colloq 0.2.0__py3-none-any.whl

colloq/_app/cli/launch.mjs

@@ -0,0 +1,1572 @@
+// cli/src/launch.ts
+import fs7 from "node:fs";
+import path6 from "node:path";
+import net from "node:net";
+import { spawn as spawn2 } from "node:child_process";
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { parse as parseEnv } from "dotenv";
+
+// cli/src/launch-config.ts
+import fs2 from "node:fs";
+import path2 from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+
+// cli/src/launch-state.ts
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { fileURLToPath } from "node:url";
+var selfDir = path.dirname(fileURLToPath(import.meta.url));
+function expandHome(value) {
+  return value === "~" || value.startsWith("~/") ? path.join(os.homedir(), value.slice(1)) : value;
+}
+function isRepository(dir) {
+  try {
+    if (!fs.existsSync(path.join(dir, "Makefile"))) return false;
+    return /"name"\s*:\s*"colloq"/.test(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+  } catch {
+    return false;
+  }
+}
+function isWorkingTree(dir) {
+  return fs.existsSync(path.join(dir, "cli/src/launch.ts"));
+}
+function isDistribution(dir = appDir()) {
+  return fs.existsSync(path.join(dir, ".colloq-dist.json"));
+}
+function looksLikeApp(dir) {
+  if (isRepository(dir) || fs.existsSync(path.join(dir, ".colloq-dist.json"))) return true;
+  return fs.existsSync(path.join(dir, "server/dist/server.js")) && fs.existsSync(path.join(dir, "web/dist"));
+}
+var appCache;
+function appDir() {
+  if (appCache) return appCache;
+  const explicit = process.env.COLLOQ_APP_DIR;
+  if (explicit) return appCache = path.resolve(expandHome(explicit));
+  for (let dir = selfDir, step = 0; step < 12; step++) {
+    if (looksLikeApp(dir)) return appCache = dir;
+    const up = path.dirname(dir);
+    if (up === dir) break;
+    dir = up;
+  }
+  return appCache = path.resolve(selfDir, "../..");
+}
+function userStateDir() {
+  const xdg = process.env.XDG_DATA_HOME;
+  return xdg && path.isAbsolute(xdg) ? path.join(xdg, "colloq") : path.join(os.homedir(), ".colloq");
+}
+function resolveHome() {
+  const explicit = process.env.COLLOQ_HOME;
+  if (explicit) return path.resolve(expandHome(explicit));
+  const app = appDir();
+  if (isRepository(app)) return app;
+  if (isDistribution(app)) return userStateDir();
+  if (isWorkingTree(app)) return app;
+  return userStateDir();
+}
+var homeCache;
+function homeDir() {
+  if (homeCache) return homeCache;
+  const home2 = resolveHome();
+  fs.mkdirSync(home2, { recursive: true, mode: 448 });
+  return homeCache = home2;
+}
+var SESSION_FILE = ".colloq/local-session.json";
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeJson(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 448 });
+  const temporary = `${file}.${process.pid}.${randomUUID()}`;
+  fs.writeFileSync(temporary, JSON.stringify(value) + "\n", { mode: 384 });
+  try {
+    fs.renameSync(temporary, file);
+  } finally {
+    try {
+      fs.unlinkSync(temporary);
+    } catch {
+    }
+  }
+}
+function alive(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 1) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function readReceipt(file) {
+  const value = readJson(file);
+  if (!value || !Number.isSafeInteger(value.pid) || value.pid <= 1 || typeof value.runId !== "string" || !value.runId || !["run", "dev"].includes(value.mode) || !Number.isInteger(value.port) || value.port < 1 || value.port > 65535 || !["root", "url", "dataDir", "workspaceDir", "leaseFile"].every(
+    (key) => typeof value[key] === "string"
+  ) || !value.options || typeof value.options !== "object")
+    return null;
+  return value;
+}
+function acquireLock(file, pid, runId, isAlive = alive) {
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 448 });
+  const create = () => {
+    const fd = fs.openSync(file, "wx", 384);
+    try {
+      fs.writeFileSync(fd, JSON.stringify({ pid, runId }) + "\n");
+    } finally {
+      fs.closeSync(fd);
+    }
+  };
+  try {
+    create();
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    const guard = `${file}.reclaim`;
+    try {
+      fs.mkdirSync(guard, { mode: 448 });
+    } catch {
+      throw new Error("Another run is already checking the local session. Repeat the command.");
+    }
+    try {
+      const prior = readJson(file);
+      if (!prior || isAlive(prior.pid))
+        throw new Error(
+          "A local session is already starting or running. Use colloq status / colloq stop."
+        );
+      fs.unlinkSync(file);
+      create();
+    } finally {
+      fs.rmdirSync(guard);
+    }
+  }
+  return () => {
+    if (readJson(file)?.runId === runId) fs.unlinkSync(file);
+  };
+}
+
+// cli/src/launch-config.ts
+function parseLaunchArgs(args) {
+  const options = {
+    action: "run",
+    detach: false,
+    open: true,
+    fast: false,
+    build: false
+  };
+  let at = 0;
+  if (["run", "dev", "stop", "restart", "cloudflared"].includes(args[0]))
+    options.action = args[at++];
+  for (; at < args.length; at++) {
+    const flag = args[at];
+    if (flag === "--detach") options.detach = true;
+    else if (flag === "--no-open") options.open = false;
+    else if (flag === "--fast") options.fast = true;
+    else if (flag === "--build") options.build = true;
+    else if (flag === "--child") options.child = true;
+    else if (flag === "--share") options.share = true;
+    else if (flag === "--port") {
+      const value = args[++at];
+      if (!value || !/^\d+$/.test(value) || Number(value) < 1 || Number(value) > 65535)
+        throw new Error("The port must be a whole number from 1 to 65535.");
+      options.port = Number(value);
+    } else if (flag === "--host") {
+      const host = args[++at];
+      if (!host || !/^[a-zA-Z0-9](?:[a-zA-Z0-9.-]*[a-zA-Z0-9])?$/.test(host))
+        throw new Error("Give a name after --host, for example class.example.ru.");
+      options.host = host;
+    } else throw new Error(`Unknown launch argument: ${flag}`);
+  }
+  if (options.action === "dev" && options.detach)
+    throw new Error("dev runs in the terminal; use run --detach for the background.");
+  if (options.share && options.host)
+    throw new Error(
+      "--share and --host do not work together: --share is a quick Cloudflare link, --host is your own name."
+    );
+  return options;
+}
+function launchConfig(root2, options, source, home2 = root2) {
+  const dev = options.action === "dev";
+  const configuredPort = Number(source.PORT || 3e3);
+  const port = dev ? configuredPort : options.port ?? configuredPort;
+  const uiPort = dev ? options.port ?? 5173 : port;
+  for (const value of [port, uiPort])
+    if (!Number.isInteger(value) || value < 1 || value > 65535)
+      throw new Error("Invalid PORT in the launch settings.");
+  if (dev && port === uiPort)
+    throw new Error("The dev frontend port must differ from the server PORT in .env.");
+  const dataDir = path2.resolve(home2, source.DATA_DIR || "data");
+  const workspaceDir = path2.resolve(home2, source.WORKSPACE_DIR || "workspace");
+  const leaseFile = path2.join(home2, ".colloq/public-url.json");
+  const url = `http://localhost:${uiPort}`;
+  const kernelEnv = source.KERNEL_ENV || "base";
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(kernelEnv))
+    throw new Error("Invalid environment name in KERNEL_ENV.");
+  if (source.COLLOQ_CLUSTER === "1")
+    throw new Error(
+      "This is a runtime broker installation: use the service or cluster commands for it. run is meant for local Docker."
