@band-app/server 0.55.0 → 0.56.0

package/dist/start-server.mjs

@@ -2989,11 +2989,11 @@ var require_tools = __commonJS({
         }
       }
     }
-    function buildFormatters(level, bindings, log94) {
+    function buildFormatters(level, bindings, log95) {
       return {
         level,
         bindings,
-        log: log94
+        log: log95
       };
     }
     function normalizeDestFileDescriptor(destination) {
@@ -3376,11 +3376,11 @@ var require_proto = __commonJS({
         }
       } else instance[serializersSym] = serializers;
       if (options.hasOwnProperty("formatters")) {
-        const { level, bindings: chindings, log: log94 } = options.formatters;
+        const { level, bindings: chindings, log: log95 } = options.formatters;
         instance[formattersSym] = buildFormatters(
           level || formatters.level,
           chindings || resetChildingsFormatter,
-          log94 || formatters.log
+          log95 || formatters.log
         );
       } else {
         instance[formattersSym] = buildFormatters(
@@ -17542,6 +17542,104 @@ var init_speech_transcription = __esm({
   }
 });
 
+// ../../packages/worktree-ops/src/http-files.ts
+import { extname } from "node:path";
+function parseByteRange(header, size) {
+  const match = /^bytes=(\d*)-(\d*)$/.exec(header?.trim() ?? "");
+  if (!match || match[1] === "" && match[2] === "") return null;
+  if (match[1] !== "" && match[2] !== "" && Number(match[2]) < Number(match[1])) return null;
+  let start;
+  let end;
+  if (match[1] === "") {
+    const length = Number(match[2]);
+    if (length === 0) return "unsatisfiable";
+    start = Math.max(0, size - length);
+    end = size - 1;
+  } else {
+    start = Number(match[1]);
+    end = match[2] === "" ? size - 1 : Math.min(Number(match[2]), size - 1);
+  }
+  if (start >= size || start > end) return "unsatisfiable";
+  return { start, end };
+}
+function attachmentDisposition(filename) {
+  const clean = filename.replace(/[/\\]/g, "_") || "download";
+  const ascii = clean.replace(/[^\x20-\x7e]/g, "_").replace(/["%;]/g, "_");
+  const encoded = encodeURIComponent(clean).replace(
+    /['()*]/g,
+    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`
+  );
+  return `attachment; filename="${ascii}"; filename*=UTF-8''${encoded}`;
+}
+function mimeTypeFromFilename(filename) {
+  const ext = extname(filename).toLowerCase();
+  return MIME_TYPES[ext] || "application/octet-stream";
+}
+function hostedFileHeaders(contentType) {
+  const headers = { "X-Content-Type-Options": "nosniff" };
+  if (/^(text\/html|image\/svg\+xml)\b/.test(contentType)) {
+    headers["Content-Security-Policy"] = "sandbox allow-scripts";
+  }
+  return headers;
+}
+function parseSharedPath(rest) {
+  const raw = rest.split("?")[0].split("/");
+  if (raw.length !== 2 && raw.length !== 3) return null;
+  const parts = [];
+  for (const segment of raw) {
+    let decoded;
+    try {
+      decoded = decodeURIComponent(segment);
+    } catch {
+      return null;
+    }
+    if (!decoded || decoded === "." || decoded === ".." || /[/\\\0]/.test(decoded)) return null;
+    parts.push(decoded);
+  }
+  return parts.length === 3 ? { worktreeId: parts[0], chatId: parts[1], name: parts[2] } : { worktreeId: parts[0], name: parts[1] };
+}
+var MIME_TYPES;
+var init_http_files = __esm({
+  "../../packages/worktree-ops/src/http-files.ts"() {
+    "use strict";
+    MIME_TYPES = {
+      ".png": "image/png",
+      ".jpg": "image/jpeg",
+      ".jpeg": "image/jpeg",
+      ".gif": "image/gif",
+      ".webp": "image/webp",
+      ".svg": "image/svg+xml",
+      ".ico": "image/x-icon",
+      ".bmp": "image/bmp",
+      ".avif": "image/avif",
+      ".mp4": "video/mp4",
+      ".m4v": "video/mp4",
+      ".mov": "video/quicktime",
+      ".webm": "video/webm",
+      ".ogv": "video/ogg",
+      ".pdf": "application/pdf",
+      ".json": "application/json",
+      ".txt": "text/plain",
+      ".md": "text/markdown",
+      ".csv": "text/csv",
+      ".html": "text/html; charset=utf-8",
+      ".htm": "text/html; charset=utf-8",
+      ".css": "text/css; charset=utf-8",
+      ".js": "text/javascript; charset=utf-8",
+      ".mjs": "text/javascript; charset=utf-8",
+      ".woff": "font/woff",
+      ".woff2": "font/woff2",
+      ".ttf": "font/ttf",
+      ".otf": "font/otf",
+      ".ts": "application/typescript",
+      ".xml": "application/xml",
+      ".yaml": "application/x-yaml",
+      ".yml": "application/x-yaml",
+      ".zip": "application/zip"
+    };
+  }
+});
+
 // ../../node_modules/.pnpm/@trpc+server@11.12.0_typescript@5.9.3/node_modules/@trpc/server/dist/codes-DagpWZLc.mjs
 function mergeWithoutOverrides(obj1, ...objs) {
   const newObj = Object.assign(emptyObject(), obj1);
@@ -65815,27 +65913,12 @@ async function agentExtraDirs(worktreeId4) {
 function sharedFileUrl(worktreeId4, chatId, filename) {
   return `/api/shared/${encodeURIComponent(worktreeId4)}/${encodeURIComponent(chatId)}/${encodeURIComponent(filename)}`;
 }
-function parseSharedPath(rest) {
-  const raw = rest.split("?")[0].split("/");
-  if (raw.length !== 2 && raw.length !== 3) return null;
-  const parts = [];
-  for (const segment of raw) {
-    let decoded;
-    try {
-      decoded = decodeURIComponent(segment);
-    } catch {
-      return null;
-    }
-    if (!decoded || decoded === "." || decoded === ".." || /[/\\\0]/.test(decoded)) return null;
-    parts.push(decoded);
-  }
-  return parts.length === 3 ? { worktreeId: parts[0], chatId: parts[1], name: parts[2] } : { worktreeId: parts[0], name: parts[1] };
-}
 var init_shared_dir = __esm({
   "src/server/services/_utils/shared-dir.ts"() {
     "use strict";
     init_registry();
     init_state();
+    init_http_files();
   }
 });
 
@@ -71332,50 +71415,10 @@ var init_chat_status_service = __esm({
 });
 
 // src/server/services/_utils/mime-types.ts
-import { extname } from "node:path";
-function mimeTypeFromFilename(filename) {
-  const ext = extname(filename).toLowerCase();
-  return MIME_TYPES[ext] || "application/octet-stream";
-}
-var MIME_TYPES;
 var init_mime_types = __esm({
   "src/server/services/_utils/mime-types.ts"() {
     "use strict";
-    MIME_TYPES = {
-      ".png": "image/png",
-      ".jpg": "image/jpeg",
-      ".jpeg": "image/jpeg",
-      ".gif": "image/gif",
-      ".webp": "image/webp",
-      ".svg": "image/svg+xml",
-      ".ico": "image/x-icon",
-      ".bmp": "image/bmp",
-      ".avif": "image/avif",
-      ".mp4": "video/mp4",
-      ".m4v": "video/mp4",
-      ".mov": "video/quicktime",
-      ".webm": "video/webm",
-      ".ogv": "video/ogg",
-      ".pdf": "application/pdf",
-      ".json": "application/json",
-      ".txt": "text/plain",
-      ".md": "text/markdown",
-      ".csv": "text/csv",
-      ".html": "text/html; charset=utf-8",
-      ".htm": "text/html; charset=utf-8",
-      ".css": "text/css; charset=utf-8",
-      ".js": "text/javascript; charset=utf-8",
-      ".mjs": "text/javascript; charset=utf-8",
-      ".woff": "font/woff",
-      ".woff2": "font/woff2",
-      ".ttf": "font/ttf",
-      ".otf": "font/otf",
-      ".ts": "application/typescript",
-      ".xml": "application/xml",
-      ".yaml": "application/x-yaml",
-      ".yml": "application/x-yaml",
-      ".zip": "application/zip"
-    };
+    init_http_files();
   }
 });
 
