X056 Gateway v1.5 (Remote Access + Docker Compose) Implementation Plan

server/manager.ts            Task 1  SessionManager + EmittingLog + ring buffer
test/manager.test.ts         Task 1
server/auth.guard.ts         Task 2  bearer/query token guard
server/api.controller.ts     Task 2  REST + SSE endpoints
server/app.module.ts         Task 2
server/main.ts               Task 2  bootstrap (exported createApp for tests)
test/gateway.test.ts         Task 2  HTTP e2e over fake-claude
server/public/panel.html     Task 3  static panel
Dockerfile, compose.yaml,
.dockerignore, docs/ACCESS.md Task 4
(deploy + smoke)             Task 5

import { mkdtempSync, readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { join } from 'node:path';
import { describe, expect, it } from 'vitest';
import { AccountRegistry } from '../src/accounts.js';
import type { RunSessionOptions, SessionResult } from '../src/failover.js';
import { BusyError, SessionManager, type GatewayEvent } from '../server/manager.js';

function fixture(result: SessionResult, opts?: { emitEvents?: boolean; delayMs?: number }) {
  const dir = mkdtempSync(join(tmpdir(), 'x056-mgr-'));
  const stateDir = join(dir, 'state');
  mkdirSync(stateDir, { recursive: true });
  AccountRegistry.init(join(stateDir, 'accounts.json'), [
    { name: 'a', configDir: '/cfg/a' },
    { name: 'b', configDir: '/cfg/b' },
  ]);
  const calls: RunSessionOptions[] = [];
  const runSessionFn = (async (o: RunSessionOptions) => {
    calls.push(o);
    if (opts?.emitEvents !== false) {
      o.tap?.({ type: 'assistant', message: { content: [{ type: 'text', text: 'hello from claude' }] } });
      o.log.append({ type: 'failover', sessionId: o.sessionId, from: 'a' });
    }
    await new Promise((r) => setTimeout(r, opts?.delayMs ?? 20));
    return result;
  }) as unknown as typeof import('../src/failover.js').runSession;
  const mgr = new SessionManager({ stateDir, workspaceRoot: dir, runSessionFn });
  return { mgr, calls, dir, stateDir };
}

const COMPLETED: SessionResult = { status: 'completed', finalAccount: 'b', failovers: 1, resultText: 'done' };

async function waitFor(pred: () => boolean, ms = 2000): Promise<void> {
  const t0 = Date.now();
  while (!pred()) {
    if (Date.now() - t0 > ms) throw new Error('waitFor timeout');
    await new Promise((r) => setTimeout(r, 10));
  }
}

describe('SessionManager', () => {
  it('runs a session, emits assistant text + log + lifecycle events, persists state', async () => {
    const { mgr, calls, dir, stateDir } = fixture(COMPLETED);
    const seen: GatewayEvent[] = [];
    mgr.subscribe((e) => seen.push(e));
    const sid = mgr.start('do it');
    expect(calls[0]?.prompt ?? '').toBe('do it');
    await waitFor(() => mgr.snapshot().running === false && seen.some((e) => e.kind === 'session_done'));
    const kinds = seen.map((e) => e.kind);
    expect(kinds).toEqual(expect.arrayContaining(['session_started', 'assistant_text', 'supervisor', 'session_done']));
    expect(seen.find((e) => e.kind === 'assistant_text')?.data.text).toBe('hello from claude');
    expect(seen.find((e) => e.kind === 'supervisor')?.data.type).toBe('failover');
    const st = JSON.parse(readFileSync(join(stateDir, 'state.json'), 'utf8'));
    expect(st.lastSessionId).toBe(sid);
    expect(st.cwd).toBe(dir);
    expect(mgr.snapshot().lastResult).toEqual(COMPLETED);
  });

  it('rejects concurrent starts with BusyError and allows continue after completion', async () => {
    const { mgr, calls } = fixture(COMPLETED, { delayMs: 100 });
    mgr.start('first');
    expect(() => mgr.start('second')).toThrow(BusyError);
    await waitFor(() => mgr.snapshot().running === false);
    const sid2 = mgr.continueLast('again');
    expect(sid2).toBe(mgr.snapshot().currentSessionId ?? sid2);
    await waitFor(() => mgr.snapshot().running === false);
    expect(calls[1]?.resume).toBe(true);
    expect(calls[1]?.sessionId).toBe(calls[0]?.sessionId);
  });

