- Fix SSE cancel handler to properly capture controller in closure
- Remove error JSON messages before WebSocket close (close reason is sufficient)
- Add POST /api/sessions/:sessionId/prompts endpoint for prompt creation
- Add SSE client cleanup on broadcast errors
- Add createPrompt and getSession imports
- Add prompt message type to ClientMessage for CLI prompt reporting
- Add prompt message handler in WebSocket to create and broadcast prompts
Implements device authentication using HMAC-SHA256 signatures with constant-time comparison for security. Includes timestamp-based auth headers with configurable freshness checking (default 5min) and clock skew tolerance.
Moved index.ts to src/server.ts and created stub files for types, db, auth,
and cli modules. Added minimal placeholder for dashboard. Removed generated
README.md in favor of CLAUDE.md and docs/plan.md.