@@ -75358,8 +75401,8 @@ var init_environment_builds = __esm({
       get(id) {
         return getDb().select().from(environmentBuilds).where(eq2(environmentBuilds.id, id)).get();
       }
-      setLog(id, log94) {
-        getDb().update(environmentBuilds).set({ log: log94 }).where(eq2(environmentBuilds.id, id)).run();
+      setLog(id, log95) {
+        getDb().update(environmentBuilds).set({ log: log95 }).where(eq2(environmentBuilds.id, id)).run();
       }
       finish(id, result) {
         getDb().update(environmentBuilds).set({
@@ -75727,32 +75770,32 @@ ${this.text.slice(-MAX_LOG_BYTES)}`;
       }
       // ---- running ---------------------------------------------------------------
       async run(row, plan) {
-        const log94 = new BuildLog(row.id, (id, text4) => this.queries.setLog(id, text4));
+        const log95 = new BuildLog(row.id, (id, text4) => this.queries.setLog(id, text4));
         let tmp = null;
         const container = `band-env-${row.id.slice(0, 12)}`;
         let failure4 = null;
         try {
-          log94.add(`Building ${plan.tag} for ${plan.repo} at ${plan.ref} (${plan.commit.slice(0, 12)})`);
-          log94.flush();
+          log95.add(`Building ${plan.tag} for ${plan.repo} at ${plan.ref} (${plan.commit.slice(0, 12)})`);
+          log95.flush();
           tmp = await plan.host.fs.mkdtemp("band-env-");
-          await this.exportCheckout(plan, tmp, log94);
-          const toolchain = await this.buildToolchain(plan, tmp, log94);
-          const layered = await this.addWorkerLayer(plan, tmp, toolchain, log94);
-          await this.install(plan, tmp, layered, container, log94);
-          if (plan.registry) await this.push(plan, log94);
-          log94.add(`Done: ${plan.tag}`);
+          await this.exportCheckout(plan, tmp, log95);
+          const toolchain = await this.buildToolchain(plan, tmp, log95);
+          const layered = await this.addWorkerLayer(plan, tmp, toolchain, log95);
+          await this.install(plan, tmp, layered, container, log95);
+          if (plan.registry) await this.push(plan, log95);
+          log95.add(`Done: ${plan.tag}`);
         } catch (err) {
           failure4 = err.message;
-          log94.add(`FAILED: ${failure4}`);
+          log95.add(`FAILED: ${failure4}`);
         }
-        await this.exec(plan.host, "docker", ["rm", "--force", container], log94, { quiet: true }).catch(
+        await this.exec(plan.host, "docker", ["rm", "--force", container], log95, { quiet: true }).catch(
           () => void 0
         );
         await this.exec(
           plan.host,
           "docker",
           ["rmi", toolchainTag(plan.repo, plan.key), layeredTag(plan.repo, plan.key)],
-          log94,
+          log95,
           { quiet: true }
         ).catch(() => void 0);
         if (tmp) await plan.host.fs.rm(tmp, { recursive: true, force: true }).catch(() => void 0);
@@ -75761,14 +75804,14 @@ ${this.text.slice(-MAX_LOG_BYTES)}`;
             this.queries.finish(row.id, {
               status: "ready",
               image: plan.tag,
-              log: log94.toString(),
+              log: log95.toString(),
               at: Date.now()
             });
           } else {
             this.queries.finish(row.id, {
               status: "failed",
               error: failure4.slice(0, 2e3),
-              log: log94.toString(),
+              log: log95.toString(),
               at: Date.now()
             });
           }
@@ -75777,9 +75820,9 @@ ${this.text.slice(-MAX_LOG_BYTES)}`;
         }
       }
       /** Runs a command on the builder host, adding it and its output to the log. */
-      async exec(host, tool2, args, log94, options = {}) {
+      async exec(host, tool2, args, log95, options = {}) {
         const bin = tool2 === "docker" ? this.dockerBin(host) : tool2 === "devcontainer" ? this.devcontainerBin(host) : "git";
-        if (!options.quiet) log94.add(`$ ${tool2} ${args.join(" ")}`);
+        if (!options.quiet) log95.add(`$ ${tool2} ${args.join(" ")}`);
         try {
           const out = await host.exec(bin, args, {
             cwd: options.cwd,
@@ -75787,35 +75830,35 @@ ${this.text.slice(-MAX_LOG_BYTES)}`;
             timeoutMs: envNumber("BAND_ENVIRONMENT_BUILD_TIMEOUT_MS", DEFAULT_STEP_TIMEOUT_MS)
           });
           if (!options.quiet) {
-            if (out.stdout.trim()) log94.add(out.stdout.trimEnd());
-            if (out.stderr.trim()) log94.add(out.stderr.trimEnd());
-            log94.flush();
+            if (out.stdout.trim()) log95.add(out.stdout.trimEnd());
+            if (out.stderr.trim()) log95.add(out.stderr.trimEnd());
+            log95.flush();
           }
           return out.stdout;
         } catch (err) {
           if (!options.quiet) {
-            log94.add(err.message);
-            log94.flush();
+            log95.add(err.message);
+            log95.flush();
           }
           throw new Error(`${tool2} ${args[0] ?? ""} failed: ${firstLine(err.message)}`);
         }
       }
       /** Writes the default branch's files, with no `.git`, to `<tmp>/src`. */
-      async exportCheckout(plan, tmp, log94) {
+      async exportCheckout(plan, tmp, log95) {
         const src = posix4.join(tmp, "src");
         await plan.host.fs.mkdir(src);
         const index3 = posix4.join(tmp, "index");
-        await this.exec(plan.host, "git", ["read-tree", plan.ref], log94, {
+        await this.exec(plan.host, "git", ["read-tree", plan.ref], log95, {
           cwd: plan.repoPath,
           env: { GIT_INDEX_FILE: index3 }
         });
-        await this.exec(plan.host, "git", ["checkout-index", "--all", `--prefix=${src}/`], log94, {
+        await this.exec(plan.host, "git", ["checkout-index", "--all", `--prefix=${src}/`], log95, {
           cwd: plan.repoPath,
           env: { GIT_INDEX_FILE: index3 }
         });
       }
       /** Layer 2: returns the tag of an image holding the repo's toolchain. */
-      async buildToolchain(plan, tmp, log94) {
+      async buildToolchain(plan, tmp, log95) {
         const build = plan.environment.build;
         const src = posix4.join(tmp, "src");
         const tag = toolchainTag(plan.repo, plan.key);
@@ -75824,7 +75867,7 @@ ${this.text.slice(-MAX_LOG_BYTES)}`;
             plan.host,
             "docker",
             dockerBuildArgs({ checkout: src, dockerfile: build.dockerfile, tag }),
-            log94
+            log95
           );
           return tag;
         }
@@ -75834,7 +75877,7 @@ ${this.text.slice(-MAX_LOG_BYTES)}`;
               plan.host,
               "devcontainer",
               devcontainerBuildArgs({ checkout: src, config: build.devcontainer, tag }),
-              log94
+              log95
             );
           } catch (err) {
             throw new Error(
@@ -75844,11 +75887,11 @@ ${this.text.slice(-MAX_LOG_BYTES)}`;
           return tag;
         }
         const image = build?.image;
-        await this.exec(plan.host, "docker", ["pull", image], log94);
+        await this.exec(plan.host, "docker", ["pull", image], log95);
         return image;
       }
       /** Layer 1 on top of layer 2: copies the worker from the worker base image. */
-      async addWorkerLayer(plan, tmp, toolchain, log94) {
+      async addWorkerLayer(plan, tmp, toolchain, log95) {
         const dir = posix4.join(tmp, "layer");
         await plan.host.fs.mkdir(dir);
         await plan.host.fs.writeFile(
@@ -75860,38 +75903,38 @@ ${this.text.slice(-MAX_LOG_BYTES)}`;
         });
         await plan.host.fs.mkdir(posix4.join(dir, "root", "work"), { recursive: true });
         const tag = layeredTag(plan.repo, plan.key);
-        await this.exec(plan.host, "docker", ["build", "--tag", tag, dir], log94);
+        await this.exec(plan.host, "docker", ["build", "--tag", tag, dir], log95);
         return tag;
       }
       /** Runs `install` at the default branch inside the image and commits the result as the final tag. */
-      async install(plan, tmp, layered, container, log94) {
+      async install(plan, tmp, layered, container, log95) {
         const install = plan.environment.install;
         if (install === void 0) {
-          await this.exec(plan.host, "docker", ["tag", layered, plan.tag], log94);
+          await this.exec(plan.host, "docker", ["tag", layered, plan.tag], log95);
           return;
         }
         await this.exec(
           plan.host,
           "docker",
           installCreateArgs({ name: container, image: layered, install }),
-          log94
+          log95
         );
         await this.exec(
           plan.host,
           "docker",
           ["cp", `${posix4.join(tmp, "src")}/.`, `${container}:${IMAGE_WORKDIR}`],
-          log94
+          log95
         );
-        await this.exec(plan.host, "docker", ["start", "--attach", container], log94);
+        await this.exec(plan.host, "docker", ["start", "--attach", container], log95);
         await this.exec(
           plan.host,
           "docker",
           commitArgs({ container, tag: plan.tag, key: plan.key, commit: plan.commit }),
-          log94
+          log95
         );
       }
-      async push(plan, log94) {
-        await this.exec(plan.host, "docker", ["push", plan.tag], log94);
+      async push(plan, log95) {
+        await this.exec(plan.host, "docker", ["push", plan.tag], log95);
       }
       // ---- auto trigger ----------------------------------------------------------
       /**
@@ -90129,11 +90172,11 @@ var require_core = __commonJS({
     Ajv2.ValidationError = validation_error_1.default;
     Ajv2.MissingRefError = ref_error_1.default;
     exports.default = Ajv2;
-    function checkOptions(checkOpts, options, msg, log94 = "error") {
+    function checkOptions(checkOpts, options, msg, log95 = "error") {
       for (const key2 in checkOpts) {
         const opt = key2;
         if (opt in options)
-          this.logger[log94](`${msg}: option ${key2}. ${checkOpts[opt]}`);
+          this.logger[log95](`${msg}: option ${key2}. ${checkOpts[opt]}`);
       }
     }
     function getSchEnv(keyRef) {
@@ -92663,6 +92706,7 @@ function createTerminalBackend(serverRoot, bandHome2) {
 // start-server.ts
 init_src4();
 init_speech_transcription();
+init_http_files();
 
 // ../../node_modules/.pnpm/@trpc+server@11.12.0_typescript@5.9.3/node_modules/@trpc/server/dist/adapters/fetch/index.mjs
 init_getErrorShape_vC8mUXJD();
@@ -112513,9 +112557,6 @@ function throwAsTRPCError(err) {
 init_dist();
 init_zod();
 
