s-app-scoder-agent 0.3.0 → 0.5.0

package/dist/cost.js

@@ -0,0 +1,141 @@
+/**
+ * Usage & cost tracking (enterprise feature).
+ *
+ * Every LLM call writes an `llm_usage` event into the session JSONL log:
+ *   { ts, type: "llm_usage", model, provider, usage: { input_tokens, output_tokens, cached_tokens } }
+ *
+ * `scoder cost` reads those logs and aggregates tokens + estimated cost.
+ * All logic here is pure/filesystem-only so it stays unit-testable.
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { resolveModelPricing } from "./constants.js";
+/** Extract `llm_usage` events from a list of raw log events. */
+export function extractUsageEvents(sessionId, events) {
+    const out = [];
+    for (const ev of events) {
+        if (ev.type !== "llm_usage")
+            continue;
+        const usage = (ev.usage ?? {});
+        const num = (v) => (typeof v === "number" && Number.isFinite(v) ? v : 0);
+        out.push({
+            ts: typeof ev.ts === "string" ? ev.ts : undefined,
+            sessionId,
+            model: typeof ev.model === "string" ? ev.model : "unknown",
+            provider: typeof ev.provider === "string" ? ev.provider : undefined,
+            inputTokens: num(usage.input_tokens ?? usage.prompt_tokens),
+            outputTokens: num(usage.output_tokens ?? usage.completion_tokens),
+            cachedTokens: num(usage.cached_tokens),
+        });
+    }
+    return out;
+}
+/** Cost of one usage event in USD (cached tokens are billed like input tokens here — provider-specific discounts are approximated by the price table). */
+export function estimateEventCost(ev, overrides = {}) {
+    const p = resolveModelPricing(ev.model, overrides);
+    return (ev.inputTokens / 1_000_000) * p.input + (ev.outputTokens / 1_000_000) * p.output;
+}
+/** Aggregate usage events into totals + estimated cost. */
+export function aggregateUsage(events, overrides = {}) {
+    const agg = { calls: 0, inputTokens: 0, outputTokens: 0, cachedTokens: 0, costUsd: 0 };
+    for (const ev of events) {
+        agg.calls += 1;
+        agg.inputTokens += ev.inputTokens;
+        agg.outputTokens += ev.outputTokens;
+        agg.cachedTokens += ev.cachedTokens;
+        agg.costUsd += estimateEventCost(ev, overrides);
+    }
+    agg.costUsd = Math.round(agg.costUsd * 10_000) / 10_000; // round to $0.0001
+    return agg;
+}
+/** Parse a JSONL log file into raw events (null if missing/unreadable). */
+export function readJsonlLog(path) {
+    let content;
+    try {
+        content = readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+    const events = [];
+    for (const line of content.split("\n")) {
+        if (!line.trim())
+            continue;
+        try {
+            events.push(JSON.parse(line));
+        }
+        catch {
+            // skip malformed lines
+        }
+    }
+    return events;
+}
+/** List all session log files, newest id first (ids sort chronologically). */
+export function listLogSessions(workdir) {
+    const dir = resolve(workdir, ".scoder/logs");
+    if (!existsSync(dir))
+        return [];
+    try {
+        return readdirSync(dir)
+            .filter((f) => f.endsWith(".jsonl"))
+            .map((f) => f.slice(0, -".jsonl".length))
+            .sort()
+            .reverse();
+    }
+    catch {
+        return [];
+    }
+}
+/** Load all usage events of a single session (or [] if no log). */
+export function loadSessionUsage(workdir, sessionId) {
+    const path = resolve(workdir, ".scoder/logs", `${sessionId}.jsonl`);
+    const events = readJsonlLog(path);
+    return events ? extractUsageEvents(sessionId, events) : [];
+}
+/**
+ * Collect usage for a selection of sessions:
+ *  - explicit id    -> that session
+ *  - "last n"       -> n most recent session logs
+ *  - all            -> every session log in the workdir
+ */
+export function collectUsage(workdir, opts = {}) {
+    let ids;
+    if (opts.sessionId) {
+        ids = [opts.sessionId];
+    }
+    else if (typeof opts.last === "number") {
+        const all = listLogSessions(workdir);
+        ids = all.slice(0, Math.max(0, opts.last));
+    }
+    else {
+        ids = listLogSessions(workdir);
+    }
+    return ids.map((id) => ({
+        sessionId: id,
+        aggregate: aggregateUsage(loadSessionUsage(workdir, id), opts.pricingOverrides),
+    }));
+}
+/** Render a human-readable cost report (also used by tests to assert output). */
+export function formatCostReport(sessionCosts) {
+    if (sessionCosts.length === 0) {
+        return "No LLM usage recorded. Run with --log-file (or SCODER_LOG_FILE=1) to record usage.";
+    }
+    const grand = { calls: 0, inputTokens: 0, outputTokens: 0, cachedTokens: 0, costUsd: 0 };
+    const lines = ["COST REPORT"];
+    for (const sc of sessionCosts) {
+        const a = sc.aggregate;
+        grand.calls += a.calls;
+        grand.inputTokens += a.inputTokens;
+        grand.outputTokens += a.outputTokens;
+        grand.cachedTokens += a.cachedTokens;
+        grand.costUsd += a.costUsd;
+        lines.push(`  ${sc.sessionId}  calls=${a.calls}  in=${a.inputTokens.toLocaleString("en-US")}  out=${a.outputTokens.toLocaleString("en-US")}  cached=${a.cachedTokens.toLocaleString("en-US")}  cost≈$${a.costUsd.toFixed(4)}`);
+    }
+    grand.costUsd = Math.round(grand.costUsd * 10_000) / 10_000;
+    lines.push(`TOTAL (${sessionCosts.length} session(s))  calls=${grand.calls}  in=${grand.inputTokens.toLocaleString("en-US")}  out=${grand.outputTokens.toLocaleString("en-US")}  cached=${grand.cachedTokens.toLocaleString("en-US")}  cost≈$${grand.costUsd.toFixed(4)}`);
+    return lines.join("\n");
+}
+/** Join a path under the workdir's log dir (exported for tests). */
+export function logFilePath(workdir, sessionId) {
+    return join(workdir, ".scoder/logs", `${sessionId}.jsonl`);
+}