  it('continueLast without prior session throws', () => {
    const { mgr } = fixture(COMPLETED);
    expect(() => mgr.continueLast('x')).toThrow(/no previous session/);
  });

  it('rejects cwd outside workspace root', () => {
    const { mgr } = fixture(COMPLETED);
    expect(() => mgr.start('x', '/etc')).toThrow(/outside workspace root/);
  });

  it('replays buffered events to late subscribers from sinceSeq', async () => {
    const { mgr } = fixture(COMPLETED);
    mgr.start('task');
    await waitFor(() => mgr.snapshot().running === false);
    const all: GatewayEvent[] = [];
    mgr.subscribe((e) => all.push(e));
    expect(all.length).toBeGreaterThanOrEqual(3);
    const later: GatewayEvent[] = [];
    mgr.subscribe((e) => later.push(e), all[1].seq);
    expect(later[0].seq).toBe(all[2].seq);
  });

  it('forceSwitch returns false when idle', () => {
    const { mgr } = fixture(COMPLETED);
    expect(mgr.forceSwitch()).toBe(false);
  });
});

import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
import { randomUUID } from 'node:crypto';
import { join, resolve, sep } from 'node:path';
import { AccountRegistry } from '../src/accounts.js';
import { EventLog } from '../src/eventlog.js';
import { runSession, type SessionResult } from '../src/failover.js';
import type { RawEvent } from '../src/types.js';

export interface GatewayEvent {
  seq: number;
  ts: string;
  kind: string;
  data: Record<string, unknown>;
}

export class BusyError extends Error {
  constructor() {
    super('a session is already running');
  }
}

export interface SessionManagerOptions {
  stateDir: string;
  workspaceRoot: string;
  claudePath?: string;
  runSessionFn?: typeof runSession;
}

const BUFFER_MAX = 1000;

/** EventLog that also forwards every supervisor row to the gateway stream. */
class EmittingLog extends EventLog {
  constructor(file: string, private readonly emit: (kind: string, data: Record<string, unknown>) => void) {
    super(file);
  }
  override append(event: Record<string, unknown>): void {
    super.append(event);
    this.emit('supervisor', event);
  }
}

interface PersistedState {
  lastSessionId?: string;
  cwd?: string;
}

export class SessionManager {
  private buffer: GatewayEvent[] = [];
  private seq = 0;
  private subscribers = new Set<(e: GatewayEvent) => void>();
  private running = false;
  private currentSessionId: string | null = null;
  private lastResult: SessionResult | null = null;

  constructor(private readonly opts: SessionManagerOptions) {
    mkdirSync(opts.stateDir, { recursive: true });
  }

  private get stateFile(): string {
    return join(this.opts.stateDir, 'state.json');
  }

  private loadState(): PersistedState {
    return existsSync(this.stateFile)
      ? (JSON.parse(readFileSync(this.stateFile, 'utf8')) as PersistedState)
      : {};
  }

  private emit(kind: string, data: Record<string, unknown>): void {
    const e: GatewayEvent = { seq: ++this.seq, ts: new Date().toISOString(), kind, data };
    this.buffer.push(e);
    if (this.buffer.length > BUFFER_MAX) this.buffer.splice(0, this.buffer.length - BUFFER_MAX);
    for (const fn of this.subscribers) {
      try {
        fn(e);
      } catch {
        // subscriber errors must not affect the session
      }
    }
  }

  private resolveCwd(cwd: string): string {
    const root = realpathSync(this.opts.workspaceRoot);
    const target = realpathSync(resolve(cwd));
    if (target !== root && !target.startsWith(root + sep)) {
      throw new Error(`cwd outside workspace root: ${cwd}`);
    }
    return target;
  }

  start(prompt: string, cwd?: string): string {
    if (this.running) throw new BusyError();
    const dir = this.resolveCwd(cwd ?? this.opts.workspaceRoot);
    const sessionId = randomUUID();
    this.launch(sessionId, prompt, dir, false);
    return sessionId;
  }

  continueLast(prompt: string): string {
    if (this.running) throw new BusyError();
    const st = this.loadState();
    if (!st.lastSessionId) throw new Error('no previous session — start one first');
    const dir = this.resolveCwd(st.cwd ?? this.opts.workspaceRoot);
    this.launch(st.lastSessionId, prompt, dir, true);
    return st.lastSessionId;
  }

