@getpaseo/server 0.1.101 → 0.1.102

package/dist/server/server/agent/providers/opencode-agent.js

@@ -1,4 +1,5 @@
 import { createOpencodeClient, } from "@opencode-ai/sdk/v2/client";
+import fs from "node:fs/promises";
 import { createPathEquivalenceMatcher } from "../../../utils/path.js";
 import pLimit from "p-limit";
 import { z } from "zod";
@@ -11,6 +12,7 @@ import { execCommand } from "../../../utils/spawn.js";
 import { buildToolCallDisplayModel } from "@getpaseo/protocol/tool-call-display";
 import { mapOpencodeToolCall } from "./opencode/tool-call-mapper.js";
 import { OpenCodeServerManager, } from "./opencode/server-manager.js";
+import { resolveOpenCodeHomeDir } from "./opencode/paths.js";
 import { formatProviderDiagnostic, formatProviderDiagnosticError, buildBinaryDiagnosticRows, buildCommandResolutionDiagnosticRows, toDiagnosticErrorMessage, } from "./diagnostic-utils.js";
 import { runProviderTurn } from "./provider-runner.js";
 import { renderPromptAttachmentAsText } from "../prompt-attachments.js";
@@ -847,6 +849,7 @@ export const __openCodeInternals = {
     resolveOpenCodeSelectedModelContextWindow,
     isSelectableOpenCodeAgent,
     mapOpenCodeAgentToMode,
+    resolveOpenCodeHomeDir,
     get OpenCodeAgentSession() {
         return OpenCodeAgentSession;
     },
@@ -867,8 +870,10 @@ export class OpenCodeAgentClient {
             deps.serverManager ??
                 OpenCodeServerManager.getInstance(this.logger, runtimeSettings, {
                     managedProcesses: deps.managedProcesses,
+                    resolveHomeDir: deps.resolveHomeDir,
                 });
         this.createOpenCodeClient = deps.createClient ?? createSdkOpenCodeClient;
+        this.resolveHomeDir = deps.resolveHomeDir ?? resolveOpenCodeHomeDir;
     }
     async createSession(config, launchContext, options) {
         const openCodeConfig = this.assertConfig(config);
@@ -930,9 +935,16 @@ export class OpenCodeAgentClient {
             ? await this.serverManager.acquireNew()
             : await this.serverManager.acquireCurrent();
         const { url } = acquisition.server;
-        const directory = options.cwd;
-        const client = this.createOpenCodeClient({ baseUrl: url, directory });
+        const isGlobalCatalog = options.scope === "global";
         try {
+            // OpenCode treats the catalog directory as a workspace. The global catalog
+            // is not a project, so use the neutral OpenCode home instead of user home.
+            const directory = isGlobalCatalog ? this.resolveHomeDir() : options.cwd;
+            if (isGlobalCatalog) {
+                await fs.mkdir(directory, { recursive: true });
+                this.logger.debug({ directory }, "opencode catalog refresh: using opencode-home for global provider catalog");
+            }
+            const client = this.createOpenCodeClient({ baseUrl: url, directory });
             const [models, modes] = await Promise.all([
                 this.fetchModelsFromClient(client, directory),
                 this.fetchModesFromClient(client, directory),

package/dist/server/server/agent/providers/pi/agent.d.ts

@@ -6,6 +6,7 @@ import type { PiRuntime, PiRuntimeSession } from "./runtime.js";
 import type { PiCommandsRpcType, PiSessionState } from "./rpc-types.js";
 export declare const PiProviderParamsSchema: z.ZodObject<{
     sessionDir: z.ZodOptional<z.ZodString>;
+    extensionTimeoutMs: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strict>;
 interface PiRpcAgentClientOptions {
     logger: Logger;
@@ -23,6 +24,7 @@ interface PiRpcAgentSessionOptions {
     initialState: PiSessionState;
     capabilities: AgentCapabilityFlags;
     cleanup?: () => void;
+    extensionTimeoutMs?: number;
 }
 export declare function transformPiModels(models: AgentModelDefinition[]): AgentModelDefinition[];
 export declare class PiRpcAgentSession implements AgentSession {
@@ -50,6 +52,7 @@ export declare class PiRpcAgentSession implements AgentSession {
     private readonly runtimeSession;
     private readonly config;
     private readonly cleanup?;
+    private readonly extensionTimeoutMs;
     get id(): string | null;
     run(prompt: AgentPromptInput, options?: AgentRunOptions): Promise<AgentRunResult>;
     startTurn(prompt: AgentPromptInput, _options?: AgentRunOptions): Promise<StartTurnResult>;

