wisp-agents 0.7.0 → 0.9.0

package/server/index.js

@@ -7,7 +7,7 @@ import os from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { randomBytes } from 'node:crypto';
 import { Store } from './store.js';
-import { Runner, summarize, newId } from './runner.js';
+import { Runner, summarize, newId, workdir } from './runner.js';
 import { adapters, listAgents } from './adapters/index.js';
 import { welcomeSession } from './welcome.js';
 import { openInTerminal, TERMINALS, shq } from './terminal.js';
@@ -16,6 +16,15 @@ import { blocksToMarkdown, sessionToMarkdown } from './render.js';
 import { openapi } from './openapi.js';
 import { Updater } from './update.js';
 import { Preferences, Retro, KINDS } from './preferences.js';
+import { cleanupCheckpoints, revertFileChange, rollbackToTurn, execCommand } from './checkpoint.js';
+import { clip } from './adapters/common.js';
+import { createWorktree, worktreeSource, ensureWorktree, removeWorktree, worktreeStatus, ship, merge, prView, repoRoot } from './git.js';
+import { normalizeRecipe, findRecipe, recipeView, fill, positional } from './recipes.js';
+import { Triggers, normalizeTrigger, triggerView } from './triggers.js';
+import { Remote } from './remote.js';
+import { Machines, splitId, qualify, sshHosts } from './machines.js';
+import { usage } from './usage.js';
+import { normalizeTeam, normalizePreset, delegationReport } from './subagents.js';
 
 const WEB = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'web');
 
@@ -44,6 +53,11 @@ export const API_VERSION = 1;
 // with follow-ups still queued is about to start the next one, so it doesn't count yet.
 const settled = (s) => s.state === 'waiting' || (s.state !== 'running' && !s.queue?.length);
 const IMAGE_EXT = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp', '.svg']);
+const PR_POLL_MS = 60_000;
+const MAX_COMPARE = 4;
+const MODES = new Set(['plan', 'edits', 'auto']);
+const bad = (msg, status = 400) => Object.assign(new Error(msg), { status });
+const expand = (p) => path.resolve(String(p).replace(/^~(?=$|[\\/])/, os.homedir()));
 
 export async function startServer({ port = 4477, host = '127.0.0.1', handleSignals = true } = {}) {
   const store = new Store();
@@ -73,6 +87,31 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
   runner.on('turn', (t) => broadcast('turn', t));
   runner.on('finished', (f) => broadcast('finished', f));
   runner.on('finished', ({ session }) => notifyWebhooks(store, session));
+  runner.on('finished', ({ session }) => remote.notify(store.get(session.id), session).catch((err) => console.warn(`wisp: phone: ${err.message}`)));
+
+  // Machines: other computers running their own wisp, reached over SSH. Their sessions show up
+  // here as <id>@<machine>; their events are relayed into this stream.
+  const machines = new Machines({
+    store,
+    version: VERSION,
+    apiVersion: API_VERSION,
+    onChange: () => broadcast('machines', machines.view()),
+    onEvent: (event, data) => {
+      broadcast(event, data);
+      if (event === 'finished' && remote.on) notifyFromMachine(data.session).catch((err) => console.warn(`wisp: phone: ${err.message}`));
+    },
+  });
+  async function notifyFromMachine(summary) {
+    const at = splitId(summary.id);
+    const s = machines.session(at.machine, await machines.json(at.machine, 'GET', `/sessions/${at.id}`));
+    await remote.notify(s, summary);
+  }
+  // Attachments are uploaded here; a machine gets its own copies before a launch or reply.
+  const pushUploads = async (mid, ids) => {
+    const out = [];
+    for (const u of resolveAttachments(ids)) out.push((await machines.upload(mid, u)).id);
+    return out;
+  };
   setInterval(() => broadcast('ping', {}), 25_000).unref();
 
   const telemetry = new Telemetry(store);
@@ -117,6 +156,188 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
   });
   if (!envDisabled()) process.on('uncaughtExceptionMonitor', (err) => telemetry.crashed(err));
 
