stuntdouble 0.1.3 → 0.2.0

package/README.md

@@ -1,12 +1,36 @@
 # stuntdouble
 
-Stunt Double Local: run [Stunt Double](https://stuntdouble.io) checklists in a Chrome on your own machine, from your own coding agent session, with every run kept as files in your project and a local viewer to watch and review them.
+[![npm](https://img.shields.io/npm/v/stuntdouble.svg)](https://www.npmjs.com/package/stuntdouble) [![License](https://img.shields.io/npm/l/stuntdouble.svg)](./LICENSE)
 
-It is an MCP server and nothing more. Your agent session does all of the reasoning: it reads the actor's brief, drives the browser through the tools here and judges each check. This package drives the browser, checks that a passed verdict cites something on the page, scores the run with the same code as the Stunt Double cloud, and writes the files. It never calls a model, never starts an agent, and never reads an agent's credentials (a test fails the build if it tries), so a local run uses whatever account your agent is signed in with, and nothing else.
+Run [Stunt Double](https://stuntdouble.io) checklists in a Chrome on your own machine, with every run kept as files in your project. Two ways in:
 
-Most people use it through the Stunt Double plugin for Claude Code, which starts it for you: `/stuntdouble setup`, then `/stuntdouble run <checklist>`.
+- **Stunt Double Studio**, a local app: `npx stuntdouble studio` opens it in your browser. Create and edit actors and checklists, run one with an AI actor on your own model connection, watch it live, stop it and review the verdicts. Signed in to Stunt Double, the same checklist also runs in the cloud.
+- **Stunt Double Local** inside your coding agent: an MCP server, which the Stunt Double plugin for Claude Code starts for you (`/stuntdouble setup`, then `/stuntdouble run <checklist>`).
 
-## Commands
+Both drive the same browser tools, check that a passed verdict cites something on the page, score the run with the same code as the Stunt Double cloud and write the same files.
+
+**The policy line.** Inside your agent, your agent session is the only model: the MCP server never calls a model, never starts an agent and never reads an agent's credentials. Studio runs use only a connection you configure, an Anthropic API key or an OpenAI-compatible endpoint (OpenAI, OpenRouter, or a local server such as Ollama or LM Studio). Nothing in this package uses a Claude subscription: no claude.ai login, no Claude Code credentials, no `claude` process. `test/no-model.test.ts` fails the build if any of that changes.
+
+## Studio
+
+```sh
+npx stuntdouble                      # in a terminal: the same as `studio` in this folder
+npx stuntdouble studio [dir]         # open Studio for a project (--port, --no-open)
+npx stuntdouble run <checklist>      # run one from the terminal on your connection (--resume, --max-steps)
+npx stuntdouble run <checklist> --cloud   # push it and run it in your Stunt Double workspace
+npx stuntdouble login                # sign in for cloud runs (--workspace <slug>)
+npx stuntdouble logout
+```
+
+A project with no `.stuntdouble/` yet starts with one question, the address to test, and gets a first-time visitor and a first checklist to edit. The editors check every field with the same schemas a run reads the files with and show what to fix beside the field.
+
+**Connection.** Set it in Settings: Anthropic (default model `claude-opus-5-5`, or `ANTHROPIC_API_KEY` from the environment) or an OpenAI-compatible endpoint with its model and key (`OPENAI_API_KEY` works too; Ollama and LM Studio on this machine need none). The key is kept in `~/.stuntdouble/credentials.json`, readable by you only, never in the project, never in a log and never sent to the page, which hears only whether a key is set. Test connection makes one short call.
+
+**A Studio run** is the MCP run with a model on your connection in the agent's place: the same brief, browser tools, `evaluate_check` and `finish_run`. It stops at 80 model calls or 3,000,000 tokens (the model is told to finish first), shows calls, tokens and, where the provider reports it or the price is known, the cost so far, and Stop ends it at the next step without another model call. Screenshots reach the model only when it asks for one. On Anthropic the prompt is cached and old page reads are cleared server side; on other endpoints old page reads are trimmed. The viewer's key never goes to the model.
+
+**Cloud runs.** Sign in from Settings or `stuntdouble login`: OAuth with PKCE against the hosted MCP, back to Studio's own `127.0.0.1` address, with the token kept in `~/.stuntdouble/credentials.json`. A cloud run pushes the project, the actor and the checklist to your workspace (reusing the ids already in the files, and writing new ones back), runs it there, checks every 30 seconds and writes the result beside your local runs. The cloud cannot reach `localhost`: give the checklist a public or preview URL and keep the local one in `local_base_url`. Cloud runs are for workspaces on a paid plan and are billed to the workspace; a refusal from Stunt Double comes back as it was written, with the billing link.
+
+## In your agent
 
 ```sh
 npx stuntdouble mcp          # the MCP server over stdio; your agent starts this
@@ -22,7 +46,7 @@ Needs Node 22.18 or later and Google Chrome (or Playwright's Chromium, from `npx
 
 | Tool                                                                                                           | What it does                                                                                                                                                                                                                          |
 | -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `navigate`, `read_page`, `find`, `get_page_text`, `click`, `type`, `form_input`, `key`, `scroll`, `screenshot` | The direct tools from [`@stunt-double/browser-toolset`](../browser-toolset). Screenshots go back to the model only from `screenshot`, unless `model_screenshots` is `every_action`.                                                   |
+| `navigate`, `read_page`, `find`, `get_page_text`, `click`, `type`, `form_input`, `key`, `scroll`, `screenshot` | The direct tools from [`@stuntkit/browser-toolset`](../browser-toolset). Screenshots go back to the model only from `screenshot`, unless `model_screenshots` is `every_action`.                                                       |
 | `start_run`                                                                                                    | Validates the files (naming every field to fix), opens a fresh Chrome at the checklist's URL and returns the viewer link, the actor's brief and the checks. `resume` continues an interrupted run, or one still open in this session. |
 | `evaluate_check`                                                                                               | Records one verdict. A pass must cite text or a selector that is on the page now. Scrolls the evidence into view and saves `shots/<check>.png`.                                                                                       |
 | `finish_run`                                                                                                   | Settles the checks left, scores the run and closes the browser.                                                                                                                                                                       |
@@ -45,7 +69,7 @@ Everything lives in `.stuntdouble/` in your project, and everything but `.live/`
 
 Actors and checklists use the same fields, and the same limits, as the Stunt Double MCP server's `create_actor` and `create_checklist`, so the same files run in the cloud. The exception is `browser_config` (a preset, viewport, touch or locale), which the cloud inputs do not take yet, so a cloud run uses the default desktop browser. A local run swaps the checklist URL's origin for `local_base_url`, so one checklist covers `localhost` here and the public address there.