+    );
+  if (source.KERNEL_BACKEND === "broker")
+    throw new Error(
+      `KERNEL_BACKEND=broker is the production setting from .env.example, and a local class runs its kernels in Docker. Set KERNEL_BACKEND=docker in ${path2.join(home2, ".env")} (or move that file aside: colloq then writes one for this machine). A real runtime broker installation is run with the service or cluster commands.`
+    );
+  const env = Object.fromEntries(
+    Object.entries(source).filter((pair) => typeof pair[1] === "string")
+  );
+  Object.assign(env, {
+    NODE_ENV: "development",
+    KERNEL_BACKEND: "docker",
+    PORT: String(port),
+    BIND_ADDR: "127.0.0.1",
+    DATA_DIR: dataDir,
+    WORKSPACE_DIR: workspaceDir,
+    WORKSPACE_HOST_DIR: "",
+    COLLOQ_LOCAL_SESSION: "1",
+    COLLOQ_LOCAL_URL: url,
+    COLLOQ_PUBLIC_URL_LEASE_FILE: leaseFile,
+    COLLOQ_STOP_KERNELS_ON_EXIT: dev ? "0" : "1",
+    // Каталог состояния — серверу его надо СКАЗАТЬ. Сам он считает только
+    // корень приложения (шагами вверх до kernel/environments), и потому окно
+    // «Окружения» не видело ни одного окружения, заведённого `colloq env new`,
+    // а заведённое из панели клало в site-packages. По этой строке панель
+    // находит свои окружения и .env; без неё каталог у неё один, как раньше.
+    COLLOQ_HOME: home2,
+    // Собранный интерфейс — часть приложения, поэтому root, а не home.
+    STATIC_DIR: path2.join(root2, "web/dist"),
+    VITE_API_TARGET: `http://127.0.0.1:${port}`
+  });
+  return {
+    root: root2,
+    home: home2,
+    dist: isDistribution(root2),
+    port,
+    uiPort,
+    url,
+    dataDir,
+    workspaceDir,
+    leaseFile,
+    env,
+    kernelEnv
+  };
+}
+function localClassEnv(dist2) {
+  return `# Settings for this machine. colloq wrote this file on its first start:
+# edit it and restart with colloq restart. The full list of everything that
+# can be configured is in .env.example next to the application.
+
+# The address of the class on this machine. From outside it is visible
+# only through colloq host.
+PORT=3000
+BIND_ADDR=127.0.0.1
+UI_LANGUAGE=${dist2 ? "en" : "ru"}
+
+# The kernels of a class are Docker containers on this computer, one per room.
+# Each room container is hardened: no privileges, a process limit, the internet
+# yes, your local network and this computer no. COLLOQ_ROOM_NETWORK=open lifts
+# the network block for a machine you fully trust.
+KERNEL_BACKEND=docker
+KERNEL_ENV=base
+# Memory and processors of one room. 4g is enough for an ordinary class; for a
+# class that trains networks set 8g-16g, if the machine has that much.
+KERNEL_MEM=4g
+KERNEL_CPUS=2
+KERNEL_SHM=1g
+
+# Signs the sign-in links of teachers and students. Left empty, the key is
+# created in data/ on its own and survives a restart; a value written here
+# wins over it.
+SESSION_SECRET=
+# Not a shared Jupyter: every room has a token of its own. This line is here
+# so the log does not keep the token from .env.example, which everyone knows.
+JUPYTER_TOKEN=${randomBytes(24).toString("hex")}
+
+# File uploads and the disk space one class may take.
+MAX_UPLOAD_MB=50
+MAX_SESSION_MB=1024
+
+# The Oracle. Without a key the class still runs, but the model cannot be asked.
+AI_PROVIDER=openai
+OPENAI_API_KEY=
+OPENAI_BASE_URL=https://api.openai.com/v1
+OPENAI_MODEL=gpt-4o-mini
+`;
+}
+function filesBelow(root2, relative) {
+  const full = path2.join(root2, relative);
+  if (!fs2.existsSync(full)) return [];
+  const stat = fs2.lstatSync(full);
+  if (stat.isSymbolicLink()) return [];
+  if (!stat.isDirectory()) return [relative];
+  return fs2.readdirSync(full).sort().flatMap((name) => {
+    if (["node_modules", "dist", ".git", ".vite"].includes(name) || name.endsWith(".built") || // Копии чужих бандлов, которые раскладывает сам шаг сборки (`npm run
+    // assets` в web/package.json): воркер pdf.js и plotly.js. Они не
+    // исходники — их содержимое уже посчитано через package-lock.json, а
+    // считать их отдельно значило бы пересобирать фронтенд всякий раз,
+    // когда копия появилась или пропала.
+    ["web/public/pdf", "web/public/plotly"].includes(path2.join(relative, name)))
+      return [];
+    return filesBelow(root2, path2.join(relative, name));
+  });
+}
+function fingerprint(root2, inputs = [
+  "web",
+  "server",
+  "runtime",
+  "shared",
+  "package.json",
+  "package-lock.json",
+  "tsconfig.json"
+]) {
+  const hash = createHash("sha256");
+  for (const file of inputs.flatMap((input) => filesBelow(root2, input)).sort()) {
+    hash.update(file).update("\0").update(fs2.readFileSync(path2.join(root2, file))).update("\0");
+  }
+  return hash.digest("hex");
+}
+function buildIsCurrent(root2, stamp, fast) {
+  return Boolean(
+    stamp && stamp.fingerprint === fingerprint(root2) && (fast || !stamp.fast) && fs2.existsSync(path2.join(root2, "web/dist/index.html")) && fs2.existsSync(path2.join(root2, "server/dist/server.js"))
+  );
+}
+function kernelInputs(root2, name) {
+  const files = ["kernel/Dockerfile", "kernel/requirements.txt"];
+  const seen = /* @__PURE__ */ new Set();
+  let current = name;
+  while (current) {
+    if (seen.has(current) || seen.size >= 8)
+      throw new Error("A cycle or too long a chain of Python environments.");
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(current))
+      throw new Error("Invalid parent environment name.");
+    seen.add(current);
+    const file = `kernel/environments/${current}.txt`;
+    if (!fs2.existsSync(path2.join(root2, file))) throw new Error(`No environment ${current}: ${file}`);
+    files.push(file);
+    current = fs2.readFileSync(path2.join(root2, file), "utf8").match(/^\s*#\s*colloq:\s*from\s+(\S+)/m)?.[1];
+  }
+  return files;
+}
+
+// cli/src/launch-process.ts
+import { spawn } from "node:child_process";
+import fs3 from "node:fs";
+import { StringDecoder } from "node:string_decoder";
+var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var Processes = class {
+  constructor(root2, env, log) {
+    this.root = root2;
+    this.env = env;
+    this.log = log;
+  }
+  children = /* @__PURE__ */ new Set();
+  /**
+   * onLine — слушатель строк stdout ребёнка: вернул true — строка его, и на
+   * экран она не идёт (в журнал идёт всё как есть). Так супервизор слышит
+   * строку-метку host.sh под --share, не показывая её человеку. Без
+   * слушателя поток идёт кусками, как шёл: построчная буферизация нужна
+   * только тому, кто просил.