package/dist/index.js

@@ -6,6 +6,7 @@ import { loadConfig } from "./config.js";
 import { Agent } from "./agent.js";
 import { listSessions, resolveSessionId, pruneSessions } from "./session.js";
 import { JsonlLogger } from "./logger.js";
+import { collectUsage, formatCostReport } from "./cost.js";
 import { getVersion as getPackageVersion } from "./version.js";
 import * as ui from "./ui.js";
 // Single source of truth: read version from package.json (see src/version.ts).
@@ -18,6 +19,11 @@ USAGE
   scoder list                      List saved sessions for this directory
   scoder resume <id|last> [task]   Resume a saved session (optionally with a follow-up task)
   scoder logs [id|last] [filter]   Print a session's JSONL log (requires --log-file runs)
+  scoder cost [--session <id>] [--last <n>]
+                                    Token usage & estimated cost from JSONL logs
+  scoder serve [--port <n>] [--host <addr>]
+                                    Run as an HTTP server: POST tasks, stream
+                                    progress via Server-Sent Events (see below)
   scoder --version | --help
 
 OPTIONS
@@ -33,6 +39,8 @@ OPTIONS
   --no-save                 Disable session auto-save to .scoder/sessions/
   --log-file                Write a JSONL event log to .scoder/logs/<session>.jsonl
                             (or set SCODER_LOG_FILE=1 / =/path/to/log.jsonl)
+  --session <id>            (cost) Aggregate usage of one specific session
+  --last <n>                (cost) Aggregate usage of the n most recent sessions
   -h, --help                Show this help
   -v, --version             Show version
 