-// src/server/services/editor-service.ts
-import { isAbsolute as isAbsolute5, join as join52, resolve as resolve10, sep as sep6 } from "node:path";
-
 // ../../packages/shared/src/file-location.ts
 function formatFileLocation(filePath, line2, options) {
   if (line2 != null && options?.lineEnd != null) return `${filePath}:${line2}-${options.lineEnd}`;
@@ -112524,12 +112565,71 @@ function formatFileLocation(filePath, line2, options) {
   return filePath;
 }
 
+// ../../packages/worktree-ops/src/resolve-path.ts
+init_resolver();
+import { isAbsolute as isAbsolute4, join as join51, resolve as resolve10, sep as sep6 } from "node:path";
+var PathsService = class {
+  constructor(worktrees2) {
+    this.worktrees = worktrees2;
+  }
+  async resolvePath(input3) {
+    const worktree = this.worktrees.resolve(input3.worktreeId);
+    if (!worktree) throw new WorktreeNotFoundError(input3.worktreeId);
+    const resolved = await resolveTarget(worktree.host.fs, worktree.worktree.path, input3.filePath);
+    return {
+      exists: resolved.exists,
+      isFile: resolved.isFile,
+      external: !resolved.inside,
+      worktreeRelativePath: resolved.inside ? resolved.relativePath : null
+    };
+  }
+};
+async function resolveTarget(fs3, root, filePath) {
+  const absoluteTarget = isAbsolute4(filePath) ? resolve10(filePath) : resolve10(root, filePath);
+  let canonicalRoot = root;
+  try {
+    canonicalRoot = await fs3.realpath(root);
+  } catch {
+  }
+  const canonicalTarget = await canonicalizeMaybeMissing(fs3, absoluteTarget);
+  let targetStat = null;
+  try {
+    targetStat = await fs3.stat(canonicalTarget, { followSymlinks: true });
+  } catch {
+  }
+  const normalizedRoot = canonicalRoot.replace(/\/+$/, "");
+  const inside = canonicalTarget === normalizedRoot || canonicalTarget.startsWith(`${normalizedRoot}${sep6}`);
+  const relativePath = inside ? (canonicalTarget === normalizedRoot ? "" : canonicalTarget.slice(normalizedRoot.length + 1)).split(sep6).join("/") : null;
+  return {
+    canonicalTarget,
+    exists: !!targetStat,
+    isFile: targetStat?.kind === "file",
+    inside,
+    relativePath
+  };
+}
+async function canonicalizeMaybeMissing(fs3, p2) {
+  try {
+    return await fs3.realpath(p2);
+  } catch {
+  }
+  const parts = p2.split(sep6);
+  for (let i = parts.length - 1; i > 0; i--) {
+    const prefix = parts.slice(0, i).join(sep6) || sep6;
+    try {
+      const canonicalPrefix = await fs3.realpath(prefix);
+      return join51(canonicalPrefix, ...parts.slice(i));
+    } catch {
+    }
+  }
+  return p2;
+}
+
 // src/server/services/editor-service.ts
 init_errors6();
 init_registry();
 
-// src/server/services/file-watcher.ts
-init_worktree_service();
+// ../../packages/worktree-ops/src/file-watch.ts
 var IGNORED_SEGMENTS = /* @__PURE__ */ new Set([
   ".git",
   "node_modules",
@@ -112600,16 +112700,15 @@ async function pumpChanges(worktreeId4, entry, host, root) {
   for (const listener of entry.listeners) listener(null);
   stopWatcher(worktreeId4, entry);
 }
-function subscribeToFileChanges(worktreeId4, listener) {
+function subscribeToFileChanges(worktreeId4, open4, listener) {
   let entry = watchers.get(worktreeId4);
   if (!entry) {
-    const ws = worktreeService.resolve(worktreeId4);
-    if (!ws) return () => {
+    const target = open4();
+    if (!target) return () => {
     };
-    const root = ws.worktree.path;
     entry = { controller: new AbortController(), listeners: /* @__PURE__ */ new Set(), pendingTimers: /* @__PURE__ */ new Map() };
     watchers.set(worktreeId4, entry);
-    void pumpChanges(worktreeId4, entry, ws.host, root);
+    void pumpChanges(worktreeId4, entry, target.host, target.root);
   }
   entry.listeners.add(listener);
   const subscribed = entry;
@@ -112619,10 +112718,23 @@ function subscribeToFileChanges(worktreeId4, listener) {
   };
 }
 
+// src/server/services/file-watcher.ts
+init_worktree_service();
+function subscribeToFileChanges2(worktreeId4, listener) {
+  return subscribeToFileChanges(
+    worktreeId4,
+    () => {
+      const ws = worktreeService.resolve(worktreeId4);
+      return ws ? { host: ws.host, root: ws.worktree.path } : null;
+    },
+    listener
+  );
+}
+
 // src/server/services/formatter.ts
 init_src();
 init_registry();
-import { basename as basename4, dirname as dirname15, isAbsolute as isAbsolute4, join as join51, resolve as resolvePath3 } from "node:path";
+import { basename as basename4, dirname as dirname15, isAbsolute as isAbsolute5, join as join52, resolve as resolvePath3 } from "node:path";
 import prettier from "prettier";
 var log64 = createLogger("formatter");
 var FormatterError = class extends Error {
@@ -112638,7 +112750,7 @@ var FormatterError = class extends Error {
 async function formatFile(worktreePath, filePath, content, options = {}) {
   const fs3 = options.fs ?? hostRegistry.local.fs;
   const onHub = fs3 === hostRegistry.local.fs;
-  const absFile = isAbsolute4(filePath) ? filePath : resolvePath3(worktreePath, filePath);
+  const absFile = isAbsolute5(filePath) ? filePath : resolvePath3(worktreePath, filePath);
   if (!await isInsideWorktree(fs3, absFile, worktreePath)) {
     throw new FormatterError(
       "FILE_NOT_IN_WORKTREE",
@@ -112704,10 +112816,10 @@ async function resolveConfigOnHost(fs3, absFile, worktreePath) {
   let dir = dirname15(absFile);
   for (; ; ) {
     for (const name5 of JSON_CONFIGS) {
-      const parsed = await readJson2(fs3, join51(dir, name5));
+      const parsed = await readJson2(fs3, join52(dir, name5));
       if (parsed && typeof parsed === "object") return withoutPlugins(parsed);
     }
-    const pkg = await readJson2(fs3, join51(dir, "package.json"));
+    const pkg = await readJson2(fs3, join52(dir, "package.json"));
     if (pkg && typeof pkg.prettier === "object" && pkg.prettier !== null) {
       return withoutPlugins(pkg.prettier);
     }
@@ -112745,7 +112857,7 @@ async function isInsideWorktree(fs3, absFile, worktreePath) {
     realFile = await fs3.realpath(absFile);
   } catch {
     try {
-      realFile = join51(await fs3.realpath(dirname15(absFile)), basename4(absFile));
+      realFile = join52(await fs3.realpath(dirname15(absFile)), basename4(absFile));
     } catch {
       realFile = absFile;
     }
@@ -112796,7 +112908,7 @@ var EditorService = class {
   // File-change subscriptions (per-worktree fs.watch)
   // -------------------------------------------------------------------------
   subscribeToFileChanges(worktreeId4, listener) {
-    return subscribeToFileChanges(worktreeId4, listener);
+    return subscribeToFileChanges2(worktreeId4, listener);
   }
   // -------------------------------------------------------------------------
   // LSP lifecycle pass-throughs
@@ -112823,11 +112935,7 @@ var EditorService = class {
     if (!worktree) {
       throw new EditorOpenError("NOT_FOUND", `Worktree '${targetWorktreeId}' not found`);
     }
-    const resolved = await this.resolveTarget(
-      worktree.host.fs,
-      worktree.worktree.path,
-      input3.filePath
-    );
+    const resolved = await resolveTarget(worktree.host.fs, worktree.worktree.path, input3.filePath);
     if (!resolved.exists) {
       throw new EditorOpenError("NOT_FOUND", `File not found: ${input3.filePath}`);
     }
@@ -112853,66 +112961,6 @@ var EditorService = class {
       external: !resolved.inside
     };
   }
-  /**
-   * Resolve a path (absolute or worktree-relative) against a worktree and
-   * report where it lands. Used by the dashboard's Quick Open to decide, for
-   * an absolute-path query, whether to open the file as a normal
-   * worktree-relative tab (when it lives *inside* the worktree) or as an
-   * external tab (outside) — and, either way, whether it exists at all.
-   *
-   * Shares the exact canonicalize + segment-aware containment logic that
-   * `openFile` uses, so an absolute path typed into Quick Open and the same
-   * path passed to `band open` resolve identically. Unlike `openFile` this
-   * neither emits an SSE event nor throws for a missing file — the caller
-   * only offers to open when `exists && isFile`.
-   */
-  async resolvePath(input3) {
-    const worktree = worktreeService.resolve(input3.worktreeId);
-    if (!worktree) {
-      throw new WorktreeNotFoundError(input3.worktreeId);
-    }
-    const resolved = await this.resolveTarget(
-      worktree.host.fs,
-      worktree.worktree.path,
-      input3.filePath
-    );
-    return {
-      exists: resolved.exists,
-      isFile: resolved.isFile,
-      external: !resolved.inside,
-      worktreeRelativePath: resolved.inside ? resolved.relativePath : null
-    };
-  }
-  /**
-   * Shared resolution core for {@link openFile} and {@link resolvePath}:
-   * canonicalize the target (following the deepest existing ancestor so
-   * not-yet-created paths still classify), stat it, and run the
-   * segment-aware containment check against the canonicalized worktree root.
-   */
-  async resolveTarget(fs3, root, filePath) {
-    const absoluteTarget = isAbsolute5(filePath) ? resolve10(filePath) : resolve10(root, filePath);
-    let canonicalRoot = root;
-    try {
-      canonicalRoot = await fs3.realpath(root);
-    } catch {
-    }
-    const canonicalTarget = await canonicalizeMaybeMissing(fs3, absoluteTarget);
-    let targetStat = null;
-    try {
-      targetStat = await fs3.stat(canonicalTarget, { followSymlinks: true });
-    } catch {
-    }
-    const normalizedRoot = canonicalRoot.replace(/\/+$/, "");
-    const inside = canonicalTarget === normalizedRoot || canonicalTarget.startsWith(`${normalizedRoot}${sep6}`);
-    const relativePath = inside ? (canonicalTarget === normalizedRoot ? "" : canonicalTarget.slice(normalizedRoot.length + 1)).split(sep6).join("/") : null;
-    return {
-      canonicalTarget,
-      exists: !!targetStat,
-      isFile: targetStat?.kind === "file",
-      inside,
-      relativePath
-    };
-  }
 };
 var EditorOpenError = class extends Error {
   code;
@@ -112922,22 +112970,6 @@ var EditorOpenError = class extends Error {
     this.code = code;
   }
 };
-async function canonicalizeMaybeMissing(fs3, p2) {
-  try {
-    return await fs3.realpath(p2);
-  } catch {
-  }
-  const parts = p2.split(sep6);
-  for (let i = parts.length - 1; i > 0; i--) {
-    const prefix = parts.slice(0, i).join(sep6) || sep6;
-    try {
-      const canonicalPrefix = await fs3.realpath(prefix);
-      return join52(canonicalPrefix, ...parts.slice(i));
-    } catch {
-    }
-  }
-  return p2;
-}
 var editorService = new EditorService();
 