+   */
+  start(name, command, args, quiet = false, extraEnv = {}, cwd = this.root, onLine) {
+    const child = spawn(command, args, {
+      cwd,
+      env: { ...this.env, ...extraEnv },
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const item = { child, name, settled: false, done: Promise.resolve(0) };
+    for (const [stream, target] of [
+      [child.stdout, process.stdout],
+      [child.stderr, process.stderr]
+    ]) {
+      const lines = stream === child.stdout && onLine ? { rest: "", decoder: new StringDecoder("utf8") } : null;
+      stream?.on("data", (chunk) => {
+        if (this.log !== void 0) fs3.writeSync(this.log, chunk);
+        if (!lines) {
+          if (!quiet) target.write(chunk);
+          return;
+        }
+        const text = lines.rest + lines.decoder.write(chunk);
+        const parts = text.split("\n");
+        lines.rest = parts.pop() ?? "";
+        for (const line of parts) if (!onLine(line) && !quiet) target.write(line + "\n");
+      });
+      if (lines)
+        stream?.on("end", () => {
+          lines.rest += lines.decoder.end();
+          if (lines.rest && !onLine(lines.rest) && !quiet) target.write(lines.rest);
+          lines.rest = "";
+        });
+    }
+    item.done = new Promise((resolve) => {
+      let finished = false;
+      const done = (code) => {
+        if (finished) return;
+        finished = true;
+        item.settled = true;
+        this.children.delete(item);
+        resolve(code);
+      };
+      child.on("error", (error) => {
+        console.error(`${name}: ${error.message}`);
+        done(127);
+      });
+      child.on(
+        "close",
+        (code, signal) => done(code ?? (signal === "SIGINT" ? 130 : signal ? 143 : 0))
+      );
+    });
+    this.children.add(item);
+    return item;
+  }
+  async run(name, command, args) {
+    const code = await this.start(name, command, args).done;
+    if (code !== 0) throw new Error(`${name}: the process exited with code ${code}.`);
+  }
+  signal(item, signal) {
+    if (item.settled || !item.child.pid) return;
+    try {
+      if (process.platform === "win32") item.child.kill(signal);
+      else process.kill(-item.child.pid, signal);
+    } catch {
+    }
+  }
+  async stop(item, grace = 8e4) {
+    if (item.settled) return;
+    this.signal(item, "SIGTERM");
+    let timer;
+    await Promise.race([
+      item.done,
+      new Promise((resolve) => {
+        timer = setTimeout(resolve, grace);
+      })
+    ]);
+    if (timer) clearTimeout(timer);
+    if (!item.settled) {
+      this.signal(item, "SIGKILL");
+      await item.done;
+    }
+  }
+  async stopAll(grace = 8e4) {
+    await Promise.all([...this.children].map((item) => this.stop(item, grace)));
+  }
+};
+async function capture(root2, env, command, args, timeout = 5e3) {
+  return await new Promise((resolve) => {
+    const child = spawn(command, args, {
+      cwd: root2,
+      env,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let text = "";
+    child.stdout.on("data", (chunk) => {
+      text += chunk.toString();
+    });
+    child.stderr.resume();
+    const timer = setTimeout(() => {
+      try {
+        if (process.platform === "win32") child.kill("SIGKILL");
+        else if (child.pid) process.kill(-child.pid, "SIGKILL");
+      } catch {
+      }
+    }, timeout);
+    const finish = (code) => {
+      clearTimeout(timer);
+      resolve({ code, text });
+    };
+    child.on("error", () => finish(127));
+    child.on("close", (code) => finish(code ?? 1));
+  });
+}
+
+// cli/src/launch-prepare.ts
+import fs4 from "node:fs";
+import path3 from "node:path";
+async function buildKernelImage(processes, buildRoot, viaMake, name, parentImage) {
+  if (viaMake) {
+    const target = ["--no-print-directory", "env-build", `NAME=${name}`];
+    await processes.run("Python build", "make", target);
+    return;
+  }
+  const kernel = path3.join(buildRoot, "kernel");
+  const args = [
+    "build",
+    "-f",
+    path3.join(kernel, "Dockerfile"),
+    "--build-arg",
+    `KERNEL_ENV=${name}`,
+    ...parentImage ? ["--build-arg", `PARENT=${parentImage}`] : [],
+    "-t",
+    `colloq-kernel:${name}`,
+    kernel
+  ];
+  const build = processes.start("Python build", "docker", args, false, {
+    DOCKER_BUILDKIT: "1",
+    BUILDKIT_PROGRESS: "plain"
+  });
+  const code = await build.done;
+  if (code !== 0) throw new Error(`Python build: the process exited with code ${code}.`);
+}
+function kernelRoot(root2, home2) {
+  const own = path3.join(home2, "environments");
+  if (home2 === root2 || !fs4.existsSync(own)) return root2;
+  const staged = path3.join(home2, ".colloq/kernel-build");
+  const to = path3.join(staged, "kernel");
+  fs4.rmSync(staged, { recursive: true, force: true });
+  const keep = { recursive: true, preserveTimestamps: true };
+  fs4.cpSync(path3.join(root2, "kernel"), to, keep);
+  const into = path3.join(to, "environments");
+  fs4.mkdirSync(into, { recursive: true });
+  for (const file of fs4.readdirSync(own))
+    if (file.endsWith(".txt")) fs4.cpSync(path3.join(own, file), path3.join(into, file), keep);
+  return staged;
+}
+async function prepare(config, options, processes, stopped) {
+  const { root: root2, home: home2, env, kernelEnv, dist: dist2 } = config;
+  const kernelFrom = kernelRoot(root2, home2);
+  const viaMake = !dist2 && kernelFrom === root2;
+  if ((await capture(root2, env, "docker", ["info", "--format", "{{.ServerVersion}}"])).code !== 0)
+    throw new Error("Docker is not responding. Start Docker and run colloq run again.");
+  if (stopped()) throw new Error("Launch cancelled.");
+  const inputs = kernelInputs(kernelFrom, kernelEnv);
+  const sourceHash = fingerprint(kernelFrom, inputs);
+  const chain = inputs.slice(2).reverse().map((file2) => {
+    const name = path3.basename(file2, ".txt");
+    const sources = kernelInputs(kernelFrom, name);
+    return { name, sources, fingerprint: fingerprint(kernelFrom, sources) };
+  });
+  const stamps = [];
+  const inspect = async (name) => {
+    const result = await capture(root2, env, "docker", ["image", "inspect", `colloq-kernel:${name}`]);
+    if (stopped()) throw new Error("Launch cancelled.");
+    if (result.code !== 0) return void 0;
+    try {
+      const image = JSON.parse(result.text)[0];
+      return typeof image?.Id === "string" && image.Id ? image : void 0;
+    } catch {
+      return void 0;
+    }
+  };
+  let parentId = "", parentImage = "", parentCreated = 0, ancestorRebuilt = false;
+  for (const item of chain) {
+    let image = await inspect(item.name);
+    const marker = path3.join(home2, `.colloq/kernel-${item.name}.json`);
+    const stamp = readJson(marker);
+    const freshImage = image && Date.parse(image.Created) >= parentCreated && item.sources.every(
+      (file2) => fs4.statSync(path3.join(kernelFrom, file2)).mtimeMs <= Date.parse(image.Created)
+    );
+    const current = stamp ? stamp.fingerprint === item.fingerprint && stamp.id === image?.Id && (stamp.parentId ?? "") === parentId : freshImage;
+    if (!image || ancestorRebuilt || !current) {
+      console.log(`Preparing the Python environment: ${item.name}`);
+      await buildKernelImage(processes, kernelFrom, viaMake, item.name, parentImage);
+      image = await inspect(item.name);
+      if (!image) throw new Error("The build finished, but the kernel image is not there.");
+      ancestorRebuilt = true;
+    }
+    if (fingerprint(kernelFrom, inputs) !== sourceHash)
+      throw new Error("The sources changed during the build. Start again, or use make dev.");
+    stamps.push({ file: marker, value: { fingerprint: item.fingerprint, id: image.Id, parentId } });
