tdsk-backend

Define a TEndpointConfig object or TEndpointBuilder function in the endpoints directory and register it in endpoints.ts. The setupEndpoints middleware auto-injects param validation for routes with :id params and applies auth, subscription, and quota middleware to accounts routes.

The authenticate function in setupAuth.ts validates JWT tokens on all /_/* routes except those in the AuthIgnore list. Auth, subscription creation, and quota enforcement are applied in accounts.ts rather than globally in main.ts.

Use the POST /_/agents/:id/v1/chat/completions route, which accepts standard OpenAI request bodies and supports both SSE streaming and non-streaming responses. Request and response adapters convert between OpenAI message types and internal thread types.

Yes, the WebSocket server uses noServer mode with multi-path dispatch, routing /ai/ws, sandbox tunnel, shell, and monitor upgrades to separate handlers. Shell sessions support PTY allocation, reconnection via ring buffers, and multi-user joining.

Placeholder tokens can leak if swapped without domain scoping. The EgressProxy uses fail-closed replacement: a placeholder is only swapped to its real secret when it carries a non-empty allowedDomains scope matching the destination host.

The SessionStore keeps LLM sessions in memory with a 1-hour TTL and 5-minute cleanup interval, so sessions do not survive server restarts. Rate limiters and sandbox session maps are also in-memory and not shared across instances.