@coopcli/specsketch 0.1.2 → 5.2.0

package/dist/cli/index.js

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 
 // server/cli.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync as readdirSync2 } from "node:fs";
-import { homedir } from "node:os";
-import { dirname as dirname2, extname, join as join2, normalize, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync as readdirSync3 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname3, extname, join as join5, normalize as normalize2, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
-import { parseArgs } from "node:util";
+import { parseArgs as parseArgs2 } from "node:util";
 import { serve } from "@hono/node-server";
 import Anthropic from "@anthropic-ai/sdk";
+import { WebSocketServer } from "ws";
 
 // server/app.ts
 import { zodOutputFormat } from "@anthropic-ai/sdk/helpers/zod";
@@ -41,10 +42,29 @@ var GENERATION_MODELS = [
 ];
 var DEFAULT_MODEL = "claude-opus-4-8";
 var GenerationModel = z.enum(GENERATION_MODELS);
+var ChatRole = z.enum(["user", "assistant", "summary"]);
+var ChatMessage = z.object({
+  role: ChatRole,
+  text: z.string(),
+  /** ISO-8601 creation time. */
+  at: z.string()
+});
 var SpecRequest = z.object({
   title: z.string().optional(),
   model: GenerationModel.optional(),
-  graph: DiagramGraph
+  graph: DiagramGraph,
+  /**
+   * The spec-review conversation so far. Regenerate sends it; the server
+   * folds it into the generation prompt as steering context and resets the
+   * chat with a seed summary afterwards.
+   */
+  conversation: z.array(ChatMessage).optional(),
+  /**
+   * User-edited generation system prompt (System Prompt side-pane option).
+   * Absent → the server's effective prompt (workspace override or built-in
+   * default). `@` references inside it resolve like any other input.
+   */
+  systemPrompt: z.string().optional()
 });
 var CapabilitySpec = z.object({
   capability: z.string(),
@@ -64,6 +84,38 @@ var SpecBundle = z.object({
   /** One entry per capability the architecture introduces. */
   specs: z.array(CapabilitySpec)
 });
+var ChatRequest = z.object({
+  /** The user's new message (may contain `@` references). */
+  message: z.string().min(1),
+  /** Conversation history preceding `message`, oldest first. */
+  conversation: z.array(ChatMessage).default([]),
+  model: GenerationModel.optional(),
+  /** URL mode has no workspace — the client supplies the bundle to ground in. */
+  bundle: SpecBundle.optional()
+});
+var UnresolvedRefInfo = z.object({ ref: z.string(), reason: z.string() });
+var ChatReply = z.object({
+  reply: ChatMessage,
+  /** Workspace-relative paths whose contents joined the answer's context. */
+  resolvedRefs: z.array(z.string()),
+  /** References that soft-failed, with the reason shown to the user. */
+  unresolvedRefs: z.array(UnresolvedRefInfo)
+});
+var SpecResponse = z.object({
+  bundle: SpecBundle,
+  seed: z.array(ChatMessage)
+});
+var PromptSave = z.object({
+  system: z.string().min(1).nullable()
+});
+var PromptInfo = z.object({
+  /** The prompt the next generation will use (custom override or default). */
+  system: z.string(),
+  /** The built-in default, for the editor's Reset action. */
+  default: z.string(),
+  /** True when a custom override is active. */
+  custom: z.boolean()
+});
 var ExcalidrawScene = z.object({
   elements: z.array(z.unknown()),
   appState: z.record(z.string(), z.unknown()).optional(),
@@ -79,9 +131,242 @@ var SessionSnapshot = z.object({
   title: z.string().optional(),
   model: GenerationModel.optional(),
   scene: ExcalidrawScene.nullable(),
-  bundle: SpecBundle.nullable()
+  bundle: SpecBundle.nullable(),
+  /** Persisted spec-review chat (seed + exchanges), oldest first. */
+  chat: z.array(ChatMessage).optional()
 });
 
+// server/references.ts
+import { readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { basename, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
+var REF_FILE_BYTE_LIMIT = 64 * 1024;
+var REF_TOTAL_BYTE_LIMIT = 256 * 1024;
+var REF_DIR_FILE_LIMIT = 50;
+var SEARCH_IGNORE = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".wrangler", ".DS_Store"]);
+function parseReferences(text) {
+  const tokens = [];
+  const pattern = /(^|[\s([{'"`])@([^\s@]+)/g;
+  for (const match of text.matchAll(pattern)) {
+    const token = (match[2] ?? "").replace(/[.,;:!?)\]}'"`>]+$/, "");
+    if (!token || token.startsWith("<")) continue;
+    if (!tokens.includes(token)) tokens.push(token);
+  }
+  return tokens;
+}
+function insideRoot(rootReal, target) {
+  return target.startsWith(rootReal + sep);
+}
+var WALK_ENTRY_LIMIT = 2e4;
+function collectEntries(root) {
+  const files = [];
+  const dirs = [];
+  const walk = (dir) => {
+    if (files.length + dirs.length >= WALK_ENTRY_LIMIT) return;
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (files.length + dirs.length >= WALK_ENTRY_LIMIT) return;
+      if (SEARCH_IGNORE.has(entry.name) || entry.isSymbolicLink()) continue;
+      const full = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        dirs.push(relative(root, full));
+        walk(full);
+      } else if (entry.isFile()) files.push(relative(root, full));
+    }
+  };
+  walk(root);
+  return { files, dirs };
+}
+var collectFiles = (root) => collectEntries(root).files;
+function findByName(root, name) {
+  return collectFiles(root).filter((p) => basename(p) === name).sort((a, b) => {
+    const depth = a.split(sep).length - b.split(sep).length;
+    return depth !== 0 ? depth : a.localeCompare(b);
+  });
+}
+var FILE_SEARCH_LIMIT = 20;
+function searchFiles(root, query, limit = FILE_SEARCH_LIMIT) {
+  if (root === void 0) return [];
+  let rootReal;
+  try {
+    rootReal = realpathSync(resolve(root));
+  } catch {
+    return [];
+  }
+  const q = query.trim().toLowerCase();
+  const { files, dirs } = collectEntries(rootReal);
+  const all = [...dirs.map((d) => `${d}/`), ...files];
+  const matches = q ? all.filter((p) => p.toLowerCase().includes(q)) : all;
+  const rank = (p) => {
+    const lower = p.toLowerCase();
+    return [
+      q && basename(lower.replace(/\/$/, "")).includes(q) ? 0 : 1,
+      q ? lower.indexOf(q) : 0,
+      p.length
+    ];
+  };
+  return matches.map((p) => ({ p, r: rank(p) })).sort(
+    (a, b) => a.r[0] - b.r[0] || a.r[1] - b.r[1] || a.r[2] - b.r[2] || a.p.localeCompare(b.p)
+  ).slice(0, limit).map(({ p }) => p);
+}
+function readClamped(target) {
+  const raw = readFileSync(target);
+  if (raw.byteLength <= REF_FILE_BYTE_LIMIT) {
+    return { content: raw.toString("utf8"), truncated: false };
+  }
+  return {
+    content: `${raw.subarray(0, REF_FILE_BYTE_LIMIT).toString("utf8")}
+\u2026 [truncated at ${REF_FILE_BYTE_LIMIT} bytes]`,
+    truncated: true
+  };
+}
+function expandReferences(text, root) {
+  const resolved = [];
+  const unresolved = [];
+  const refs = parseReferences(text);
+  if (refs.length === 0) return { resolved, unresolved };
+  let rootReal = null;
+  if (root !== void 0) {
+    try {
+      rootReal = realpathSync(resolve(root));
+    } catch {
+      rootReal = null;
+    }
+  }
+  let totalBytes = 0;
+  for (const ref of refs) {
+    if (rootReal === null) {
+      unresolved.push({ ref, reason: "file references are unavailable here" });
+      continue;
+    }
+    if (totalBytes >= REF_TOTAL_BYTE_LIMIT) {
+      unresolved.push({ ref, reason: "reference budget exceeded \u2014 too much file content already included" });
+      continue;
+    }
+    const outcome = resolveOne(rootReal, ref);
+    if ("reason" in outcome) {
+      unresolved.push({ ref, ...outcome });
+      continue;
+    }
+    if ("dirFiles" in outcome) {
+      let included = 0;
+      for (const relPath of outcome.dirFiles) {
+        if (included >= REF_DIR_FILE_LIMIT || totalBytes >= REF_TOTAL_BYTE_LIMIT) break;
+        let body;
+        try {
+          body = readClamped(join(rootReal, relPath));
+        } catch {
+          continue;
+        }
+        totalBytes += Buffer.byteLength(body.content, "utf8");
+        resolved.push({ ref, path: relPath, ...body });
+        included++;
+      }
+      const omitted = outcome.dirFiles.length - included;
+      if (included === 0) {
+        unresolved.push({
+          ref,
+          reason: "reference budget exceeded \u2014 too much file content already included"
+        });
+      } else if (omitted > 0) {
+        unresolved.push({
+          ref,
+          kind: "partial",
+          reason: `directory partially included \u2014 ${omitted} of ${outcome.dirFiles.length} files omitted by the size budget`
+        });
+      }
+      continue;
+    }
+    totalBytes += Buffer.byteLength(outcome.content, "utf8");
+    resolved.push({ ref, ...outcome });
+  }
+  return { resolved, unresolved };
+}
+function resolveOne(rootReal, ref) {
+  if (isAbsolute(ref)) return { reason: "absolute paths are not allowed" };
+  const rel = normalize(ref);
+  if (rel.split(sep).includes("..")) return { reason: "path escapes the working directory" };
+  const direct = resolve(rootReal, rel);
+  if (direct !== rootReal && !insideRoot(rootReal, direct)) {
+    return { reason: "path escapes the working directory" };
+  }
+  const stats = statOrNull(direct);
+  if (stats?.isDirectory()) {
+    let real;
+    try {
+      real = realpathSync(direct);
+    } catch {
+      return { reason: "not readable" };
+    }
+    if (real !== rootReal && !insideRoot(rootReal, real)) {
+      return { reason: "resolves outside the working directory" };
+    }
+    const dirFiles = collectFiles(direct).map((p) => relative(rootReal, join(direct, p))).sort((a, b) => {
+      const depth = a.split(sep).length - b.split(sep).length;
+      return depth !== 0 ? depth : a.localeCompare(b);
+    });
+    if (dirFiles.length === 0) return { reason: "directory contains no files" };
+    return { dirFiles };
+  }
+  if (stats?.isFile()) {
+    let real;
+    try {
+      real = realpathSync(direct);
+    } catch {
+      return { reason: "not readable" };
+    }
+    if (!insideRoot(rootReal, real)) return { reason: "resolves outside the working directory" };
+    try {
+      return { path: relative(rootReal, direct), ...readClamped(direct) };
+    } catch {
+      return { reason: "not readable" };
+    }
+  }
+  if (rel.includes(sep)) return { reason: "not found" };
+  const matches = findByName(rootReal, rel);
+  if (matches.length === 0) return { reason: "not found" };
+  const best = matches[0];
+  try {
+    const body = readClamped(join(rootReal, best));
+    return {
+      path: best,
+      ...body,
+      ...matches.length > 1 ? {
+        note: `ambiguous \u2014 ${matches.length} files named "${rel}"; using ${best}, others: ${matches.slice(1, 5).join(", ")}${matches.length > 5 ? ", \u2026" : ""}`
+      } : {}
+    };
+  } catch {
+    return { reason: "not readable" };
+  }
+}
+function statOrNull(path) {
+  try {
+    return statSync(path);
+  } catch {
+    return null;
+  }
+}
+function renderReferenceContext(expansion) {
+  const parts = [];
+  for (const r of expansion.resolved) {
+    const note = r.note ? `(${r.note})
+` : "";
+    parts.push(`=== @${r.path} ===
+${note}${r.content}
+=== end @${r.path} ===`);
+  }
+  for (const u of expansion.unresolved) {
+    parts.push(
+      u.kind === "partial" ? `@${u.ref}: ${u.reason}.` : `@${u.ref}: could not be resolved (${u.reason}) \u2014 do not invent its contents.`
+    );
+  }
+  return parts.join("\n\n");
+}
+
 // server/app.ts
 var SYSTEM = `You are a principal software architect and specification writer.