  private launch(sessionId: string, prompt: string, cwd: string, resume: boolean): void {
    this.running = true;
    this.currentSessionId = sessionId;
    const runFn = this.opts.runSessionFn ?? runSession;
    const registry = AccountRegistry.load(join(this.opts.stateDir, 'accounts.json'));
    const log = new EmittingLog(join(this.opts.stateDir, 'events.jsonl'), (k, d) => this.emit(k, d));
    let stateSaved = resume;
    const saveStateOnce = () => {
      if (!stateSaved) {
        writeFileSync(this.stateFile, JSON.stringify({ lastSessionId: sessionId, cwd }));
        stateSaved = true;
      }
    };
    this.emit('session_started', { sessionId, cwd, resume, prompt });
    void runFn({
      registry,
      log,
      sessionId,
      cwd,
      prompt,
      resume,
      claudePath: this.opts.claudePath,
      tap: (e: RawEvent) => {
        saveStateOnce();
        this.tapToEvents(e);
      },
    })
      .then((res) => {
        this.lastResult = res;
        this.emit('session_done', { sessionId, ...res });
      })
      .catch((err: unknown) => {
        this.emit('session_error', { sessionId, message: (err as Error).message });
      })
      .finally(() => {
        this.running = false;
        this.currentSessionId = null;
      });
  }

  private tapToEvents(e: RawEvent): void {
    if (e.type !== 'assistant') return;
    const msg = e.message as { content?: unknown } | undefined;
    const content = Array.isArray(msg?.content) ? msg.content : [];
    for (const block of content) {
      if (block && typeof block === 'object' && (block as { type?: string }).type === 'text') {
        const text = (block as { text?: unknown }).text;
        if (typeof text === 'string' && text.length > 0) this.emit('assistant_text', { text });
      }
    }
  }

  subscribe(fn: (e: GatewayEvent) => void, sinceSeq = 0): () => void {
    for (const e of this.buffer) {
      if (e.seq > sinceSeq) fn(e);
    }
    this.subscribers.add(fn);
    return () => this.subscribers.delete(fn);
  }

  snapshot(): {
    running: boolean;
    currentSessionId: string | null;
    lastSessionId: string | null;
    lastResult: SessionResult | null;
  } {
    return {
      running: this.running,
      currentSessionId: this.currentSessionId,
      lastSessionId: this.loadState().lastSessionId ?? null,
      lastResult: this.lastResult,
    };
  }

  forceSwitch(): boolean {
    if (!this.running) return false;
    process.kill(process.pid, 'SIGUSR1');
    return true;
  }
}

git add server/manager.ts test/manager.test.ts
git commit -m "feat: add gateway session manager with event ring buffer"

npm install @nestjs/common@^11 @nestjs/core@^11 @nestjs/platform-express@^11 reflect-metadata@^0.2 rxjs@^7

    "experimentalDecorators": true,
    "emitDecoratorMetadata": true

import { mkdtempSync, writeFileSync, mkdirSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { join } from 'node:path';
import { afterAll, beforeAll, describe, expect, it } from 'vitest';
import type { INestApplication } from '@nestjs/common';
import { AccountRegistry } from '../src/accounts.js';
import { createApp } from '../server/main.js';

const FAKE = new URL('./bin/fake-claude', import.meta.url).pathname;
const TOKEN = 'test-token-0123456789abcdefghij';

let app: INestApplication;
let base = '';
let dir = '';

beforeAll(async () => {
  dir = mkdtempSync(join(tmpdir(), 'x056-gw-'));
  const stateDir = join(dir, 'state');
  mkdirSync(stateDir, { recursive: true });
  AccountRegistry.init(join(stateDir, 'accounts.json'), [
    { name: 'a', configDir: join(dir, 'cfg-a') },
    { name: 'b', configDir: join(dir, 'cfg-b') },
  ]);
  const scenarioA = join(dir, 'a.jsonl');
  writeFileSync(scenarioA, [
    JSON.stringify({ event: { type: 'system', subtype: 'init', session_id: 'gw' } }),
    JSON.stringify({ event: { type: 'assistant', message: { content: [{ type: 'text', text: 'working on it' }] } } }),
    JSON.stringify({ delayMs: 20 }),
    JSON.stringify({ event: { type: 'system', subtype: 'api_retry', attempt: 1, max_retries: 10, retry_delay_ms: 1000, error_status: 429, error: 'rate_limit' } }),
    JSON.stringify({ hang: true }),
  ].join('\n'));
  const scenarioB = join(dir, 'b.jsonl');
  writeFileSync(scenarioB, [
    JSON.stringify({ event: { type: 'assistant', message: { content: [{ type: 'text', text: 'finishing on b' }] } } }),
    JSON.stringify({ event: { type: 'result', subtype: 'success', is_error: false, api_error_status: null, result: 'done on b' } }),
    JSON.stringify({ exit: 0 }),
  ].join('\n'));
  process.env.X056_FAKE_SCENARIO = scenarioA;
  process.env.X056_FAKE_SCENARIO_RESUME = scenarioB;

