sliccy 5.17.0 → 5.19.0

package/dist/node-server/electron-controller.d.ts

@@ -149,7 +149,6 @@ export declare class ElectronOverlayInjector {
     static create(options: {
         cdpPort: number;
         servePort: number;
-        dev: boolean;
         projectRoot: string;
         /**
          * Thin-bridge coordinates: the overlay loads from the hosted launcher

package/dist/node-server/electron-controller.js

@@ -7,7 +7,7 @@ import { promisify } from 'util';
 import { WebSocket } from 'ws';
 import { inflateSync } from 'zlib';
 import { BRIDGE_TOKEN_QUERY_PARAM, BRIDGE_WS_QUERY_PARAM } from './bridge-security.js';
-import { buildElectronAppLaunchSpec, buildElectronOverlayBootstrapScript, buildElectronOverlayEntryUrl, ELECTRON_OVERLAY_APP_PATH, getElectronOverlayEntryDistPath, getElectronServeOrigin, selectBestOverlayTargets, } from './electron-runtime.js';
+import { buildElectronAppLaunchSpec, buildElectronOverlayBootstrapScript, ELECTRON_OVERLAY_APP_PATH, getElectronOverlayEntryDistPath, selectBestOverlayTargets, } from './electron-runtime.js';
 const execFile = promisify(nodeExecFile);
 const ELECTRON_OVERLAY_SYNC_INTERVAL_MS = 1500;
 /**
@@ -420,14 +420,6 @@ function detectAppThemeFromScreenshot(ws, send) {
     });
 }
 async function loadElectronOverlayBundleSource(options) {
-    const serveOrigin = getElectronServeOrigin(options.servePort);
-    if (options.dev) {
-        const response = await fetch(buildElectronOverlayEntryUrl(serveOrigin));
-        if (!response.ok) {
-            throw new Error(`Failed to fetch electron overlay entry: ${response.status} ${response.statusText}`);
-        }
-        return await response.text();
-    }
     return await readFile(getElectronOverlayEntryDistPath(options.projectRoot), 'utf8');
 }
 /**
@@ -567,7 +559,9 @@ export class ElectronOverlayInjector {
         this.presenceCheckIntervalMs = presenceCheckIntervalMs;
     }
     static async create(options) {
-        const bundleSource = await loadElectronOverlayBundleSource(options);
+        const bundleSource = await loadElectronOverlayBundleSource({
+            projectRoot: options.projectRoot,
+        });
         const thinBootstraps = {
             leader: buildElectronOverlayBootstrapScript({
                 bundleSource,

package/dist/node-server/electron-main.js

@@ -5,7 +5,7 @@ import { resolve } from 'path';
 import { fileURLToPath } from 'url';
 import { mintBridgeToken } from './bridge-security.js';
 import { BRIDGE_ROLE_LEADER, buildThinOverlayAppUrl, resolveHostedLeaderOrigin, } from './electron-controller.js';
-import { buildElectronOverlayEntryUrl, buildElectronOverlayInjectionCall, buildElectronServerSpawnConfig, getElectronOverlayEntryDistPath, getElectronServeOrigin, parseElectronFloatFlags, } from './electron-runtime.js';
+import { buildElectronOverlayInjectionCall, buildElectronServerSpawnConfig, getElectronOverlayEntryDistPath, getElectronServeOrigin, parseElectronFloatFlags, } from './electron-runtime.js';
 const Dirname = fileURLToPath(new URL('.', import.meta.url));
 const PROJECT_ROOT = resolve(Dirname, '..', '..');
 const FLAGS = parseElectronFloatFlags(process.argv.slice(2));
@@ -61,13 +61,6 @@ async function waitForServerReady(origin, retries = 60, delayMs = 500) {
     throw new Error(`Electron float server did not become ready at ${origin}`);
 }
 async function loadOverlayBundleSource() {
-    if (FLAGS.dev) {
-        const response = await fetch(buildElectronOverlayEntryUrl(SERVE_ORIGIN));
-        if (!response.ok) {
-            throw new Error(`Failed to fetch electron overlay entry: ${response.status} ${response.statusText}`);
-        }
-        return await response.text();
-    }
     return await readFile(getElectronOverlayEntryDistPath(PROJECT_ROOT), 'utf8');
 }
 async function injectOverlay(window) {
@@ -132,7 +125,6 @@ async function createFloatWindow(targetUrl) {
 }
 function startCliServer() {
     const spawnConfig = buildElectronServerSpawnConfig(PROJECT_ROOT, {
-        dev: FLAGS.dev,
         cdpPort: FLAGS.cdpPort,
         nodePath: process.env['npm_node_execpath'] ?? 'node',
     });
@@ -141,10 +133,10 @@ function startCliServer() {
         env: {
             ...process.env,
             PORT: String(FLAGS.servePort),
-            // Forward the per-process bridge token to the child server. The
-            // current --serve-only mode doesn't gate /cdp on it (THIN_BRIDGE_MODE
-            // is false), but the env var is in place so a follow-up index.ts
-            // change can flip the gate on without retouching this file.
+            // Forward the per-process bridge token to the child server. The child
+            // runs as a thin /cdp bridge and gates its `/cdp` upgrade on this
+            // token (via `resolveServerBridgeToken`), so it matches the token
+            // carried by the float's overlay BrowserWindow.
             SLICC_BRIDGE_TOKEN: BRIDGE_TOKEN,
             SLICC_HOSTED_LEADER_ORIGIN: HOSTED_LEADER_ORIGIN,
         },

