workerdeck 2.2.1 → 2.3.0

package/build/{instance-DeDxfiBR.mjs → instance-Bdf5e-lQ.mjs}

@@ -2,12 +2,342 @@ import { createReadStream, existsSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { createFileSessionStore, createWorkerServer } from "@workerdeck/server";
 import { dashboardDir } from "@workerdeck/web";
-import { createHash, createHmac, createPrivateKey, randomBytes, sign, timingSafeEqual } from "node:crypto";
 import { chmod, mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
+import { createHash, createHmac, createPrivateKey, randomBytes, sign, timingSafeEqual } from "node:crypto";
 import { connect, constants } from "node:http2";
+import { parseUserQuestions } from "@workerdeck/protocol";
 import { homedir } from "node:os";
 import { pathToFileURL } from "node:url";
 import { spawn } from "node:child_process";
+//#region src/lib/http.ts
+function readBody(req, maxBytes) {
+	return new Promise((resolve) => {
+		const chunks = [];
+		let size = 0;
+		let settled = false;
+		const finish = (value) => {
+			if (!settled) {
+				settled = true;
+				resolve(value);
+			}
+		};
+		req.on("data", (chunk) => {
+			size += chunk.length;
+			if (size > maxBytes) {
+				finish(null);
+				return;
+			}
+			chunks.push(chunk);
+		});
+		req.on("end", () => finish(Buffer.concat(chunks).toString("utf8")));
+		req.on("error", () => finish(null));
+	});
+}
+function respondJson(res, status, body, headers) {
+	res.writeHead(status, {
+		"content-type": "application/json",
+		"cache-control": "no-store",
+		...headers
+	}).end(JSON.stringify(body));
+}
+//#endregion
+//#region src/apns/activities.ts
+const FILENAME$1 = "apns-activities.json";
+const TOKEN_PATTERN$1 = /^[0-9a-fA-F]{32,200}$/;
+const MAX_BODY_BYTES$1 = 4096;
+function isEnvironment$1(value) {
+	return value === "development" || value === "production";
+}
+function keyOf(deviceToken, sessionId) {
+	return `${deviceToken}:${sessionId}`;
+}
+function persistable(record) {
+	const { deviceToken, sessionId, hostId, environment, updateToken, phase, startedAt } = record;
+	return {
+		deviceToken,
+		sessionId,
+		hostId,
+		environment,
+		updateToken,
+		phase,
+		startedAt
+	};
+}
+async function createActivityRegistry(options) {
+	const path = options.dir === null ? null : join(options.dir, FILENAME$1);
+	const records = /* @__PURE__ */ new Map();
+	if (path !== null) try {
+		const parsed = JSON.parse(await readFile(path, "utf8"));
+		for (const record of parsed.activities ?? []) if (typeof record?.deviceToken === "string" && typeof record.sessionId === "string" && isEnvironment$1(record.environment)) records.set(keyOf(record.deviceToken, record.sessionId), record);
+	} catch {}
+	const persist = async () => {
+		if (path === null) return;
+		try {
+			await mkdir(options.dir, {
+				recursive: true,
+				mode: 448
+			});
+			await writeFile(path, `${JSON.stringify({ activities: [...records.values()].map(persistable) }, null, 2)}\n`, { mode: 384 });
+			await chmod(path, 384);
+		} catch (error) {
+			options.onError?.(error, {
+				op: "write",
+				path
+			});
+		}
+	};
+	return {
+		list: () => [...records.values()],
+		get: (deviceToken, sessionId) => records.get(keyOf(deviceToken, sessionId)),
+		forSession: (sessionId) => [...records.values()].filter((record) => record.sessionId === sessionId),
+		async start(record) {
+			const existing = records.get(keyOf(record.deviceToken, record.sessionId));
+			if (existing !== void 0) return existing;
+			const created = {
+				...record,
+				phase: "starting",
+				startedAt: record.startedAt ?? Date.now()
+			};
+			records.set(keyOf(created.deviceToken, created.sessionId), created);
+			await persist();
+			return created;
+		},
+		async attach(match, updateToken) {
+			const direct = match.deviceToken === void 0 ? void 0 : records.get(keyOf(match.deviceToken, match.sessionId));
+			const candidates = direct !== void 0 ? [direct] : [...records.values()].filter((record) => record.sessionId === match.sessionId && record.environment === match.environment && record.updateToken === void 0);
+			const target = candidates.length === 1 ? candidates[0] : void 0;
+			if (target === void 0 || target.updateToken === updateToken) return target;
+			target.updateToken = updateToken;
+			target.phase = "live";
+			await persist();
+			return target;
+		},
+		async touch(deviceToken, sessionId, changes) {
+			const record = records.get(keyOf(deviceToken, sessionId));
+			if (record === void 0) return;
+			const structural = changes.phase !== void 0 && changes.phase !== record.phase;
+			Object.assign(record, changes);
+			if (structural) await persist();
+		},
+		async remove(deviceToken, sessionId) {
+			if (!records.delete(keyOf(deviceToken, sessionId))) return;
+			await persist();
+		},
+		async removeByUpdateToken(updateToken) {
+			let removed = false;
+			for (const [key, record] of records) if (record.updateToken === updateToken) {
+				records.delete(key);
+				removed = true;
+			}