 
-Local results are self-judged: the actor records its own verdicts. Cloud runs add a second judge.
+Local results are self-judged: the actor records its own verdicts. Cloud runs add a second judge. A Studio run's `run.json` says which model it ran on: `runner` gains `model` (`{"provider": "anthropic", "id": "claude-opus-5-5"}`) and, once it finishes, `usage` (`steps`, `input_tokens`, `output_tokens`, `cache_read_tokens`, `cost_usd`). Both are optional, so older files read as before.
 
 A checklist with no `weighted` checks has no score: it passes only when every pass/fail check passes, and its `pass_threshold`, which applies to weighted checks only, is not used. `start_run` and `finish_run` say so, and the viewer shows the tally with the same sentence.
 
@@ -55,6 +79,7 @@ A checklist with no `weighted` checks has no score: it passes only when every pa
 - The browser reaches local and private addresses only for the app under test: the exact origins (scheme, host and port) of the checklist's URL and `local_base_url`. The rule holds however the browser gets there, by a link, a script, a popup, a frame or a redirect; a redirect's request is still sent, but the page is cleared before any tool reads it.
 - With `safety` at `third_party` (the default), on any other host the tools refuse to pay, subscribe, create an account or type a password or card number. Set it to `off` when your app signs in on another domain.
 - The viewer listens on `127.0.0.1` only (port 4747, or the next free one), answers only to its own Host header, needs the key from the printed link (kept as an HttpOnly, SameSite=Strict cookie), sends no CORS headers and serves files from `.stuntdouble/` only. Its one control is Stop.
+- Studio is the same server with more on it, and keeps every one of those rules. Each write also needs Studio's own `Origin` and a JSON body. Values from files and replies are shown as text, and only `http(s)` addresses become links. The OAuth callback is the one route without the key: it answers only a sign-in this process started.
 
 ## Licence
 

package/dist/chunk-BFI6P5DO.js

@@ -0,0 +1,278 @@
+import {
+  ActorSchema,
+  ChecklistSchema,
+  effectiveStatus,
+  readJson,
+  readRun,
+  readRuns,
+  tallyRun,
+  writeFileAtomic
+} from "./chunk-F3R3QL7V.js";
+
+// src/ui-server.ts
+import { randomBytes, timingSafeEqual } from "crypto";
+import { watch } from "fs";
+import { readdir, readFile, realpath } from "fs/promises";
+import { createServer } from "http";
+import { basename, extname, join, resolve, sep } from "path";
+var FIRST_PORT = 4747;
+var PORT_TRIES = 20;
+var TYPES = {
+  ".png": "image/png",
+  ".json": "application/json",
+  ".jsonl": "text/plain; charset=utf-8"
+};
+var PAGE_HEADERS = {
+  "Content-Security-Policy": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'unsafe-inline'; img-src 'self'; frame-ancestors 'none'; form-action 'none'"
+};
+function send(res, status, body, type = "text/plain; charset=utf-8", headers = {}) {
+  res.writeHead(status, {
+    "Content-Type": type,
+    "Cache-Control": "no-store",
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "no-referrer",
+    ...headers
+  });
+  res.end(body);
+}
+var json = (res, data) => send(res, 200, JSON.stringify(data), "application/json");
+function sameSecret(given, token) {
+  const a = Buffer.from(given);
+  const b = Buffer.from(token);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function cookie(req, name) {
+  for (const part of (req.headers.cookie ?? "").split(";")) {
+    const [key, ...value] = part.trim().split("=");
+    if (key === name) return value.join("=");
+  }
+  return void 0;
+}
+async function confined(root, rel) {
+  try {
+    const realRoot = await realpath(root);
+    const real = await realpath(resolve(root, rel));
+    return real.startsWith(realRoot + sep) ? real : null;
+  } catch {
+    return null;
+  }
+}
+async function definitions(root, folder) {
+  const schema = folder === "checklists" ? ChecklistSchema : ActorSchema;
+  const names = await readdir(join(root, folder)).catch(() => []);
+  return Promise.all(
+    names.filter((n) => n.endsWith(".json")).sort().map(async (name) => {
+      const slug = basename(name, ".json");
+      try {
+        return { slug, data: await readJson(join(root, folder, name), schema, name) };
+      } catch (err) {
+        return { slug, error: err.message };
+      }
+    })
+  );
+}
+async function actorNames(root) {
+  const actors = await definitions(root, "actors");
+  return new Map(actors.flatMap((a) => "data" in a && a.data ? [[a.slug, a.data.name]] : []));
+}
+function runSummary(root, run, names) {
+  const { checklist_snapshot, results: _results, ...rest } = run;
+  return {
+    ...rest,
+    status: effectiveStatus(root, run),
+    actor_name: names.get(run.actor) ?? null,
+    checklist_name: typeof checklist_snapshot.name === "string" ? checklist_snapshot.name : null,
+    tally: tallyRun(run)
+  };
+}
+async function readBody(req) {
+  let body = "";
+  for await (const chunk of req) {
+    body += chunk;
+    if (body.length > 1e4) throw new Error("Body too large");
+  }
+  return body;
+}
+async function startUi(options) {
+  const extension = options.extension;
+  const root = resolve(options.root);
+  const token = randomBytes(24).toString("base64url");
+  const clients = /* @__PURE__ */ new Set();
+  let port = 0;
+  let ensureWatch = () => {
+  };
+  async function handle(req, res) {
+    const host = req.headers.host ?? "";
+    if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) {
+      return send(res, 403, "Forbidden");
+    }
+    const url = new URL(req.url ?? "/", `http://${host}`);
+    if (url.pathname === "/__stuntdouble") return json(res, { stuntdouble: true });
+    if (url.pathname === "/favicon.ico") return send(res, 204, "");
+    if (extension && url.pathname === "/oauth/callback" && req.method === "GET") {
+      return extension.oauthCallback(req, res, url);
+    }
+    const cookieName = `stuntdouble_${port}`;
+    const key = url.searchParams.get("t");
+    if (key !== null) {
+      if (!sameSecret(key, token)) return send(res, 403, "This link is out of date.");
+      url.searchParams.delete("t");
+      return send(res, 302, "", void 0, {
+        Location: `${url.pathname}${url.search}`,
+        "Set-Cookie": `${cookieName}=${token}; HttpOnly; SameSite=Strict; Path=/`
+      });
+    }
+    const signedIn = cookie(req, cookieName);
+    if (!signedIn || !sameSecret(signedIn, token)) {
+      return send(
+        res,
+        403,
+        "Open the viewer from the link Stunt Double printed: it carries the key."
