shadok-ai 0.1.0

package/dist/server.js

@@ -0,0 +1,854 @@
+import { randomUUID } from "node:crypto";
+import fs from "node:fs";
+import http from "node:http";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import express from "express";
+import { WebSocketServer } from "ws";
+import { detectDialog, findSessionId, listSessions, loadHistory, } from "./extract.js";
+import { findTransientErrors, newTransientErrors, RETRY_DELAYS_MS } from "./retry.js";
+import { screenShowsWork } from "./detect.js";
+import { PtyPilot } from "./session.js";
+import { TmuxPilot, tmuxAvailable, tmuxHasSession, tmuxPaneCwd } from "./tmux.js";
+import { scanUsage, sessionFilePath, tailSession } from "./tail.js";
+import { computePace, paceBlock, WINDOW_SEC } from "./pace.js";
+import { getUsage } from "./usage.js";
+import { loadChannels, loadGroups, saveGroups, upsertChannel, removeChannel, mergeClientChannels, } from "./channels.js";
+import { startTelegram, renameTelegramTopic, closeTelegramTopic } from "./telegram.js";
+import { migrateTgBindings } from "./channels.js";
+import { secretsForCwd, secretKeys, setSecret, deleteSecret, resolveRepo } from "./secrets.js";
+import { createWorktree, ensureWorktreeCheckout, gitDiff, isGitRepo, listPastSessions, } from "./worktree.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const PORT = Number(process.env.PORT ?? 3789);
+const app = express();
+app.use(express.json({ limit: "1mb" }));
+app.use(express.static(path.join(__dirname, "..", "public")));
+// Markdown parser served locally (history rendering on the client).
+app.get("/vendor/marked.js", (_req, res) => res.sendFile(path.join(__dirname, "..", "node_modules", "marked", "lib", "marked.umd.js")));
+// Resumable sessions of a directory (for the "resume by id" picker).
+app.get("/sessions", (req, res) => {
+    const cwd = String(req.query.cwd ?? "").trim() || process.cwd();
+    res.json(listSessions(cwd));
+});
+// Sessions alive in THIS server (agents spawned by any client, including the
+// pilotctl thin client). They own no transcript until their first turn, so
+// /sessions cannot see them — this is the only way the UI can list them.
+app.get("/live", (_req, res) => {
+    res.json([...sessions.values()]
+        .filter((s) => !s.pilot.hasExited)
+        .map((s) => ({
+        id: s.id,
+        cwd: s.cwd,
+        branch: s.worktree?.branch ?? null,
+        busy: s.busy,
+        clients: s.clients.size,
+        lastPrompt: s.lastPrompt,
+    })));
+});
+// Current 5-hour and 7-day subscription usage, each window enriched with how it
+// compares to the time already elapsed (for the quota gauges and the send guard).
+app.get("/usage", async (_req, res) => {
+    const u = await getUsage();
+    const now = Date.now();
+    // The pace is derived per request, not per fetch: getUsage() caches for 60 s
+    // and a frozen pace would drift away from the clock.
+    const enrich = (w, durationSec) => w ? { ...w, ...computePace(w, durationSec, now) } : null;
+    res.json({
+        fiveHour: enrich(u?.fiveHour ?? null, WINDOW_SEC.fiveHour),
+        sevenDay: enrich(u?.sevenDay ?? null, WINDOW_SEC.sevenDay),
+        fetchedAt: u?.fetchedAt ?? now,
+        ...paceBlock(u, now),
+    });
+});
+// Changes made by a session (git status + diff), for the review panel.
+app.get("/diff", (req, res) => {
+    const s = sessions.get(String(req.query.session ?? ""));
+    if (!s)
+        return res.json({ status: "", diff: "", branch: null, error: "no such session" });
+    res.json(gitDiff(s.cwd, s.worktree?.baseSha ?? null));
+});
+// Past worktree sessions of a repo (for reopening unfinished work).
+app.get("/recover", (req, res) => {
+    const repo = String(req.query.repo ?? "").trim() || process.cwd();
+    res.json(isGitRepo(repo) ? listPastSessions(repo) : []);
+});
+// Server-side defaults (the launch directory pre-fills the working dir field).
+app.get("/defaults", (_req, res) => {
+    res.json({ cwd: process.cwd() });
+});
+// Channel list, persisted server-side per launch directory — survives a wiped
+// browser, another device, a restart or a reboot.
+app.get("/channels", (_req, res) => res.json(loadChannels()));
+app.put("/channels", (req, res) => {
+    // Merge, don't overwrite: the browser owns order + name/group, but must never
+    // drop a live or Telegram-bound session or strip server-owned fields.