+    parentId = image.Id;
+    parentImage = `colloq-kernel:${item.name}`;
+    parentCreated = Date.parse(image.Created);
+  }
+  for (const stamp of stamps) writeJson(stamp.file, stamp.value);
+  if (stopped()) throw new Error("Launch cancelled.");
+  if (options.action === "dev") return;
+  if (dist2) {
+    for (const required of ["web/dist/index.html", "server/dist/server.js"])
+      if (!fs4.existsSync(path3.join(root2, required)))
+        throw new Error(
+          `The installation is incomplete: no ${required} in ${root2}. Reinstall colloq (pip install --force-reinstall colloq).`
+        );
+    return;
+  }
+  const file = path3.join(root2, ".colloq/build.json");
+  if (options.build || !buildIsCurrent(root2, readJson(file), options.fast)) {
+    const before = fingerprint(root2);
+    console.log("Building the application\u2026");
+    await processes.run("Application build", "npm", [
+      "run",
+      options.fast ? "build" : "build:optimized"
+    ]);
+    if (!fs4.existsSync(path3.join(root2, "web/dist/index.html")) || !fs4.existsSync(path3.join(root2, "server/dist/server.js")))
+      throw new Error("The build produced no frontend and no server. Check the output above.");
+    if (fingerprint(root2) !== before)
+      throw new Error("The sources changed during the build. Start again, or use make dev.");
+    writeJson(file, { fingerprint: before, fast: options.fast });
+  }
+}
+
+// cli/src/launch-readiness.ts
+async function devFrontendReady(url) {
+  for (const resource of ["/", "/src/index.css"]) {
+    let response;
+    try {
+      response = await fetch(new URL(resource, url), { signal: AbortSignal.timeout(5e3) });
+      await response.arrayBuffer();
+    } catch {
+      return false;
+    }
+    if (response.status >= 500)
+      throw new Error(`Vite could not compile ${resource}. Check the frontend error above.`);
+    if (!response.ok) return false;
+  }
+  return true;
+}
+
+// cli/src/launch-cloudflared.ts
+import fs5 from "node:fs";
+import path4 from "node:path";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { gunzipSync } from "node:zlib";
+
+// cli/src/launch-cloudflared-pin.ts
+var CLOUDFLARED_VERSION = "2026.9.1";
+var CLOUDFLARED_ASSETS = [
+  {
+    platform: "darwin",
+    arch: "arm64",
+    name: "cloudflared-darwin-arm64.tgz",
+    archive: "tgz",
+    size: 19217478,
+    sha256: "c27ab8fd0aa489449e3d201eb02f957ef460a13b613662928b1b23394bf1bcfe",
+    binarySha256: "9a0b19f67dc7a3011bc6b972c7ce06a5fcea8784ac6bd599ffa382ea4aeb5a6e"
+  },
+  {
+    platform: "darwin",
+    arch: "x64",
+    name: "cloudflared-darwin-amd64.tgz",
+    archive: "tgz",
+    size: 21118723,
+    sha256: "ff0d3b51d5ff70eceef89d6b32145fee985018a2174596a5dbe405e2766e2ac4",
+    binarySha256: "1ea07ae775b03236bd6be18ca1848d6bdc4af2f4f3bce398823b5a36e5761b75"
+  },
+  {
+    platform: "linux",
+    arch: "x64",
+    name: "cloudflared-linux-amd64",
+    archive: "binary",
+    size: 39838488,
+    sha256: "03f1f25d1cc93b9ad6c60569d44060bc4f17ed97075760ed8cfca4b12dcd68cc",
+    binarySha256: "03f1f25d1cc93b9ad6c60569d44060bc4f17ed97075760ed8cfca4b12dcd68cc"
+  },
+  {
+    platform: "linux",
+    arch: "arm64",
+    name: "cloudflared-linux-arm64",
+    archive: "binary",
+    size: 37466252,
+    sha256: "3d97437c71848bd8df68041e12436b484a661d95073ea1937f01a845ce88faa3",
+    binarySha256: "3d97437c71848bd8df68041e12436b484a661d95073ea1937f01a845ce88faa3"
+  }
+];
+
+// cli/src/launch-cloudflared.ts
+var CLOUDFLARED_RELEASES = "https://github.com/cloudflare/cloudflared/releases";
+var INSTALL_HINT = "Install cloudflared yourself (brew install cloudflared, or a package from " + CLOUDFLARED_RELEASES + ") or name the file: COLLOQ_CLOUDFLARED=/path/to/cloudflared.";
+var SYSTEMS = { darwin: "macOS", linux: "Linux" };
+function cloudflaredUrl(asset, version = CLOUDFLARED_VERSION) {
+  return `${CLOUDFLARED_RELEASES}/download/${version}/${asset.name}`;
+}
+function pickCloudflaredAsset(platform, arch, assets = CLOUDFLARED_ASSETS) {
+  if (platform === "win32")
+    throw new Error(
+      "Sharing a class from Windows is not supported: colloq runs on macOS and Linux. Run it inside WSL 2 (Ubuntu on Windows), where it works as on Linux."
+    );
+  const asset = assets.find((item) => item.platform === platform && item.arch === arch);
+  if (!asset)
+    throw new Error(
+      `colloq has no pinned cloudflared build for ${SYSTEMS[platform] ?? platform} ${arch}. ` + INSTALL_HINT
+    );
+  return asset;
+}
+function sha256(data) {
+  return createHash2("sha256").update(data).digest("hex");
+}
+function verifySha256(data, expected, what) {
+  const actual = sha256(data);
+  if (actual !== expected)
+    throw new Error(
+      `${what}: the sha256 does not match the pinned one (expected ${expected}, got ${actual}). Nothing was saved or run.`
+    );
+}
+function untarFile(tar, wanted) {
+  const data = Buffer.from(tar.buffer, tar.byteOffset, tar.byteLength);
+  let at = 0;
+  let nextName = null;
+  while (at + 512 <= data.length) {
+    const header = data.subarray(at, at + 512);
+    if (header.every((byte) => byte === 0)) break;
+    const field = (start, length) => {
+      const raw = header.subarray(start, start + length);
+      const end = raw.indexOf(0);
+      return raw.subarray(0, end === -1 ? length : end).toString("utf8");
+    };
+    const size = parseInt(field(124, 12).trim() || "0", 8);
+    if (!Number.isSafeInteger(size) || size < 0) throw new Error("The archive is damaged.");
+    const body = at + 512;
+    if (body + size > data.length) throw new Error("The archive is cut short.");
+    const type = header[156];
+    const content = data.subarray(body, body + size);
+    const prefix = field(345, 155);
+    const name = nextName ?? (prefix ? `${prefix}/${field(0, 100)}` : field(0, 100));
+    nextName = null;
+    if (type === 76) nextName = content.toString("utf8").replace(/\0+$/, "");
+    else if (type === 120)
+      nextName = /(?:^|\n)\d+ path=([^\n]*)\n/.exec(content.toString("utf8"))?.[1] ?? null;
+    else if ((type === 48 || type === 0) && name.replace(/^\.\//, "") === wanted)
+      return Buffer.from(content);
+    at = body + Math.ceil(size / 512) * 512;
+  }
+  throw new Error(`There is no ${wanted} inside the archive.`);
+}
+function cloudflaredBinary(asset, downloaded) {
+  verifySha256(downloaded, asset.sha256, asset.name);
+  const binary = asset.archive === "tgz" ? untarFile(gunzipSync(downloaded), "cloudflared") : Buffer.from(downloaded);
+  verifySha256(binary, asset.binarySha256, `cloudflared from ${asset.name}`);
+  return binary;
+}
+function resolveCloudflared(lookup) {
+  const named = (lookup.env.COLLOQ_CLOUDFLARED ?? "").trim();
+  if (named) {
+    if (!path4.isAbsolute(named))
+      return {
+        kind: "refuse",
+        message: `COLLOQ_CLOUDFLARED must be an absolute path to the file, not "${named}".`
+      };
+    if (!lookup.executable(named))
+      return {
+        kind: "refuse",
+        message: `COLLOQ_CLOUDFLARED names ${named}, and that is not an executable file.`
+      };
+    return { kind: "use", path: named, source: "override" };
+  }
+  const ours = path4.join(lookup.binDir, "cloudflared");
+  for (const dir of (lookup.env.PATH ?? "").split(path4.delimiter)) {
+    if (!dir || !path4.isAbsolute(dir) || path4.resolve(dir) === path4.resolve(lookup.binDir)) continue;
+    const candidate = path4.join(dir, "cloudflared");
+    if (lookup.executable(candidate)) return { kind: "use", path: candidate, source: "path" };
+  }
+  let asset;
+  try {
+    asset = pickCloudflaredAsset(lookup.platform, lookup.arch, lookup.assets);
+  } catch (error) {
