smolcoder-plus 1.0.0

package/dist/web/hub.js

@@ -0,0 +1,952 @@
+"use strict";
+// The web hub: what `smol --web` serves. One local HTTP server hosting many
+// sessions across many workspaces — the browser page shows them in a sidebar
+// and can start, resume, switch between, close and delete them. All sessions
+// share one SSE stream (events are tagged with a session id) and one random
+// URL token; the server binds to loopback only.
+//
+// Sessions are saved under ~/.smolcoder/sessions/ as they run, so the sidebar
+// survives a restart and any past session can be resumed. A second
+// `smol --web` started elsewhere finds the running hub through
+// ~/.smolcoder/web.json and adds its folder there instead of starting a
+// second server.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebHub = void 0;
+exports.readHubRecord = readHubRecord;
+exports.pingHub = pingHub;
+exports.askHubToOpen = askHubToOpen;
+exports.browseDir = browseDir;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const http = __importStar(require("http"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const session_1 = require("../session");
+const util_1 = require("../util");
+const attachments_1 = require("../attachments");
+const channel_1 = require("./channel");
+const page_1 = require("./page");
+const store_1 = require("./store");
+const terminal_1 = require("./terminal");
+/** Session ids are short hex and upload ids are 16 hex chars. Both end up in
+ * file paths under the data folder, so nothing else is accepted. */
+const SESSION_ID_RE = /^[a-z0-9_-]{1,64}$/i;
+const UPLOAD_ID_RE = /^[a-f0-9]{16}$/;
+const HUB_FILE = "web.json";
+function readHubRecord(dataDir = config_1.DATA_DIR) {
+    try {
+        const r = JSON.parse(fs.readFileSync(path.join(dataDir, HUB_FILE), "utf8"));
+        if (r && typeof r.port === "number" && typeof r.token === "string")
+            return r;
+    }
+    catch {
+        /* none */
+    }
+    return null;
+}
+function writeHubRecord(rec, dataDir) {
+    try {
+        fs.mkdirSync(dataDir, { recursive: true });
+        fs.writeFileSync(path.join(dataDir, HUB_FILE), JSON.stringify(rec));
+    }
+    catch {
+        /* non-fatal: a second smol --web will just start its own server */
+    }
+}
+function clearHubRecord(pid, dataDir) {
+    const rec = readHubRecord(dataDir);
+    if (rec && rec.pid === pid) {
+        try {
+            fs.unlinkSync(path.join(dataDir, HUB_FILE));
+        }
+        catch {
+            /* gone */
+        }
+    }
+}
+/** Is the hub a previous invocation recorded still answering? */
+async function pingHub(rec) {
+    const r = await (0, util_1.tryFetchJson)(`http://127.0.0.1:${rec.port}/ping?k=${rec.token}`, undefined, 1500);
+    return !!r?.ok;
+}
+/** Ask a running hub to add a workspace (and optionally start a session). */
+function askHubToOpen(rec, workspace, start) {
+    return (0, util_1.tryFetchJson)(`http://127.0.0.1:${rec.port}/workspaces/add?k=${rec.token}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ path: workspace, start }),
+    }, 5000);
+}
+// ---- helpers ----------------------------------------------------------------
+function tilde(p) {
+    const home = os.homedir();
+    const same = process.platform === "win32" ? p.slice(0, home.length).toLowerCase() === home.toLowerCase() : p.startsWith(home);
+    return same ? "~" + p.slice(home.length).replace(/\\/g, "/") : p;
+}
+function expandHome(s) {
+    if (s === "~")
+        return os.homedir();
+    if (s.startsWith("~/") || s.startsWith("~\\"))
+        return path.join(os.homedir(), s.slice(2));
+    return s;
+}
+const PROJECT_MARKERS = [".git", "package.json", "pyproject.toml", "Cargo.toml", "go.mod", "AGENTS.md", "pom.xml", "Gemfile"];
