wisp-agents 0.14.0 → 0.16.0

package/server/proc.js

@@ -7,6 +7,7 @@
 import { spawn as nodeSpawn, execFile as nodeExecFile, spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
+import { bad } from './util.js';
 
 // Find `bin` on PATH the way cmd.exe would (PATHEXT). Returns an absolute path or null.
 // A copied env object loses Windows' case-insensitive keys, so PATH may be spelled "Path".
@@ -125,3 +126,56 @@ export function onPath(bin, env = process.env) {
     }
   });
 }
+
+const MAX_EXEC_OUTPUT = 32 * 1024;
+const EXEC_TIMEOUT_MS = 60_000;
+
+// Run a shell command from an actionable presentation block inside `cwd`.
+export function execCommand(cwd, command, { timeoutMs = EXEC_TIMEOUT_MS } = {}) {
+  const cmd = String(command || '').trim();
+  if (!cmd) return Promise.reject(bad('command required'));
+  const t0 = Date.now();
+
+  return new Promise((resolve) => {
+    const child = nodeSpawn(cmd, {
+      cwd,
+      env: { ...process.env, PAGER: 'cat', GIT_TERMINAL_PROMPT: '0', CI: '1' },
+      shell: true,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let out = '';
+    const append = (chunk) => {
+      if (out.length < MAX_EXEC_OUTPUT) out += chunk.toString('utf8').slice(0, MAX_EXEC_OUTPUT - out.length);
+    };
+    child.stdout.on('data', append);
+    child.stderr.on('data', append);
+
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      killTree(child);
+    }, timeoutMs);
+
+    child.on('error', (err) => {
+      clearTimeout(timer);
+      resolve({
+        command: cmd,
+        output: (out ? `${out}\n` : '') + err.message,
+        exitCode: 1,
+        durationMs: Date.now() - t0,
+      });
+    });
+
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      const suffix = timedOut ? `\n[timed out after ${Math.round(timeoutMs / 1000)}s]` : '';
+      resolve({
+        command: cmd,
+        output: (out.replace(/\s+$/, '') + suffix).trim(),
+        exitCode: timedOut ? 124 : (code ?? 1),
+        durationMs: Date.now() - t0,
+      });
+    });
+  });
+}

package/server/recipes.js

@@ -2,10 +2,9 @@
 // parameter, filled in when the recipe runs (the run dialog, `wisp run release 0.8.0`, a trigger).
 
 import path from 'node:path';
-import { newId } from './runner.js';
+import { bad, MODES, newId } from './util.js';
 
 const PARAM = /\{([a-zA-Z][\w-]{0,30})\}/g;
-const MODES = new Set(['plan', 'edits', 'auto']);
 
 export const params = (prompt) => [...new Set([...String(prompt || '').matchAll(PARAM)].map((m) => m[1]))];
 
@@ -14,7 +13,7 @@ export const params = (prompt) => [...new Set([...String(prompt || '').matchAll(
 export function fill(prompt, values = {}, { strict = true } = {}) {
   const has = (k) => values[k] !== undefined && values[k] !== null && String(values[k]).trim() !== '';
   const missing = params(prompt).filter((k) => !has(k));
-  if (strict && missing.length) throw Object.assign(new Error(`Missing ${missing.map((k) => `{${k}}`).join(', ')}`), { status: 400 });
+  if (strict && missing.length) throw bad(`Missing ${missing.map((k) => `{${k}}`).join(', ')}`);
   return String(prompt).replace(PARAM, (_, k) => (has(k) ? String(values[k]) : ''));
 }
 
@@ -25,7 +24,6 @@ export function positional(prompt, words = []) {
   return out;
 }
 
-const bad = (msg) => Object.assign(new Error(msg), { status: 400 });
 
 export function normalizeRecipe(body, prev = null) {
   const name = String(body.name ?? prev?.name ?? '').trim().slice(0, 60);

package/server/remote.js

@@ -8,13 +8,13 @@
 //             /new [@project] <task> starts a task and /projects lists where it can run.
 
