Overview
The server provides:- RESTful API for CRUD operations
- WebSocket server for real-time updates
- End-to-end encrypted data storage
- Machine and session coordination
- RPC routing between clients and machines
- Voice communication orchestration
Technology Stack
Fastify 5
High-performance web framework with type-safe routing via Zod schemas
PostgreSQL + Prisma
Prisma ORM for type-safe database access with migrations
Socket.IO
Real-time WebSocket communication with Redis adapter for clustering
Redis
Event bus, caching, and distributed locking across server instances
Architecture
Directory Structure
Core Design Principles
- 4-space indentation (not 2 spaces)
- Functional programming: Avoid classes, prefer pure functions
- Strict typing: All code fully typed, no
any - Absolute imports: Use
@/prefix (e.g.,import { log } from '@/utils/log') - Modular architecture: Modules abstract complexity, apps contain business logic
- Idempotent operations: All API operations handle duplicate requests gracefully
Key Features
Authentication
Challenge-response authentication with TweetNaCl:- Client requests auth challenge
- Server generates random challenge
- Client signs challenge with private key
- Server verifies signature with public key
- Server issues JWT token
No passwords are ever stored or transmitted. Authentication is purely cryptographic.
Session Management
Sessions are encrypted on the server:- Metadata: Public session info (title, created time, machine)
- Messages: End-to-end encrypted message content
- Agent State: Encrypted agent-specific state
- Artifacts: Encrypted code artifacts and outputs
Real-time Updates
Socket.IO broadcasts state changes:- New sessions created
- Session metadata changes
- New messages
- Machine status changes
- Daemon state updates
RPC System
Bidirectional RPC between clients:API Routes
Authentication (/v1/auth)
Authentication (/v1/auth)
POST /v1/auth/request- Request auth challengePOST /v1/auth/response- Submit signed challengeGET /v1/auth/me- Get current user info
Sessions (/v1/sessions)
Sessions (/v1/sessions)
GET /v1/sessions- List user sessionsPOST /v1/sessions- Create new sessionGET /v1/sessions/:id- Get session detailsPOST /v1/sessions/:id- Update session metadataDELETE /v1/sessions/:id- Delete sessionGET /v1/sessions/:id/messages- Get messagesPOST /v1/sessions/:id/messages- Send messages
Machines (/v1/machines)
Machines (/v1/machines)
GET /v1/machines- List user machinesPOST /v1/machines- Register new machineGET /v1/machines/:id- Get machine detailsPOST /v1/machines/:id/metadata- Update metadataPOST /v1/machines/:id/state- Update daemon state
Voice (/v1/voice)
Voice (/v1/voice)
POST /v1/voice/token- Get LiveKit tokenPOST /v1/voice/session- Create voice session
Artifacts (/v1/artifacts)
Artifacts (/v1/artifacts)
GET /v1/sessions/:id/artifacts- List artifactsPOST /v1/sessions/:id/artifacts- Create artifactGET /v1/artifacts/:id- Get artifactPOST /v1/artifacts/:id- Update artifact
Core Dependencies
Scripts
Development
Development
yarn dev- Start with auto-reload (kills port 3005 first)yarn start- Start production serveryarn standalone- Start standalone server (embedded PGlite)yarn build- TypeScript type checkingyarn test- Run Vitest tests
Database
Database
yarn migrate- Run Prisma migrationsyarn migrate:reset- Reset databaseyarn generate- Generate Prisma clientyarn db- Start local PostgreSQL in Docker
Infrastructure
Infrastructure
yarn redis- Start Redis in Dockeryarn s3- Start MinIO (S3-compatible) in Dockeryarn s3:init- Initialize S3 buckets
Database Schema
Key Prisma models:Event Bus
The event bus enables communication between modules:- Local events (single process)
- Redis-backed events (cluster-wide)
- Typed event schemas
Monitoring
Prometheus metrics exposed:- HTTP request latency
- WebSocket connection count
- Database query performance
- Active session count
- Error rates
Deployment
Docker
Environment Variables
Design Philosophy
- Modules over apps: Abstract complexity into reusable modules
- Idempotency: All operations handle duplicate requests
- No backward compatibility: Move fast with clean migrations
- Transaction safety: Use
inTxfor atomic operations - Event-driven: Use event bus for cross-module communication
- Type safety: Zod schemas for all API boundaries
Related Components
- CLI - Command-line daemon that connects to server
- Mobile App - Mobile client
- Agent - Remote control CLI