+			if (removed) await persist();
+		}
+	};
+}
+function createActivityRoute(registry, authenticate) {
+	return async (req, res) => {
+		let pathname;
+		try {
+			pathname = new URL(req.url ?? "/", "http://internal").pathname;
+		} catch {
+			return false;
+		}
+		if (pathname !== "/apns/activities") return false;
+		if (registry === null) {
+			res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+			res.end("this gateway runs without push\n");
+			return true;
+		}
+		if (req.method !== "POST" && req.method !== "DELETE") {
+			res.writeHead(405, { allow: "POST, DELETE" }).end();
+			return true;
+		}
+		if (authenticate(req) === null) {
+			respondJson(res, 401, { error: "unauthorized" });
+			return true;
+		}
+		const raw = await readBody(req, MAX_BODY_BYTES$1);
+		if (raw === null) {
+			respondJson(res, 413, { error: "body too large" });
+			res.once("finish", () => req.destroy());
+			return true;
+		}
+		let body;
+		try {
+			body = JSON.parse(raw);
+		} catch {
+			respondJson(res, 400, { error: "invalid JSON body" });
+			return true;
+		}
+		const token = body.token;
+		if (typeof token !== "string" || !TOKEN_PATTERN$1.test(token)) {
+			respondJson(res, 400, { error: "token must be a hex Live Activity update token" });
+			return true;
+		}
+		if (req.method === "DELETE") {
+			await registry.removeByUpdateToken(token);
+			res.writeHead(204).end();
+			return true;
+		}
+		const sessionId = body.sessionId;
+		if (typeof sessionId !== "string" || sessionId === "") {
+			respondJson(res, 400, { error: "sessionId is required" });
+			return true;
+		}
+		if (!isEnvironment$1(body.environment)) {
+			respondJson(res, 400, { error: "environment must be 'development' or 'production'" });
+			return true;
+		}
+		const deviceToken = typeof body.deviceToken === "string" && TOKEN_PATTERN$1.test(body.deviceToken) ? body.deviceToken : void 0;
+		if (await registry.attach({
+			sessionId,
+			deviceToken,
+			environment: body.environment
+		}, token) === void 0) {
+			respondJson(res, 404, { error: "no activity awaiting a token for this session" });
+			return true;
+		}
+		respondJson(res, 200, {
+			attached: true,
+			sessionId
+		});
+		return true;
+	};
+}
+//#endregion
+//#region src/apns/devices.ts
+const FILENAME = "apns-devices.json";
+const TOKEN_PATTERN = /^[0-9a-fA-F]{32,200}$/;
+const MAX_BODY_BYTES = 4096;
+function isEnvironment(value) {
+	return value === "development" || value === "production";
+}
+async function createDeviceRegistry(options) {
+	const path = options.dir === null ? null : join(options.dir, FILENAME);
+	const devices = /* @__PURE__ */ new Map();
+	if (path !== null) try {
+		const parsed = JSON.parse(await readFile(path, "utf8"));
+		for (const record of parsed.devices ?? []) if (typeof record?.token === "string" && isEnvironment(record.environment)) devices.set(record.token, record);
+	} catch {}
+	const persist = async () => {
+		if (path === null) return;
+		try {
+			await mkdir(options.dir, {
+				recursive: true,
+				mode: 448
+			});
+			await writeFile(path, `${JSON.stringify({ devices: [...devices.values()] }, null, 2)}\n`, { mode: 384 });
+			await chmod(path, 384);
+		} catch (error) {
+			options.onError?.(error, {
+				op: "write",
+				path
+			});
+		}
+	};
+	return {
+		list: () => [...devices.values()],
+		async register(record) {
+			const existing = devices.get(record.token);
+			devices.set(record.token, {
+				...record,
+				updatedAt: Date.now()
+			});
+			if (existing !== void 0 && existing.environment === record.environment && existing.hostId === record.hostId && existing.liveActivityStartToken === record.liveActivityStartToken) return;
+			await persist();
+		},
+		async clearStartToken(token) {
+			const existing = devices.get(token);
+			if (existing === void 0 || existing.liveActivityStartToken === void 0) return;
+			delete existing.liveActivityStartToken;
+			await persist();
+		},
+		async remove(token) {
+			if (!devices.delete(token)) return;
+			await persist();
+		}
+	};
+}
+function createDeviceRoute(registry, authenticate) {
+	return async (req, res) => {
+		let pathname;
+		try {
+			pathname = new URL(req.url ?? "/", "http://internal").pathname;
+		} catch {
+			return false;
+		}
+		if (pathname !== "/apns/devices") return false;
+		if (registry === null) {
+			res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+			res.end("this gateway runs without push\n");
+			return true;
+		}
+		if (req.method !== "POST" && req.method !== "DELETE") {
+			res.writeHead(405, { allow: "POST, DELETE" }).end();
+			return true;
+		}
+		if (authenticate(req) === null) {
+			respondJson(res, 401, { error: "unauthorized" });
+			return true;
+		}
+		const raw = await readBody(req, MAX_BODY_BYTES);
+		if (raw === null) {
+			respondJson(res, 413, { error: "body too large" });
+			res.once("finish", () => req.destroy());
+			return true;
+		}
+		let body;
+		try {
+			body = JSON.parse(raw);
+		} catch {