 import { createHmac, randomBytes, randomInt, timingSafeEqual } from 'node:crypto';
+import { bad, truncate } from './util.js';
 
 const KIND = { a: 'answer', r: 'reply', d: 'done' };
 const CODE = { answer: 'a', reply: 'r', done: 'd' };
 const MAX_TG_IDS = 20;
 const STALE_S = 10 * 60;
 const sleep = (ms, signal) => new Promise((r) => (signal?.aborted ? r() : (setTimeout(r, ms).unref?.(), signal?.addEventListener('abort', r, { once: true }))));
-const clip = (s, n) => (String(s || '').length > n ? `${String(s).slice(0, n - 1)}…` : String(s || ''));
 // /new @name: exact name, then name prefix, then anywhere in the name or path.
 export function findProject(projects, q) {
   const n = String(q || '').toLowerCase();
@@ -76,7 +76,7 @@ export class Remote {
     if (s.ask) {
       return {
         title: `❓ ${where}`,
-        text: [s.ask.question, s.ask.context && clip(s.ask.context, 600)].filter(Boolean).join('\n\n'),
+        text: [s.ask.question, s.ask.context && truncate(s.ask.context, 600)].filter(Boolean).join('\n\n'),
         actions: (s.ask.options || []).map((label, index) => ({ label, kind: 'answer', ref: s.ask.id, index })),
       };
     }
@@ -139,12 +139,12 @@ export class Remote {
     const { server, topic, headers } = this.#ntfy();
     const actions = (s ? msg.actions : []).slice(0, 3).map((a) => {
       const k = CODE[a.kind];
-      return { action: 'http', label: clip(a.label, 40), url: `${server}/${topic}-reply`, method: 'POST', headers, body: JSON.stringify({ s: s.id, k, r: a.ref, i: a.index, sig: this.sign(s.id, a.kind, a.ref, a.index) }), clear: true };
+      return { action: 'http', label: truncate(a.label, 40), url: `${server}/${topic}-reply`, method: 'POST', headers, body: JSON.stringify({ s: s.id, k, r: a.ref, i: a.index, sig: this.sign(s.id, a.kind, a.ref, a.index) }), clear: true };
     });
     const r = await fetch(server, {
       method: 'POST',
       headers: { 'content-type': 'application/json', ...headers },
-      body: JSON.stringify({ topic, title: clip(msg.title, 200), message: clip(msg.text, 3000), tags: ['wisp'], ...(actions.length && { actions }) }),
+      body: JSON.stringify({ topic, title: truncate(msg.title, 200), message: truncate(msg.text, 3000), tags: ['wisp'], ...(actions.length && { actions }) }),
       signal: AbortSignal.timeout(10_000),
     });
     if (!r.ok) throw new Error(`ntfy: ${r.status} ${(await r.text().catch(() => '')).slice(0, 120)}`);
@@ -194,10 +194,10 @@ export class Remote {
   }
 