+    return { kind: "refuse", message: error.message };
+  }
+  const present = lookup.executable(ours);
+  if (present && lookup.hashOf(ours) === asset.binarySha256)
+    return { kind: "use", path: ours, source: "colloq" };
+  if (lookup.env.COLLOQ_CLOUDFLARED_DOWNLOAD?.trim() === "0")
+    return {
+      kind: "refuse",
+      message: (present ? `${ours} is not the pinned cloudflared ${CLOUDFLARED_VERSION}` : "cloudflared is not installed") + ", and downloading is switched off (COLLOQ_CLOUDFLARED_DOWNLOAD=0). " + INSTALL_HINT
+    };
+  return { kind: "download", asset, stale: present };
+}
+async function download(url, asset, fetchImpl, say, cancel) {
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  cancel?.addEventListener("abort", abort, { once: true });
+  let quiet;
+  const idle = () => {
+    if (quiet) clearTimeout(quiet);
+    quiet = setTimeout(abort, 6e4);
+  };
+  try {
+    idle();
+    const response = await fetchImpl(url, { redirect: "follow", signal: controller.signal });
+    if (!response.ok || !response.body)
+      throw new Error(`GitHub answered ${response.status} for ${url}.`);
+    const chunks = [];
+    let received = 0;
+    let told = 0;
+    const reader = response.body.getReader();
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      idle();
+      received += value.byteLength;
+      if (received > asset.size)
+        throw new Error(`${asset.name} is larger than the pinned ${asset.size} bytes.`);
+      chunks.push(Buffer.from(value));
+      const quarter = Math.floor(received / asset.size * 4);
+      if (quarter > told && quarter < 4) {
+        told = quarter;
+        say(`  \u2026 ${quarter * 25}%`);
+      }
+    }
+    return Buffer.concat(chunks, received);
+  } catch (error) {
+    if (cancel?.aborted) throw new Error("The download was cancelled.");
+    if (controller.signal.aborted) throw new Error("The download stalled: no data for a minute.");
+    const cause = error.cause;
+    const reason = cause instanceof Error ? cause.message : error.message;
+    throw new Error(`Could not download ${asset.name}: ${reason}`);
+  } finally {
+    if (quiet) clearTimeout(quiet);
+    cancel?.removeEventListener("abort", abort);
+    controller.abort();
+  }
+}
+function install(binDir, binary, expected) {
+  fs5.mkdirSync(binDir, { recursive: true, mode: 448 });
+  const file = path4.join(binDir, "cloudflared");
+  const temporary = path4.join(binDir, `.cloudflared-${process.pid}-${randomUUID2()}`);
+  try {
+    fs5.writeFileSync(temporary, binary, { mode: 384, flag: "wx" });
+    verifySha256(fs5.readFileSync(temporary), expected, temporary);
+    fs5.chmodSync(temporary, 493);
+    fs5.renameSync(temporary, file);
+  } finally {
+    try {
+      fs5.unlinkSync(temporary);
+    } catch {
+    }
+  }
+  return file;
+}
+function executable(file) {
+  try {
+    if (!fs5.statSync(file).isFile()) return false;
+    fs5.accessSync(file, fs5.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function hashOf(file) {
+  try {
+    return sha256(fs5.readFileSync(file));
+  } catch {
+    return null;
+  }
+}
+async function ensureCloudflared(options) {
+  const platform = options.platform ?? process.platform;
+  const arch = options.arch ?? process.arch;
+  const binDir = path4.join(options.home, "bin");
+  const decision = resolveCloudflared({
+    env: options.env,
+    platform,
+    arch,
+    binDir,
+    executable,
+    hashOf,
+    assets: options.assets
+  });
+  if (decision.kind === "use") return decision.path;
+  if (decision.kind === "refuse") throw new Error(decision.message);
+  const { asset } = decision;
+  const url = cloudflaredUrl(asset);
+  options.say(
+    decision.stale ? `The cloudflared in ${binDir} is not the pinned ${CLOUDFLARED_VERSION} build: fetching it again.` : "cloudflared is not installed: colloq fetches it once, for this and every later link."
+  );
+  options.say(
+    `  cloudflared ${CLOUDFLARED_VERSION} for ${SYSTEMS[asset.platform]} ${asset.arch}, ${(asset.size / 1e6).toFixed(0)} MB, from ${url}`
+  );
+  const downloaded = await download(
+    url,
+    asset,
+    options.fetch ?? fetch,
+    options.say,
+    options.signal
+  );
+  const binary = cloudflaredBinary(asset, downloaded);
+  const file = install(binDir, binary, asset.binarySha256);
+  options.say(`  sha256 matches the pinned one; saved as ${file}`);
+  return file;
+}
+
+// cli/src/launch-share.ts
+import fs6 from "node:fs";
+import path5 from "node:path";
+function publishRefusal(check) {
+  const backend = (check.env.KERNEL_BACKEND ?? "").trim() || "docker";
+  if ((check.env.KERNEL_ISOLATION ?? "").trim().toLowerCase() === "off")
+    return "KERNEL_ISOLATION=off is set, so the rooms would not be kept apart";
+  if (backend !== "docker" && backend !== "broker")
+    return `KERNEL_BACKEND=${backend} does not give every room a container of its own`;
+  if (backend === "docker" && check.dockerReachable === false)
+    return "Docker is not responding, and without it nothing keeps the rooms apart";
+  if (check.health !== void 0) {
+    const said = check.health?.isolation;
+    if (said !== backend)
+      return typeof said === "string" ? `the server reports room isolation "${said}", not ${backend}` : "the server does not confirm that every room runs in a container of its own";
+  }
+  return null;
+}
+function refusalText(reason, local) {
+  return [
+    `Not published: ${reason}.`,
+    "A public link lets anyone who has it run code on this computer, so colloq",
+    "publishes a class only when every room runs in a Docker container of its own.",
+    "Check Docker and KERNEL_BACKEND / KERNEL_ISOLATION in .env, then try again.",
+    ...local ? [`The class keeps running locally: ${local}`] : []
+  ].join("\n");
+}
+function parseShareMarker(line) {
+  const match = /^@colloq-share (ok|unverified) (https:\/\/[A-Za-z0-9.-]+)\/?\s*$/.exec(line);
+  return match ? { url: match[2], verified: match[1] === "ok" } : null;
+}
+function printable(name) {
+  const clean = name.replace(/[\u0000-\u001f\u007f-\u009f]+/g, " ").trim();
+  return clean.length > 48 ? clean.slice(0, 47) + "\u2026" : clean;
+}
+function renderShareBlock(block) {
+  const out = ["", `  \u250C Colloq is online at ${block.url}`, "  \u2502"];
+  const link = (item) => `  \u2502   ${block.url}/s/${encodeURIComponent(item.id)}   ${printable(item.name)}`;
+  if (block.classes.length === 1 && block.total === 1) {
+    out.push("  \u2502 Give your students this link:", link(block.classes[0]));
+  } else if (block.classes.length > 0) {
+    out.push("  \u2502 Give your students the link of the class you teach (newest first):");
+    for (const item of block.classes) out.push(link(item));
+    const more = block.total - block.classes.length;
+    if (more > 0) out.push(`  \u2502   \u2026 and ${more} more: the panel lists every class with its link`);
+  } else {
+    out.push(
+      "  \u2502 There is no class yet. Create one in the panel and copy its link from",
+      "  \u2502 the list \u2014 the list already gives links on this public address:",
+      `  \u2502   ${block.url}/admin`,
+      `  \u2502   (on this computer the panel is also at ${block.local}/admin)`
+    );
+  }
+  out.push(
+    "  \u2502",
+    "  \u2502 Never share a link with /admin/ in it (/admin/t/\u2026, /admin/k/\u2026): it is a",
+    "  \u2502 key to the panel. Students only ever get /s/\u2026 links."
+  );
+  if (block.verified === false)
+    out.push(
+      "  \u2502",
+      "  \u2502 The check from this computer did not get through \u2014 usually the DNS of",
+      "  \u2502 this network, not the class. Open the link on a phone on mobile data."
