@diologue/local-agent 0.1.0

package/dist/cli.mjs

@@ -0,0 +1,2527 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/adapters/engine-locator-npm.ts
+var engine_locator_npm_exports = {};
+__export(engine_locator_npm_exports, {
+  NpmSdkLocator: () => NpmSdkLocator
+});
+import { spawn } from "node:child_process";
+var defaultBinaryCheck, defaultSdkLoader, NpmSdkLocator;
+var init_engine_locator_npm = __esm({
+  "src/adapters/engine-locator-npm.ts"() {
+    "use strict";
+    defaultBinaryCheck = async () => new Promise((resolve) => {
+      const child = spawn("opencode", ["--version"], { stdio: "ignore" });
+      child.on("error", () => resolve(false));
+      child.on("exit", (code) => resolve(code === 0));
+    });
+    defaultSdkLoader = () => import("@opencode-ai/sdk");
+    NpmSdkLocator = class {
+      constructor(options = {}) {
+        this.options = options;
+      }
+      name = "npm";
+      async start(options) {
+        const check = this.options.checkBinary ?? defaultBinaryCheck;
+        const ok = await check();
+        if (!ok) {
+          throw new Error(
+            "opencode binary not found on PATH. Install via `curl -fsSL https://opencode.ai/install | bash` and ensure `opencode --version` works in this shell. (Or set LOCAL_AGENT_ENGINE=local once V4 ships.)"
+          );
+        }
+        const loadSdk = this.options.sdkLoader ?? defaultSdkLoader;
+        const sdk = await loadSdk();
+        const server = await sdk.createOpencodeServer({
+          hostname: "127.0.0.1",
+          port: 0,
+          signal: options.signal,
+          config: options.config
+        });
+        const client = sdk.createOpencodeClient({ baseUrl: server.url });
+        return {
+          url: server.url,
+          client,
+          close: () => {
+            server.close();
+          }
+        };
+      }
+    };
+  }
+});
+
+// engine-release.json
+var engine_release_default;
+var init_engine_release = __esm({
+  "engine-release.json"() {
+    engine_release_default = {
+      _comment: "Single source of truth for the engine bundle the helper expects. Both scripts/build-engine-bundle.ts and local-agent/scripts/postinstall.ts read this. Bumping `version` here is what triggers a new release.",
+      version: "0.1.0",
+      releaseTag: "engine-v0.1.0",
+      downloadBase: "https://github.com/Deplova-Ltd/AI-Personas-and-Multi-LLM/releases/download",
+      targets: [
+        { platform: "darwin", arch: "arm64", bunTarget: "bun-darwin-arm64", ext: "" },
+        { platform: "darwin", arch: "x64", bunTarget: "bun-darwin-x64", ext: "" },
+        { platform: "linux", arch: "x64", bunTarget: "bun-linux-x64", ext: "" },
+        { platform: "linux", arch: "arm64", bunTarget: "bun-linux-arm64", ext: "" },
+        { platform: "win32", arch: "x64", bunTarget: "bun-windows-x64", ext: ".exe" }
+      ]
+    };
+  }
+});
+
+// src/lib/engine-bundle.ts
+import { access as access2, constants } from "node:fs/promises";
+import path3 from "node:path";
+import { fileURLToPath } from "node:url";
+var engineRelease, __filename, __dirname, LOCAL_AGENT_ROOT, REPO_ROOT, BUNDLE_DIR_INSTALLED, BUNDLE_DIR_LOCAL_BUILD, ENGINE_BUNDLE_ENV, exists2, bundleFilename, findEngineBundle;
+var init_engine_bundle = __esm({
+  "src/lib/engine-bundle.ts"() {
+    "use strict";
+    init_engine_release();
+    engineRelease = engine_release_default;
+    __filename = fileURLToPath(import.meta.url);
+    __dirname = path3.dirname(__filename);
+    LOCAL_AGENT_ROOT = path3.resolve(__dirname, "../..");
+    REPO_ROOT = path3.resolve(LOCAL_AGENT_ROOT, "..");
+    BUNDLE_DIR_INSTALLED = path3.join(
+      LOCAL_AGENT_ROOT,
+      "dist/engine",
+      engineRelease.releaseTag
+    );
+    BUNDLE_DIR_LOCAL_BUILD = path3.join(
+      REPO_ROOT,
+      "build/diologue-engine-bundles"
+    );
+    ENGINE_BUNDLE_ENV = "LOCAL_AGENT_ENGINE_BUNDLE";
+    exists2 = async (p) => {
+      try {
+        await access2(p, constants.X_OK);
+        return true;
+      } catch {
+        return false;
+      }
+    };
+    bundleFilename = (platform = process.platform, arch = process.arch) => {
+      const target = engineRelease.targets.find(
+        (t) => t.platform === platform && t.arch === arch
+      );
+      const ext = target?.ext ?? "";
+      return `diologue-engine-${platform}-${arch}${ext}`;
+    };
+    findEngineBundle = async () => {
+      const fromEnv = process.env[ENGINE_BUNDLE_ENV];
+      if (fromEnv) {
+        if (await exists2(fromEnv)) {
+          return { path: fromEnv, source: "env" };
+        }
+      }
+      const filename = bundleFilename();
+      const installed = path3.join(BUNDLE_DIR_INSTALLED, filename);
+      if (await exists2(installed)) {
+        return { path: installed, source: "installed" };
+      }
+      const localBuild = path3.join(BUNDLE_DIR_LOCAL_BUILD, filename);
+      if (await exists2(localBuild)) {
+        return { path: localBuild, source: "local-build" };
+      }
+      return null;
+    };
+  }
+});
+
+// src/adapters/engine-locator-local.ts
+var engine_locator_local_exports = {};
+__export(engine_locator_local_exports, {
+  LocalEngineLocator: () => LocalEngineLocator
+});
+import { access as access3, constants as constants2 } from "node:fs/promises";
+import { spawn as spawn2 } from "node:child_process";
+import path4 from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var __filename2, __dirname2, REPO_ROOT2, DEFAULT_ENGINE_DIR, ENTRY_REL, DEFAULT_STARTUP_TIMEOUT_MS, LISTENING_REGEX, defaultRuntimeCheck, exists3, defaultClientFactory, LocalEngineLocator, truncate;
+var init_engine_locator_local = __esm({
+  "src/adapters/engine-locator-local.ts"() {
+    "use strict";
+    init_engine_bundle();
+    __filename2 = fileURLToPath2(import.meta.url);
+    __dirname2 = path4.dirname(__filename2);
+    REPO_ROOT2 = path4.resolve(__dirname2, "../../..");
+    DEFAULT_ENGINE_DIR = path4.join(REPO_ROOT2, "build/diologue-engine");
+    ENTRY_REL = "packages/opencode/src/index.ts";
+    DEFAULT_STARTUP_TIMEOUT_MS = 3e4;
+    LISTENING_REGEX = /listening on (https?:\/\/[^\s]+)/i;
+    defaultRuntimeCheck = async (runtime) => new Promise((resolve) => {
+      const child = spawn2(runtime, ["--version"], { stdio: "ignore" });
+      child.on("error", () => resolve(false));
+      child.on("exit", (code) => resolve(code === 0));
+    });
+    exists3 = async (p) => {
+      try {
+        await access3(p, constants2.F_OK);
+        return true;
+      } catch {
+        return false;
+      }
+    };
+    defaultClientFactory = async (baseUrl) => {
+      const sdk = await import("@opencode-ai/sdk");
+      return sdk.createOpencodeClient({ baseUrl });
+    };
+    LocalEngineLocator = class {
+      constructor(options = {}) {
+        this.options = options;
+        this.enginePath = options.enginePath ?? DEFAULT_ENGINE_DIR;
+        this.runtime = options.runtime ?? "bun";
+        this.startupTimeoutMs = options.startupTimeoutMs ?? DEFAULT_STARTUP_TIMEOUT_MS;
+      }
+      name = "local";
+      enginePath;
+      runtime;
+      startupTimeoutMs;
+      /** Decide which engine path we're going to use. Returns the resolved
+       *  bundle when we'll spawn that directly, or null when we'll fall
+       *  back to the source-tree path. Test seam. */
+      async resolveBundle() {
+        if (this.options.forceSource) return null;
+        if (this.options.resolveBundle) return this.options.resolveBundle();
+        return findEngineBundle();
+      }
+      /** Run the preflight checks for the path we're about to use. Returns
+       *  null on success, or a human-readable error string if something's
+       *  wrong. Exposed so start() can reuse it and tests can assert it
+       *  directly. */
+      async preflight() {
+        const bundle = await this.resolveBundle();
+        if (bundle) {
+          return null;
+        }
+        if (!await exists3(this.enginePath)) {
+          return `[engine-locator/local] No engine bundle found and no source tree at ${this.enginePath}. Either:
+  - Reinstall the package so postinstall fetches a bundle, or
+  - Run \`npm run rebrand-engine\` to populate the source tree.`;
+        }
+        const entry = path4.join(this.enginePath, ENTRY_REL);
+        if (!await exists3(entry)) {
+          return `[engine-locator/local] Engine entry not found at ${entry}. The rebrand may have produced a partial tree \u2014 re-run \`npm run rebrand-engine\`.`;
+        }
+        const check = this.options.checkRuntime ?? defaultRuntimeCheck;
+        const ok = await check(this.runtime);
+        if (!ok) {
+          return `[engine-locator/local] No engine bundle found and runtime "${this.runtime}" is not on PATH. Either:
+  - Reinstall the package so postinstall fetches a bundle, or
+  - Install bun (https://bun.sh) for the source-tree fallback.`;
+        }
+        return null;
+      }
+      /** Build the spawn command. Tests override via `engineCommand`.