   async #tgPublish(msg, s) {
-    const buttons = (s ? msg.actions : []).map((a) => [{ text: clip(a.label, 60), callback_data: `${CODE[a.kind]}:${s.id}:${a.ref}:${a.index}` }]);
+    const buttons = (s ? msg.actions : []).map((a) => [{ text: truncate(a.label, 60), callback_data: `${CODE[a.kind]}:${s.id}:${a.ref}:${a.index}` }]);
     const sent = await this.#tg('sendMessage', {
       chat_id: this.cfg.telegram.chatId,
-      text: clip(`${msg.title}\n\n${msg.text}${s ? '\n\n↩ Reply to this message to answer or follow up.' : ''}`, 4000),
+      text: truncate(`${msg.title}\n\n${msg.text}${s ? '\n\n↩ Reply to this message to answer or follow up.' : ''}`, 4000),
       ...(buttons.length && { reply_markup: { inline_keyboard: buttons } }),
     });
     if (s && sent?.message_id) this.#tgLink(s.id, sent.message_id);
@@ -231,7 +231,7 @@ export class Remote {
       if (!t.chatId || String(q.message?.chat?.id) !== String(t.chatId)) return;
       const [k, sessionId, ref, i] = String(q.data || '').split(':');
       const result = KIND[k] ? await this.act({ sessionId, kind: KIND[k], ref, index: Number(i) }) : 'Unknown button.';
-      await this.#tg('answerCallbackQuery', { callback_query_id: q.id, text: clip(result, 190) }).catch(() => {});
+      await this.#tg('answerCallbackQuery', { callback_query_id: q.id, text: truncate(result, 190) }).catch(() => {});
       await this.#tg('editMessageReplyMarkup', { chat_id: t.chatId, message_id: q.message.message_id, reply_markup: { inline_keyboard: [] } }).catch(() => {});
       return;
     }
@@ -274,14 +274,14 @@ export class Remote {
       const def = this.defaultProject();
       const where = (id) => (this.store.config.machines || []).find((x) => x.id === id)?.name || id;
       const lines = projects.map((p) => `• ${p.name}${p.machine ? ` (on ${where(p.machine)})` : ''}${p === def ? '  ← default' : ''}`);
-      return say(clip(`Projects:\n${lines.join('\n')}\n\n/new @name <task> runs in one of them.`, 4000));
+      return say(truncate(`Projects:\n${lines.join('\n')}\n\n/new @name <task> runs in one of them.`, 4000));
     }
     let prompt = arg;
     let project = this.defaultProject();
     const at = arg.match(/^@(\S+)\s*([\s\S]*)$/);
     if (at) {
       project = findProject(projects, at[1]);
-      if (!project) return say(`No project matches “${clip(at[1], 60)}”. Send /projects to see them.`);
+      if (!project) return say(`No project matches “${truncate(at[1], 60)}”. Send /projects to see them.`);
       prompt = at[2].trim();
     }
     if (!prompt) return say('What should it do? Send /new <task>, or /new @project <task>.');
@@ -290,9 +290,9 @@ export class Remote {
     try {
       s = await this.launch({ project, prompt });
     } catch (err) {
-      return say(`Couldn’t start it: ${clip(err.message, 300)}`, { reply_to_message_id: m.message_id });
+      return say(`Couldn’t start it: ${truncate(err.message, 300)}`, { reply_to_message_id: m.message_id });
     }
-    const sent = await say(clip(`▶ Started in ${project.name}: ${s?.title || prompt}\n\nwisp will message you when it needs you or is done. Reply to this message to follow up.`, 4000), { reply_to_message_id: m.message_id });
+    const sent = await say(truncate(`▶ Started in ${project.name}: ${s?.title || prompt}\n\nwisp will message you when it needs you or is done. Reply to this message to follow up.`, 4000), { reply_to_message_id: m.message_id });
     if (s?.id && sent?.message_id) this.#tgLink(s.id, sent.message_id);
   }
 
@@ -342,8 +342,8 @@ export class Remote {
     if (body.ntfy) {
       const n = { ...c.ntfy, ...body.ntfy };
       n.token = keep(body.ntfy.token, c.ntfy?.token) || '';
-      if (n.server && !/^https?:\/\/\S+$/.test(n.server)) throw Object.assign(new Error('ntfy server must be an http(s) URL'), { status: 400 });
-      if (n.topic && !/^[\w-]{1,64}$/.test(n.topic)) throw Object.assign(new Error('ntfy topic: letters, digits, - and _ only'), { status: 400 });
+      if (n.server && !/^https?:\/\/\S+$/.test(n.server)) throw bad('ntfy server must be an http(s) URL');
+      if (n.topic && !/^[\w-]{1,64}$/.test(n.topic)) throw bad('ntfy topic: letters, digits, - and _ only');
       c.ntfy = { enabled: !!n.enabled, server: n.server || 'https://ntfy.sh', topic: n.topic || '', token: n.token };
     }
     if (body.telegram) {
@@ -352,7 +352,7 @@ export class Remote {
       const relink = body.telegram.unlink || token !== prev.token;
       if (token !== prev.token) this.tgOffset = 0; // another bot, another update counter
       const project = body.telegram.project ?? prev.project ?? '';
-      if (project && !this.store.config.projects.some((p) => p.id === project)) throw Object.assign(new Error('Unknown project'), { status: 400 });
+      if (project && !this.store.config.projects.some((p) => p.id === project)) throw bad('Unknown project');
       c.telegram = {
         ...prev,
         enabled: !!(body.telegram.enabled ?? prev.enabled),