+			respondJson(res, 400, { error: "invalid JSON body" });
+			return true;
+		}
+		const token = body.token;
+		if (typeof token !== "string" || !TOKEN_PATTERN.test(token)) {
+			respondJson(res, 400, { error: "token must be a hex APNs device token" });
+			return true;
+		}
+		if (req.method === "DELETE") {
+			await registry.remove(token);
+			res.writeHead(204).end();
+			return true;
+		}
+		if (!isEnvironment(body.environment)) {
+			respondJson(res, 400, { error: "environment must be 'development' or 'production'" });
+			return true;
+		}
+		const optionalString = (value) => typeof value === "string" && value.length > 0 && value.length <= 200 ? value : void 0;
+		const startTokenGiven = Object.hasOwn(body, "liveActivityStartToken");
+		const startToken = body.liveActivityStartToken;
+		if (startTokenGiven && startToken !== null && (typeof startToken !== "string" || !TOKEN_PATTERN.test(startToken))) {
+			respondJson(res, 400, { error: "liveActivityStartToken must be a hex token or null" });
+			return true;
+		}
+		const previous = registry.list().find((record) => record.token === token);
+		const liveActivityStartToken = startTokenGiven ? startToken ?? void 0 : previous?.liveActivityStartToken;
+		await registry.register({
+			token,
+			environment: body.environment,
+			hostId: optionalString(body.hostId),
+			bundleId: optionalString(body.bundleId),
+			platform: optionalString(body.platform),
+			...liveActivityStartToken === void 0 ? {} : { liveActivityStartToken }
+		});
+		respondJson(res, 200, {
+			registered: true,
+			environment: body.environment
+		});
+		return true;
+	};
+}
+//#endregion
+//#region src/apns/routes.ts
+function createApnsRoute(registries, authenticate) {
+	const device = createDeviceRoute(registries?.devices ?? null, authenticate);
+	const activity = createActivityRoute(registries?.activities ?? null, authenticate);
+	return async (req, res) => await device(req, res) || activity(req, res);
+}
+//#endregion
 //#region src/apns/client.ts
 const HOSTS = {
 	development: "https://api.sandbox.push.apple.com",
@@ -16,6 +346,9 @@ const HOSTS = {
 const TOKEN_TTL_MS = 24e5;
 const REQUEST_TIMEOUT_MS = 1e4;
 const DIAL_ATTEMPT_TIMEOUT_MS = 2e3;
+function topicFor(topic, pushType) {
+	return pushType === "liveactivity" ? `${topic}.push-type.liveactivity` : topic;
+}
 function base64url(input) {
 	return Buffer.from(input).toString("base64url");
 }
@@ -119,8 +452,8 @@ function createApnsClient(config, key, options = {}) {
 				":method": "POST",
 				":path": `/3/device/${request.deviceToken}`,
 				authorization: `bearer ${jwt}`,
-				"apns-topic": config.topic,
-				"apns-push-type": "alert",
+				"apns-topic": topicFor(config.topic, request.pushType),
+				"apns-push-type": request.pushType ?? "alert",
 				"apns-priority": String(request.priority ?? 10),
 				"apns-expiration": String(request.expiration ?? 0),
 				"content-length": String(body.byteLength),
@@ -237,142 +570,211 @@ function createApnsClient(config, key, options = {}) {
 	};
 }
 //#endregion
-//#region src/lib/http.ts
-function readBody(req, maxBytes) {
-	return new Promise((resolve) => {
-		const chunks = [];
-		let size = 0;
-		let settled = false;
-		const finish = (value) => {
-			if (!settled) {
-				settled = true;
-				resolve(value);
-			}
-		};
-		req.on("data", (chunk) => {
-			size += chunk.length;
-			if (size > maxBytes) {
-				finish(null);
-				return;
-			}
-			chunks.push(chunk);
-		});
-		req.on("end", () => finish(Buffer.concat(chunks).toString("utf8")));
-		req.on("error", () => finish(null));
-	});
+//#region src/apns/live-activity.ts
+const MAX_PAYLOAD_BYTES$1 = 3800;
+const LIMIT = {
+	title: 60,
+	headline: 120,
+	detail: 200,
+	choiceLabel: 40,
+	choices: 4
+};
+const STALE_MS = 12e5;
+const DISMISSAL_MS = 9e5;
+const EXPIRATION_MS = 6e5;
+const END_EXPIRATION_MS = 144e5;
+const RELEVANCE = {
+	approval: 100,
+	question: 100,
+	plan: 100,
+	running: 50,
+	done: 10,
+	failed: 10,
+	parked: 10,
+	ended: 10
+};
+const PREVIEW_KEYS = [
+	"command",
+	"file_path",
+	"path",
+	"pattern",
+	"url",
+	"notebook_path",
+	"prompt",
+	"description"
+];
+function clamp(text, limit) {
+	const flat = text.replace(/\s+/g, " ").trim();
+	return flat.length <= limit ? flat : `${flat.slice(0, limit - 1)}…`;
 }
-function respondJson(res, status, body, headers) {
-	res.writeHead(status, {
-		"content-type": "application/json",
-		"cache-control": "no-store",
-		...headers
-	}).end(JSON.stringify(body));
+function sessionLabel(info) {
+	const title = info.title?.trim();
+	if (title !== void 0 && title !== "") return title;
+	return cwdLeaf(info.cwd) || info.id;
 }
-//#endregion
-//#region src/apns/devices.ts
-const FILENAME = "apns-devices.json";
-const TOKEN_PATTERN = /^[0-9a-fA-F]{32,200}$/;
-const MAX_BODY_BYTES = 4096;
-function isEnvironment(value) {
-	return value === "development" || value === "production";
+function cwdLeaf(cwd) {
+	return cwd.split("/").filter(Boolean).at(-1) ?? "";
 }
-async function createDeviceRegistry(options) {