+       *  Otherwise we prefer a discovered bundle; failing that, we fall
+       *  back to `<runtime> run <entry>`. */
+      async resolveCommand() {
+        if (this.options.engineCommand) {
+          return { ...this.options.engineCommand, source: "override" };
+        }
+        const bundle = await this.resolveBundle();
+        if (bundle) {
+          return {
+            command: bundle.path,
+            args: ["serve", "--port", "0", "--hostname", "127.0.0.1"],
+            source: "bundle",
+            bundle
+          };
+        }
+        return {
+          command: this.runtime,
+          args: [
+            "run",
+            path4.join(this.enginePath, ENTRY_REL),
+            "serve",
+            "--port",
+            "0",
+            "--hostname",
+            "127.0.0.1"
+          ],
+          source: "source"
+        };
+      }
+      async start(options) {
+        const preflightErr = await this.preflight();
+        if (preflightErr) throw new Error(preflightErr);
+        const resolved = await this.resolveCommand();
+        const { command, args } = resolved;
+        const cwd = resolved.source === "source" && await exists3(this.enginePath) ? this.enginePath : void 0;
+        const child = spawn2(command, args, {
+          cwd,
+          stdio: ["ignore", "pipe", "pipe"],
+          // Inherit env so the engine sees any LOCAL_AGENT_* / Provider
+          // credentials the parent has, plus inject the shim config via
+          // OPENCODE_CONFIG-style env once V2.5 wires that. (For now the
+          // config flows through createOpencodeServer in the npm path
+          // and is wired post-spawn here — TODO once we cut the npm
+          // SDK entirely, we'll pipe the config in via stdin or args.)
+          env: process.env
+        });
+        let url;
+        try {
+          url = await this.waitForListening(child, options.signal);
+        } catch (err) {
+          if (!child.killed) {
+            try {
+              child.kill();
+            } catch {
+            }
+          }
+          throw err;
+        }
+        const factory = this.options.clientFactory ?? defaultClientFactory;
+        const client = await factory(url);
+        return {
+          url,
+          client,
+          close: () => {
+            if (child.exitCode === null && !child.killed) {
+              try {
+                child.kill();
+              } catch {
+              }
+            }
+          }
+        };
+      }
+      /** Watch the subprocess until either:
+       *    - stdout/stderr emits a "listening on http://..." line — resolve
+       *    - the process exits before that happens — reject with stderr
+       *    - the startup timeout fires — reject + (caller kills the child)
+       *    - the abort signal fires — reject + (caller kills the child)
+       */
+      waitForListening(child, abort) {
+        return new Promise((resolve, reject) => {
+          let settled = false;
+          let buffered = "";
+          const tag = `${this.runtime}/${path4.basename(this.enginePath)}`;
+          const settle = (fn) => {
+            if (settled) return;
+            settled = true;
+            cleanup();
+            fn();
+          };
+          const onStdout = (chunk) => {
+            const text = chunk.toString("utf-8");
+            buffered += text;
+            const match = LISTENING_REGEX.exec(buffered);
+            if (match) {
+              settle(() => resolve(match[1]));
+            }
+          };
+          const onStderr = onStdout;
+          const onExit = (code, signal) => {
+            settle(
+              () => reject(
+                new Error(
+                  `[engine-locator/local] ${tag} exited before becoming ready (code=${code} signal=${signal ?? "-"}). Last output:
+${truncate(buffered, 4096)}`
+                )
+              )
+            );
+          };
+          const onError = (err) => {
+            settle(
+              () => reject(
+                new Error(
+                  `[engine-locator/local] ${tag} failed to spawn: ${err.message}`
+                )
+              )
+            );
+          };
+          const timer = setTimeout(() => {
+            settle(
+              () => reject(
+                new Error(
+                  `[engine-locator/local] ${tag} did not become ready within ${this.startupTimeoutMs}ms. Last output:
+${truncate(buffered, 4096)}`
+                )
+              )
+            );
+          }, this.startupTimeoutMs);
+          const onAbort = () => {
+            settle(
+              () => reject(new Error(`[engine-locator/local] startup aborted`))
+            );
+          };
+          const cleanup = () => {
+            clearTimeout(timer);
+            child.stdout?.off("data", onStdout);
+            child.stderr?.off("data", onStderr);
+            child.off("exit", onExit);
+            child.off("error", onError);
+            abort?.removeEventListener("abort", onAbort);
+          };
+          child.stdout?.on("data", onStdout);
+          child.stderr?.on("data", onStderr);
+          child.once("exit", onExit);
+          child.once("error", onError);
+          if (abort) {
+            if (abort.aborted) {
+              onAbort();
+              return;
+            }
+            abort.addEventListener("abort", onAbort);
+          }
+        });
+      }
+    };
+    truncate = (s, max) => s.length <= max ? s : s.slice(s.length - max);
+  }
+});
+
+// src/cli.ts
+import process2 from "node:process";
+
+// src/config.ts
+import { randomBytes } from "node:crypto";
+var DEFAULT_PORT = 4099;
+var DEFAULT_ALLOWED_ORIGIN = "http://localhost:5000";
+var parsePort = (raw) => {
+  if (!raw) {
+    return DEFAULT_PORT;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0 || parsed > 65535) {
+    throw new Error(
+      `LOCAL_AGENT_PORT must be a valid TCP port (1-65535), got: ${raw}`
+    );
+  }
+  return parsed;
+};
+var generateToken = () => {
+  return randomBytes(32).toString("hex");
+};
+var loadConfig = (options = {}) => {
+  const env = options.env ?? process.env;
+  const base = {
+    // 127.0.0.1 is intentional and not configurable. Binding to 0.0.0.0
+    // would expose the helper to the LAN, which the token alone is not
+    // designed to defend against. See TODO(tunnel-cloud-auth).
+    host: "127.0.0.1",
+    port: parsePort(env.LOCAL_AGENT_PORT),
+    allowedOrigin: (env.LOCAL_AGENT_ALLOWED_ORIGIN ?? "").trim() || DEFAULT_ALLOWED_ORIGIN,
+    token: (env.LOCAL_AGENT_TOKEN ?? "").trim() || generateToken(),
+    // Bumped from package.json when we ship a meaningful change. Kept inline
+    // to avoid a JSON import + ESM ergonomics in tests.
+    helperVersion: "0.0.1",
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  return { ...base, ...options.overrides };
+};
+
+// src/server.ts
+import express from "express";
+
+// src/auth.ts
+import { timingSafeEqual } from "node:crypto";
+
+// ../shared/coding-agent-types.ts
+var LOCAL_AGENT_TOKEN_HEADER = "x-local-agent-token";
+
+// src/auth.ts
+var DEFAULT_UNAUTHENTICATED = /* @__PURE__ */ new Set(["GET /health"]);
+var DEFAULT_UNAUTHENTICATED_PREFIXES = ["/llm-shim/"];
+var tokensEqual = (a, b) => {
+  const ab = Buffer.from(a, "utf8");
+  const bb = Buffer.from(b, "utf8");
+  if (ab.length !== bb.length) {
+    return false;
+  }
+  return timingSafeEqual(ab, bb);
+};
+var createAuthMiddleware = (options) => {
+  const exempt = options.unauthenticated ?? DEFAULT_UNAUTHENTICATED;
+  return (req, res, next) => {
+    const key = `${req.method} ${req.path}`;
+    if (exempt.has(key)) {
+      next();
+      return;
+    }
+    for (const prefix of DEFAULT_UNAUTHENTICATED_PREFIXES) {
+      if (req.path.startsWith(prefix)) {
+        next();
+        return;
+      }
+    }
+    if (req.method === "OPTIONS") {
+      next();
+      return;
+    }
+    const provided = req.header(LOCAL_AGENT_TOKEN_HEADER);
+    if (!provided || !tokensEqual(provided, options.token)) {
+      res.status(401).json({ error: "invalid_or_missing_token", header: LOCAL_AGENT_TOKEN_HEADER });
+      return;
+    }
+    next();
+  };
+};
+
+// src/cors.ts
+var createCorsMiddleware = (options) => {
+  const allowed = options.allowedOrigin;
+  return (req, res, next) => {
+    const origin = req.header("origin");
+    if (origin && origin === allowed) {
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Vary", "Origin");
+      res.setHeader("Access-Control-Allow-Credentials", "false");
+      res.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS");
+      res.setHeader(
+        "Access-Control-Allow-Headers",
+        `Content-Type, ${LOCAL_AGENT_TOKEN_HEADER}`
+      );
+      res.setHeader("Access-Control-Max-Age", "300");
+    }
+    if (req.method === "OPTIONS") {
+      res.status(204).end();
+      return;
+    }
+    next();
+  };
+};
+
+// src/state.ts
+var createState = () => {
+  let selected = null;
+  return {
+    getSelectedRepo: () => selected,
+    setSelectedRepo: (repo) => {
+      selected = repo;
+    },
+    clearSelectedRepo: () => {
+      selected = null;
+    }
+  };
+};
+
+// src/routes/health.ts
+var createHealthHandler = (config) => {
+  return (_req, res) => {
+    const body = {
+      ok: true,
+      helperVersion: config.helperVersion,
+      boundHost: config.host,
+      port: config.port,
+      startedAt: config.startedAt
+    };
+    res.json(body);
+  };
+};
+
+// src/routes/repo.ts
+import { Router as createRouter } from "express";
+import path2 from "node:path";
+import { z } from "zod";
+
+// src/lib/git.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var GitCommandError = class extends Error {
+  stderr;
+  exitCode;
+  constructor(args, exitCode, stderr) {
+    super(`git ${args.join(" ")} failed with exit ${exitCode}: ${stderr.trim()}`);
+    this.name = "GitCommandError";
+    this.stderr = stderr;
+    this.exitCode = exitCode;
+  }
+};
+var runGit = async (cwd, args) => {
+  try {
+    const { stdout } = await execFileAsync("git", args, {
+      cwd,
+      // Generous-ish buffer for diffs of medium-sized changes. We surface
+      // a sizeBytes field so the UI can refuse to render extreme cases.
+      maxBuffer: 16 * 1024 * 1024,
+      // Inherit a stripped env — we don't want PAGER or GIT_* tracing.
+      env: { ...process.env, GIT_PAGER: "cat", PAGER: "cat" }
+    });
+    return stdout;
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err) {
+      const e = err;
+      throw new GitCommandError(args, e.code ?? -1, e.stderr ?? "");
+    }
+    throw err;
+  }
+};
+var getBranch = async (cwd) => {
+  try {
+    const out = (await runGit(cwd, ["rev-parse", "--abbrev-ref", "HEAD"])).trim();
+    if (out === "HEAD") {
+      return null;
+    }
+    return out;
+  } catch {
+    return null;
+  }
+};
+var getHeadShort = async (cwd) => {
+  try {
+    return (await runGit(cwd, ["rev-parse", "--short", "HEAD"])).trim();
+  } catch {
+    return null;
+  }
+};
+var isDirty = async (cwd) => {
+  const out = await runGit(cwd, ["status", "--porcelain"]);
+  return out.trim().length > 0;
+};
+var parseShortStatus = (output) => {
+  const lines = output.split("\n");
+  const files = [];
+  for (const line of lines) {
+    if (line.length < 4) {
+      continue;
+    }
+    const indexChar = line[0];
+    const workChar = line[1];
+    if (indexChar === void 0 || workChar === void 0) {
+      continue;
+    }
+    let pathPart = line.slice(3);
+    const arrow = pathPart.indexOf(" -> ");
+    if (arrow !== -1) {
+      pathPart = pathPart.slice(arrow + 4);
+    }
+    if (pathPart.startsWith('"') && pathPart.endsWith('"') && pathPart.length >= 2) {
+      pathPart = pathPart.slice(1, -1);
+    }
+    files.push({
+      path: pathPart,
+      index: asGitStatusCode(indexChar),
+      workTree: asGitStatusCode(workChar),
+      untracked: indexChar === "?" && workChar === "?"