@@ -96,6 +104,17 @@ function parseArgs(argv) {
             case "--log-file":
                 args.logFile = true;
                 break;
+            case "--session":
+                args.costSession = next();
+                break;
+            case "--last": {
+                const n = Number(next());
+                if (!Number.isFinite(n) || n < 1) {
+                    throw new Error(`Invalid --last value (expected a positive integer): ${n}`);
+                }
+                args.costLast = Math.floor(n);
+                break;
+            }
             case "--provider": {
                 const p = next();
                 if (p !== "openai" && p !== "anthropic") {
@@ -104,6 +123,17 @@ function parseArgs(argv) {
                 args.provider = p;
                 break;
             }
+            case "--port": {
+                const n = Number(next());
+                if (!Number.isInteger(n) || n < 0 || n > 65535) {
+                    throw new Error(`Invalid --port value (expected 0-65535): ${n}`);
+                }
+                args.servePort = n;
+                break;
+            }
+            case "--host":
+                args.serveHost = next();
+                break;
             case "-h":
             case "--help":
                 args.help = true;
@@ -135,6 +165,14 @@ function parseArgs(argv) {
         args.logsId = rest[1] ?? "last";
         args.logsFilter = rest.length > 2 ? rest.slice(2).join(" ") : undefined;
     }
+    else if (rest[0] === "cost") {
+        args.subcommand = "cost";
+        args.task = null;
+    }
+    else if (rest[0] === "serve") {
+        args.subcommand = "serve";
+        args.task = null;
+    }
     return args;
 }
 async function runOnce(cfg, task) {
@@ -273,6 +311,41 @@ async function main() {
         }
         return;
     }
+    if (args.subcommand === "cost") {
+        const sessionCosts = collectUsage(cfg.workdir, {
+            sessionId: args.costSession,
+            last: args.costLast,
+            pricingOverrides: cfg.modelPricing,
+        });
+        console.log(formatCostReport(sessionCosts));
+        return;
+    }
+    if (args.subcommand === "serve") {
+        const { startServer } = await import("./server.js");
+        if (!cfg.apiKey) {
+            ui.warn("No API key configured — runs will fail until SCODER_API_KEY (or OPENAI_API_KEY) is set.");
+        }
+        const srv = await startServer(cfg, { host: args.serveHost, port: args.servePort });
+        const token = process.env.SCODER_SERVER_TOKEN ? " · token auth" : "";
+        ui.banner(`scoder serve @ http://${args.serveHost ?? "127.0.0.1"}:${srv.port}${token}`, [
+            ["task", `POST /api/runs { "task": "..." } → 202 { id, eventsUrl }`],
+            ["events", `GET /api/runs/<id>/events → SSE stream`],
+            ["list", `GET /api/runs`],
+            ["abort", `POST /api/runs/<id>/abort`],
+            ["workdir", cfg.workdir],
+            ["model", `${cfg.model}  ·  permission ${cfg.permissionMode}`],
+        ]);
+        const shutdown = async () => {
+            ui.info("shutting down server...");
+            await srv.close();
+            process.exit(0);
+        };
+        process.on("SIGINT", () => {
+            ui.warn("\nSIGINT — shutting down server, aborting in-flight runs...");
+            void shutdown();
+        });
+        return;
+    }
     if (args.task) {
         const code = await runOnce(cfg, args.task);
         process.exit(code);

package/dist/llm.js

@@ -119,6 +119,16 @@ export class LlmClient {
         const choice = data.choices?.[0]?.message;
         if (!choice)
             throw new LlmError("LLM API returned no message in response");
+        // Extract cached prompt tokens when the provider reports them
+        // (OpenAI-style: usage.prompt_tokens_details.cached_tokens).
+        let usage;
+        if (data.usage) {
+            usage = { ...data.usage };
+            const details = usage.prompt_tokens_details;
+            if (usage.cached_tokens === undefined && typeof details?.cached_tokens === "number") {
+                usage.cached_tokens = details.cached_tokens;
+            }
+        }
         return {
             message: {
                 role: "assistant",
@@ -130,7 +140,7 @@ export class LlmClient {
                     arguments: tc.function?.arguments ?? "",
                 })),
             },
-            usage: data.usage,
+            usage,
         };
     }
     // ── Streaming ───────────────────────────────────────────────────────────────