+    const live = new Set([...sessions.values()].filter((s) => !s.pilot.hasExited).map((s) => s.id));
+    const before = new Map(loadChannels().map((c) => [c.sessionId, c.name]));
+    const merged = mergeClientChannels(Array.isArray(req.body) ? req.body : [], live);
+    // A web-side rename of a Telegram-bound channel → rename its topic too.
+    for (const c of merged) {
+        if (c.telegram?.threadId && c.name && c.name !== before.get(c.sessionId)) {
+            renameTelegramTopic(c.telegram.chatId, c.telegram.threadId, c.name);
+        }
+    }
+    res.json(merged);
+});
+app.get("/groups", (_req, res) => res.json(loadGroups()));
+app.put("/groups", (req, res) => {
+    saveGroups(Array.isArray(req.body) ? req.body : []);
+    res.json({ ok: true });
+});
+// Per-repo secrets, injected as env into agents (stored 600 outside any repo).
+// The repo is resolved from a session's cwd; values are NEVER returned.
+function repoOf(session, repo) {
+    const s = sessions.get(String(session ?? ""));
+    return s ? resolveRepo(s.cwd) : String(repo ?? "").trim() || process.cwd();
+}
+app.get("/secrets", (req, res) => {
+    const repo = repoOf(req.query.session, req.query.repo);
+    res.json({ repo, keys: secretKeys(repo) });
+});
+app.put("/secrets", (req, res) => {
+    const { session, repo, key, value } = req.body ?? {};
+    if (typeof key !== "string" || !key.trim() || typeof value !== "string")
+        return res.status(400).json({ error: "key and value required" });
+    const r = repoOf(session, repo);
+    setSecret(r, key.trim(), value);
+    res.json({ repo: r, keys: secretKeys(r) });
+});
+app.delete("/secrets", (req, res) => {
+    const { session, repo, key } = req.body ?? {};
+    const r = repoOf(session, repo);
+    if (typeof key === "string")
+        deleteSecret(r, key);
+    res.json({ repo: r, keys: secretKeys(r) });
+});
+const server = http.createServer(app);
+const wss = new WebSocketServer({ server, path: "/ws" });
+/**
+ * Selects the transport. tmux is the DEFAULT whenever it is installed: the
+ * agent runs in a detached tmux session named after the Claude session id, so
+ * it survives the server restarting/crashing and is reattached on the next
+ * start of the same id. Set SHADOK_TMUX=0 to force the node-pty transport
+ * (which dies with the server). Falls back to node-pty if tmux is absent.
+ */
+const USE_TMUX = process.env.SHADOK_TMUX !== "0" && tmuxAvailable();
+function makePilot(id, cwd, args) {
+    // Inject the repo's secrets as env — never written into the working dir.
+    const env = secretsForCwd(cwd);
+    return USE_TMUX
+        ? new TmuxPilot({ cwd, args, env, tmuxName: "sk-" + id })
+        : new PtyPilot({ cwd, args, env });
+}
+/** Session-wide token totals, for the window-title counter. */
+function tokenTotals(s) {
+    const t = { input: 0, output: 0, cacheCreation: 0, cacheRead: 0 };
+    for (const u of s.usage.values()) {
+        t.input += u.input;
+        t.output += u.output;
+        t.cacheCreation += u.cacheCreation;
+        t.cacheRead += u.cacheRead;
+    }
+    return t;
+}
+/**
+ * How long a session with no attached client is kept alive before being
+ * reclaimed. Closing a tab or reloading detaches but does NOT kill the agent;
+ * you reattach on return and the running turn continues. Set 0 to keep
+ * sessions until the process exits or an explicit End.
+ */
+const IDLE_RECLAIM_MS = Number(process.env.SHADOK_IDLE_MIN ?? 60) * 60_000;
+const sessions = new Map();
+function broadcast(s, msg, except) {
+    const data = JSON.stringify(msg);
+    for (const c of s.clients) {
+        if (c !== except && c.readyState === c.OPEN)
+            c.send(data);
+    }
+}
+function destroySession(s) {
+    if (s.screenTimer)
+        clearInterval(s.screenTimer);
+    s.screenTimer = null;
+    if (s.idleTimer)
+        clearTimeout(s.idleTimer);
+    s.idleTimer = null;
+    if (s.retryTimer)
+        clearTimeout(s.retryTimer);
+    s.retryTimer = null;
+    s.stopTail?.();
+    s.stopTail = null;
+    s.pilot.kill();
+    // Worktrees are durable: never auto-removed. They persist (with their
+    // branch and any uncommitted changes) until an explicit merge/discard,
+    // so no work is ever silently lost.