package/server/router.js

@@ -7,7 +7,8 @@
 // sampling: arms with little data sometimes draw high and get tried) and picks the best value
 // for the goal: value × chance − expected $ − a price on your waiting time.
 //
-// What happened afterwards is the reward, strongest signal first: merged (1) / PR closed (0.2),
+// What happened afterwards is the reward, strongest signal first: switched to another harness or
+// model in a follow-up (0.1), merged (1) / PR closed (0.2),
 // 👍 (1) / 👎 (0), rolled back (0.1), else the presentation's hero (done 0.6, partial 0.3,
 // blocked 0.1, error 0) less 0.1 per follow-up. A later, stronger signal replaces an earlier one.
 //
@@ -17,6 +18,7 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import { writeJsonAtomic } from './util.js';
 
 const PRIORS = JSON.parse(fs.readFileSync(new URL('./router-priors.json', import.meta.url), 'utf8'));
 
@@ -97,7 +99,7 @@ export class Router {
 
   save() {
     try {
-      fs.writeFileSync(this.file, JSON.stringify(this.state));
+      writeJsonAtomic(this.file, this.state); // a cut-off file would load as nothing learned
     } catch (err) {
       console.warn(`wisp: router: ${err.message}`);
     }
@@ -226,7 +228,7 @@ export class Router {
   }
 
   // Something happened to a routed session: { hero, error, followups, feedback, merged, closed,
-  // rolledBack, costUsd, ms }. The reward is recomputed and the stats move by the difference.
+  // rolledBack, switched, costUsd, ms }. The reward is recomputed and the stats move by the difference.
   signal(id, patch) {
     const route = this.state.routes[id];
     if (!route) return null;
@@ -291,6 +293,8 @@ export class Router {
 }
 
 export function reward(sig) {
+  // The user moved the task to another harness or model: whatever happens next isn't this arm's.
+  if (sig.switched) return 0.1;
   if (sig.merged) return 1;
   if (sig.feedback === 'up') return 1;
   if (sig.feedback === 'down') return 0;

package/server/routes/auto.js

@@ -0,0 +1,29 @@
+// Auto: what the router learned, and its settings (goal, trying new models, allowed harnesses).
+
+import { adapters } from '../adapters/index.js';
+import { GOALS } from '../router.js';
+
+export function register(r, app) {
+  const { store, auto } = app;
+
+  r.route('GET', '/router', async (c) => c.send(200, await auto.view()));
+  r.route('PATCH', '/router', async (c) => {
+    const body = await c.body();
+    const d = store.config.defaults;
+    if (body.goal !== undefined) {
+      if (!GOALS[body.goal]) return c.send(400, { error: `goal must be one of ${Object.keys(GOALS).join(', ')}` });
+      d.models = { ...d.models, auto: body.goal };
+      if (d.agent === 'auto') d.model = body.goal;
+    }
+    d.router = { ...d.router };
+    if (body.explore !== undefined) d.router.explore = body.explore ? 'on' : 'off';
+    if (body.allowed !== undefined) d.router.allowed = Array.isArray(body.allowed) ? body.allowed.filter((a) => adapters[a]) : null;
+    app.configChanged();
+    c.send(200, await auto.view());
+  });
+  r.route('POST', '/router/reset', async (c) => {
+    app.router.reset();
+    app.broadcast('router', {});
+    c.send(200, await auto.view());
+  });
+}