package/dist/node-server/electron-runtime.d.ts

@@ -1,5 +1,4 @@
 export interface ElectronFloatFlags {
-    dev: boolean;
     cdpPort: number;
     servePort: number;
     targetUrl: string;
@@ -54,13 +53,10 @@ export declare function buildElectronAppLaunchSpec(appPath: string, options: {
 }): ElectronAppLaunchSpec;
 export declare function parseElectronFloatFlags(argv: string[], env?: Record<string, string | undefined>): ElectronFloatFlags;
 export declare function buildElectronServerSpawnConfig(projectRoot: string, options: {
-    dev: boolean;
     cdpPort: number;
-    platform?: NodeJS.Platform;
     nodePath?: string;
 }): ElectronServerSpawnConfig;
 export declare function getElectronServeOrigin(servePort: number): string;
-export declare function buildElectronOverlayEntryUrl(serveOrigin: string): string;
 export declare function getElectronOverlayEntryDistPath(projectRoot: string): string;
 export declare function buildElectronOverlayInjectionCall(options: {
     appUrl: string;

package/dist/node-server/electron-runtime.js

@@ -196,14 +196,9 @@ function parsePositiveInt(value, fallback) {
     return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
 }
 export function parseElectronFloatFlags(argv, env = process.env) {
-    let dev = false;
     let cdpPort = DEFAULT_ELECTRON_CDP_PORT;
     let targetUrl = DEFAULT_ELECTRON_TARGET_URL;
     for (const arg of argv) {
-        if (arg === '--dev') {
-            dev = true;
-            continue;
-        }
         if (arg.startsWith('--cdp-port=')) {
             cdpPort = parsePositiveInt(arg.slice('--cdp-port='.length), DEFAULT_ELECTRON_CDP_PORT);
             continue;
@@ -218,25 +213,12 @@ export function parseElectronFloatFlags(argv, env = process.env) {
         }
     }
     return {
-        dev,
         cdpPort,
         servePort: parsePositiveInt(env['PORT'], DEFAULT_ELECTRON_SERVE_PORT),
         targetUrl,
     };
 }
 export function buildElectronServerSpawnConfig(projectRoot, options) {
-    if (options.dev) {
-        return {
-            command: (options.platform ?? process.platform) === 'win32' ? 'npx.cmd' : 'npx',
-            args: [
-                'tsx',
-                'packages/node-server/src/index.ts',
-                '--dev',
-                '--serve-only',
-                `--cdp-port=${options.cdpPort}`,
-            ],
-        };
-    }
     return {
         command: options.nodePath ?? process.env['npm_node_execpath'] ?? 'node',
         args: [
@@ -249,9 +231,10 @@ export function buildElectronServerSpawnConfig(projectRoot, options) {
 export function getElectronServeOrigin(servePort) {
     return `http://${DEFAULT_ELECTRON_SERVE_HOST}:${servePort}`;
 }
-export function buildElectronOverlayEntryUrl(serveOrigin) {
-    return new URL('/electron-overlay-entry.js', serveOrigin).toString();
-}
+// The overlay bootstrap IIFE is produced by `@ai-ecoverse/spoon`'s build
+// (`node packages/spoon/build.mjs`), which emits to this canonical `dist/ui`
+// path — the same location the webapp build mirrors it to and swift-launcher
+// copies from. node-server reads it from disk at runtime; the path is stable.
 export function getElectronOverlayEntryDistPath(projectRoot) {
     return resolve(projectRoot, 'dist/ui/electron-overlay-entry.js');
 }

