Function runForegroundSession

apps/cli/src/main.ts:1064–1141

(input: {
  port: number;
  hostname: string;
  allowedHosts: ReadonlyArray<string>;
  authToken: string | undefined;
})

// ---------------------------------------------------------------------------

const runForegroundSession = (input: {
  port: number;
  hostname: string;
  allowedHosts: ReadonlyArray<string>;
  authToken: string | undefined;
}) =>
  Effect.gen(function* () {
    const displayHost =
      input.hostname === "0.0.0.0" || input.hostname === "::" ? "localhost" : input.hostname;
    const restoreWebBaseUrl = installDefaultExecutorWebBaseUrl(
      `http://${displayHost}:${input.port}`,
    );

    try {
      // No process-level startup lock: the DB ownership lock acquired inside
      // startServer (openOwnedLocalDatabase) is the real gate. server.json is
      // only an attach hint, and assertNoOtherActiveLocalServer is a friendly
      // fast-path that may race without being unsafe.
      yield* assertNoOtherActiveLocalServer();
      const startResult = yield* startServerOrAttachOwnedDataDir({
        port: input.port,
        hostname: input.hostname,
        allowedHosts: input.allowedHosts,
        authToken: input.authToken,
        embeddedWebUI,
      });
      if (startResult.kind === "attached") {
        console.log(`Executor is already running at ${startResult.manifest.connection.origin}.`);
        return;
      }
      const server = startResult.server;
      const baseUrl = `http://${displayHost}:${server.port}`;
      yield* publishLocalServerManifest({
        kind: "foreground",
        connection: normalizeExecutorServerConnection({
          kind: "http",
          origin: baseUrl,
          displayName: "CLI web",
          auth: { kind: "bearer", token: server.authToken },
        }),
      });

      try {
        console.log(`Executor is ready.`);
        console.log(`Open:    ${baseUrl}/?_token=${server.authToken}`);
        console.log(`Web:     ${baseUrl}`);
        console.log(`MCP:     ${baseUrl}/mcp`);
        console.log(`OpenAPI: ${baseUrl}/api/docs`);
        if (input.hostname !== "127.0.0.1" && input.hostname !== "localhost") {
          console.log(
            `\n⚠  Listening on ${input.hostname}. Executor runs arbitrary commands — only expose on trusted networks.`,
          );
          if (input.allowedHosts.length > 0) {
            console.log(`   Extra CORS origins: ${input.allowedHosts.join(", ")}`);
          }
        }

        // Best-effort upgrade nudge. `checkForUpdate` never throws and bounds