package/server/routes/automations.js

@@ -0,0 +1,92 @@
+// Recipes (saved prompts with {params}) and triggers (schedules and GitHub watchers).
+
+import { normalizeRecipe, findRecipe, recipeView } from '../recipes.js';
+import { normalizeTrigger, triggerView } from '../triggers.js';
+
+export function register(r, app) {
+  const { store } = app;
+
+  r.route('GET', '/recipes', (c) => c.send(200, store.config.recipes.map(recipeView)));
+  r.route('POST', '/recipes', async (c) => {
+    const x = normalizeRecipe(await c.body());
+    store.config.recipes.push(x);
+    app.configChanged();
+    c.send(201, recipeView(x));
+  });
+  // A recipe by id or by name (loosely: "Fix Bug" finds fix-bug).
+  const recipe = (fn) => async (c) => {
+    const x = findRecipe(store.config.recipes, c.params.key);
+    if (!x) return c.send(404, { error: 'no such recipe' });
+    return fn(c, x);
+  };
+  r.route('GET', '/recipes/:key', recipe((c, x) => c.send(200, recipeView(x))));
+  r.route(
+    'PATCH',
+    '/recipes/:key',
+    recipe(async (c, x) => {
+      Object.assign(x, normalizeRecipe(await c.body(), x));
+      app.configChanged();
+      c.send(200, recipeView(x));
+    }),
+  );
+  r.route(
+    'DELETE',
+    '/recipes/:key',
+    recipe((c, x) => {
+      store.config.recipes = store.config.recipes.filter((y) => y !== x);
+      app.configChanged();
+      c.send(200, { ok: true });
+    }),
+  );
+  // POST /recipes/:key/run { params | words, cwd, … }. machine: run it in a project there
+  // (r.cwd empty, or a path on that machine).
+  r.route(
+    'POST',
+    '/recipes/:key/run',
+    recipe(async (c, x) => {
+      const body = await c.body();
+      const s = await app.launcher.runRecipe(x, { params: body.params || {}, words: Array.isArray(body.words) ? body.words.map(String) : undefined, cwd: body.cwd, machine: body.machine || undefined, agent: body.agent, model: body.model, effort: body.effort, mode: body.mode });
+      c.send(201, s);
+    }),
+  );
+
+  r.route('GET', '/triggers', (c) => c.send(200, store.config.triggers.map(triggerView)));
+  r.route('POST', '/triggers', async (c) => {
+    const t = normalizeTrigger(await c.body(), null, { recipes: store.config.recipes });
+    store.config.triggers.push(t);
+    app.configChanged();
+    c.send(201, triggerView(t));
+  });
+  const trigger = (fn) => async (c) => {
+    const t = store.config.triggers.find((x) => x.id === c.params.id);
+    if (!t) return c.send(404, { error: 'no such trigger' });
+    return fn(c, t);
+  };
+  r.route(
+    'PATCH',
+    '/triggers/:id',
+    trigger(async (c, t) => {
+      Object.assign(t, normalizeTrigger(await c.body(), t, { recipes: store.config.recipes }));
+      app.configChanged();
+      c.send(200, triggerView(t));
+    }),
+  );
+  r.route(
+    'DELETE',
+    '/triggers/:id',
+    trigger((c, t) => {
+      store.config.triggers = store.config.triggers.filter((x) => x !== t);
+      app.configChanged();
+      c.send(200, { ok: true });
+    }),
+  );
+  r.route(
+    'POST',
+    '/triggers/:id/run',
+    trigger(async (c, t) => {
+      const out = await app.triggers.runNow(t);
+      const started = Array.isArray(out) ? out : out ? [out] : [];
+      c.send(200, { started, trigger: triggerView(t) });
+    }),
+  );
+}