 Given an architecture diagram as a graph (nodes = components/services/datastores/actors,
@@ -95,8 +380,26 @@ Follow OpenSpec conventions:
 - Each capability the architecture introduces gets its own spec: a Purpose paragraph,
   "The system SHALL ..." requirements, and a "WHEN / THEN" scenario per requirement.
 - changeName and capability ids are kebab-case.
-Ground every requirement in what the diagram shows; record ambiguity as an assumption in design
-rather than inventing unrelated features. Prefer 2-5 focused capabilities.`;
+
+Referenced files: the input may contain "@<path | filename>" references that were resolved
+to real file contents, delimited as "=== @<path> === \u2026 === end @<path> ===" blocks. That
+content is authoritative ground truth about the existing system \u2014 prefer it over inference
+from the diagram or your own assumptions. A note like "@foo.ts: could not be resolved" marks
+a reference that failed to resolve; acknowledge the gap where relevant, never invent the
+file's contents.
+
+Conversation context: the input may include a "Conversation so far" section \u2014 a review chat
+about the previous generation. Treat user statements there as requirements and corrections
+that MUST steer this regeneration; treat assistant statements as clarifying context. Apply
+them even where they override what the diagram alone would suggest, and say so in design.
+
+When a baseline (existing artifacts and/or a prior conversation) is present, change only
+what the diagram, referenced files, and conversation implicate \u2014 keep every unrelated part
+of the previous spec stable, verbatim where possible.
+
+Ground every requirement in what the diagram, referenced files, and conversation actually
+show; record ambiguity as an assumption in design rather than inventing unrelated features.
+Prefer 2-5 focused capabilities.`;
 function renderBaseline(ws) {
   const a = ws.readArtifacts();
   const sections = [];
@@ -128,7 +431,121 @@ ${edges}
 Notes:
 ${notes}`;
 }
-function createApp(anthropic, workspace) {
+var CHAT_SYSTEM = `You are SpecSketch's spec review assistant. The user generated an OpenSpec
+change proposal from an architecture diagram and is reviewing it. Answer questions about the
+OpenSpec below: explain requirements and scenarios, surface gaps and ambiguities, suggest
+concrete wording. Ground every answer in the OpenSpec artifacts and any referenced files
+provided \u2014 quote the relevant artifact when it helps.
+
+"=== @<path> ===" blocks are real file contents resolved from @-references; they are
+authoritative over your assumptions. A note like "@x: could not be resolved" means the file
+was unavailable \u2014 say so rather than guessing its contents.
+
+Answers render as plain text in a narrow side pane: be concise, use short paragraphs or
+simple "- " lists, no headings or heavy markdown.`;
+function renderBundleContext(b) {
+  const sections = [
+    `--- proposal.md ---
+${b.proposal}`,
+    `--- design.md ---
+${b.design}`,
+    `--- tasks.md ---
+${b.tasks}`,
+    ...b.specs.map((s) => `--- specs/${s.capability}/spec.md ---
+${s.spec}`)
+  ];
+  return `Current OpenSpec (change "${b.changeName}"):
+
+${sections.join("\n\n")}`;
+}
+function renderConversation(conversation) {
+  if (conversation.length === 0) return "";
+  const turns = conversation.map((m) => `[${m.role === "user" ? "user" : "assistant"}]
+${m.text}`).join("\n\n");
+  return `
+
+Conversation so far (a review chat about the previous generation \u2014 user statements are requirements and corrections that MUST steer this regeneration):
+
+${turns}`;
+}
+var SUMMARY_SYSTEM = `You write the opening message of a fresh spec-review chat inside SpecSketch.
+A generation of the OpenSpec just completed and the previous conversation (if any) was
+cleared. Produce a short plain-text handoff:
+- If a prior conversation is provided, first recap in at most ~150 words what the user
+  asked for, corrected, and decided there.
+- Then list what changed in this generation as short "- " bullets, grounded in the
+  changed-file list. When no files changed, say the artifacts were already up to date.
+No headings, no markdown beyond "- " bullets, no preamble \u2014 the text is shown directly
+as the first chat message.`;
+async function makeSeed(anthropic, model, conversation, changedFiles, bundle) {
+  const changes = changedFiles.length ? changedFiles.map((f) => `- ${f}`).join("\n") : "- (none \u2014 every artifact was already up to date)";
+  const prompt = (conversation.length > 0 ? `Prior conversation:
+
+${conversation.map((m) => `[${m.role === "user" ? "user" : "assistant"}]
+${m.text}`).join("\n\n")}
+
+` : "There is no prior conversation \u2014 summarize only the changes made in this generation.\n\n") + `Files changed by this generation:
+${changes}
+
+Spec summary: ${bundle.summary}`;
+  let text = "";
+  try {
+    const msg = await createWithModelGate(anthropic, {
+      model,
+      max_tokens: 700,
+      system: SUMMARY_SYSTEM,
+      messages: [{ role: "user", content: prompt }]
+    });
+    if (msg.stop_reason !== "refusal") text = textOf(msg);
+  } catch {
+  }
+  if (!text) {
+    const files = changedFiles.length ? `Files updated: ${changedFiles.join(", ")}.` : "No files changed \u2014 everything was already up to date.";
+    text = conversation.length > 0 ? `Spec regenerated with the previous conversation as context. ${files}` : `Spec generated. ${files}`;
+  }
+  return [{ role: "summary", text, at: (/* @__PURE__ */ new Date()).toISOString() }];
+}
+function bundleFilePaths(b) {
+  return [
+    "proposal.md",
+    "design.md",
+    "tasks.md",
+    ...b.specs.map((s) => `specs/${s.capability}/spec.md`)
+  ];
+}
+var FABLE_BETAS = ["server-side-fallback-2026-06-01"];
+var FABLE_FALLBACKS = [{ model: "claude-opus-4-8" }];
+function parseWithModelGate(anthropic, request) {
+  return request.model === "claude-fable-5" ? anthropic.beta.messages.parse({ ...request, betas: FABLE_BETAS, fallbacks: FABLE_FALLBACKS }) : anthropic.messages.parse(request);
+}
+async function createWithModelGate(anthropic, request) {
+  const msg = request.model === "claude-fable-5" ? await anthropic.beta.messages.create({
+    ...request,
+    betas: FABLE_BETAS,
+    fallbacks: FABLE_FALLBACKS
+  }) : await anthropic.messages.create(request);
+  return msg;
+}
+function textOf(msg) {
+  return msg.content.filter((b) => b.type === "text").map((b) => b.text ?? "").join("");
+}
+function anthropicErrorResponse(c, err, kind) {
+  const message = err instanceof Error ? err.message : String(err);
+  const status = err.status;
+  if (status === 401 || /authentication|auth token|x-api-key/i.test(message)) {
+    return c.json(
+      {
+        error: "anthropic-auth",
+        hint: "No Anthropic credentials available to the server. Set ANTHROPIC_API_KEY in your environment, or install the Anthropic CLI and run `ant auth login` (macOS: brew install anthropics/tap/ant), then restart specsketch.",
+        detail: message
+      },
+      401
+    );
+  }
+  return c.json({ error: kind, detail: message }, 502);
+}
+function createApp(anthropic, workspace, getShare, options) {
+  const refRoot = options === void 0 ? process.cwd() : options.refRoot;
   const app = new Hono();
   app.get("/api/health", (c) => c.json({ ok: true }));
   app.get(
@@ -136,7 +553,8 @@ function createApp(anthropic, workspace) {
     (c) => c.json({
       workspace: Boolean(workspace),
       models: GENERATION_MODELS,
-      defaultModel: DEFAULT_MODEL
+      defaultModel: DEFAULT_MODEL,
+      share: getShare ? getShare() : { active: false }
     })
   );
   if (workspace) {
@@ -147,7 +565,8 @@ function createApp(anthropic, workspace) {
         title: sidecar.title,
         model: GENERATION_MODELS.find((m) => m === sidecar.model),
         scene: workspace.loadScene(),
-        bundle: workspace.toBundle()
+        bundle: workspace.toBundle(),
+        chat: workspace.readChat()
       });
     });
     app.put("/api/session", async (c) => {
@@ -159,81 +578,1609 @@ function createApp(anthropic, workspace) {
       return c.json({ ok: true });
     });
   }
+  app.get(
+    "/api/files",
+    (c) => c.json({ files: searchFiles(refRoot, c.req.query("q") ?? "") })
+  );
+  app.get("/api/prompt", (c) => {
+    const custom = workspace?.readSystemPrompt();
+    return c.json({ system: custom ?? SYSTEM, default: SYSTEM, custom: custom !== void 0 });
+  });
+  app.put("/api/prompt", async (c) => {
+    const parsed = PromptSave.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      return c.json({ error: "invalid prompt", detail: parsed.error.issues }, 400);
+    }
+    workspace?.writeSystemPrompt(parsed.data.system ?? void 0);
+    return c.json({ ok: true, persisted: Boolean(workspace) });
+  });
   app.post("/api/spec", async (c) => {
     const parsed = SpecRequest.safeParse(await c.req.json().catch(() => null));
     if (!parsed.success) {
       return c.json({ error: "invalid request", detail: parsed.error.issues }, 400);
     }
-    const { title, graph, model = DEFAULT_MODEL } = parsed.data;
+    const { title, graph, model = DEFAULT_MODEL, conversation = [] } = parsed.data;
     if (graph.nodes.length === 0) return c.json({ error: "diagram has no nodes" }, 400);
+    const system = parsed.data.systemPrompt ?? workspace?.readSystemPrompt() ?? SYSTEM;
     const changeNameHint = workspace ? `
 
 Use exactly "${workspace.changeName}" as the changeName.` : "";
+    const refs = expandReferences(
+      [
+        ...system === SYSTEM ? [] : [system],
+        title ?? "",
+        renderGraph(graph),
+        ...conversation.map((m) => m.text)
+      ].join("\n"),
+      refRoot
+    );
+    const refContext = renderReferenceContext(refs);
     const prompt = `Architecture diagram: "${title ?? "Untitled architecture"}"
 
 ${renderGraph(graph)}
 
-Produce the OpenSpec change proposal for this architecture as structured output.` + changeNameHint + (workspace ? renderBaseline(workspace) : "");
+Produce the OpenSpec change proposal for this architecture as structured output.` + changeNameHint + (workspace ? renderBaseline(workspace) : "") + renderConversation(conversation) + (refContext ? `
+
+Referenced files (resolved from @-references in the input):
+
+${refContext}` : "");
     let msg;
     try {
-      const request = {
+      msg = await parseWithModelGate(anthropic, {
         model,
         max_tokens: 16e3,
         // non-streaming stays under the SDK HTTP timeout
-        system: SYSTEM,
+        system,
         messages: [{ role: "user", content: prompt }],
         output_config: { format: zodOutputFormat(SpecBundle) }
         // No temperature/top_p or thinking config — both 400 on modern models.
-      };
-      msg = model === "claude-fable-5" ? (
-        // Fable: opt into server-side refusal fallbacks by default.