-	const path = options.dir === null ? null : join(options.dir, FILENAME);
-	const devices = /* @__PURE__ */ new Map();
-	if (path !== null) try {
-		const parsed = JSON.parse(await readFile(path, "utf8"));
-		for (const record of parsed.devices ?? []) if (typeof record?.token === "string" && isEnvironment(record.environment)) devices.set(record.token, record);
-	} catch {}
-	const persist = async () => {
-		if (path === null) return;
-		try {
-			await mkdir(options.dir, {
-				recursive: true,
-				mode: 448
-			});
-			await writeFile(path, `${JSON.stringify({ devices: [...devices.values()] }, null, 2)}\n`, { mode: 384 });
-			await chmod(path, 384);
-		} catch (error) {
-			options.onError?.(error, {
-				op: "write",
-				path
-			});
+function previewOf(input) {
+	for (const key of PREVIEW_KEYS) {
+		const value = input[key];
+		if (typeof value === "string" && value.trim() !== "") return value;
+	}
+}
+function requestKind(request) {
+	if (request.toolName === "ExitPlanMode") return "plan";
+	return request.toolName === "AskUserQuestion" && parseUserQuestions(request.input).length > 0 ? "question" : "permission";
+}
+function choicesFor(request, kind) {
+	if (kind !== "question") return [];
+	const questions = parseUserQuestions(request.input);
+	const [question] = questions;
+	if (questions.length !== 1 || question === void 0 || question.multiSelect === true || question.options.length > LIMIT.choices) return [];
+	return question.options.map((option, index) => ({
+		index,
+		label: clamp(option.label, LIMIT.choiceLabel)
+	}));
+}
+function phaseFor(info, request) {
+	switch (info.status) {
+		case "awaiting_approval": {
+			if (request === void 0) return "running";
+			const kind = requestKind(request);
+			return kind === "permission" ? "approval" : kind;
+		}
+		case "parked": return "parked";
+		case "failed": return "failed";
+		case "closed": return "ended";
+		case "idle": return "done";
+		default: return "running";
+	}
+}
+function headlineFor(info, phase, request) {
+	if (request !== void 0 && (phase === "approval" || phase === "question" || phase === "plan")) {
+		if (phase === "question") {
+			const [question] = parseUserQuestions(request.input);
+			return clamp(question?.header !== void 0 && question.header !== "" ? question.header : "A question", LIMIT.headline);
 		}
+		if (phase === "plan") return "Plan ready for review";
+		return clamp(request.title ?? request.displayName ?? request.toolName, LIMIT.headline);
+	}
+	if (phase === "running") {
+		const active = info.checklist?.find((item) => item.status === "in_progress");
+		return clamp(active?.text ?? "Working…", LIMIT.headline);
+	}
+	return {
+		done: "Turn finished",
+		failed: "Session failed",
+		parked: "Parked",
+		ended: "Session ended"
+	}[phase] ?? "";
+}
+function detailFor(phase, request) {
+	if (request === void 0) return;
+	if (phase === "question") {
+		const [question] = parseUserQuestions(request.input);
+		return question === void 0 ? void 0 : clamp(question.question, LIMIT.detail);
+	}
+	if (phase === "approval" || phase === "plan") {
+		const preview = previewOf(request.input) ?? request.description;
+		return preview === void 0 ? void 0 : clamp(preview, LIMIT.detail);
+	}
+}
+function attributesFor(info, hostId) {
+	return {
+		sessionId: info.id,
+		...hostId === void 0 ? {} : { hostId },
+		...info.engine === void 0 ? {} : { engine: info.engine },
+		cwdLeaf: cwdLeaf(info.cwd)
 	};
+}
+function projectContentState(options) {
+	const { info, request, startedAtMs } = options;
+	const phase = options.finalPhase ?? phaseFor(info, request);
+	const kind = request === void 0 ? void 0 : requestKind(request);
+	const choices = request === void 0 || kind === void 0 ? [] : choicesFor(request, kind);
+	const total = info.checklist?.length ?? 0;
 	return {
-		list: () => [...devices.values()],
-		async register(record) {
-			const existing = devices.get(record.token);
-			devices.set(record.token, {
-				...record,
-				updatedAt: Date.now()
-			});
-			if (existing !== void 0 && existing.environment === record.environment && existing.hostId === record.hostId) return;
-			await persist();
-		},
-		async remove(token) {
-			if (!devices.delete(token)) return;
-			await persist();
-		}
+		phase,
+		title: clamp(sessionLabel(info), LIMIT.title),
+		headline: options.finalHeadline ?? headlineFor(info, phase, request),
+		...detailFor(phase, request) === void 0 ? {} : { detail: detailFor(phase, request) },
+		startedAtMs,
+		...request?.expiresAt === void 0 ? {} : { expiresAtMs: request.expiresAt },
+		pendingCount: info.pendingPermissionCount,
+		...total === 0 ? {} : { steps: {
+			done: info.checklist.filter((item) => item.status === "completed").length,
+			total
+		} },
+		...request === void 0 || kind === void 0 ? {} : { request: {
+			id: request.id,
+			kind,
+			choices,
+			...choices.length === 0 ? {} : { inputJSON: JSON.stringify(request.input) }
+		} },