+    sessions.delete(s.id);
+}
+function detach(ws, s) {
+    s.clients.delete(ws);
+    if (s.clients.size !== 0)
+        return;
+    // No viewer attached: keep the agent running and reclaim only after a long
+    // idle, so reloading or closing a tab never aborts work.
+    if (IDLE_RECLAIM_MS <= 0)
+        return;
+    if (s.idleTimer)
+        clearTimeout(s.idleTimer);
+    s.idleTimer = setTimeout(() => {
+        if (s.clients.size === 0)
+            destroySession(s);
+    }, IDLE_RECLAIM_MS);
+}
+async function createSession(id, cwd, args, worktree = null) {
+    const pilot = makePilot(id, cwd, args);
+    const s = {
+        id,
+        cwd,
+        pilot,
+        clients: new Set(),
+        busy: false,
+        lastPrompt: "",
+        screenTimer: null,
+        lastScreen: "",
+        contextPct: null,
+        stopTail: null,
+        worktree,
+        idleTimer: null,
+        // Resumed sessions start with what the transcript already consumed.
+        usage: scanUsage(sessionFilePath(cwd, id)),
+        retryTimer: null,
+        retryCount: 0,
+        errorsAtTurnStart: [],
+        turnStartedAt: null,
+        lastTurnMs: null,
+    };
+    await attachPilot(s);
+    return s;
+}
+/**
+ * Wires a session's pilot: exit handling, content tail, screen watcher, and the
+ * wait-until-up handshake. Split out of createSession so a restart can swap in a
+ * fresh pilot (e.g. to pick up new env/secrets) on the SAME Live object — every
+ * WS client keeps its reference, so nobody is disconnected.
+ */
+async function attachPilot(s) {
+    const pilot = s.pilot;
+    const { id, cwd } = s;
+    s.pilotOff = pilot.onExit((code) => {
+        if (s.restarting)
+            return; // a restart is swapping the pilot; don't tear down
+        broadcast(s, { type: "exited", code });
+        destroySession(s);
+    });
+    pilot.start();
+    // Stream authoritative content from the session transcript: each assistant
+    // text/tool block is broadcast as soon as Claude Code writes it — complete,
+    // never truncated, at message granularity.
+    s.stopTail = tailSession(sessionFilePath(cwd, id), (e) => {
+        if (e.kind === "text")
+            broadcast(s, { type: "stream-text", text: e.text });
+        else if (e.kind === "tool")
+            broadcast(s, { type: "stream-tool", id: e.id, name: e.name, summary: e.summary });
+        else if (e.kind === "usage") {
+            s.usage.set(e.messageId, e.usage);
+            broadcast(s, { type: "tokens", tokens: tokenTotals(s) });
+        }
+        else
+            broadcast(s, {
+                type: "stream-result",
+                toolUseId: e.toolUseId,
+                text: e.text,
+                isError: e.isError,
+            });
+    });
+    let settled = false;
+    s.screenTimer = setInterval(() => {
+        if (pilot.hasExited)
+            return;
+        const scr = pilot.screen();
+        if (scr !== s.lastScreen) {
+            s.lastScreen = scr;
+            broadcast(s, { type: "screen", text: scr, working: pilot.isWorking() });
+            // Context-window usage from the TUI footer ("… ctx:37% …"), per session.
+            const m = scr.match(/ctx:\s*(\d+)\s*%/i);
+            const pct = m ? Number(m[1]) : s.contextPct;
+            if (pct !== s.contextPct) {
+                s.contextPct = pct;
+                broadcast(s, { type: "context", pct });
+            }
+        }
+        // Spontaneous resume: work restarting without a client prompt (e.g. a
+        // background agent completing and waking the model). No handler called
+        // finishTurn, so watch for it here and signal the turn like any other.
+        if (settled && !s.busy && pilot.isWorking())
+            finishTurn(s).catch(() => { });
+    }, 300);
+    // Ready as soon as the TUI is up: trust prompt, input line, or an
+    // in-flight turn. A session reattached MID-WORK (tmux survives server
+    // restarts, and turns can run for many minutes) must not block on idle —
+    // the screen watcher above signals the running turn right after `settled`.