+    });
+  }
+  return files;
+};
+var VALID_STATUS_CODES = /* @__PURE__ */ new Set([" ", "M", "A", "D", "R", "C", "U", "?", "!"]);
+var asGitStatusCode = (ch) => {
+  if (VALID_STATUS_CODES.has(ch)) {
+    return ch;
+  }
+  return "M";
+};
+var getStatusShort = async (cwd) => {
+  const out = await runGit(cwd, ["status", "--short", "-uall"]);
+  return parseShortStatus(out);
+};
+var getDiff = async (cwd) => {
+  return runGit(cwd, ["diff", "HEAD"]);
+};
+var runGitWithStdin = async (cwd, args, input) => {
+  const { execFile: execFile2 } = await import("node:child_process");
+  return new Promise((resolve, reject) => {
+    const child = execFile2(
+      "git",
+      args,
+      {
+        cwd,
+        maxBuffer: 16 * 1024 * 1024,
+        env: { ...process.env, GIT_PAGER: "cat", PAGER: "cat" }
+      },
+      (err, stdout, stderr) => {
+        if (err) {
+          const e = err;
+          reject(new GitCommandError(args, e.code ?? -1, stderr));
+          return;
+        }
+        resolve(stdout);
+      }
+    );
+    child.stdin?.write(input);
+    child.stdin?.end();
+  });
+};
+var canApplyDiff = async (cwd, unified) => {
+  try {
+    await runGitWithStdin(cwd, ["apply", "--check"], unified);
+    return { ok: true };
+  } catch (err) {
+    if (err instanceof GitCommandError) {
+      return { ok: false, stderr: err.stderr };
+    }
+    throw err;
+  }
+};
+var applyDiff = async (cwd, unified) => {
+  await runGitWithStdin(cwd, ["apply"], unified);
+};
+var parseDiffPaths = (unified) => {
+  const paths = [];
+  for (const line of unified.split("\n")) {
+    const match = /^diff --git a\/(.+) b\/(.+)$/.exec(line);
+    if (match) {
+      paths.push(match[2]);
+    }
+  }
+  return paths;
+};
+
+// src/lib/paths.ts
+import { access, lstat, realpath, stat } from "node:fs/promises";
+import path from "node:path";
+var InvalidRepoPathError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "InvalidRepoPathError";
+    this.code = code;
+  }
+};
+var exists = async (p) => {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var validateRepoPath = async (raw) => {
+  if (typeof raw !== "string") {
+    throw new InvalidRepoPathError("not_a_string", "path must be a string");
+  }
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) {
+    throw new InvalidRepoPathError("empty", "path must not be empty");
+  }
+  if (!path.isAbsolute(trimmed)) {
+    throw new InvalidRepoPathError(
+      "not_absolute",
+      `path must be absolute (got: ${trimmed})`
+    );
+  }
+  let resolved;
+  try {
+    resolved = await realpath(trimmed);
+  } catch {
+    throw new InvalidRepoPathError(
+      "does_not_exist",
+      `path does not exist: ${trimmed}`
+    );
+  }
+  const dirStat = await stat(resolved);
+  if (!dirStat.isDirectory()) {
+    throw new InvalidRepoPathError(
+      "not_a_directory",
+      `path is not a directory: ${resolved}`
+    );
+  }
+  const gitMarker = path.join(resolved, ".git");
+  if (!await exists(gitMarker)) {
+    throw new InvalidRepoPathError(
+      "not_a_git_repo",
+      `path does not contain a .git entry: ${resolved}`
+    );
+  }
+  await lstat(gitMarker);
+  return resolved;
+};
+
+// src/routes/repo.ts
+var selectRepoSchema = z.object({
+  path: z.string().min(1)
+});
+var applyPatchSchema = z.object({
+  unified: z.string().min(1).max(8 * 1024 * 1024),
+  baselineHash: z.string().optional()
+});
+var buildRepoStatus = async (resolvedPath) => {
+  const [branch, head, dirty] = await Promise.all([
+    getBranch(resolvedPath),
+    getHeadShort(resolvedPath),
+    isDirty(resolvedPath)
+  ]);
+  return {
+    path: resolvedPath,
+    name: path2.basename(resolvedPath),
+    branch,
+    head,
+    isDirty: dirty
+  };
+};
+var sendInvalidRepoPath = (res, err) => {
+  res.status(400).json({ error: err.code, message: err.message });
+};
+var sendGitError = (res, err) => {
+  res.status(500).json({
+    error: "git_command_failed",
+    message: err.message,
+    exitCode: err.exitCode
+  });
+};
+var requireSelectedRepo = (state, res) => {
+  const repo = state.getSelectedRepo();
+  if (!repo) {
+    res.status(409).json({ error: "no_repo_selected" });
+    return null;
+  }
+  return repo;
+};
+var createRepoRouter = (state) => {
+  const router = createRouter();
+  router.post("/select", async (req, res) => {
+    const parsed = selectRepoSchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "invalid_body", issues: parsed.error.issues });
+      return;
+    }
+    try {
+      const resolved = await validateRepoPath(parsed.data.path);
+      const status = await buildRepoStatus(resolved);
+      state.setSelectedRepo(status);
+      const body = { ok: true, repo: status };
+      res.json(body);
+    } catch (err) {
+      if (err instanceof InvalidRepoPathError) {
+        sendInvalidRepoPath(res, err);
+        return;
+      }
+      if (err instanceof GitCommandError) {
+        sendGitError(res, err);
+        return;
+      }
+      throw err;
+    }
+  });
+  router.get("/status", async (_req, res) => {
+    const repo = state.getSelectedRepo();
+    if (!repo) {
+      const body = { repo: null };
+      res.json(body);
+      return;
+    }
+    try {
+      const refreshed = await buildRepoStatus(repo.path);
+      state.setSelectedRepo(refreshed);
+      const body = { repo: refreshed };
+      res.json(body);
+    } catch (err) {
+      if (err instanceof GitCommandError) {
+        sendGitError(res, err);
+        return;
+      }
+      throw err;
+    }
+  });
+  router.get("/diff", async (_req, res) => {
+    const repo = requireSelectedRepo(state, res);
+    if (!repo) {
+      return;
+    }
+    try {
+      const unified = await getDiff(repo.path);
+      const body = {
+        unified,
+        sizeBytes: Buffer.byteLength(unified, "utf8")
+      };
+      res.json(body);
+    } catch (err) {
+      if (err instanceof GitCommandError) {
+        sendGitError(res, err);
+        return;
+      }
+      throw err;
+    }
+  });
+  router.get("/changed-files", async (_req, res) => {
+    const repo = requireSelectedRepo(state, res);
+    if (!repo) {
+      return;
+    }
+    try {
+      const files = await getStatusShort(repo.path);
+      const body = { files };
+      res.json(body);
+    } catch (err) {
+      if (err instanceof GitCommandError) {
+        sendGitError(res, err);
+        return;
+      }
+      throw err;
+    }
+  });
+  router.post("/apply", async (req, res) => {
+    const repo = requireSelectedRepo(state, res);
+    if (!repo) return;
+    const parsed = applyPatchSchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "invalid_body", issues: parsed.error.issues });
+      return;
+    }
+    try {
+      const check = await canApplyDiff(repo.path, parsed.data.unified);
+      if (!check.ok) {
+        res.status(409).json({
+          error: "diff_does_not_apply",
+          message: "Diff doesn't apply against the current working tree. The repo may have changed since the diff was proposed.",
+          stderr: check.stderr
+        });
+        return;
+      }
+      await applyDiff(repo.path, parsed.data.unified);
+      const paths = parseDiffPaths(parsed.data.unified);
+      const body = {
+        ok: true,
+        filesChanged: paths.length,
+        paths
+      };
+      res.json(body);
+    } catch (err) {
+      if (err instanceof GitCommandError) {
+        sendGitError(res, err);
+        return;
+      }
+      throw err;
+    }
+  });
+  return router;
+};
+
+// src/routes/agent.ts
+import { Router as createRouter2 } from "express";
+import { z as z2 } from "zod";
+
+// src/broker.ts
+import { randomUUID } from "node:crypto";
+var LlmBroker = class {
+  pending = /* @__PURE__ */ new Map();
+  emit;
+  timeoutMs;
+  overrideProvider;
+  overrideModel;
+  closed = false;
+  constructor(options) {
+    this.emit = options.emitToStream;
+    this.timeoutMs = options.timeoutMs ?? 9e4;
+    this.overrideProvider = options.overrideProvider;
+    this.overrideModel = options.overrideModel;
+  }
+  /** Called by the adapter when it needs an LLM call. Resolves with the
+   *  full LlmBrokerResponsePayload once the browser fulfils it. Rejects
+   *  on timeout, broker close, or explicit failure from the browser.
+   *
+   *  Pass `observer` to receive incremental stream chunks if the browser
+   *  fulfils via the streaming chunk endpoint. Observer is called once
+   *  per chunk; the Promise still resolves with the final aggregate
+   *  payload when the stream completes. */
+  request(payload, observer) {
+    if (this.closed) {
+      return Promise.reject(new Error("broker is closed"));
+    }
+    const requestId = randomUUID();
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.pending.delete(requestId);
+        reject(
+          new Error(
+            `llm_broker_timeout: no response within ${this.timeoutMs}ms`
+          )
+        );
+      }, this.timeoutMs);
+      timer.unref?.();
+      this.pending.set(requestId, { resolve, reject, timer, observer });
+      const effectiveProvider = this.overrideProvider ?? payload.provider;
+      const effectiveModel = this.overrideModel ?? payload.model;
+      const envelope = {
+        type: "llm_request",
+        requestId,
+        provider: effectiveProvider,
+        model: effectiveModel,
+        payload: {
+          messages: payload.messages,
+          tools: payload.tools,
+          temperature: payload.temperature,
+          systemPrompt: payload.systemPrompt
+        }
+      };
+      try {
+        this.emit(envelope);
+      } catch (err) {
+        clearTimeout(timer);
+        this.pending.delete(requestId);
+        reject(err instanceof Error ? err : new Error(String(err)));
+      }
+    });
+  }
+  /** True iff this broker has a pending request with the given id. Used
+   *  by the registry to route /agent/llm-response/:requestId without
+   *  needing the caller to supply sessionId. */
+  has(requestId) {
+    return this.pending.has(requestId);
+  }
+  /** Called by the /agent/llm-response route once the browser has POSTed
+   *  the completion back. Returns true if a pending request matched.