+function isProject(dir) {
+    return PROJECT_MARKERS.some((m) => fs.existsSync(path.join(dir, m)));
+}
+let rootsCache = null;
+function listRoots() {
+    if (rootsCache && Date.now() - rootsCache.at < 60_000)
+        return rootsCache.roots;
+    let roots;
+    if (process.platform === "win32") {
+        roots = [];
+        for (let i = 67; i <= 90; i++) {
+            // C: through Z:; A:/B: are floppy letters and slow to probe
+            const r = `${String.fromCharCode(i)}:\\`;
+            try {
+                if (fs.existsSync(r))
+                    roots.push(r);
+            }
+            catch {
+                /* skip */
+            }
+        }
+    }
+    else {
+        roots = ["/"];
+    }
+    rootsCache = { at: Date.now(), roots };
+    return roots;
+}
+const SKIP_DIRS = /^(node_modules|\$recycle\.bin|system volume information|windows|program files( \(x86\))?|programdata|appdata)$/i;
+/** Folder listing for the "open folder" picker. Exported for tests. */
+function browseDir(input) {
+    const home = os.homedir();
+    const target = input && input.trim() ? path.resolve(expandHome(input.trim())) : home;
+    const roots = listRoots();
+    const base = { path: target, display: tilde(target), home, roots };
+    let st;
+    try {
+        st = fs.statSync(target);
+    }
+    catch {
+        return { ...base, error: `not a folder: ${target}`, parent: path.dirname(target), dirs: [] };
+    }
+    if (!st.isDirectory())
+        return { ...base, error: `not a folder: ${target}`, parent: path.dirname(target), dirs: [] };
+    let entries;
+    try {
+        entries = fs.readdirSync(target, { withFileTypes: true });
+    }
+    catch (err) {
+        return { ...base, error: `cannot read ${target}: ${err?.message ?? err}`, parent: path.dirname(target), dirs: [] };
+    }
+    const dirs = entries
+        .filter((e) => e.isDirectory() && !e.name.startsWith(".") && !SKIP_DIRS.test(e.name))
+        .sort((a, b) => a.name.localeCompare(b.name, undefined, { sensitivity: "base" }))
+        .slice(0, 500)
+        .map((e) => {
+        const full = path.join(target, e.name);
+        let project = false;
+        try {
+            project = isProject(full);
+        }
+        catch {
+            /* unreadable */
+        }
+        return { name: e.name, path: full, project };
+    });
+    const parent = path.dirname(target);
+    return { ...base, parent: parent === target ? null : parent, dirs, project: isProject(target) };
+}
+function defaultFactory(help) {
+    return async (ui, workspace, prefs) => {
+        const cfg = (0, config_1.loadConfig)();
+        let chosen = await (0, session_1.prepareModel)(prefs, cfg, (label) => ui.startSpinner(label));
+        ui.stopSpinner();
+        // Nothing on this computer: the page offers to look on the network.
+        if (!chosen)
+            chosen = await (0, session_1.setupWithoutLocalModels)(ui, prefs);
+        if (!chosen)
+            throw new Error((0, session_1.noBackendsMessage)());
+        return new session_1.Session(ui, { workspace, chosen, prefs, cfg, help });
+    };
+}
+// ---- the hub ----------------------------------------------------------------
+class WebHub {
+    opts;
+    authToken = crypto.randomBytes(9).toString("base64url");
+    dataDir;
+    port;
+    server = null;
+    clients = new Set();
+    live = new Map();
+    metas = new Map();
+    store;
+    workspaces;
+    factory;
+    hubTimer = null;
+    termCounter = 0;
+    stopped = false;
+    constructor(opts) {
+        this.opts = opts;
+        this.port = opts.port;
+        this.dataDir = opts.dataDir ?? config_1.DATA_DIR;
+        this.store = new store_1.SessionStore(this.dataDir);