+		...info.epoch === void 0 ? {} : { epoch: info.epoch },
+		seq: info.lastSeq,
+		decision: null
 	};
 }
-function createDeviceRoute(registry, authenticate) {
-	return async (req, res) => {
-		let pathname;
-		try {
-			pathname = new URL(req.url ?? "/", "http://internal").pathname;
-		} catch {
-			return false;
-		}
-		if (pathname !== "/apns/devices") return false;
-		if (req.method !== "POST" && req.method !== "DELETE") {
-			res.writeHead(405, { allow: "POST, DELETE" }).end();
-			return true;
-		}
-		if (authenticate(req) === null) {
-			respondJson(res, 401, { error: "unauthorized" });
-			return true;
-		}
-		const raw = await readBody(req, MAX_BODY_BYTES);
-		if (raw === null) {
-			respondJson(res, 413, { error: "body too large" });
-			res.once("finish", () => req.destroy());
-			return true;
-		}
-		let body;
-		try {
-			body = JSON.parse(raw);
-		} catch {
-			respondJson(res, 400, { error: "invalid JSON body" });
-			return true;
-		}
-		const token = body.token;
-		if (typeof token !== "string" || !TOKEN_PATTERN.test(token)) {
-			respondJson(res, 400, { error: "token must be a hex APNs device token" });
-			return true;
-		}
-		if (req.method === "DELETE") {
-			await registry.remove(token);
-			res.writeHead(204).end();
-			return true;
-		}
-		if (!isEnvironment(body.environment)) {
-			respondJson(res, 400, { error: "environment must be 'development' or 'production'" });
-			return true;
+function contentHash(state) {
+	const { seq: _seq, epoch: _epoch, decision: _decision, ...drawn } = state;
+	return createHash("sha256").update(JSON.stringify(drawn)).digest("base64url").slice(0, 22);
+}
+function shrink(state) {
+	if (state.request?.inputJSON !== void 0) return {
+		...state,
+		request: {
+			...state.request,
+			choices: [],
+			inputJSON: void 0
 		}
-		const optionalString = (value) => typeof value === "string" && value.length > 0 && value.length <= 200 ? value : void 0;
-		await registry.register({
-			token,
-			environment: body.environment,
-			hostId: optionalString(body.hostId),
-			bundleId: optionalString(body.bundleId),
-			platform: optionalString(body.platform)
-		});
-		respondJson(res, 200, {
-			registered: true,
-			environment: body.environment
-		});
-		return true;
+	};
+	if (state.detail !== void 0 && state.detail.length > 24) return {
+		...state,
+		detail: clamp(state.detail, Math.floor(state.detail.length / 2))
+	};
+	if (state.detail !== void 0) return {
+		...state,
+		detail: void 0
+	};
+	if (state.headline.length > 24) return {
+		...state,
+		headline: clamp(state.headline, Math.floor(state.headline.length / 2))
+	};
+}
+function buildLiveActivityPush(kind, options) {
+	const now = options.now ?? Date.now();
+	const seconds = Math.floor(now / 1e3);
+	let state = options.state;
+	const build = (content) => ({ aps: {
+		timestamp: seconds,
+		event: kind,
+		...kind === "start" ? {
+			"attributes-type": "SessionActivityAttributes",
+			attributes: options.attributes,
+			alert: {
+				title: content.title,
+				body: content.phase === "running" ? "working" : "approval needed"
+			},
+			"input-push-token": 1
+		} : {},
+		"content-state": content,
+		...kind === "end" ? { "dismissal-date": Math.floor((now + DISMISSAL_MS) / 1e3) } : { "stale-date": Math.floor((now + STALE_MS) / 1e3) },
+		"relevance-score": RELEVANCE[content.phase]
+	} });
+	let payload = build(state);
+	while (Buffer.byteLength(JSON.stringify(payload)) > MAX_PAYLOAD_BYTES$1) {
+		const smaller = shrink(state);
+		if (smaller === void 0) break;
+		state = smaller;
+		payload = build(state);
+	}
+	return {
+		payload,
+		pushType: "liveactivity",
+		priority: kind === "update" && options.urgent !== true ? 5 : 10,
+		expiration: Math.floor((now + (kind === "end" ? END_EXPIRATION_MS : EXPIRATION_MS)) / 1e3)
 	};
 }
 //#endregion
@@ -432,6 +834,7 @@ function buildPush(notification, hostId) {
 		type: notification.type,
 		sessionId: notification.sessionId,
 		seq: notification.seq,
+		...notification.session.epoch === void 0 ? {} : { epoch: notification.session.epoch },
 		...hostId === void 0 ? {} : { hostId },
 		...notification.request === void 0 ? {} : { requestId: notification.request.id }
 	});
@@ -455,7 +858,14 @@ async function createApnsForwarder(options) {
 		dir: options.stateDir,
 		onError: (error, context) => warn(`device registry ${context.op} failed for ${context.path}: ${error instanceof Error ? error.message : String(error)}`)
 	});
-	const handleRequest = createDeviceRoute(registry, options.authenticate);
+	const activities = await createActivityRegistry({
+		dir: options.stateDir,
+		onError: (error, context) => warn(`activity registry ${context.op} failed for ${context.path}: ${error instanceof Error ? error.message : String(error)}`)
+	});
+	const handleRequest = createApnsRoute({
+		devices: registry,
+		activities
+	}, options.authenticate);
 	const fallbackEnvironment = options.config.production === false ? "development" : "production";
 	const chains = /* @__PURE__ */ new Map();