+   *
+   *  If the request was registered with an observer (streaming flow),
+   *  the observer is also invoked with a synthesised text_delta + a
+   *  `complete` chunk — this makes the streaming path work even when
+   *  the browser fulfils via the non-streaming /agent/llm-response
+   *  route (e.g. for providers that don't support streaming). */
+  fulfill(requestId, response) {
+    const entry = this.pending.get(requestId);
+    if (!entry) return false;
+    clearTimeout(entry.timer);
+    this.pending.delete(requestId);
+    if (entry.observer) {
+      try {
+        if (response.text) {
+          entry.observer({ type: "text_delta", text: response.text });
+        }
+        entry.observer({ type: "complete", payload: response });
+      } catch {
+      }
+    }
+    entry.resolve(response);
+    return true;
+  }
+  /** Called by the /agent/llm-chunk/:requestId route when the browser
+   *  forwards an incremental stream chunk. The observer (if any) is
+   *  invoked; a `complete` chunk also resolves the pending Promise. */
+  pushChunk(requestId, chunk) {
+    const entry = this.pending.get(requestId);
+    if (!entry) return false;
+    if (entry.observer) {
+      try {
+        entry.observer(chunk);
+      } catch {
+      }
+    }
+    if (chunk.type === "complete") {
+      clearTimeout(entry.timer);
+      this.pending.delete(requestId);
+      entry.resolve(chunk.payload);
+    } else if (chunk.type === "error") {
+      clearTimeout(entry.timer);
+      this.pending.delete(requestId);
+      entry.reject(new Error(chunk.message));
+    }
+    return true;
+  }
+  /** Called by the /agent/llm-response route when the browser reports a
+   *  failure rather than a completion. */
+  fail(requestId, message) {
+    const entry = this.pending.get(requestId);
+    if (!entry) return false;
+    clearTimeout(entry.timer);
+    this.pending.delete(requestId);
+    entry.reject(new Error(message));
+    return true;
+  }
+  /** Reject all in-flight requests. Called when the parent SSE stream
+   *  closes so a stranded request doesn't sit forever. */
+  close(reason = "broker_closed") {
+    this.closed = true;
+    for (const [, entry] of this.pending.entries()) {
+      clearTimeout(entry.timer);
+      entry.reject(new Error(reason));
+    }
+    this.pending.clear();
+  }
+  get pendingCount() {
+    return this.pending.size;
+  }
+};
+var createBrokerRegistry = () => {
+  const bySession = /* @__PURE__ */ new Map();
+  return {
+    register(sessionId, broker) {
+      const existing = bySession.get(sessionId);
+      if (existing && existing !== broker) {
+        existing.close("superseded_by_new_stream");
+      }
+      bySession.set(sessionId, broker);
+    },
+    unregister(sessionId, broker) {
+      if (bySession.get(sessionId) === broker) {
+        bySession.delete(sessionId);
+      }
+    },
+    get(sessionId) {
+      return bySession.get(sessionId) ?? null;
+    }
+  };
+};
+
+// src/routes/agent.ts
+var historyRoleSchema = z2.enum(["user", "assistant", "system", "tool"]);
+var agentMessageBodySchema = z2.object({
+  sessionId: z2.string().min(1),
+  prompt: z2.string().min(1).max(2e5),
+  history: z2.array(
+    z2.object({
+      role: historyRoleSchema,
+      content: z2.string()
+    })
+  ).max(200).optional(),
+  /** Optional user-chosen routing for this turn. When absent the cloud
+   *  picks the default (CODING_AGENT_DEFAULT_PROVIDER/MODEL). */
+  preferredProvider: z2.string().min(1).max(100).optional(),
+  preferredModel: z2.string().min(1).max(200).optional()
+});
+var writeEvent = (res, event) => {
+  res.write(`data: ${JSON.stringify(event)}
+
+`);
+};
+var writeDone = (res) => {
+  res.write("data: [DONE]\n\n");
+};
+var createAgentRouter = (deps) => {
+  const router = createRouter2();
+  router.post("/message", async (req, res) => {
+    const parsed = agentMessageBodySchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "invalid_body", issues: parsed.error.issues });
+      return;
+    }
+    const repo = deps.state.getSelectedRepo();
+    if (!repo) {
+      res.status(409).json({ error: "no_repo_selected" });
+      return;
+    }
+    res.setHeader("Content-Type", "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache, no-transform");
+    res.setHeader("Connection", "keep-alive");
+    res.setHeader("X-Accel-Buffering", "no");
+    res.flushHeaders?.();
+    const controller = new AbortController();
+    res.on("close", () => {
+      if (!res.writableEnded) {
+        controller.abort();
+      }
+    });
+    const broker = new LlmBroker({
+      emitToStream: (event) => writeEvent(res, event),
+      overrideProvider: parsed.data.preferredProvider,
+      overrideModel: parsed.data.preferredModel
+    });
+    deps.brokerRegistry.register(parsed.data.sessionId, broker);
+    try {
+      const history = parsed.data.history ? parsed.data.history.map((m) => ({ role: m.role, content: m.content })) : void 0;
+      for await (const event of deps.adapter.streamMessage({
+        sessionId: parsed.data.sessionId,
+        repoPath: repo.path,
+        prompt: parsed.data.prompt,
+        history,
+        signal: controller.signal,
+        broker: (payload) => broker.request(payload),
+        preferredProvider: parsed.data.preferredProvider,
+        preferredModel: parsed.data.preferredModel
+      })) {
+        if (controller.signal.aborted) {
+          break;
+        }
+        writeEvent(res, event);
+      }
+      writeDone(res);
+    } catch (err) {
+      if (err && typeof err === "object" && "name" in err && err.name === "AbortError") {
+        writeDone(res);
+      } else {
+        const message = err instanceof Error ? err.message : "Adapter stream failed";
+        writeEvent(res, { type: "error", message });
+        writeDone(res);
+      }
+    } finally {
+      broker.close("stream_closed");
+      deps.brokerRegistry.unregister(parsed.data.sessionId, broker);
+      res.end();
+    }
+  });
+  return router;
+};
+var llmResponseBodySchema = z2.object({
+  sessionId: z2.string().min(1),
+  text: z2.string(),
+  provider: z2.string().min(1),
+  model: z2.string().min(1),
+  tokenUsage: z2.object({ input: z2.number().nonnegative(), output: z2.number().nonnegative() }).optional(),
+  error: z2.string().optional(),
+  toolCalls: z2.array(
+    z2.object({
+      id: z2.string().min(1),
+      type: z2.literal("function"),
+      function: z2.object({
+        name: z2.string().min(1),
+        arguments: z2.string()
+      })
+    })
+  ).optional(),
+  finishReason: z2.enum(["stop", "tool_calls", "length", "content_filter"]).optional()
+});
+var llmChunkBodySchema = z2.object({
+  sessionId: z2.string().min(1),
+  chunk: z2.union([
+    z2.object({
+      type: z2.literal("text_delta"),
+      text: z2.string()
+    }),
+    z2.object({
+      type: z2.literal("tool_call_delta"),
+      index: z2.number().int().nonnegative(),
+      id: z2.string().optional(),
+      name: z2.string().optional(),
+      argumentsDelta: z2.string().optional()
+    }),
+    z2.object({
+      type: z2.literal("complete"),
+      payload: z2.object({
+        text: z2.string(),
+        provider: z2.string(),
+        model: z2.string(),
+        tokenUsage: z2.object({
+          input: z2.number().nonnegative(),
+          output: z2.number().nonnegative()
+        }).optional(),
+        finishReason: z2.enum(["stop", "tool_calls", "length", "content_filter"]).optional(),
+        toolCalls: z2.array(
+          z2.object({
+            id: z2.string(),
+            type: z2.literal("function"),
+            function: z2.object({
+              name: z2.string(),
+              arguments: z2.string()
+            })
+          })
+        ).optional()
+      })
+    }),
+    z2.object({
+      type: z2.literal("error"),
+      message: z2.string()
+    })
+  ])
+});
+var createLlmResponseRouter = (deps) => {
+  const router = createRouter2();
+  router.post("/:requestId", (req, res) => {
+    const requestId = req.params.requestId;
+    if (!requestId) {
+      res.status(400).json({ error: "missing_request_id" });
+      return;
+    }
+    const parsed = llmResponseBodySchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "invalid_body", issues: parsed.error.issues });
+      return;
+    }
+    const broker = deps.brokerRegistry.get(parsed.data.sessionId);
+    if (!broker) {
+      res.status(404).json({ error: "no_active_stream_for_session" });
+      return;
+    }
+    if (!broker.has(requestId)) {
+      res.status(404).json({ error: "unknown_request_id" });
+      return;
+    }
+    if (parsed.data.error) {
+      broker.fail(requestId, parsed.data.error);
+      res.json({ ok: true });
+      return;
+    }
+    const payload = {
+      text: parsed.data.text,
+      provider: parsed.data.provider,
+      model: parsed.data.model,
+      tokenUsage: parsed.data.tokenUsage,
+      ...parsed.data.toolCalls ? { toolCalls: parsed.data.toolCalls } : {},
+      ...parsed.data.finishReason ? { finishReason: parsed.data.finishReason } : {}
+    };
+    broker.fulfill(requestId, payload);
+    res.json({ ok: true });
+  });
+  return router;
+};
+var createLlmChunkRouter = (deps) => {
+  const router = createRouter2();
+  router.post("/:requestId", (req, res) => {
+    const requestId = req.params.requestId;
+    if (!requestId) {
+      res.status(400).json({ error: "missing_request_id" });
+      return;
+    }
+    const parsed = llmChunkBodySchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "invalid_body", issues: parsed.error.issues });
+      return;
+    }
+    const broker = deps.brokerRegistry.get(parsed.data.sessionId);
+    if (!broker) {
+      res.status(404).json({ error: "no_active_stream_for_session" });
+      return;
+    }
+    const accepted = broker.pushChunk(
+      requestId,
+      parsed.data.chunk
+    );
+    if (!accepted) {
+      res.status(404).json({ error: "unknown_request_id" });
+      return;
+    }
+    res.json({ ok: true });
+  });
+  return router;
+};
+
+// src/routes/llm-shim.ts
+import { Router as createRouter3 } from "express";
+
+// src/shim/openai-translator.ts
+var translateRequest = (req) => {
+  let systemPrompt;
+  const messages = [];
+  for (const msg of req.messages) {
+    if (msg.role === "system") {
+      const text = typeof msg.content === "string" ? msg.content : "";
+      systemPrompt = systemPrompt === void 0 ? text : `${systemPrompt}
+
+${text}`;
+      continue;
+    }
+    let content = typeof msg.content === "string" ? msg.content : "";
+    if (msg.role === "assistant" && msg.tool_calls && msg.tool_calls.length > 0) {
+      const callsLine = msg.tool_calls.map(
+        (c) => `[tool_call ${c.function.name} args=${c.function.arguments}]`
+      ).join("\n");
+      content = content ? `${content}
+${callsLine}` : callsLine;
+    }
+    if (msg.role === "tool" && msg.tool_call_id) {
+      content = `[tool_result id=${msg.tool_call_id}] ${content}`;
+    }
+    messages.push({ role: msg.role, content });
+  }
+  return {
+    provider: void 0,
+    // cloud picks the default — see CODING_AGENT_DEFAULT_PROVIDER
+    model: req.model,
+    // pass through for telemetry; cloud may override
+    systemPrompt,
+    temperature: req.temperature,
+    messages,
+    tools: req.tools
+  };
+};
+var translateResponse = (response, id, modelEcho) => {
+  const hasToolCalls = response.toolCalls && response.toolCalls.length > 0;
+  const finish_reason = response.finishReason ?? (hasToolCalls ? "tool_calls" : "stop");
+  return {
+    id,
+    object: "chat.completion",
+    created: Math.floor(Date.now() / 1e3),
+    // Echo the model the client requested. The cloud may have routed to
+    // a different actual model; we surface that in `response.model` but
+    // OpenAI clients expect the echoed model id to match their request.
