPort === listenPort;
+        if (!isEditorRequest && !isPreviewRequest(req)) {
+            res.sendStatus(403);
+            return;
+        }
+        next();
+    });
+    const corsOrigins = new Set([
+        (0, exports.resolveEmbeddedAgentUiOrigin)(listenPort),
+    ]);
     const rawCorsOrigins = process.env.RIVET_CORS_ORIGINS;
     if (rawCorsOrigins) {
         rawCorsOrigins
@@ -305,22 +287,41 @@ const startServer = async (options) => {
             allowedHeaders: exports.RIVET_CORS_ALLOWED_HEADERS,
         })(req, res, next);
     });
-    if (previewPort !== undefined) {
-        app.use((req, res, next) => {
-            if (req.socket.localPort !== previewPort) {
-                next();
-                return;
+    app.use((req, res, next) => {
+        if (!isPreviewRequest(req)) {
+            next();
+            return;
+        }
+        if (req.headers[editorAccess_2.EDITOR_ACCESS_TOKEN_HEADER]) {
+            res.sendStatus(403);
+            return;
+        }
+        const isAppApi = req.path.toLowerCase().startsWith('/api/') &&
+            !PREVIEW_PORT_ALLOWED_API_RE.test(req.path.toLowerCase());
+        const isEditorUi = req.path.toLowerCase() === '/rivet' ||
+            req.path.toLowerCase().startsWith('/rivet/');
+        if (isEditorUi || /^\/api\/git(?:\/|$)/i.test(req.path)) {
+            res.status(404).end();
+            return;
+        }
+        if (isAppApi) {
+            if (userDevProxy) {
+                userDevProxy.middleware(req, res, (error) => {
+                    if (error) {
+                        next(error);
+                        return;
+                    }
+                    res.sendStatus(404);
+                });
             }
-            const isBlockedApi = req.path.startsWith('/api/') &&
-                !PREVIEW_PORT_ALLOWED_API_RE.test(req.path);
-            const isEditorUi = req.path === '/rivet' || req.path.startsWith('/rivet/');
-            if (isBlockedApi || isEditorUi) {
-                res.status(404).end();
-                return;
+            else {
+                res.sendStatus(404);
             }
-            next();
-        });
-    }
+            return;
+        }
+        next();
+    });
+    app.use('/api/telemetry', (0, telemetry_1.createTelemetryRouter)(telemetry));
     const jsonBodyParser = express_1.default.json({ limit: '50mb' });
     app.use(jsonBodyParser);
     app.use((req, res, next) => {
@@ -341,21 +342,27 @@ const startServer = async (options) => {
         },
     };
     const sendRivetUiIndex = (req, res) => {
-        if (!(0, exports.isEmbeddedAgentUiHost)(req.hostname, agentApplyMode)) {
+        if (!(0, exports.isEmbeddedAgentUiHost)(req.hostname, 'embedded')) {
             res.redirect(302, `${(0, exports.resolveEmbeddedAgentUiOrigin)(listenPort)}${req.originalUrl}`);
             return;
         }
         setNoStoreHeaders(res);
+        const libraryOrigin = options.resolveLibraryOrigin?.();
+        res.setHeader('Content-Security-Policy', `frame-ancestors 'self'${libraryOrigin ? ` ${new URL(libraryOrigin).origin}` : ''}`);
         res.type('html').send((0, exports.injectRivetUiBootstrap)((0, exports.readRivetUiIndexHtml)(), {
             agentApplyMode: agentApplyMode ?? null,
             queueAccessToken,
             previewOrigin,
         }));
     };
-    app.use('/assets', express_1.default.static(path_1.default.join(exports.DIST_UI_PATH, 'assets'), uiStaticOptions));
-    app.use('/rivet/assets', express_1.default.static(path_1.default.join(exports.DIST_UI_PATH, 'assets'), uiStaticOptions));
-    app.use('/fonts', express_1.default.static(path_1.default.join(exports.DIST_UI_PATH, 'fonts'), uiStaticOptions));
-    app.use('/rivet/fonts', express_1.default.static(path_1.default.join(exports.DIST_UI_PATH, 'fonts'), uiStaticOptions));
+    const serveEditorAssets = (directory) => {
+        const serve = express_1.default.static(directory, uiStaticOptions);
+        return (req, res, next) => isPreviewRequest(req) ? next() : serve(req, res, next);
+    };
+    app.use('/assets', serveEditorAssets(path_1.default.join(exports.DIST_UI_PATH, 'assets')));
+    app.use('/rivet/assets', serveEditorAssets(path_1.default.join(exports.DIST_UI_PATH, 'assets')));
+    app.use('/fonts', serveEditorAssets(path_1.default.join(exports.DIST_UI_PATH, 'fonts')));
+    app.use('/rivet/fonts', serveEditorAssets(path_1.default.join(exports.DIST_UI_PATH, 'fonts')));
     app.get('/favicon.ico', (_req, res) => {
         res.sendFile('favicon.ico', { root: exports.DIST_UI_PATH });
     });