 	const deliver = async (notification) => {
@@ -476,7 +886,110 @@ async function createApnsForwarder(options) {
 			warn(`push to ${device.token.slice(0, 8)}… failed: ${result.reason} (${result.status})`);
 		}));
 	};
+	const sendActivity = async (kind, target, attributes, state, urgent) => {
+		const push = buildLiveActivityPush(kind, {
+			attributes,
+			state,
+			urgent
+		});
+		const result = await client.send({
+			...push,
+			deviceToken: target.token,
+			environment: target.environment
+		});
+		if (result.ok) {
+			await activities.touch(target.deviceToken, target.sessionId, { lastPushAt: Date.now() });
+			return;
+		}
+		if (result.unregistered) {
+			if (kind === "start") await registry.clearStartToken(target.deviceToken);
+			await activities.remove(target.deviceToken, target.sessionId);
+			return;
+		}
+		warn(`live activity ${kind} for ${target.sessionId} failed: ${result.reason} (${result.status})`);
+	};
+	const startCards = async (attributes, state) => {
+		await Promise.all(registry.list().map(async (device) => {
+			if (device.liveActivityStartToken === void 0) return;
+			if (activities.get(device.token, attributes.sessionId) !== void 0) return;
+			const environment = device.environment ?? fallbackEnvironment;
+			await activities.start({
+				deviceToken: device.token,
+				sessionId: attributes.sessionId,
+				hostId: device.hostId,
+				environment
+			});
+			await sendActivity("start", {
+				deviceToken: device.token,
+				token: device.liveActivityStartToken,
+				environment,
+				sessionId: attributes.sessionId
+			}, {
+				...attributes,
+				hostId: device.hostId
+			}, state, true);
+		}));
+	};
+	const pushCards = async (kind, sessionId, state, urgent) => {
+		await Promise.all(activities.forSession(sessionId).map(async (record) => {
+			if (record.updateToken === void 0) return;
+			await sendActivity(kind, {
+				deviceToken: record.deviceToken,
+				token: record.updateToken,
+				environment: record.environment,
+				sessionId
+			}, {
+				sessionId,
+				hostId: record.hostId,
+				cwdLeaf: ""
+			}, state, urgent);
+			if (kind === "end") await activities.remove(record.deviceToken, sessionId);
+		}));
+	};
+	const queueActivity = (sessionId, run) => {
+		const next = (chains.get(sessionId) ?? Promise.resolve()).then(() => run().catch((error) => {
+			warn(error instanceof Error ? error.message : String(error));
+		}));
+		chains.set(sessionId, next);
+		next.then(() => {
+			if (chains.get(sessionId) === next) chains.delete(sessionId);
+		});
+	};
 	return {
+		activity: {
+			start(attributes, state) {
+				queueActivity(attributes.sessionId, () => startCards(attributes, state));
+			},
+			update(sessionId, state, { urgent }) {
+				queueActivity(sessionId, () => pushCards("update", sessionId, state, urgent));
+			},
+			end(sessionId, state) {
+				queueActivity(sessionId, () => pushCards("end", sessionId, state, true));
+			},
+			async endAll(headline) {
+				await Promise.all(activities.list().map(async (record) => {
+					if (record.updateToken !== void 0) await sendActivity("end", {
+						deviceToken: record.deviceToken,
+						token: record.updateToken,
+						environment: record.environment,
+						sessionId: record.sessionId
+					}, {
+						sessionId: record.sessionId,
+						hostId: record.hostId,
+						cwdLeaf: ""
+					}, {
+						phase: "ended",
+						title: record.sessionId,
+						headline,
+						startedAtMs: record.startedAt,
+						pendingCount: 0,
+						decision: null
+					}, true);
+					await activities.remove(record.deviceToken, record.sessionId);
+				}));
+			},
+			count: () => activities.list().length
+		},
 		onNotification(notification) {
 			const next = (chains.get(notification.sessionId) ?? Promise.resolve()).then(() => deliver(notification).catch((error) => {
 				warn(error instanceof Error ? error.message : String(error));
@@ -492,6 +1005,181 @@ async function createApnsForwarder(options) {
 	};
 }
 //#endregion
+//#region src/apns/live-activities.ts
+const START_DEBOUNCE_MS = 2e3;
+const END_GRACE_MS = 2e4;
+const FLUSH_DEBOUNCE_MS = 5e3;
+const MIN_UPDATE_INTERVAL_MS = 3e4;
+const HEARTBEAT_MS = 6e5;
+const RENEW_MS = 279e5;
+const ENGAGED = /* @__PURE__ */ new Set(["running", "awaiting_approval"]);
+const RELEVANT = /* @__PURE__ */ new Set([
+	"status_changed",
+	"permission_requested",
+	"permission_resolved",
+	"checklist",
+	"turn_result",
+	"session_error",
+	"session_closed"
+]);
+function finalPhaseFor(status) {
+	switch (status) {
+		case "parked": return "parked";
+		case "failed": return "failed";
+		case "closed": return "ended";
+		default: return "done";
+	}
+}
+function isWaiting(phase) {
+	return phase === "approval" || phase === "question" || phase === "plan";
+}
+function driveLiveActivities(options) {
+	const sessions = /* @__PURE__ */ new Map();
+	const unsubscribes = /* @__PURE__ */ new Set();
+	const clear = (tracked, name) => {
+		const handle = tracked.timers.get(name);