+    model: modelEcho,
+    choices: [
+      {
+        index: 0,
+        message: {
+          role: "assistant",
+          content: response.text || null,
+          ...hasToolCalls ? { tool_calls: response.toolCalls } : {}
+        },
+        finish_reason
+      }
+    ],
+    ...response.tokenUsage ? {
+      usage: {
+        prompt_tokens: response.tokenUsage.input,
+        completion_tokens: response.tokenUsage.output,
+        total_tokens: response.tokenUsage.input + response.tokenUsage.output
+      }
+    } : {}
+  };
+};
+
+// src/shim/active-broker.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+var byToken = /* @__PURE__ */ new Map();
+var bindActiveBroker = (broker) => {
+  const token = `dlg-${randomUUID2()}`;
+  byToken.set(token, { token, broker });
+  return {
+    token,
+    release() {
+      const current = byToken.get(token);
+      if (current && current.broker === broker) {
+        byToken.delete(token);
+      }
+    }
+  };
+};
+var getActiveBrokerByToken = (token) => {
+  return byToken.get(token)?.broker ?? null;
+};
+
+// src/routes/llm-shim.ts
+var extractBearer = (req) => {
+  const header = req.header("authorization");
+  if (!header) return null;
+  if (!header.toLowerCase().startsWith("bearer ")) return null;
+  return header.slice(7).trim() || null;
+};
+var sendOpenAIError = (res, status, message, type = "invalid_request_error") => {
+  res.status(status).json({ error: { message, type } });
+};
+var createLlmShimRouter = () => {
+  const router = createRouter3();
+  router.post(
+    "/v1/chat/completions",
+    async (req, res) => {
+      const token = extractBearer(req);
+      if (!token) {
+        sendOpenAIError(res, 401, "Missing Authorization bearer", "auth_error");
+        return;
+      }
+      const broker = getActiveBrokerByToken(token);
+      if (!broker) {
+        sendOpenAIError(
+          res,
+          401,
+          "No active coding-agent stream is currently authorised on this helper.",
+          "auth_error"
+        );
+        return;
+      }
+      const body = req.body;
+      if (!body || typeof body !== "object" || !Array.isArray(body.messages) || body.messages.length === 0) {
+        sendOpenAIError(res, 400, "messages[] is required and must be non-empty");
+        return;
+      }
+      const brokerRequest = translateRequest(body);
+      const completionId = `chatcmpl-${Math.random().toString(36).slice(2, 10)}`;
+      const stream = body.stream === true;
+      if (stream) {
+        res.setHeader("Content-Type", "text/event-stream");
+        res.setHeader("Cache-Control", "no-cache, no-transform");
+        res.setHeader("Connection", "keep-alive");
+        res.flushHeaders?.();
+        const writeOpenAi = (delta) => {
+          res.write(`data: ${JSON.stringify(delta)}
+
+`);
+        };
+        writeOpenAi({
+          id: completionId,
+          object: "chat.completion.chunk",
+          created: Math.floor(Date.now() / 1e3),
+          model: body.model,
+          choices: [
+            { index: 0, delta: { role: "assistant" }, finish_reason: null }
+          ]
+        });
+        const finalPayloadRef = { current: null };
+        const observer = (chunk) => {
+          switch (chunk.type) {
+            case "text_delta":
+              writeOpenAi({
+                id: completionId,
+                object: "chat.completion.chunk",
+                created: Math.floor(Date.now() / 1e3),
+                model: body.model,
+                choices: [
+                  {
+                    index: 0,
+                    delta: { content: chunk.text },
+                    finish_reason: null
+                  }
+                ]
+              });
+              break;
+            case "tool_call_delta":
+              writeOpenAi({
+                id: completionId,
+                object: "chat.completion.chunk",
+                created: Math.floor(Date.now() / 1e3),
+                model: body.model,
+                choices: [
+                  {
+                    index: 0,
+                    delta: {
+                      tool_calls: [
+                        {
+                          index: chunk.index,
+                          ...chunk.id ? { id: chunk.id } : {},
+                          ...chunk.id || chunk.name ? { type: "function" } : {},
+                          ...chunk.name || chunk.argumentsDelta !== void 0 ? {
+                            function: {
+                              ...chunk.name ? { name: chunk.name } : {},
+                              ...chunk.argumentsDelta !== void 0 ? { arguments: chunk.argumentsDelta } : {}
+                            }
+                          } : {}
+                        }
+                      ]
+                    },
+                    finish_reason: null
+                  }
+                ]
+              });
+              break;
+            case "complete":
+              finalPayloadRef.current = translateResponse(
+                chunk.payload,
+                completionId,
+                body.model
+              );
+              break;
+            case "error":
+              break;
+          }
+        };
+        try {
+          await broker.request(brokerRequest, observer);
+        } catch (err) {
+          writeOpenAi({
+            id: completionId,
+            object: "chat.completion.chunk",
+            created: Math.floor(Date.now() / 1e3),
+            model: body.model,
+            choices: [
+              {
+                index: 0,
+                delta: {},
+                finish_reason: "stop"
+              }
+            ]
+          });
+          res.write("data: [DONE]\n\n");
+          res.end();
+          void err;
+          return;
+        }
+        const finishReason = finalPayloadRef.current?.choices[0]?.finish_reason ?? "stop";
+        writeOpenAi({
+          id: completionId,
+          object: "chat.completion.chunk",
+          created: Math.floor(Date.now() / 1e3),
+          model: body.model,
+          choices: [
+            {
+              index: 0,
+              delta: {},
+              finish_reason: finishReason
+            }
+          ]
+        });
+        res.write("data: [DONE]\n\n");
+        res.end();
+        return;
+      }
+      let brokerResponse;
+      try {
+        brokerResponse = await broker.request(brokerRequest);
+      } catch (err) {
+        sendOpenAIError(
+          res,
+          502,
+          err instanceof Error ? err.message : "Broker call failed",
+          "api_error"
+        );
+        return;
+      }
+      if (brokerResponse.error) {
+        sendOpenAIError(res, 502, brokerResponse.error, "api_error");
+        return;
+      }
+      const out = translateResponse(brokerResponse, completionId, body.model);
+      res.json(out);
+    }
+  );
+  return router;
+};
+
+// src/adapters/mock-adapter.ts
+import { setTimeout as delay } from "node:timers/promises";
+var RESPONSE_FRAGMENTS = [
+  "Got it \u2014 looking at",
+  " the repo at",
+  " {repoPath}.",
+  "\n\nThis is a mock response from MockOpenCodeAdapter,",
+  " so the actual analysis hasn't run.",
+  " The real opencode integration lands in Step 9; until then",
+  " every prompt produces this same canned reply plus a small synthetic",
+  " diff so you can exercise the apply flow safely."