package/server/routes/internal.js

@@ -0,0 +1,56 @@
+// Bridge for the MCP servers running inside an agent process (ask_user, delegate). Every call
+// carries the per-run token wisp handed the agent; nothing else may use these.
+
+import { adapters } from '../adapters/index.js';
+import { delegationReport } from '../subagents.js';
+
+export function register(r, app) {
+  const { store, runner, telemetry } = app;
+  // The token check, then the handler; a wrong token is a 403 whatever the route.
+  const guarded = (fn) => (c) => (c.req.headers['x-wisp-token'] !== app.token ? c.send(403, { error: 'bad token' }) : fn(c));
+  const opts = { doc: false };
+  const lead = (c) => store.get(c.params.id);
+
+  r.route(
+    'POST',
+    '/internal/ask',
+    guarded(async (c) => {
+      const body = await c.body();
+      const s = store.get(body.session);
+      if (!s) return c.send(404, { error: 'no such session' });
+      telemetry.track('ask_user', { agent: s.agent });
+      c.send(200, { id: runner.ask(s, body) });
+    }),
+    opts,
+  );
+  r.route('GET', '/internal/ask/:id', guarded((c) => c.send(200, runner.pollAnswer(c.params.id))), opts);
+
+  // delegate: POST starts tasks on the lead's subagents; GET reports on them (done once all finished).
+  r.route(
+    'POST',
+    '/internal/delegate/:id',
+    guarded(async (c) => {
+      const s = lead(c);
+      if (!s) return c.send(404, { error: 'no such session' });
+      const body = await c.body();
+      const delegations = runner.delegate(s, body.tasks);
+      telemetry.track('delegate', { agent: s.agent, tasks: delegations.length, harnesses: [...new Set(delegations.filter((d) => d.agent).map((d) => d.agent))] });
+      c.send(200, { delegations });
+    }),
+    opts,
+  );
+  r.route(
+    'GET',
+    '/internal/delegate/:id',
+    guarded((c) => {
+      const s = lead(c);
+      if (!s) return c.send(404, { error: 'no such session' });
+      const ids = (c.query.get('ids') || '').split(',').filter(Boolean);
+      const list = runner.delegations(s, ids);
+      if (!list.length) return c.send(200, { done: true, text: 'No delegated tasks to report on.' });
+      const running = ({ d, child }) => child?.turns.find((t) => t.id === d.turnId)?.status === 'running';
+      c.send(200, { done: !list.some(running), text: list.map(({ d, child }) => delegationReport(d, child, adapters)).join('\n\n---\n\n') });
+    }),
+    opts,
+  );
+}