 // src/server/api/editor/router.ts
@@ -113700,7 +113732,7 @@ init_registry();
 // package.json
 var package_default = {
   name: "@band-app/server",
-  version: "0.55.0",
+  version: "0.56.0",
   type: "module",
   types: "src/index.ts",
   exports: {
@@ -118504,11 +118536,11 @@ var ProvisionQueries = class {
     const result = this.db().update(hostProvisions).set({ spentAt: at, hostId: hostId2, runHash, state: "running", updatedAt: at }).where(and2(eq2(hostProvisions.id, id), isNull2(hostProvisions.spentAt))).run();
     return Number(result.changes ?? 0) > 0;
   }
-  setLog(id, log94, at) {
-    this.db().update(hostProvisions).set({ log: log94, updatedAt: at }).where(eq2(hostProvisions.id, id)).run();
+  setLog(id, log95, at) {
+    this.db().update(hostProvisions).set({ log: log95, updatedAt: at }).where(eq2(hostProvisions.id, id)).run();
   }
-  finish(id, state2, exitCode, log94, at) {
-    this.db().update(hostProvisions).set({ state: state2, exitCode, log: log94, updatedAt: at }).where(eq2(hostProvisions.id, id)).run();
+  finish(id, state2, exitCode, log95, at) {
+    this.db().update(hostProvisions).set({ state: state2, exitCode, log: log95, updatedAt: at }).where(eq2(hostProvisions.id, id)).run();
   }
   /** Ids of rows created before `at`, so their bundle files can be deleted. */
   idsCreatedBefore(at) {
@@ -122098,6 +122130,32 @@ var searchContentInput = external_exports2.object({
   regex: external_exports2.boolean().default(false),
   limit: external_exports2.number().default(100)
 });
+var commitShaSchema = external_exports2.string().regex(/^[0-9a-f]{7,40}$/i, "sha must be a 7\u201340 character hex commit id");
+var listBranchesInput = external_exports2.object({
+  worktreeId: external_exports2.string(),
+  query: external_exports2.string().max(200).optional(),
+  limit: external_exports2.number().int().min(1).max(500).optional()
+});
+var getCommitHistoryInput = external_exports2.object({
+  worktreeId: external_exports2.string(),
+  skip: external_exports2.number().int().min(0).optional(),
+  limit: external_exports2.number().int().min(1).max(500).optional()
+});
+var getCommitHistorySignatureInput = external_exports2.object({ worktreeId: external_exports2.string() });
+var getCommitDetailsInput = external_exports2.object({ worktreeId: external_exports2.string(), sha: commitShaSchema });
+var createFileInput = external_exports2.object({
+  worktreeId: external_exports2.string(),
+  path: external_exports2.string().min(1),
+  content: external_exports2.string().default("")
+});
+var createDirectoryInput = external_exports2.object({ worktreeId: external_exports2.string(), path: external_exports2.string().min(1) });
+var deletePathInput = external_exports2.object({ worktreeId: external_exports2.string(), path: external_exports2.string().min(1) });
+var renamePathInput = external_exports2.object({
+  worktreeId: external_exports2.string(),
+  fromPath: external_exports2.string().min(1),
+  toPath: external_exports2.string().min(1)
+});
+var resolvePathInput = external_exports2.object({ worktreeId: external_exports2.string(), path: external_exports2.string().min(1) });
 
 // ../../packages/worktree-ops/src/direct.ts
 var op = (o) => o;
@@ -122149,6 +122207,42 @@ var directOps = {
       regex: i.regex,
       limit: i.limit
     })
+  }),
+  "worktree.listBranches": op({
+    input: listBranchesInput,
+    run: (ops, i) => ops.diff.listBranches(i.worktreeId, { query: i.query, limit: i.limit })
+  }),
+  "worktree.getCommitHistory": op({
+    input: getCommitHistoryInput,
+    run: (ops, i) => ops.gitGraph.getCommitHistory(i.worktreeId, { skip: i.skip, limit: i.limit })
+  }),
+  "worktree.getCommitHistorySignature": op({
+    input: getCommitHistorySignatureInput,
+    run: (ops, i) => ops.gitGraph.getCommitHistorySignature(i.worktreeId)
+  }),
+  "worktree.getCommitDetails": op({
+    input: getCommitDetailsInput,
+    run: (ops, i) => ops.gitGraph.getCommitDetails(i.worktreeId, i.sha)
+  }),
+  "worktree.createFile": op({
+    input: createFileInput,
+    run: (ops, i) => ops.files.createFile(i.worktreeId, i.path, i.content)
+  }),
+  "worktree.createDirectory": op({
+    input: createDirectoryInput,
+    run: (ops, i) => ops.files.createDirectory(i.worktreeId, i.path)
+  }),
+  "worktree.deletePath": op({
+    input: deletePathInput,
+    run: (ops, i) => ops.files.deletePath(i.worktreeId, i.path)
+  }),
+  "worktree.renamePath": op({
+    input: renamePathInput,
+    run: (ops, i) => ops.files.renamePath(i.worktreeId, i.fromPath, i.toPath)
+  }),
+  "worktree.copyPath": op({
+    input: renamePathInput,
+    run: (ops, i) => ops.files.copyPath(i.worktreeId, i.fromPath, i.toPath)
   })
 };
 
@@ -123146,11 +123240,10 @@ var filesService = new FilesService({
   ensureAwake: (worktreeId4) => ephemeralLifecycleService.ensureAwake(worktreeId4)
 });
 
-// src/server/services/git-graph-service.ts
+// ../../packages/worktree-ops/src/git-graph.ts
 init_src3();
 import { createHash as createHash14 } from "node:crypto";
-init_errors6();
-init_worktree_service();
+init_resolver();
 var FS = "";
 var RS = "";
 var COMMIT_HISTORY_DEFAULT_LIMIT = 50;
@@ -123196,7 +123289,7 @@ function parseNameStatus2(output2) {
   return files;
 }
 var GitGraphService = class {
-  constructor(worktrees2 = worktreeService) {
+  constructor(worktrees2) {
     this.worktrees = worktrees2;
   }
   target(worktreeId4) {
@@ -123325,7 +123418,10 @@ var GitGraphService = class {
     return { diff };
   }
 };
-var gitGraphService = new GitGraphService();
+
+// src/server/services/git-graph-service.ts
+init_worktree_service();
+var gitGraphService = new GitGraphService(worktreeService);
 