+  // One way in for every launch: the launcher, the CLI, recipes, triggers and compare runs.
+  // body: { prompt, cwd, agent, mode, model, effort, attachments: [uploadId], worktree, compare,
+  //         subagents: [{ name, agent, model, effort, use }] | preset: teamId }
+  async function launch(body, origin = null) {
+    if (!String(body.prompt || '').trim()) throw bad('prompt required');
+    const cwd = expand(body.cwd || process.cwd());
+    if (!fs.existsSync(cwd) || !fs.statSync(cwd).isDirectory()) throw bad(`Not a directory: ${cwd}`);
+    const d = store.config.defaults;
+    // compare: more { agent, model, effort } to run the same task on, side by side.
+    const runners = [{ agent: body.agent, model: body.model, effort: body.effort }, ...(Array.isArray(body.compare) ? body.compare : [])].slice(0, MAX_COMPARE).map((r, i) => {
+      const agent = r.agent || (i ? d.agent : '') || 'claude';
+      if (!adapters[agent]) throw bad(`unknown agent: ${agent}`);
+      return { agent, model: r.model ?? (i ? d.models?.[agent] || '' : ''), effort: /^[\w-]{1,20}$/.test(r.effort || '') ? r.effort : '' };
+    });
+    const mode = MODES.has(body.mode) ? body.mode : 'edits';
+    // Worktrees are on by default in git repos (off in Plan mode: nothing gets written). Compare
+    // runs need one each, or the harnesses would edit the same files.
+    const comparing = runners.length > 1;
+    const wantTree = body.worktree ?? (comparing || (mode !== 'plan' && d.worktree !== 'off'));
+    // groupId: one launch sent to several machines (or here and there) shows as one task.
+    const groupId = /^[a-f0-9]{12}$/.test(body.groupId || '') ? body.groupId : comparing ? newId() : null;
+    const attachments = resolveAttachments(body.attachments);
+    const preset = body.preset && store.config.teams.find((t) => t.id === body.preset);
+    if (body.preset && !preset && !body.subagents) throw bad(`no such subagent preset: ${body.preset}`);
+    const subagents = normalizeTeam(body.subagents ?? preset?.members, adapters);
+    const ids = runners.map(() => newId());
+    let trees = ids.map(() => null);
+    if (wantTree) {
+      const must = body.worktree === true || (comparing && mode !== 'plan');
+      // One fetch for the whole launch, then the checkouts side by side: compare runs used to
+      // fetch and check out one after the other before anything showed up in the feed.
+      const results = await worktreeSource(cwd).then(
+        (source) => source && Promise.allSettled(ids.map((id) => createWorktree({ cwd, home: store.home, id, title: body.prompt, source }))),
+        (err) => [{ status: 'rejected', reason: err }],
+      );
+      const failed = results?.find((x) => x.status === 'rejected')?.reason;
+      trees = ids.map((_, i) => (results?.[i]?.status === 'fulfilled' ? results[i].value : null));
+      if (must && (failed || trees.some((t) => !t))) {
+        await Promise.all(trees.map((t) => t && removeWorktree(t, { force: true, branch: 'force' }).catch(() => {})));
+        if (failed) throw bad(`Could not create a worktree: ${failed.message}`);
+        throw bad(comparing ? 'Compare needs a git repo with at least one commit, so each harness gets its own worktree.' : 'Not a git repo with commits, so there is nothing to make a worktree from.');
+      }
+      if (failed) console.warn(`wisp: no worktree for ${cwd}: ${failed.message}`);
+    }
+    return runners.map((r, i) => runner.create({ id: ids[i], prompt: body.prompt, cwd, ...r, mode, attachments, worktree: trees[i], groupId, origin, subagents }));
+  }
+
+  // Where a launch runs: body.machine, else a project folder that only exists on a machine
+  // (recipes and schedules keep just the path). null = here.
+  function machineFor(body) {
+    if (body.machine) return machines.get(String(body.machine)).id;
+    const cwd = String(body.cwd || '');
+    if (!cwd || fs.existsSync(expand(cwd))) return null;
+    return store.config.projects.find((p) => p.machine && (cwd === p.path || cwd.startsWith(`${p.path}/`)))?.machine || null;
+  }
+
+  // launch(), here or on a machine. Resolves with summaries (a compare launch has several).
+  async function launchAny(body, origin = null) {
+    const mid = machineFor(body);
+    if (!mid) return (await launch(body, origin)).map((x) => summarize(x, store));
+    const out = await machines.launch(mid, { ...body, attachments: await pushUploads(mid, body.attachments), ...(origin && { origin }) });
+    const known = store.projectFor(out.cwd, mid);
+    (known || store.addProject(out.cwd, { machine: mid })).lastUsedAt = Date.now();
+    store.saveConfig();
+    if (!known) broadcast('config', {});
+    return (out.group || [out]).map((x) => machines.summary(mid, x));
+  }
+
+  // A follow-up from anywhere (UI, CLI, phone). An archived session may have lost its worktree.
+  async function replyTo(s, text, attachments = [], queue) {
+    await ensureWorktree(s.worktree);
+    return runner.reply(s, text, attachments, { queue: queue ?? store.config.defaults.followUp === 'queue' });
+  }
+
+  const markDone = (s) => {
+    if (s.state === 'running' || s.state === 'waiting') return false;
+    s.state = 'done';
+    s.unread = false;
+    retro.schedule(s, 0);
+    store.save(s);
+    broadcast('summary', summarize(s, store));
+    return true;
+  };
+
+  // Recipes and triggers.
+  const runRecipe = async (r, { params = {}, words, cwd, machine, agent, model, effort, mode } = {}) => {
+    const values = words ? { ...positional(r.prompt, words), ...params } : params;
+    const [s] = await launchAny({ prompt: fill(r.prompt, values), cwd: r.cwd || cwd, machine, agent: agent || r.agent || undefined, model: model ?? (r.model || undefined), effort: effort || r.effort || undefined, mode: mode || r.mode || undefined }, { kind: 'recipe', id: r.id, name: r.name });
+    r.runs = (r.runs || 0) + 1;
+    r.lastRunAt = Date.now();
+    store.saveConfig();
+    broadcast('config', {});
+    return s;
+  };
+  const triggers = new Triggers({ store, launch: async (body, origin) => (await launchAny(body, origin))[0], onChange: () => broadcast('config', {}) });
+
+  // Phone: answers and follow-ups coming back from ntfy / Telegram.
+  const remote = new Remote({
+    store,
+    onChange: () => broadcast('remote', {}),
+    act: async ({ sessionId, kind, ref, index, text }) => {
+      const ops = await sessionOps(sessionId).catch((err) => ({ error: err.message }));
+      if (ops?.error) return `Can’t reach it: ${ops.error}`;
+      if (!ops) return 'That session is gone.';
+      const { s } = ops;
+      if (kind === 'answer') {
+        if (!s.ask || s.ask.id !== ref) return 'That question was already answered.';
+        const answer = s.ask.options[index];
+        if (answer === undefined) return 'Unknown option.';
+        await ops.answer(answer);
+        return `✓ Answered: ${answer}`;
+      }
+      if (kind === 'reply') {
+        const turn = s.turns.at(-1);
+        if (!turn || turn.id !== ref || s.state === 'running') return 'That was already answered.';
+        const q = turn.presentation?.blocks?.findLast((b) => b?.type === 'question');
+        const o = q?.options?.[index];
+        const msg = typeof o === 'string' ? o : o?.reply || o?.label;
+        if (!msg) return 'Unknown option.';
+        await ops.reply(msg);
+        return `✓ Sent: ${typeof o === 'string' ? o : o.label || msg}`;
+      }
+      if (kind === 'done') {
+        if (s.turns.at(-1)?.id !== ref && ref) return 'There is newer work on that session; open wisp to review it.';
+        return (await ops.done()) ? '✓ Marked done' : 'It is still working.';
+      }
+      if (s.agent === 'wisp') return 'That is the tour; it can’t take follow-ups.';
+      const r = await ops.reply(String(text || '').trim());
+      return r.answered ? '✓ Answered' : r.interrupted ? '✓ Sent; the agent picked it up mid-run' : r.queued ? '✓ Queued for when it finishes' : '✓ Sent';
+    },
+  });
+
+  // What the phone can do to a session, here or on a machine: { s, answer, reply, done } or null.
+  async function sessionOps(sessionId) {
+    const at = splitId(sessionId);
+    if (!at) {
+      const s = store.get(sessionId);
+      return s && { s, answer: (a) => runner.answer(s, a), reply: (t) => replyTo(s, t), done: () => markDone(s) };
+    }
+    const call = (method, p, body) => machines.json(at.machine, method, `/sessions/${at.id}${p}`, body);
+    const s = await call('GET', '').catch((err) => {
+      if (err.status === 404) return null;
+      throw err;
+    });
+    const live = s && (s.state === 'running' || s.state === 'waiting');
+    return s && { s: machines.session(at.machine, s), answer: (a) => call('POST', '/answer', { text: a }), reply: (t) => call('POST', '/reply', { text: t }), done: async () => !live && !!(await call('PATCH', '', { state: 'done' })) };
+  }
+
+  // Ship it: follow open PRs (checks, reviews, merges) so their cards stay current.
+  const refreshPr = async (s) => {
+    if (!s.pr || !s.worktree) return s.pr;
+    const prev = s.pr;
+    const dir = fs.existsSync(s.worktree.path) ? s.worktree.path : s.worktree.root;
+    const pr = await prView(dir, prev.number);
+    const changed = (k) => JSON.stringify(k(pr)) !== JSON.stringify(k(prev));
+    s.pr = pr;
+    // Things worth coming back for: CI finished either way, a review landed, it merged or closed.
+    const settledChecks = (x) => (x.checks.pending ? 'pending' : x.checks.fail ? 'fail' : 'pass');
+    if (changed((x) => x.state) || changed((x) => x.review) || (changed(settledChecks) && settledChecks(pr) !== 'pending')) s.unread = true;
+    store.save(s);
+    broadcast('summary', summarize(s, store));
+    return pr;
+  };
+  const prTimer = setInterval(async () => {
+    for (const s of store.all()) if (s.pr?.state === 'OPEN') await refreshPr(s).catch(() => {});
+  }, PR_POLL_MS);
+  prTimer.unref();
+
+  // Default commit message and PR text, from the session's latest presentation.
+  const shipDraft = (s) => {
+    const turn = s.turns.findLast((t) => t.status === 'done') || s.turns.at(-1);
+    const blocks = turn?.presentation?.blocks || [];
+    const hero = blocks.find((b) => b?.type === 'hero');
+    const text = `${hero?.title || s.title}`.trim();
+    const conventional = /^[a-z]+(\([\w./-]+\))?!?: /.test(text);
+    const type = /\b(fix|bug|broken|crash|flaky|regression)/i.test(`${text} ${s.turns[0]?.prompt || ''}`) ? 'fix' : /\b(docs?|readme|changelog)\b/i.test(text) ? 'docs' : /\b(refactor|clean ?up|simplif)/i.test(text) ? 'refactor' : /\btests?\b/i.test(text) ? 'test' : 'feat';
+    const title = conventional ? text : `${type}: ${text.charAt(0).toLowerCase()}${text.slice(1)}`;
+    const keep = blocks.filter((b) => !['hero', 'next', 'question', 'diff', 'code', 'image', 'terminal'].includes(b?.type));
+    const body = [hero?.summary, blocksToMarkdown(keep, turn)].filter(Boolean).join('\n\n').trim();
+    return { title: title.slice(0, 100), body: `${body}\n\n_Shipped from [wisp](https://github.com/M0xoo/wisp)._`.trim() };
+  };
+
   const allowedHosts = new Set([`127.0.0.1:${port}`, `localhost:${port}`, `[::1]:${port}`]);
 