package/server/routes/machines.js

@@ -0,0 +1,43 @@
+// /api/machines: add, connect, and browse folders on other computers.
+
+import { sshHosts, discoverHosts } from '../machines.js';
+
+export function register(r, app) {
+  const { store, machines } = app;
+  const one = (mid) => machines.view().find((x) => x.id === mid);
+  // A machine route: 404s for an unknown id before doing anything.
+  const known = (fn) => (c) => (machines.get(c.params.id), fn(c, c.params.id));
+
+  r.route('GET', '/machines', (c) => c.send(200, machines.view()));
+  r.route('POST', '/machines', async (c) => {
+    const body = await c.body();
+    const x = machines.add(body);
+    if (body.connect !== false) await machines.connect(x.id);
+    c.send(201, one(x.id));
+  });
+  r.route('GET', '/machines/ssh-hosts', (c) => c.send(200, sshHosts()));
+  r.route('GET', '/machines/discover', async (c) => c.send(200, await discoverHosts()));
+  r.route('PATCH', '/machines/:id', known(async (c, id) => c.send(200, (await machines.update(id, await c.body()), one(id)))));
+  r.route(
+    'DELETE',
+    '/machines/:id',
+    known((c, id) => {
+      machines.remove(id);
+      app.broadcast('config', {});
+      c.send(200, { ok: true });
+    }),
+  );
+  r.route('POST', '/machines/:id/connect', known(async (c, id) => c.send(200, await machines.connect(id))));
+  r.route('POST', '/machines/:id/disconnect', known((c, id) => c.send(200, (machines.disconnect(id), one(id)))));
+  // Stop wisp over there (its agents too); restart starts this version in its place.
+  r.route('POST', '/machines/:id/stop', known(async (c, id) => c.send(200, (await machines.stopRemote(id, { restart: !!(await c.body()).restart }), one(id)))));
+  r.route('GET', '/machines/:id/fs', known(async (c, id) => c.send(200, await machines.json(id, 'GET', `/fs?q=${encodeURIComponent(c.query.get('q') || '')}`))));
+  r.route(
+    'GET',
+    '/machines/:id/discover',
+    known(async (c, id) => {
+      const have = new Set(store.config.projects.filter((p) => p.machine === id).map((p) => p.path));
+      c.send(200, (await machines.json(id, 'GET', '/projects/discover')).filter((f) => !have.has(f.path)));
+    }),
+  );
+}

package/server/routes/meta.js

@@ -0,0 +1,76 @@
+// The server itself: live events, health, self-update, the API description, installed
+// harnesses, folder suggestions, usage and feedback.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { openapi } from '../openapi.js';
+import { usage } from '../usage.js';
+import { expandHome, VERSION } from '../util.js';
+
+export const API_VERSION = 1;
+
+export function register(r, app) {
+  const { store, runner, updater, telemetry, machines, port } = app;
+
+  r.route('GET', '/events', (c) => app.events.attach(c.req, c.res));
+
+  r.route('GET', '/health', (c) => c.send(200, { ok: true, name: 'wisp', version: VERSION, apiVersion: API_VERSION, pid: process.pid, url: `http://127.0.0.1:${port}` }));
+
+  // New wisp-agents on npm? POST installs it and relaunches; running agents are stopped, so the
+  // client must pass force once it has confirmed that with the user.
+  r.route('GET', '/update', async (c) => {
+    if (c.query.has('check')) return c.send(200, await updater.check());
+    updater.maybeCheck(); // the UI asks on focus and reconnect: a day-old check gets refreshed
+    c.send(200, updater.view());
+  });
+  r.route('POST', '/update', async (c) => {
+    const body = await c.body();
+    if (runner.live.size && !body.force) return c.send(409, { error: 'agents are running', running: runner.live.size });
+    await updater.install();
+    c.send(202, updater.view());
+    telemetry.track('update', { from: updater.state.current, to: updater.state.latest, method: updater.method });
+    setTimeout(() => (app.shutdown(), process.exit(0)), 300);
+  });
+
+  r.route('GET', '/openapi.json', (c) => c.send(200, openapi({ version: VERSION, port })), { doc: false });
+
+  r.route('GET', '/agents', async (c) => c.send(200, await app.auto.detect({ fresh: c.query.has('fresh') })));
+  // Re-check: detect harnesses and models again, here and on every online machine.
+  r.route('POST', '/agents/recheck', async (c) => {
+    const [agents] = await Promise.all([app.auto.detect({ fresh: true }), machines.recheckAgents()]);
+    c.send(200, agents);
+  });
+  // No harness yet: install one (opencode) without leaving wisp. Answers once it's ready.
+  r.route('POST', '/agents/install', async (c) => {
+    const { id } = await c.body();
+    c.send(200, await app.installer.run(String(id || '')));
+  });
+
+  // Directory suggestions for the launcher's project picker.
+  r.route(
+    'GET',
+    '/fs',
+    (c) => {
+      const raw = expandHome(c.query.get('q') || '');
+      const trailing = /[\\/]$/.test(raw); // a trailing backslash counts too (Windows)
+      const dir = trailing ? raw : path.dirname(raw);
+      const prefix = trailing ? '' : path.basename(raw).toLowerCase();
+      let entries = [];
+      try {
+        entries = fs
+          .readdirSync(dir, { withFileTypes: true })
+          .filter((e) => e.isDirectory() && !e.name.startsWith('.') && e.name.toLowerCase().startsWith(prefix))
+          .slice(0, 12)
+          .map((e) => path.join(dir, e.name));
+      } catch {}
+      c.send(200, entries);
+    },
+    { doc: false },
+  );
+
+  // Spend and outcomes. ?days=7|30|90
+  r.route('GET', '/usage', (c) => c.send(200, usage(store.all(), { days: Number(c.query.get('days')) || 30, project: (s) => store.projectFor(s.cwd) })));
+
+  // Feedback for the wisp team: thumbs on a turn and/or a note. { rating?, text?, sessionId?, turnId? }
+  r.route('POST', '/feedback', async (c) => c.send(200, await app.sendFeedback(await c.body())));
+}