+        this.workspaces = new store_1.WorkspaceStore(this.dataDir);
+        for (const m of this.store.listMetas())
+            this.metas.set(m.id, m);
+        this.factory = opts.factory ?? defaultFactory(opts.help);
+    }
+    url() {
+        return `http://127.0.0.1:${this.port}/?k=${this.authToken}`;
+    }
+    start() {
+        return new Promise((resolve, reject) => {
+            const server = http.createServer((req, res) => this.route(req, res));
+            this.server = server;
+            server.once("error", reject);
+            server.listen(this.opts.port, "127.0.0.1", () => {
+                const addr = server.address();
+                if (addr && typeof addr === "object")
+                    this.port = addr.port;
+                writeHubRecord({ port: this.port, token: this.authToken, pid: process.pid, startedAt: Date.now() }, this.dataDir);
+                resolve();
+            });
+        });
+    }
+    /** Synchronous teardown for exit paths: save what has something to save,
+     * kill background tasks and terminals, drop the running-hub record. */
+    shutdownSync() {
+        if (this.stopped)
+            return;
+        this.stopped = true;
+        for (const live of this.live.values()) {
+            if (live.saveTimer)
+                clearTimeout(live.saveTimer);
+            try {
+                if (!live.discard && live.session && live.channel.title)
+                    this.saveSync(live);
+            }
+            catch {
+                /* best effort */
+            }
+            live.session?.taskManager.killAll();
+            for (const t of live.terminals.values())
+                t.close();
+        }
+        clearHubRecord(process.pid, this.dataDir);
+        for (const c of this.clients)
+            c.end();
+        this.server?.close();
+    }
+    close() {
+        this.shutdownSync();
+    }
+    log(s) {
+        if (!this.opts.quiet)
+            console.log(s);
+    }
+    // ---- sessions ---------------------------------------------------------------
+    addWorkspace(p) {
+        this.workspaces.add(p);
+        this.changed();
+    }
+    /** Start a new session in a workspace; returns its id right away while the
+     * model is detected and loaded in the background. */
+    openSession(workspace) {
+        const id = crypto.randomBytes(4).toString("hex");
+        this.workspaces.add(workspace);
+        const now = Date.now();
+        const live = this.makeLive(id, { id, workspace, title: "", createdAt: now, updatedAt: now });
+        void this.spawn(live, null);
+        this.changed();
+        return id;
+    }
+    /** Bring a saved session back to life (or retry one that failed to start). */
+    resumeSession(id) {
+        const existing = this.live.get(id);
+        if (existing) {
+            if (existing.error)
+                void this.spawn(existing, existing.pendingRestore);
+            return true;
+        }
+        const meta = this.metas.get(id);
+        if (!meta)
+            return false;
+        const body = this.store.loadBody(id);
+        const live = this.makeLive(id, meta);
+        live.channel.title = meta.title;
+        if (body) {
+            live.channel.restoreReplay(body.events);
+            for (const ev of live.channel.replay)
+                this.send(ev);
+        }
+        this.workspaces.add(meta.workspace);
+        void this.spawn(live, body?.snapshot ?? null);
+        this.changed();
+        return true;
+    }
+    closeSession(id) {
+        const live = this.live.get(id);
+        if (!live)
+            return false;
+        if (!live.session) {
+            // Still starting (or failed to start): there is no loop to unwind.