   const server = http.createServer(async (req, res) => {
@@ -188,6 +409,24 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
         return send(res, 200, { id: runner.ask(s, body) });
       }
       if (id === 'ask' && action && m === 'GET') return send(res, 200, runner.pollAnswer(action));
+      // delegate: POST starts tasks on the lead's subagents; GET reports on them (done once all finished).
+      if (id === 'delegate' && action) {
+        const lead = store.get(action);
+        if (!lead) return send(res, 404, { error: 'no such session' });
+        if (m === 'POST') {
+          const body = await readJson(req);
+          const delegations = runner.delegate(lead, body.tasks);
+          telemetry.track('delegate', { agent: lead.agent, tasks: delegations.length, harnesses: [...new Set(delegations.filter((d) => d.agent).map((d) => d.agent))] });
+          return send(res, 200, { delegations });
+        }
+        if (m === 'GET') {
+          const ids = (url.searchParams.get('ids') || '').split(',').filter(Boolean);
+          const list = runner.delegations(lead, ids);
+          if (!list.length) return send(res, 200, { done: true, text: 'No delegated tasks to report on.' });
+          const running = ({ d, child }) => child?.turns.find((t) => t.id === d.turnId)?.status === 'running';
+          return send(res, 200, { done: !list.some(running), text: list.map(({ d, child }) => delegationReport(d, child, adapters)).join('\n\n---\n\n') });
+        }
+      }
     }
 
