git:20261002.986f395 to git:20261019.2345208

2 added, 1 removed. Audit A to A.

Bun server on port 13337. Serves the client at `/`, upgrades `/ws` to WebSocket.

- `web.ts` owns the Bun fullstack surface only: the SPA HTML shell (dev bundler + HMR / prebuilt `dist/`), the two WebSocket channels (`/ws` chat, `/api/workspaces/ws` live events), and graceful shutdown. Every HTTP API request is delegated to the Hono app via `fetch`.

- - `api.ts` is the Hono REST API (all `/api/*` routes). `withWorkspace` middleware resolves `:id` → workspace (404 if missing) and stashes it on the context, so handlers read `c.get('ws')`. Its catch-all serves the prebuilt client from `dist/` in prod via Hono's `serveStatic` (cached, traversal-safe).

+ - `api/index.ts` assembles the Hono REST API (all `/api/*` routes). Harness authentication routes live in `api/harnesses.ts`. `withWorkspace` middleware resolves `:id` → workspace (404 if missing) and stashes it on the context, so handlers read `c.get('ws')`. Its catch-all serves the prebuilt client from `dist/` in prod via Hono's `serveStatic` (cached, traversal-safe).

+ - API tests live in `api/` without an `api-` filename prefix; other unit tests stay beside their modules.

- `static.ts` exposes the `dist/` location (`DIST_DIR`), the `prebuilt` flag, and the prod SPA `distShell`. `events.ts` holds `publishEvent` (server→client live-event broadcast over `/api/workspaces/ws`) decoupled from `web.ts` to avoid an import cycle; `web.ts` wires it via `setEventServer`.

- `state.ts` holds the connected chat clients and `broadcast()` (which also feeds the harness debug tap).

- `applets/` owns shared view/widget machinery: dependency analysis, compilation, CSS scoping, bundle serving, and view source edits/cleanup. `views.ts` and `widgets.ts` own each kind's manifests and events.

- `harness/` holds every agent backend (Claude Code, OpenClaw, Codex): per-harness adapter + session + transport + protocol NOTES, colocated. Read `harness/README.md` for the message-type layers, the adapter contract, and the folder conventions before touching agent-backend code.

- WebSocket protocol: server sends `ServerMessage`, client sends `ClientMessage` — both defined in `lib/types.ts`.

- Never import `react`, `react-dom`, or the `tldraw` package into server-evaluated code in `server/` or `lib/`. `applets/runtime/` contains applet runtime sources: `moi.ts`, `rpc.ts`, and `collab.ts` run in browser bundles; tests run in Bun. The shared API base constant lives in `applets/api-base.ts`. The server must not evaluate React (a global install can pair mismatched `react`/`react-dom` copies, and `react-dom` then throws at load). The scratchpad writer uses `@tldraw/store` + `@tldraw/tlschema` instead; `server/test/server-react-free.test.ts` enforces this. See `docs/moi-scratchpad.md`.

- Agents run in the workspace directory; Claude Code and Codex approve every permission request by default (a `PreToolUse` allow hook and a transport-level accept, respectively) until UI approvals land. Each backend persists its own session history (see `harness/README.md`).