+    );
+  out.push(
+    "  \u2502",
+    block.detached ? "  \u2502 The link lives until colloq stop, which closes it with the class." : "  \u2502 The link lives while this terminal is open: Ctrl+C closes it and the class.",
+    "  \u2502 A quick tunnel gets a new address on every start: send the new link each time.",
+    "  \u2502 Cloudflare addresses do not open from Russia. For students there, use a relay:",
+    block.relayDomain ? `  \u2502   colloq start --host <name>.${block.relayDomain}` : "  \u2502   colloq start --host <name> with RELAY_* in .env (see the docs: networking)",
+    "  \u2514",
+    ""
+  );
+  return out;
+}
+async function readClasses(dataDir, limit = 3) {
+  const file = path5.join(dataDir, "colloq.db");
+  if (!fs6.existsSync(file)) return { classes: [], total: 0 };
+  try {
+    const { default: Database } = await import("better-sqlite3");
+    const db = new Database(file, { readonly: true, fileMustExist: true });
+    try {
+      const rows = db.prepare(
+        "SELECT id, name FROM sessions WHERE archived_at IS NULL ORDER BY created_at DESC LIMIT ?"
+      ).all(limit);
+      const { total } = db.prepare("SELECT COUNT(*) AS total FROM sessions WHERE archived_at IS NULL").get();
+      return {
+        classes: rows.filter(
+          (row) => typeof row.id === "string" && /^[A-Za-z0-9_-]+$/.test(row.id)
+        ),
+        total
+      };
+    } finally {
+      db.close();
+    }
+  } catch {
+    return { classes: [], total: 0 };
+  }
+}
+
+// shared/local-public-url-lease.ts
+function publicLeaseAddress(value) {
+  if (typeof value !== "string") return null;
+  try {
+    const url = new URL(value);
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) return null;
+    return url.href.replace(/\/+$/, "");
+  } catch {
+    return null;
+  }
+}
+function parsePublicUrlLease(raw) {
+  try {
+    const lease = JSON.parse(raw ?? "");
+    if (!lease || typeof lease.runId !== "string" || !lease.runId || typeof lease.owner !== "string" || !lease.owner || !Number.isFinite(lease.expiresAt)) return null;
+    const url = publicLeaseAddress(lease.url);
+    return url ? { runId: lease.runId, owner: lease.owner, expiresAt: lease.expiresAt, url } : null;
+  } catch {
+    return null;
+  }
+}
+function leaseUrl(raw, runId, now) {
+  const lease = parsePublicUrlLease(raw);
+  return lease && lease.runId === runId && lease.expiresAt > now ? lease.url : void 0;
+}
+
+// cli/src/launch.ts
+import { createRequire } from "node:module";
+function layOutWebAssets(root2) {
+  const from = createRequire(path6.join(root2, "web/package.json"));
+  const copies = [
+    ["pdfjs-dist/build/pdf.worker.min.mjs", "web/public/pdf/pdf.worker.min.mjs"],
+    ["plotly.js-strict-dist-min/plotly-strict.min.js", "web/public/plotly/plotly.min.js"]
+  ];
+  for (const [module, target] of copies) {
+    try {
+      const source = from.resolve(module);
+      const to = path6.join(root2, target);
+      if (fs7.existsSync(to) && fs7.statSync(to).size === fs7.statSync(source).size) continue;
+      fs7.mkdirSync(path6.dirname(to), { recursive: true });
+      fs7.copyFileSync(source, to);
+    } catch (error) {
+      console.warn(`[colloq] ${target}: ${error instanceof Error ? error.message : String(error)} \u2014 npm ci?`);
+    }
+  }
+}
+var root = appDir();
+var home = homeDir();
+var dist = isDistribution(root);
+var receiptFile = path6.join(home, SESSION_FILE);
+var resultFile = path6.join(home, ".colloq/local-session-result.json");
+var pidFile = path6.join(home, ".colloq.pid");
+var logFile = path6.join(home, ".colloq.log");
+var entry = fileURLToPath2(import.meta.url);
+var GRACE = 8e4;
+async function health(port) {
+  try {
+    const response = await fetch(`http://127.0.0.1:${port}/api/health`, {
+      signal: AbortSignal.timeout(1500)
+    });
+    if (!response.ok) return null;
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+async function portOccupied(port) {
+  return await new Promise((resolve) => {
+    const socket = net.connect(port, "127.0.0.1");
+    const done = (busy) => {
+      socket.destroy();
+      resolve(busy);
+    };
+    socket.once("connect", () => done(true));
+    socket.once("error", () => done(false));
+    socket.setTimeout(1e3, () => done(true));
+  });
+}
+async function supervisorOwned(receipt) {
+  if (receipt.root !== home || !alive(receipt.pid)) return false;
+  const command = await capture(root, process.env, "ps", [
+    "-ww",
+    "-p",
+    String(receipt.pid),
+    "-o",
+    "command="
+  ]);
+  return command.code === 0 && command.text.trim() === `clq:${receipt.runId.slice(0, 24)}`;
+}
+function openBrowser(url) {
+  if (!process.stdout.isTTY) return;
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  const child = spawn2(command, args, { stdio: "ignore", detached: process.platform !== "win32" });
+  child.on("error", () => console.log(`Open in your browser: ${url}`));
+  child.unref();
+}
+function banner(receipt) {
+  console.log(
+    `
+Colloq is running
+
+Local:  ${receipt.url}
+Panel:  ${receipt.url}/admin
+Data:   ${receipt.dataDir}
+Files:  ${receipt.workspaceDir}
+
+Ctrl+C \u2014 save and stop the server and the local kernels
+`
+  );
+}
+async function announceShare(url, receipt, relayDomain, verified, detached2) {
+  const { classes, total } = await readClasses(receipt.dataDir);
+  console.log(
+    renderShareBlock({
+      url,
+      local: receipt.url,
+      classes,
+      total,
+      verified,
+      detached: detached2,
+      relayDomain
+    }).join("\n")
+  );
+}
+async function shareCloudflared(env, signal) {
+  try {
+    return await ensureCloudflared({ home, env, say: (line) => console.log(line), signal });
+  } catch (error) {
+    throw new Error(
+      `No cloudflared for --share: ${error.message}
+Start without --share (colloq start) and publish later with colloq host.`
+    );
+  }
+}
+function effectiveEnv() {
+  const envFile = path6.join(home, ".env");
+  return {
+    ...fs7.existsSync(envFile) ? parseEnv(fs7.readFileSync(envFile)) : {},
+    ...process.env
+  };
+}
+async function stopSession() {
+  const receipt = readReceipt(receiptFile);
+  if (!receipt) {
+    console.log("No local session found.");
+    return null;
+  }
+  if (!alive(receipt.pid)) {
+    console.log("The local session has already ended.");
+    return receipt;
+  }
+  if (!await supervisorOwned(receipt))
+    throw new Error(
+      "The PID in the session receipt does not belong to this run. Nothing was stopped."
