muxtower 0.1.0__py3-none-any.whl

muxtower/__init__.py

@@ -0,0 +1,6 @@
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("muxtower")  # the one in pyproject.toml, as installed
+except PackageNotFoundError:  # pragma: no cover - run without being installed
+    __version__ = "0.0.0"

muxtower/__main__.py

@@ -0,0 +1,3 @@
+from muxtower.cli.main import main
+
+main()

muxtower/agent_text.py

@@ -0,0 +1,31 @@
+"""Turning agent tool calls and long text into the short lines a phone or glasses can show."""
+
+import json
+from typing import Any
+
+DETAIL_LIMIT = 4000
+
+
+def truncate(text: str) -> str:
+    return text if len(text) <= DETAIL_LIMIT else text[:DETAIL_LIMIT] + "…"
+
+
+def tool_description(tool_input: Any) -> str | None:
+    """What the agent said a tool call does, when it said (Claude Code's Bash and Task take one)."""
+    value = tool_input.get("description") if isinstance(tool_input, dict) else None
+    return (value.strip()[:200] or None) if isinstance(value, str) else None
+
+
+def describe_tool_input(tool_input: Any) -> str | None:
+    """The one thing a human needs to judge a tool call: the command, the path, the URL…"""
+    if not isinstance(tool_input, dict):
+        return None
+    for key in ("command", "cmd", "file_path", "path", "url", "pattern", "query", "prompt", "plan"):
+        value = tool_input.get(key)
+        if isinstance(value, str) and value:
+            return truncate(value)
+    questions = tool_input.get("questions")
+    if isinstance(questions, list):
+        texts = [q.get("question", "") for q in questions if isinstance(q, dict)]
+        return truncate("\n".join(t for t in texts if t)) or None
+    return truncate(json.dumps(tool_input, ensure_ascii=False, indent=1)) if tool_input else None

muxtower/agents/__init__.py

@@ -0,0 +1,8 @@
+"""Coding agents muxtower knows beyond running them in a terminal, one package each.
+
+An agent plugin tells, for a tmux pane running it, which session of the agent that is (`ClaudeProcessPort`:
+its Remote Control id, transcript file and name) and reads its transcript into conversation items
+(`sessions.transcripts.TranscriptFormat`). `agents.processes.AgentProcesses` asks each plugin in turn.
+Claude Code's live in `sessions/claude_processes.py` and `claude_conversation.py`; Codex's here, in
+`agents/codex/`.
+"""