+            live.channel.close();
+            this.dropLive(live);
+            return true;
+        }
+        live.channel.cancel();
+        live.channel.requestExit();
+        return true;
+    }
+    deleteSession(id) {
+        const live = this.live.get(id);
+        if (live) {
+            live.discard = true;
+            this.closeSession(id);
+        }
+        this.store.delete(id);
+        this.metas.delete(id);
+        try {
+            fs.rmSync(this.uploadsDir(id), { recursive: true, force: true });
+        }
+        catch {
+            /* best effort */
+        }
+        this.changed();
+    }
+    renameSession(id, title) {
+        title = title.replace(/\s+/g, " ").trim().slice(0, 80);
+        if (!title)
+            return;
+        const live = this.live.get(id);
+        if (live) {
+            live.channel.title = title;
+            live.meta.title = title;
+            live.titleByUser = true;
+            live.channel.pushState();
+            this.scheduleSave(live);
+        }
+        const meta = this.metas.get(id);
+        if (meta) {
+            meta.title = title;
+            try {
+                this.store.saveMeta(meta);
+            }
+            catch {
+                /* non-fatal */
+            }
+        }
+        this.changed();
+    }
+    /** Forget a workspace and delete its saved sessions. Returns an error
+     * message when it still has open sessions. */
+    removeWorkspace(p) {
+        const key = (0, store_1.workspaceKey)(p);
+        for (const live of this.live.values()) {
+            if ((0, store_1.workspaceKey)(live.workspace) === key)
+                return "close its open sessions first";
+        }
+        for (const m of [...this.metas.values()]) {
+            if ((0, store_1.workspaceKey)(m.workspace) === key) {
+                this.store.delete(m.id);
+                this.metas.delete(m.id);
+            }
+        }
+        this.workspaces.remove(p);
+        this.changed();
+        return null;
+    }
+    makeLive(id, meta) {
+        const channel = new channel_1.SessionChannel(id, {
+            send: (ev) => this.send(ev),
+            changed: () => this.changed(),
+            touched: (sid) => this.touched(sid),
+        });
+        const live = {
+            id,
+            workspace: meta.workspace,
+            channel,
+            session: null,
+            meta,
+            error: null,
+            pendingRestore: null,
+            terminals: new Map(),
+            uploads: new Map(),
+            saveTimer: null,
+            saving: false,
+            dirty: false,
+            discard: false,
+            // A saved session already has a name; only fresh ones get one written.
+            titleTries: meta.title ? 99 : 0,
+            titleByUser: false,
+        };
+        this.live.set(id, live);
+        return live;
+    }
+    /** After the first turn: replace the verbatim first-message title with a
+     * short model-written one. Bounded retries, never over a manual rename. */
+    async autoTitle(live) {
+        if (!live.session || live.titleByUser || live.titleTries >= 2)
+            return;
+        live.titleTries++;
+        const title = await live.session.suggestTitle();
+        if (!title || live.titleByUser || live.channel.closed || this.live.get(live.id) !== live)
+            return;
+        live.channel.title = title;
+        live.meta.title = title;
+        live.channel.pushState();
+        this.changed();
+        this.scheduleSave(live);
+    }
+    async spawn(live, restore) {
+        live.error = null;
+        live.pendingRestore = restore;
+        live.channel.phase = "starting";
+        this.changed();
+        let prefs = this.opts.prefs;
+        if (restore) {
+            // A saved bypass mode is not inherited silently, same as the config:
+            // the user re-enables it per session.
+            const mode = restore.mode === "bypass" ? "edit" : restore.mode ?? prefs.mode;
+            prefs = { ...prefs, mode, backend: restore.backend, model: restore.model ?? prefs.model, baseUrl: restore.baseUrl, effort: restore.effort !== undefined ? restore.effort : prefs.effort };
+        }
+        try {
+            const session = await this.factory(live.channel, live.workspace, prefs);
+            if (live.channel.closed || this.live.get(live.id) !== live) {
+                session.taskManager.killAll();
+                return;
+            }
+            live.session = session;
+            session.onExit = () => this.sessionEnded(live.id);
+            session.onTurnDone = () => void this.autoTitle(live);
+            live.channel.getState = () => session.state();
+            if (restore)
+                session.restore(restore);
+            live.meta.model = session.chosen.id;
+            live.meta.backend = session.chosen.backend;
+            session.announce();
+            if (restore) {
+                live.channel.status(`· session resumed${restore.mode === "bypass" ? " in edit mode (bypass is not restored)" : ""} — earlier command approvals are not remembered`);
+            }
+            this.log(`  ● ${live.id} · ${tilde(live.workspace)} · ${session.chosen.id}`);
+            this.changed();
+            session.run().catch((err) => live.channel.error(String(err?.message ?? err)));
+        }
+        catch (err) {
+            live.error = String(err?.message ?? err);
+            live.channel.phase = "error";
+            live.channel.error(live.error);
+            live.channel.warn("Start a backend, then click this session in the sidebar to retry.");
+            this.changed();
+        }
+    }
+    sessionEnded(id) {
+        const live = this.live.get(id);
+        if (!live)
+            return;
+        if (!live.discard && live.session && live.channel.title) {
+            try {
+                this.saveSync(live);
+            }
+            catch {
+                /* best effort */
+            }
+        }
+        this.dropLive(live);
+        this.log(`  ○ ${id} closed`);
+    }
+    dropLive(live) {
+        if (live.saveTimer) {
+            clearTimeout(live.saveTimer);
+            live.saveTimer = null;
+        }
+        for (const t of live.terminals.values())
+            t.close();
+        live.terminals.clear();
+        if (this.live.get(live.id) === live)
+            this.live.delete(live.id);
+        this.send({ t: "closed", sid: live.id });
+        this.changed();
+    }
+    // ---- saving -----------------------------------------------------------------
+    touched(id) {
+        const live = this.live.get(id);
+        if (!live)
+            return;
+        live.meta.updatedAt = Date.now();
+        this.scheduleSave(live);
+    }
+    scheduleSave(live) {
+        live.dirty = true;
+        if (live.saveTimer)
+            return;
+        live.saveTimer = setTimeout(() => {
+            live.saveTimer = null;
+            void this.save(live);
+        }, 1500);
+    }
+    async save(live) {
+        // Untitled sessions (nothing sent yet) are not worth a file.
