deva serve: remote session access (umbrella)

[lroolle]

Description

Reach running agents from anywhere: inventory -> attach -> web. Umbrella issue; ships in rungs, each useful alone.

Type

• New feature

Details

1. deva ps (deva ps: container inventory joined with launch receipts #520): inventory over receipts
2. deva attach <container|goal-slug>: resolve and exec/tmux in from any terminal (host-tmux host-tmux: SSH transport for container-to-host tmux #405 covers the SSH path already)
3. deva serve: thin HTTP layer over 1+2 — session list plus xterm.js attach via docker exec streams. Binds loopback only; tunneling stays Tailscale/cloudflared's job, documented as a recipe. Auth: bearer token, nothing fancier.

serve is the bun-only candidate: a daemon in bash is self-harm, and the bun port needs a first feature that is not parity. Blocked on the parity harness being declared good enough.

Related Files

• deva.sh (ps/attach)
• bun port (serve)

Test Plan

• ps/attach land with their own issues
• serve: session list and attach round-trip over loopback, token required