 // ../../node_modules/.pnpm/fzf@0.5.2/node_modules/fzf/dist/fzf.es.js
 var normalized = {
@@ -124383,9 +124479,14 @@ var searchService = new SearchService({
 // src/server/api/worktree/router.ts
 init_terminal_service();
 init_worktree_service();
-var worktreeOps = { files: filesService, diff: diffService, search: searchService };
+var pathsService = new PathsService(worktreeService);
+var worktreeOps = {
+  files: filesService,
+  diff: diffService,
+  search: searchService,
+  gitGraph: gitGraphService
+};
 var pathListSchema = external_exports2.array(filePathSchema).min(1).max(5e4);
-var commitShaSchema = external_exports2.string().regex(/^[0-9a-f]{7,40}$/i, "sha must be a 7\u201340 character hex commit id");
 var worktreeRouter = t.router({
   /**
    * A short-lived token for the worker that holds `worktreeId`, when that
@@ -124493,29 +124594,10 @@ var worktreeRouter = t.router({
       unsubscribe();
     }
   }),
-  listBranches: publicProcedure.input(
-    external_exports2.object({
-      worktreeId: external_exports2.string(),
-      query: external_exports2.string().max(200).optional(),
-      limit: external_exports2.number().int().min(1).max(500).optional()
-    })
-  ).query(
-    ({ input: input3 }) => diffService.listBranches(input3.worktreeId, { query: input3.query, limit: input3.limit })
-  ),
-  getCommitHistory: publicProcedure.input(
-    external_exports2.object({
-      worktreeId: external_exports2.string(),
-      skip: external_exports2.number().int().min(0).optional(),
-      limit: external_exports2.number().int().min(1).max(500).optional()
-    })
-  ).query(
-    ({ input: input3 }) => gitGraphService.getCommitHistory(input3.worktreeId, {
-      skip: input3.skip,
-      limit: input3.limit
-    })
-  ),
-  getCommitHistorySignature: publicProcedure.input(external_exports2.object({ worktreeId: external_exports2.string() })).query(({ input: input3 }) => gitGraphService.getCommitHistorySignature(input3.worktreeId)),
-  getCommitDetails: publicProcedure.input(external_exports2.object({ worktreeId: external_exports2.string(), sha: commitShaSchema })).query(({ input: input3 }) => gitGraphService.getCommitDetails(input3.worktreeId, input3.sha)),
+  listBranches: publicProcedure.input(directOps["worktree.listBranches"].input).query(({ input: input3 }) => directOps["worktree.listBranches"].run(worktreeOps, input3)),
+  getCommitHistory: publicProcedure.input(directOps["worktree.getCommitHistory"].input).query(({ input: input3 }) => directOps["worktree.getCommitHistory"].run(worktreeOps, input3)),
+  getCommitHistorySignature: publicProcedure.input(directOps["worktree.getCommitHistorySignature"].input).query(({ input: input3 }) => directOps["worktree.getCommitHistorySignature"].run(worktreeOps, input3)),
+  getCommitDetails: publicProcedure.input(directOps["worktree.getCommitDetails"].input).query(({ input: input3 }) => directOps["worktree.getCommitDetails"].run(worktreeOps, input3)),
   getCommitFileDiff: publicProcedure.input(
     external_exports2.object({
       worktreeId: external_exports2.string(),
@@ -124563,31 +124645,11 @@ var worktreeRouter = t.router({
   listFiles: publicProcedure.input(directOps["worktree.listFiles"].input).query(({ input: input3 }) => directOps["worktree.listFiles"].run(worktreeOps, input3)),
   getFile: publicProcedure.input(directOps["worktree.getFile"].input).query(({ input: input3 }) => directOps["worktree.getFile"].run(worktreeOps, input3)),
   saveFile: publicProcedure.input(directOps["worktree.saveFile"].input).mutation(({ input: input3 }) => directOps["worktree.saveFile"].run(worktreeOps, input3)),
-  createFile: publicProcedure.input(
-    external_exports2.object({
-      worktreeId: external_exports2.string(),
-      path: external_exports2.string().min(1),
-      content: external_exports2.string().default("")
-    })
-  ).mutation(({ input: input3 }) => filesService.createFile(input3.worktreeId, input3.path, input3.content)),
-  createDirectory: publicProcedure.input(external_exports2.object({ worktreeId: external_exports2.string(), path: external_exports2.string().min(1) })).mutation(({ input: input3 }) => filesService.createDirectory(input3.worktreeId, input3.path)),
-  deletePath: publicProcedure.input(external_exports2.object({ worktreeId: external_exports2.string(), path: external_exports2.string().min(1) })).mutation(({ input: input3 }) => filesService.deletePath(input3.worktreeId, input3.path)),
-  renamePath: publicProcedure.input(
-    external_exports2.object({
-      worktreeId: external_exports2.string(),
-      fromPath: external_exports2.string().min(1),
-      toPath: external_exports2.string().min(1)
-    })
-  ).mutation(
-    ({ input: input3 }) => filesService.renamePath(input3.worktreeId, input3.fromPath, input3.toPath)
-  ),
-  copyPath: publicProcedure.input(
-    external_exports2.object({
-      worktreeId: external_exports2.string(),
-      fromPath: external_exports2.string().min(1),
-      toPath: external_exports2.string().min(1)
-    })
-  ).mutation(({ input: input3 }) => filesService.copyPath(input3.worktreeId, input3.fromPath, input3.toPath)),
+  createFile: publicProcedure.input(directOps["worktree.createFile"].input).mutation(({ input: input3 }) => directOps["worktree.createFile"].run(worktreeOps, input3)),
+  createDirectory: publicProcedure.input(directOps["worktree.createDirectory"].input).mutation(({ input: input3 }) => directOps["worktree.createDirectory"].run(worktreeOps, input3)),
+  deletePath: publicProcedure.input(directOps["worktree.deletePath"].input).mutation(({ input: input3 }) => directOps["worktree.deletePath"].run(worktreeOps, input3)),
+  renamePath: publicProcedure.input(directOps["worktree.renamePath"].input).mutation(({ input: input3 }) => directOps["worktree.renamePath"].run(worktreeOps, input3)),
+  copyPath: publicProcedure.input(directOps["worktree.copyPath"].input).mutation(({ input: input3 }) => directOps["worktree.copyPath"].run(worktreeOps, input3)),
   /** A signed, expiring URL for one worktree file, for a browser tab that cannot send the auth header. */
   previewUrl: publicProcedure.input(external_exports2.object({ worktreeId: external_exports2.string(), path: external_exports2.string().min(1) })).query(({ input: input3 }) => {
     if (!worktreeService.resolve(input3.worktreeId)) {
@@ -124610,8 +124672,8 @@ var worktreeRouter = t.router({
   // `host.readFile` — and the `external` flag is load-bearing, not dead code:
   // it's how the client decides between a worktree-relative and an external
   // tab. Do not "harden" this by dropping the out-of-worktree classification.
-  resolvePath: publicProcedure.input(external_exports2.object({ worktreeId: external_exports2.string(), path: external_exports2.string().min(1) })).query(
-    ({ input: input3 }) => editorService.resolvePath({ worktreeId: input3.worktreeId, filePath: input3.path })
+  resolvePath: publicProcedure.input(resolvePathInput).query(
+    ({ input: input3 }) => pathsService.resolvePath({ worktreeId: input3.worktreeId, filePath: input3.path })
   ),
   searchContent: publicProcedure.input(directOps["worktree.searchContent"].input).query(({ input: input3 }) => directOps["worktree.searchContent"].run(worktreeOps, input3))
 });
@@ -125847,18 +125909,11 @@ async function handlePairExchange(req, res) {
 
 // src/server/api/plugins/stream-handler.ts
 init_src();
-init_plugin_host_service();
+
+// ../../packages/worktree-ops/src/plugin-stream-socket.ts
+init_src();
 var log85 = createLogger("plugin-stream");
-var STREAM_PATH = /^\/api\/plugins\/([a-z0-9][a-z0-9-]*)\/worktrees\/([^/]+)\/stream$/;
-function pluginStreamTarget(pathname) {
-  const match = STREAM_PATH.exec(pathname);
-  if (!match?.[1] || !match[2]) return null;
-  try {
-    return { pluginId: match[1], worktreeId: decodeURIComponent(match[2]) };
-  } catch {
-    return null;
-  }
-}
+var MAX_INPUT_BYTES = 64 * 1024;
 function parseModeRequest(text4) {
   try {
     const msg = JSON.parse(text4);
@@ -125867,8 +125922,7 @@ function parseModeRequest(text4) {
   }
   return null;
 }
-var MAX_INPUT_BYTES = 64 * 1024;
-async function handlePluginStream(ws, req, target) {
+async function bridgePluginStream(ws, label2, open4, onOpenFailed) {
   let controlling = false;
   let stream = null;
   ws.on("message", (data, isBinary) => {
@@ -125879,35 +125933,24 @@ async function handlePluginStream(ws, req, target) {
     const enabled = parseModeRequest(text4);
     if (enabled !== null) {
       controlling = enabled;
-      log85.debug(
-        "%s stream of %s is now %s",
-        target.pluginId,
-        target.worktreeId,
-        enabled ? "controlled" : "view-only"
-      );
+      log85.debug("%s is now %s", label2, enabled ? "controlled" : "view-only");
       return;
     }
     if (controlling && stream && text4.length <= MAX_INPUT_BYTES) stream.send(text4);
   });
   ws.once("close", () => stream?.close());
   try {
-    stream = await pluginHost.openStream(target.pluginId, target.worktreeId, "screen");
+    stream = await open4();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log85.warn("%s stream of %s is unavailable: %s", target.pluginId, target.worktreeId, message);
-    ws.close(4001, message.slice(0, 120));
+    log85.warn("%s is unavailable: %s", label2, message);
+    onOpenFailed(message);
     return;
   }
   if (ws.readyState !== ws.OPEN) {
     stream.close();
     return;
   }
-  log85.debug(
-    "%s viewer connected: %s (%s)",
-    target.pluginId,
-    target.worktreeId,
-    req.socket.remoteAddress ?? "unknown"
-  );
   try {
     for await (const message of stream.messages) {
       if (ws.readyState !== ws.OPEN) break;
@@ -125916,22 +125959,45 @@ async function handlePluginStream(ws, req, target) {
       );
     }
   } catch (err) {
-    log85.warn(
-      "%s stream of %s failed: %s",
-      target.pluginId,
-      target.worktreeId,
-      err.message
-    );
+    log85.warn("%s failed: %s", label2, err.message);
   } finally {
     stream.close();
     if (ws.readyState === ws.OPEN) ws.close(1e3, "The stream ended");
   }
 }
 