+        if (!live.session || live.discard || !live.channel.title)
+            return;
+        if (live.saving) {
+            live.dirty = true;
+            return;
+        }
+        live.saving = true;
+        live.dirty = false;
+        try {
+            live.meta.title = live.channel.title;
+            this.metas.set(live.id, live.meta);
+            this.store.saveMeta(live.meta);
+            await this.store.saveBody(live.id, { snapshot: live.session.snapshot(), events: live.channel.replay });
+            live.saveFailed = false;
+        }
+        catch (err) {
+            if (!live.saveFailed) {
+                live.saveFailed = true;
+                live.channel.warn(`Session could not be saved: ${err?.message ?? err}. Keep this session open and check free disk space and permissions.`);
+            }
+        }
+        live.saving = false;
+        if (live.dirty)
+            this.scheduleSave(live);
+    }
+    saveSync(live) {
+        if (!live.session)
+            return;
+        live.meta.title = live.channel.title;
+        this.metas.set(live.id, live.meta);
+        this.store.saveMeta(live.meta);
+        this.store.saveBodySync(live.id, { snapshot: live.session.snapshot(), events: live.channel.replay });
+    }
+    // ---- terminals --------------------------------------------------------------
+    openTerminal(sid) {
+        const live = this.live.get(sid);
+        if (!live)
+            return null;
+        const tid = `t${++this.termCounter}`;
+        this.send({ t: "termopen", sid, tid, cwd: live.workspace });
+        const term = new terminal_1.Terminal(tid, live.workspace, {
+            output: (text) => this.send({ t: "term", sid, tid, s: text }),
+            done: (code, cwd) => this.send({ t: "termdone", sid, tid, code, cwd }),
+        });
+        live.terminals.set(tid, term);
+        this.changed();
+        return { tid, cwd: term.cwd };
+    }
+    closeTerminal(sid, tid) {
+        const live = this.live.get(sid);
+        const t = live?.terminals.get(tid);
+        if (!live || !t)
+            return;
+        t.close();
+        live.terminals.delete(tid);
+        this.send({ t: "termclosed", sid, tid });
+        this.changed();
+    }
+    // ---- broadcasting -----------------------------------------------------------
+    send(ev) {
+        const line = `data: ${JSON.stringify(ev)}\n\n`;
+        for (const c of this.clients)
+            c.write(line);
+    }
+    /** Coalesced: many status flips in one tick produce one snapshot. */
+    changed() {
+        if (this.hubTimer)
+            return;
+        this.hubTimer = setTimeout(() => {
+            this.hubTimer = null;
+            this.send(this.snapshot());
+        }, 25);
+    }
+    /** What the sidebar shows. Exported through the SSE stream and /ping. */
+    snapshot() {
+        const groups = new Map();
+        const group = (p) => {
+            const key = (0, store_1.workspaceKey)(p);
+            let g = groups.get(key);
+            if (!g) {
+                g = { path: p, sessions: [], last: 0 };
+                groups.set(key, g);
+            }
+            return g;
+        };
+        for (const w of this.workspaces.list()) {
+            const g = group(w.path);
+            g.last = Math.max(g.last, w.lastOpened);
+        }
+        for (const m of this.metas.values()) {
+            if (this.live.has(m.id))
+                continue;
+            group(m.workspace).sessions.push({
+                id: m.id,
+                title: m.title,
+                status: "stored",
+                live: false,
+                createdAt: m.createdAt,
+                updatedAt: m.updatedAt,
+                model: m.model,
+                terminals: [],
+            });
+        }
+        for (const l of this.live.values()) {
+            group(l.workspace).sessions.push({
+                id: l.id,
+                title: l.channel.title || l.meta.title,
+                status: l.channel.phase,
+                live: true,
+                createdAt: l.meta.createdAt,
+                updatedAt: l.meta.updatedAt,
+                model: l.meta.model,
+                terminals: [...l.terminals.values()].map((t) => ({ tid: t.id, cwd: t.cwd })),