+    const isUp = (scr) => /do you trust the files/i.test(scr) || screenShowsWork(scr) || scr.includes("❯");
+    let screen = await pilot.waitFor(isUp, { timeoutMs: 60_000 });
+    if (/do you trust the files/i.test(screen)) {
+        pilot.press("enter");
+        screen = await pilot.waitFor((scr) => screenShowsWork(scr) || scr.includes("❯"), { timeoutMs: 30_000 });
+    }
+    // Resuming a large session shows a "resume from summary?" prompt. Keep the
+    // FULL session as-is automatically (the machine may have slept mid-work; the
+    // user wants their full context back, not a summary), unless disabled.
+    if (process.env.SHADOK_RESUME_SUMMARY !== "1") {
+        const rd = detectDialog(screen);
+        const full = rd?.options.find((o) => /full session/i.test(o.label));
+        if (full && /resum|summary/i.test(rd.question)) {
+            await selectOption(pilot, full.n);
+            await pilot
+                .waitFor((scr) => screenShowsWork(scr) || scr.includes("❯"), { timeoutMs: 30_000 })
+                .catch(() => { });
+        }
+    }
+    settled = true;
+    sessions.set(id, s);
+}
+/**
+ * Waits for the current turn to finish and broadcasts the outcome. Content is
+ * streamed separately by the transcript tail; here we only signal an
+ * interactive dialog (turn stays suspended) or turn completion.
+ */
+async function finishTurn(s) {
+    s.busy = true;
+    if (!s.turnStartedAt)
+        s.turnStartedAt = Date.now();
+    s.errorsAtTurnStart = findTransientErrors(s.pilot.screen());
+    broadcast(s, { type: "working", startedAt: s.turnStartedAt });
+    try {
+        await s.pilot.waitForIdle({ stableMs: 2000, timeoutMs: 900_000 });
+        const dialog = detectDialog(s.pilot.screen());
+        if (dialog)
+            broadcast(s, { type: "dialog", ...dialog });
+        else {
+            broadcast(s, { type: "turn-done", sessionId: s.id });
+            maybeScheduleRetry(s);
+        }
+    }
+    finally {
+        s.busy = false;
+        // Remember how long it took: a dialog suspends the turn and a completion
+        // ends it, but both freeze the client's timer, so both are worth keeping.
+        if (s.turnStartedAt)
+            s.lastTurnMs = Date.now() - s.turnStartedAt;
+        s.turnStartedAt = null;
+    }
+}
+/** The option number the ❯ cursor is currently on, or null. */
+function selectedOptionN(screen) {
+    for (const l of screen.split("\n")) {
+        const m = l.match(/^\s*❯\s*(\d+)\.\s/);
+        if (m)
+            return Number(m[1]);
+    }
+    return null;
+}
+/**
+ * Selects option `n` in a single-select dialog by moving the ❯ cursor with
+ * arrow keys, then Enter — the only reliable way for preview-style dialogs
+ * that ignore digit keys. Falls back to typing the digit if the cursor can't
+ * be read.
+ */
+async function selectOption(pilot, n) {
+    for (let i = 0; i < 12; i++) {
+        const cur = selectedOptionN(pilot.screen());
+        if (cur === null) {
+            pilot.write(String(n)); // fallback: older digit-selectable dialogs
+            return;
+        }
+        if (cur === n) {
+            pilot.press("enter");
+            return;
+        }
+        pilot.press(cur < n ? "down" : "up");
+        await new Promise((r) => setTimeout(r, 160));
+    }
+    pilot.press("enter");
+}
+/**
+ * Surfaces a dialog already on screen when a client connects — e.g. the
+ * "resume from summary" or permission prompt that appears at startup/resume.
+ * Without this, a resumed session waiting on such a dialog looks frozen.
+ */
+function sendPendingDialog(s, send) {
+    const d = detectDialog(s.pilot.screen());
+    // The resume-from-summary prompt is auto-answered at startup; don't surface
+    // it (a stale copy can otherwise flash before the auto-answer lands).
+    if (d && d.options.some((o) => /full session/i.test(o.label)) && /resum|summary/i.test(d.question))
+        return;
+    if (d)
+        send({ type: "dialog", ...d });
+}
+/** Cancels a pending auto-retry (user took over, or session ends). */
+function clearRetry(s, notify = false) {
+    if (!s.retryTimer)
+        return;
+    clearTimeout(s.retryTimer);
+    s.retryTimer = null;
+    if (notify)
+        broadcast(s, { type: "auto-retry-cancelled" });
+}
+/**
+ * Pas de re-test du rythme pendant une pause. Aligné sur le TTL du cache de
+ * usage.ts : la boucle d'attente n'émet aucune requête vers l'API.
