HTTP & WebSocket APIs

Runner HTTP API (local + hybrid)

Every deployment exposes an Express server on the configured port (default 3000). The dashboard static assets mount under /dashboard/.

Core job + health

Method	Path	Purpose
GET	/health	Liveness
POST	/jobs	Create job (type, workflowPath, params)
GET	/jobs	List jobs (filters, pagination — see handler)
GET	/jobs/:jobId	Full job snapshot
GET	/jobs/:jobId/stream	SSE log stream
GET	/jobs/:jobId/artifacts/:artifactId/content	Download artefact bytes
POST	/intake/stream	Coro plan mode — SSE stream for conversational brief shaping (see below)
POST	/jobs/:jobId/resume	Manual / synthetic resume
POST	/jobs/:jobId/cancel	Cooperative cancel
POST	/jobs/:jobId/pause	Pause scheduling
POST	/jobs/:jobId/message	Mid-flight developer message

Campaign child controls

Method	Path
POST	/jobs/:jobId/children/:name/skip
POST	/jobs/:jobId/children/:name/rerun
POST	/jobs/:jobId/children/:name/cancel
POST	/jobs/:jobId/children/:name/abandon
POST	/jobs/:jobId/children/:name/resume
POST	/jobs/:jobId/children/:name/start

Intelligence editing (dashboard)

Method	Path
GET/PUT/DELETE	/intelligence/file
GET	/intelligence/layers
POST	/intelligence/preflight

Plugins + diagnostics

Method	Path
GET	/plugins
POST	/plugins/install
DELETE	/plugins/:id
GET	/plugins/:id/models
POST	/plugins/:id/healthcheck
POST	/test/git, /test/tracker, /test/llm

Config + proposals

Method	Path
GET/PUT	/config
GET	/config/claude-code-mcps
GET	/proposals
GET	/jobs/:jobId/insights
DELETE	/jobs/:jobId/insights/:insightId
POST	/jobs/:jobId/phases/:phase/rerun

Static UI

Method	Path
GET	/dashboard/*
GET	/

POST /intake/stream (Coro plan mode)

Server-Sent Events endpoint used by the New Run chat. Requires a healthy LLM executor plugin; returns 503 with reason: no-llm when plugins are not initialised.

Request body:

{
  "sessionId": "uuid-or-stable-browser-id",
  "messages": [{ "role": "user", "content": "Add rate limiting to /api/users" }],
  "model": "claude-sonnet-4-6",
  "provider": "anthropic",
  "context": {
    "recentRepos": ["org/api-service"],
    "recentReviewers": ["alice"],
    "availableWorkflows": [
      {
        "id": "job",
        "name": "Implementation Job",
        "workflowPath": "workflows/job/workflow.md",
        "description": "Default lane for scoped feature work…"
      }
    ],
    "userLocale": "en"
  }
}

model and provider are optional per-session overrides from the dashboard model picker. When omitted, the handler resolves the planning tier via settings.llm.aliases.

SSE events (JSON payloads on message frames):

type	Meaning
token	{ "text": "…" } assistant delta
done	Turn complete; may include usage token counts
error	{ "message": "…", "reason?": "…" } budget or provider failure

The handler calls the executor’s optional chat() method (direct provider HTTP — no Claude Code subprocess, no MCP tools). Session budgets: 8 turns, 4k output tokens per turn, 30k tokens total per sessionId.

Plan-mode streams intentionally do not abort when the HTTP request emits close immediately after body parsing (Express 4 + Node 20 quirk) — the LLM call runs to completion.

See Coro plan mode for UX and troubleshooting.

---

Cloud control plane (hybrid mode)

When cloud.url + cloud.token are configured, a separate cloud service (packages/runner/src/cloud) fronts team operations:

Surface	Purpose
GET /health	Liveness
/auth/*	OAuth / JWT for dashboard users
/teams/*	Team CRUD
/teams/:teamId/jobs/*	Remote job APIs (fan-out to connected runners)
/teams/:teamId/proposals/*	Proposal review
POST /webhook/:teamId/:pluginId	HMAC-verified ingress; forwards { pluginId, headers, rawBody } to runners
GET /teams/:teamId/runners	Connection inventory
WS /ws/runner	Authenticated channel for dispatch, state sync, forwarded webhooks

Plugin manifests contribute webhook.algorithm, header, and format so the cloud verifier stays provider-agnostic.

---

Local vs hybrid event delivery

• Local mode: PollingTransport polls SCM for PR approvals/comments and injects synthetic events.
• Hybrid mode: Real provider webhooks hit the cloud edge, verify HMAC, then flow across the runner WebSocket to parked jobs.

Full narrative + sequence diagrams live in docs/agent-host-spec.md within the Coro developer framework repository.