+            });
+        }
+        const workspaces = [...groups.values()]
+            .map((g) => {
+            g.sessions.sort((a, b) => b.updatedAt - a.updatedAt);
+            const last = Math.max(g.last, ...g.sessions.map((s) => s.updatedAt));
+            return { path: g.path, name: path.basename(g.path) || g.path, display: tilde(g.path), last, sessions: g.sessions };
+        })
+            .sort((a, b) => b.last - a.last);
+        return { t: "hub", home: os.homedir(), sep: path.sep, version: this.opts.version, workspaces };
+    }
+    // ---- http ---------------------------------------------------------------------
+    route(req, res) {
+        res.setHeader("Referrer-Policy", "no-referrer");
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        res.setHeader("X-Frame-Options", "DENY");
+        res.setHeader("Cache-Control", "no-store");
+        const url = new URL(req.url ?? "/", `http://127.0.0.1:${this.port}`);
+        const origin = req.headers.origin;
+        const sameOrigin = !origin || origin === `http://127.0.0.1:${this.port}` || origin === `http://localhost:${this.port}`;
+        if (url.searchParams.get("k") !== this.authToken || !sameOrigin) {
+            res.writeHead(403, { "content-type": "text/plain" });
+            res.end("forbidden — open smolcoder's printed URL (it includes the session key)");
+            return;
+        }
+        const json = (code, body) => {
+            res.writeHead(code, { "content-type": "application/json" });
+            res.end(JSON.stringify(body));
+        };
+        if (req.method === "GET") {
+            switch (url.pathname) {
+                case "/":
+                    res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+                    res.end(page_1.PAGE_HTML);
+                    return;
+                case "/ping":
+                    json(200, { ok: true, pid: process.pid, version: this.opts.version });
+                    return;
+                case "/events":
+                    this.sse(req, res);
+                    return;
+                case "/fs":
+                    json(200, browseDir(url.searchParams.get("path")));
+                    return;
+                case "/upload":
+                    this.serveUpload(res, url);
+                    return;
+                default:
+                    res.writeHead(404);
+                    res.end();
+                    return;
+            }
+        }
+        if (req.method === "POST") {
+            if (url.pathname === "/upload") {
+                this.receiveUpload(req, res, url);
+                return;
+            }
+            let body = "";
+            req.on("data", (d) => {
+                body += d;
+                if (body.length > 1_000_000)
+                    req.destroy();
+            });
+            req.on("end", () => {
+                let data = {};
+                try {
+                    data = body ? JSON.parse(body) : {};
+                }
+                catch {
+                    /* ignore */
+                }
+                try {
+                    json(200, this.handlePost(url.pathname, data) ?? {});
+                }
+                catch (err) {
+                    json(400, { error: String(err?.message ?? err) });
+                }
+            });
+            return;
+        }
+        res.writeHead(404);
+        res.end();
+    }
+    sse(req, res) {
+        res.writeHead(200, {
+            "content-type": "text/event-stream",
+            "cache-control": "no-cache",
+            connection: "keep-alive",
+        });
+        const write = (ev) => res.write(`data: ${JSON.stringify(ev)}\n\n`);
+        write(this.snapshot());
+        for (const l of this.live.values()) {
+            for (const ev of l.channel.replay)
+                write(ev);
+            write(l.channel.stateEvent());
+            for (const t of l.terminals.values()) {
+                write({ t: "termopen", sid: l.id, tid: t.id, cwd: t.cwd });
+                if (t.buffer)
+                    write({ t: "term", sid: l.id, tid: t.id, s: t.buffer });
+            }
+        }
+        this.clients.add(res);
+        req.on("close", () => this.clients.delete(res));
+    }