+];
+var SYNTHETIC_DIFF = {
+  type: "diff_proposed",
+  unified: [
+    "diff --git a/MOCK_NOTES.md b/MOCK_NOTES.md",
+    "new file mode 100644",
+    "index 0000000..1111111",
+    "--- /dev/null",
+    "+++ b/MOCK_NOTES.md",
+    "@@ -0,0 +1,3 @@",
+    "+# Mock notes",
+    "+",
+    "+Created by MockOpenCodeAdapter to demonstrate the diff flow.",
+    ""
+  ].join("\n"),
+  files: [
+    {
+      path: "MOCK_NOTES.md",
+      additions: 3,
+      deletions: 0,
+      status: "added"
+    }
+  ]
+};
+var MockOpenCodeAdapter = class {
+  constructor(options = {}) {
+    this.options = options;
+  }
+  name = "mock";
+  async *streamMessage(request) {
+    const tokenDelay = this.options.tokenDelayMs ?? 0;
+    let brokerPrefix = null;
+    if (this.options.useBroker && request.broker) {
+      this.throwIfAborted(request.signal);
+      try {
+        const response = await request.broker({
+          provider: this.options.brokerProvider,
+          model: this.options.brokerModel,
+          messages: [
+            { role: "user", content: request.prompt }
+          ]
+        });
+        brokerPrefix = `[brokered via ${response.provider}:${response.model}] ` + response.text.slice(0, 200);
+      } catch (err) {
+        yield {
+          type: "error",
+          message: `Brokered LLM call failed: ${err.message}`,
+          recoverable: true
+        };
+      }
+    }
+    if (brokerPrefix) {
+      yield { type: "text_delta", text: brokerPrefix + "\n\n" };
+    }
+    for (const fragment of RESPONSE_FRAGMENTS) {
+      this.throwIfAborted(request.signal);
+      const text = fragment.replace("{repoPath}", request.repoPath);
+      yield { type: "text_delta", text };
+      if (tokenDelay > 0) {
+        await delay(tokenDelay);
+      }
+    }
+    if (!this.options.skipToolCall) {
+      this.throwIfAborted(request.signal);
+      const toolCallId = `mock-tool-${Date.now()}`;
+      yield {
+        type: "tool_call_start",
+        toolCallId,
+        tool: "fs.read",
+        args: { path: "README.md" }
+      };
+      if (tokenDelay > 0) {
+        await delay(tokenDelay);
+      }
+      yield {
+        type: "tool_call_end",
+        toolCallId,
+        ok: true,
+        summary: "Read README.md (mock \u2014 no actual file IO performed)"
+      };
+    }
+    if (!this.options.skipDiff) {
+      this.throwIfAborted(request.signal);
+      yield SYNTHETIC_DIFF;
+    }
+    this.throwIfAborted(request.signal);
+    yield {
+      type: "done",
+      messageId: this.options.fixedMessageId ?? `mock-msg-${request.sessionId}-${Date.now()}`
+    };
+  }
+  throwIfAborted(signal) {
+    if (signal?.aborted) {
+      const err = new Error("aborted");
+      err.name = "AbortError";
+      throw err;
+    }
+  }
+};
+
+// src/adapters/opencode-event-mapper.ts
+var createMapState = (ourSessionId, openCodeSessionId) => ({
+  ourSessionId,
+  openCodeSessionId,
+  startedTools: /* @__PURE__ */ new Set(),
+  endedTools: /* @__PURE__ */ new Set(),
+  announcedPatches: /* @__PURE__ */ new Set()
+});
+var EMPTY = { events: [], done: false };
+var mapEvent = (item, state) => {
+  const sid = item.properties?.sessionID;
+  if (sid && sid !== state.openCodeSessionId) {
+    return EMPTY;
+  }
+  if (item.type === "session.idle" && sid === state.openCodeSessionId) {
+    return { events: [{ type: "done" }], done: true };
+  }
+  if (item.type !== "message.part.updated") {
+    return EMPTY;
+  }
+  const part = item.properties?.part;
+  if (!part) return EMPTY;
+  switch (part.type) {
+    case "text": {
+      const delta = item.properties?.delta ?? part.text ?? "";
+      if (!delta) return EMPTY;
+      return { events: [{ type: "text_delta", text: delta }], done: false };
+    }
+    case "tool": {
+      const callId = part.callID ?? part.id ?? "";
+      const tool = part.tool ?? "tool";
+      const status = part.state?.status;
+      if (!callId || !status) return EMPTY;
+      if (status === "pending" || status === "running") {
+        if (state.startedTools.has(callId)) {
+          return EMPTY;
+        }
+        state.startedTools.add(callId);
+        const event = {
+          type: "tool_call_start",
+          toolCallId: callId,
+          tool,
+          args: part.state?.input
+        };
+        return { events: [event], done: false };
+      }
+      if (status === "completed" || status === "error") {
+        if (state.endedTools.has(callId)) {
+          return EMPTY;
+        }
+        state.endedTools.add(callId);
+        const event = {
+          type: "tool_call_end",
+          toolCallId: callId,
+          ok: status === "completed",
+          summary: status === "error" ? part.state?.error ?? "Tool failed" : part.state?.title
+        };
+        return { events: [event], done: false };
+      }
+      return EMPTY;
+    }
+    case "patch": {
+      const hash = part.hash ?? "";
+      if (!hash || state.announcedPatches.has(hash)) {
+        return EMPTY;
+      }
+      state.announcedPatches.add(hash);
+      const files = part.files ?? [];
+      return {
+        events: [
+          {
+            type: "diff_proposed",
+            unified: "",
+            files: files.map((path6) => ({
+              path: path6,
+              additions: 0,
+              deletions: 0,
+              status: "modified"
+            }))
+          }
+        ],
+        done: false,
+        patchToFetch: { hash, files }
+      };
+    }
+    default:
+      return EMPTY;
+  }
+};
+
+// src/adapters/engine-locator.ts
+var ENGINE_LOCATOR_ENV = "LOCAL_AGENT_ENGINE";
+var DEFAULT_LOCATOR_NAME = "local";
+var isLocatorName = (value) => value === "npm" || value === "local";
+var createEngineLocator = async (name) => {
+  const resolved = name ?? process.env[ENGINE_LOCATOR_ENV] ?? DEFAULT_LOCATOR_NAME;
+  if (!isLocatorName(resolved)) {
+    throw new Error(
+      `[engine-locator] Unknown engine "${resolved}". Set ${ENGINE_LOCATOR_ENV} to "npm" or "local".`
+    );
+  }
+  if (resolved === "npm") {
+    const { NpmSdkLocator: NpmSdkLocator2 } = await Promise.resolve().then(() => (init_engine_locator_npm(), engine_locator_npm_exports));
+    return new NpmSdkLocator2();
+  }
+  const { LocalEngineLocator: LocalEngineLocator2 } = await Promise.resolve().then(() => (init_engine_locator_local(), engine_locator_local_exports));
+  return new LocalEngineLocator2();
+};
+
+// src/adapters/opencode-adapter.ts
+init_engine_locator_npm();
+var DIOLOGUE_PROVIDER_ID = "diologue";
+var DIOLOGUE_MODEL_ID = "diologue-routed";
+var OpenCodeProcessAdapter = class {
+  constructor(options = {}) {
+    this.options = options;
+  }
+  name = "opencode";
+  serverPromise = null;
+  /** Maps our sessionId → opencode session id so successive turns within
+   *  one coding-agent session reuse the same opencode conversation. */
+  sessionMap = /* @__PURE__ */ new Map();
+  async resolveLocator() {
+    if (this.options.engineLocator) {
+      return this.options.engineLocator;
+    }
+    if (this.options.sdkLoader) {
+      return new NpmSdkLocator({
+        sdkLoader: this.options.sdkLoader
+      });
+    }
+    return createEngineLocator();
+  }
+  resolveHelperBaseUrl() {
+    if (this.options.helperBaseUrl) return this.options.helperBaseUrl;
+    const port = process.env.LOCAL_AGENT_PORT ?? "4099";
+    return `http://127.0.0.1:${port}`;
+  }
+  buildShimConfig() {
+    const baseURL = `${this.resolveHelperBaseUrl()}/llm-shim/v1`;
+    return {
+      provider: {
+        [DIOLOGUE_PROVIDER_ID]: {
+          name: "Diologue (brokered)",
+          // openai-compatible AI SDK provider — present in opencode's
+          // bundled providers. Any other custom-base-URL provider would
+          // work too; openai is the most permissive.
+          npm: "@ai-sdk/openai",
+          models: {
+            [DIOLOGUE_MODEL_ID]: {
+              id: DIOLOGUE_MODEL_ID,
+              name: "Diologue brokered model"
+            }
+          },
+          options: {
+            baseURL,
+            // The real apiKey gets injected per-stream via the
+            // active-broker handle. This placeholder is what opencode
+            // sees at config time; we'll override via env at runtime.