package/dist/node-server/index.js

@@ -43,7 +43,6 @@ import { SecretProxyManager } from './secrets/proxy-manager.js';
 import { readOrCreateSessionId } from './secrets/session-id-file.js';
 import { registerSecretsReloadEndpoint } from './secrets-reload-endpoint.js';
 import { registerSudoApproveEndpoint } from './sudo/endpoint.js';
-import { attachUiServing } from './ui-serving.js';
 const Dirname = fileURLToPath(new URL('.', import.meta.url));
 const PROJECT_ROOT = resolve(Dirname, '..', '..');
 // ---------------------------------------------------------------------------
@@ -61,25 +60,28 @@ if (RUNTIME_FLAGS.version) {
     console.log(pkg.version);
     process.exit(0);
 }
-const DEV_MODE = RUNTIME_FLAGS.dev;
 const SERVE_ONLY = RUNTIME_FLAGS.serveOnly;
 const ELECTRON_MODE = RUNTIME_FLAGS.electron;
 const ELECTRON_APP = RUNTIME_FLAGS.electronApp;
 const KILL_EXISTING_ELECTRON_APP = RUNTIME_FLAGS.kill;
 /**
- * Standalone thin-bridge mode: production CLI with no bundled UI. The
- * launched Chrome opens a sliccy.ai-hosted leader; node-server is a thin
- * /cdp bridge + /api surface. Dev / electron / serve-only / hosted all
- * keep the bundled UI path (a separate path B / hosted task covers those).
+ * Whether to default-mint a `/cdp` bridge token (and mount thin-bridge
+ * CORS) for this process. Active in every mode EXCEPT a direct
+ * `--serve-only` run with no forwarded token: serve-only reuses an
+ * external CDP target and never launches a browser or prints a hosted
+ * launch URL carrying a freshly minted token, so minting one would gate
+ * `/cdp` (and `/api/*` CORS) on a secret the already-open page can never
+ * present. A `--serve-only` reattach from Sliccstart still works because
+ * it forwards `SLICC_BRIDGE_TOKEN`, which `resolveServerBridgeToken` and
+ * `shouldMountThinBridgeCors` honor regardless of this flag.
  */
-const THIN_BRIDGE_MODE = !DEV_MODE && !SERVE_ONLY && !ELECTRON_MODE && !RUNTIME_FLAGS.hosted;
+const THIN_BRIDGE_MODE = !SERVE_ONLY;
 // ---------------------------------------------------------------------------
 // File logger — persistent log file in ~/.slicc/logs/
 // ---------------------------------------------------------------------------
 const fileLogger = new FileLogger({
     logDir: RUNTIME_FLAGS.logDir ?? undefined,
     logLevel: RUNTIME_FLAGS.logLevel,
-    devMode: DEV_MODE,
 });
 if (fileLogger.logFile) {
     console.log(`Log file: ${fileLogger.logFile}`);
@@ -115,13 +117,6 @@ async function waitForCDP(port, retries = 30, delayMs = 500) {
     }
     throw new Error(`CDP did not become available on port ${port}`);
 }
-// ---------------------------------------------------------------------------
-// ANSI color helpers
-// ---------------------------------------------------------------------------
-const ANSI_RED = '\x1b[31m';
-const ANSI_YELLOW = '\x1b[33m';
-const ANSI_CYAN = '\x1b[36m';
-const ANSI_RESET = '\x1b[0m';
 function pipeChildOutput(child, label) {
     child.stdout?.on('data', (data) => {
         process.stdout.write(`[${label}:out] ${data}`);
@@ -175,123 +170,6 @@ async function findAvailablePort(preferred) {
         throw err;
     }
 }
-function formatPreviewProperties(properties) {
-    return properties
-        .map((p) => {
-        let val;
-        if (p.type === 'object')
-            val = p.subtype === 'array' ? '[...]' : '{...}';
-        else if (p.type === 'string')
-            val = `"${p.value}"`;
-        else
-            val = p.value;
-        return `${p.name}: ${val}`;
-    })
-        .join(', ');
-}
-function formatRemoteObject(obj) {
-    if (obj.type === 'undefined')
-        return 'undefined';
-    if (obj.type === 'object' && obj.subtype === 'null')
-        return 'null';
-    // Format objects/arrays using preview properties when available
-    if (obj.type === 'object' && obj.preview?.properties && obj.preview.properties.length > 0) {
-        const inner = formatPreviewProperties(obj.preview.properties);
-        const suffix = obj.preview.overflow ? ', ...' : '';
-        if (obj.subtype === 'array')
-            return `[${inner}${suffix}]`;