package/dist/permissions.js

@@ -10,9 +10,30 @@ import { createInterface } from "node:readline";
 // Catastrophic command patterns — always denied, no exceptions
 // ---------------------------------------------------------------------------
 const CATASTROPHIC_PATTERNS = [
+    // rm -rf (original) — kept for backwards compatibility
     /rm\s+-rf\s+[/~"]|(?:rm\s+-rf\s+\/\*)/i,
-    /mkfs\b/i,
+    // rm with whitespace/flag variants: "rm  -rf /", "rm -fr /", "rm -r -f /",
+    // "rm --recursive --force /", "rm -rvf /" … i.e. any rm followed by one or
+    // more option flags and then a target at filesystem root or home.
+    // Does NOT match common safe commands: "rm -rf node_modules", "rm file.txt",
+    // "rm ./build" (target must START with / or ~).
+    /\brm\s+(?:-{1,2}[\w-]+\s+)+["']?[/~](?:\s|$|\/)/,
+    // rm with a single flag token containing both r/R and f (e.g. -fr, -Rf, -rvf)
+    // targeting / or ~ — covered above, but also catch "rm -fr --no-preserve-root".
+    /\brm\s+[^|;&>]*--no-preserve-root/i,
+    // base64/sh -c wrappers used to smuggle destructive commands past filters:
+    //   echo cm0gLXJmIC8= | base64 -d | sh
+    //   sh -c "rm -rf /"
+    /base64\s+(?:-d|-D|--decode)\b[^|;&]*\|\s*(?:ba|z|da)?sh\b/i,
+    /\b(?:ba|z|da)?sh\s+-c\s+["'][^"']*\brm\s+[^"']*\s-[a-zA-Z]*[rf]/i,
+    // Filesystem destruction
+    /\bmkfs(?:\.[a-z0-9]+)?\b/i,
     /dd\s+.*of=\//i,
+    /chmod\s+-R\s+0[77][07][07]\s+[/~]/i,
+    // chmod -R 777 on / or ~ (any flag spelling: -R, -r, -Rf, --recursive)
+    /\bchmod\s+(?:-{1,2}[\w-]+\s+)+[0-7]{3,4}\s+["']?[/~](?:\s|$|\/)/,
+    // Redirect raw writes to block devices: > /dev/sda, > /dev/nvme0n1, dd > disk...
+    />\s*\/dev\/(?:sd[a-z]+|hd[a-z]+|nvme\d+n\d+(?:p\d+)?|disk\d|rdisk\d)/i,
     /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/i,
     // curl/wget pipe-to-shell: match any content between command and '| sh'/'| bash'
     // Handles -qO-, -X POST, etc. flags; URL-like patterns must contain '/' or '.'
@@ -20,9 +41,9 @@ const CATASTROPHIC_PATTERNS = [
     /curl\s+.*[/.].*\s*\|\s*bash\b/i,
     /wget\s+.*[/.].*\s*\|\s*sh\b/i,
     /wget\s+.*[/.].*\s*\|\s*bash\b/i,
-    /sudo\s+rm\s+-rf/i,
+    // sudo rm with any recursive/force flag combo: "sudo rm -rf x", "sudo rm -fr /usr"
+    /sudo\s+rm\s+[^|;&]*-\w*[rR]/i,
     /\bshutdown\b|\breboot\b|\binit\s+[06]\b/i,
-    /chmod\s+-R\s+0[77][07][07]\s+[/~]/i,
     />\s*\/dev\/sda/i,
     /\|\s*nc\s+-e\s+/i,
     /\|\s*bash\s+-i/i,

package/dist/provider-anthropic.js

@@ -72,16 +72,20 @@ export function fromAnthropicResponse(data) {
             });
         }
     }
+    const usage = {
+        prompt_tokens: data.usage?.input_tokens,
+        completion_tokens: data.usage?.output_tokens,
+    };
+    if (typeof data.usage?.cache_read_input_tokens === "number") {
+        usage.cached_tokens = data.usage.cache_read_input_tokens;
+    }
     return {
         message: {
             role: "assistant",
             content: text.length > 0 ? text : null,
             tool_calls: toolCalls.length > 0 ? toolCalls : undefined,
         },
-        usage: {
-            prompt_tokens: data.usage?.input_tokens,
-            completion_tokens: data.usage?.output_tokens,
-        },
+        usage,
     };
 }
 // ---------------------------------------------------------------------------
@@ -216,6 +220,9 @@ export class AnthropicClient {
                         prompt_tokens: ev.message.usage.input_tokens,
                         completion_tokens: ev.message.usage.output_tokens,
                     };
+                    if (typeof ev.message.usage.cache_read_input_tokens === "number") {
+                        usage.cached_tokens = ev.message.usage.cache_read_input_tokens;
+                    }
                 }
                 return null;
             }
@@ -252,6 +259,9 @@ export class AnthropicClient {
                         prompt_tokens: usage?.prompt_tokens ?? ev.usage.input_tokens,
                         completion_tokens: ev.usage.output_tokens ?? usage?.completion_tokens,
                     };
+                    if (usage?.cached_tokens === undefined && typeof ev.usage.cache_read_input_tokens === "number") {
+                        usage = { ...usage, cached_tokens: ev.usage.cache_read_input_tokens };
+                    }
                 }
                 return null;
             }