+            apiKey: "placeholder-will-be-replaced"
+          }
+        }
+      },
+      model: `${DIOLOGUE_PROVIDER_ID}/${DIOLOGUE_MODEL_ID}`
+    };
+  }
+  async ensureServer() {
+    if (this.serverPromise) {
+      return this.serverPromise;
+    }
+    this.serverPromise = (async () => {
+      const locator = await this.resolveLocator();
+      return locator.start({ config: this.buildShimConfig() });
+    })();
+    try {
+      return await this.serverPromise;
+    } catch (err) {
+      this.serverPromise = null;
+      throw err;
+    }
+  }
+  async ensureOpencodeSession(handle, ourSessionId, repoPath, title) {
+    const existing = this.sessionMap.get(ourSessionId);
+    if (existing) return existing;
+    const created = await handle.client.session.create({
+      body: { title },
+      query: { directory: repoPath }
+    });
+    const id = created.data?.id;
+    if (!id) {
+      throw new Error("opencode session.create returned no id");
+    }
+    this.sessionMap.set(ourSessionId, id);
+    return id;
+  }
+  async *streamMessage(request) {
+    let handle;
+    try {
+      handle = await this.ensureServer();
+    } catch (err) {
+      yield {
+        type: "error",
+        message: err instanceof Error ? err.message : "Failed to start opencode server",
+        recoverable: false
+      };
+      return;
+    }
+    let openCodeSessionId;
+    try {
+      openCodeSessionId = await this.ensureOpencodeSession(
+        handle,
+        request.sessionId,
+        request.repoPath,
+        request.prompt.slice(0, 80)
+      );
+    } catch (err) {
+      yield {
+        type: "error",
+        message: err instanceof Error ? err.message : "Failed to start opencode session",
+        recoverable: true
+      };
+      return;
+    }
+    const mapState = createMapState(
+      request.sessionId,
+      openCodeSessionId
+    );
+    let sawAnyPatch = false;
+    let lastPatchHash = "";
+    let activeBrokerHandle = null;
+    let streamScopedBroker = null;
+    if (request.broker) {
+      const callback = request.broker;
+      streamScopedBroker = new LlmBroker({
+        emitToStream: () => {
+        }
+      });
+      const realCallback = callback;
+      streamScopedBroker.request = async (payload) => {
+        return realCallback(payload);
+      };
+      activeBrokerHandle = bindActiveBroker(streamScopedBroker);
+    }
+    const eventController = new AbortController();
+    const stopOnAbort = () => eventController.abort();
+    if (request.signal) {
+      if (request.signal.aborted) {
+        return;
+      }
+      request.signal.addEventListener("abort", stopOnAbort);
+    }
+    let eventStream;
+    try {
+      const res = await handle.client.global.event({
+        signal: eventController.signal
+      });
+      eventStream = res.stream;
+    } catch (err) {
+      yield {
+        type: "error",
+        message: err instanceof Error ? err.message : "Failed to subscribe to opencode events",
+        recoverable: true
+      };
+      request.signal?.removeEventListener("abort", stopOnAbort);
+      return;
+    }
+    const promptBody = {
+      parts: [{ type: "text", text: request.prompt }]
+    };
+    if (streamScopedBroker && activeBrokerHandle) {
+      promptBody.model = {
+        providerID: DIOLOGUE_PROVIDER_ID,
+        modelID: DIOLOGUE_MODEL_ID
+      };
+    }
+    const promptPromise = handle.client.session.prompt({
+      path: { id: openCodeSessionId },
+      query: { directory: request.repoPath },
+      body: promptBody
+    }).catch((err) => {
+      return err instanceof Error ? err : new Error(String(err));
+    });
+    try {
+      for await (const item of eventStream) {
+        if (request.signal?.aborted) break;
+        const mapped = mapEvent(item, mapState);
+        for (const event of mapped.events) {
+          if (event.type === "diff_proposed" && mapped.patchToFetch) {
+            sawAnyPatch = true;
+            lastPatchHash = mapped.patchToFetch.hash;
+          }
+          yield event;
+        }
+        if (mapped.done) {
+          break;
+        }
+      }
+    } finally {
+      eventController.abort();
+      request.signal?.removeEventListener("abort", stopOnAbort);
+      activeBrokerHandle?.release();
+      streamScopedBroker?.close("turn_ended");
+    }
+    if (sawAnyPatch) {
+      try {
+        const diffRes = await handle.client.session.diff({
+          path: { id: openCodeSessionId },
+          query: { directory: request.repoPath }
+        });
+        const unified = diffRes.data?.unified ?? "";
+        if (unified) {
+          yield {
+            type: "diff_proposed",
+            unified,
+            files: parseUnifiedDiffFiles(unified)
+          };
+        }
+      } catch {
+      }
+    }
+    const promptResult = await promptPromise;
+    if (promptResult instanceof Error) {
+      yield { type: "error", message: promptResult.message, recoverable: true };
+    }
+    void lastPatchHash;
+  }
+  async close() {
+    if (!this.serverPromise) return;
+    try {
+      const handle = await this.serverPromise;
+      await handle.close();
+    } catch {
+    } finally {
+      this.serverPromise = null;
+      this.sessionMap.clear();
+    }
+  }
+};
+var parseUnifiedDiffFiles = (unified) => {
+  const files = [];
+  let current = null;
+  let oldPath = "";
+  let newPath = "";
+  for (const line of unified.split("\n")) {
+    if (line.startsWith("diff --git")) {
+      if (current) files.push(current);
+      const match = /^diff --git a\/(.+) b\/(.+)$/.exec(line);
+      if (match) {
+        oldPath = match[1];
+        newPath = match[2];
+      } else {
+        oldPath = "";
+        newPath = "";
+      }
+      current = {
+        path: newPath || oldPath,
+        additions: 0,
+        deletions: 0,
+        status: oldPath === newPath ? "modified" : "renamed"
+      };
+      continue;
+    }
+    if (!current) continue;
+    if (line.startsWith("--- /dev/null")) {
+      current.status = "added";
+    } else if (line.startsWith("+++ /dev/null")) {
+      current.status = "deleted";
+    } else if (line.startsWith("+") && !line.startsWith("+++")) {
+      current.additions++;
+    } else if (line.startsWith("-") && !line.startsWith("---")) {
+      current.deletions++;
+    }
+  }
+  if (current) files.push(current);
+  return files;
+};
+
+// src/adapters/index.ts
+var buildDefaultAdapter = () => {
+  const forced = (process.env.LOCAL_AGENT_ADAPTER ?? "").trim().toLowerCase();
+  if (forced === "mock") {
+    return new MockOpenCodeAdapter({ tokenDelayMs: 40 });
+  }
+  return new OpenCodeProcessAdapter();
+};
+
+// src/server.ts
+var createApp = (options) => {
+  const state = options.state ?? createState();
+  const adapter = options.adapter ?? buildDefaultAdapter();
+  const brokerRegistry = createBrokerRegistry();
+  const app = express();
+  app.use(express.json({ limit: "1mb" }));
+  app.use(createCorsMiddleware({ allowedOrigin: options.config.allowedOrigin }));
+  app.use(createAuthMiddleware({ token: options.config.token }));
+  app.get("/health", createHealthHandler(options.config));
+  app.use("/repo", createRepoRouter(state));
+  app.use("/agent", createAgentRouter({ state, adapter, brokerRegistry }));
+  app.use("/agent/llm-response", createLlmResponseRouter({ brokerRegistry }));
+  app.use("/agent/llm-chunk", createLlmChunkRouter({ brokerRegistry }));
+  app.use("/llm-shim", createLlmShimRouter());
+  app.use((req, res) => {
+    res.status(404).json({ error: "not_found", method: req.method, path: req.path });
+  });
+  return { app, state, adapter, brokerRegistry };
+};
+
+// src/modes/quickstart.ts
+var checkInQuickstart = async (cloudUrl, setupToken, helperVersion, port) => {
+  const res = await fetch(`${cloudUrl}/api/coding/quickstart/checked-in`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      setupToken,
+      helperVersion,
+      port
+    })
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(
+      `Cloud quickstart/checked-in returned ${res.status}: ${text || "no body"}`
+    );
+  }
+};
+var tryOpenBrowser = async (url) => {
+  try {
+    const open = (await import("open")).default;
+    await open(url);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var runQuickstart = async (options) => {
+  const cloudUrl = options.cloudUrl.replace(/\/$/, "");
+  if (!options.setupToken) {
+    const browserUrl = `${cloudUrl}/coding-agent/quickstart`;
+    console.log("[quickstart] No --token supplied.");
+    console.log(`[quickstart] Open the quickstart page first:`);
+    console.log(`[quickstart]   ${browserUrl}`);
+    console.log("");
+    console.log(
+      "[quickstart] It'll give you the exact `npx` command to paste here."
+    );
+    if (options.autoOpenBrowser) {
+      await tryOpenBrowser(browserUrl);
+    }
+    return;
+  }
+  console.log(`[quickstart] Cloud: ${cloudUrl}`);
+  console.log(`[quickstart] Setup token: ${options.setupToken.slice(0, 12)}\u2026`);
+  process.env.LOCAL_AGENT_TOKEN = options.setupToken;
+  process.env.LOCAL_AGENT_ALLOWED_ORIGIN = cloudUrl;
+  process.env.LOCAL_AGENT_PORT = String(options.port);
+  const config = loadConfig();
+  const { app, adapter } = createApp({ config });
+  const server = app.listen(config.port, config.host, async () => {
+    const url = `http://${config.host}:${config.port}`;
+    console.log(`[quickstart] Helper listening on ${url}`);
+    console.log(`[quickstart] Adapter: ${adapter.name}`);
+    console.log("[quickstart] Telling the cloud the helper is ready\u2026");
+    try {
+      await checkInQuickstart(
+        cloudUrl,
+        options.setupToken,
+        options.helperVersion,
+        config.port
+      );
+      console.log(
+        "[quickstart] \u2714 Ready. The browser tab should redirect you to /coding-agent in a moment."
+      );
+    } catch (err) {
+      console.error(
+        `[quickstart] Couldn't notify the cloud \u2014 the browser will keep polling but won't auto-connect.`
+      );
+      console.error(`[quickstart] Underlying error: ${err.message}`);
+      console.error("");
+      console.error(
+        `[quickstart] Workaround: in the browser, paste these into the connection panel:`
+      );
+      console.error(`[quickstart]   Helper URL:     ${url}`);
+      console.error(`[quickstart]   Pairing token:  ${options.setupToken}`);
+    }
+    console.log("");
+    console.log("[quickstart] Press Ctrl+C to stop the helper.");
+  });
+  const shutdown = (signal) => {
+    console.log(`
+[quickstart] Received ${signal}, shutting down\u2026`);
+    server.close(() => process.exit(0));
+    setTimeout(() => process.exit(0), 3e3).unref();
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+};
+
+// src/lib/keychain.ts
+import { promises as fs } from "node:fs";
+import path5 from "node:path";
+import os from "node:os";
+var KEYTAR_SERVICE = "diologue.local-agent";
+var KEYTAR_ACCOUNT = "device-credential";
+var keytarPromise = null;
+var loadKeytar = async () => {
+  if (keytarPromise) return keytarPromise;
+  keytarPromise = (async () => {
+    try {
+      const moduleName = "keytar";
+      const mod = await import(
+        /* @vite-ignore */
+        moduleName
+      );
+      return mod.default ?? mod;
+    } catch {
+      return null;
+    }
+  })();
+  return keytarPromise;
+};
+var fileFallbackPath = () => {
+  const home = os.homedir();
+  return path5.join(home, ".diologue", "credentials");
+};
+var createCredentialStore = (options = {}) => {
+  const filePath = options.filePathOverride ?? fileFallbackPath();
+  const forceBackend = options.forceBackend;
+  const resolveBackend = async () => {
+    if (forceBackend) return forceBackend;
+    const keytar = await loadKeytar();
+    return keytar ? "keychain" : "file";
+  };
+  return {
+    async load() {
+      const backend = await resolveBackend();
+      if (backend === "keychain") {
+        const keytar = await loadKeytar();
+        if (!keytar) return null;
+        const raw = await keytar.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
+        if (!raw) return null;
+        try {
+          const credential = JSON.parse(raw);
+          return { credential, backend: "keychain" };
+        } catch {
+          return null;
+        }
+      }
+      try {
+        const raw = await fs.readFile(filePath, "utf8");
+        const credential = JSON.parse(raw);
+        return { credential, backend: "file" };
+      } catch {
+        return null;
+      }
+    },
+    async save(credential) {
+      const backend = await resolveBackend();
+      if (backend === "keychain") {
+        const keytar = await loadKeytar();
+        if (!keytar) {
+        } else {
+          await keytar.setPassword(
+            KEYTAR_SERVICE,
+            KEYTAR_ACCOUNT,
+            JSON.stringify(credential)
+          );
+          return { backend: "keychain" };
+        }
+      }
+      await fs.mkdir(path5.dirname(filePath), { recursive: true });
+      await fs.writeFile(filePath, JSON.stringify(credential, null, 2), {
+        mode: 384
+      });
+      return { backend: "file" };
+    },
+    async clear() {
+      const backend = await resolveBackend();
+      if (backend === "keychain") {
+        const keytar = await loadKeytar();
+        if (keytar) {
+          await keytar.deletePassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT).catch(() => void 0);
+        }
+      }
+      await fs.rm(filePath, { force: true }).catch(() => void 0);
+    }
+  };
+};
+
+// src/modes/start.ts
+var printTunnelStatus = async () => {
+  const store = createCredentialStore();
+  const loaded = await store.load().catch(() => null);
+  if (!loaded) {
+    console.log("[local-agent] Tunnel: not paired.");
+    console.log(
+      "[local-agent]   Run `diologue-local-agent pair <code>` to enable remote-machine use."