+ */
+const PACE_RECHECK_MS = 60_000;
+/**
+ * If the turn died on a NEW transient API error (529 Overloaded, 5xx,
+ * timeout…), schedules an automatic `continue` — 15 s, then 30 s, then
+ * 60 s. Cancelled if the user takes over; gives up after 3 attempts.
+ */
+function maybeScheduleRetry(s) {
+    if (s.retryTimer)
+        return; // one pending retry at a time
+    const fresh = newTransientErrors(s.errorsAtTurnStart, findTransientErrors(s.pilot.screen()));
+    if (fresh.length === 0) {
+        s.retryCount = 0; // clean turn: the error streak is over
+        return;
+    }
+    if (s.retryCount >= RETRY_DELAYS_MS.length) {
+        broadcast(s, { type: "auto-retry-gave-up", attempts: s.retryCount });
+        s.retryCount = 0;
+        return;
+    }
+    const delayMs = RETRY_DELAYS_MS[s.retryCount];
+    s.retryCount++;
+    broadcast(s, {
+        type: "auto-retry",
+        delayMs,
+        attempt: s.retryCount,
+        max: RETRY_DELAYS_MS.length,
+    });
+    // Set when the retry has been parked on a pace overrun, so the resume is
+    // announced only to clients that were told about the pause.
+    let held = false;
+    const fire = async () => {
+        // Keep s.retryTimer pointing at this chain across the await below: it is
+        // both the "a retry is pending" guard for maybeScheduleRetry and this
+        // chain's identity token.
+        const mine = s.retryTimer;
+        if (s.pilot.hasExited || s.busy) {
+            s.retryTimer = null;
+            return;
+        }
+        // Never forced: an automatic turn must not spend quota the user is being
+        // asked to hold back on. Park and re-test until the pace comes back down.
+        // A failed usage read must never block: paceBlock(null, …) reports
+        // "not blocked", so a rejection degrades to letting the retry through
+        // rather than wedging the chain on an unhandled rejection.
+        const verdict = paceBlock(await getUsage().catch(() => null), Date.now());
+        // A takeover (or teardown) replaced or cleared our timer while we were
+        // fetching: this chain is no longer the live one, so stand down — and
+        // leave s.retryTimer alone, it now belongs to whoever replaced us.
+        if (s.retryTimer !== mine)
+            return;
+        // Still ours, but the session died or a turn started on its own while we
+        // were fetching (the screen watcher sets s.busy without touching
+        // s.retryTimer). Submitting `continue` now would spend quota on an
+        // already-running turn. Release our own already-fired handle, otherwise
+        // maybeScheduleRetry's `if (s.retryTimer) return` guard stays wedged for
+        // this session until something else happens to call clearRetry.
+        if (s.pilot.hasExited || s.busy) {
+            s.retryTimer = null;
+            return;
+        }
+        if (verdict.blocked) {
+            if (!held) {
+                held = true;
+                broadcast(s, { type: "pace-hold", reason: verdict.reason });
+            }
+            s.retryTimer = setTimeout(fire, PACE_RECHECK_MS);
+            return;
+        }
+        s.retryTimer = null;
+        if (held)
+            broadcast(s, { type: "pace-resumed" });
+        broadcast(s, { type: "prompt-echo", text: "continue", auto: true });
+        s.busy = true;
+        s.turnStartedAt = Date.now();
+        broadcast(s, { type: "working", startedAt: s.turnStartedAt });
+        try {
+            await s.pilot.submit("continue");
+        }
+        catch {
+            return; // TUI unreachable: give the user back the controls
+        }
+        finally {
+            s.busy = false;
+        }
+        await finishTurn(s).catch(() => { });
+    };
+    s.retryTimer = setTimeout(fire, delayMs);
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+wss.on("connection", (ws) => {
+    let session = null;
+    const send = (msg) => {
+        if (ws.readyState === ws.OPEN)
+            ws.send(JSON.stringify(msg));
+    };
+    const fail = (message) => send({ type: "error", message });
+    ws.on("close", () => {
+        if (session)
+            detach(ws, session);
+        session = null;
+    });
+    ws.on("message", async (raw) => {
+        let msg;
+        try {
+            msg = JSON.parse(String(raw));
+        }
+        catch {
+            return fail("unreadable message");
+        }
+        try {
+            // Any user takeover cancels a pending auto-retry and ends the streak.
+            // "prompt" is settled inside its own case instead: a prompt refused on
+            // pace grounds sends nothing, so it must not count as a takeover — it
+            // would silently kill the pace pause it was just told about.