+    );
+  console.log("Saving and stopping the local session\u2026");
+  process.kill(receipt.pid, "SIGTERM");
+  const deadline = Date.now() + GRACE * 2 + 1e4;
+  while (Date.now() < deadline) {
+    if (readReceipt(receiptFile)?.runId !== receipt.runId && !alive(receipt.pid)) {
+      const result = readJson(resultFile);
+      if (result?.runId === receipt.runId && result.error)
+        throw new Error(result.error + " Check colloq logs.");
+      return receipt;
+    }
+    await delay(100);
+  }
+  throw new Error("The stop did not finish. Check colloq logs; nothing was killed by force.");
+}
+function kernelCleanupArgs() {
+  const bundle = path6.join(root, "server/dist/local-cleanup.js");
+  const source = path6.join(root, "server/src/ops/local-cleanup.ts");
+  for (const candidate of dist ? [bundle, source] : [source, bundle]) {
+    if (!fs7.existsSync(candidate)) continue;
+    return candidate.endsWith(".ts") ? ["--import", "tsx", candidate] : [candidate];
+  }
+  return null;
+}
+function childArgs(options) {
+  const args = [options.action, "--child"];
+  if (options.detach) args.push("--detach");
+  if (!options.open) args.push("--no-open");
+  if (options.fast) args.push("--fast");
+  if (options.build) args.push("--build");
+  if (options.host) args.push("--host", options.host);
+  if (options.share) args.push("--share");
+  if (options.port) args.push("--port", String(options.port));
+  return args;
+}
+async function detached(options) {
+  const existing = readReceipt(receiptFile);
+  if (existing && await supervisorOwned(existing)) {
+    console.log(`Colloq is already running: ${existing.url}`);
+    return 0;
+  }
+  if (options.share || options.host) {
+    const env = effectiveEnv();
+    const refusal = publishRefusal({ env });
+    if (refusal) throw new Error(refusalText(refusal));
+    if (options.share) await shareCloudflared(env);
+  }
+  const runId = randomUUID3();
+  const log = fs7.openSync(logFile, "a", 384);
+  fs7.chmodSync(logFile, 384);
+  const loader = entry.endsWith(".ts") ? ["--import", "tsx"] : [];
+  const child = spawn2(process.execPath, [...loader, entry, ...childArgs(options)], {
+    cwd: root,
+    env: { ...process.env, COLLOQ_LAUNCH_ID: runId, COLLOQ_APP_DIR: root, COLLOQ_HOME: home },
+    detached: true,
+    stdio: ["ignore", log, log]
+  });
+  fs7.closeSync(log);
+  let ended = false, failure = "", cancelled = 0;
+  child.once("error", (error) => {
+    failure = error.message;
+    ended = true;
+  });
+  child.once("exit", () => {
+    ended = true;
+  });
+  const stop = (code) => {
+    cancelled = code;
+    try {
+      child.kill("SIGTERM");
+    } catch {
+    }
+  };
+  const onInt = () => stop(130), onTerm = () => stop(143);
+  process.once("SIGINT", onInt);
+  process.once("SIGTERM", onTerm);
+  try {
+    console.log(`Preparing the background start. Log: ${logFile}`);
+    while (!ended) {
+      const receipt = readReceipt(receiptFile);
+      let publicUrl;
+      if (receipt?.runId === runId) {
+        try {
+          publicUrl = leaseUrl(fs7.readFileSync(receipt.leaseFile, "utf8"), runId, Date.now());
+        } catch {
+        }
+      }
+      const publishing = Boolean(options.host || options.share);
+      if (!cancelled && receipt?.runId === runId && receipt.phase === "ready" && (!publishing || publicUrl || receipt.hosting === "failed")) {
+        console.log(
+          `Colloq is running in the background: ${receipt.url}
+Logs: colloq logs
+Stop: colloq stop`
+        );
+        if (publicUrl && options.share)
+          await announceShare(
+            publicUrl,
+            receipt,
+            effectiveEnv().RELAY_DOMAIN?.trim() ?? "",
+            null,
+            true
+          );
+        else if (publicUrl) console.log(`Public address: ${publicUrl}`);
+        else if (publishing)
+          console.log(`The tunnel did not come up; local work continues. Details: ${logFile}`);
+        if (options.open) openBrowser(`${receipt.url}/admin`);
+        child.unref();
+        return 0;
+      }
+      await delay(150);
+    }
+    if (cancelled) return cancelled;
+    throw new Error(failure || `The background start failed. Log: ${logFile}`);
+  } finally {
+    process.off("SIGINT", onInt);
+    process.off("SIGTERM", onTerm);
+  }
+}
+async function runSession(options) {
+  const prior = readReceipt(receiptFile);
+  if (prior && await supervisorOwned(prior)) {
+    console.log(
+      `Colloq is already ${prior.phase === "ready" ? "running" : "starting"}: ${prior.url}`
+    );
+    if (options.host) console.log(`For public access: colloq host ${options.host}`);
+    if (options.share) console.log("For a public link: colloq host");
+    if (options.open && prior.phase === "ready") openBrowser(`${prior.url}/admin`);
+    return 0;
+  }
+  if (options.detach && !options.child) return await detached(options);
+  const runId = options.child ? process.env.COLLOQ_LAUNCH_ID || randomUUID3() : randomUUID3();
+  process.title = `clq:${runId.slice(0, 24)}`;
+  const releases = [];
+  let processes, receipt, log;
+  let stopping = false, exitCode = 0, started = false;
+  let stopPromise;
+  let cleanupFailure = null;
+  let tunnel;
+  const cancel = new AbortController();
+  const stop = (code) => {
+    if (stopping) return;
+    stopping = true;
+    exitCode = code;
+    cancel.abort();
+    console.log("\nStopping the local session\u2026");
+    stopPromise = (async () => {
+      if (tunnel) await processes?.stop(tunnel, 5e3);
+      await processes?.stopAll(GRACE);
+    })();
+  };
+  const onInt = () => stop(130), onTerm = () => stop(143), onHangup = () => stop(129);
+  const onOutputError = () => stop(129);
+  process.on("SIGINT", onInt);
+  process.on("SIGTERM", onTerm);
+  process.on("SIGHUP", onHangup);
+  process.stdout.on("error", onOutputError);
+  process.stderr.on("error", onOutputError);
+  try {
+    releases.push(acquireLock(path6.join(home, ".colloq/local-session.lock"), process.pid, runId));
+    const legacy = Number(fs7.existsSync(pidFile) ? fs7.readFileSync(pidFile, "utf8").trim() : 0);
+    if (legacy && alive(legacy))
+      throw new Error(
+        "A server from .colloq.pid is already running. Use it, or stop it explicitly with colloq stop."
+      );
+    const envFile = path6.join(home, ".env");
+    if (!fs7.existsSync(envFile)) {
+      fs7.writeFileSync(envFile, localClassEnv(dist), { flag: "wx", mode: 384 });
+      console.log(`Created ${envFile}: the settings for this machine.`);
+    }
+    const config = launchConfig(
+      root,
+      options,
+      {
+        ...parseEnv(fs7.readFileSync(envFile)),
+        ...process.env
+      },
+      home
+    );
+    config.env.COLLOQ_LOCAL_RUN_ID = runId;
+    if (await portOccupied(config.port) || config.uiPort !== config.port && await portOccupied(config.uiPort))
+      throw new Error(
+        `Port ${config.port} or ${config.uiPort} is already taken. The running process was left alone.`
+      );
+    const publishing = Boolean(options.host || options.share);
+    const early = publishing ? publishRefusal({ env: config.env }) : null;
+    if (early) throw new Error(refusalText(early));
+    let cloudflared;
+    if (options.share) {
+      try {
+        cloudflared = await shareCloudflared(config.env, cancel.signal);
+      } catch (error) {
+        if (stopping) return exitCode;
+        throw error;
+      }
+    }
+    if (stopping) return exitCode;
+    releases.push(acquireLock(path6.join(config.dataDir, ".local-session.lock"), process.pid, runId));
+    fs7.mkdirSync(config.workspaceDir, { recursive: true });
+    if (!options.child) {
+      log = fs7.openSync(logFile, "a", 384);
+      fs7.chmodSync(logFile, 384);
+    }
+    processes = new Processes(root, config.env, log);
+    receipt = {
+      pid: process.pid,
+      runId,
+      // Каталог состояния: он и опознаёт сессию (см. supervisorOwned).