+// src/server/api/plugins/stream-handler.ts
+init_plugin_host_service();
+var log86 = createLogger("plugin-stream");
+var STREAM_PATH = /^\/api\/plugins\/([a-z0-9][a-z0-9-]*)\/worktrees\/([^/]+)\/stream$/;
+function pluginStreamTarget(pathname) {
+  const match = STREAM_PATH.exec(pathname);
+  if (!match?.[1] || !match[2]) return null;
+  try {
+    return { pluginId: match[1], worktreeId: decodeURIComponent(match[2]) };
+  } catch {
+    return null;
+  }
+}
+async function handlePluginStream(ws, req, target) {
+  log86.debug(
+    "%s viewer connected: %s (%s)",
+    target.pluginId,
+    target.worktreeId,
+    req.socket.remoteAddress ?? "unknown"
+  );
+  await bridgePluginStream(
+    ws,
+    `${target.pluginId} stream of ${target.worktreeId}`,
+    () => pluginHost.openStream(target.pluginId, target.worktreeId, "screen", { profile: "hub" }),
+    (message) => ws.close(4001, message.slice(0, 120))
+  );
+}
+
 // src/server/api/provisioning/handler.ts
 init_src();
 import { pipeline } from "node:stream";
-var log86 = createLogger("provisioning");
+var log87 = createLogger("provisioning");
 var PROVISION_PREFIX = "/api/provision/";
 var MAX_EXCHANGE_BODY_BYTES2 = 4096;
 var MAX_LOG_BODY_BYTES = 128 * 1024;
@@ -125988,7 +126054,7 @@ async function handleProvision(req, res) {
       send3(200, provisioningService.exchange(code2), "text/plain; charset=utf-8");
     } catch (err) {
       if (!(err instanceof ProvisionExchangeError)) throw err;
-      log86.debug(`provisioning exchange refused: ${err.reason}`);
+      log87.debug(`provisioning exchange refused: ${err.reason}`);
       refused();
     }
     return;
@@ -126124,7 +126190,7 @@ var OutputFlow = class {
 };
 
 // ../../packages/worktree-ops/src/terminal-socket.ts
-var log87 = createLogger("terminal-ws");
+var log88 = createLogger("terminal-ws");
 var MAX_CLOSE_REASON_BYTES = 123;
 var HEARTBEAT_INTERVAL_MS2 = 3e4;
 function clampCloseReason(reason) {
@@ -126192,7 +126258,7 @@ function createInbox(ws) {
   };
 }
 function attachSession(backend, ws, inbox, terminalId, worktreeId4, isNew, pendingMessage) {
-  log87.debug(
+  log88.debug(
     "Terminal %s: %s (worktree %s)",
     isNew ? "connected" : "reconnected",
     terminalId,
@@ -126212,7 +126278,7 @@ function attachSession(backend, ws, inbox, terminalId, worktreeId4, isNew, pendi
   });
   const unsubscribeExit = backend.onExit(terminalId, (event) => {
     unsubscribeTitle();
-    log87.debug("PTY exited with code %d for terminal %s", event.exitCode, terminalId);
+    log88.debug("PTY exited with code %d for terminal %s", event.exitCode, terminalId);
     if (ws.readyState === ws.OPEN) {
       ws.close(1e3, "Terminal exited");
     }
@@ -126240,7 +126306,7 @@ function attachSession(backend, ws, inbox, terminalId, worktreeId4, isNew, pendi
     try {
       attached = await backend.attach(terminalId, dims);
     } catch (err) {
-      log87.error("Failed to attach terminal %s: %s", terminalId, err);
+      log88.error("Failed to attach terminal %s: %s", terminalId, err);
       safeClose(ws, 1011, "Terminal attach failed");
       return;
     }
@@ -126282,7 +126348,7 @@ function attachSession(backend, ws, inbox, terminalId, worktreeId4, isNew, pendi
           const cols = Number.isFinite(parsed.cols) && parsed.cols > 0 ? parsed.cols : void 0;
           const rows = Number.isFinite(parsed.rows) && parsed.rows > 0 ? parsed.rows : void 0;
           void startReplay(cols, rows, parsed.flow === true).catch((err) => {
-            log87.error("Failed to replay terminal %s: %s", terminalId, err);
+            log88.error("Failed to replay terminal %s: %s", terminalId, err);
           });
           return;
         }
@@ -126302,7 +126368,7 @@ function attachSession(backend, ws, inbox, terminalId, worktreeId4, isNew, pendi
     flow?.dispose();
     attachment?.detach();
     unsubscribeExit();
-    log87.debug("Terminal disconnected: %s (PTY kept alive)", terminalId);
+    log88.debug("Terminal disconnected: %s (PTY kept alive)", terminalId);
   });
   if (pendingMessage) {
     processMessage(pendingMessage);
@@ -126325,7 +126391,7 @@ function handleMessage(backend, ws, terminalId, message) {
       }
       if (parsed.type === "close") {
         void backend.kill(terminalId).catch((err) => {
-          log87.error("Failed to kill terminal %s: %s", terminalId, err);
+          log88.error("Failed to kill terminal %s: %s", terminalId, err);
         });
         ws.close(1e3, "Terminal closed by client");
         return;
@@ -126341,7 +126407,7 @@ function handleMessage(backend, ws, terminalId, message) {
 
 // src/server/api/terminals/ws.ts
 init_terminal_service();
-var log88 = createLogger("terminal-ws");
+var log89 = createLogger("terminal-ws");
 async function handleTerminalConnection(ws, req) {
   if (!req.url) {
     safeClose(ws, 4e3, "Missing request URL");
@@ -126360,7 +126426,7 @@ async function handleTerminalConnection(ws, req) {
     existing = await terminalService.info(terminalId) !== null;
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    log88.error("Failed to look up terminal %s: %s", terminalId, msg);
+    log89.error("Failed to look up terminal %s: %s", terminalId, msg);
     safeClose(ws, 1011, msg);
     return;
   }
@@ -126408,7 +126474,7 @@ async function handleTerminalConnection(ws, req) {
     await terminalService.spawn(worktreeId4, terminalId, spawnOpts);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    log88.error("Failed to spawn terminal %s for worktree %s: %s", terminalId, worktreeId4, msg);
+    log89.error("Failed to spawn terminal %s for worktree %s: %s", terminalId, worktreeId4, msg);
     safeClose(ws, 4001, msg);
     return;
   }
@@ -126547,7 +126613,7 @@ init_src();
 init_wrapper();
 init_browser_lookup();
 init_remote_cdp();
-var log89 = createLogger("cdp-proxy");
+var log90 = createLogger("cdp-proxy");
 async function handleCdpConnection(ws, req) {
   const url3 = new URL(req.url ?? "", `http://${req.headers.host}`);
   const bandTabId = url3.searchParams.get("bandTabId");
@@ -126590,17 +126656,17 @@ async function handleCdpConnection(ws, req) {
     cdpTargetId = await ensureCdpTargetId(bandTabId);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log89.debug("ensureCdpTargetId failed for %s: %s", bandTabId, message);
+    log90.debug("ensureCdpTargetId failed for %s: %s", bandTabId, message);
     if (ws.readyState === ws.OPEN) {
       ws.close(4001, message.slice(0, 123));
     }
     return;
   }
   const upstreamUrl = `ws://${DESKTOP_CDP_HOST}:${DESKTOP_CDP_PORT}/devtools/page/${encodeURIComponent(cdpTargetId)}`;
-  log89.info("CDP proxy connecting bandTabId=%s upstream=%s", bandTabId, upstreamUrl);
+  log90.info("CDP proxy connecting bandTabId=%s upstream=%s", bandTabId, upstreamUrl);
   upstream = new wrapper_default(upstreamUrl);
   upstream.on("open", () => {
-    log89.info("CDP upstream open bandTabId=%s pending=%d", bandTabId, pending2.length);
+    log90.info("CDP upstream open bandTabId=%s pending=%d", bandTabId, pending2.length);
     for (const msg of pending2) {
       upstream?.send(msg);
     }
@@ -126612,20 +126678,20 @@ async function handleCdpConnection(ws, req) {
     }
   });
   upstream.on("error", (err) => {
-    log89.warn("CDP upstream error bandTabId=%s: %s", bandTabId, err.message);
+    log90.warn("CDP upstream error bandTabId=%s: %s", bandTabId, err.message);
     markTargetDestroyed(bandTabId);
     if (ws.readyState === ws.OPEN) {
       ws.close(4001, `Desktop CDP error: ${err.message}`.slice(0, 123));
     }
   });
   upstream.on("close", (code) => {
-    log89.info("CDP upstream closed bandTabId=%s code=%d", bandTabId, code);
+    log90.info("CDP upstream closed bandTabId=%s code=%d", bandTabId, code);
     if (ws.readyState === ws.OPEN) {
       ws.close(1e3, "Upstream closed");
     }
   });
   ws.on("close", () => {
-    log89.debug("CDP client closed bandTabId=%s", bandTabId);
+    log90.debug("CDP client closed bandTabId=%s", bandTabId);
     if (upstream && (upstream.readyState === wrapper_default.OPEN || upstream.readyState === wrapper_default.CONNECTING)) {
       try {
         upstream.close();
@@ -126634,7 +126700,7 @@ async function handleCdpConnection(ws, req) {
     }
   });
   ws.on("error", (err) => {
-    log89.debug("CDP client error bandTabId=%s: %s", bandTabId, err.message);
+    log90.debug("CDP client error bandTabId=%s: %s", bandTabId, err.message);
     try {
       upstream?.close();
     } catch {
@@ -126664,7 +126730,7 @@ async function bridgeRemote(ws, worktreeId4) {
     cdp = await openRemoteCdp(worktreeId4);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log89.warn("remote CDP failed for worktree %s: %s", worktreeId4, message);
+    log90.warn("remote CDP failed for worktree %s: %s", worktreeId4, message);
     if (ws.readyState === ws.OPEN)
       ws.close(4001, closeReason(`Remote browser unavailable: ${message}`));
     return true;
@@ -126688,7 +126754,7 @@ async function bridgeRemote(ws, worktreeId4) {
         if (ws.readyState === ws.OPEN) ws.send(message);
       }
     } catch (err) {
-      log89.debug("remote CDP stream ended for worktree %s: %s", worktreeId4, String(err));
+      log90.debug("remote CDP stream ended for worktree %s: %s", worktreeId4, String(err));
     }
     if (ws.readyState === ws.OPEN) ws.close(1e3, "Upstream closed");
   })();
@@ -126698,7 +126764,7 @@ async function bridgeRemote(ws, worktreeId4) {
 // src/server/infra/browser-host/cdp-targets.ts
 init_src();
 init_wrapper();
-var log90 = createLogger("cdp-targets");
+var log91 = createLogger("cdp-targets");
 var CdpUnreachableError = class extends Error {
   constructor(message) {
     super(message);
@@ -126754,7 +126820,7 @@ async function captureSnapshot(bandTabId) {
     });
     ws.on("error", (err) => {
       clearTimeout(timeout);
-      log90.debug("captureSnapshot ws error for tab %s: %s", bandTabId, err.message);
+      log91.debug("captureSnapshot ws error for tab %s: %s", bandTabId, err.message);
       markTargetDestroyed(bandTabId);
       settle2(new CdpUnreachableError(err.message));
     });
@@ -126881,7 +126947,7 @@ var RfbClientFilter = class {
 };
 