muxtower/agents/accounts.py

@@ -0,0 +1,91 @@
+"""The account each agent on this machine runs as, so sessions of different accounts can be told apart
+(two Claude accounts, Claude Code with an API key, Codex). Read from the agents' own login files, for
+who is logged in only: no token is kept, logged or sent anywhere. Re-read when a file changes.
+
+Claude Code (and its Remote Control sessions): `~/.claude.json` names the claude.ai account it signed in
+with; without one, an API key (`ANTHROPIC_API_KEY`) is "API key". Codex: `~/.codex/auth.json` holds a
+ChatGPT sign-in, whose ID token names its email, or an API key."""
+
+import base64
+import json
+import os
+from collections.abc import Callable, Mapping
+from pathlib import Path
+from typing import Any
+
+from muxtower.sessions.models import Session
+from muxtower.sessions.ports import SessionSource
+
+API_KEY = "API key"
+
+
+def _jwt_email(token: Any) -> str | None:
+    """The email claim of an ID token, read for display only (it is the agent's own; not verified)."""
+    if not isinstance(token, str) or token.count(".") != 2:
+        return None
+    payload = token.split(".")[1]
+    try:
+        claims = json.loads(base64.urlsafe_b64decode(payload + "=" * (-len(payload) % 4)))
+    except ValueError:
+        return None
+    email = claims.get("email") if isinstance(claims, dict) else None
+    return email if isinstance(email, str) and email else None
+
+
+class _Cached:
+    """A value read from a file, again only when the file changed."""
+
+    def __init__(self, path: Path, read: Callable[[dict[str, Any]], str | None]) -> None:
+        self.path = path
+        self.read = read
+        self._stamp: float | None = None
+        self._value: str | None = None
+
+    def get(self) -> str | None:
+        try:
+            stamp = self.path.stat().st_mtime
+        except OSError:
+            return None
+        if stamp != self._stamp:
+            try:
+                data = json.loads(self.path.read_text())
+                self._value = self.read(data) if isinstance(data, dict) else None
+            except (OSError, ValueError):
+                self._value = None
+            self._stamp = stamp
+        return self._value
+
+
+class Accounts:
+    def __init__(self, home: Path | None = None, env: Mapping[str, str] | None = None) -> None:
+        home = home or Path.home()
+        self.env = os.environ if env is None else env
+        self._claude = _Cached(home / ".claude.json", self._claude_account)
+        self._codex = _Cached(home / ".codex" / "auth.json", self._codex_account)
+
+    @staticmethod
+    def _claude_account(data: dict[str, Any]) -> str | None:
+        account = data.get("oauthAccount")
+        email = account.get("emailAddress") if isinstance(account, dict) else None
+        return email if isinstance(email, str) and email else None
+
+    @staticmethod
+    def _codex_account(data: dict[str, Any]) -> str | None:
+        tokens = data.get("tokens")
+        if data.get("auth_mode") != "apikey" and isinstance(tokens, dict):
+            if email := _jwt_email(tokens.get("id_token")):
+                return email
+        return API_KEY if data.get("OPENAI_API_KEY") else None
+
+    def claude(self) -> str | None:
+        return self._claude.get() or (API_KEY if self.env.get("ANTHROPIC_API_KEY") else None)
+
+    def codex(self) -> str | None:
+        return self._codex.get()
+
+    def __call__(self, session: Session) -> str | None:
+        if session.runtime == "codex" or session.source == SessionSource.CODEX:
+            return self.codex()
+        if session.runtime.startswith("claude") or session.source == SessionSource.REMOTE_CONTROL:
+            return self.claude()
+        return None

muxtower/agents/codex/processes.py

@@ -0,0 +1,66 @@
+"""Which Codex session a tmux pane runs.
+
+Codex keeps no file per process (Claude Code does), but while a session runs its process holds the
+session's rollout file open for appending: the pane's process, or one it started, has an open file
+`<codex home>/sessions/…/rollout-<time>-<thread id>.jsonl`. The rollout is the transcript; the thread's
+name (what `/rename` set, else its title) is in Codex's state database, read without writing. A
+session's rollout is only created with its first message, so a fresh Codex has none yet. Codex has no
+Remote Control, so no remote id.
+"""
+
+import os
+import re
+import sqlite3
+from pathlib import Path
+
+from muxtower.infra.procfs import Children, family
+from muxtower.sessions.claude_processes import ClaudeProcess
+
+SEARCH_DEPTH = 3
+THREAD_ID = re.compile(r"rollout-.*-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$")
+STATE_DB = "state_5.sqlite"
+
+
+class CodexProcesses:
+    def __init__(self, codex_home: Path | None = None, proc: Path = Path("/proc")) -> None:
+        self.home = codex_home or Path(os.environ.get("CODEX_HOME") or Path.home() / ".codex")
+        self.sessions = str(self.home / "sessions") + os.sep
+        self.proc = proc
+
+    def _rollout(self, pane_pid: int) -> str | None:
+        """The rollout file the pane's Codex holds open, if it runs one."""
+        for pid in family(pane_pid, Children(self.proc), SEARCH_DEPTH):
+            try:
+                fds = list((self.proc / str(pid) / "fd").iterdir())
+            except OSError:
+                continue
+            for fd in fds:
+                try:
+                    target = os.readlink(fd)
+                except OSError:
+                    continue
+                if target.startswith(self.sessions) and THREAD_ID.search(target):
+                    return target
+        return None
+
+    def remote_id(self, pane_pid: int) -> str | None:
+        return None
+
+    def transcript(self, pane_pid: int) -> str | None:
+        return self._rollout(pane_pid)
+
+    def name(self, pane_pid: int) -> str | None:
+        rollout = self._rollout(pane_pid)
+        found = THREAD_ID.search(rollout) if rollout else None
+        if not found:
+            return None
+        try:
+            with sqlite3.connect(f"file:{self.home / STATE_DB}?mode=ro", uri=True, timeout=1) as db:
+                row = db.execute("SELECT name, title FROM threads WHERE id = ?", (found.group(1),)).fetchone()
+        except sqlite3.Error:
+            return None
+        name = next((str(v).strip() for v in row or () if v and str(v).strip()), None)
+        return name[:80] if name else None
+
+    def running(self) -> dict[str, ClaudeProcess]:
+        return {}