  app = await createApp({ token: TOKEN, stateDir, workspaceRoot: dir, claudePath: FAKE });
  await app.listen(0);
  base = await app.getUrl();
});

afterAll(async () => {
  delete process.env.X056_FAKE_SCENARIO;
  delete process.env.X056_FAKE_SCENARIO_RESUME;
  await app?.close();
});

const auth = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };

describe('gateway e2e', () => {
  it('healthz is open, api is locked', async () => {
    expect((await fetch(`${base}/healthz`)).status).toBe(200);
    expect((await fetch(`${base}/api/accounts`)).status).toBe(401);
    expect((await fetch(`${base}/api/accounts`, { headers: { Authorization: 'Bearer wrong' } })).status).toBe(401);
  });

  it('serves the panel unauthenticated with no token inside', async () => {
    const res = await fetch(`${base}/`);
    expect(res.status).toBe(200);
    const html = await res.text();
    expect(html).toContain('x056');
    expect(html).not.toContain(TOKEN);
  });

  it('runs a full failover session over HTTP + SSE', async () => {
    const started = await fetch(`${base}/api/sessions`, { method: 'POST', headers: auth, body: JSON.stringify({ prompt: 'do the task' }) });
    expect(started.status).toBe(201);
    const { sessionId } = (await started.json()) as { sessionId: string };
    expect(sessionId).toMatch(/[0-9a-f-]{36}/);

    // busy guard
    const busy = await fetch(`${base}/api/sessions`, { method: 'POST', headers: auth, body: JSON.stringify({ prompt: 'nope' }) });
    expect(busy.status).toBe(409);

    // SSE via query token
    const stream = await fetch(`${base}/api/sessions/current/stream?token=${TOKEN}`);
    expect(stream.status).toBe(200);
    expect(stream.headers.get('content-type')).toContain('text/event-stream');
    const reader = stream.body!.getReader();
    const decoder = new TextDecoder();
    let text = '';
    const t0 = Date.now();
    while (!text.includes('session_done') && Date.now() - t0 < 15000) {
      const { value, done } = await reader.read();
      if (done) break;
      text += decoder.decode(value, { stream: true });
    }
    await reader.cancel().catch(() => {});
    expect(text).toContain('assistant_text');
    expect(text).toContain('working on it');
    expect(text).toContain('failover');
    expect(text).toContain('finishing on b');
    expect(text).toContain('session_done');
  }, 20000);

  it('accounts endpoint returns registry state with quota errors handled gracefully', async () => {
    const res = await fetch(`${base}/api/accounts`, { headers: auth });
    expect(res.status).toBe(200);
    const body = (await res.json()) as { name: string; state: unknown; quota: unknown; quotaError?: string }[];
    expect(body.map((a) => a.name)).toEqual(['a', 'b']);
    expect(body[0].quotaError).toBeTruthy(); // fake cfg dirs have no credentials
  });

  it('switch returns 409 when idle', async () => {
    const res = await fetch(`${base}/api/switch`, { method: 'POST', headers: auth });
    expect(res.status).toBe(409);
  });

  it('cwd outside workspace root is a 400', async () => {
    const res = await fetch(`${base}/api/sessions`, { method: 'POST', headers: auth, body: JSON.stringify({ prompt: 'x', cwd: '/etc' }) });
    expect(res.status).toBe(400);
  });
});

import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common';
import { createHash, timingSafeEqual } from 'node:crypto';
import type { Request } from 'express';

export const TOKEN_KEY = Symbol('x056-token');

function safeEqual(a: string, b: string): boolean {
  const ha = createHash('sha256').update(a).digest();
  const hb = createHash('sha256').update(b).digest();
  return timingSafeEqual(ha, hb);
}