-        return `{ ${inner}${suffix} }`;
-    }
-    if (obj.preview?.description)
-        return obj.preview.description;
-    if (obj.description !== undefined)
-        return obj.description;
-    if (obj.value !== undefined)
-        return String(obj.value);
-    return `[${obj.type}]`;
-}
-function colorForType(type) {
-    switch (type) {
-        case 'error':
-            return ANSI_RED;
-        case 'warning':
-            return ANSI_YELLOW;
-        default:
-            return ANSI_CYAN;
-    }
-}
-async function findPageTarget(cdpPort, pageUrl) {
-    try {
-        const res = await fetch(`http://127.0.0.1:${cdpPort}/json`);
-        const targets = (await res.json());
-        const match = targets.find((t) => t.type === 'page' && t.url.includes(`localhost:${pageUrl}`) && t.webSocketDebuggerUrl);
-        return match ? { webSocketDebuggerUrl: match.webSocketDebuggerUrl } : null;
-    }
-    catch {
-        return null;
-    }
-}
-async function attachConsoleForwarder(cdpPort, pageUrl) {
-    const pageDedup = new CliLogDedup('[page]');
-    const connect = async () => {
-        // Poll for the page target
-        let target = null;
-        for (let i = 0; i < 20; i++) {
-            target = await findPageTarget(cdpPort, pageUrl);
-            if (target)
-                break;
-            await new Promise((r) => setTimeout(r, 500));
-        }
-        if (!target) {
-            console.log('[page] Could not find page target — console forwarding disabled');
-            return;
-        }
-        const ws = new WebSocket(target.webSocketDebuggerUrl);
-        ws.on('open', () => {
-            ws.send(JSON.stringify({ id: 1, method: 'Runtime.enable' }));
-        });
-        ws.on('message', (raw) => {
-            try {
-                const msg = JSON.parse(String(raw));
-                if (msg.method === 'Runtime.consoleAPICalled') {
-                    const params = msg.params;
-                    const type = params.type;
-                    const color = colorForType(type);
-                    const argsStr = params.args.map(formatRemoteObject).join(' ');
-                    const line = `[page:${type}] ${argsStr}`;
-                    if (pageDedup.shouldLog(line)) {
-                        console.log(`${color}[page:${type}]${ANSI_RESET} ${argsStr}`);
-                    }
-                }
-                if (msg.method === 'Runtime.exceptionThrown') {
-                    const params = msg.params;
-                    const details = params.exceptionDetails;
-                    const desc = details.exception?.description ?? details.text;
-                    console.log(`${ANSI_RED}[page:exception]${ANSI_RESET} ${desc}`);
-                    if (details.stackTrace) {
-                        for (const frame of details.stackTrace.callFrames) {
-                            const fn = frame.functionName || '<anonymous>';
-                            console.log(`${ANSI_RED}    at ${fn} (${frame.url}:${frame.lineNumber}:${frame.columnNumber})${ANSI_RESET}`);
-                        }
-                    }
-                }
-            }
-            catch {
-                // Ignore malformed messages
-            }
-        });
-        ws.on('close', () => {
-            // Reconnect after a short delay (page may have reloaded)
-            setTimeout(() => {
-                connect();
-            }, 1000);
-        });
-        ws.on('error', () => {
-            // Error will trigger close, which handles reconnection
-        });
-    };
-    await connect();
-}
 // ---------------------------------------------------------------------------
 // Main
 // ---------------------------------------------------------------------------
@@ -349,8 +227,6 @@ async function resolvePorts(state) {
     else if (state.servePort !== PREFERRED_SERVE_PORT) {
         console.log(`Port ${PREFERRED_SERVE_PORT} in use, serving on port ${state.servePort}`);
     }
-    if (DEV_MODE)
-        console.log('Starting in dev mode (Vite HMR enabled)');
     if (SERVE_ONLY) {
         console.log(`Starting in serve-only mode (reusing external CDP on port ${state.cdpPort})`);