package/dist/server/server/agent/providers/pi/agent.js

@@ -22,7 +22,7 @@ const PASEO_PI_TREE_EXTENSION_COMMAND = "paseo_tree";
 const PASEO_PI_CAPTURE_EXTENSION_COMMAND = "paseo_capture_entries";
 const PASEO_PI_ENTRY_CAPTURE_MARKER = "PASEO_ENTRY_CAPTURE";
 const PASEO_PI_COMMAND_RESULT_MARKER = "PASEO_COMMAND_RESULT";
-const PASEO_PI_EXTENSION_RESULT_TIMEOUT_MS = 10000;
+const DEFAULT_PI_EXTENSION_RESULT_TIMEOUT_MS = 30000;
 const QUESTION_RESPONSE_HEADER = "Response";
 const QUESTION_COMMENT_HEADER = "Comment";
 const PI_ASK_USER_FREEFORM_SENTINEL = "✏️ Type custom response...";
@@ -30,6 +30,7 @@ const COMBINED_ASK_USER_METADATA = "ask_user_select_optional_comment";
 export const PiProviderParamsSchema = z
     .object({
     sessionDir: z.string().min(1).optional(),
+    extensionTimeoutMs: z.number().int().positive().default(DEFAULT_PI_EXTENSION_RESULT_TIMEOUT_MS),
 })
     .strict();
 const PI_HANDLED_BUILTIN_SLASH_COMMANDS = [
@@ -715,6 +716,7 @@ export class PiRpcAgentSession {
             normalizePiThinkingOption(options.config.thinkingOptionId) ??
                 this.state.thinkingLevel ??
                 null;
+        this.extensionTimeoutMs = options.extensionTimeoutMs ?? DEFAULT_PI_EXTENSION_RESULT_TIMEOUT_MS;
         this.runtimeSession.onEvent((event) => {
             this.handleRuntimeEvent(event);
         });
@@ -1065,7 +1067,7 @@ export class PiRpcAgentSession {
             const timer = setTimeout(() => {
                 this.pendingExtensionResults.delete(requestId);
                 reject(new Error(`Pi extension result timed out for request ${requestId}`));
-            }, PASEO_PI_EXTENSION_RESULT_TIMEOUT_MS);
+            }, this.extensionTimeoutMs);
             this.pendingExtensionResults.set(requestId, { resolve, reject, timer });
         });
     }
@@ -1489,6 +1491,7 @@ export class PiRpcAgentClient {
                 initialState: await runtimeSession.getState(),
                 capabilities: withPiMcpCapability(mcpConfig !== null),
                 cleanup: combineCleanup([mcpConfig?.cleanup, paseoExtension.cleanup]),
+                extensionTimeoutMs: this.providerParams.extensionTimeoutMs,
             });
         }
         catch (error) {
@@ -1531,6 +1534,7 @@ export class PiRpcAgentClient {
                 initialState: await runtimeSession.getState(),
                 capabilities: withPiMcpCapability(mcpConfig !== null),
                 cleanup: combineCleanup([mcpConfig?.cleanup, paseoExtension.cleanup]),
+                extensionTimeoutMs: this.providerParams.extensionTimeoutMs,
             });
         }
         catch (error) {
@@ -1541,7 +1545,9 @@ export class PiRpcAgentClient {
         }
     }
     async fetchCatalog(options) {
-        const runtimeSession = await this.runtime.startSession({ cwd: options.cwd });
+        const runtimeSession = await this.runtime.startSession({
+            cwd: options.scope === "global" ? homedir() : options.cwd,
+        });
         try {
             const models = transformPiModels((await runtimeSession.getAvailableModels(PI_CATALOG_REQUEST_TIMEOUT_MS)).map(mapPiModel));
             return { models, modes: [] };

