Module server 

Daemon-owned, phone-oriented control surface for Hel.

The server deliberately owns no controller business logic. It publishes a redacted projection of controller state and forwards validated, typed actions through a channel supplied by the controller.

Re-exports

pub use api::ApiFailure;

pub use api::ApiSession;

pub use api::PromptRequest;

pub use api::PromptResponse;

pub use api::SessionListResponse;

pub use api::StartSessionRequest;

pub use api::StartSessionResponse;

pub use api::SubagentBackend;

pub use api::WaitOutcome;

pub use api::WaitRequest;

pub use api::WaitResponse;

pub use api::api_token_path;

pub use api::load_or_create_api_token;

pub use api::map_stop_reason;

pub use api::resolve_wait;

Modules

api

The documented HTTP API an orchestrating agent drives sessions with.

Structs

BackgroundTaskStopRequest

A phone request to stop one currently projected background task.

BrowserDiffStat

One file a tool changed, and by how much.

BrowserTranscript

The conversation shape the phone reads. The chat layer projects its entries into this; the browser API owns the wire form.

BrowserTranscriptEntry

BundleRequest

A phone request to create or reuse a quick project bundle. This has its own channel because bundle creation returns a durable id and must publish a config snapshot before the HTTP request can succeed; ControllerAction intentionally carries only action admission outcomes.

ControllerRequest

MovePreparationRequest

A move preparation is intentionally separate from action admission. It performs read-only compatibility checks and returns the exact fingerprint the later confirmation must echo; it never interrupts the source session.

PreflightNew

What a preflight found. Isolated sessions expose their complete network source plan so the person can review it before creation. Raw-local targets leave the plan empty because they use the selected checkout directly; isolated targets set local_changes_excluded to make the copy boundary explicit.

PreflightRepository

One configured repository’s network clone and publication destinations. URLs have already been passed through the shared display sanitizer before they reach a phone.

PreflightRequest

A phone acknowledging how far it has read a conversation.

ReadReceiptRequest

ServerOptions

Options for the daemon’s phone service.

ServerRequests

Typed request channels served by the authenticated HTTP surface.

ViewerActivityDetails

ViewerBackgroundTask

One command the active agent left running in the background.

ViewerBundle

ViewerClientState

ViewerConfigChoice

ViewerConfigOption

One setting the harness advertised, with the values it will accept.

ViewerLaunchFailure

Deliberately excludes raw diagnostics, which can contain credentials.

ViewerMjCommand

One Mjolnir command a phone may offer for this session.

ViewerMoveRecovery

ViewerOperation

A provision, resume, stop or checkpoint the controller is running now.

ViewerOperationStage

One stage of a running operation, with the clock it started on.

ViewerProfile

ViewerPromptHistory

ViewerPromptImage

One image a phone attached to a prompt. Legacy callers may send inline base64 data; the server normalizes it into an attachment before dispatch.

ViewerQueuedPrompt

ViewerQuota

ViewerQuotaWindow

One usage window a harness reports, such as a weekly or five-hour limit.

ViewerRepository

ViewerReviewConfig

Public review configuration: exactly what /review status needs.

ViewerReviewRole

ViewerReviewVerdict

ViewerSession

ViewerSessionCapabilities

What a phone may do with one session, as the controller sees it.

ViewerSnapshot

ViewerTarget

ViewerTargetCapacity

What one host or fleet has, and how fresh the reading is.

ViewerTurnReview

A turn review as a phone renders it.

ViewerUserShell

ViewerWorkspace

WebListenerProcess

Identity shown before an explicit stop request and checked again before signalling.

Enums

ActionOutcome

The controller’s answer to one phone action.

BackgroundTaskStopFailure

BundleFailure

Safe failure classes for bundle creation. Detailed controller errors stay in daemon logs; a browser only needs to know whether to fix its source or report a server-side failure.

ClientStateRequest

What a phone asks about, or stores against, its own identity.

ControllerAction

The complete set of operations a phone may ask the controller to perform. Destructive force-cleanup and secret/config editing are intentionally not representable here.

PreflightFailure

A preflight can fail because the requested bare directory is unusable, an isolated repository lacks a usable network source, or the controller-side check itself could not complete. The HTTP surface keeps those outcomes distinct without carrying filesystem, Git, or SSH details to the phone.

ResumeQueueDisposition

ViewerActivityKind

ViewerChatPhase

What the agent is doing, mirroring RelayExecutionState.

ViewerCommandSource

ViewerLifecycleCategory

The small set of states a phone reasons about, alongside the precise state.

ViewerOperationKind

WebViewerAccess

WebViewerRecovery

Constants

COOKIE_NAME

MAX_HISTORY_MATCHES

How many prompt-history matches one search returns. Public because the controller loop performs the search and must use the same bound the phone was promised.

MAX_PROMPT_IMAGES

Keep this in sync with the prompt admission bound and the browser composer.

Functions

cookie_key_path

default_session_ttl

How long stored viewer state outlives its last use.

install_rustls_crypto_provider

Select the process-wide rustls provider before any TLS configuration is built.

load_or_create_cookie_key

Load the phone cookie signing key, creating it on first use.

mint_desktop_session_cookie

Mint a signed viewer-session cookie value without the HTTP login flow.

resolution_from_name

The resolution a phone’s button asked for.

resolution_name

The wire name of one resolution, shared by the projection and the action that performs it, so a button’s name is the name the server accepts.

run_server

Run the phone server until its shutdown token is cancelled.

run_server_on_listener

Serve a reserved socket so readiness and advertised ports reflect a real listener.

session_config_view

viewer_config_options