     }
@@ -491,7 +367,7 @@ function buildBrowserLaunchUrl(state) {
     // Thin-bridge standalone: Chrome opens the hosted leader directly; the
     // local node-server serves no UI at all. Bridge coordinates ride as
     // query params so the leader can discover + authenticate /cdp.
-    const serveOriginForLaunch = THIN_BRIDGE_MODE && state.bridgeToken ? resolveThinLeaderOrigin() : state.serveOrigin;
+    const serveOriginForLaunch = state.bridgeToken ? resolveThinLeaderOrigin() : state.serveOrigin;
     let url = resolveCliBrowserLaunchUrl({
         serveOrigin: serveOriginForLaunch,
         lead: RUNTIME_FLAGS.lead,
@@ -499,7 +375,7 @@ function buildBrowserLaunchUrl(state) {
         envWorkerBaseUrl: process.env['WORKER_BASE_URL'] ?? null,
         join: RUNTIME_FLAGS.join,
         joinUrl: RUNTIME_FLAGS.joinUrl,
-        bridgeWsUrl: THIN_BRIDGE_MODE && state.bridgeToken ? `ws://localhost:${state.servePort}/cdp` : null,
+        bridgeWsUrl: state.bridgeToken ? `ws://localhost:${state.servePort}/cdp` : null,
         bridgeToken: state.bridgeToken,
     });
     if (RUNTIME_FLAGS.hosted) {
@@ -514,7 +390,7 @@ function buildBrowserLaunchUrl(state) {
     else if (RUNTIME_FLAGS.lead) {
         console.log(`Lead launch URL: ${url}`);
     }
-    else if (THIN_BRIDGE_MODE) {
+    else {
         // Print WITHOUT the bridgeToken — it's a session capability.
         const sanitized = url.replace(/([?&])bridgeToken=[^&]+/, '$1bridgeToken=<redacted>');
         console.log(`Thin-bridge launch URL: ${sanitized}`);
@@ -543,7 +419,7 @@ async function launchChromeTarget(state) {
     const browserLaunchUrl = buildBrowserLaunchUrl(state);
     const chromeProfile = resolveChromeProfileOrExit(state);
     const chromePath = findChromeExecutable({
-        executablePreference: !DEV_MODE && !chromeProfile.id ? 'installed' : 'chrome-for-testing',
+        executablePreference: !chromeProfile.id ? 'installed' : 'chrome-for-testing',
     });
     if (!chromePath) {
         console.error('Could not find Chrome/Chromium. Please install Chrome or set CHROME_PATH.');
@@ -996,7 +872,6 @@ async function startOverlayInjector(state, cdpPort, servePort) {
         state.overlayInjector = await ElectronOverlayInjector.create({
             cdpPort,
             servePort,
-            dev: DEV_MODE,
             projectRoot: PROJECT_ROOT,
             thinBridge,
         });
@@ -1023,17 +898,11 @@ function startListening(deps) {
     const { server, fileLogger, servePort, serveOrigin, cdpPort } = deps;
     return new Promise((resolve) => {
         server.listen(servePort, '127.0.0.1', () => {
-            if (THIN_BRIDGE_MODE) {
-                console.log(`Thin /cdp bridge + /api at ${serveOrigin}`);
-            }
-            else {
-                console.log(`Serving UI at ${serveOrigin}`);
-            }
+            console.log(`Thin /cdp bridge + /api at ${serveOrigin}`);
             console.log(`CDP proxy at ws://localhost:${servePort}/cdp`);
             fileLogger.log('info', 'CLI server started', {
                 port: servePort,
                 cdpPort,
-                devMode: DEV_MODE,
                 electronMode: ELECTRON_MODE,
             });
             resolve();
@@ -1042,10 +911,10 @@ function startListening(deps) {
 }
 /**
  * Post-listen warmup: pre-connects to Chrome's CDP (so the proxy is warm
- * before the first client), starts the Electron overlay injector, and
- * attaches the console forwarder. Reads `state.cdpPort` dynamically so
- * the value populated by `launchChromeTarget` is used regardless of when
- * this runs relative to the listen callback.
+ * before the first client) and, in Electron mode, starts the overlay
+ * injector. Reads `state.cdpPort` dynamically so the value populated by
+ * `launchChromeTarget` is used regardless of when this runs relative to
+ * the listen callback.
  */
 function runCdpProxyWarmup(state, deps) {
     const { app, ctx, servePort } = deps;
@@ -1053,15 +922,6 @@ function runCdpProxyWarmup(state, deps) {
     if (ELECTRON_MODE) {
         void startOverlayInjector(state, state.cdpPort, servePort);