+      );
+    }
+    const path = url.pathname;
+    if (req.method === "POST" && path === "/api/stop") {
+      const origin = req.headers.origin;
+      if (origin && origin !== `http://${host}`) return send(res, 403, "Forbidden");
+      const { run } = JSON.parse(await readBody(req));
+      const entry = typeof run === "string" ? await readRun(root, run) : null;
+      if (!entry || !("run" in entry) || effectiveStatus(root, entry.run) !== "running") {
+        return send(res, 409, "That run is not going.");
+      }
+      await writeFileAtomic(join(root, ".live", "stop"), entry.id);
+      return send(res, 204, "");
+    }
+    if (extension && await extension.handle(req, res, url)) return;
+    if (req.method !== "GET") return send(res, 405, "Method not allowed");
+    if (path === "/" || path === "/definitions" || /^\/runs\/[^/]+$/.test(path) || extension?.pages.test(path)) {
+      let page = await readFile(new URL("./ui.html", import.meta.url), "utf8");
+      if (extension) {
+        page = page.replace("</body>", `<script src="${extension.script}"></script>
+  </body>`);
+      }
+      return send(res, 200, page, "text/html; charset=utf-8", PAGE_HEADERS);
+    }
+    if (path === "/api/runs") {
+      const [runs, names] = await Promise.all([readRuns(root), actorNames(root)]);
+      return json(
+        res,
+        runs.map((e) => "run" in e ? runSummary(root, e.run, names) : e)
+      );
+    }
+    const runMatch = path.match(/^\/api\/runs\/([^/]+)$/);
+    if (runMatch) {
+      const id = decodeURIComponent(runMatch[1]);
+      const entry = await readRun(root, id);
+      if (!entry) return send(res, 404, "No such run");
+      const activity = await readFile(join(root, "runs", entry.id, "activity.jsonl"), "utf8").then(
+        (text) => text.split("\n").filter(Boolean).map((line) => JSON.parse(line))
+      ).catch(() => []);
+      const stop = await readFile(join(root, ".live", "stop"), "utf8").catch(() => "");
+      const names = "run" in entry ? await actorNames(root) : /* @__PURE__ */ new Map();
+      return json(res, {
+        ...entry,
+        ..."run" in entry ? {
+          run: {
+            ...entry.run,
+            status: effectiveStatus(root, entry.run),
+            actor_name: names.get(entry.run.actor) ?? null
+          }
+        } : {},
+        activity,
+        stop_requested: stop.trim() === entry.id
+      });
+    }
+    if (path === "/api/definitions") {
+      return json(res, {
+        checklists: await definitions(root, "checklists"),
+        actors: await definitions(root, "actors")
+      });
+    }
+    if (path === "/api/events") {
+      res.writeHead(200, {
+        "Content-Type": "text/event-stream",
+        "Cache-Control": "no-store",
+        "X-Content-Type-Options": "nosniff"
+      });
+      res.write(": connected\n\n");
+      ensureWatch();
+      clients.add(res);
+      req.on("close", () => clients.delete(res));
+      return;
+    }
+    if (path.startsWith("/files/")) {
+      const rel = decodeURIComponent(path.slice("/files/".length));
+      const file = await confined(root, rel);
+      if (!file) return send(res, 403, "Outside .stuntdouble/");
+      const type = TYPES[extname(file)];
+      if (!type) return send(res, 404, "Not found");
+      const cache = rel.includes("/shots/") ? "private, max-age=86400" : "no-store";
+      return send(res, 200, await readFile(file), type, { "Cache-Control": cache });
+    }
+    return send(res, 404, "Not found");
+  }
+  const server = createServer((req, res) => {
+    handle(req, res).catch(() => {
+      if (res.headersSent) res.end();
+      else send(res, 500, "Something went wrong reading .stuntdouble/");
+    });
+  });
+  const first = options.port ?? FIRST_PORT;
+  for (let candidate = first; ; candidate++) {
+    try {
+      await new Promise((ok, fail) => {
+        server.once("error", fail);
+        server.listen(candidate, "127.0.0.1", () => {
+          server.off("error", fail);
+          ok();
+        });
+      });
+      break;
+    } catch (err) {
+      const busy = err.code === "EADDRINUSE";
+      if (!busy || candidate >= first + PORT_TRIES) throw err;
+    }
+  }
+  port = server.address().port;
+  let watcher = null;
+  let pending = /* @__PURE__ */ new Set();
+  let timer;
+  ensureWatch = () => {
+    if (watcher) return;