package/dist/server.js

@@ -0,0 +1,256 @@
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+import { existsSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+import process from "node:process";
+import { Agent } from "./agent.js";
+const MAX_BODY_BYTES = 1024 * 1024;
+function readBody(req, maxBytes = MAX_BODY_BYTES) {
+    return new Promise((resolve, reject) => {
+        let body = "";
+        let size = 0;
+        req.on("data", (c) => {
+            size += c.byteLength;
+            if (size > maxBytes) {
+                reject(new Error(`request body too large (>${maxBytes} bytes)`));
+                req.destroy();
+                return;
+            }
+            body += c.toString("utf8");
+        });
+        req.on("end", () => resolve(body));
+        req.on("error", reject);
+    });
+}
+function sendJson(res, status, payload) {
+    res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
+    res.end(JSON.stringify(payload));
+}
+function isAuthorized(req, token) {
+    if (!token)
+        return true;
+    const header = req.headers.authorization ?? "";
+    return header === `Bearer ${token}`;
+}
+export function startServer(baseConfig, opts = {}) {
+    const host = opts.host ?? "127.0.0.1";
+    const maxConcurrent = opts.maxConcurrent ?? 4;
+    const token = process.env.SCODER_SERVER_TOKEN || "";
+    /** id -> run record; Map preserves insertion order (= creation order). */
+    const runs = new Map();
+    const publicRun = (r) => ({
+        id: r.id,
+        task: r.task,
+        workdir: r.workdir,
+        status: r.status,
+        createdAt: r.createdAt,
+        finishedAt: r.finishedAt,
+        eventCount: r.events.length,
+        result: r.result,
+        error: r.error,
+        eventsUrl: `/api/runs/${r.id}/events`,
+    });
+    const runningCount = () => [...runs.values()].filter((r) => r.status === "running").length;
+    /** Launch an agent run in the background, wiring events into the record. */
+    const launchRun = (record, cfg, task) => {
+        const agent = new Agent(cfg);
+        record.agent = agent;
+        agent.onEvent = (ev) => {
+            record.events.push(ev);
+            if (ev.type === "finish") {
+                record.status = ev.success ? "success" : record.abortRequested ? "aborted" : "failed";
+                record.finishedAt = new Date().toISOString();
+            }
+            for (const sub of record.subscribers)
+                sub();
+        };
+        agent
+            .run(task)
+            .then((result) => {
+            record.result = result;
+            if (record.status === "running") {
+                // Should not happen (finish event always arrives first), but be safe.
+                record.status = result.success ? "success" : record.abortRequested ? "aborted" : "failed";
+                record.finishedAt = new Date().toISOString();
+            }
+        })
+            .catch((err) => {
+            record.error = err.message;
+            // Synthetic terminal events so SSE clients always see a stream end.
+            record.events.push({ type: "error", message: record.error });
+            record.events.push({ type: "finish", success: false, steps: 0, summary: `run failed: ${record.error}` });
+            record.status = "error";
+            record.finishedAt = new Date().toISOString();
+            for (const sub of record.subscribers)
+                sub();
+        });
+    };
+    const handleEventsSSE = (req, res, record) => {
+        res.writeHead(200, {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache",
+            Connection: "keep-alive",
+        });
+        let sent = 0;
+        const heartbeat = setInterval(() => {
+            if (!res.writableEnded)
+                res.write(": ping\n\n");
+        }, 15_000);
+        heartbeat.unref?.();
+        /** Replay buffered events + live ones; ends the stream on a terminal event. */
+        const flush = () => {
+            while (sent < record.events.length) {
+                const ev = record.events[sent++];
+                res.write(`data: ${JSON.stringify(ev)}\n\n`);
+                if (ev.type === "finish" || ev.type === "error") {
+                    res.end();
+                    record.subscribers.delete(flush);
+                    return;
+                }
+            }
+        };
+        record.subscribers.add(flush);
+        flush(); // replays the buffer, then stays live via the subscription
+        req.on("close", () => {
+            record.subscribers.delete(flush);
+            clearInterval(heartbeat);
+        });
+    };
+    const handle = async (req, res) => {
+        const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+        const path = url.pathname;
+        if (!isAuthorized(req, token)) {
+            sendJson(res, 401, { error: "unauthorized (set Authorization: Bearer <SCODER_SERVER_TOKEN>)" });
+            return;
+        }
+        // ── GET /api/health ──
+        if (path === "/api/health" && req.method === "GET") {
+            sendJson(res, 200, { ok: true, running: runningCount(), runs: runs.size });
+            return;
+        }
+        // ── /api/runs ──
+        if (path === "/api/runs") {
+            if (req.method === "GET") {