     // Attachments: raw body streamed to disk, referenced by id from launches and replies.
@@ -217,6 +456,10 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
         fs.writeFileSync(path.join(uploadsDir, `${uid}.json`), JSON.stringify(meta));
         return send(res, 201, meta);
       }
+      if (id && m === 'GET' && splitId(id)) {
+        const at = splitId(id);
+        return pipeFrom(res, await machines.stream(at.machine, 'GET', `/uploads/${at.id}`));
+      }
       if (id && m === 'GET') {
         const u = uploads.get(id);
         if (!u || !fs.existsSync(u.path)) return send(res, 404, { error: 'not found' });
@@ -226,7 +469,7 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
     }
 
     if (root === 'config') {
-      if (m === 'GET') return send(res, 200, { ...store.config, home: os.homedir(), cwd: process.cwd(), terminals: TERMINALS, telemetry: { available: !envDisabled(), enabled: telemetry.enabled } });
+      if (m === 'GET') return send(res, 200, { ...store.config, remote: undefined, home: os.homedir(), cwd: process.cwd(), terminals: TERMINALS, telemetry: { available: !envDisabled(), enabled: telemetry.enabled } });
       if (m === 'PATCH') {
         const body = await readJson(req);
         if (body.defaults) Object.assign(store.config.defaults, body.defaults);
@@ -238,7 +481,7 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
         }
         store.saveConfig();
         broadcast('config', {});
-        return send(res, 200, store.config);
+        return send(res, 200, { ...store.config, remote: undefined });
       }
     }
 
@@ -264,10 +507,117 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
       }
     }
 
+    // Subagent presets: a saved team (members with harness, model, thinking and "use it for").
+    if (root === 'teams') {
+      const list = store.config.teams;
+      const saved = (status, body) => (store.saveConfig(), broadcast('config', {}), send(res, status, body));
+      if (!id && m === 'GET') return send(res, 200, list);
+      if (!id && m === 'POST') {
+        const t = normalizePreset(await readJson(req), adapters);
+        list.push(t);
+        return saved(201, t);
+      }
+      const t = list.find((x) => x.id === id);
+      if (!t) return send(res, 404, { error: 'no such preset' });
+      if (!action && m === 'GET') return send(res, 200, t);
+      if (!action && m === 'PATCH') return saved(200, Object.assign(t, normalizePreset(await readJson(req), adapters, t)));
+      if (!action && m === 'DELETE') {
+        store.config.teams = list.filter((x) => x !== t);
+        return saved(200, { ok: true });
+      }
+    }
+
+    // Recipes: saved prompts with {params}. POST /recipes/:id/run { params | words, cwd, … }.
+    if (root === 'recipes') {
+      const list = store.config.recipes;
+      if (!id && m === 'GET') return send(res, 200, list.map(recipeView));
+      if (!id && m === 'POST') {
+        const r = normalizeRecipe(await readJson(req));
+        list.push(r);
+        store.saveConfig();
+        broadcast('config', {});
+        return send(res, 201, recipeView(r));
+      }
+      const r = findRecipe(list, decodeURIComponent(id || ''));
+      if (!r) return send(res, 404, { error: 'no such recipe' });
+      if (!action && m === 'GET') return send(res, 200, recipeView(r));
+      if (!action && m === 'PATCH') {
+        Object.assign(r, normalizeRecipe(await readJson(req), r));
+        store.saveConfig();
+        broadcast('config', {});
+        return send(res, 200, recipeView(r));
+      }
+      if (!action && m === 'DELETE') {
+        store.config.recipes = list.filter((x) => x !== r);
+        store.saveConfig();
+        broadcast('config', {});
+        return send(res, 200, { ok: true });
+      }
+      if (action === 'run' && m === 'POST') {
+        const body = await readJson(req);
+        // machine: run it in a project there (r.cwd empty, or a path on that machine).
+        const s = await runRecipe(r, { params: body.params || {}, words: Array.isArray(body.words) ? body.words.map(String) : undefined, cwd: body.cwd, machine: body.machine || undefined, agent: body.agent, model: body.model, effort: body.effort, mode: body.mode });
+        return send(res, 201, s);
+      }
+    }
+
+    // Triggers: schedules and GitHub watchers that launch sessions on their own.
+    if (root === 'triggers') {
+      const list = store.config.triggers;
+      if (!id && m === 'GET') return send(res, 200, list.map(triggerView));
+      if (!id && m === 'POST') {
+        const t = normalizeTrigger(await readJson(req), null, { recipes: store.config.recipes });
+        list.push(t);
+        store.saveConfig();
+        broadcast('config', {});
+        return send(res, 201, triggerView(t));
+      }
+      const t = list.find((x) => x.id === id);
+      if (!t) return send(res, 404, { error: 'no such trigger' });
+      if (!action && m === 'PATCH') {
+        Object.assign(t, normalizeTrigger(await readJson(req), t, { recipes: store.config.recipes }));
+        store.saveConfig();
+        broadcast('config', {});
+        return send(res, 200, triggerView(t));
+      }
+      if (!action && m === 'DELETE') {
+        store.config.triggers = list.filter((x) => x !== t);
+        store.saveConfig();
+        broadcast('config', {});
+        return send(res, 200, { ok: true });
+      }
+      if (action === 'run' && m === 'POST') {
+        const r = await triggers.runNow(t);
+        const started = Array.isArray(r) ? r : r ? [r] : [];
+        return send(res, 200, { started, trigger: triggerView(t) });
+      }
+    }
+
+    // Phone: ntfy / Telegram settings (secrets masked), and a test message.
+    if (root === 'remote') {
+      if (!id && m === 'GET') return send(res, 200, remote.view());
+      if (!id && m === 'PUT') return send(res, 200, remote.update(await readJson(req)));
+      if (id === 'test' && m === 'POST') {
+        const sent = await remote.send({ title: '✨ wisp', text: 'Test from wisp: questions and finished tasks will show up like this.', actions: [] });
+        if (!sent) return send(res, 400, { error: 'Turn on ntfy or link Telegram first.' });
+        return send(res, 200, remote.view());
+      }
+    }
+
+    // Spend and outcomes. ?days=7|30|90
+    if (root === 'usage' && m === 'GET') {
+      return send(res, 200, usage(store.all(), { days: Number(url.searchParams.get('days')) || 30, project: (s) => store.projectFor(s.cwd) }));
+    }
+
     if (root === 'projects') {
       if (!id && m === 'GET') return send(res, 200, store.config.projects);
       if (!id && m === 'POST') {
         const body = await readJson(req);
+        if (body.machine) {
+          const p = await machines.addProject(String(body.machine), String(body.path || '').trim(), body.name);
+          broadcast('config', {});
+          return send(res, 201, p);
+        }
         const dir = path.resolve(String(body.path || '').replace(/^~(?=$|[\\/])/, os.homedir()));
         if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory()) return send(res, 400, { error: `Not a folder: ${dir}` });
         const p = store.addProject(dir, { name: body.name });
@@ -332,12 +682,18 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
       return send(res, 200, entries);
     }
 