-        await anthropic.beta.messages.parse({
-          ...request,
-          betas: ["server-side-fallback-2026-06-01"],
-          fallbacks: [{ model: "claude-opus-4-8" }]
-        })
-      ) : await anthropic.messages.parse(request);
+      });
     } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      const status = err.status;
-      if (status === 401 || /authentication|auth token|x-api-key/i.test(message)) {
-        return c.json(
-          {
-            error: "anthropic-auth",
-            hint: "No Anthropic credentials available to the server. Set ANTHROPIC_API_KEY in your environment, or install the Anthropic CLI and run `ant auth login` (macOS: brew install anthropics/tap/ant), then restart specsketch.",
-            detail: message
-          },
-          401
-        );
-      }
-      return c.json({ error: "generation-failed", detail: message }, 502);
+      return anthropicErrorResponse(c, err, "generation-failed");
     }
     if (msg.stop_reason === "refusal") {
       return c.json({ error: "refusal", detail: msg.stop_details }, 422);
     }
     if (!msg.parsed_output) return c.json({ error: "model returned no structured output" }, 502);
     const output = SpecBundle.parse(msg.parsed_output);
-    if (workspace) {
-      const bundle = { ...output, changeName: workspace.changeName };
-      workspace.writeBundle(bundle);
-      return c.json(bundle);
+    const bundle = workspace ? { ...output, changeName: workspace.changeName } : output;
+    const changedFiles = workspace ? workspace.writeBundle(bundle) : bundleFilePaths(bundle);
+    const seed = await makeSeed(anthropic, model, conversation, changedFiles, bundle);
+    if (workspace) workspace.writeChat(seed);
+    return c.json({ bundle, seed });
+  });
+  app.post("/api/chat", async (c) => {
+    const parsed = ChatRequest.safeParse(await c.req.json().catch(() => null));
+    if (!parsed.success) {
+      return c.json({ error: "invalid request", detail: parsed.error.issues }, 400);
+    }
+    const { message, conversation, model = DEFAULT_MODEL } = parsed.data;
+    const bundle = parsed.data.bundle ?? workspace?.toBundle() ?? null;
+    if (!bundle) return c.json({ error: "no spec to chat about \u2014 generate one first" }, 400);
+    const refs = expandReferences(message, refRoot);
+    const refContext = renderReferenceContext(refs);
+    const history = conversation.map((m) => ({
+      role: m.role === "user" ? "user" : "assistant",
+      content: m.text
+    }));
+    let msg;
+    try {
+      msg = await createWithModelGate(anthropic, {
+        model,
+        max_tokens: 2e3,
+        system: `${CHAT_SYSTEM}
+
+${renderBundleContext(bundle)}`,
+        messages: [
+          ...history,
+          {
+            role: "user",
+            content: message + (refContext ? `
+
+Referenced files (resolved from @-references in the message):
+
+${refContext}` : "")
+          }
+        ]
+      });
+    } catch (err) {
+      return anthropicErrorResponse(c, err, "chat-failed");
+    }
+    if (msg.stop_reason === "refusal") {
+      return c.json({ error: "refusal", detail: msg.stop_details }, 422);
     }
-    return c.json(output);
+    const text = textOf(msg);
+    if (!text) return c.json({ error: "model returned no text" }, 502);
+    const reply = { role: "assistant", text, at: (/* @__PURE__ */ new Date()).toISOString() };
+    workspace?.writeChat([
+      ...conversation,
+      { role: "user", text: message, at: reply.at },
+      reply
+    ]);
+    return c.json({
+      reply,
+      resolvedRefs: refs.resolved.map((r) => r.path),
+      unresolvedRefs: refs.unresolved
+    });
+  });
+  app.delete("/api/chat", (c) => {
+    workspace?.writeChat([]);
+    return c.json({ ok: true });
   });
   return app;
 }
 
+// server/coop-auth.ts
+import { homedir as homedir2 } from "node:os";
+import { join as join3 } from "node:path";
+
+// ../shared/src/cli-auth.ts
+import { exec } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { createServer } from "node:http";
+import { hostname as hostname2 } from "node:os";
+import { URL as URL2 } from "node:url";
+
+// ../shared/src/cli-config.ts
+import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
+import { homedir, hostname } from "node:os";
+import { join as join2, dirname } from "node:path";
+
+// ../shared/src/schemas.ts
+import { z as z2 } from "zod";
+var planTierSchema = z2.enum(["hobby", "squad", "org"]);
+var jurisdictionSchema = z2.enum(["eu", "fedramp"]);
+var locationHintSchema = z2.enum([
+  "wnam",
+  "enam",
+  "weur",
+  "eeur",
+  "apac",
+  "oc",
+  "afr",
+  "me",
+  "sam"
+]);
+var sessionNameSchema = z2.string().min(1).max(63).regex(
+  /^[a-z0-9][a-z0-9-]*$/,
+  "Session name must be lowercase alphanumeric with hyphens, starting with a letter or digit"
+);
+var teamNameSchema = z2.string().min(1).max(63).regex(
+  /^[a-z0-9][a-z0-9-]*$/,
+  "Team name must be lowercase alphanumeric with hyphens"
+);
+var messageKindSchema = z2.enum(["text", "context", "request", "system"]);
+var messageContentSchema = z2.object({
+  kind: messageKindSchema,
+  // No .max() here: the 10 000-char body limit is business logic owned by the
+  // SessionActor (MAX_BODY_BYTES), which rejects with 413 MESSAGE_TOO_LARGE on
+  // both REST and WS. A schema cap would pre-empt it as a generic 400.
+  body: z2.string().min(1),
+  // Two-arg z.record: identical semantics in zod 3, required form in zod 4
+  // (specsketch bundles this file against zod 4 — keep every construct dual-safe).
+  metadata: z2.record(z2.string(), z2.unknown()).optional()
+});
+var createTeamInputSchema = z2.object({
+  name: teamNameSchema
+});
+var createSessionInputSchema = z2.object({
+  name: sessionNameSchema,
+  teamId: z2.string().optional(),
+  jurisdiction: jurisdictionSchema.optional(),
+  locationHint: locationHintSchema.optional()
+});
+var sendMessageInputSchema = z2.object({
+  content: messageContentSchema
+});
+var inviteInputSchema = z2.object({
+  email: z2.string().email(),
+  role: z2.enum(["admin", "member"]).default("member")
+});
+var joinTeamInputSchema = z2.object({
+  inviteCode: z2.string().min(1)
+});
+var markReadInputSchema = z2.object({
+  notificationIds: z2.array(z2.string().min(1))
+});
+var pollQuerySchema = z2.object({
+  since: z2.string().optional(),
+  limit: z2.coerce.number().int().min(1).max(100).default(50),
+  session: z2.string().optional()
+});
+var messagesQuerySchema = z2.object({
+  cursor: z2.string().optional(),
+  limit: z2.coerce.number().int().min(1).max(100).default(50)
+});
+var teamTypeSchema = z2.enum(["personal", "shared"]);
+var teamRoleSchema = z2.enum(["owner", "admin", "member"]);
+var accessPermissionSchema = z2.enum(["read", "write", "admin"]);
+var accessGrantInputSchema = z2.object({
+  userId: z2.string().min(1),
+  sessionName: sessionNameSchema.nullable().default(null),
+  // null = general
+  permission: accessPermissionSchema
+});
+var machineIdSchema = z2.string().min(1).max(63).regex(
+  /^[a-z0-9][a-z0-9-]*$/,
+  "Machine ID must be lowercase alphanumeric with hyphens, starting with a letter or digit"
+);
+var clerkProfileInputSchema = z2.object({
+  email: z2.string().email().nullable(),
+  displayName: z2.string().min(1).max(100),
+  avatarUrl: z2.string().url().nullable(),
+  provider: z2.string().min(1).max(50),
+  providerUserId: z2.string().min(1).max(100)
+});
+var sessionEnrollmentSchema = z2.object({
+  sessionId: z2.string(),
+  team: z2.string(),
+  teamName: z2.string().optional(),
+  key: z2.string().startsWith("api_"),
+  enrolledAt: z2.string().datetime(),
+  apiUrl: z2.string().url().optional(),
+  machineId: z2.string().optional()
+});
+var authConfigSchema = z2.object({
+  key: z2.string().startsWith("api_"),
+  userId: z2.string().min(1),
+  displayName: z2.string().nullable().optional().default(null),
+  email: z2.string().email().nullable(),
+  machineId: z2.string().nullable(),
+  authenticatedAt: z2.string().datetime()
+});
+var configBaseFields = {
+  apiUrl: z2.string().url(),
+  machineId: z2.string().nullable(),
+  sessions: z2.record(z2.string(), sessionEnrollmentSchema),
+  defaults: z2.object({
+    team: z2.string().nullable(),
+    session: z2.string().nullable()
+  }),
+  poll: z2.object({
+    lastPollAt: z2.string().datetime().nullable()
+  })
+};
+var coopConfigV1Schema = z2.object({
+  version: z2.literal(1),
+  ...configBaseFields
+});
+var coopConfigV2Schema = z2.object({
+  version: z2.literal(2),
+  ...configBaseFields,
+  auth: authConfigSchema.optional()
+});
+var profileNameSchema = z2.string().regex(
+  /^[a-z0-9][a-z0-9_-]{0,63}$/,
+  "Profile name must be lowercase alphanumeric with dashes/underscores, max 64 chars"
+);
+var coopProfileSchema = z2.object({
+  apiUrl: z2.string().url(),
+  auth: authConfigSchema.optional(),
+  sessions: z2.record(z2.string(), sessionEnrollmentSchema),
+  defaults: z2.object({
+    team: z2.string().nullable(),
+    session: z2.string().nullable()
+  }),
+  poll: z2.object({
+    lastPollAt: z2.string().datetime().nullable()
+  })
+});
+var coopConfigV3ObjectSchema = z2.object({
+  version: z2.literal(3),
+  machineId: z2.string().nullable(),
+  defaultProfile: z2.string(),
+  profiles: z2.record(profileNameSchema, coopProfileSchema)
+});
+function requireDefaultProfilePointer(config, ctx) {
+  if (!(config.defaultProfile in config.profiles)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["defaultProfile"],
+      message: `defaultProfile "${config.defaultProfile}" does not name an existing profile`
+    });
+  }
+}
+var coopConfigV3Schema = coopConfigV3ObjectSchema.superRefine(
+  requireDefaultProfilePointer
+);
+var coopConfigSchema = z2.discriminatedUnion("version", [
+  coopConfigV1Schema,
+  coopConfigV2Schema,
+  coopConfigV3ObjectSchema
+]).superRefine((config, ctx) => {
+  if (config.version === 3) {
+    requireDefaultProfilePointer(config, ctx);
+  }
+});
+var hookStdinSchema = z2.object({
+  session_id: z2.string().optional(),
+  cwd: z2.string().optional(),
+  hook_event_name: z2.string().optional()
+}).passthrough();
+var wsClientMessageSchema = z2.discriminatedUnion("type", [
+  z2.object({ type: z2.literal("message"), content: messageContentSchema }),
+  z2.object({ type: z2.literal("presence_request") }),
+  z2.object({ type: z2.literal("ping") })
+]);
+
+// ../shared/src/cli-config.ts
+var DEFAULT_CONFIG_DIR = join2(homedir(), ".coopcli");
+var DEFAULT_CONFIG_PATH = join2(DEFAULT_CONFIG_DIR, "config.json");
+var PROD_API_URL = "https://api.coopcli.com";
+function emptyProfile(apiUrl) {
+  return {
+    apiUrl,
+    sessions: {},
+    defaults: { team: null, session: null },
+    poll: { lastPollAt: null }
+  };
+}
+var DEFAULT_CONFIG = {
+  version: 3,
+  machineId: hostname(),
+  defaultProfile: "default",
+  profiles: { default: emptyProfile(PROD_API_URL) }
+};
+function upgradeToV3(parsed) {
+  if (parsed.version === 3) return parsed;
+  const profile = {
+    apiUrl: parsed.apiUrl,
+    ...parsed.version === 2 && parsed.auth ? { auth: parsed.auth } : {},
+    sessions: parsed.sessions,
+    defaults: parsed.defaults,
+    poll: parsed.poll
+  };
+  return {
+    version: 3,
+    machineId: parsed.machineId,
+    defaultProfile: "default",
+    profiles: { default: profile }
+  };
+}
+function profileFromEnv(env, envVars) {
+  for (const name of envVars) {
+    const value = env[name];
+    if (value) return value;
+  }
+  return null;
+}
+var ConfigStore = class {
+  config = null;
+  selectedProfile = null;
+  configPath;
+  configDir;
+  constructor(configPath) {
+    this.configPath = configPath ?? DEFAULT_CONFIG_PATH;
+    this.configDir = dirname(this.configPath);
+  }
+  /**
+   * Select the profile this store operates on for the rest of the process
+   * (--profile flag / COOP_PROFILE env). Without a selection, the
+   * defaultProfile pointer applies.