+            if (session &&
+                ["choose", "toggle", "freetext", "confirm", "key"].includes(msg.type)) {
+                clearRetry(session, true);
+                session.retryCount = 0;
+            }
+            switch (msg.type) {
+                case "start": {
+                    if (session)
+                        return fail("session already started");
+                    const cwd = msg.cwd?.trim() || process.cwd();
+                    // Deterministic id: enforced with --session-id for a new session,
+                    // known for a resume. NEVER derive it from the most recent file
+                    // in the directory — with several channels in the same directory
+                    // they would all converge to the same session.
+                    let id;
+                    const args = [];
+                    let resumed = false;
+                    if (msg.resume) {
+                        id = msg.resume;
+                        args.push("--resume", id);
+                        resumed = true;
+                    }
+                    else if (msg.continue) {
+                        const found = findSessionId(cwd);
+                        if (found) {
+                            id = found;
+                            args.push("--resume", id);
+                            resumed = true;
+                        }
+                        else {
+                            // Nothing to resume in this directory: new session.
+                            id = randomUUID();
+                            args.push("--session-id", id);
+                        }
+                    }
+                    else {
+                        id = randomUUID();
+                        args.push("--session-id", id);
+                    }
+                    // Isolation: run a NEW session inside a fresh git worktree so the
+                    // agent's edits stay contained until the user merges them.
+                    let worktree = null;
+                    let effectiveCwd = cwd;
+                    // Resume: a reattached tmux agent knows its own cwd (e.g. a worktree
+                    // path the client didn't supply — the Telegram bridge only passes the
+                    // repo root). Trust the live pane so history and the transcript tail
+                    // resolve to the right directory (invariant: cwd ↔ history).
+                    if (resumed && USE_TMUX && tmuxHasSession("sk-" + id)) {
+                        const paneCwd = tmuxPaneCwd("sk-" + id);
+                        if (paneCwd && fs.existsSync(paneCwd))
+                            effectiveCwd = paneCwd;
+                    }
+                    if (msg.worktree && !resumed && isGitRepo(cwd)) {
+                        try {
+                            worktree = createWorktree(cwd, id.slice(0, 8));
+                            effectiveCwd = worktree.path;
+                        }
+                        catch (e) {
+                            return fail("worktree creation failed: " + (e instanceof Error ? e.message : String(e)));
+                        }
+                    }
+                    // Reopen: if resuming into a worktree whose checkout was reclaimed,
+                    // recreate it from its branch so the past session can continue.
+                    if (resumed && msg.branch && msg.repo && !fs.existsSync(effectiveCwd)) {
+                        ensureWorktreeCheckout(msg.repo, msg.branch, effectiveCwd);
+                    }
+                    // Guard against a vanished directory (e.g. a restored channel whose
+                    // worktree was removed): spawning claude there would exit instantly
+                    // with a cryptic error. Signal it clearly so the client can drop it.
+                    if (!fs.existsSync(effectiveCwd)) {
+                        return send({
+                            type: "gone",
+                            sessionId: id,
+                            message: "working directory no longer exists: " + effectiveCwd,
+                        });
+                    }
+                    const existing = sessions.get(id);
+                    if (existing && !existing.pilot.hasExited) {
+                        // Session already piloted: attach to it (shared process). Cancel
+                        // any pending reclaim — a viewer is back.
+                        session = existing;
+                        if (session.idleTimer) {
+                            clearTimeout(session.idleTimer);
+                            session.idleTimer = null;
+                        }
+                        session.clients.add(ws);
+                        const turns = loadHistory(session.cwd, id);
+                        if (turns.length)
+                            send({ type: "history", turns });
+                        send({
+                            type: "ready",
+                            sessionId: id,
+                            cwd: session.cwd,
+                            lastTurnMs: session.lastTurnMs,
+                        });
+                        upsertChannel({ sessionId: id, cwd: session.cwd, branch: session.worktree?.branch ?? null });
+                        send({ type: "tokens", tokens: tokenTotals(session) });
+                        if (session.contextPct !== null)
+                            send({ type: "context", pct: session.contextPct });
+                        send({
+                            type: "screen",
+                            text: session.pilot.screen(),
+                            working: session.pilot.isWorking(),
+                        });
+                        if (session.busy)
+                            send({ type: "working", startedAt: session.turnStartedAt });
+                        sendPendingDialog(session, send);
+                        break;
+                    }
+                    session = await createSession(id, effectiveCwd, args, worktree);
+                    session.clients.add(ws);
+                    if (resumed) {
+                        const turns = loadHistory(effectiveCwd, id);
+                        if (turns.length)
+                            send({ type: "history", turns });
+                    }
+                    send({
+                        type: "ready",
+                        sessionId: id,
+                        cwd: effectiveCwd,
+                        branch: worktree?.branch ?? null,
+                    });
+                    upsertChannel({ sessionId: id, cwd: effectiveCwd, branch: worktree?.branch ?? null });
+                    send({ type: "tokens", tokens: tokenTotals(session) });
+                    if (session.contextPct !== null)
+                        send({ type: "context", pct: session.contextPct });
+                    sendPendingDialog(session, send);
+                    break;
+                }
+                case "prompt": {
+                    if (!session)
+                        return fail("no session started");
+                    if (session.busy)
+                        return fail("a response is already in progress");
+                    const text = msg.text.trim();
+                    if (!text)
+                        return;
+                    // Above the ideal pace, a prompt needs an explicit second click. The
+                    // check lives here because this is the single door every user prompt
+                    // goes through — including the pilotctl thin client.