package/server/routes/proxy.js

@@ -0,0 +1,47 @@
+// /api/sessions/<id>@<machine>/…: passed through to that machine's wisp, ids rewritten.
+// Registered before the session routes, so a qualified id never reaches them.
+
+import os from 'node:os';
+import { pipeFrom } from '../http/respond.js';
+import { splitId, qualify } from '../machines.js';
+import { openInTerminal, shq } from '../terminal.js';
+import { MAX_WAIT_S } from './sessions.js';
+
+const METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
+
+export function register(r, app) {
+  const { store, machines, telemetry } = app;
+  const remote = { when: (p) => !!splitId(p.id), doc: false };
+
+  async function proxy(c) {
+    const at = splitId(c.params.id);
+    const { action } = c.params;
+    const m = c.req.method;
+    const mid = at.machine;
+    const sub = `/sessions/${at.id}${action ? `/${action}` : ''}${c.url.search}`;
+    if ((action === 'file' && m === 'GET') || (action === 'presentation' && c.query.get('format') === 'markdown')) return pipeFrom(c.res, await machines.stream(mid, 'GET', sub));
+    // Take over: a terminal here, signed in over there, resuming the agent in its folder.
+    if (action === 'takeover') {
+      const { command } = await machines.json(mid, 'GET', `/sessions/${at.id}/takeover`);
+      const argv = machines.terminalArgv(mid, command);
+      if (m === 'POST') {
+        const s = await machines.json(mid, 'GET', `/sessions/${at.id}`);
+        if (s.state === 'running' || s.state === 'waiting') await machines.json(mid, 'POST', `/sessions/${at.id}/stop`, {});
+        const d = store.config.defaults;
+        openInTerminal({ cwd: os.homedir(), argv, terminal: d.terminal || 'auto', custom: d.terminalCommand });
+        telemetry.track('takeover', { agent: s.agent, terminal: d.terminal || 'auto', machine: true });
+      }
+      return c.send(200, { command: argv.map(shq).join(' ') });
+    }
+    const body = m === 'GET' ? undefined : await c.body();
+    if (action === 'reply' && body?.attachments?.length) body.attachments = await app.launcher.pushUploads(mid, body.attachments);
+    const out = await machines.json(mid, m, sub, body, action === 'wait' ? { timeout: (MAX_WAIT_S + 30) * 1000 } : undefined);
+    if (!action && m === 'GET') return c.send(200, machines.session(mid, out));
+    if ((!action && m === 'PATCH') || action === 'wait') return c.send(200, machines.summary(mid, out));
+    if (out && typeof out === 'object' && out.sessionId) out.sessionId = qualify(out.sessionId, mid);
+    c.send(200, out);
+  }
+
+  r.route(METHODS, '/sessions/:id', proxy, remote);
+  r.route(METHODS, '/sessions/:id/:action', proxy, remote);
+}