muxtower/agents/codex/rollout.py

@@ -0,0 +1,155 @@
+"""A Codex session's conversation, read from its rollout file.
+
+Codex writes each session to `~/.codex/sessions/YYYY/MM/DD/rollout-<time>-<thread id>.jsonl`: one
+`{timestamp, type, payload}` per line. What the owner and the agent said are `event_msg`s
+(`user_message`, `agent_message`); tool calls are `response_item`s (`function_call`, `custom_tool_call`,
+`local_shell_call`, `web_search_call`) whose output arrives later under the same `call_id`; a turn ends
+with `task_complete` (or `turn_complete`, `turn_aborted`). Approval prompts are never written down, so
+the file cannot tell a waiting turn from a working one: the screen does.
+
+In "code mode" a tool call is a script (`custom_tool_call` named `exec`) that calls the real tools, as
+`tools.exec_command({"cmd": …})`: the first one it calls names the call.
+"""
+
+import json
+import re
+from datetime import datetime
+from typing import Any
+
+from muxtower.agent_text import describe_tool_input, truncate
+from muxtower.sessions.models import ConversationItem, ConversationItemKind, ItemStatus
+
+MAX_ITEMS = 2000
+TOOL_CALLS = {"function_call", "custom_tool_call", "local_shell_call", "web_search_call"}
+TOOL_OUTPUTS = {"function_call_output", "custom_tool_call_output", "local_shell_call_output"}
+TURN_ENDS = {"task_complete", "turn_complete"}
+ABORTED = {"turn_aborted", "task_aborted"}
+SCRIPT_CALL = re.compile(r"tools\.(\w+)\(\s*(\{.*?\})\s*\)", re.S)
+FAILED = re.compile(r"^(Script failed|Process exited with code [1-9])|Exit code: [1-9]", re.M)
+
+
+def _at(value: Any) -> datetime | None:
+    try:
+        return datetime.fromisoformat(str(value).replace("Z", "+00:00")) if value else None
+    except ValueError:
+        return None
+
+
+def _json(text: Any) -> Any:
+    try:
+        return json.loads(text) if isinstance(text, str) else text
+    except ValueError:
+        return None
+
+
+def _output_text(output: Any) -> str:
+    if isinstance(output, list):
+        return "\n".join(str(o.get("text") or "") for o in output if isinstance(o, dict))
+    return str(output or "")
+
+
+def tool_of(payload: dict[str, Any]) -> tuple[str, str | None]:
+    """The tool a call runs and the one line that says what it does."""
+    kind = payload.get("type")
+    if kind == "local_shell_call":
+        command = (payload.get("action") or {}).get("command")
+        return "exec_command", " ".join(command) if isinstance(command, list) else None
+    if kind == "web_search_call":
+        query = (payload.get("action") or {}).get("query")
+        return "web_search", str(query) if query else None
+    name = str(payload.get("name") or "tool")
+    if kind == "custom_tool_call" and name == "exec":  # code mode: a script calling tools
+        script = str(payload.get("input") or "")
+        found = SCRIPT_CALL.search(script)
+        if found:
+            args = _json(found.group(2))
+            return found.group(1), describe_tool_input(args) if isinstance(args, dict) else truncate(found.group(2))
+        return "exec", truncate(script) or None
+    args = _json(payload.get("arguments")) if kind == "function_call" else payload.get("input")
+    if isinstance(args, dict):
+        return name, describe_tool_input(args)
+    return name, truncate(str(args)) if args else None
+
+
+class RolloutBuilder:
+    """Rollout lines → conversation items, in the order written; a tool call's item is sent again once
+    its output tells how it ended."""
+
+    def __init__(self) -> None:
+        self.items: dict[int, ConversationItem] = {}
+        self._calls: dict[str, int] = {}  # call_id → its item's seq
+        self._seq = 0
+
+    @property
+    def last_reply(self) -> str | None:
+        for seq in sorted(self.items, reverse=True):
+            if self.items[seq].kind == ConversationItemKind.REPLY:
+                return self.items[seq].text
+        return None
+
+    def after(self, seq: int, limit: int) -> list[ConversationItem]:
+        newer = [self.items[s] for s in sorted(self.items) if s > seq]
+        return newer[-limit:] if seq == 0 else newer[:limit]
+
+    def feed_lines(self, lines: list[bytes]) -> list[ConversationItem]:
+        touched: dict[int, ConversationItem] = {}
+        for line in lines:
+            self._seq += 1
+            try:
+                record = json.loads(line)
+            except ValueError:
+                continue
+            if isinstance(record, dict) and isinstance(record.get("payload"), dict):
+                for item in self._apply(str(record.get("type")), record["payload"], _at(record.get("timestamp"))):
+                    self.items[item.seq] = item
+                    touched[item.seq] = item
+        for seq in sorted(self.items)[:-MAX_ITEMS]:
+            del self.items[seq]
+        return [touched[s] for s in sorted(touched)]
+
+    def _item(self, kind: ConversationItemKind, at: datetime | None, **fields: Any) -> ConversationItem:
+        return ConversationItem(seq=self._seq, at=at, kind=kind, **fields)
+
+    def _finish(self, call_id: Any, status: ItemStatus) -> list[ConversationItem]:
+        seq = self._calls.get(str(call_id))
+        item = self.items.get(seq) if seq is not None else None
+        if item is None or item.status == ItemStatus.ERROR:
+            return []
+        return [item.model_copy(update={"status": status})]
+
+    def _apply(self, kind: str, payload: dict[str, Any], at: datetime | None) -> list[ConversationItem]:
+        sub = payload.get("type")
+        if kind == "event_msg":
+            if sub == "user_message" and (text := str(payload.get("message") or "").strip()):
+                return [self._item(ConversationItemKind.PROMPT, at, text=text)]
+            if sub == "agent_message" and (text := str(payload.get("message") or "").strip()):
+                return [self._item(ConversationItemKind.REPLY, at, text=text)]
+            if sub == "exec_command_end" and payload.get("exit_code") not in (0, None):
+                return self._finish(payload.get("call_id"), ItemStatus.ERROR)
+            if sub in TURN_ENDS:
+                return [self._item(ConversationItemKind.RESULT, at, status=ItemStatus.DONE)]
+            if sub in ABORTED:
+                reason = str(payload.get("reason") or "interrupted")
+                return [self._item(ConversationItemKind.RESULT, at, text=reason, status=ItemStatus.ERROR)]
+            if sub == "error" and (text := str(payload.get("message") or "").strip()):
+                return [self._item(ConversationItemKind.RESULT, at, text=text, status=ItemStatus.ERROR)]
+            return []
+        if kind != "response_item":
+            return []
+        if sub in TOOL_CALLS:
+            name, what = tool_of(payload)
+            done = sub == "web_search_call" or payload.get("status") == "failed"
+            status = (
+                ItemStatus.ERROR
+                if payload.get("status") == "failed"
+                else ItemStatus.DONE
+                if done
+                else ItemStatus.RUNNING
+            )
+            if call_id := payload.get("call_id"):
+                self._calls[str(call_id)] = self._seq
+            return [self._item(ConversationItemKind.TOOL, at, tool_name=name, text=what, status=status)]
+        if sub in TOOL_OUTPUTS:
+            failed = FAILED.search(_output_text(payload.get("output")))
+            return self._finish(payload.get("call_id"), ItemStatus.ERROR if failed else ItemStatus.DONE)
+        return []