+                    if (!msg.force) {
+                        const verdict = paceBlock(await getUsage(), Date.now());
+                        if (verdict.blocked)
+                            return send({ type: "pace-blocked", reason: verdict.reason, text });
+                        // The busy test above is now stale: a parked fire() (or another
+                        // client's prompt) can have claimed the session while we awaited
+                        // getUsage(). Submitting now would interleave two texts into one
+                        // TUI. Mirrors the re-check fire() does after its own await.
+                        if (session.busy)
+                            return fail("a response is already in progress");
+                    }
+                    // Getting here means the prompt is really being sent — that is the
+                    // takeover. A pending auto-retry (or pace pause) gives way to it.
+                    clearRetry(session, true);
+                    session.retryCount = 0;
+                    session.lastPrompt = text;
+                    // The session's other clients see the prompt arrive.
+                    broadcast(session, { type: "prompt-echo", text }, ws);
+                    session.busy = true;
+                    session.turnStartedAt = Date.now();
+                    broadcast(session, { type: "working", startedAt: session.turnStartedAt });
+                    try {
+                        await session.pilot.submit(text);
+                    }
+                    finally {
+                        session.busy = false;
+                    }
+                    await finishTurn(session);
+                    break;
+                }
+                case "choose": {
+                    // Single select. Preview-style dialogs ("Enter to select · ↑/↓ to
+                    // navigate") ignore digit keys, so navigate the ❯ cursor to the
+                    // target option with arrows, then Enter (works for all variants).
+                    if (!session)
+                        return fail("no session started");
+                    // You can only answer a dialog that's actually on screen. If it's not,
+                    // the keyboard is stale (the session moved past it) or a turn is
+                    // running — either way there's nothing to select here.
+                    if (!detectDialog(session.pilot.screen()))
+                        return fail(session.busy ? "a response is already in progress" : "this dialog is no longer active");
+                    await selectOption(session.pilot, msg.n);
+                    await sleep(500);
+                    await finishTurn(session);
+                    break;
+                }
+                case "toggle": {
+                    // Multi-select: toggle the checkbox then rebroadcast the state.
+                    if (!session)
+                        return fail("no session started");
+                    if (!detectDialog(session.pilot.screen()))
+                        return fail(session.busy ? "a response is already in progress" : "this dialog is no longer active");
+                    session.pilot.write(String(msg.n));
+                    await sleep(500);
+                    const d = detectDialog(session.pilot.screen());
+                    if (d)
+                        broadcast(session, { type: "dialog", ...d });
+                    else
+                        await finishTurn(session);
+                    break;
+                }
+                case "freetext": {
+                    // "Type something" option: digit → paste the text → Enter.
+                    if (!session)
+                        return fail("no session started");
+                    if (!detectDialog(session.pilot.screen()))
+                        return fail(session.busy ? "a response is already in progress" : "this dialog is no longer active");
+                    const t = msg.text.trim();
+                    if (!t)
+                        return;
+                    session.pilot.write(String(msg.n));
+                    await sleep(700);
+                    session.pilot.write(`\x1b[200~${t}\x1b[201~`);
+                    await sleep(400);
+                    session.pilot.press("enter");
+                    await sleep(600);
+                    const d = detectDialog(session.pilot.screen());
+                    if (d)
+                        broadcast(session, { type: "dialog", ...d });
+                    else
+                        await finishTurn(session);
+                    break;
+                }
+                case "confirm": {
+                    // Multi-select: Tab → "Submit answers" page → Enter.
