feat(server): restore the Nitro control plane with registered routes

[RedStar071]

Restores apps/server, which #21 removed, and fixes the two P1 review findings from #2 that were never resolved against it: the built server registered no routes (404 on every path) and ignored the documented AGENT_ZERO_PORT.

Routes actually register now. The root cause of the original 404s is that this Nitro release ships with filesystem scanning disabled (serverDir defaults to false), so route files were silently ignored no matter where they lived. The config opts in explicitly:

exportdefaultdefineConfig({compatibilityDate: '2026-05-22',serverDir: true,});

Handlers under server/routes/ are one-line shells (health.get.ts, tasks/index.get.ts, tasks/index.post.ts, tasks/[id].get.ts, tasks/[id]/evidence.get.ts) over the transport-independent task API restored in src/router.ts, with the HTTP shaping (404s, body validation via the taskInput schema) in src/http.ts so it stays unit-testable without a listener.

AGENT_ZERO_PORT is honored.aube run start boots through a wrapper that maps the documented variable onto NITRO_PORT before the listener reads its environment; explicit NITRO_PORT/PORT still win. The mapping is a pure tested function.

Task checkouts are authorized against a managed root.POST /tasks is unauthenticated transport, so the repository field is no longer a raw filesystem path: it is an identifier that must canonically resolve (via realpath, so symlinks cannot escape) to a directory strictly inside the operator-configured AGENT_ZERO_CHECKOUT_ROOT. Without a configured root the route fails closed with 403 and runs nothing. The resolution is a pure tested function in src/checkout.ts.

Build follows the repo toolchain.build runs nitro build && tsdown, so the listener comes from the Nitro pipeline while the library surface and start wrapper go through the shared tsdown config, addressing the tsdown-bypass note from #2.

Verified against a real built server in the sandbox: with AGENT_ZERO_PORT=4040 the listener binds 4040 (3000 refuses), GET /health and GET /tasks return 200, GET /tasks/missing-task returns a JSON 404, and malformed or schema-invalid POST /tasks bodies return 400. The full check suite (check:repo, lint:ci, typecheck, test with 28 server tests, build) passes locally; the lockfile gains only the new importer (pure additions, resolved with aube 1.38.0).

One behavior note: taskResponse/evidenceResponse keep the in-memory task store semantics of the original server; the restored router.ts only adapts to the current modelFromEnvironment(config.model) signature and reports version 0.3.0.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}

Confidence Score: 5/5

No blocking failure remains.

The prior path-access concern was tested through the HTTP endpoint and its predicted unauthorized execution did not occur.

T-Rex Logs

What T-Rex did

• Ran the reproducible built listener path-authorization harness to create fixtures, start the listener, send the four HTTP requests, and verify the task counts.
• Observed that the absolute path traversal and symlink-escape external requests were rejected with HTTP 403 and left the task count at zero.
• Observed that the in-root, relative repo checkout request returned HTTP 200 and created one completed read-only task with zero model calls.

_{Ran code and verified through T-Rex}

_{Reviews (2): Last reviewed commit: "fix(server): authorize task checkouts ag..." | Re-trigger Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nitro@​3.0.260522-beta
	@​agent-zero/​github@​0.3.0	N/A	N/A	N/A	N/A	N/A

View full report

[greptile-apps]

Unauthenticated task route accepts arbitrary local paths

POST /tasks accepts any non-empty repository value without authenticating the caller, authorizing the requested checkout, or constraining it to an approved root. The value then reaches loadConfig, createRunner, and agent.run, allowing a client that can reach the listener to process arbitrary server-local directories and their repository policy. Resolve an authorized server-side repository identifier instead of accepting a filesystem path, and enforce canonical containment within managed checkout roots before task execution.

Artifacts

Baseline before PR #24 with no POST task route

• A detached worktree at the parent commit was checked for the task POST route and HTTP handler; both were absent, establishing the pre-change baseline.

Runtime API validation source for unauthenticated task path acceptance

• This executed script starts the built Nitro server without model credentials and sends unauthenticated POST requests using an empty and a controlled existing directory path.

Unauthenticated POST task path acceptance after PR #24

• The live server returned HTTP 400 for an empty path and HTTP 200 for a controlled existing server-local directory without an Authorization header, with a completed agent task; this confirms the exposure.

Focused server HTTP tests

• The focused server HTTP test suite was executed and all seven tests passed, confirming the checked transport behavior remains executable.

_{Ran code and verified through T-Rex}

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/server/src/router.ts
Line: 31
Comment:
**Unauthenticated task route accepts arbitrary local paths**`POST /tasks` accepts any non-empty `repository` value without authenticating the caller, authorizing the requested checkout, or constraining it to an approved root. The value then reaches `loadConfig`, `createRunner`, and `agent.run`, allowing a client that can reach the listener to process arbitrary server-local directories and their repository policy. Resolve an authorized server-side repository identifier instead of accepting a filesystem path, and enforce canonical containment within managed checkout roots before task execution.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.