 // src/server/infra/host/desktop-proxy.ts
-var log91 = createLogger("desktop-proxy");
+var log92 = createLogger("desktop-proxy");
 var DESKTOP_PATH = /^\/api\/hosts\/([^/]+)\/desktop$/;
 function desktopHostId(pathname) {
   const match = DESKTOP_PATH.exec(pathname);
@@ -126930,7 +126996,7 @@ async function handleDesktopConnection(ws, req, hostId2) {
       );
       if (enabled !== null) {
         filter.viewOnly = !enabled;
-        log91.debug("desktop of host %s is now %s", hostId2, enabled ? "controlled" : "view-only");
+        log92.debug("desktop of host %s is now %s", hostId2, enabled ? "controlled" : "view-only");
       }
       return;
     }
@@ -126965,7 +127031,7 @@ async function handleDesktopConnection(ws, req, hostId2) {
     opened = true;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log91.warn("desktop of host %s is unavailable: %s", hostId2, message);
+    log92.warn("desktop of host %s is unavailable: %s", hostId2, message);
     release();
     ws.close(4001, message.slice(0, 120));
     return;
@@ -126975,7 +127041,7 @@ async function handleDesktopConnection(ws, req, hostId2) {
     release();
     return;
   }
-  log91.debug("desktop viewer connected: %s (%s)", hostId2, req.socket.remoteAddress ?? "unknown");
+  log92.debug("desktop viewer connected: %s (%s)", hostId2, req.socket.remoteAddress ?? "unknown");
   for (const chunk of pending2.splice(0)) desktop.write(chunk);
   try {
     for await (const bytes of desktop.output) {
@@ -126983,7 +127049,7 @@ async function handleDesktopConnection(ws, req, hostId2) {
       await new Promise((resolve15) => ws.send(bytes, { binary: true }, () => resolve15()));
     }
   } catch (err) {
-    log91.warn("desktop stream of host %s failed: %s", hostId2, err.message);
+    log92.warn("desktop stream of host %s failed: %s", hostId2, err.message);
   } finally {
     if (opened) {
       desktop.close();
@@ -126996,12 +127062,9 @@ async function handleDesktopConnection(ws, req, hostId2) {
 // start-server.ts
 init_registry();
 
-// src/server/infra/lsp/lsp-proxy.ts
+// ../../packages/worktree-ops/src/lsp-socket.ts
 init_src();
-init_worktrees();
-init_registry();
-var worktreeQueries2 = new WorktreeQueries();
-var log92 = createLogger("lsp-proxy");
+var log93 = createLogger("lsp-proxy");
 function frameMessage(json4) {
   const body = Buffer.from(json4, "utf-8");
   const header = `Content-Length: ${body.byteLength}\r
@@ -127019,7 +127082,7 @@ function createFrameParser(onMessage) {
       const headerStr = buffer.subarray(0, separatorIdx).toString("ascii");
       const match = headerStr.match(/Content-Length:\s*(\d+)/i);
       if (!match) {
-        log92.warn("Malformed LSP header: %s", headerStr);
+        log93.warn("Malformed LSP header: %s", headerStr);
         buffer = buffer.subarray(separatorIdx + 4);
         continue;
       }
@@ -127043,28 +127106,17 @@ function didCloseMessage(uri) {
   });
 }
 var serverDocuments = /* @__PURE__ */ new Map();
-async function handleLspConnection(ws, req) {
-  const url3 = new URL(req.url, `http://${req.headers.host}`);
-  const worktreeId4 = url3.searchParams.get("worktreeId");
-  const lang = url3.searchParams.get("lang");
-  if (!worktreeId4 || !lang) {
-    ws.close(4e3, "Missing worktreeId or lang");
-    return;
-  }
+async function serveLspSocket(ws, worktreeId4, lang, connect3) {
   const pendingMessages = [];
   ws.on("message", (data) => {
     pendingMessages.push(data.toString());
   });
   let connection;
   try {
-    const worktree = worktreeQueries2.findIdentity(worktreeId4);
-    if (!worktree) {
-      throw new Error(`Worktree not found: ${worktreeId4}`);
-    }
-    connection = await hostRegistry.hostFor(worktreeId4).lsp.connect({ worktreeId: worktreeId4, lang, root: worktree.worktreePath });
+    connection = await connect3();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log92.error("Failed to spawn %s language server for worktree %s: %s", lang, worktreeId4, message);
+    log93.error("Failed to spawn %s language server for worktree %s: %s", lang, worktreeId4, message);
     ws.close(4001, message);
     return;
   }
@@ -127072,7 +127124,7 @@ async function handleLspConnection(ws, req) {
     connection.close();
     return;
   }
-  log92.debug("LSP client connected: %s/%s", worktreeId4, lang);
+  log93.debug("LSP client connected: %s/%s", worktreeId4, lang);
   const pendingRequests = /* @__PURE__ */ new Map();
   const openDocuments = /* @__PURE__ */ new Set();
   const serverId = `${worktreeId4}:${lang}`;
@@ -127108,7 +127160,7 @@ async function handleLspConnection(ws, req) {
   const retriedIds = /* @__PURE__ */ new Set();
   const RETRY_DELAY_MS = 2e3;
   const parseFrame = createFrameParser((json4) => {
-    log92.debug(
+    log93.debug(
       "LSP stdout [%s/%s]: %s",
       worktreeId4,
       lang,
@@ -127120,7 +127172,7 @@ async function handleLspConnection(ws, req) {
         const originalRequest = pendingRequests.get(msg.id);
         retriedIds.add(msg.id);
         pendingRequests.delete(msg.id);
-        log92.debug(
+        log93.debug(
           "LSP retrying request %d after 'No Project' error [%s/%s]",
           msg.id,
           worktreeId4,
@@ -127151,16 +127203,16 @@ async function handleLspConnection(ws, req) {
       for await (const chunk of connection.output)
         parseFrame(Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength));
     } catch (err) {
-      log92.warn("LSP output stream failed [%s/%s]: %s", worktreeId4, lang, String(err));
+      log93.warn("LSP output stream failed [%s/%s]: %s", worktreeId4, lang, String(err));
     }
     release();
     if (ws.readyState === ws.OPEN) {
-      log92.debug("LSP server exited, closing WebSocket");
+      log93.debug("LSP server exited, closing WebSocket");
       ws.close(1e3, "Language server exited");
     }
   })();
   function forwardToStdin(json4) {
-    log92.debug(
+    log93.debug(
       "LSP stdin [%s/%s]: %s",
       worktreeId4,
       lang,
@@ -127192,7 +127244,28 @@ async function handleLspConnection(ws, req) {
   ws.on("close", () => {
     release();
     connection.close();
-    log92.debug("LSP client disconnected: %s/%s (server kept alive)", worktreeId4, lang);
+    log93.debug("LSP client disconnected: %s/%s (server kept alive)", worktreeId4, lang);
+  });
+}
+
+// src/server/infra/lsp/lsp-proxy.ts
+init_worktrees();
+init_registry();
+var worktreeQueries2 = new WorktreeQueries();
+async function handleLspConnection(ws, req) {
+  const url3 = new URL(req.url, `http://${req.headers.host}`);
+  const worktreeId4 = url3.searchParams.get("worktreeId");
+  const lang = url3.searchParams.get("lang");
+  if (!worktreeId4 || !lang) {
+    ws.close(4e3, "Missing worktreeId or lang");
+    return;
+  }
+  await serveLspSocket(ws, worktreeId4, lang, async () => {
+    const worktree = worktreeQueries2.findIdentity(worktreeId4);
+    if (!worktree) {
+      throw new Error(`Worktree not found: ${worktreeId4}`);
+    }
+    return hostRegistry.hostFor(worktreeId4).lsp.connect({ worktreeId: worktreeId4, lang, root: worktree.worktreePath });
   });
 }
 
@@ -127200,35 +127273,10 @@ async function handleLspConnection(ws, req) {
 init_webhook2();
 
 // src/server/services/_utils/byte-range.ts
-function parseByteRange(header, size) {
-  const match = /^bytes=(\d*)-(\d*)$/.exec(header?.trim() ?? "");
-  if (!match || match[1] === "" && match[2] === "") return null;
-  if (match[1] !== "" && match[2] !== "" && Number(match[2]) < Number(match[1])) return null;
-  let start;
-  let end;
-  if (match[1] === "") {
-    const length = Number(match[2]);
-    if (length === 0) return "unsatisfiable";
-    start = Math.max(0, size - length);
-    end = size - 1;
-  } else {
-    start = Number(match[1]);
-    end = match[2] === "" ? size - 1 : Math.min(Number(match[2]), size - 1);
-  }
-  if (start >= size || start > end) return "unsatisfiable";
-  return { start, end };
-}
+init_http_files();
 