+                    if (!session)
+                        return fail("no session started");
+                    if (!detectDialog(session.pilot.screen()))
+                        return fail(session.busy ? "a response is already in progress" : "this dialog is no longer active");
+                    session.pilot.press("tab");
+                    await sleep(600);
+                    session.pilot.press("enter");
+                    await sleep(400);
+                    await finishTurn(session);
+                    break;
+                }
+                case "key": {
+                    // Manual keystroke from the terminal view (dialogs, menus…).
+                    if (!session)
+                        return fail("no session started");
+                    const named = [
+                        "enter",
+                        "escape",
+                        "up",
+                        "down",
+                        "left",
+                        "right",
+                        "tab",
+                        "ctrl-c",
+                    ];
+                    if (named.includes(msg.key)) {
+                        session.pilot.press(msg.key);
+                    }
+                    else if (msg.key.length === 1) {
+                        session.pilot.write(msg.key);
+                    }
+                    break;
+                }
+                case "settle": {
+                    // After a manual intervention: wait for the turn to finish.
+                    if (!session || session.busy)
+                        return;
+                    await finishTurn(session);
+                    break;
+                }
+                case "restart": {
+                    // Re-spawn the agent in place, resuming the same session id, so it
+                    // picks up fresh env (e.g. newly-added secrets). History is preserved
+                    // (resume reads the transcript); every attached client keeps its ref.
+                    if (!session)
+                        return fail("no session started");
+                    const s = session;
+                    s.restarting = true;
+                    s.pilotOff?.();
+                    if (s.screenTimer)
+                        clearInterval(s.screenTimer);
+                    s.screenTimer = null;
+                    s.stopTail?.();
+                    s.stopTail = null;
+                    if (s.retryTimer)
+                        clearTimeout(s.retryTimer);
+                    s.retryTimer = null;
+                    // Clean /exit (not a hard kill) so claude releases the session lock
+                    // and `--resume` works; then make sure the tmux session is gone.
+                    await s.pilot.stop();
+                    if (USE_TMUX) {
+                        for (let i = 0; i < 30 && tmuxHasSession("sk-" + s.id); i++)
+                            await sleep(100);
+                    }
+                    s.busy = false;
+                    s.lastScreen = "";
+                    broadcast(s, { type: "working", startedAt: Date.now() });
+                    // Resume only if there's a transcript; a never-used session has
+                    // nothing to resume (claude --resume would exit) — re-create it.
+                    const hasTranscript = fs.existsSync(sessionFilePath(s.cwd, s.id));
+                    s.pilot = makePilot(s.id, s.cwd, hasTranscript ? ["--resume", s.id] : ["--session-id", s.id]);
+                    await attachPilot(s);
+                    s.restarting = false;
+                    broadcast(s, { type: "ready", sessionId: s.id, cwd: s.cwd, branch: s.worktree?.branch ?? null });
+                    broadcast(s, { type: "screen", text: s.pilot.screen(), working: s.pilot.isWorking() });
+                    break;
+                }
+                case "stop": {
+                    // Explicit stop: ends the session for ALL clients, drops it from the
+                    // one registry, and archives its Telegram topic if it had one.
+                    if (!session)
+                        return;
+                    const s = session;
+                    const ch = loadChannels().find((c) => c.sessionId === s.id);
+                    // Update the registry BEFORE notifying, so a client that reacts to
+                    // "stopped" (or the sync poll) sees it already gone.
+                    removeChannel(s.id);
+                    if (ch?.telegram?.threadId)
+                        closeTelegramTopic(ch.telegram.chatId, ch.telegram.threadId);
+                    broadcast(s, { type: "stopped" });
+                    await s.pilot.stop();
+                    destroySession(s);
+                    session = null;
+                    break;
+                }
+            }
+        }
+        catch (err) {
+            if (session)
+                session.busy = false;
+            fail(err instanceof Error ? err.message : String(err));
+        }
+    });
+});
+// Fold any legacy separate Telegram bindings into the one channel registry.
+migrateTgBindings();
+server.listen(PORT, () => {
+    console.log(`shadok-ai web: http://localhost:${PORT}`);
+    console.log(USE_TMUX
+        ? "transport: tmux (agents survive server restarts)"
+        : "transport: node-pty (agents die with the server; install tmux or unset SHADOK_TMUX=0 for durability)");
+    // Telegram control bridge — connects to this server's own /ws as a client
+    // (only if TELEGRAM_BOT_TOKEN is set), so Telegram shares the web sessions.
+    startTelegram(PORT);
+});
+//# sourceMappingURL=server.js.map