+   */
+  selectProfile(name) {
+    this.selectedProfile = name;
+  }
+  activeProfileName(config) {
+    return this.selectedProfile ?? config.defaultProfile;
+  }
+  view(config) {
+    const profileName = this.activeProfileName(config);
+    const profile = config.profiles[profileName];
+    if (!profile) {
+      const available = Object.keys(config.profiles).join(", ");
+      throw new Error(`Unknown profile "${profileName}". Available profiles: ${available}`);
+    }
+    return { profileName, machineId: config.machineId, ...profile };
+  }
+  /** Returns the active-profile view of the previously loaded config. Throws if load() hasn't been called. */
+  cached() {
+    return this.view(this.cachedRaw());
+  }
+  /** Returns the full previously loaded config. Throws if load() hasn't been called. */
+  cachedRaw() {
+    if (this.config === null) {
+      throw new Error("Config not loaded yet. Call load() first.");
+    }
+    return this.config;
+  }
+  /** Load the config file and return the active profile's view. */
+  async load() {
+    return this.view(await this.loadRaw());
+  }
+  /** Load the config file, normalized to v3. Legacy v1/v2 files upgrade in memory (persisted on next save). */
+  async loadRaw() {
+    if (this.config !== null) {
+      return this.config;
+    }
+    try {
+      const raw = await readFile(this.configPath, "utf8");
+      const parsed = upgradeToV3(coopConfigSchema.parse(JSON.parse(raw)));
+      if (!parsed.machineId) {
+        parsed.machineId = hostname();
+      }
+      this.config = parsed;
+      return parsed;
+    } catch (err) {
+      if (isNodeError(err) && err.code === "ENOENT") {
+        this.config = structuredClone(DEFAULT_CONFIG);
+        return this.config;
+      }
+      if (err instanceof SyntaxError || err?.name === "ZodError") {
+        throw new Error(`Config file (${this.configPath}) is corrupt. Reset with: rm ${this.configPath}`);
+      }
+      throw err;
+    }
+  }
+  async save(config) {
+    await mkdir(this.configDir, { recursive: true, mode: 448 });
+    const content = JSON.stringify(config, null, 2);
+    const tmpPath = this.configPath + ".tmp";
+    await writeFile(tmpPath, content, { mode: 384 });
+    const { rename } = await import("node:fs/promises");
+    await rename(tmpPath, this.configPath);
+    try {
+      await chmod(this.configPath, 384);
+    } catch {
+    }
+    this.config = config;
+  }
+  /** Load, transform the active profile, and save — the single write path for profile-scoped state. */
+  async saveProfile(mutate) {
+    const config = await this.loadRaw();
+    const name = this.activeProfileName(config);
+    const profile = config.profiles[name];
+    if (!profile) {
+      throw new Error(`Profile "${name}" not found in config (${this.configPath})`);
+    }
+    await this.save({
+      ...config,
+      profiles: { ...config.profiles, [name]: mutate(profile) }
+    });
+  }
+  /** Validate config for common misconfigurations. Returns warning strings. */
+  validate() {
+    if (!this.config) return [];
+    let view;
+    try {
+      view = this.view(this.config);
+    } catch {
+      return [];
+    }
+    const warnings = [];
+    try {
+      const url = new URL(view.apiUrl);
+      if (!["http:", "https:"].includes(url.protocol)) {
+        warnings.push(`apiUrl protocol "${url.protocol}" is not http/https`);
+      }
+    } catch {
+      warnings.push(`apiUrl "${view.apiUrl}" is not a valid URL`);
+    }
+    if (this.selectedProfile === null && (view.apiUrl.includes("localhost") || view.apiUrl.includes("127.0.0.1"))) {
+      warnings.push(
+        `profile "${view.profileName}" points to localhost \u2014 select it explicitly with --profile, or run coop login`
+      );
+    }
+    return warnings;
+  }
+  async enrollSession(name, enrollment) {
+    await this.saveProfile((profile) => ({
+      ...profile,
+      sessions: { ...profile.sessions, [name]: enrollment }
+    }));
+  }
+  async unenrollSession(name) {
+    await this.saveProfile((profile) => {
+      const sessions = { ...profile.sessions };
+      delete sessions[name];
+      const defaults = { ...profile.defaults };
+      if (defaults.session === name) {
+        defaults.session = null;
+      }
+      return { ...profile, sessions, defaults };
+    });
+  }
+  async setDefault(key, value) {
+    await this.saveProfile((profile) => ({
+      ...profile,
+      defaults: { ...profile.defaults, [key]: value }
+    }));
+  }
+  async getDefaultSession() {
+    const view = await this.load();
+    return view.defaults.session;
+  }
+  async getSessionKey(sessionName) {
+    const view = await this.load();
+    const enrollment = view.sessions[sessionName];
+    if (!enrollment) {
+      throw new Error(`Not enrolled in session "${sessionName}". Join it first.`);
+    }
+    return enrollment.key;
+  }
+  /** Resolve the API URL for a session, falling back to the active profile's apiUrl. */
+  async getApiUrl(sessionName) {
+    const view = await this.load();
+    if (sessionName) {
+      const enrollment = view.sessions[sessionName];
+      if (enrollment?.apiUrl) return enrollment.apiUrl;
+    }
+    return view.apiUrl;
+  }
+  /** Resolve the machine ID for a session, falling back to the global machineId or the profile's auth. */
+  async getMachineId(sessionName) {
+    const view = await this.load();
+    if (sessionName) {
+      const enrollment = view.sessions[sessionName];
+      if (enrollment?.machineId) return enrollment.machineId;
+    }
+    if (view.machineId) return view.machineId;
+    if (view.auth?.machineId) return view.auth.machineId;
+    return null;
+  }
+  async setMachineId(machineId) {
+    const config = await this.loadRaw();
+    await this.save({ ...config, machineId });
+  }
+  /** Set the active profile's API base URL. */
+  async setApiUrl(apiUrl) {
+    await this.saveProfile((profile) => ({ ...profile, apiUrl }));
+  }
+  /** Create the active profile (empty, at the given endpoint) if it does not exist yet. */
+  async ensureActiveProfile(apiUrl) {
+    const config = await this.loadRaw();
+    const name = this.activeProfileName(config);
+    if (config.profiles[name]) return;
+    await this.save({
+      ...config,
+      profiles: { ...config.profiles, [name]: emptyProfile(apiUrl) }
+    });
+  }
+  /** Re-point the defaultProfile fallback. The target must exist. */
+  async setDefaultProfile(name) {
+    const config = await this.loadRaw();
+    if (!config.profiles[name]) {
+      const available = Object.keys(config.profiles).join(", ");
+      throw new Error(`Unknown profile "${name}". Available profiles: ${available}`);
+    }
+    await this.save({ ...config, defaultProfile: name });
+  }
+  /** True if any profile holds an auth block (used to detect the first login). */
+  async hasAnyAuth() {
+    const config = await this.loadRaw();
+    return Object.values(config.profiles).some((profile) => profile.auth !== void 0);
+  }
+  /**
+   * Remove a profile including its credentials and enrollments. The
+   * defaultProfile pointer target cannot be deleted — re-point first.
+   */
+  async deleteProfile(name) {
+    const config = await this.loadRaw();
+    if (!config.profiles[name]) {
+      const available = Object.keys(config.profiles).join(", ");
+      throw new Error(`Unknown profile "${name}". Available profiles: ${available}`);
+    }
+    if (config.defaultProfile === name) {
+      throw new Error(
+        `Profile "${name}" is the default profile. Re-point it first: coop profile set-default <other>`
+      );
+    }
+    const profiles = { ...config.profiles };
+    delete profiles[name];
+    await this.save({ ...config, profiles });
+  }
+  async updateLastPoll() {
+    await this.saveProfile((profile) => ({
+      ...profile,
+      poll: { lastPollAt: (/* @__PURE__ */ new Date()).toISOString() }
+    }));
+  }
+  /** Returns true if the active profile has an auth block. */
+  isAuthenticated() {
+    if (this.config === null) return false;
+    return this.view(this.config).auth !== void 0;
+  }
+  /** Returns the user-scoped API key, or throws if not authenticated. */
+  getAuthKey() {
+    const auth = this.config === null ? void 0 : this.view(this.config).auth;
+    if (!auth) {
+      throw new Error("Not authenticated. Run `coop login` first.");
+    }
+    return auth.key;
+  }
+  /** Returns the user ID, or throws if not authenticated. */
+  getUserId() {
+    const auth = this.config === null ? void 0 : this.view(this.config).auth;
+    if (!auth) {
+      throw new Error("Not authenticated. Run `coop login` first.");
+    }
+    return auth.userId;
+  }
+  /**
+   * Saves the auth block into the active profile. Legacy v1/v2 files are
+   * normalized to v3 by load(), so the write always persists v3.
+   */
+  async setAuth(auth) {
+    await this.saveProfile((profile) => ({ ...profile, auth }));
+  }
+  /**
+   * Returns true if the user should be nudged to run `coop login`:
+   * the active profile has no auth block.
+   */
+  needsLoginNudge() {
+    if (this.config === null) return true;
+    return this.view(this.config).auth === void 0;
+  }
+  /**
+   * Removes the auth block from the active profile (for `coop logout`).
+   * Sessions are preserved.