+		if (handle !== void 0) {
+			clearTimeout(handle);
+			tracked.timers.delete(name);
+		}
+	};
+	const arm = (tracked, name, delay, run) => {
+		clear(tracked, name);
+		tracked.timers.set(name, setTimeout(() => {
+			tracked.timers.delete(name);
+			run();
+		}, delay));
+	};
+	const forget = (sessionId) => {
+		const tracked = sessions.get(sessionId);
+		if (tracked === void 0) return;
+		for (const name of tracked.timers.keys()) clear(tracked, name);
+		sessions.delete(sessionId);
+	};
+	const send = (runner, tracked, state, urgent) => {
+		const hash = contentHash(state);
+		if (hash === tracked.lastHash) return;
+		tracked.lastHash = hash;
+		tracked.lastSentAt = Date.now();
+		tracked.pending = void 0;
+		clear(tracked, "flush");
+		tracked.attributes = attributesFor(runner.info(), options.hostIdOf?.());
+		if (!tracked.started) {
+			tracked.started = true;
+			options.target.start(tracked.attributes, state);
+		} else options.target.update(runner.id, state, { urgent });
+		arm(tracked, "heartbeat", HEARTBEAT_MS, () => {
+			const current = sessions.get(runner.id);
+			if (current !== void 0 && current.started) {
+				options.target.update(runner.id, {
+					...state,
+					seq: runner.info().lastSeq
+				}, { urgent: false });
+				current.lastSentAt = Date.now();
+			}
+		});
+	};
+	const finish = (runner, tracked, phase) => {
+		if (tracked.started) options.target.end(runner.id, projectContentState({
+			info: runner.info(),
+			startedAtMs: tracked.startedAtMs,
+			finalPhase: phase
+		}));
+		forget(runner.id);
+	};
+	const evaluate = (runner, immediate = false) => {
+		const info = runner.info();
+		const request = runner.pendingApprovals[0];
+		const now = Date.now();
+		if (!ENGAGED.has(info.status)) {
+			const tracked = sessions.get(info.id);
+			if (tracked === void 0) return;
+			clear(tracked, "start");
+			if (info.status === "idle") {
+				arm(tracked, "end", END_GRACE_MS, () => finish(runner, tracked, "done"));
+				return;
+			}
+			finish(runner, tracked, finalPhaseFor(info.status));
+			return;
+		}
+		let tracked = sessions.get(info.id);
+		if (tracked === void 0) {
+			tracked = {
+				attributes: attributesFor(info, options.hostIdOf?.()),
+				startedAtMs: now,
+				started: false,
+				lastSentAt: 0,
+				lastWaiting: false,
+				timers: /* @__PURE__ */ new Map()
+			};
+			sessions.set(info.id, tracked);
+		}
+		const current = tracked;
+		clear(current, "end");
+		const state = projectContentState({
+			info,
+			request,
+			startedAtMs: current.startedAtMs
+		});
+		const waiting = isWaiting(state.phase);
+		const urgent = waiting !== current.lastWaiting || state.request?.id !== current.lastRequestId;
+		current.lastWaiting = waiting;
+		current.lastRequestId = state.request?.id;
+		if (!current.started && current.timers.get("start") === void 0) {
+			current.pending = state;
+			if (waiting || immediate) {
+				send(runner, current, state, true);
+				arm(current, "renew", RENEW_MS, () => renew(runner));
+			} else arm(current, "start", START_DEBOUNCE_MS, () => {
+				const pending = sessions.get(runner.id);
+				if (pending === void 0 || !ENGAGED.has(runner.info().status)) return;
+				send(runner, pending, pending.pending ?? state, true);
+				arm(pending, "renew", RENEW_MS, () => renew(runner));
+			});
+			return;
+		}
+		if (!current.started) {
+			current.pending = state;
+			return;
+		}
+		if (urgent) {
+			send(runner, current, state, true);
+			return;
+		}
+		current.pending = state;
+		const since = now - current.lastSentAt;
+		const delay = Math.max(FLUSH_DEBOUNCE_MS, MIN_UPDATE_INTERVAL_MS - since);
+		arm(current, "flush", delay, () => {
+			const pending = sessions.get(runner.id);
+			if (pending?.pending !== void 0) send(runner, pending, pending.pending, false);
+		});
+	};
+	const renew = (runner) => {
+		const tracked = sessions.get(runner.id);
+		if (tracked === void 0 || !ENGAGED.has(runner.info().status)) return;
+		finish(runner, tracked, "ended");
+		evaluate(runner, true);
+	};
+	const stop = options.source.observe((runner) => {
+		const unsubscribe = runner.subscribe((event) => {
+			if (!RELEVANT.has(event.type)) return;
+			evaluate(runner);
+			if (event.type === "session_closed") {
+				unsubscribe();
+				unsubscribes.delete(unsubscribe);
+			}
+		}, runner.info().lastSeq);
+		unsubscribes.add(unsubscribe);
+		evaluate(runner);
+	});
+	return () => {
+		stop();
+		for (const unsubscribe of unsubscribes) unsubscribe();
+		unsubscribes.clear();
+		for (const sessionId of sessions.keys()) forget(sessionId);
+	};
+}
+//#endregion
 //#region src/auth/auth-key.ts
 function generateKey() {
 	return randomBytes(24).toString("hex");
@@ -1486,13 +2174,6 @@ function createHostGuard(allowedHosts) {
 		return isLoopbackHostname(hostname) || allowedHosts.has(hostname);
 	};
 }
-function pathnameOf(req) {
-	try {
-		return new URL(req.url ?? "/", "http://internal").pathname;
-	} catch {
-		return null;
-	}
-}
 function createFallback(auth, webRoot, hostAllowed, apnsRoute) {