+    );
+    return;
+  }
+  const expires = new Date(loaded.credential.expiresAt);
+  const daysLeft = Math.max(
+    0,
+    Math.round((expires.getTime() - Date.now()) / 864e5)
+  );
+  console.log(
+    `[local-agent] Tunnel: paired as "${loaded.credential.label}" (${loaded.credential.deviceId})`
+  );
+  console.log(
+    `[local-agent]   Cloud: ${loaded.credential.cloudUrl}   Expires in ${daysLeft}d   Storage: ${loaded.backend}`
+  );
+};
+var runStart = async (options) => {
+  if (options.port) process.env.LOCAL_AGENT_PORT = String(options.port);
+  if (options.token) process.env.LOCAL_AGENT_TOKEN = options.token;
+  if (options.allowedOrigin)
+    process.env.LOCAL_AGENT_ALLOWED_ORIGIN = options.allowedOrigin;
+  if (options.adapter) process.env.LOCAL_AGENT_ADAPTER = options.adapter;
+  const config = loadConfig();
+  const { app, adapter } = createApp({ config });
+  const server = app.listen(config.port, config.host, async () => {
+    const url = `http://${config.host}:${config.port}`;
+    console.log(`[local-agent] Listening on ${url}`);
+    console.log(`[local-agent] Adapter: ${adapter.name}`);
+    console.log("[local-agent] Pairing token (paste into the web UI):");
+    console.log(`[local-agent]   ${config.token}`);
+    console.log(`[local-agent] Allowed browser origin: ${config.allowedOrigin}`);
+    await printTunnelStatus();
+    console.log(
+      "[local-agent] Press Ctrl+C to stop. The token is regenerated on each restart."
+    );
+  });
+  const shutdown = (signal) => {
+    console.log(`
+[local-agent] Received ${signal}, shutting down...`);
+    server.close(() => process.exit(0));
+    setTimeout(() => process.exit(0), 3e3).unref();
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+};
+
+// src/modes/pair.ts
+import os2 from "node:os";
+var detectOs = () => {
+  const p = process.platform;
+  if (p === "darwin" || p === "linux" || p === "win32") return p;
+  return void 0;
+};
+var detectLabel = () => {
+  const hostname = os2.hostname() || "unknown-host";
+  return hostname.replace(/\.local$/i, "");
+};
+var runPair = async (options) => {
+  const cloudUrl = options.cloudUrl.replace(/\/$/, "");
+  const label = process.env.DIOLOGUE_DEVICE_LABEL?.trim() || detectLabel();
+  const osId = detectOs();
+  console.log(`[pair] Cloud:   ${cloudUrl}`);
+  console.log(`[pair] Label:   ${label}`);
+  console.log(`[pair] OS:      ${osId ?? "(unknown)"}`);
+  console.log(`[pair] Code:    ${options.code}`);
+  console.log("[pair] Exchanging code for a device credential\u2026");
+  let response;
+  try {
+    response = await fetch(`${cloudUrl}/api/devices/pair-complete`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        code: options.code,
+        label,
+        ...osId ? { os: osId } : {},
+        helperVersion: options.helperVersion
+      })
+    });
+  } catch (err) {
+    console.error(
+      "[pair] Could not reach the cloud. Check --cloud / DIOLOGUE_CLOUD_URL and your network."
+    );
+    console.error(`[pair] Underlying error: ${err.message}`);
+    process.exit(1);
+  }
+  if (response.status === 404) {
+    console.error(
+      "[pair] Code not found. Generate a fresh one from Settings \u2192 Devices."
+    );
+    process.exit(1);
+  }
+  if (response.status === 410) {
+    console.error("[pair] Code already used or expired. Generate a fresh one.");
+    process.exit(1);
+  }
+  if (!response.ok) {
+    const text = await response.text().catch(() => "");
+    console.error(`[pair] Cloud returned ${response.status}: ${text}`);
+    process.exit(1);
+  }
+  const data = await response.json();
+  if (!data.jwt || !data.device?.id) {
+    console.error("[pair] Cloud response missing fields:", data);
+    process.exit(1);
+  }
+  const store = createCredentialStore();
+  const { backend } = await store.save({
+    jwt: data.jwt,
+    deviceId: data.device.id,
+    expiresAt: data.expiresAt,
+    pairedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    label: data.device.label,
+    cloudUrl
+  });
+  console.log("");
+  console.log(`[pair] \u2714 Paired as "${data.device.label}" (${data.device.id})`);
+  console.log(`[pair]   Credential expires: ${data.expiresAt}`);
+  console.log(
+    `[pair]   Stored in: ${backend === "keychain" ? "OS keychain" : "~/.diologue/credentials (file, 0600)"}`
+  );
+  if (backend === "file") {
+    console.log(
+      "[pair]   Note: keytar (OS keychain) couldn't load; using file fallback."
+    );
+  }
+  console.log("");
+  console.log("[pair] The helper will pick this credential up on next start.");
+  console.log("[pair] Start it with: diologue-local-agent");
+};
+
+// src/cli.ts
+var HELPER_VERSION = "0.1.0";
+var DEFAULT_CLOUD_URL = "http://localhost:5000";
+var parseArgs = (argv) => {
+  const flags = /* @__PURE__ */ new Map();
+  const positional = [];
+  let subcommand = null;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") {
+      return { subcommand: "help", flags, positional };
+    }
+    if (arg === "--version" || arg === "-v") {
+      return { subcommand: "version", flags, positional };
+    }
+    if (arg.startsWith("--")) {
+      const eq = arg.indexOf("=");
+      if (eq !== -1) {
+        flags.set(arg.slice(2, eq), arg.slice(eq + 1));
+      } else {
+        const next = argv[i + 1];
+        if (next && !next.startsWith("--")) {
+          flags.set(arg.slice(2), next);
+          i++;
+        } else {
+          flags.set(arg.slice(2), true);
+        }
+      }
+      continue;
+    }
+    if (subcommand === null && ["quickstart", "start", "pair"].includes(arg)) {
+      subcommand = arg;
+      continue;
+    }
+    positional.push(arg);
+  }
+  return {
+    subcommand: subcommand ?? "quickstart",
+    flags,
+    positional
+  };
+};
+var printHelp = () => {
+  console.log(`
+Diologue Local Agent v${HELPER_VERSION}
+
+USAGE
+  diologue-local-agent [<command>] [options]
+
+COMMANDS
+  quickstart  (default)  Start the helper + open the browser to pair
+  start                  Start the helper in raw token mode (no browser)
+  pair <code>            Pair this machine with a previously-issued code
+  --help                 Show this message
+  --version              Show version
+
+QUICKSTART OPTIONS
+  --cloud=<url>          Cloud URL to pair with
+                         (default: \${DIOLOGUE_CLOUD_URL:-${DEFAULT_CLOUD_URL}})
+  --no-open              Don't auto-open the browser; print the URL instead
+  --port=<n>             TCP port for the helper (default: 4099)
+
+START OPTIONS
+  --token=<token>        Use this pairing token instead of a random one
+  --origin=<url>         Allowed browser origin for CORS
+  --port=<n>             TCP port (default: 4099)
+  --adapter=<mock|opencode>  Engine adapter (default: opencode)
+
+EXAMPLES
+  # New user \u2014 go from zero to chatting in 30s
+  npx @diologue/local-agent --cloud=https://app.your-domain.com
+
+  # Power user \u2014 manual flags
+  diologue-local-agent start --port=5099 --origin=https://your.app
+
+  # Pair a device (for the future tunnel transport)
+  diologue-local-agent pair K9F-27R --cloud=https://app.your-domain.com
+
+ENVIRONMENT
+  DIOLOGUE_CLOUD_URL              Default cloud URL (overridden by --cloud)
+  LOCAL_AGENT_ALLOWED_ORIGIN      Default CORS origin
+  LOCAL_AGENT_ADAPTER             "mock" forces the canned-response adapter
+  LOCAL_AGENT_TOKEN               Pin a specific pairing token (testing)
+  LOCAL_AGENT_PORT                Default TCP port
+
+For docs + the source, visit:
+  https://github.com/Deplova-Ltd/AI-Personas-and-Multi-LLM
+`.trim());
+};
+var main = async () => {
+  const argv = process2.argv.slice(2);
+  const parsed = parseArgs(argv);
+  switch (parsed.subcommand) {
+    case "help":
+      printHelp();
+      return;
+    case "version":
+      console.log(`diologue-local-agent v${HELPER_VERSION}`);
+      return;
+    case "quickstart":
+      await runQuickstart({
+        cloudUrl: parsed.flags.get("cloud") ?? process2.env.DIOLOGUE_CLOUD_URL ?? DEFAULT_CLOUD_URL,
+        port: parseFlagInt(parsed.flags.get("port"), 4099),
+        autoOpenBrowser: parsed.flags.get("no-open") !== true,
+        helperVersion: HELPER_VERSION,
+        setupToken: parsed.flags.get("token")
+      });
+      return;
+    case "start":
+      await runStart({
+        port: parseFlagInt(parsed.flags.get("port"), 4099),
+        token: parsed.flags.get("token"),
+        allowedOrigin: parsed.flags.get("origin"),
+        adapter: parsed.flags.get("adapter")
+      });
+      return;
+    case "pair": {
+      const code = parsed.positional[0];
+      if (!code) {
+        console.error("Usage: diologue-local-agent pair <code>");
+        process2.exit(2);
+      }
+      await runPair({
+        code,
+        cloudUrl: parsed.flags.get("cloud") ?? process2.env.DIOLOGUE_CLOUD_URL ?? DEFAULT_CLOUD_URL,
+        helperVersion: HELPER_VERSION
+      });
+      return;
+    }
+  }
+};
+var parseFlagInt = (raw, fallback) => {
+  if (typeof raw !== "string") return fallback;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) && n > 0 ? n : fallback;
+};
+main().catch((err) => {
+  console.error("[cli] Fatal error:", err);
+  process2.exit(1);
+});
+//# sourceMappingURL=cli.mjs.map