+    try {
+      watcher = watch(root, { recursive: true }, (_event, name) => {
+        if (!name || name.endsWith(".tmp")) return;
+        pending.add(String(name).split(sep).join("/"));
+        timer ??= setTimeout(() => {
+          const data = `data: ${JSON.stringify({ paths: [...pending] })}
+
+`;
+          for (const client of clients) client.write(data);
+          pending = /* @__PURE__ */ new Set();
+          timer = void 0;
+        }, 150);
+      });
+    } catch {
+    }
+  };
+  ensureWatch();
+  return {
+    port,
+    token,
+    link: (path = "/") => `http://127.0.0.1:${port}${path}?t=${token}`,
+    close: async () => {
+      watcher?.close();
+      clearTimeout(timer);
+      for (const client of clients) client.end();
+      server.closeAllConnections();
+      await new Promise((ok) => server.close(() => ok()));
+    }
+  };
+}
+
+export {
+  FIRST_PORT,
+  send,
+  startUi
+};
+//# sourceMappingURL=chunk-BFI6P5DO.js.map

package/dist/chunk-BFI6P5DO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/ui-server.ts"],"sourcesContent":["// The local viewer: one HTML page over the files in `.stuntdouble/`, with live\n// updates while a run is going and a Stop button.\n//\n// It listens on loopback only, and still trusts nothing that can reach\n// loopback: a page in the person's browser can, and so can a DNS rebinding\n// attack. So every request must name this server in its Host header, and\n// everything but the identity probe needs the per-start key, which the printed\n// link carries once and an HttpOnly, SameSite=Strict cookie carries after\n// that. No CORS headers are ever sent, and files are served from inside\n// `.stuntdouble/` only.\n\nimport { randomBytes, timingSafeEqual } from 'node:crypto';\nimport { watch, type FSWatcher } from 'node:fs';\nimport { readdir, readFile, realpath } from 'node:fs/promises';\nimport { createServer, type IncomingMessage, type ServerResponse } from 'node:http';\nimport type { AddressInfo } from 'node:net';\nimport { basename, extname, join, resolve, sep } from 'node:path';\n\nimport {\n  ActorSchema,\n  ChecklistSchema,\n  effectiveStatus,\n  readJson,\n  readRun,\n  readRuns,\n  tallyRun,\n  writeFileAtomic,\n  type Run,\n} from './files.ts';\n\nexport const FIRST_PORT = 4747;\nconst PORT_TRIES = 20;\n\n/**\n * What the Studio adds to the viewer (studio.ts). The viewer alone has none of\n * it: inside Claude Code it reads files and offers Stop, nothing more.\n */\nexport type UiExtension = {\n  /** Paths beyond the viewer's own that serve the page. */\n  pages: RegExp;\n  /** A script the page loads after its own, served by `handle`. */\n  script: string;\n  /** A signed-in request the viewer does not answer. Resolves false for a 404. */\n  handle(req: IncomingMessage, res: ServerResponse, url: URL): Promise<boolean>;\n  /**\n   * `/oauth/callback`, which a cross-site redirect reaches without the\n   * SameSite=Strict cookie: it proves itself with the OAuth state instead.\n   */\n  oauthCallback(req: IncomingMessage, res: ServerResponse, url: URL): Promise<void>;\n};\n\nexport type UiServer = {\n  port: number;\n  token: string;\n  /** An address that signs the browser in, opening at `path`. */\n  link(path?: string): string;\n  close(): Promise<void>;\n};\n\nconst TYPES: Record<string, string> = {\n  '.png': 'image/png',\n  '.json': 'application/json',\n  '.jsonl': 'text/plain; charset=utf-8',\n};\n\nconst PAGE_HEADERS = {\n  'Content-Security-Policy':\n    \"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'unsafe-inline'; img-src 'self'; frame-ancestors 'none'; form-action 'none'\",\n};\n\nexport function send(\n  res: ServerResponse,\n  status: number,\n  body: string | Uint8Array,\n  type = 'text/plain; charset=utf-8',\n  headers: Record<string, string> = {}\n): void {\n  res.writeHead(status, {\n    'Content-Type': type,\n    'Cache-Control': 'no-store',\n    'X-Content-Type-Options': 'nosniff',\n    'Referrer-Policy': 'no-referrer',\n    ...headers,\n  });\n  res.end(body);\n}\n\nconst json = (res: ServerResponse, data: unknown) =>\n  send(res, 200, JSON.stringify(data), 'application/json');\n\nfunction sameSecret(given: string, token: string): boolean {\n  const a = Buffer.from(given);\n  const b = Buffer.from(token);\n  return a.length === b.length && timingSafeEqual(a, b);\n}\n\nfunction cookie(req: IncomingMessage, name: string): string | undefined {\n  for (const part of (req.headers.cookie ?? '').split(';')) {\n    const [key, ...value] = part.trim().split('=');\n    if (key === name) return value.join('=');\n  }\n  return undefined;\n}\n\n/** The real path of `rel` under `root`, or null when it would leave it (`..