@Injectable()
export class AuthGuard implements CanActivate {
  constructor(private readonly token: string) {}

  canActivate(ctx: ExecutionContext): boolean {
    const req = ctx.switchToHttp().getRequest<Request>();
    const header = req.headers.authorization ?? '';
    const bearer = header.startsWith('Bearer ') ? header.slice(7) : '';
    const query = typeof req.query.token === 'string' ? req.query.token : '';
    const presented = bearer || query;
    if (!presented || !safeEqual(presented, this.token)) throw new UnauthorizedException();
    return true;
  }
}

import {
  BadRequestException,
  Body,
  ConflictException,
  Controller,
  Get,
  HttpCode,
  Post,
  Query,
  Res,
} from '@nestjs/common';
import type { Response } from 'express';
import { AccountRegistry } from '../src/accounts.js';
import { fetchUsage } from '../src/quota.js';
import { join } from 'node:path';
import { BusyError, SessionManager } from './manager.js';

@Controller('api')
export class ApiController {
  constructor(
    private readonly manager: SessionManager,
    private readonly stateDir: string,
  ) {}

  @Post('sessions')
  startSession(@Body() body: { prompt?: string; cwd?: string }): { sessionId: string } {
    if (!body?.prompt) throw new BadRequestException('prompt required');
    try {
      return { sessionId: this.manager.start(body.prompt, body.cwd) };
    } catch (err) {
      if (err instanceof BusyError) throw new ConflictException('busy');
      throw new BadRequestException((err as Error).message);
    }
  }

  @Post('sessions/current/messages')
  continueSession(@Body() body: { prompt?: string }): { sessionId: string } {
    if (!body?.prompt) throw new BadRequestException('prompt required');
    try {
      return { sessionId: this.manager.continueLast(body.prompt) };
    } catch (err) {
      if (err instanceof BusyError) throw new ConflictException('busy');
      throw new BadRequestException((err as Error).message);
    }
  }

  @Get('sessions/current/stream')
  stream(@Res() res: Response, @Query('since') since?: string): void {
    res.setHeader('Content-Type', 'text/event-stream');
    res.setHeader('Cache-Control', 'no-cache');
    res.setHeader('Connection', 'keep-alive');
    res.flushHeaders();
    const ping = setInterval(() => res.write(': ping\n\n'), 15000);
    const unsub = this.manager.subscribe((e) => {
      res.write(`id: ${e.seq}\nevent: ${e.kind}\ndata: ${JSON.stringify(e)}\n\n`);
    }, since ? Number(since) : 0);
    res.on('close', () => {
      clearInterval(ping);
      unsub();
    });
  }

  @Get('sessions')
  sessions(): unknown {
    return this.manager.snapshot();
  }

  @Get('accounts')
  async accounts(): Promise<unknown[]> {
    const registry = AccountRegistry.load(join(this.stateDir, 'accounts.json'));
    return Promise.all(
      registry.list().map(async (acct) => {
        try {
          return { ...acct, quota: await fetchUsage(acct.configDir) };
        } catch (err) {
          return { ...acct, quota: null, quotaError: (err as Error).message };
        }
      }),
    );
  }

  @Post('switch')
  @HttpCode(200)
  switch(): { switched: boolean } {
    if (!this.manager.forceSwitch()) throw new ConflictException('no session running');
    return { switched: true };
  }
}

import { Module } from '@nestjs/common';
import { APP_GUARD } from '@nestjs/core';
import { AuthGuard } from './auth.guard.js';
import { ApiController } from './api.controller.js';
import { SessionManager } from './manager.js';

export interface GatewayConfig {
  token: string;
  stateDir: string;
  workspaceRoot: string;
  claudePath?: string;
}

export function buildModule(cfg: GatewayConfig): unknown {
  const manager = new SessionManager({
    stateDir: cfg.stateDir,
    workspaceRoot: cfg.workspaceRoot,
    claudePath: cfg.claudePath,
  });