+   */
+  async clearAuth() {
+    await this.saveProfile((profile) => {
+      const { auth: _removed, ...rest } = profile;
+      return rest;
+    });
+  }
+};
+function isNodeError(err) {
+  return err instanceof Error && "code" in err;
+}
+
+// ../shared/src/cli-auth.ts
+function resolveDisplayName(name, email, userId) {
+  if (name && !name.startsWith("user_")) return name;
+  if (email) return email.split("@")[0];
+  if (userId) return userId.slice(0, 12);
+  if (name) return name.slice(0, 12);
+  return "unknown";
+}
+async function openBrowser(url) {
+  const escaped = url.replace(/"/g, '\\"');
+  const cmd = process.platform === "darwin" ? `open "${escaped}"` : process.platform === "win32" ? `start "" "${escaped}"` : `xdg-open "${escaped}"`;
+  return new Promise((resolve4) => {
+    exec(cmd, () => resolve4());
+  });
+}
+var PAGE_STYLE = "body{background:#0f0f0f;color:#e8e8e8;font-family:system-ui;display:flex;justify-content:center;padding-top:4rem}";
+function htmlPage(title, body) {
+  return `<!DOCTYPE html><html><head><title>${title}</title><style>${PAGE_STYLE}</style></head><body><div><h2>${title}</h2><p>${body}</p></div></body></html>`;
+}
+function startLocalhostServer(options) {
+  const timeout = options.timeout ?? 12e4;
+  const loginCommand = options.loginCommand ?? "coop login";
+  return new Promise((resolveServer, rejectServer) => {
+    let resolveCallback;
+    let rejectCallback;
+    const callbackPromise = new Promise((res, rej) => {
+      resolveCallback = res;
+      rejectCallback = rej;
+    });
+    const timer = setTimeout(() => {
+      rejectCallback(new Error(`Login timed out. No browser callback received. Check your browser and try \`${loginCommand}\` again.`));
+      server.close();
+    }, timeout);
+    const server = createServer((req, res) => {
+      const url = new URL2(req.url ?? "/", `http://127.0.0.1`);
+      if (url.pathname === "/") {
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(htmlPage("Waiting for Authentication", `This page was opened by <code>${loginCommand}</code>. Complete sign-in in the browser window.`));
+        return;
+      }
+      if (url.pathname === "/callback") {
+        const state = url.searchParams.get("state") ?? "";
+        if (state !== options.expectedState) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(htmlPage("State Mismatch", `Possible CSRF attack. Try <code>${loginCommand}</code> again.`));
+          return;
+        }
+        const key = url.searchParams.get("key") ?? "";
+        if (!key) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(htmlPage("Missing Key", `No API key received. Try <code>${loginCommand}</code> again.`));
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(htmlPage("Authentication Complete", "You can close this tab."));
+        clearTimeout(timer);
+        resolveCallback({
+          key,
+          userId: url.searchParams.get("userId") ?? "",
+          email: url.searchParams.get("email") ?? "",
+          displayName: url.searchParams.get("displayName") ?? "",
+          state,
+          apiUrl: url.searchParams.get("apiUrl") ?? ""
+        });
+        return;
+      }
+      res.writeHead(404, { "Content-Type": "text/plain" });
+      res.end("Not Found");
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      const port = typeof addr === "object" && addr ? addr.port : 0;
+      resolveServer({
+        port,
+        close: () => {
+          clearTimeout(timer);
+          server.close();
+        },
+        waitForCallback: () => callbackPromise
+      });
+    });
+    server.on("error", (err) => {
+      clearTimeout(timer);
+      rejectServer(err);
+    });
+  });
+}
+function deriveApiUrl(webUrl) {
+  const url = new URL2(webUrl);
+  if (url.hostname === "localhost" || url.hostname === "127.0.0.1") {
+    return "http://localhost:8788";
+  }
+  return `https://api.${url.hostname}`;
+}
+async function login(input, deps) {
+  const state = randomBytes(16).toString("hex");
+  const machineId = input.machine ?? hostname2();
+  const server = await startLocalhostServer({ expectedState: state, loginCommand: input.loginCommand });
+  try {
+    const webUrl = input.webUrl ?? "https://coopcli.com";
+    const authUrl = `${webUrl}/cli-auth?port=${server.port}&state=${state}&machine=${encodeURIComponent(machineId)}`;
+    process.stderr.write(`Opening browser for authentication...
+`);
+    await deps.openBrowser(authUrl);
+    process.stderr.write(`Waiting for callback on port ${server.port}...
+`);
+    const params = await server.waitForCallback();
+    const displayName = resolveDisplayName(params.displayName, params.email, params.userId);
+    const resolvedApiUrl = input.apiUrl ?? (params.apiUrl || deriveApiUrl(webUrl));
+    const isFirstLogin = !await deps.config.hasAnyAuth();
+    await deps.config.ensureActiveProfile(resolvedApiUrl);
+    await deps.config.setAuth({
+      key: params.key,
+      userId: params.userId,
+      displayName,
+      email: params.email || null,
+      machineId,
+      authenticatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    const config = await deps.config.load();
+    if (params.apiUrl && config.apiUrl && params.apiUrl !== config.apiUrl) {
+      process.stderr.write(
+        `
+Backend mismatch: you authenticated against ${params.apiUrl}
+  but your config points to ${config.apiUrl}
+  Updating config to ${resolvedApiUrl}
+
+`
+      );
+    }
+    if (resolvedApiUrl !== config.apiUrl) {
+      await deps.config.setApiUrl(resolvedApiUrl);
+    }
+    if (isFirstLogin) {
+      await deps.config.setDefaultProfile(config.profileName);
+    }
+    return {
+      userId: params.userId,
+      email: params.email || null,
+      displayName
+    };
+  } finally {
+    server.close();
+  }
+}
+var CliAuthError = class extends Error {
+  constructor(message, kind) {
+    super(message);
+    this.kind = kind;
+    this.name = "CliAuthError";
+  }
+  kind;
+};
+async function resolveCoopCredentials(opts) {
+  const env = opts.env ?? process.env;
+  const { configPath, loginHint } = opts;
+  if (!existsSync(configPath)) {
+    throw new CliAuthError(`No CoopCLI config found at ${configPath}.
+${loginHint}`, "missing-config");
+  }
+  const store = new ConfigStore(configPath);
+  let raw;
+  try {
+    raw = await store.loadRaw();
+  } catch {
+    throw new CliAuthError(
+      `Could not read CoopCLI credentials from ${configPath}.
+${loginHint}`,
+      "unreadable-config"
+    );
+  }
+  const profileName = profileFromEnv(env, opts.profileEnvVars ?? ["COOP_PROFILE"]) ?? raw.defaultProfile;
+  const profile = raw.profiles[profileName];
+  if (!profile) {
+    const available = Object.keys(raw.profiles).join(", ");
+    throw new CliAuthError(
+      `CoopCLI config at ${configPath} has no profile "${profileName}" (available: ${available}).
+${loginHint}`,
+      "unknown-profile"
+    );
+  }
+  if (!profile.auth) {
+    throw new CliAuthError(`CoopCLI config at ${configPath} has no login.
+${loginHint}`, "no-login");
+  }
+  const apiUrl = (opts.apiUrlEnvVar && env[opts.apiUrlEnvVar] || profile.apiUrl).replace(/\/+$/, "");
+  return {
+    apiUrl,
+    key: profile.auth.key,
+    userId: profile.auth.userId,
+    displayName: profile.auth.displayName ?? null
+  };
+}
+
+// server/coop-auth.ts
+var CoopAuthError = class extends Error {
+};
+var LOGIN_HINT = "--share needs a CoopCLI account. Run `specsketch login` (it opens your browser and saves credentials to ~/.coopcli/config.json), then rerun with --share.";
+async function readCoopAuth(configPath = join3(homedir2(), ".coopcli", "config.json"), env = process.env) {
+  try {
+    return await resolveCoopCredentials({
+      configPath,
+      env,
+      profileEnvVars: ["SPECSKETCH_COOP_PROFILE", "COOP_PROFILE"],
+      apiUrlEnvVar: "SPECSKETCH_COOP_API_URL",
+      loginHint: LOGIN_HINT
+    });
+  } catch (err) {
+    if (err instanceof CliAuthError) throw new CoopAuthError(err.message);
+    throw err;
+  }
+}
+
+// server/login.ts
+import { parseArgs } from "node:util";
+var LOGIN_USAGE = `Usage: specsketch login [--profile <name>] [--web-url <url>]
+
+Opens your browser to sign in to CoopCLI and saves credentials to
+~/.coopcli/config.json \u2014 the same file and format \`coop login\` uses.
+
+--profile   config profile to log into (default: SPECSKETCH_COOP_PROFILE,
+            then COOP_PROFILE, then the config's default profile). A profile
+            that doesn't exist yet is created.
+--web-url   web app URL for browser auth (default: https://coopcli.com)`;
+var LoginUsageError = class extends Error {
+};
+function parseLoginArgs(argv) {
+  let parsed;
+  try {
+    parsed = parseArgs({
+      args: argv,
+      options: { profile: { type: "string" }, "web-url": { type: "string" } },
+      allowPositionals: true
+    });
+  } catch (err) {
+    throw new LoginUsageError(err instanceof Error ? err.message : String(err));
+  }
+  if (parsed.positionals.length > 0) {
+    throw new LoginUsageError(`unexpected argument: ${parsed.positionals[0]}`);
+  }
+  return {
+    profile: parsed.values.profile ?? null,
+    ...parsed.values["web-url"] !== void 0 ? { webUrl: parsed.values["web-url"] } : {}
+  };
+}
+async function runLogin(args, deps = {}) {
+  const env = deps.env ?? process.env;
+  const config = deps.config ?? new ConfigStore();
+  const profile = args.profile ?? profileFromEnv(env, ["SPECSKETCH_COOP_PROFILE", "COOP_PROFILE"]);
+  if (profile) config.selectProfile(profile);
+  const result = await login(
+    { webUrl: args.webUrl, loginCommand: "specsketch login" },
+    { config, openBrowser: deps.openBrowser ?? openBrowser }
+  );
+  (deps.log ?? console.log)(`Authenticated as ${result.email ?? result.userId}. Credentials saved.`);
+}
+
+// server/remote-session.ts
+import { WebSocket } from "ws";
+
+// ../shared/src/errors.ts
+function isApiErrorBody(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  return typeof v.category === "string" && typeof v.code === "string" && typeof v.message === "string";
+}
+
+// ../shared/src/api-client.ts
+var CoopApiError = class extends Error {
+  category;
+  code;
+  status;
+  details;
+  constructor(status, body) {
+    super(body.message);
+    this.name = "CoopApiError";
+    this.category = body.category;
+    this.code = body.code;
+    this.status = status;
+    this.details = body.details;
+  }
+};
+function isCoopApiError(err) {
+  return err instanceof CoopApiError;
+}
+async function streamToBuffer(stream) {
+  const reader = stream.getReader();
+  const chunks = [];
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(value);
+  }
+  const total = chunks.reduce((sum, c) => sum + c.length, 0);
+  const result = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    result.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return result;
+}
+var verbose = false;
+var ApiClient = class _ApiClient {
+  constructor(apiUrl, token, userId) {
+    this.apiUrl = apiUrl;
+    this.token = token;
+    this.userId = userId;
+  }
+  apiUrl;
+  token;
+  userId;
+  /** Build a user-scoped path. Only callable when userId is set. */
+  userPath(sub) {
+    return `/api/u/${this.userId}${sub}`;
+  }
+  async request(method, path, body, params) {
+    const url = new URL(path, this.apiUrl);
+    if (params) {
+      for (const [key, val] of Object.entries(params)) {
+        if (val !== void 0) {
+          url.searchParams.set(key, String(val));
+        }
+      }
+    }
+    if (verbose) {
+      process.stderr.write(`[verbose] ${method} ${url.toString()}
+`);
+      if (body) process.stderr.write(`[verbose] body: ${JSON.stringify(body)}
+`);
+    }
+    const res = await fetch(url.toString(), {
+      method,
+      headers: {
+        Authorization: `Bearer ${this.token}`,
+        "Content-Type": "application/json"
+      },
+      body: body !== void 0 ? JSON.stringify(body) : void 0
+    });
+    if (verbose) {
+      process.stderr.write(`[verbose] ${res.status} ${res.statusText}
+`);
+    }
+    if (!res.ok) {
+      let parsed = null;
+      try {
+        const json = await res.json();
+        if (isApiErrorBody(json)) {
+          parsed = json;
+        } else {
+          const legacy = json;
+          parsed = {
+            category: res.status >= 500 ? "server_error" : "user_action",
+            code: "UNKNOWN",
+            message: legacy.error ?? legacy.message ?? res.statusText
+          };
+        }
+      } catch {
+        parsed = {
+          category: res.status >= 500 ? "server_error" : "user_action",
+          code: "UNKNOWN",
+          message: res.statusText
+        };
+      }
+      if (verbose) {
+        process.stderr.write(`[verbose] error: [${parsed.category}/${parsed.code}] ${parsed.message}
+`);
+      }
+      throw new CoopApiError(res.status, parsed);
+    }
+    return res.json();
+  }
+  async getMe() {
+    const path = this.userId ? this.userPath("/me") : "/api/me";