 	return async (req, res) => {
 		if (!hostAllowed(req)) {
@@ -1501,12 +2182,7 @@ function createFallback(auth, webRoot, hostAllowed, apnsRoute) {
 			return;
 		}
 		if (await auth.handleAuthRequest(req, res)) return;
-		if (apnsRoute !== void 0 && await apnsRoute(req, res)) return;
-		if (apnsRoute === void 0 && pathnameOf(req) === "/apns/devices") {
-			res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
-			res.end("this gateway runs without push\n");
-			return;
-		}
+		if (await apnsRoute(req, res)) return;
 		if (webRoot === void 0) {
 			res.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
 			res.end("the web dashboard is disabled on this gateway\n");
@@ -1564,12 +2240,13 @@ async function startInstance(config, options = {}) {
 	if (config.allowedHosts === null && !config.hostAuthenticates && !auth.enabled) throw new Error("refusing to serve: the resolved config expects auth but no shared secret was materialized — this instance would be open while believing itself authenticated");
 	if (config.corsOrigins.length > 0 && !config.hostAuthenticates && !auth.enabled) throw new Error("refusing to serve: corsOrigins is set but this instance has no auth — a cross-origin page could drive it with no credential. Set --auth-key.");
 	const hostAllowed = createHostGuard(config.allowedHosts);
+	const authenticateHost = (req) => hostAllowed(req) ? auth.authenticate(req) : null;
 	const apns = config.apns === void 0 ? void 0 : await createApnsForwarder({
 		config: config.apns,
 		stateDir: config.stateDir,
-		authenticate: (req) => hostAllowed(req) ? auth.authenticate(req) : null
+		authenticate: authenticateHost
 	});
-	const fallback = createFallback(auth, webRoot, hostAllowed, apns?.handleRequest);
+	const fallback = createFallback(auth, webRoot, hostAllowed, apns?.handleRequest ?? createApnsRoute(null, authenticateHost));
 	const parking = { ...config.options.parking };
 	if (config.stateDir && !parking.store) parking.store = createFileSessionStore({
 		dir: join(config.stateDir, "parked"),
@@ -1601,6 +2278,14 @@ async function startInstance(config, options = {}) {
 		sweep = setInterval(() => wake.set(sessionsNeedTheMachine(server.registry.list())), WAKE_SWEEP_MS);
 		sweep.unref();
 	}
+	let stopActivities;
+	if (apns) {
+		await apns.activity.endAll("Gateway restarted");
+		stopActivities = driveLiveActivities({
+			source: server.registry,
+			target: apns.activity
+		});
+	}
 	const { port } = await server.listen(config.port, config.host);
 	const displayHost = config.host === "0.0.0.0" || config.host === "::" ? "localhost" : config.host;
 	const url = `http://${displayHost.includes(":") ? `[${displayHost}]` : displayHost}:${port}`;
@@ -1628,7 +2313,8 @@ async function startInstance(config, options = {}) {
 		line(config.stateDir ? `  parked sessions persist in ${join(config.stateDir, "parked")}` : "  parked sessions are in memory only — a restart drops them");
 		if (apns) {
 			const count = apns.deviceCount();
-			line(`  push: APNs forwarder on ${config.apns?.topic} — ${count === 0 ? "no devices registered yet" : `${count} device(s)`}`);
+			const cards = apns.activity.count();
+			line(`  push: APNs forwarder on ${config.apns?.topic} — ${count === 0 ? "no devices registered yet" : `${count} device(s)`}${cards === 0 ? "" : `, ${cards} live card(s)`}`);
 		}
 		if (config.configPath) line(`  config ${config.configPath}`);
 		line("");
@@ -1642,14 +2328,16 @@ async function startInstance(config, options = {}) {
 		close: async () => {
 			if (sweep) clearInterval(sweep);
 			wake?.release();
+			stopActivities?.();
 			await server.close();
 			await sessions?.flush?.();
+			if (apns) await Promise.race([apns.activity.endAll("Gateway stopped"), new Promise((resolve) => setTimeout(resolve, 3e3))]);
 			apns?.close();
 			resolveClosed();
 		}
 	};
 }
 //#endregion
-export { createApnsForwarder as _, ConfigError as a, createApnsClient as b, isLoopback as c, parseArgs as d, resolveInstanceConfig as f, buildPush as g, materializeAuthKey as h, renderLoginPage as i, isLoopbackHostname as l, createAuthSessionStore as m, resolveWebRoot as n, defaultStateDir as o, createCliAuth as p, startInstance as r, hostnameOf as s, createHostGuard as t, loadConfigFile as u, createDeviceRegistry as v, loadApnsKey as x, createDeviceRoute as y };
+export { createActivityRegistry as C, createDeviceRoute as S, createApnsForwarder as _, ConfigError as a, createApnsRoute as b, isLoopback as c, parseArgs as d, resolveInstanceConfig as f, buildPush as g, materializeAuthKey as h, renderLoginPage as i, isLoopbackHostname as l, createAuthSessionStore as m, resolveWebRoot as n, defaultStateDir as o, createCliAuth as p, startInstance as r, hostnameOf as s, createHostGuard as t, loadConfigFile as u, createApnsClient as v, createActivityRoute as w, createDeviceRegistry as x, loadApnsKey as y };
 
-//# sourceMappingURL=instance-DeDxfiBR.mjs.map
+//# sourceMappingURL=instance-Bdf5e-lQ.mjs.map