`, a symlink). */\nasync function confined(root: string, rel: string): Promise<string | null> {\n  try {\n    const realRoot = await realpath(root);\n    const real = await realpath(resolve(root, rel));\n    return real.startsWith(realRoot + sep) ? real : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function definitions(root: string, folder: 'checklists' | 'actors') {\n  const schema = folder === 'checklists' ? ChecklistSchema : ActorSchema;\n  const names = await readdir(join(root, folder)).catch(() => [] as string[]);\n  return Promise.all(\n    names\n      .filter((n) => n.endsWith('.json'))\n      .sort()\n      .map(async (name) => {\n        const slug = basename(name, '.json');\n        try {\n          return { slug, data: await readJson(join(root, folder, name), schema, name) };\n        } catch (err) {\n          return { slug, error: (err as Error).message };\n        }\n      })\n  );\n}\n\n/** Actor slugs to the names people gave them, for labels. */\nasync function actorNames(root: string): Promise<Map<string, string>> {\n  const actors = await definitions(root, 'actors');\n  return new Map(actors.flatMap((a) => ('data' in a && a.data ? [[a.slug, a.data.name]] : [])));\n}\n\n/** What the runs list shows of a run: not its snapshot or its results. */\nfunction runSummary(root: string, run: Run, names: Map<string, string>) {\n  const { checklist_snapshot, results: _results, ...rest } = run;\n  return {\n    ...rest,\n    status: effectiveStatus(root, run),\n    actor_name: names.get(run.actor) ?? null,\n    checklist_name: typeof checklist_snapshot.name === 'string' ? checklist_snapshot.name : null,\n    tally: tallyRun(run),\n  };\n}\n\nasync function readBody(req: IncomingMessage): Promise<string> {\n  let body = '';\n  for await (const chunk of req) {\n    body += chunk;\n    if (body.length > 10_000) throw new Error('Body too large');\n  }\n  return body;\n}\n\nexport async function startUi(options: {\n  root: string;\n  port?: number;\n  extension?: UiExtension;\n}): Promise<UiServer> {\n  const extension = options.extension;\n  const root = resolve(options.root);\n  const token = randomBytes(24).toString('base64url');\n  const clients = new Set<ServerResponse>();\n  let port = 0;\n  let ensureWatch = () => {};\n\n  async function handle(req: IncomingMessage, res: ServerResponse): Promise<void> {\n    const host = req.headers.host ?? '';\n    if (host !== `127.0.0.1:${port}` && host !== `localhost:${port}`) {\n      return send(res, 403, 'Forbidden');\n    }\n    const url = new URL(req.url ?? '/', `http://${host}`);\n    if (url.pathname === '/__stuntdouble') return json(res, { stuntdouble: true });\n    // Browsers ask for it unprompted; there is none, and that is not an error.\n    if (url.pathname === '/favicon.ico') return send(res, 204, '');\n    if (extension && url.pathname === '/oauth/callback' && req.method === 'GET') {\n      return extension.oauthCallback(req, res, url);\n    }\n\n    // Cookies are per host, not per port, so each server names its own.\n    const cookieName = `stuntdouble_${port}`;\n    const key = url.searchParams.get('t');\n    if (key !== null) {\n      if (!sameSecret(key, token)) return send(res, 403, 'This link is out of date.');\n      url.searchParams.delete('t');\n      return send(res, 302, '', undefined, {\n        Location: `${url.pathname}${url.search}`,\n        'Set-Cookie': `${cookieName}=${token}; HttpOnly; SameSite=Strict; Path=/`,\n      });\n    }\n    const signedIn = cookie(req, cookieName);\n    if (!signedIn || !sameSecret(signedIn, token)) {\n      return send(\n        res,\n        403,\n        'Open the viewer from the link Stunt Double printed: it carries the key.'\n      );\n    }\n\n    const path = url.pathname;\n    if (req.method === 'POST' && path === '/api/stop') {\n      const origin = req.headers.origin;\n      if (origin && origin !