 // src/server/services/_utils/content-disposition.ts
-function attachmentDisposition(filename) {
-  const clean = filename.replace(/[/\\]/g, "_") || "download";
-  const ascii = clean.replace(/[^\x20-\x7e]/g, "_").replace(/["%;]/g, "_");
-  const encoded = encodeURIComponent(clean).replace(
-    /['()*]/g,
-    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`
-  );
-  return `attachment; filename="${ascii}"; filename*=UTF-8''${encoded}`;
-}
+init_http_files();
 
 // src/server/services/_utils/hosted-file.ts
 init_registry();
@@ -135387,15 +135435,15 @@ init_src();
 init_registry();
 async function installSkills2(opts = {}) {
   const result = await hostRegistry.local.agentEnv.installSkills({ home: opts.home });
-  const log94 = opts.log;
-  if (log94) {
-    for (const warning of result.warnings) log94.warn(warning);
-    for (const path2 of result.written) log94.info("Installed skill at %s", path2);
+  const log95 = opts.log;
+  if (log95) {
+    for (const warning of result.warnings) log95.warn(warning);
+    for (const path2 of result.written) log95.info("Installed skill at %s", path2);
     for (const path2 of result.updated) {
-      log94.info("Updated skill at %s (content differed \u2014 shipped version reinstalled)", path2);
+      log95.info("Updated skill at %s (content differed \u2014 shipped version reinstalled)", path2);
     }
     for (const conflict of result.conflicts) {
-      log94.warn("Skill symlink conflict \u2014 %s (left as-is; remove it manually to re-link)", conflict);
+      log95.warn("Skill symlink conflict \u2014 %s (left as-is; remove it manually to re-link)", conflict);
     }
   }
   return result;
@@ -135408,7 +135456,7 @@ init_state();
 init_sync_service();
 init_worktree_group_service();
 init_worktree_service();
-var log93 = createLogger("setup");
+var log94 = createLogger("setup");
 async function runFirstTimeSetup() {
   forgetLocalWorktrees();
   convertLegacyLabels();
@@ -135421,7 +135469,7 @@ async function runFirstTimeSetup() {
   ]);
   for (const r of results) {
     if (r.status === "rejected") {
-      log93.warn(
+      log94.warn(
         "Setup step failed: %s",
         r.reason instanceof Error ? r.reason.message : String(r.reason)
       );
@@ -135435,7 +135483,7 @@ async function refreshAgentModelsInBackground() {
     const ok2 = results.filter((r) => !r.error).length;
     const failed = results.length - ok2;
     if (results.length > 0) {
-      log93.info(
+      log94.info(
         "Background model refresh: %d/%d agents updated (%d failed)",
         ok2,
         results.length,
@@ -135443,7 +135491,7 @@ async function refreshAgentModelsInBackground() {
       );
     }
   } catch (err) {
-    log93.warn(
+    log94.warn(
       "Background model refresh failed: %s",
       err instanceof Error ? err.message : String(err)
     );
@@ -135458,7 +135506,7 @@ async function ensureRepoRemotes() {
   try {
     await repoService.backfillRemotes();
   } catch (err) {
-    log93.warn(
+    log94.warn(
       "Failed to record repo remotes at boot: %s",
       err instanceof Error ? err.message : String(err)
     );
@@ -135468,7 +135516,7 @@ function migrateRepoCronjobs() {
   try {
     cronjobService.migrateRepoJobs();
   } catch (err) {
-    log93.warn(
+    log94.warn(
       "Failed to move repo-scoped cronjobs to worktrees at boot: %s",
       err instanceof Error ? err.message : String(err)
     );
@@ -135478,7 +135526,7 @@ function convertLegacyLabels() {
   try {
     worktreeGroupService.convertLegacyLabels();
   } catch (err) {
-    log93.warn(
+    log94.warn(
       "Failed to convert repo labels to groups at boot: %s",
       err instanceof Error ? err.message : String(err)
     );
@@ -135488,7 +135536,7 @@ function forgetLocalWorktrees() {
   try {
     worktreeService.forgetLocalWorktrees();
   } catch (err) {
-    log93.warn(
+    log94.warn(
       "Failed to forget local worktrees at boot: %s",
       err instanceof Error ? err.message : String(err)
     );
@@ -135498,7 +135546,7 @@ async function ensureRepoStateInSync() {
   try {
     await syncService.syncWorktrees();
   } catch (err) {
-    log93.warn(
+    log94.warn(
       "Failed to sync repo state at boot: %s",
       err instanceof Error ? err.message : String(err)
     );
@@ -135509,22 +135557,22 @@ async function ensureCliInstalled() {
   try {
     cliStatus = await checkCli();
   } catch (err) {
-    log93.warn("Could not check CLI status: %s", err instanceof Error ? err.message : String(err));
+    log94.warn("Could not check CLI status: %s", err instanceof Error ? err.message : String(err));
     return;
   }
   if (cliStatus === "Installed") {
     return;
   }
   if (cliStatus !== "NotInstalled") {
-    log93.warn("CLI not auto-installed (status: %s)", cliStatus);
+    log94.warn("CLI not auto-installed (status: %s)", cliStatus);
     return;
   }
-  log93.info("Installing band CLI...");
+  log94.info("Installing band CLI...");
   try {
     await installCli();
-    log93.info("CLI installed to %s", SYMLINK_PATH);
+    log94.info("CLI installed to %s", SYMLINK_PATH);
   } catch (err) {
-    log93.warn("CLI installation failed: %s", err instanceof Error ? err.message : String(err));
+    log94.warn("CLI installation failed: %s", err instanceof Error ? err.message : String(err));
   }
 }
 async function ensureDefaultCodingAgents() {
@@ -135533,17 +135581,17 @@ async function ensureDefaultCodingAgents() {
   if (Array.isArray(existing) && existing.length > 0) {
     return;
   }
-  log93.info("Detecting installed coding agents...");
+  log94.info("Detecting installed coding agents...");
   const detected = [];
   for (const check3 of AGENT_CHECKS) {
     const path2 = await systemService.whichBinary(check3.binary);
     if (path2) {
-      log93.info("Detected coding agent: %s (%s)", check3.id, path2);
+      log94.info("Detected coding agent: %s (%s)", check3.id, path2);
       detected.push({ id: check3.id, type: check3.type, label: check3.label });
     }
   }
   if (detected.length === 0) {
-    log93.info("No coding agent CLIs detected on PATH");
+    log94.info("No coding agent CLIs detected on PATH");
     return;
   }
   const current3 = loadSettings();
@@ -135552,7 +135600,7 @@ async function ensureDefaultCodingAgents() {
     current3.defaultCodingAgent = detected[0].id;
   }
   saveSettings(current3);
-  log93.info("Enabled %d coding agent(s); default = %s", detected.length, current3.defaultCodingAgent);
+  log94.info("Enabled %d coding agent(s); default = %s", detected.length, current3.defaultCodingAgent);
 }
 function ensureNotificationDefaults() {
   const settings3 = loadSettings();
@@ -135564,7 +135612,7 @@ function ensureNotificationDefaults() {
     ...settings3,
     notifications: { ...notifications, soundOnNeedsAttention: true }
   });
-  log93.info("Set default notifications.soundOnNeedsAttention = true");
+  log94.info("Set default notifications.soundOnNeedsAttention = true");
 }
 function migrateAgentDefaultMode() {
   const settings3 = loadSettings();
@@ -135572,15 +135620,15 @@ function migrateAgentDefaultMode() {
   const mode = agentModeFromVia(settings3.cli?.defaultVia);
   if (!mode) return;
   saveSettings({ ...settings3, agents: { ...settings3.agents, defaultMode: mode } });
-  log93.info("Migrated cli.defaultVia to agents.defaultMode = %s", mode);
+  log94.info("Migrated cli.defaultVia to agents.defaultMode = %s", mode);
 }
 async function ensureSkillsInstalled() {
   try {
-    const result = await installSkills2({ log: log93 });
+    const result = await installSkills2({ log: log94 });
     const wrote = result.written.length + result.updated.length;
     const linkChange = result.linked.length;
     if (wrote > 0 || linkChange > 0 || result.conflicts.length > 0) {
-      log93.info(
+      log94.info(
         "Synced CLI skills (shared: %d written, %d updated, %d unchanged; symlinks: %d created, %d already-linked, %d conflicts, %d skipped)",
         result.written.length,
         result.updated.length,
@@ -135592,7 +135640,7 @@ async function ensureSkillsInstalled() {
       );
     }
   } catch (err) {
-    log93.warn("Failed to sync CLI skills: %s", err instanceof Error ? err.message : String(err));
+    log94.warn("Failed to sync CLI skills: %s", err instanceof Error ? err.message : String(err));
   }
 }
 var SetupService = class {
@@ -135732,13 +135780,6 @@ function getCachedScalarHtml() {
   _scalarHtml = getScalarHtml("/api/openapi.json");
   return _scalarHtml;
 }
-function hostedFileHeaders(contentType) {
-  const headers = { "X-Content-Type-Options": "nosniff" };
-  if (/^(text\/html|image\/svg\+xml)\b/.test(contentType)) {
-    headers["Content-Security-Policy"] = "sandbox allow-scripts";
-  }
-  return headers;
-}
 function serveStaticFile(res, root, subdir, rawFilename) {
   const filename = basename7(decodeURIComponent(rawFilename));
   if (!filename || filename.includes("..")) {