@@ -371,7 +378,11 @@ const startServer = async (options) => {
     });
     log.info(`Serving UI assets from: ${exports.DIST_UI_PATH}`);
     if (framework === 'static' && !hasUserDevServer) {
-        app.get('/', (req, res) => {
+        app.get('/', (req, res, next) => {
+            if (isPreviewRequest(req)) {
+                next();
+                return;
+            }
             log.debug(`${framework} mode - serving Rivet at root`);
             sendRivetUiIndex(req, res);
         });
@@ -410,19 +421,28 @@ const startServer = async (options) => {
     app.use('/api', (0, integrations_1.createIntegrationsRouter)());
     app.use('/api', (0, referenceProfiles_1.createReferenceProfilesRouter)());
     void (0, WorktreeManager_1.pruneWorktrees)(projectPath);
-    if (!isGitEnabled) {
-        log.info('Git routes disabled for this server instance');
-    }
-    app.use('/api', (0, git_1.createGitRouter)(sessionService, projectPath, {
-        isGitEnabled,
-    }));
+    app.use('/api/git', (_req, res) => res.sendStatus(404));
     app.use('/api', (0, support_1.createSupportRouter)(telemetry));
+    app.use((req, res, next) => {
+        const isPreviewPath = req.path.toLowerCase().startsWith('/static') ||
+            req.path.toLowerCase().startsWith('/__rivet/preview/') ||
+            PREVIEW_PORT_ALLOWED_API_RE.test(req.path.toLowerCase());
+        if (!isPreviewRequest(req) && isPreviewPath) {
+            if (req.headers[editorAccess_2.EDITOR_ACCESS_TOKEN_HEADER]) {
+                res.sendStatus(403);
+                return;
+            }
+            res.redirect(302, `${previewOrigin}${req.originalUrl}`);
+            return;
+        }
+        next();
+    });
     if (staticService) {
         app.use((0, static_1.createStaticRoutes)(staticService, projectPath, {
-            isPreviewBridgeEnabled: agentApplyMode === 'embedded',
-            expectedPreviewParentOrigin: agentApplyMode === 'embedded'
-                ? (0, exports.resolveEmbeddedAgentUiOrigin)(listenPort)
-                : undefined,
+            isPreviewBridgeEnabled: true,
+            get expectedPreviewParentOrigin() {
+                return (0, exports.resolveEmbeddedAgentUiOrigin)(listenPort);
+            },
         }));
         log.info('Static routes mounted at /static');
     }
@@ -441,8 +461,9 @@ const startServer = async (options) => {
             projectPath,
             pid: process.pid,
             channel: (0, installationChannel_1.installationChannel)(),
-            rivetVersion: telemetry_1.RIVET_VERSION,
+            rivetVersion: telemetry_2.RIVET_VERSION,
             pluginName: (0, pluginContext_1.getPluginName)(),
+            telemetryMode: (0, telemetryPolicy_1.getTelemetryMode)(),
             timestamp: new Date().toISOString(),
             framework,
             ports: {
@@ -489,7 +510,7 @@ const startServer = async (options) => {
             const url = await options.createLibraryViewUrl?.(view);
             if (!url)
                 return res.sendStatus(503);
-            return res.redirect(303, url);
+            return res.json({ url });
         }
         catch (error) {
             log.error('Could not open the project library', error);
@@ -518,11 +539,11 @@ const startServer = async (options) => {
     }
     if (variantsOrchestrator) {
         app.use('/api', (0, agentVariants_1.createAgentVariantsRouter)(variantsOrchestrator, variantsBridge, telemetry, variantHistory ?? undefined, undefined, variantRunService, historyReplay ?? undefined, {
-            isEnabled: agentApplyMode === 'embedded',
+            isEnabled: true,
             resolveLibraryOrigin: options.resolveLibraryOrigin,
-            expectedParentOrigin: agentApplyMode === 'embedded'
-                ? (0, exports.resolveEmbeddedAgentUiOrigin)(listenPort)
-                : undefined,
+            get expectedParentOrigin() {
+                return (0, exports.resolveEmbeddedAgentUiOrigin)(listenPort);
+            },
         }, inlineStartTracker, runtimeAdmission));
         log.info('agent-variants routes mounted at /api/variants');
     }
@@ -534,16 +555,15 @@ const startServer = async (options) => {
             (0, exports.sendInactiveVariantsEventStream)(req, res);
         });
     }
-    let userDevProxy = null;
     if (framework !== 'static' || hasUserDevServer || variantsBridge) {
         const proxyUserPort = framework === 'static' && !hasUserDevServer
             ? NO_USER_DEV_SERVER_PORT
             : userPortWithFallback;
         userDevProxy = (0, proxy_config_1.createUserDevServerProxy)(proxyUserPort, userHostWithFallback, {