+    if (root === 'machines') return machinesApi(req, res, url, id, action);
+
     if (root === 'sessions') {
+      if (id && splitId(id)) return machineSessionApi(req, res, url, splitId(id), action);
       if (!id) {
         if (m === 'GET') {
           const q = Object.fromEntries(url.searchParams);
           const cwd = q.cwd && path.resolve(q.cwd.replace(/^~(?=$|[\\/])/, os.homedir()));
-          let list = store.all().map((x) => summarize(x, store)).sort((a, b) => b.updatedAt - a.updatedAt);
+          // Subagent sessions belong to their lead; ?children=1 lists them too.
+          // Sessions on machines too (the last ones seen, for a machine that's offline).
+          const here = store.all().filter((x) => !x.parentId || q.children).map((x) => summarize(x, store));
+          let list = [...here, ...(await machines.sessions(q))].sort((a, b) => b.updatedAt - a.updatedAt);
           if (q.state) list = list.filter((x) => q.state.split(',').includes(x.state));
           if (q.agent) list = list.filter((x) => x.agent === q.agent);
           if (q.project) list = list.filter((x) => x.projectId === q.project || x.project === q.project);
@@ -348,12 +704,11 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
         }
         if (m === 'POST') {
           const body = await readJson(req);
-          if (!body.prompt?.trim()) return send(res, 400, { error: 'prompt required' });
-          const cwd = path.resolve((body.cwd || process.cwd()).replace(/^~(?=$|[\\/])/, os.homedir()));
-          if (!fs.existsSync(cwd) || !fs.statSync(cwd).isDirectory()) return send(res, 400, { error: `Not a directory: ${cwd}` });
-          if (!adapters[body.agent || 'claude']) return send(res, 400, { error: 'unknown agent' });
-          const s = runner.create({ prompt: body.prompt, cwd, agent: body.agent, mode: body.mode, model: body.model, effort: /^[\w-]{1,20}$/.test(body.effort || '') ? body.effort : '', attachments: resolveAttachments(body.attachments) });
-          return send(res, 201, summarize(s, store));
+          // A machine's wisp hands on where a recipe or trigger launch came from.
+          const o = body.origin;
+          const origin = o && (o.kind === 'recipe' || o.kind === 'trigger') ? { kind: o.kind, id: String(o.id || ''), name: String(o.name || '') } : null;
+          const out = await launchAny(body, origin);
+          return send(res, 201, out.length > 1 ? { ...out[0], group: out } : out[0]);
         }
       }
 
@@ -361,22 +716,39 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
       if (!s) return send(res, 404, { error: 'no such session' });
 