+    return this.request("GET", path);
+  }
+  async createTeam(input) {
+    if (this.userId) {
+    }
+    return this.request("POST", "/api/teams", input);
+  }
+  async listTeams() {
+    if (this.userId) {
+      const me = await this.request("GET", this.userPath("/me"));
+      return (me.teams ?? []).map((m) => ({
+        id: m.teamId,
+        name: m.teamName,
+        type: m.teamId.startsWith("team:personal:") ? "personal" : "shared",
+        plan: "hobby",
+        createdBy: "",
+        createdAt: m.joinedAt
+      }));
+    }
+    return this.request("GET", "/api/teams");
+  }
+  async inviteToTeam(team, input) {
+    return this.request("POST", `/api/teams/${encodeURIComponent(team)}/invite`, input);
+  }
+  async joinTeam(team, inviteCode) {
+    await this.request("POST", `/api/teams/${encodeURIComponent(team)}/join`, { inviteCode });
+  }
+  async listTeamMembers(team) {
+    return this.request("GET", `/api/teams/${encodeURIComponent(team)}/members`);
+  }
+  async createSession(input) {
+    const path = this.userId ? this.userPath("/sessions") : "/api/sessions";
+    return this.request("POST", path, input);
+  }
+  async listSessions() {
+    const path = this.userId ? this.userPath("/sessions") : "/api/sessions";
+    const result = await this.request("GET", path);
+    return result.sessions;
+  }
+  async joinSession(name) {
+    await this.request("POST", `/api/sessions/${encodeURIComponent(name)}/join`);
+  }
+  async leaveSession(name) {
+    await this.request("POST", `/api/sessions/${encodeURIComponent(name)}/leave`);
+  }
+  async deleteSession(name) {
+    const path = this.userId ? this.userPath(`/sessions/${encodeURIComponent(name)}`) : `/api/sessions/${encodeURIComponent(name)}`;
+    return this.request("DELETE", path);
+  }
+  async sendMessage(teamId, session, input) {
+    if (this.userId) {
+      return this.request(
+        "POST",
+        this.userPath(`/sessions/${encodeURIComponent(session)}/messages`),
+        input,
+        { team: teamId }
+      );
+    }
+    return this.request("POST", `/api/teams/${encodeURIComponent(teamId)}/sessions/${encodeURIComponent(session)}/messages`, input);
+  }
+  async getMessages(teamId, session, cursor, limit) {
+    if (this.userId) {
+      return this.request(
+        "GET",
+        this.userPath(`/sessions/${encodeURIComponent(session)}/messages`),
+        void 0,
+        { team: teamId, cursor, limit }
+      );
+    }
+    return this.request("GET", `/api/teams/${encodeURIComponent(teamId)}/sessions/${encodeURIComponent(session)}/messages`, void 0, {
+      cursor,
+      limit
+    });
+  }
+  async getLatestMessages(teamId, session, count = 5) {
+    if (this.userId) {
+      return this.request(
+        "GET",
+        this.userPath(`/sessions/${encodeURIComponent(session)}/messages`),
+        void 0,
+        { team: teamId, latest: count }
+      );
+    }
+    return this.request("GET", `/api/teams/${encodeURIComponent(teamId)}/sessions/${encodeURIComponent(session)}/messages`, void 0, {
+      latest: count
+    });
+  }
+  async queryAIContext(teamId, sessionName, input) {
+    return this.request(
+      "POST",
+      this.userPath(`/sessions/${encodeURIComponent(sessionName)}/ai-context`),
+      input,
+      { team: teamId }
+    );
+  }
+  async listSessionFiles(teamId, sessionName) {
+    const result = await this.request(
+      "GET",
+      this.userPath(`/sessions/${encodeURIComponent(sessionName)}/files`),
+      void 0,
+      { team: teamId }
+    );
+    return result.files;
+  }
+  async getNotifications(params) {
+    const path = this.userId ? this.userPath("/notifications") : "/api/notifications";
+    return this.request("GET", path, void 0, params);
+  }
+  async markRead(ids) {
+    const path = this.userId ? this.userPath("/notifications/read") : "/api/notifications/read";
+    await this.request("POST", path, { notificationIds: ids });
+  }
+  /** List the caller's user-scoped API keys. Requires user-level auth. */
+  async listUserApiKeys() {
+    const body = await this.request("GET", this.userPath("/keys"));
+    return body.keys;
+  }
+  /** Revoke a user-scoped API key by id. Requires user-level auth. */
+  async revokeUserApiKey(id) {
+    await this.request("DELETE", this.userPath(`/keys/${encodeURIComponent(id)}`));
+  }
+  /**
+   * Create a live canvas session (specsketch --share host). User-scoped
+   * route; the caller validates the response shape against
+   * canvasSessionCreatedSchema.
+   */
+  async createCanvasSession(input) {
+    return this.request("POST", this.userPath("/canvas/sessions"), input);
+  }
+  /** End a canvas session server-side (invalidates the share link). */
+  async endCanvasSession(sessionId) {
+    await this.request("DELETE", this.userPath(`/canvas/sessions/${encodeURIComponent(sessionId)}`));
+  }
+  async uploadFile(teamId, session, filename, body, size) {
+    const path = this.userId ? this.userPath(`/sessions/${encodeURIComponent(session)}/upload`) : `/api/teams/${encodeURIComponent(teamId)}/sessions/${encodeURIComponent(session)}/upload`;
+    const url = new URL(path, this.apiUrl);
+    if (this.userId) url.searchParams.set("team", teamId);
+    const form = new FormData();
+    const bytes = new Uint8Array(
+      body instanceof Buffer || body instanceof Uint8Array ? body : await streamToBuffer(body)
+    );
+    form.append("file", new Blob([bytes]), filename);
+    form.append("filename", filename);
+    const res = await fetch(url.toString(), {
+      method: "POST",
+      headers: { Authorization: `Bearer ${this.token}` },
+      body: form
+    });
+    if (!res.ok) {
+      const text = await res.text();
+      let msg = res.statusText;
+      try {
+        msg = JSON.parse(text).message ?? msg;
+      } catch {
+      }
+      throw new CoopApiError(res.status, { category: "user_action", code: "UPLOAD_FAILED", message: msg });
+    }
+    return res.json();
+  }
+  async downloadFile(teamId, session, fileId) {
+    const path = this.userId ? this.userPath(`/sessions/${encodeURIComponent(session)}/files/${encodeURIComponent(fileId)}`) : `/api/teams/${encodeURIComponent(teamId)}/sessions/${encodeURIComponent(session)}/files/${encodeURIComponent(fileId)}`;
+    const url = new URL(path, this.apiUrl);
+    if (this.userId) url.searchParams.set("team", teamId);
+    const res = await fetch(url.toString(), {
+      method: "GET",
+      headers: { Authorization: `Bearer ${this.token}` }
+    });
+    if (!res.ok) {
+      const text = await res.text();
+      let msg = res.statusText;
+      try {
+        msg = JSON.parse(text).message ?? msg;
+      } catch {
+      }
+      throw new CoopApiError(res.status, { category: "user_action", code: "DOWNLOAD_FAILED", message: msg });
+    }
+    const disposition = res.headers.get("Content-Disposition") ?? "";
+    const filenameMatch = disposition.match(/filename="?([^"]+)"?/);
+    const filename = filenameMatch ? decodeURIComponent(filenameMatch[1]) : fileId;
+    const size = parseInt(res.headers.get("Content-Length") ?? "0", 10);
+    return { filename, body: res.body, size };
+  }
+  getWebSocketUrl(session) {
+    const wsBase = this.apiUrl.replace(
+      /^https?:\/\//,
+      (match) => match === "https://" ? "wss://" : "ws://"
+    );
+    return `${wsBase}/api/sessions/${encodeURIComponent(session)}/ws?token=${encodeURIComponent(this.token)}`;
+  }
+  withToken(token) {
+    return new _ApiClient(this.apiUrl, token, this.userId);
+  }
+};
+
+// ../shared/src/canvas-protocol.ts
+import { z as z3 } from "zod";
+var CANVAS_PROTOCOL_VERSION = 1;
+var canvasElementSchema = z3.object({
+  id: z3.string().min(1),
+  version: z3.number().int().nonnegative(),
+  versionNonce: z3.number().int(),
+  isDeleted: z3.boolean().optional()
+}).passthrough();
+var canvasFilesSchema = z3.record(z3.string(), z3.unknown());
+var canvasSceneSchema = z3.object({
+  elements: z3.array(canvasElementSchema),
+  files: canvasFilesSchema.optional()
+});
+var canvasParticipantSchema = z3.object({
+  id: z3.string().min(1),
+  role: z3.enum(["host", "guest"]),
+  name: z3.string().optional(),
+  color: z3.string().optional()
+});
+var canvasHelloSchema = z3.object({
+  type: z3.literal("hello"),
+  protocolVersion: z3.number().int().positive(),
+  role: z3.enum(["host", "guest"]),
+  /** Stable id across reconnects, if the client has one. */
+  participantId: z3.string().min(1).max(64).optional(),
+  name: z3.string().max(120).optional()
+});
+var canvasClientOpSchema = z3.object({
+  type: z3.literal("op"),
+  /** Changed or soft-deleted elements only — never the full scene. */
+  elements: z3.array(canvasElementSchema).min(1),
+  /** New binary files referenced by the changed elements, if any. */
+  files: canvasFilesSchema.optional(),
+  /** Client-local monotonic sequence, used by the sender for echo dedupe. */
+  clientSeq: z3.number().int().nonnegative()
+});
+var canvasClientMessageSchema = z3.discriminatedUnion("type", [
+  canvasHelloSchema,
+  canvasClientOpSchema
+]);
+var canvasSnapshotSchema = z3.object({
+  type: z3.literal("snapshot"),
+  scene: canvasSceneSchema,
+  revision: z3.number().int().nonnegative(),
+  participants: z3.array(canvasParticipantSchema),
+  /** Echoes the server's protocol version so clients can detect skew. */
+  protocolVersion: z3.number().int().positive(),
+  /** The participant id the server assigned to (or kept for) this client. */
+  participantId: z3.string()
+});
+var canvasServerOpSchema = z3.object({
+  type: z3.literal("op"),
+  /** The elements that won reconciliation (never echoed to the sender). */
+  elements: z3.array(canvasElementSchema),
+  files: canvasFilesSchema.optional(),
+  revision: z3.number().int().positive(),
+  /** Participant id of the sender. */
+  from: z3.string()
+});
+var canvasPresenceSchema = z3.object({
+  type: z3.literal("presence"),
+  participants: z3.array(canvasParticipantSchema)
+});
+var canvasEndSchema = z3.object({
+  type: z3.literal("end"),
+  reason: z3.string()
+});
+var canvasErrorSchema = z3.object({
+  type: z3.literal("error"),
+  code: z3.string(),
+  message: z3.string()
+});
+var canvasServerMessageSchema = z3.discriminatedUnion("type", [
+  canvasSnapshotSchema,
+  canvasServerOpSchema,
+  canvasPresenceSchema,
+  canvasEndSchema,
+  canvasErrorSchema
+]);
+var canvasSessionCreatedSchema = z3.object({
+  sessionId: z3.string().min(1),
+  /** Capability token — shown once; the server stores only its hash. */
+  token: z3.string().min(1),
+  shareUrl: z3.string().min(1),
+  wsUrl: z3.string().min(1)
+});
+var canvasSessionSummarySchema = z3.object({
+  sessionId: z3.string(),
+  title: z3.string().nullable(),
+  status: z3.enum(["active", "ended"]),
+  createdAt: z3.number(),
+  endedAt: z3.number().nullable()
+});
+function elementWins(local, incoming) {
+  if (incoming.version !== local.version) return incoming.version > local.version;
+  return incoming.versionNonce < local.versionNonce;
+}
+function reconcileCanvasElements(local, incoming) {
+  const byId = new Map(local.map((el) => [el.id, el]));
+  const accepted = [];
+  for (const el of incoming) {
+    const existing = byId.get(el.id);
+    if (!existing || elementWins(existing, el)) {
+      byId.set(el.id, el);
+      accepted.push(el);
+    }
+  }
+  return { elements: [...byId.values()], accepted };
+}
+
+// server/remote-session.ts
+var HEARTBEAT_INTERVAL_MS = 3e4;
+var HEARTBEAT_TIMEOUT_MS = 75e3;
+var BACKOFF_MIN_MS = 1e3;
+var BACKOFF_MAX_MS = 3e4;
+var PENDING_OP_LIMIT = 200;
+function asCanvasElements(elements) {
+  if (!elements) return [];
+  return elements.filter(
+    (el) => typeof el === "object" && el !== null && typeof el.id === "string" && typeof el.version === "number" && typeof el.versionNonce === "number"
+  );
+}
+var RemoteSession = class _RemoteSession {
+  sessionId;
+  shareUrl;
+  token;
+  wsUrl;
+  opts;
+  status = "connecting";
+  revision = 0;
+  participants = [];
+  ws = null;
+  closed = false;
+  clientSeq = 0;
+  backoffMs;
+  lastTrafficAt = 0;
+  heartbeatTimer = null;
+  reconnectTimer = null;
+  pendingOps = [];
+  api;
+  constructor(opts, api, created) {
+    this.opts = opts;
+    this.api = api;
+    this.sessionId = created.sessionId;
+    this.token = created.token;
+    this.shareUrl = created.shareUrl;
+    this.wsUrl = created.wsUrl;
+    this.backoffMs = opts.backoffMinMs ?? BACKOFF_MIN_MS;
+  }
+  /** Create the session server-side and open the host connection. */
+  static async start(opts) {
+    const api = opts.api ?? new ApiClient(opts.apiUrl, opts.key, opts.userId);
+    let response;
+    try {
+      response = await api.createCanvasSession({ title: opts.title });
+    } catch (err) {
+      if (isCoopApiError(err)) {
+        if (err.status === 401 || err.status === 403) {
+          throw new Error(
+            "CoopCLI rejected the saved credentials (revoked or expired key). Run `specsketch login` and retry."