== `http://${host}`) return send(res, 403, 'Forbidden');\n      const { run } = JSON.parse(await readBody(req)) as { run?: unknown };\n      const entry = typeof run === 'string' ? await readRun(root, run) : null;\n      if (!entry || !('run' in entry) || effectiveStatus(root, entry.run) !== 'running') {\n        return send(res, 409, 'That run is not going.');\n      }\n      await writeFileAtomic(join(root, '.live', 'stop'), entry.id);\n      return send(res, 204, '');\n    }\n    if (extension && (await extension.handle(req, res, url))) return;\n    if (req.method !== 'GET') return send(res, 405, 'Method not allowed');\n\n    if (\n      path === '/' ||\n      path === '/definitions' ||\n      /^\\/runs\\/[^/]+$/.test(path) ||\n      extension?.pages.test(path)\n    ) {\n      let page = await readFile(new URL('./ui.html', import.meta.url), 'utf8');\n      if (extension) {\n        page = page.replace('</body>', `<script src=\"${extension.script}\"></script>\\n  </body>`);\n      }\n      return send(res, 200, page, 'text/html; charset=utf-8', PAGE_HEADERS);\n    }\n    if (path === '/api/runs') {\n      const [runs, names] = await Promise.all([readRuns(root), actorNames(root)]);\n      return json(\n        res,\n        runs.map((e) => ('run' in e ? runSummary(root, e.run, names) : e))\n      );\n    }\n    const runMatch = path.match(/^\\/api\\/runs\\/([^/]+)$/);\n    if (runMatch) {\n      const id = decodeURIComponent(runMatch[1]!);\n      const entry = await readRun(root, id);\n      if (!entry) return send(res, 404, 'No such run');\n      const activity = await readFile(join(root, 'runs', entry.id, 'activity.jsonl'), 'utf8')\n        .then((text) =>\n          text\n            .split('\\n')\n            .filter(Boolean)\n            .map((line) => JSON.parse(line))\n        )\n        .catch(() => []);\n      const stop = await readFile(join(root, '.live', 'stop'), 'utf8').catch(() => '');\n      const names = 'run' in entry ? await actorNames(root) : new Map<string, string>();\n      return json(res, {\n        ...entry,\n        ...('run' in entry\n          ? {\n              run: {\n                ...entry.run,\n                status: effectiveStatus(root, entry.run),\n                actor_name: names.get(entry.run.actor) ?? null,\n              },\n            }\n          : {}),\n        activity,\n        stop_requested: stop.trim() === entry.id,\n      });\n    }\n    if (path === '/api/definitions') {\n      return json(res, {\n        checklists: await definitions(root, 'checklists'),\n        actors: await definitions(root, 'actors'),\n      });\n    }\n    if (path === '/api/events') {\n      res.writeHead(200, {\n        'Content-Type': 'text/event-stream',\n        'Cache-Control': 'no-store',\n        'X-Content-Type-Options': 'nosniff',\n      });\n      res.write(': connected\\n\\n');\n      ensureWatch();\n      clients.add(res);\n      req.on('close', () => clients.delete(res));\n      return;\n    }\n    if (path.startsWith('/files/')) {\n      const rel = decodeURIComponent(path.slice('/files/'.length));\n      const file = await confined(root, rel);\n      if (!file) return send(res, 403, 'Outside .stuntdouble/');\n      const type = TYPES[extname(file)];\n      if (!type) return send(res, 404, 'Not found');\n      // A verdict's screenshot never changes once written; the live frame does.\n      const cache = rel.includes('/shots/') ? 'private, max-age=86400' : 'no-store';\n      return send(res, 200, await readFile(file), type, { 'Cache-Control': cache });\n    }\n    return send(res, 404, 'Not found');\n  }\n\n  const server = createServer((req, res) => {\n    handle(req, res).catch(() => {\n      if (res.headersSent) res.end();\n      else send(res, 500, 'Something went wrong reading .stuntdouble/');\n    });\n  });\n\n  const first = options.port ?? FIRST_PORT;\n  for (let candidate = first; ; candidate++) {\n    try {\n      await new Promise<void>((ok, fail) => {\n        server.once('error', fail);\n        server.listen(candidate, '127.0.0.1', () => {\n          server.off('error', fail);\n          ok();\n        });\n      });\n      break;\n    } catch (err) {\n      const busy = (err as NodeJS.ErrnoException).code === 'EADDRINUSE';\n      if (!busy || candidate >= first + PORT_TRIES) throw err;\n    }\n  }\n  port = (server.address() as AddressInfo).port;\n\n  // Every change under .stuntdouble/ is announced, and the page refetches what\n  // it shows. This works the same whether the run is in this process or not.