+    // ---- attachments ---------------------------------------------------------
+    uploadsDir(sid) {
+        return path.join(this.dataDir, "uploads", sid);
+    }
+    /** One file for a live session, sent as the raw request body with the name
+     * in the query string (a pasted screenshot has no name; the page makes one). */
+    receiveUpload(req, res, url) {
+        const reply = (code, body) => {
+            res.writeHead(code, { "content-type": "application/json" });
+            res.end(JSON.stringify(body));
+        };
+        const sid = String(url.searchParams.get("sid") ?? "");
+        const live = SESSION_ID_RE.test(sid) ? this.live.get(sid) : undefined;
+        if (!live) {
+            reply(404, { error: "no such session" });
+            req.resume();
+            return;
+        }
+        const name = (0, attachments_1.safeName)(url.searchParams.get("name"));
+        const mime = String(req.headers["content-type"] ?? "application/octet-stream").split(";")[0].trim().toLowerCase();
+        const chunks = [];
+        let size = 0;
+        let failed = false;
+        req.on("data", (d) => {
+            if (failed)
+                return;
+            size += d.length;
+            if (size > attachments_1.MAX_UPLOAD_BYTES) {
+                failed = true;
+                reply(413, { error: `"${name}" is larger than the ${attachments_1.MAX_UPLOAD_BYTES / 1024 / 1024} MB upload limit.` });
+                req.destroy();
+                return;
+            }
+            chunks.push(d);
+        });
+        req.on("end", () => {
+            if (failed)
+                return;
+            const bytes = Buffer.concat(chunks);
+            const verdict = (0, attachments_1.classifyUpload)(name, mime, bytes);
+            if ("error" in verdict) {
+                reply(415, { error: verdict.error });
+                return;
+            }
+            const id = crypto.randomBytes(8).toString("hex");
+            const dir = this.uploadsDir(sid);
+            const file = path.join(dir, `${id}.${(0, attachments_1.extOf)(name, mime)}`);
+            try {
+                fs.mkdirSync(dir, { recursive: true });
+                fs.writeFileSync(file, bytes);
+            }
+            catch (err) {
+                reply(500, { error: `could not store the upload: ${err?.message ?? err}` });
+                return;
+            }
+            const att = { id, name, kind: verdict.kind, mime: verdict.mime, size: bytes.length, path: file };
+            live.uploads.set(id, att);
+            const model = live.session?.chosen;
+            const warning = att.kind === "image" && model?.vision === false
+                ? `${model.id} cannot see images — switch to a vision-capable model with /models`
+                : undefined;
+            reply(200, { id, name, kind: att.kind, size: att.size, url: (0, channel_1.uploadUrl)(sid, id), ...(warning ? { warning } : {}) });
+        });
+    }
+    /** A stored upload, for the page's thumbnails and "open" links. */
+    serveUpload(res, url) {
+        const sid = String(url.searchParams.get("sid") ?? "");
+        const id = String(url.searchParams.get("id") ?? "");
+        const file = SESSION_ID_RE.test(sid) && UPLOAD_ID_RE.test(id) ? this.findUpload(sid, id) : null;
+        if (!file) {
+            res.writeHead(404);
+            res.end();
+            return;
+        }
+        res.writeHead(200, { "content-type": (0, attachments_1.mimeForExt)(path.extname(file).slice(1)), "content-length": fs.statSync(file).size });
+        fs.createReadStream(file).pipe(res);
+    }
+    findUpload(sid, id) {
+        const dir = this.uploadsDir(sid);
+        try {
+            const entry = fs.readdirSync(dir).find((f) => f.startsWith(id + "."));
+            return entry ? path.join(dir, entry) : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** The user took a chip off the composer: forget the file. */
+    removeUpload(live, id) {
+        const att = live.uploads.get(id);
+        live.uploads.delete(id);
+        const file = att?.path ?? (UPLOAD_ID_RE.test(id) ? this.findUpload(live.id, id) : null);
+        if (!file)
+            return;
+        try {
+            fs.unlinkSync(file);
+        }