+          );
+        }
+        throw new Error(`Could not create the shared session: HTTP ${err.status} ${err.message}`);
+      }
+      throw err;
+    }
+    const created = canvasSessionCreatedSchema.parse(response);
+    const session = new _RemoteSession(opts, api, created);
+    session.connect();
+    return session;
+  }
+  // ── Upstream connection ──
+  connect() {
+    if (this.closed) return;
+    const factory = this.opts.wsFactory ?? ((url, headers) => new WebSocket(url, { headers }));
+    const ws = factory(this.wsUrl, { Authorization: `Bearer ${this.opts.key}` });
+    this.ws = ws;
+    this.lastTrafficAt = Date.now();
+    ws.on("open", () => {
+      this.backoffMs = this.opts.backoffMinMs ?? BACKOFF_MIN_MS;
+      this.status = "connected";
+      ws.send(
+        JSON.stringify({
+          type: "hello",
+          protocolVersion: CANVAS_PROTOCOL_VERSION,
+          role: "host",
+          name: this.opts.hostName ?? void 0
+        })
+      );
+      for (const frame of this.pendingOps.splice(0)) ws.send(frame);
+    });
+    ws.on("message", (data) => this.handleUpstreamFrame(String(data)));
+    ws.on("close", (code) => {
+      if (ws !== this.ws) return;
+      this.stopHeartbeat();
+      if (this.closed) return;
+      this.status = "reconnecting";
+      this.opts.log?.(`share: connection lost (code ${code}) \u2014 reconnecting`);
+      this.scheduleReconnect();
+    });
+    ws.on("error", () => {
+    });
+    this.startHeartbeat();
+  }
+  scheduleReconnect() {
+    if (this.closed || this.reconnectTimer) return;
+    const jitter = Math.random() * 0.3 + 0.85;
+    const delay = Math.round(this.backoffMs * jitter);
+    this.backoffMs = Math.min(this.backoffMs * 2, BACKOFF_MAX_MS);
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = null;
+      this.connect();
+    }, delay);
+  }
+  startHeartbeat() {
+    this.stopHeartbeat();
+    this.heartbeatTimer = setInterval(() => {
+      const ws = this.ws;
+      if (!ws || ws.readyState !== WebSocket.OPEN) return;
+      if (Date.now() - this.lastTrafficAt > HEARTBEAT_TIMEOUT_MS) {
+        ws.terminate();
+        return;
+      }
+      ws.send("ping");
+    }, HEARTBEAT_INTERVAL_MS);
+    this.heartbeatTimer.unref?.();
+  }
+  stopHeartbeat() {
+    if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
+    this.heartbeatTimer = null;
+  }
+  // ── Frames from the DO ──
+  handleUpstreamFrame(text) {
+    this.lastTrafficAt = Date.now();
+    if (text === "pong") return;
+    const parsed = canvasServerMessageSchema.safeParse(
+      (() => {
+        try {
+          return JSON.parse(text);
+        } catch {
+          return null;
+        }
+      })()
+    );
+    if (!parsed.success) return;
+    const frame = parsed.data;
+    switch (frame.type) {
+      case "snapshot": {
+        const local = this.opts.workspace.loadScene();
+        const { elements, accepted } = reconcileCanvasElements(
+          asCanvasElements(frame.scene.elements),
+          asCanvasElements(local?.elements)
+        );
+        this.revision = frame.revision;
+        this.participants = frame.participants;
+        this.opts.workspace.saveScene({
+          elements,
+          appState: local?.appState,
+          files: { ...frame.scene.files ?? {}, ...local?.files ?? {} }
+        });
+        if (accepted.length > 0) {
+          this.sendUpstream(
+            JSON.stringify({ type: "op", elements: accepted, clientSeq: ++this.clientSeq })
+          );
+        }
+        this.opts.onLocalBroadcast?.(text);
+        return;
+      }
+      case "op": {
+        if (frame.revision > this.revision + 1) {
+          this.ws?.terminate();
+          return;
+        }
+        this.revision = frame.revision;
+        this.applyRemoteElements(frame.elements, frame.files);
+        this.opts.onLocalBroadcast?.(text);
+        return;
+      }
+      case "presence": {
+        this.participants = frame.participants;
+        this.opts.onLocalBroadcast?.(text);
+        return;
+      }
+      case "end": {
+        this.opts.log?.(`share: session ended (${frame.reason})`);
+        this.opts.onLocalBroadcast?.(text);
+        this.closed = true;
+        this.status = "ended";
+        this.teardown();
+        return;
+      }
+      case "error": {
+        this.opts.log?.(`share: server error ${frame.code}: ${frame.message}`);
+        return;
+      }
+    }
+  }
+  /** Persist remote edits into the change directory — the durable copy. */
+  applyRemoteElements(incoming, files) {
+    const local = this.opts.workspace.loadScene();
+    const { elements } = reconcileCanvasElements(asCanvasElements(local?.elements), incoming);
+    this.opts.workspace.saveScene({
+      elements,
+      appState: local?.appState,
+      files: { ...local?.files ?? {}, ...files ?? {} }
+    });
+  }
+  // ── Frames from the host browser (via /ws/local) ──
+  /**
+   * Handle one message from a local browser socket. Ops are relayed upstream
+   * verbatim (the browser already persists via its autosave PUT). A `hello`
+   * is answered locally with a synthetic snapshot so the browser can seed
+   * its revision/participant state without a round-trip to the DO.
+   */
+  handleLocalFrame(text, reply) {
+    const parsed = canvasClientMessageSchema.safeParse(
+      (() => {
+        try {
+          return JSON.parse(text);
+        } catch {
+          return null;
+        }
+      })()
+    );
+    if (!parsed.success) return;
+    if (parsed.data.type === "hello") {
+      const scene = this.opts.workspace.loadScene();
+      reply(
+        JSON.stringify({
+          type: "snapshot",
+          scene: { elements: scene?.elements ?? [], files: scene?.files ?? void 0 },
+          revision: this.revision,
+          participants: this.participants,
+          protocolVersion: CANVAS_PROTOCOL_VERSION,
+          participantId: "host"
+        })
+      );
+      return;
+    }
+    this.sendUpstream(text);
+  }
+  sendUpstream(frameText) {
+    const ws = this.ws;
+    if (ws && ws.readyState === WebSocket.OPEN) {
+      ws.send(frameText);
+      return;
+    }
+    this.pendingOps.push(frameText);
+    if (this.pendingOps.length > PENDING_OP_LIMIT) this.pendingOps.shift();
+  }
+  // ── Teardown ──
+  /** End the session server-side (invalidates the share link) and close. */
+  async end() {
+    if (this.status === "ended") return;
+    this.closed = true;
+    this.status = "ended";
+    this.teardown();
+    try {
+      await this.api.endCanvasSession(this.sessionId);
+    } catch {
+    }
+  }
+  teardown() {
+    this.stopHeartbeat();
+    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
+    this.reconnectTimer = null;
+    try {
+      this.ws?.close(1e3, "host shutting down");
+    } catch {
+    }
+    this.ws = null;
+  }
+};
+
 // server/workspace.ts
 import { createHash } from "node:crypto";
 import {
-  existsSync,
+  existsSync as existsSync2,
   mkdirSync,
-  readFileSync,
-  readdirSync,
+  readFileSync as readFileSync2,
+  readdirSync as readdirSync2,
   renameSync,
   writeFileSync
 } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename as basename2, dirname as dirname2, join as join4, resolve as resolve2 } from "node:path";
 var DIAGRAM_FILE = "diagram.excalidraw";
 var SIDECAR_FILE = "specsketch.json";
 var sha256 = (s) => createHash("sha256").update(s).digest("hex");
@@ -241,20 +2188,20 @@ var ChangeWorkspace = class {
   dir;
   changeName;
   constructor(dir) {
-    this.dir = resolve(dir);
-    this.changeName = basename(this.dir);
+    this.dir = resolve2(dir);
+    this.changeName = basename2(this.dir);
     mkdirSync(this.dir, { recursive: true });
   }
   writeAtomic(relPath, content) {
-    const target = join(this.dir, relPath);
-    mkdirSync(dirname(target), { recursive: true });
+    const target = join4(this.dir, relPath);
+    mkdirSync(dirname2(target), { recursive: true });
     const tmp = `${target}.tmp`;
     writeFileSync(tmp, content, "utf8");
     renameSync(tmp, target);
   }
   readIfExists(relPath) {
-    const target = join(this.dir, relPath);
-    return existsSync(target) ? readFileSync(target, "utf8") : void 0;
+    const target = join4(this.dir, relPath);
+    return existsSync2(target) ? readFileSync2(target, "utf8") : void 0;
   }
   // ── Scene ────────────────────────────────────────────────────────────────
   loadScene() {
@@ -315,11 +2262,11 @@ var ChangeWorkspace = class {
   /** Current artifact files, however they were authored. */
   readArtifacts() {
     const specs = [];
-    const specsDir = join(this.dir, "specs");
-    if (existsSync(specsDir)) {
-      for (const entry of readdirSync(specsDir, { withFileTypes: true })) {
+    const specsDir = join4(this.dir, "specs");
+    if (existsSync2(specsDir)) {
+      for (const entry of readdirSync2(specsDir, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
-        const spec = this.readIfExists(join("specs", entry.name, "spec.md"));
+        const spec = this.readIfExists(join4("specs", entry.name, "spec.md"));
         if (spec !== void 0) specs.push({ capability: entry.name, spec });
       }
     }
@@ -353,7 +2300,7 @@ var ChangeWorkspace = class {
       "design.md": bundle.design,
       "tasks.md": bundle.tasks
     };
-    for (const s of bundle.specs) files[join("specs", s.capability, "spec.md")] = s.spec;
+    for (const s of bundle.specs) files[join4("specs", s.capability, "spec.md")] = s.spec;
     const written = [];
     const manifest = {};
     for (const [relPath, content] of Object.entries(files)) {
@@ -362,27 +2309,64 @@ var ChangeWorkspace = class {
       this.writeAtomic(relPath, content);
       written.push(relPath);
     }
-    this.updateSidecar((s) => ({ ...s, summary: bundle.summary, generated: manifest }));
+    this.updateSidecar((s) => ({
+      ...s,
+      summary: bundle.summary,
+      generated: manifest,
+      // The diff-before-write result IS the changed-file signal for the
+      // post-generation chat seed (generation-chat-reset-summary).