\n  let watcher: FSWatcher | null = null;\n  let pending = new Set<string>();\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  // Tried again on each new page: the Studio creates .stuntdouble/ after starting.\n  ensureWatch = () => {\n    if (watcher) return;\n    try {\n      watcher = watch(root, { recursive: true }, (_event, name) => {\n        if (!name || name.endsWith('.tmp')) return;\n        pending.add(String(name).split(sep).join('/'));\n        timer ??= setTimeout(() => {\n          const data = `data: ${JSON.stringify({ paths: [...pending] })}\\n\\n`;\n          for (const client of clients) client.write(data);\n          pending = new Set();\n          timer = undefined;\n        }, 150);\n      });\n    } catch {\n      // No .stuntdouble/ yet: the viewer shows the empty state without live updates.\n    }\n  };\n  ensureWatch();\n\n  return {\n    port,\n    token,\n    link: (path = '/') => `http://127.0.0.1:${port}${path}?t=${token}`,\n    close: async () => {\n      watcher?.close();\n      clearTimeout(timer);\n      for (const client of clients) client.end();\n      server.closeAllConnections();\n      await new Promise<void>((ok) => server.close(() => ok()));\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;AAWA,SAAS,aAAa,uBAAuB;AAC7C,SAAS,aAA6B;AACtC,SAAS,SAAS,UAAU,gBAAgB;AAC5C,SAAS,oBAA+D;AAExE,SAAS,UAAU,SAAS,MAAM,SAAS,WAAW;AAc/C,IAAM,aAAa;AAC1B,IAAM,aAAa;AA4BnB,IAAM,QAAgC;AAAA,EACpC,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,UAAU;AACZ;AAEA,IAAM,eAAe;AAAA,EACnB,2BACE;AACJ;AAEO,SAAS,KACd,KACA,QACA,MACA,OAAO,6BACP,UAAkC,CAAC,GAC7B;AACN,MAAI,UAAU,QAAQ;AAAA,IACpB,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,0BAA0B;AAAA,IAC1B,mBAAmB;AAAA,IACnB,GAAG;AAAA,EACL,CAAC;AACD,MAAI,IAAI,IAAI;AACd;AAEA,IAAM,OAAO,CAAC,KAAqB,SACjC,KAAK,KAAK,KAAK,KAAK,UAAU,IAAI,GAAG,kBAAkB;AAEzD,SAAS,WAAW,OAAe,OAAwB;AACzD,QAAM,IAAI,OAAO,KAAK,KAAK;AAC3B,QAAM,IAAI,OAAO,KAAK,KAAK;AAC3B,SAAO,EAAE,WAAW,EAAE,UAAU,gBAAgB,GAAG,CAAC;AACtD;AAEA,SAAS,OAAO,KAAsB,MAAkC;AACtE,aAAW,SAAS,IAAI,QAAQ,UAAU,IAAI,MAAM,GAAG,GAAG;AACxD,UAAM,CAAC,KAAK,GAAG,KAAK,IAAI,KAAK,KAAK,EAAE,MAAM,GAAG;AAC7C,QAAI,QAAQ,KAAM,QAAO,MAAM,KAAK,GAAG;AAAA,EACzC;AACA,SAAO;AACT;AAGA,eAAe,SAAS,MAAc,KAAqC;AACzE,MAAI;AACF,UAAM,WAAW,MAAM,SAAS,IAAI;AACpC,UAAM,OAAO,MAAM,SAAS,QAAQ,MAAM,GAAG,CAAC;AAC9C,WAAO,KAAK,WAAW,WAAW,GAAG,IAAI,OAAO;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,YAAY,MAAc,QAAiC;AACxE,QAAM,SAAS,WAAW,eAAe,kBAAkB;AAC3D,QAAM,QAAQ,MAAM,QAAQ,KAAK,MAAM,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC,CAAa;AAC1E,SAAO,QAAQ;AAAA,IACb,MACG,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO,CAAC,EACjC,KAAK,EACL,IAAI,OAAO,SAAS;AACnB,YAAM,OAAO,SAAS,MAAM,OAAO;AACnC,UAAI;AACF,eAAO,EAAE,MAAM,MAAM,MAAM,SAAS,KAAK,MAAM,QAAQ,IAAI,GAAG,QAAQ,IAAI,EAAE;AAAA,MAC9E,SAAS,KAAK;AACZ,eAAO,EAAE,MAAM,OAAQ,IAAc,QAAQ;AAAA,MAC/C;AAAA,IACF,CAAC;AAAA,EACL;AACF;AAGA,eAAe,WAAW,MAA4C;AACpE,QAAM,SAAS,MAAM,YAAY,MAAM,QAAQ;AAC/C,SAAO,IAAI,IAAI,OAAO,QAAQ,CAAC,MAAO,UAAU,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,CAAE,CAAC;AAC9F;AAGA,SAAS,WAAW,MAAc,KAAU,OAA4B;AACtE,QAAM,EAAE,oBAAoB,SAAS,UAAU,GAAG,KAAK,IAAI;AAC3D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,gBAAgB,MAAM,GAAG;AAAA,IACjC,YAAY,MAAM,IAAI,IAAI,KAAK,KAAK;AAAA,IACpC,gBAAgB,OAAO,mBAAmB,SAAS,WAAW,mBAAmB,OAAO;AAAA,IACxF,OAAO,SAAS,GAAG;AAAA,EACrB;AACF;AAEA,eAAe,SAAS,KAAuC;AAC7D,MAAI,OAAO;AACX,mBAAiB,SAAS,KAAK;AAC7B,YAAQ;AACR,QAAI,KAAK,SAAS,IAAQ,OAAM,IAAI,MAAM,gBAAgB;AAAA,EAC5D;AACA,SAAO;AACT;AAEA,eAAsB,QAAQ,SAIR;AACpB,QAAM,YAAY,QAAQ;AAC1B,QAAM,OAAO,QAAQ,QAAQ,IAAI;AACjC,QAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,WAAW;AAClD,QAAM,UAAU,oBAAI,IAAoB;AACxC,MAAI,OAAO;AACX,MAAI,cAAc,MAAM;AAAA,EAAC;AAEzB,iBAAe,OAAO,KAAsB,KAAoC;AAC9E,UAAM,OAAO,IAAI,QAAQ,QAAQ;AACjC,QAAI,SAAS,aAAa,IAAI,MAAM,SAAS,aAAa,IAAI,IAAI;AAChE,aAAO,KAAK,KAAK,KAAK,WAAW;AAAA,IACnC;AACA,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,IAAI,EAAE;AACpD,QAAI,IAAI,aAAa,iBAAkB,QAAO,KAAK,KAAK,EAAE,aAAa,KAAK,CAAC;AAE7E,QAAI,IAAI,aAAa,eAAgB,QAAO,KAAK,KAAK,KAAK,EAAE;AAC7D,QAAI,aAAa,IAAI,aAAa,qBAAqB,IAAI,WAAW,OAAO;AAC3E,aAAO,UAAU,cAAc,KAAK,KAAK,GAAG;AAAA,IAC9C;AAGA,UAAM,aAAa,eAAe,IAAI;AACtC,UAAM,MAAM,IAAI,aAAa,IAAI,GAAG;AACpC,QAAI,QAAQ,MAAM;AAChB,UAAI,CAAC,WAAW,KAAK,KAAK,EAAG,QAAO,KAAK,KAAK,KAAK,2BAA2B;AAC9E