     }
-    else if (!THIN_BRIDGE_MODE) {
-        // Thin-bridge mode has no local UI page to forward console output from.
-        const cdpPort = state.cdpPort;
-        setTimeout(() => {
-            attachConsoleForwarder(cdpPort, String(servePort)).catch((err) => {
-                console.error('[page] Console forwarder error:', err);
-            });
-        }, 2500);
-    }
 }
 /**
  * Build the secret stores + masking pipeline shared by the fetch-proxy, the
@@ -1171,7 +1031,7 @@ async function main() {
     // shutdown handler) read it dynamically from `state`.
     const state = createServerState();
     await resolvePorts(state);
-    const { servePort: SERVE_PORT, serveOrigin: SERVE_ORIGIN } = state;
+    const { servePort: SERVE_PORT } = state;
     // 3. Set up express app with request logging
     const { secretStore, secretProxy, oauthStore } = await bootstrapSecrets();
     const app = express();
@@ -1206,9 +1066,7 @@ async function main() {
             (process.env['SLICC_TRAY_WORKER_BASE_URL']?.trim() || null) ??
                 RUNTIME_FLAGS.leadWorkerBaseUrl ??
                 (process.env['WORKER_BASE_URL']?.trim() || null) ??
-                (DEV_MODE
-                    ? 'https://slicc-tray-hub-staging.minivelos.workers.dev'
-                    : 'https://www.sliccy.ai'),
+                'https://www.sliccy.ai',
             // Read dynamically from state — populated by `launchElectronTarget`
             // when an existing leader is discovered. `launchBrowser` now runs
             // after `server.listen()`, so this endpoint must NOT close over a
@@ -1242,7 +1100,7 @@ async function main() {
     registerHandoffRoute(app, { broadcastLickEvent });
     // Secret management API — direct .env file access (no browser needed),
     // plus the S3 / DA sign-and-forward and masked-secret endpoints.
-    registerSecretRoutes(app, { secretStore, secretProxy, oauthStore, devMode: DEV_MODE });
+    registerSecretRoutes(app, { secretStore, secretProxy, oauthStore, devMode: false });
     // Cloud status endpoint (hosted-only) — writes join info to /tmp/slicc-join.json
     // Register BEFORE Chromium launches. The webapp's first action after
     // ?runtime=hosted-leader boot is to mint a tray and POST /api/cloud-status.
@@ -1259,21 +1117,13 @@ async function main() {
     // Fetch proxy — forwards cross-origin requests from the browser to bypass CORS,
     // injecting/unmasking secrets and streaming the response with a UTF-8-safe scrub.
     registerFetchProxyRoute(app, { secretProxy });
-    // Create the HTTP server BEFORE Vite so we can register our upgrade handler first
+    // node-server serves no UI in any mode: it is a pure /cdp bridge + /api
+    // surface. Chrome opens the sliccy.ai-hosted leader which talks to /cdp +
+    // /api cross-origin. Create the HTTP server so we can attach the /cdp WS
+    // upgrade handler to it.
     const server = createServer(app);
-    // Thin-bridge mode: skip UI serving entirely. node-server becomes a
-    // pure /cdp bridge + /api surface; Chrome opens the sliccy.ai-hosted
-    // leader which talks to /cdp + /api cross-origin.
-    if (!THIN_BRIDGE_MODE) {
-        await attachUiServing(app, server, {
-            devMode: DEV_MODE,
-            hosted: RUNTIME_FLAGS.hosted,
-            serveOrigin: SERVE_ORIGIN,
-            uiDir: resolve(Dirname, '..', 'ui'),
-        });
-    }
-    // 4. CDP WebSocket proxy at /cdp — noServer mode so Vite's dev middleware
-    //    doesn't intercept the upgrade.
+    // 4. CDP WebSocket proxy at /cdp — noServer mode so we own the upgrade
+    //    handler routing for /cdp and /licks-ws.
     const wss = createCdpWebSocketServer(state.bridgeToken);
     attachCdpUpgradeRouting(server, wss, lickWss, state.bridgeToken);
     const cdpCtx = {

package/dist/node-server/runtime-flags.d.ts

@@ -1,6 +1,5 @@
 export type LogLevel = 'debug' | 'info' | 'warn' | 'error';
 export interface CliRuntimeFlags {
-    dev: boolean;
     serveOnly: boolean;
     cdpPort: number;
     /** Whether --cdp-port was explicitly specified */