+      lastGeneration: { at: (/* @__PURE__ */ new Date()).toISOString(), changedFiles: written }
+    }));
     return written;
   }
+  // ── Spec review chat ─────────────────────────────────────────────────────
+  readChat() {
+    return this.readSidecar().chat ?? [];
+  }
+  writeChat(chat) {
+    this.updateSidecar((s) => ({ ...s, chat }));
+  }
+  // ── Generation system prompt override ────────────────────────────────────
+  readSystemPrompt() {
+    return this.readSidecar().systemPrompt;
+  }
+  /** `undefined` clears the override (reset to the built-in default). */
+  writeSystemPrompt(systemPrompt) {
+    this.updateSidecar(({ systemPrompt: _prev, ...s }) => ({
+      ...s,
+      ...systemPrompt !== void 0 ? { systemPrompt } : {}
+    }));
+  }
 };
 
 // server/cli.ts
-var USAGE = `Usage: specsketch <path-to-openspec-change-dir> [--port <n>]
+var USAGE = `Usage: specsketch <path-to-openspec-change-dir> [--port <n>] [--share]
+       specsketch login [--profile <name>] [--web-url <url>]
 
   specsketch ./openspec/changes/new-feature-change
 
 The directory is created if it doesn't exist. Diagrams autosave to
 diagram.excalidraw inside it; Generate Spec writes proposal.md, design.md,
-tasks.md and specs/<capability>/spec.md alongside.`;
+tasks.md and specs/<capability>/spec.md alongside.
+
+--port sets the preferred port (default 8787); if it's already in use the
+server moves to the next available port and prints the actual URL.
+
+--share hosts the canvas as a live multiplayer session on your CoopCLI
+account and prints a link coworkers can open in a browser \u2014 no account
+needed on their side. Requires \`specsketch login\` first. The local server
+still binds to 127.0.0.1 only; sharing runs over an outbound connection.
+
+login authenticates this machine against your CoopCLI account (opens a
+browser, saves credentials to ~/.coopcli/config.json).`;
 var UsageError = class extends Error {
 };
 function parseCliArgs(argv) {
   let parsed;
   try {
-    parsed = parseArgs({
+    parsed = parseArgs2({
       args: argv,
-      options: { port: { type: "string" } },
+      options: { port: { type: "string" }, share: { type: "boolean" } },
       allowPositionals: true
     });
   } catch (err) {
@@ -394,7 +2378,19 @@ function parseCliArgs(argv) {
   if (!Number.isInteger(port) || port < 1 || port > 65535) {
     throw new UsageError(`invalid --port: ${String(parsed.values.port)}`);
   }
-  return { dir, port };
+  return { dir, port, share: parsed.values.share === true };
+}
+var PORT_SCAN_LIMIT = 100;
+async function bindAvailablePort(start, tryBind) {
+  const end = Math.min(start + PORT_SCAN_LIMIT - 1, 65535);
+  for (let port = start; port <= end; port++) {
+    try {
+      return { port: await tryBind(port), moved: port !== start };
+    } catch (err) {
+      if (err.code !== "EADDRINUSE") throw err;
+    }
+  }
+  throw new Error(`no free port between ${start} and ${end} \u2014 free one up or pass --port`);
 }
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -409,25 +2405,25 @@ var MIME = {
   ".woff": "font/woff"
 };
 function resolveClientDir(moduleUrl) {
-  const here = dirname2(fileURLToPath(moduleUrl));
+  const here = dirname3(fileURLToPath(moduleUrl));
   const candidates = [
-    join2(here, "..", "client"),
+    join5(here, "..", "client"),
     // packed: dist/cli -> dist/client
-    join2(here, "..", "dist", "client")
+    join5(here, "..", "dist", "client")
     // repo: server/ -> dist/client
   ];
   for (const dir of candidates) {
-    if (existsSync2(join2(dir, "index.html"))) return dir;
+    if (existsSync3(join5(dir, "index.html"))) return dir;
   }
   return null;
 }
 function staticResponse(clientDir, pathname) {
-  const rel = normalize(decodeURIComponent(pathname)).replace(/^\/+/, "");
-  const target = resolve2(clientDir, rel === "" ? "index.html" : rel);
-  if (!target.startsWith(resolve2(clientDir))) return null;
-  const file = existsSync2(target) && extname(target) ? target : join2(clientDir, "index.html");
-  if (!existsSync2(file)) return null;
-  return new Response(readFileSync2(file), {
+  const rel = normalize2(decodeURIComponent(pathname)).replace(/^\/+/, "");
+  const target = resolve3(clientDir, rel === "" ? "index.html" : rel);
+  if (!target.startsWith(resolve3(clientDir))) return null;
+  const file = existsSync3(target) && extname(target) ? target : join5(clientDir, "index.html");
+  if (!existsSync3(file)) return null;
+  return new Response(readFileSync3(file), {
     headers: { "Content-Type": MIME[extname(file)] ?? "application/octet-stream" }
   });
 }
@@ -439,12 +2435,12 @@ but "Generate Spec" needs one of:
   \u2022 or the Anthropic CLI's login profile (no key handling needed):
       brew install anthropics/tap/ant   # macOS
       ant auth login`;
-function detectCredentialSource(env = process.env, home = homedir()) {
+function detectCredentialSource(env = process.env, home = homedir3()) {
   if (env.ANTHROPIC_API_KEY) return "ANTHROPIC_API_KEY";
   if (env.ANTHROPIC_AUTH_TOKEN) return "ANTHROPIC_AUTH_TOKEN";
   try {
-    const dir = join2(home, ".config", "anthropic", "credentials");
-    if (readdirSync2(dir).some((f) => f.endsWith(".json"))) return "anthropic profile";
+    const dir = join5(home, ".config", "anthropic", "credentials");
+    if (readdirSync3(dir).some((f) => f.endsWith(".json"))) return "anthropic profile";
   } catch {
   }
   return null;
@@ -457,8 +2453,28 @@ function preflight(log = console.log) {
     process.exit(1);
   }
 }
-function main(argv) {
+async function main(argv) {
   preflight();
+  if (argv[0] === "login") {
+    let loginArgs;
+    try {
+      loginArgs = parseLoginArgs(argv.slice(1));
+    } catch (err) {
+      console.error(
+        err instanceof LoginUsageError ? `specsketch: ${err.message}
+
+${LOGIN_USAGE}` : err
+      );
+      process.exit(1);
+    }
+    try {
+      await runLogin(loginArgs);
+    } catch (err) {
+      console.error(`specsketch: ${err instanceof Error ? err.message : String(err)}`);
+      process.exit(1);
+    }
+    return;
+  }
   let args;
   try {
     args = parseCliArgs(argv);
@@ -473,26 +2489,125 @@ ${USAGE}` : err);
     console.error("specsketch: built UI assets not found (dist/client missing).");
     process.exit(1);
   }
+  if (args.share) {
+    try {
+      await readCoopAuth();
+    } catch (err) {
+      console.error(`specsketch: ${err instanceof CoopAuthError ? err.message : String(err)}`);
+      process.exit(1);
+    }
+  }
   const workspace = new ChangeWorkspace(args.dir);
-  const app = createApp(new Anthropic(), workspace);
+  let remote = null;
+  const app = createApp(
+    new Anthropic(),
+    workspace,
+    () => remote ? {
+      active: true,
+      shareUrl: remote.shareUrl,
+      status: remote.status,
+      participants: remote.participants.length
+    } : { active: false }
+  );
   app.get("*", (c) => {
     const res = staticResponse(clientDir, new URL(c.req.url).pathname);
     return res ?? c.notFound();
   });
-  serve({ fetch: app.fetch, port: args.port, hostname: "127.0.0.1" }, () => {
-    const source = detectCredentialSource();
-    console.log(`coopcli specsketch`);
-    console.log(`  workspace: ${workspace.dir}`);
-    console.log(`  open:      http://127.0.0.1:${args.port}`);
-    if (source) {
-      console.log(`  auth:      ${source}`);
-    } else {
-      console.log(`
+  let httpServer = null;
+  const tryBind = (port2) => new Promise((bound, failed) => {
+    const server = serve({ fetch: app.fetch, port: port2, hostname: "127.0.0.1" }, (info) => {
+      httpServer = server;
+      bound(info.port);
+    });
+    server.once("error", (err) => {
+      try {
+        server.close();
+      } catch {
+      }
+      failed(err);
+    });
+  });
+  let port;
+  let moved;
+  try {
+    ({ port, moved } = await bindAvailablePort(args.port, tryBind));
+  } catch (err) {
+    console.error(`specsketch: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
+  if (args.share) {
+    try {
+      remote = await startShare(workspace, httpServer);
+    } catch (err) {
+      console.error(`specsketch: ${err instanceof Error ? err.message : String(err)}`);
+      process.exit(1);
+    }
+  }
+  const source = detectCredentialSource();
+  console.log(`coopcli specsketch`);
+  console.log(`  workspace: ${workspace.dir}`);
+  console.log(`  open:      http://127.0.0.1:${port}`);
+  if (moved) {
+    console.log(`  port:      ${args.port} was in use \u2014 moved to ${port}`);
+  }
+  if (source) {
+    console.log(`  auth:      ${source}`);
+  } else {
+    console.log(`
 \u26A0 ${CREDENTIALS_HINT}
 `);
+  }
+  if (remote) {
+    console.log(`
+  \u2500\u2500 shared session \u2500\u2500`);
+    console.log(`  anyone with this link can view AND edit the canvas (no account needed):`);
+    console.log(`
+    ${remote.shareUrl}
+`);
+    console.log(`  Ctrl-C ends the session and invalidates the link.`);
+  }
+}
+async function startShare(workspace, server) {
+  const auth = await readCoopAuth();
+  const localClients = /* @__PURE__ */ new Set();
+  const remote = await RemoteSession.start({
+    ...auth,
+    workspace,
+    title: workspace.changeName,
+    hostName: auth.displayName,
+    log: (msg) => console.log(`  ${msg}`),
+    onLocalBroadcast: (frame) => {
+      for (const client of localClients) client.send(frame);
     }
   });
+  const wss = new WebSocketServer({ noServer: true });
+  server.on("upgrade", (req, socket, head) => {
+    const pathname = new URL(req.url ?? "/", "http://localhost").pathname;
+    if (pathname !== "/ws/local") {
+      socket.destroy();
+      return;
+    }
+    wss.handleUpgrade(req, socket, head, (ws) => {
+      localClients.add(ws);
+      ws.on("close", () => localClients.delete(ws));
+      ws.on(
+        "message",
+        (data) => remote.handleLocalFrame(String(data), (reply) => ws.send(reply))
+      );
+    });
+  });
+  let ending = false;
+  const endAndExit = async () => {
+    if (ending) return;
+    ending = true;
+    console.log("\nspecsketch: ending shared session\u2026");
+    await remote.end();
+    process.exit(0);
+  };
+  process.on("SIGINT", () => void endAndExit());
+  process.on("SIGTERM", () => void endAndExit());
+  return remote;
 }
 
 // server/cli-entry.ts
-main(process.argv.slice(2));
+void main(process.argv.slice(2));