  @Module({
    controllers: [ApiController],
    providers: [
      { provide: SessionManager, useValue: manager },
      { provide: ApiController, useFactory: () => new ApiController(manager, cfg.stateDir) },
      { provide: APP_GUARD, useFactory: () => new AuthGuard(cfg.token) },
    ],
  })
  class AppModule {}
  return AppModule;
}

import 'reflect-metadata';
import { NestFactory } from '@nestjs/core';
import type { INestApplication } from '@nestjs/common';
import { readFileSync } from 'node:fs';
import { dirname, join } from 'node:path';
import { fileURLToPath } from 'node:url';
import { buildModule, type GatewayConfig } from './app.module.js';

const __dir = dirname(fileURLToPath(import.meta.url));

export async function createApp(cfg: GatewayConfig): Promise<INestApplication> {
  if (!cfg.token || cfg.token.length < 24) {
    throw new Error('X056_TOKEN missing or shorter than 24 chars — refusing to start');
  }
  const app = await NestFactory.create(buildModule(cfg) as never, { logger: ['warn', 'error'] });
  const express = app.getHttpAdapter().getInstance() as import('express').Express;
  const panel = readFileSync(join(__dir, 'public', 'panel.html'), 'utf8');
  express.get('/healthz', (_req, res) => res.json({ ok: true }));
  express.get('/', (_req, res) => res.type('html').send(panel));
  return app;
}

const isMain = process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1];
if (isMain) {
  const cfg: GatewayConfig = {
    token: process.env.X056_TOKEN ?? '',
    stateDir: process.env.X056_STATE_DIR ?? join(process.cwd(), 'state'),
    workspaceRoot: process.env.X056_WORKSPACE_ROOT ?? process.cwd(),
    claudePath: process.env.X056_CLAUDE_PATH,
  };
  const port = Number(process.env.PORT ?? 4056);
  createApp(cfg)
    .then((app) => app.listen(port, '0.0.0.0'))
    .then(() => console.log(`x056 gateway listening on :${port}`))
    .catch((err) => {
      console.error((err as Error).message);
      process.exit(1);
    });
}

git add package.json package-lock.json tsconfig.json server/ test/gateway.test.ts
git commit -m "feat: add nestjs gateway with sse streaming and token auth"

X056_TOKEN=devtoken-0123456789abcdefghij X056_CLAUDE_PATH=test/bin/fake-claude \
X056_FAKE_SCENARIO=/path/a.jsonl X056_FAKE_SCENARIO_RESUME=/path/b.jsonl npm run serve
# browse http://localhost:4056/ — enter token, run a task, watch failover banner appear

npx vitest run test/gateway.test.ts && npm test
git add server/public/panel.html
git commit -m "feat: add static remote-control panel page"

FROM node:22-bookworm
RUN npm install -g @anthropic-ai/claude-code \
 && apt-get update && apt-get install -y --no-install-recommends ripgrep curl \
 && rm -rf /var/lib/apt/lists/*
RUN useradd -m -u 1001 efran
USER efran
WORKDIR /app
COPY --chown=efran:efran package.json package-lock.json ./
RUN npm ci
COPY --chown=efran:efran . .
ENV PORT=4056
EXPOSE 4056
HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD curl -fsS http://localhost:4056/healthz || exit 1
CMD ["npx", "tsx", "server/main.ts"]

services:
  x056:
    build: .
    restart: unless-stopped
    ports:
      - "4056:4056"
    environment:
      X056_TOKEN: ${X056_TOKEN:?generate one into .env — openssl rand -hex 32}
      X056_WORKSPACE_ROOT: /home/efran/remote-development
      X056_STATE_DIR: /app/state
      PORT: "4056"
    volumes:
      - /home/efran/.claude-x056-a:/home/efran/.claude-x056-a
      - /home/efran/.claude-x056-b:/home/efran/.claude-x056-b
      - /home/efran/remote-development:/home/efran/remote-development
      - x056-state:/app/state
volumes:
  x056-state:

node_modules
state
.git
.superpowers
docs
*.md

echo "X056_TOKEN=$(openssl rand -hex 32)" > .env
docker compose build
docker compose up -d
sleep is hook-blocked in the driving shell: poll with until-loop
until curl -fsS localhost:4056/healthz; do sleep 2; done
TOKEN=$(grep -oP 'X056_TOKEN=\K.*' .env)
curl -fsS -H "Authorization: Bearer $TOKEN" localhost:4056/api/accounts

curl -F "file=@docs/ACCESS.md" https://x056.think.val.id/upload
git add Dockerfile compose.yaml .dockerignore .gitignore docs/ACCESS.md
git commit -m "feat: dockerize gateway with compose deployment"

curl -X POST -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"prompt":"Reply with exactly: GATEWAY_OK","cwd":"/home/efran/remote-development/x056-remote-control"}' \
  localhost:4056/api/sessions
curl -N "localhost:4056/api/sessions/current/stream?token=$TOKEN" | head -40   # watch until session_done