       if (!action) {
-        if (m === 'GET') return send(res, 200, s);
+        // A lead comes with its subagents' sessions, so its cards can show their reports and diffs.
+        if (m === 'GET') return send(res, 200, s.children ? { ...s, childSessions: Object.fromEntries(Object.values(s.children).map((cid) => [cid, store.get(cid)]).filter(([, c]) => c)) } : s);
         if (m === 'PATCH') {
           const body = await readJson(req);
           if (typeof body.title === 'string' && body.title.trim()) Object.assign(s, { title: body.title.trim(), titleAuto: false });
           if (body.state === 'done' && s.state !== 'running') s.state = 'done';
           if (body.state === 'review' && s.state === 'done') s.state = 'review';
           if (typeof body.unread === 'boolean') s.unread = body.unread;
+          // The team can change between turns; the next turn's lead sees the new roster.
+          if (body.subagents !== undefined && !s.parentId) {
+            s.subagents = normalizeTeam(body.subagents, adapters);
+            s.children ||= {};
+          }
           if (body.archived === true && s.state !== 'running' && s.state !== 'waiting') Object.assign(s, { archived: true, unread: false });
           if (body.archived === false) delete s.archived;
           if (s.state === 'done' || s.archived) retro.schedule(s, 0); // finished with it: learn now
+          // Archived: a clean worktree goes (its branch stays, a follow-up brings it back).
+          // discardWorktree: a compare run you didn't keep; its changes go too.
+          if (s.worktree && !runner.live.has(s.id) && (s.archived || body.discardWorktree)) await removeWorktree(s.worktree, { force: !!body.discardWorktree, branch: !!body.discardWorktree && !s.pr && 'force' });
           store.save(s);
           broadcast('summary', summarize(s, store));
           return send(res, 200, summarize(s, store));
         }
         if (m === 'DELETE') {
           runner.stop(s);
+          await runner.live.get(s.id)?.done;
+          cleanupCheckpoints(workdir(s), s.id);
+          for (const cid of Object.values(s.children || {})) {
+            await runner.live.get(cid)?.done;
+            if (store.get(cid)) (store.delete(cid), broadcast('removed', { id: cid }));
+          }
+          // Its worktree goes with it; the branch only if it holds nothing beyond its base.
+          if (s.worktree) await removeWorktree(s.worktree, { force: true, branch: true }).catch(() => {});
           store.delete(id);
           broadcast('removed', { id });
           return send(res, 200, { ok: true });
@@ -415,7 +787,9 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
           blocks: turn.presentation?.blocks || [],
           notes: turn.presentation?.notes,
           fallback: !!turn.presentation?.fallback,
-          changes: turn.changes.map((c) => ({ file: c.file, op: c.op, edits: c.edits.length })),
+          checkpoint: turn.checkpoint ? { commit: turn.checkpoint.commit, head: turn.checkpoint.head, branch: turn.checkpoint.branch, dirty: turn.checkpoint.dirty, at: turn.checkpoint.at } : null,
+          rolledBackAt: turn.rolledBackAt || null,
+          changes: turn.changes.map((c) => ({ file: c.file, op: c.op, edits: c.edits.length, reverted: !!c.reverted })),
           stats: turn.stats,
           ask: latest ? s.ask || null : null,
           markdown,
@@ -426,7 +800,7 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
         const { text, attachments, queue } = await readJson(req);
         if (!text?.trim()) return send(res, 400, { error: 'text required' });
         if (s.agent === 'wisp') return send(res, 400, { error: 'This is the tour — launch a real wisp to follow up.' });
-        return send(res, 200, runner.reply(s, text.trim(), resolveAttachments(attachments), { queue: queue ?? store.config.defaults.followUp === 'queue' }));
+        return send(res, 200, await replyTo(s, text.trim(), resolveAttachments(attachments), queue));
       }
 
       if (action === 'queue' && m === 'DELETE') {
@@ -440,19 +814,78 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
         return send(res, 200, { ok: runner.answer(s, text.trim()) });
       }
 
+      // Revert (or re-apply) a single file's edits from a turn.
+      if (action === 'revert' && m === 'POST') {
+        if (s.agent === 'wisp') return send(res, 400, { error: 'This is the tour — launch a real wisp to revert files.' });
+        if (runner.live.has(s.id)) return send(res, 409, { error: 'Stop the running turn before reverting files.' });
+        const { turnId, file, restore } = await readJson(req);
+        const turn = turnId ? s.turns.find((t) => t.id === turnId) : s.turns.at(-1);
+        if (!turn) return send(res, 404, { error: 'no such turn' });
+        await ensureWorktree(s.worktree);
+        const result = revertFileChange(s, turn, file, { restore: !!restore });
+        turn.activity.push({ t: Date.now(), kind: 'edit', label: `${result.reverted ? 'Reverted' : 'Re-applied'} ${result.file}`, file: result.file });
+        s.updatedAt = Date.now();
+        store.save(s);
+        broadcast('summary', summarize(s, store));
+        broadcast('turn', { sessionId: s.id, turnId: turn.id });
+        telemetry.track('revert_file', { agent: s.agent, restore: !!restore });
+        return send(res, 200, { ok: true, turnId: turn.id, ...result });
+      }
+
+      // Roll back (or re-apply) the project working tree to the checkpoint before a turn.
+      if (action === 'rollback' && m === 'POST') {
+        if (s.agent === 'wisp') return send(res, 400, { error: 'This is the tour — launch a real wisp to roll back turns.' });
+        if (runner.live.has(s.id)) return send(res, 409, { error: 'Stop the running turn before rolling back.' });
+        const { turnId, restore } = await readJson(req);
+        const turn = turnId ? s.turns.find((t) => t.id === turnId) : s.turns.at(-1);
+        if (!turn) return send(res, 404, { error: 'no such turn' });
+        await ensureWorktree(s.worktree);
+        const result = rollbackToTurn(s, turn, { restore: !!restore });
+        turn.activity.push({ t: Date.now(), kind: 'edit', label: result.rolledBack ? 'Restored checkpoint before this turn' : 'Re-applied turn changes' });
+        s.updatedAt = Date.now();
+        store.save(s);
+        broadcast('summary', summarize(s, store));
+        broadcast('turn', { sessionId: s.id, turnId: turn.id });
+        telemetry.track('rollback_turn', { agent: s.agent, restore: !!restore });
+        return send(res, 200, { ok: true, turnId: turn.id, ...result });
+      }
+
+      // Run a command from an actionable presentation block (actions, tests, terminal).
+      if (action === 'exec' && m === 'POST') {
+        const { command, turnId, key } = await readJson(req);
+        const cmd = String(command || '').trim();
+        if (!cmd) return send(res, 400, { error: 'command required' });
+        const turn = (turnId && s.turns.find((t) => t.id === turnId)) || s.turns.at(-1);
+        if (s.agent === 'wisp') {
+          return send(res, 200, { command: cmd, output: '✓ Tour preview — in a real project, wisp runs this command in your repo folder and streams the exit code and output here.', exitCode: 0, durationMs: 18 });
+        }
+        await ensureWorktree(s.worktree);
+        const resExec = await execCommand(workdir(s), cmd);
+        if (turn) {
+          turn.actionRuns ||= {};
+          turn.actionRuns[key || cmd] = { ...resExec, ranAt: Date.now() };
+          turn.activity.push({ t: Date.now(), kind: 'run', label: `Ran ${clip(cmd, 60)}`, detail: cmd });
+          store.save(s);
+          broadcast('turn', { sessionId: s.id, turnId: turn.id });
+        }
+        telemetry.track('exec_action', { agent: s.agent, exitCode: resExec.exitCode });
+        return send(res, 200, resExec);
+      }
+
       // Take over: continue this exact agent session interactively in a terminal.
       if (action === 'takeover') {
         const adapter = adapters[s.agent];
         if (!adapter?.resumeCommand || !s.agentSessionId) return send(res, 400, { error: 'This session cannot be resumed in a terminal.' });
         const argv = adapter.resumeCommand({ resumeId: s.agentSessionId, model: s.model, effort: s.effort });
-        const command = `cd ${shq(s.cwd)} && ${argv.map(shq).join(' ')}`;
+        await ensureWorktree(s.worktree);
+        const command = `cd ${shq(workdir(s))} && ${argv.map(shq).join(' ')}`;
         if (m === 'GET') return send(res, 200, { command });
         if (m === 'POST') {
           if (runner.live.has(s.id)) {
             runner.stop(s);
             await runner.live.get(s.id)?.done;
           }
-          openInTerminal({ cwd: s.cwd, argv, terminal: store.config.defaults.terminal || 'auto', custom: store.config.defaults.terminalCommand });
+          openInTerminal({ cwd: workdir(s), argv, terminal: store.config.defaults.terminal || 'auto', custom: store.config.defaults.terminalCommand });
           s.takenOverAt = Date.now();
           telemetry.track('takeover', { agent: s.agent, terminal: store.config.defaults.terminal || 'auto' });
           store.save(s);
@@ -465,18 +898,51 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
         return send(res, 200, { ok: true });
       }
 