muxtower/agents/processes.py

@@ -0,0 +1,22 @@
+"""Every agent plugin's answer for a pane, asked in turn: the first that recognizes the pane's agent
+answers (a pane runs one agent; each plugin finds only its own)."""
+
+from muxtower.sessions.claude_processes import ClaudeProcess
+from muxtower.sessions.ports import ClaudeProcessPort
+
+
+class AgentProcesses:
+    def __init__(self, plugins: list[ClaudeProcessPort]) -> None:
+        self.plugins = plugins
+
+    def remote_id(self, pane_pid: int) -> str | None:
+        return next((found for p in self.plugins if (found := p.remote_id(pane_pid))), None)
+
+    def transcript(self, pane_pid: int) -> str | None:
+        return next((found for p in self.plugins if (found := p.transcript(pane_pid))), None)
+
+    def name(self, pane_pid: int) -> str | None:
+        return next((found for p in self.plugins if (found := p.name(pane_pid))), None)
+
+    def running(self) -> dict[str, ClaudeProcess]:
+        return {k: v for p in self.plugins for k, v in p.running().items()}

muxtower/app.py

@@ -0,0 +1,242 @@
+"""FastAPI application factory: builds adapters and services, keeps them on app.state, starts loops."""
+
+import asyncio
+import logging
+import socket
+import sys
+from collections.abc import AsyncIterator
+from contextlib import asynccontextmanager
+
+from fastapi import FastAPI, Request
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse
+
+from muxtower import __version__
+from muxtower.agents.accounts import Accounts
+from muxtower.agents.codex.processes import CodexProcesses
+from muxtower.agents.processes import AgentProcesses
+from muxtower.approval.auto import AutoApprover
+from muxtower.approval.service import ApprovalService
+from muxtower.asr.routes import router as asr_router
+from muxtower.auth.deps import DAEMON_AUTH_HEADER
+from muxtower.auth.pairing import PairingService
+from muxtower.auth.routes import router as auth_router
+from muxtower.auth.stream_cookie import StreamCookieSigner
+from muxtower.builders import (
+    build_asr,
+    build_codex,
+    build_remote_control,
+    build_summaries,
+    build_token_service,
+)
+from muxtower.concierge.service import ConciergeService
+from muxtower.concierge.store import FileConciergeStore
+from muxtower.config import Settings
+from muxtower.errors import Conflict, Forbidden, Invalid, NotFound, TooManyRequests, Unauthorized, Unavailable
+from muxtower.hooks.routes import router as hooks_router
+from muxtower.infra.audit import AuditLog
+from muxtower.infra.bus import EventBus
+from muxtower.infra.db import Database
+from muxtower.infra.tmux import TmuxCli, TmuxError
+from muxtower.mcp.routes import router as mcp_router
+from muxtower.mcp.service import McpTools
+from muxtower.net import ClientAddress
+from muxtower.nodes import protocol as node_protocol
+from muxtower.nodes.api import NodeApi
+from muxtower.nodes.client import HubClient
+from muxtower.nodes.directory import HubDirectory
+from muxtower.nodes.hub import Nodes
+from muxtower.nodes.processes import NodeProcesses
+from muxtower.nodes.repository import SqliteNodeRepository
+from muxtower.nodes.routes import router as nodes_router
+from muxtower.nodes.source import NodeSource
+from muxtower.nodes.store import HubStore
+from muxtower.nodes.update import Updater
+from muxtower.notify.repository import SqliteSubscriptionRepository
+from muxtower.notify.routes import router as push_router
+from muxtower.notify.service import PushService
+from muxtower.notify.webpush_sender import WebPushSender
+from muxtower.origins import OriginPolicy
+from muxtower.runtimes.spec import load_runtimes
+from muxtower.sessions.archive import SessionArchive
+from muxtower.sessions.archive_repository import SqliteArchiveRepository
+from muxtower.sessions.archiving import Archiver
+from muxtower.sessions.claude_processes import ClaudeProcesses
+from muxtower.sessions.launcher import Launcher
+from muxtower.sessions.marks import SessionMarks, SqliteMarksRepository
+from muxtower.sessions.monitor import Monitor
+from muxtower.sessions.placement import Placements
+from muxtower.sessions.ports import SessionSourcePort