-            isPreviewBridgeEnabled: agentApplyMode === 'embedded',
-            expectedPreviewParentOrigin: agentApplyMode === 'embedded'
-                ? (0, exports.resolveEmbeddedAgentUiOrigin)(listenPort)
-                : undefined,
+            isPreviewBridgeEnabled: true,
+            get expectedPreviewParentOrigin() {
+                return (0, exports.resolveEmbeddedAgentUiOrigin)(listenPort);
+            },
             resolveVariantPreviewPort: (sessionId, variantId, options) => {
                 if (options?.source === 'history') {
                     return historyReplay?.getPort(sessionId, variantId) ?? null;
@@ -555,6 +575,25 @@ const startServer = async (options) => {
             },
         });
         variantsBridge?.registerVariantTargetSetter(userDevProxy.setVariantTarget);
+        app.use((req, res, next) => {
+            if (!isPreviewRequest(req)) {
+                if (req.path.toLowerCase().startsWith('/api/')) {
+                    res.sendStatus(404);
+                    return;
+                }
+                if (req.headers[editorAccess_2.EDITOR_ACCESS_TOKEN_HEADER]) {
+                    res.sendStatus(403);
+                    return;
+                }
+                res.redirect(302, `${previewOrigin}${req.originalUrl}`);
+                return;
+            }
+            if (req.headers[editorAccess_2.EDITOR_ACCESS_TOKEN_HEADER]) {
+                res.sendStatus(403);
+                return;
+            }
+            next();
+        });
         app.get('/{*any}', userDevProxy.middleware);
         app.post('/{*any}', userDevProxy.middleware);
         app.put('/{*any}', userDevProxy.middleware);
@@ -567,7 +606,7 @@ const startServer = async (options) => {
     else {
         log.info(`${framework} mode - skipping proxy setup`);
     }
-    if (process.env.SENTRY_DSN) {
+    if (process.env.SENTRY_DSN && (0, telemetryPolicy_1.getTelemetryMode)() === 'full') {
         Sentry.setupExpressErrorHandler(app);
     }
     app.use((err, req, res, _next) => {
@@ -598,12 +637,13 @@ const startServer = async (options) => {
                 pid: process.pid,
                 rivetPort: listenPort,
                 projectPath,
-                startedAt: new Date().toISOString(),
+                startedAt,
                 sessionId: sessionBridge?.getSessionId() ?? null,
                 applyMode: handshakeApplyMode,
                 queueAccessToken,
-                rivetVersion: telemetry_1.RIVET_VERSION,
+                rivetVersion: telemetry_2.RIVET_VERSION,
                 pluginName: (0, pluginContext_1.getPluginName)(),
+                telemetryMode: (0, telemetryPolicy_1.getTelemetryMode)(),
             });
         }
         catch (err) {
@@ -612,22 +652,37 @@ const startServer = async (options) => {
     };
     const retireCliHandshake = () => {
         (0, serverHandshake_1.removeHandshake)(projectPath, process.pid);
+        (0, editorSession_1.removeEditorSession)({ pid: process.pid, port: listenPort, projectPath, startedAt }, editorAccessToken);
     };
     const httpServer = await new Promise((resolve, reject) => {
         const listenHost = (0, exports.resolveRivetListenHost)(agentApplyMode);
-        const server = listenHost
-            ? app.listen(listenPort, listenHost, () => {
-                log.info(`🎨 Rivet server running on http://${listenHost}:${listenPort}`);
-                writeDevPortFile(listenPort);
-                advertiseCliHandshake();
-                resolve(server);
-            })
-            : app.listen(listenPort, () => {
-                log.info(`🎨 Rivet server running on http://localhost:${listenPort}`);
-                writeDevPortFile(listenPort);
-                advertiseCliHandshake();
-                resolve(server);
-            });
+        const server = app.listen(listenPort, listenHost, (error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            log.info(`🎨 Rivet server running on http://${listenHost}:${listenPort}`);
+            listenPort = server.address().port;
+            if (previewPort === undefined)
+                previewOrigin = `http://${EMBEDDED_AGENT_PREVIEW_HOST}:${listenPort}`;
+            corsOrigins.add((0, exports.resolveEmbeddedAgentUiOrigin)(listenPort));
+            try {
+                (0, editorSession_1.writeEditorSession)({
+                    pid: process.pid,
+                    port: listenPort,
+                    projectPath,
+                    token: editorAccessToken,
+                    startedAt,
+                });
+            }
+            catch (error) {