+      // Ship it. GET: what would ship (branch, changes, draft message). POST { title, body, draft }:
+      // commit, push, open or update the PR.
+      if (action === 'ship') {
+        if (!s.worktree) return send(res, 400, { error: 'Ship it works on worktree sessions: launch with a worktree to get one.' });
+        if (m === 'GET') return send(res, 200, { branch: s.worktree.branch, base: s.worktree.base, remote: s.worktree.remote, ...(await worktreeStatus(s.worktree)), pr: s.pr || null, ...shipDraft(s) });
+        if (m === 'POST') {
+          if (runner.live.has(s.id)) return send(res, 409, { error: 'Still working: wait for it to finish, or stop it.' });
+          const body = await readJson(req);
+          const draft = shipDraft(s);
+          s.pr = await ship(s.worktree, { title: body.title ?? draft.title, body: body.body ?? draft.body, draft: !!body.draft, pr: s.pr });
+          telemetry.track('ship', { agent: s.agent, draft: !!body.draft });
+          store.save(s, { now: true });
+          broadcast('summary', summarize(s, store));
+          return send(res, 200, s.pr);
+        }
+      }
+      if (action === 'pr' && m === 'POST') {
+        if (!s.pr) return send(res, 404, { error: 'No pull request yet.' });
+        return send(res, 200, await refreshPr(s));
+      }
+      // Squash-merge the reviewed head, sync the user's base branch, clean up the worktree.
+      if (action === 'merge' && m === 'POST') {
+        if (!s.pr || !s.worktree) return send(res, 400, { error: 'No pull request to merge.' });
+        const { pr, sync } = await merge(s.worktree, s.pr.number);
+        s.pr = pr;
+        markDone(s);
+        telemetry.track('merge', { agent: s.agent });
+        store.save(s, { now: true });
+        broadcast('summary', summarize(s, store));
+        return send(res, 200, { pr, sync });
+      }
+
       // Images the agent pointed at (screenshots etc.). Served if inside the session's project,
       // or if the agent named that exact path in an image block (screenshots often land in /tmp).
       if (action === 'file' && m === 'GET') {
-        let p = path.resolve(s.cwd, url.searchParams.get('path') || '');
+        const dir = workdir(s);
+        let p = path.resolve(dir, url.searchParams.get('path') || '');
         const ext = path.extname(p).toLowerCase();
         const images = s.turns.flatMap((t) => (t.presentation?.blocks || []).filter((b) => b?.type === 'image'));
-        const at = (v) => typeof v === 'string' && path.resolve(s.cwd, v) === p;
+        const at = (v) => typeof v === 'string' && path.resolve(dir, v) === p;
         const named = images.find((b) => at(b.path || b.src));
         // A page rendered before keepImages() rewrote the block still asks for the original path.
         const kept = !named && images.find((b) => at(b.source) && typeof b.path === 'string');
-        if (kept) p = path.resolve(s.cwd, kept.path);
-        if (!(p.startsWith(s.cwd + path.sep) || named || kept) || !IMAGE_EXT.has(ext) || !fs.existsSync(p)) return send(res, 404, { error: 'not found' });
+        if (kept) p = path.resolve(dir, kept.path);
+        if (!(p.startsWith(dir + path.sep) || named || kept) || !IMAGE_EXT.has(ext) || !fs.existsSync(p)) return send(res, 404, { error: 'not found' });
         res.writeHead(200, { 'content-type': MIME[ext] });
         return fs.createReadStream(p).pipe(res);
       }
@@ -485,6 +951,64 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
     send(res, 404, { error: 'not found' });
   }
 