+from muxtower.sessions.repository import SqliteSessionRepository
+from muxtower.sessions.routes import router as sessions_router
+from muxtower.sessions.service import SessionConfig, SessionService
+from muxtower.sessions.transcripts import Transcripts
+from muxtower.sessions.turns import TurnWatcher
+from muxtower.sources.codex.service import CodexSource
+from muxtower.sources.remote_control.service import RemoteControlSource
+from muxtower.summaries.routes import router as summaries_router
+from muxtower.system.routes import router as system_router
+from muxtower.terminal.ports import TmuxPort
+from muxtower.terminal.service import TerminalService
+from muxtower.terminal.stream import router as stream_router
+from muxtower.web import mount_ui
+
+logger = logging.getLogger("muxtower")
+
+
+def _log_crash(task: asyncio.Task[None]) -> None:
+    if not task.cancelled() and task.exception() is not None:
+        logger.error("background task %s crashed", task.get_name(), exc_info=task.exception())
+
+
+def create_app(
+    settings: Settings,
+    tmux: TmuxPort | None = None,
+    run_loops: bool = True,
+    remote_control: RemoteControlSource | None = None,
+    codex: CodexSource | None = None,
+) -> FastAPI:
+    db = Database(settings.db_path)
+    tokens = build_token_service(settings, db)
+    daemon_name = settings.name or socket.gethostname()
+    bus = EventBus()
+    sessions = SessionService(
+        SqliteSessionRepository(db),
+        tmux or TmuxCli(),
+        load_runtimes(settings.config_dir / "runtimes"),
+        SessionConfig(settings.tmux_socket, settings.adopt_sockets, settings.local_url, settings.state_dir),
+    )
+    remote_control = remote_control or build_remote_control(settings)
+    codex = codex or build_codex(settings)
+    sources: list[SessionSourcePort] = [s for s in (remote_control, codex) if s is not None]
+    # Links panes to their agent's session: Remote Control, transcript, name (one plugin per agent).
+    processes = AgentProcesses([ClaudeProcesses(), CodexProcesses()])
+    monitor = Monitor(sessions, processes)
+    approvals = ApprovalService(sessions)
+    terminal = TerminalService(sessions, monitor)
+    summaries = build_summaries(settings, db)
+    marks = SessionMarks(SqliteMarksRepository(db))
+    transcripts = Transcripts()
+    archive = SessionArchive(SqliteArchiveRepository(db), transcripts)
+    audit = AuditLog(db)
+    # Daemons joined to this one (nodes): their sessions are one more source.
+    nodes = Nodes(SqliteNodeRepository(db), bus)
+    node_sessions = NodeSource(nodes)
+    node_processes = NodeProcesses(nodes)  # where the Remote Control sessions listed here run, if on a node
+    processes.plugins.append(node_processes)
+    directory = HubDirectory(
+        sessions, terminal, approvals, sources, summaries, daemon_name, processes,
+        marks, transcripts, archive, Accounts(), nodes=node_sessions, node_processes=node_processes,
+    )  # fmt: skip
+    launcher = Launcher(directory, [codex] if codex else [], node_sessions)
+    archiver = Archiver(directory, archive)
+    placements = Placements(directory, marks)
+    # This daemon as a node of a hub, once it joined one (`muxtower pair --join`).
+    hub = HubClient(
+        HubStore(settings.state_dir / "hub.json"), settings.hub.headers,
+        NodeApi(directory, launcher, archiver, placements, audit, processes), monitor, bus,
+        lambda: node_protocol.Hello(
+            protocol=node_protocol.PROTOCOL, name=daemon_name, version=__version__, runtimes=launcher.runtimes(),
+            platform=sys.platform,
+        ),
+        Updater(settings.hub.update),
+    )  # fmt: skip
+    concierge: ConciergeService | None = None
+    if settings.concierge.enabled:
+        store = FileConciergeStore(settings.state_dir / "concierge.json", settings.state_dir / "concierge")
+        mcp_url = f"{settings.local_url}/v1/mcp"
+        concierge = ConciergeService(settings.concierge, sessions, directory, tokens, store, mcp_url)
+    push = PushService(
+        SqliteSubscriptionRepository(db), WebPushSender(settings.state_dir), directory, daemon_name, tokens.exists
+    )
+