+                server.close(() => reject(error));
+                return;
+            }
+            writeDevPortFile(listenPort);
+            advertiseCliHandshake();
+            resolve(server);
+        });
         server.on('error', (err) => {
             reject(err);
         });
@@ -650,28 +705,76 @@ const startServer = async (options) => {
     });
     let previewHttpServer = null;
     if (previewPort !== undefined) {
-        previewHttpServer = await new Promise((resolve, reject) => {
-            const pServer = (0, http_1.createServer)(app);
-            pServer.on('error', reject);
-            pServer.on('connection', (socket) => {
-                activeSockets.add(socket);
-                socket.on('close', () => activeSockets.delete(socket));
-            });
-            pServer.on('upgrade', (req, socket, head) => {
-                const proxyUpgrade = userDevProxy?.middleware?.upgrade;
-                if (proxyUpgrade) {
-                    proxyUpgrade(req, socket, head);
-                    return;
-                }
-                socket.destroy();
+        try {
+            previewHttpServer = await new Promise((resolve, reject) => {
+                const pServer = (0, http_1.createServer)(app);
+                pServer.on('error', reject);
+                pServer.on('connection', (socket) => {
+                    activeSockets.add(socket);
+                    socket.on('close', () => activeSockets.delete(socket));
+                });
+                pServer.on('upgrade', (req, socket, head) => {
+                    const proxyUpgrade = userDevProxy?.middleware?.upgrade;
+                    if (proxyUpgrade) {
+                        proxyUpgrade(req, socket, head);
+                        return;
+                    }
+                    socket.destroy();
+                });
+                pServer.listen(previewPort, EMBEDDED_AGENT_LISTEN_HOST, () => {
+                    log.info(`🔒 Rivet isolated preview origin on http://${EMBEDDED_AGENT_LISTEN_HOST}:${previewPort}`);
+                    resolve(pServer);
+                });
             });
-            pServer.listen(previewPort, EMBEDDED_AGENT_LISTEN_HOST, () => {
-                log.info(`🔒 Rivet isolated preview origin on http://${EMBEDDED_AGENT_LISTEN_HOST}:${previewPort}`);
-                resolve(pServer);
+        }
+        catch (error) {
+            removeDevPortFile();
+            retireCliHandshake();
+            await new Promise((resolve) => {
+                httpServer.close(() => resolve());
+                for (const socket of activeSockets)
+                    socket.destroy();
             });
+            throw error;
+        }
+    }
+    if (!skipProcessHandlers) {
+        const shutdownAndExit = async (code) => {
+            log.info('Server shutting down, cleaning up...');
+            (0, WorktreeManager_1.cleanupOrphanedWorktrees)();
+            const results = await Promise.allSettled([
+                options.beforeShutdown?.(),
+                telemetry?.shutdown(),
+                (0, FeatureFlagService_1.getFeatureFlagService)().shutdown(),
+            ]);
+            const labels = ['shutdown hook', 'telemetry', 'feature flags'];
+            for (let i = 0; i < results.length; i++) {
+                if (results[i].status === 'rejected') {
+                    log.error(`Failed to cleanup ${labels[i]}:`, results[i].reason);
+                }
+            }
+            (0, serverHandshake_1.removeHandshake)(projectPath, process.pid);
+            (0, editorSession_1.removeEditorSession)({ pid: process.pid, port: listenPort, projectPath, startedAt }, editorAccessToken);
+            process.exit(code);
+        };
+        process.on('SIGINT', () => shutdownAndExit(0));
+        process.on('SIGTERM', () => shutdownAndExit(0));
+        process.on('uncaughtException', (err) => {
+            log.error('Uncaught exception:', err);
+            telemetry?.captureException(err, 'uncaught_exception');
+            shutdownAndExit(1);
+        });
+        process.on('unhandledRejection', (reason) => {
+            log.error('Unhandled rejection:', reason);
+            telemetry?.captureException(reason, 'unhandled_rejection');
+            shutdownAndExit(1);
         });
     }
     return {
+        editorUrl: (0, editorAccess_2.createEditorUrl)({
+            port: httpServer.address().port,
+            token: editorAccessToken,
+        }),
         close: () => new Promise((resolve, reject) => {
             removeDevPortFile();
             retireCliHandshake();