+  // /api/machines: add, connect, and browse folders on other computers.
+  async function machinesApi(req, res, url, id, action) {
+    const m = req.method;
+    const one = (mid) => machines.view().find((x) => x.id === mid);
+    if (!id && m === 'GET') return send(res, 200, machines.view());
+    if (!id && m === 'POST') {
+      const body = await readJson(req);
+      const x = machines.add(body);
+      if (body.connect !== false) await machines.connect(x.id);
+      return send(res, 201, one(x.id));
+    }
+    if (id === 'ssh-hosts' && m === 'GET') return send(res, 200, sshHosts());
+    machines.get(id); // 404s
+    if (!action && m === 'PATCH') return send(res, 200, (await machines.update(id, await readJson(req)), one(id)));
+    if (!action && m === 'DELETE') {
+      machines.remove(id);
+      broadcast('config', {});
+      return send(res, 200, { ok: true });
+    }
+    if (action === 'connect' && m === 'POST') return send(res, 200, await machines.connect(id));
+    if (action === 'disconnect' && m === 'POST') return send(res, 200, (machines.disconnect(id), one(id)));
+    // Stop wisp over there (its agents too); restart starts this version in its place.
+    if (action === 'stop' && m === 'POST') return send(res, 200, (await machines.stopRemote(id, { restart: !!(await readJson(req)).restart }), one(id)));
+    if (action === 'fs' && m === 'GET') return send(res, 200, await machines.json(id, 'GET', `/fs?q=${encodeURIComponent(url.searchParams.get('q') || '')}`));
+    if (action === 'discover' && m === 'GET') {
+      const known = new Set(store.config.projects.filter((p) => p.machine === id).map((p) => p.path));
+      return send(res, 200, (await machines.json(id, 'GET', '/projects/discover')).filter((f) => !known.has(f.path)));
+    }
+    send(res, 404, { error: 'not found' });
+  }
+
+  // /api/sessions/<id>@<machine>/…: passed through to that machine's wisp, ids rewritten.
+  async function machineSessionApi(req, res, url, at, action) {
+    const m = req.method;
+    const mid = at.machine;
+    const sub = `/sessions/${at.id}${action ? `/${action}` : ''}${url.search}`;
+    if ((action === 'file' && m === 'GET') || (action === 'presentation' && url.searchParams.get('format') === 'markdown')) return pipeFrom(res, await machines.stream(mid, 'GET', sub));
+    // Take over: a terminal here, signed in over there, resuming the agent in its folder.
+    if (action === 'takeover') {
+      const { command } = await machines.json(mid, 'GET', `/sessions/${at.id}/takeover`);
+      const argv = machines.terminalArgv(mid, command);
+      if (m === 'POST') {
+        const s = await machines.json(mid, 'GET', `/sessions/${at.id}`);
+        if (s.state === 'running' || s.state === 'waiting') await machines.json(mid, 'POST', `/sessions/${at.id}/stop`, {});
+        openInTerminal({ cwd: os.homedir(), argv, terminal: store.config.defaults.terminal || 'auto', custom: store.config.defaults.terminalCommand });
+        telemetry.track('takeover', { agent: s.agent, terminal: store.config.defaults.terminal || 'auto', machine: true });
+      }
+      return send(res, 200, { command: argv.map(shq).join(' ') });
+    }
+    const body = m === 'GET' ? undefined : await readJson(req);
+    if (action === 'reply' && body?.attachments?.length) body.attachments = await pushUploads(mid, body.attachments);
+    const out = await machines.json(mid, m, sub, body, action === 'wait' ? { timeout: (MAX_WAIT_S + 30) * 1000 } : undefined);
+    if (!action && m === 'GET') return send(res, 200, machines.session(mid, out));
+    if ((!action && m === 'PATCH') || action === 'wait') return send(res, 200, machines.summary(mid, out));
+    if (out && typeof out === 'object' && out.sessionId) out.sessionId = qualify(out.sessionId, mid);
+    return send(res, 200, out);
+  }
+
   function serveStatic(res, pathname) {
     const p = path.normalize(path.join(WEB, pathname === '/' ? 'index.html' : pathname));
     if (!p.startsWith(WEB) || !fs.existsSync(p) || fs.statSync(p).isDirectory()) {
@@ -503,6 +1027,10 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
       if (JSON.parse(fs.readFileSync(serverFile, 'utf8')).pid === process.pid) fs.rmSync(serverFile, { force: true });
     } catch {}
     retro.stop();
+    triggers.stop();
+    remote.stop();
+    machines.stop(); // the tunnels go; wisp over there keeps running, agents and all
+    clearInterval(prTimer);
     for (const s of store.all()) runner.stop(s);
     store.flush();
     telemetry.persist();
@@ -519,6 +1047,9 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
   });
   fs.writeFileSync(serverFile, JSON.stringify({ url: `http://127.0.0.1:${port}`, port, pid: process.pid, version: VERSION, apiVersion: API_VERSION, startedAt: Date.now() }, null, 2));
   updater.start();
+  triggers.start();
+  remote.start();
+  machines.start();
 
   if (telemetry.enabled) {
     if (store.config.defaults.telemetryNotice !== 'seen') console.log('wisp sends anonymous usage stats and error reports (no prompts, paths or code). Opt out: Settings, or WISP_TELEMETRY=0 / DO_NOT_TRACK=1.');
@@ -527,7 +1058,7 @@ export async function startServer({ port = 4477, host = '127.0.0.1', handleSigna
       .catch(() => {});
   }
 
-  return { url: `http://localhost:${port}`, server, store, runner, shutdown, telemetry };
+  return { url: `http://localhost:${port}`, server, store, runner, shutdown, telemetry, triggers, remote, machines };
 }
 
 // POST { event, session, markdown } to each configured webhook (Slack bridges, CI, notifiers).
@@ -547,6 +1078,14 @@ function notifyWebhooks(store, summary) {
   }
 }
 
+// Pass a machine's raw response (images, markdown, uploads) straight through.
+function pipeFrom(res, r) {
+  const headers = { 'content-type': r.headers['content-type'] || 'application/octet-stream' };
+  if (r.headers['content-length']) headers['content-length'] = r.headers['content-length'];
+  res.writeHead(r.statusCode, headers);
+  r.pipe(res);
+}
+
 function send(res, status, body) {
   res.writeHead(status, { 'content-type': 'application/json' });
   res.end(JSON.stringify(body));