+        catch {
+            /* already gone */
+        }
+    }
+    checkDir(p) {
+        const s = String(p ?? "").trim();
+        if (!s)
+            throw new Error("path is required");
+        const abs = path.resolve(expandHome(s));
+        if (!fs.existsSync(abs) || !fs.statSync(abs).isDirectory())
+            throw new Error(`not a folder: ${abs}`);
+        return abs;
+    }
+    handlePost(p, d) {
+        const sid = String(d.sid ?? "");
+        const live = () => {
+            const l = this.live.get(sid);
+            if (!l)
+                throw new Error("no such session");
+            return l;
+        };
+        switch (p) {
+            case "/msg": {
+                const l = live();
+                const ids = Array.isArray(d.attachments) ? d.attachments.map(String) : [];
+                const attachments = ids.map((id) => l.uploads.get(id));
+                if (attachments.some((a) => !a))
+                    throw new Error("an attachment is no longer available — add it again");
+                for (const id of ids)
+                    l.uploads.delete(id);
+                l.channel.handleMessage(String(d.text ?? ""), attachments);
+                return {};
+            }
+            case "/upload/remove":
+                this.removeUpload(live(), String(d.id ?? ""));
+                return {};
+            case "/confirm":
+                live().channel.handleAnswer(Number(d.id), d.answer);
+                return {};
+            case "/select":
+                live().channel.handleAnswer(Number(d.id), d.index);
+                return {};
+            case "/prompt":
+                live().channel.handleAnswer(Number(d.id), typeof d.value === "string" ? d.value : null);
+                return {};
+            case "/cycle": {
+                const l = live();
+                l.channel.onModeCycle?.();
+                l.channel.refresh();
+                return {};
+            }
+            case "/cancel":
+                live().channel.cancel();
+                return {};
+            case "/sessions/new":
+                return { id: this.openSession(this.checkDir(d.workspace)) };
+            case "/sessions/resume":
+                if (!this.resumeSession(String(d.id ?? "")))
+                    throw new Error("unknown session");
+                return { id: d.id };
+            case "/sessions/close":
+                this.closeSession(String(d.id ?? ""));
+                return {};
+            case "/sessions/delete":
+                this.deleteSession(String(d.id ?? ""));
+                return {};
+            case "/sessions/rename":
+                this.renameSession(String(d.id ?? ""), String(d.title ?? ""));
+                return {};
+            case "/workspaces/add": {
+                const ws = this.checkDir(d.path);
+                this.workspaces.add(ws);
+                this.changed();
+                return d.start ? { path: ws, id: this.openSession(ws) } : { path: ws };
+            }
+            case "/workspaces/remove": {
+                const err = this.removeWorkspace(String(d.path ?? ""));
+                if (err)
+                    throw new Error(err);
+                return {};
+            }
+            case "/term/open": {
+                const r = this.openTerminal(sid);
+                if (!r)
+                    throw new Error("no such session");
+                return r;
+            }
+            case "/term/input": {
+                const t = live().terminals.get(String(d.tid ?? ""));
+                if (!t)
+                    throw new Error("no such terminal");
+                t.write(String(d.text ?? ""));
+                return {};
+            }
+            case "/term/interrupt": {
+                const t = live().terminals.get(String(d.tid ?? ""));
+                if (!t)
+                    throw new Error("no such terminal");
+                t.interrupt();
+                return {};
+            }
+            case "/term/close":
+                this.closeTerminal(sid, String(d.tid ?? ""));
+                return {};
+            default:
+                throw new Error(`unknown endpoint ${p}`);
+        }
+    }
+}
+exports.WebHub = WebHub;