+    @asynccontextmanager
+    async def lifespan(app: FastAPI) -> AsyncIterator[None]:
+        tasks: list[asyncio.Task[None]] = []
+        if run_loops:
+            loops = {
+                "monitor": monitor.run_loop(bus, settings.tick_seconds),
+                "push": push.run_loop(bus),
+                "turns": TurnWatcher(marks.finished).run_loop(bus, directory.list),
+                "transcripts": transcripts.run_loop(bus, directory.transcript_paths),
+                "auto-approve": AutoApprover(approvals, audit).run_loop(bus),
+            }
+            if summaries.available:
+
+                def reply_of(session_id: str) -> str | None:
+                    session = directory.find(session_id)
+                    return session.last_message if session else None
+
+                loops["summaries"] = summaries.run_loop(bus, reply_of, settings.summaries.eager)
+            if concierge is not None:
+                loops["concierge"] = concierge.run_loop(bus)
+            if remote_control is not None:
+                loops["remote-control"] = remote_control.run_loop(bus, settings.remote_control.poll_seconds)
+            if codex is not None:
+                loops["codex"] = codex.run_loop(bus)
+            loops["hub"] = hub.run_loop()
+            for name, coro in loops.items():
+                task = asyncio.create_task(coro, name=name)
+                task.add_done_callback(_log_crash)
+                tasks.append(task)
+        yield
+        for task in tasks:
+            task.cancel()
+        if codex is not None:
+            codex.port.close()
+
+    app = FastAPI(title="muxtower", version="1", lifespan=lifespan)  # the API's (/v1): a release leaves the contract be
+    app.state.settings = settings
+    app.state.daemon_name = daemon_name
+    app.state.tokens = tokens
+    app.state.origins = OriginPolicy(settings.cors.allowed_origins)
+    app.state.bus = bus
+    app.state.sessions = sessions
+    app.state.monitor = monitor
+    app.state.directory = directory
+    app.state.placements = placements
+    app.state.archiver = archiver
+    app.state.launcher = launcher
+    app.state.nodes = nodes
+    app.state.hub = hub
+    app.state.summaries = summaries
+    app.state.concierge = concierge
+    app.state.mcp = McpTools(directory, sessions, concierge, daemon_name)
+    app.state.asr = build_asr(settings, lambda: [s.name for s in directory.list()])
+    app.state.terminal = terminal
+    app.state.approvals = approvals
+    app.state.audit = audit
+    app.state.push = push
+    app.state.pairing = PairingService(db, tokens, settings.pairing, daemon_name)
+    app.state.stream_cookies = StreamCookieSigner(settings.state_dir)
+    app.state.client_address = ClientAddress(settings.trusted_proxies)
+
+    if settings.cors.allowed_origins:
+        app.add_middleware(
+            CORSMiddleware,
+            allow_origins=settings.cors.allowed_origins,
+            allow_credentials=False,  # bearer tokens only; the stream cookie is same-origin
+            allow_methods=["GET", "POST", "PATCH", "DELETE"],
+            allow_headers=["Authorization", "Content-Type", *settings.cors.extra_headers],
+            expose_headers=list(DAEMON_AUTH_HEADER),
+            max_age=600,
+        )
+
+    errors = ((NotFound, 404), (Invalid, 400), (Conflict, 409), (Forbidden, 403), (Unauthorized, 401),
+              (TooManyRequests, 429), (TmuxError, 502), (Unavailable, 502))  # fmt: skip
+    for error, status in errors:
+
+        def handler(_: Request, exc: Exception, status: int = status) -> JSONResponse:
+            headers = DAEMON_AUTH_HEADER if status == 401 else None
+            return JSONResponse({"detail": str(exc)}, status_code=status, headers=headers)
+
+        app.add_exception_handler(error, handler)
+
+    routers = (system_router, auth_router, sessions_router, summaries_router, asr_router, mcp_router, stream_router,
+               push_router, hooks_router, nodes_router)  # fmt: skip
+    for router in routers:
+        app.include_router(router)
+
+    if settings.serve_ui:
+        mount_ui(app, settings.public_url, daemon_name)
+    return app