,UAAI,aAAa,OAAO,GAAG;AAC3B,aAAO,KAAK,KAAK,KAAK,IAAI,QAAW;AAAA,QACnC,UAAU,GAAG,IAAI,QAAQ,GAAG,IAAI,MAAM;AAAA,QACtC,cAAc,GAAG,UAAU,IAAI,KAAK;AAAA,MACtC,CAAC;AAAA,IACH;AACA,UAAM,WAAW,OAAO,KAAK,UAAU;AACvC,QAAI,CAAC,YAAY,CAAC,WAAW,UAAU,KAAK,GAAG;AAC7C,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAO,IAAI;AACjB,QAAI,IAAI,WAAW,UAAU,SAAS,aAAa;AACjD,YAAM,SAAS,IAAI,QAAQ;AAC3B,UAAI,UAAU,WAAW,UAAU,IAAI,GAAI,QAAO,KAAK,KAAK,KAAK,WAAW;AAC5E,YAAM,EAAE,IAAI,IAAI,KAAK,MAAM,MAAM,SAAS,GAAG,CAAC;AAC9C,YAAM,QAAQ,OAAO,QAAQ,WAAW,MAAM,QAAQ,MAAM,GAAG,IAAI;AACnE,UAAI,CAAC,SAAS,EAAE,SAAS,UAAU,gBAAgB,MAAM,MAAM,GAAG,MAAM,WAAW;AACjF,eAAO,KAAK,KAAK,KAAK,wBAAwB;AAAA,MAChD;AACA,YAAM,gBAAgB,KAAK,MAAM,SAAS,MAAM,GAAG,MAAM,EAAE;AAC3D,aAAO,KAAK,KAAK,KAAK,EAAE;AAAA,IAC1B;AACA,QAAI,aAAc,MAAM,UAAU,OAAO,KAAK,KAAK,GAAG,EAAI;AAC1D,QAAI,IAAI,WAAW,MAAO,QAAO,KAAK,KAAK,KAAK,oBAAoB;AAEpE,QACE,SAAS,OACT,SAAS,kBACT,kBAAkB,KAAK,IAAI,KAC3B,WAAW,MAAM,KAAK,IAAI,GAC1B;AACA,UAAI,OAAO,MAAM,SAAS,IAAI,IAAI,aAAa,YAAY,GAAG,GAAG,MAAM;AACvE,UAAI,WAAW;AACb,eAAO,KAAK,QAAQ,WAAW,gBAAgB,UAAU,MAAM;AAAA,UAAwB;AAAA,MACzF;AACA,aAAO,KAAK,KAAK,KAAK,MAAM,4BAA4B,YAAY;AAAA,IACtE;AACA,QAAI,SAAS,aAAa;AACxB,YAAM,CAAC,MAAM,KAAK,IAAI,MAAM,QAAQ,IAAI,CAAC,SAAS,IAAI,GAAG,WAAW,IAAI,CAAC,CAAC;AAC1E,aAAO;AAAA,QACL;AAAA,QACA,KAAK,IAAI,CAAC,MAAO,SAAS,IAAI,WAAW,MAAM,EAAE,KAAK,KAAK,IAAI,CAAE;AAAA,MACnE;AAAA,IACF;AACA,UAAM,WAAW,KAAK,MAAM,wBAAwB;AACpD,QAAI,UAAU;AACZ,YAAM,KAAK,mBAAmB,SAAS,CAAC,CAAE;AAC1C,YAAM,QAAQ,MAAM,QAAQ,MAAM,EAAE;AACpC,UAAI,CAAC,MAAO,QAAO,KAAK,KAAK,KAAK,aAAa;AAC/C,YAAM,WAAW,MAAM,SAAS,KAAK,MAAM,QAAQ,MAAM,IAAI,gBAAgB,GAAG,MAAM,EACnF;AAAA,QAAK,CAAC,SACL,KACG,MAAM,IAAI,EACV,OAAO,OAAO,EACd,IAAI,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC;AAAA,MACnC,EACC,MAAM,MAAM,CAAC,CAAC;AACjB,YAAM,OAAO,MAAM,SAAS,KAAK,MAAM,SAAS,MAAM,GAAG,MAAM,EAAE,MAAM,MAAM,EAAE;AAC/E,YAAM,QAAQ,SAAS,QAAQ,MAAM,WAAW,IAAI,IAAI,oBAAI,IAAoB;AAChF,aAAO,KAAK,KAAK;AAAA,QACf,GAAG;AAAA,QACH,GAAI,SAAS,QACT;AAAA,UACE,KAAK;AAAA,YACH,GAAG,MAAM;AAAA,YACT,QAAQ,gBAAgB,MAAM,MAAM,GAAG;AAAA,YACvC,YAAY,MAAM,IAAI,MAAM,IAAI,KAAK,KAAK;AAAA,UAC5C;AAAA,QACF,IACA,CAAC;AAAA,QACL;AAAA,QACA,gBAAgB,KAAK,KAAK,MAAM,MAAM;AAAA,MACxC,CAAC;AAAA,IACH;AACA,QAAI,SAAS,oBAAoB;AAC/B,aAAO,KAAK,KAAK;AAAA,QACf,YAAY,MAAM,YAAY,MAAM,YAAY;AAAA,QAChD,QAAQ,MAAM,YAAY,MAAM,QAAQ;AAAA,MAC1C,CAAC;AAAA,IACH;AACA,QAAI,SAAS,eAAe;AAC1B,UAAI,UAAU,KAAK;AAAA,QACjB,gBAAgB;AAAA,QAChB,iBAAiB;AAAA,QACjB,0BAA0B;AAAA,MAC5B,CAAC;AACD,UAAI,MAAM,iBAAiB;AAC3B,kBAAY;AACZ,cAAQ,IAAI,GAAG;AACf,UAAI,GAAG,SAAS,MAAM,QAAQ,OAAO,GAAG,CAAC;AACzC;AAAA,IACF;AACA,QAAI,KAAK,WAAW,SAAS,GAAG;AAC9B,YAAM,MAAM,mBAAmB,KAAK,MAAM,UAAU,MAAM,CAAC;AAC3D,YAAM,OAAO,MAAM,SAAS,MAAM,GAAG;AACrC,UAAI,CAAC,KAAM,QAAO,KAAK,KAAK,KAAK,uBAAuB;AACxD,YAAM,OAAO,MAAM,QAAQ,IAAI,CAAC;AAChC,UAAI,CAAC,KAAM,QAAO,KAAK,KAAK,KAAK,WAAW;AAE5C,YAAM,QAAQ,IAAI,SAAS,SAAS,IAAI,2BAA2B;AACnE,aAAO,KAAK,KAAK,KAAK,MAAM,SAAS,IAAI,GAAG,MAAM,EAAE,iBAAiB,MAAM,CAAC;AAAA,IAC9E;AACA,WAAO,KAAK,KAAK,KAAK,WAAW;AAAA,EACnC;AAEA,QAAM,SAAS,aAAa,CAAC,KAAK,QAAQ;AACxC,WAAO,KAAK,GAAG,EAAE,MAAM,MAAM;AAC3B,UAAI,IAAI,YAAa,KAAI,IAAI;AAAA,UACxB,MAAK,KAAK,KAAK,4CAA4C;AAAA,IAClE,CAAC;AAAA,EACH,CAAC;AAED,QAAM,QAAQ,QAAQ,QAAQ;AAC9B,WAAS,YAAY,SAAS,aAAa;AACzC,QAAI;AACF,YAAM,IAAI,QAAc,CAAC,IAAI,SAAS;AACpC,eAAO,KAAK,SAAS,IAAI;AACzB,eAAO,OAAO,WAAW,aAAa,MAAM;AAC1C,iBAAO,IAAI,SAAS,IAAI;AACxB,aAAG;AAAA,QACL,CAAC;AAAA,MACH,CAAC;AACD;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B,SAAS;AACrD,UAAI,CAAC,QAAQ,aAAa,QAAQ,WAAY,OAAM;AAAA,IACtD;AAAA,EACF;AACA,SAAQ,OAAO,QAAQ,EAAkB;AAIzC,MAAI,UAA4B;AAChC,MAAI,UAAU,oBAAI,IAAY;AAC9B,MAAI;AAEJ,gBAAc,MAAM;AAClB,QAAI,QAAS;AACb,QAAI;AACF,gBAAU,MAAM,MAAM,EAAE,WAAW,KAAK,GAAG,CAAC,QAAQ,SAAS;AAC3D,YAAI,CAAC,QAAQ,KAAK,SAAS,MAAM,EAAG;AACpC,gBAAQ,IAAI,OAAO,IAAI,EAAE,MAAM,GAAG,EAAE,KAAK,GAAG,CAAC;AAC7C,kBAAU,WAAW,MAAM;AACzB,gBAAM,OAAO,SAAS,KAAK,UAAU,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC,CAAC;AAAA;AAAA;AAC7D,qBAAW,UAAU,QAAS,QAAO,MAAM,IAAI;AAC/C,oBAAU,oBAAI,IAAI;AAClB,kBAAQ;AAAA,QACV,GAAG,GAAG;AAAA,MACR,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AACA,cAAY;AAEZ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,CAAC,OAAO,QAAQ,oBAAoB,IAAI,GAAG,IAAI,MAAM,KAAK;AAAA,IAChE,OAAO,YAAY;AACjB,eAAS,MAAM;AACf,mBAAa,KAAK;AAClB,iBAAW,UAAU,QAAS,QAAO,IAAI;AACzC,aAAO,oBAAoB;AAC3B,YAAM,IAAI,QAAc,CAAC,OAAO,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC;AAAA,IAC1D;AAAA,EACF;AACF;","names":[]}