+                sendJson(res, 200, { runs: [...runs.values()].map(publicRun) });
+                return;
+            }
+            if (req.method === "POST") {
+                if (runningCount() >= maxConcurrent) {
+                    sendJson(res, 429, { error: `too many concurrent runs (max ${maxConcurrent}) — retry later` });
+                    return;
+                }
+                let body;
+                try {
+                    body = JSON.parse(await readBody(req));
+                }
+                catch (err) {
+                    sendJson(res, 400, { error: err.message });
+                    return;
+                }
+                if (typeof body.task !== "string" || body.task.trim().length === 0) {
+                    sendJson(res, 400, { error: 'field "task" (non-empty string) is required' });
+                    return;
+                }
+                const cfg = { ...baseConfig, yes: true };
+                if (body.workdir) {
+                    const abs = resolve(body.workdir);
+                    if (!existsSync(abs) || !statSync(abs).isDirectory()) {
+                        sendJson(res, 400, { error: `workdir does not exist or is not a directory: ${body.workdir}` });
+                        return;
+                    }
+                    cfg.workdir = abs;
+                }
+                const permission = body.permission ?? cfg.permissionMode;
+                if (permission === "ask") {
+                    sendJson(res, 400, { error: 'permission "ask" is not supported by the server (it cannot prompt). Use "auto" or "readonly".' });
+                    return;
+                }
+                cfg.permissionMode = permission;
+                if (body.buildCmd)
+                    cfg.buildCmd = body.buildCmd;
+                if (body.model)
+                    cfg.model = body.model;
+                if (body.provider)
+                    cfg.provider = body.provider;
+                if (body.maxSteps)
+                    cfg.maxSteps = Math.min(Math.max(body.maxSteps, 1), 500);
+                const record = {
+                    id: randomUUID(),
+                    task: body.task,
+                    workdir: cfg.workdir,
+                    status: "running",
+                    createdAt: new Date().toISOString(),
+                    finishedAt: null,
+                    events: [],
+                    subscribers: new Set(),
+                    agent: null,
+                    abortRequested: false,
+                    result: null,
+                    error: null,
+                };
+                runs.set(record.id, record);
+                launchRun(record, cfg, body.task);
+                sendJson(res, 202, publicRun(record));
+                return;
+            }
+            sendJson(res, 405, { error: "method not allowed" });
+            return;
+        }
+        // ── /api/runs/:id[...] ──
+        const runMatch = path.match(/^\/api\/runs\/([0-9a-f-]{36})(\/events|\/abort)?$/i);
+        if (runMatch) {
+            const record = runs.get(runMatch[1]);
+            if (!record) {
+                sendJson(res, 404, { error: `unknown run id: ${runMatch[1]}` });
+                return;
+            }
+            if (runMatch[2] === "/events" && req.method === "GET") {
+                handleEventsSSE(req, res, record);
+                return;
+            }
+            if (runMatch[2] === "/abort" && req.method === "POST") {
+                if (record.status !== "running" || !record.agent) {
+                    sendJson(res, 409, { error: `run is not running (status: ${record.status})` });
+                    return;
+                }
+                record.abortRequested = true;
+                record.agent.abort();
+                sendJson(res, 200, { ok: true, status: "running (aborting...)" });
+                return;
+            }
+            if (!runMatch[2] && req.method === "GET") {
+                sendJson(res, 200, publicRun(record));
+                return;
+            }
+        }
+        sendJson(res, 404, { error: `not found: ${req.method} ${path}` });
+    };
+    const server = createServer((req, res) => {
+        void handle(req, res).catch(() => {
+            if (!res.writableEnded)
+                sendJson(res, 500, { error: "internal server error" });
+        });
+    });
+    return new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(opts.port ?? 0, host, () => {
+            const address = server.address();
+            const port = typeof address === "object" && address !== null ? address.port : 0;
+            resolve({
+                server,
+                port,
+                close: () => new Promise((res) => {
+                    // Abort in-flight runs so background work does not keep the loop alive.
+                    for (const r of runs.values()) {
+                        if (r.status === "running") {
+                            r.abortRequested = true;
+                            r.agent?.abort();
+                        }
+                    }
+                    server.close(() => res());
+                    server.closeAllConnections?.();
+                }),
+            });
+        });
+    });
+}