+      root: home,
+      port: config.port,
+      url: config.url,
+      dataDir: config.dataDir,
+      workspaceDir: config.workspaceDir,
+      leaseFile: config.leaseFile,
+      mode: options.action === "dev" ? "dev" : "run",
+      startedAt: Date.now(),
+      phase: "preparing",
+      options
+    };
+    writeJson(receiptFile, receipt);
+    fs7.writeFileSync(pidFile, String(process.pid) + "\n", { mode: 384 });
+    if (stopping) return exitCode;
+    await prepare(config, options, processes, () => stopping);
+    if (stopping) return exitCode;
+    receipt.phase = "starting";
+    writeJson(receiptFile, receipt);
+    const dev = options.action === "dev";
+    if (dev) layOutWebAssets(root);
+    const server = dev ? processes.start("Dev server", process.execPath, [
+      path6.join(root, "node_modules/tsx/dist/cli.mjs"),
+      "watch",
+      "--clear-screen=false",
+      "server/src/index.ts"
+    ]) : processes.start("Server", process.execPath, ["server/dist/server.js"]);
+    started = true;
+    receipt.serverPid = server.child.pid;
+    writeJson(receiptFile, receipt);
+    let frontend;
+    if (dev) {
+      frontend = processes.start(
+        "Dev frontend",
+        process.execPath,
+        [
+          path6.join(root, "node_modules/vite/bin/vite.js"),
+          path6.join(root, "web"),
+          "--host",
+          "127.0.0.1",
+          "--port",
+          String(config.uiPort),
+          "--strictPort",
+          "--clearScreen=false"
+        ],
+        false,
+        {},
+        path6.join(root, "web")
+      );
+    }
+    const deadline = Date.now() + 9e4;
+    while (!stopping) {
+      if (server.settled || frontend?.settled)
+        throw new Error(
+          "The server or the frontend exited before it was ready. Check the log above."
+        );
+      const status = await health(config.port);
+      const uiReady = !dev || await devFrontendReady(config.url);
+      if (status?.localRunId === runId && uiReady) break;
+      if (Date.now() > deadline)
+        throw new Error(
+          "The server did not become ready in 90 seconds. Check Docker and the log above."
+        );
+      await delay(150);
+    }
+    if (stopping) return exitCode;
+    receipt.phase = "ready";
+    if (publishing) receipt.hosting = "starting";
+    writeJson(receiptFile, receipt);
+    banner(receipt);
+    if (options.open) openBrowser(`${config.url}/admin`);
+    if (publishing) {
+      const script = path6.join(root, "scripts/host.sh");
+      const docker = fs7.existsSync(script) ? await capture(root, config.env, "docker", ["info", "--format", "{{.ServerVersion}}"]) : null;
+      const refusal = docker ? publishRefusal({
+        env: config.env,
+        dockerReachable: docker.code === 0,
+        health: await health(config.port)
+      }) : null;
+      if (!fs7.existsSync(script)) {
+        receipt.hosting = "failed";
+        writeJson(receiptFile, receipt);
+        console.error(
+          `
+Not published: there is no ${script} next to the application.
+The class runs locally: ${config.url}
+The package looks built without scripts/: update colloq (pip install -U colloq).`
+        );
+      } else if (refusal) {
+        receipt.hosting = "failed";
+        writeJson(receiptFile, receipt);
+        console.error("\n" + refusalText(refusal, config.url));
+      } else {
+        const relayDomain = config.env.RELAY_DOMAIN?.trim() ?? "";
+        tunnel = processes.start(
+          "Public access",
+          "bash",
+          [script],
+          false,
+          {
+            COLLOQ_HOME: home,
+            ...options.share ? {
+              COLLOQ_HOSTNAME: "",
+              COLLOQ_DIRECT: "",
+              COLLOQ_SHARE: "1",
+              COLLOQ_CLOUDFLARED: cloudflared ?? ""
+            } : { COLLOQ_HOSTNAME: options.host }
+          },
+          root,
+          options.share ? (line) => {
+            const shared = parseShareMarker(line);
+            if (!shared || !receipt) return false;
+            void announceShare(shared.url, receipt, relayDomain, shared.verified, false);
+            return true;
+          } : void 0
+        );
+        void tunnel.done.then((code) => {
+          if (!stopping && receipt) {
+            receipt.hosting = "failed";
+            writeJson(receiptFile, receipt);
+            console.log(
+              `
+Public access ended (code ${code}). Local work continues: ${config.url}
+` + (options.share ? "Try again: colloq host (a new quick tunnel \u2014 and a new address to send)." : `Try again: colloq host ${options.host}`)
+            );
+          }
+        });
+      }
+    }
+    const ended = await Promise.race([server.done, ...frontend ? [frontend.done] : []]);
+    if (!stopping) {
+      exitCode = ended || 1;
+      console.error("The local server or frontend exited. Stopping the remaining processes.");
+    }
+    return exitCode;
+  } catch (error) {
+    if (!stopping) console.error(error instanceof Error ? error.message : String(error));
+    return stopping ? exitCode : 1;
+  } finally {
+    stopping = true;
+    if (receipt && readReceipt(receiptFile)?.runId === runId) {
+      receipt.phase = "stopping";
+      writeJson(receiptFile, receipt);
+    }
+    await stopPromise;
+    if (tunnel) await processes?.stop(tunnel, 5e3);
+    await processes?.stopAll(GRACE);
+    const cleanupArgs = started && processes ? kernelCleanupArgs() : null;
+    if (started && processes && !cleanupArgs)
+      console.error(
+        "Nothing here can stop the kernels: neither server/dist/local-cleanup.js nor the source. Containers left behind are visible with: docker ps --filter name=colloq-room-"
+      );
+    if (processes && cleanupArgs) {
+      const cleanup = processes.start("Stopping kernels", process.execPath, cleanupArgs);
+      let timer;
+      const cleanupCode = await Promise.race([
+        cleanup.done,
+        new Promise((resolve) => {
+          timer = setTimeout(() => resolve(void 0), GRACE);
+        })
+      ]);
+      if (cleanupCode !== 0)
+        cleanupFailure = cleanupCode === void 0 ? "Stopping the kernels timed out." : `Stopping the kernels exited with code ${cleanupCode}.`;
+      if (timer) clearTimeout(timer);
+      if (!cleanup.settled) {
+        processes.signal(cleanup, "SIGKILL");
+        await cleanup.done;
+      }
+    }
+    if (receipt && readJson(receipt.leaseFile)?.runId === runId) {
+      try {
+        fs7.unlinkSync(receipt.leaseFile);
+      } catch {
+      }
+    }
+    if (receipt) writeJson(resultFile, { runId, error: cleanupFailure });
+    if (readReceipt(receiptFile)?.runId === runId) fs7.unlinkSync(receiptFile);
+    try {
+      if (fs7.readFileSync(pidFile, "utf8").trim() === String(process.pid)) fs7.unlinkSync(pidFile);
+    } catch {
+    }
+    for (const release of releases.reverse()) release();
+    if (log !== void 0) fs7.closeSync(log);
+    process.off("SIGINT", onInt);
+    process.off("SIGTERM", onTerm);
+    process.off("SIGHUP", onHangup);
+    process.stdout.off("error", onOutputError);
+    process.stderr.off("error", onOutputError);
+    if (cleanupFailure) throw new Error(cleanupFailure + " Check colloq logs; the data is saved.");
+  }
+}
+async function main() {
+  const options = parseLaunchArgs(process.argv.slice(2));
+  if (options.action === "cloudflared") {
+    const file = await ensureCloudflared({
+      home,
+      env: effectiveEnv(),
+      say: (line) => console.error(line)
+    });
+    process.stdout.write(file + "\n");
+    return 0;
+  }
+  if (options.action === "stop") {
+    await stopSession();
+    return 0;
+  }
+  if (options.action === "restart") {
+    const prior = await stopSession();
+    if (!prior) return 1;
+    process.env.DATA_DIR = prior.dataDir;
+    process.env.WORKSPACE_DIR = prior.workspaceDir;
+    process.env.PORT = String(prior.port);
+    const port = prior.mode === "dev" ? Number(new URL(prior.url).port || 80) : prior.port;
+    return await runSession({
+      ...prior.options,
+      action: prior.mode,
+      port,
+      child: false,
+      build: options.build,
+      fast: options.fast || prior.options.fast
+    });
+  }
+  return await runSession(options);
+}
+main().then((code) => {
+  process.exitCode = code;
+}).catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});