package/dist/server/server/agent/providers/provider-image-output.js

@@ -44,11 +44,10 @@ export function materializeProviderImage(image) {
     fsSync.writeFileSync(filePath, bytes);
     return { path: filePath };
 }
-// Recognizes the markdown renderProviderImageOutputAsAssistantMarkdown emits for a materialized
-// provider image: its source is a content-hashed file in the attachments dir. Matching the full
-// <hash>.<ext> shape (not just a leading "![") keeps user-authored text from being mistaken for a
-// provider image when it reaches the history-replay filter. The separator class allows one-or-more
-// because on Windows the path uses "\\" and escapeMarkdownImageSource doubles each backslash.
+// Recognizes markdown rendered for a materialized provider image: its source is a content-hashed
+// file in the attachments dir. Matching the full <hash>.<ext> shape (not just a leading "![")
+// keeps user-authored text from being mistaken for a provider image during history replay. The
+// separator still accepts old doubled-backslash Windows history; new Windows output uses file URIs.
 const PROVIDER_IMAGE_MARKDOWN = new RegExp(`^!\\[[^\\]]*\\]\\([^)]*${PROVIDER_IMAGE_ATTACHMENT_DIR}[/\\\\]+[0-9a-f]{64}\\.[a-z0-9]+\\)`);
 export function isProviderImageMarkdown(text) {
     return PROVIDER_IMAGE_MARKDOWN.test(text);
@@ -63,8 +62,14 @@ function isDataImageSource(source) {
 function escapeMarkdownImageAlt(value) {
     return value.replace(/\\/g, "\\\\").replace(/\]/g, "\\]");
 }
+function markdownImageSource(value) {
+    if (/^[A-Za-z]:[\\/]/.test(value)) {
+        return `file:///${value.replace(/\\/g, "/")}`;
+    }
+    return value;
+}
 function escapeMarkdownImageSource(value) {
-    return value.replace(/\\/g, "\\\\").replace(/\)/g, "\\)");
+    return markdownImageSource(value).replace(/\\/g, "\\\\").replace(/\)/g, "\\)");
 }
 export function renderProviderImageOutputAsAssistantMarkdown(image, options = {}) {
     const source = nonEmptyString(image.path) ?? nonEmptyString(image.url);

package/dist/server/server/agent/tools/paseo-tools.d.ts

@@ -6,7 +6,7 @@ import type { VoiceCallerContext, VoiceSpeakHandler } from "../../voice-types.js
 import type { TerminalManager } from "../../../terminal/terminal-manager.js";
 import type { CreatePaseoWorktreeWorkflowFn } from "../../worktree-session.js";
 import type { ScheduleService } from "../../schedule/service.js";
-import { type ProviderSnapshotManager } from "../provider-snapshot-manager.js";
+import type { ProviderSnapshotManager } from "../provider-snapshot-manager.js";
 import type { GitHubService } from "../../../services/github-service.js";
 import type { WorkspaceGitService } from "../../workspace-git-service.js";
 import type { PaseoToolCatalog } from "./types.js";

package/dist/server/server/agent/tools/paseo-tools.js

@@ -11,7 +11,6 @@ import { WaitForAgentTracker } from "../wait-for-agent-tracker.js";
 import { createAgentCommand } from "../create-agent/create.js";
 import { expandUserPath, isSameOrDescendantPath, resolvePathFromBase } from "../../path-utils.js";
 import { ScheduleRunSchema, ScheduleSummarySchema, StoredScheduleSchema, } from "@getpaseo/protocol/schedule/types";
-import { resolveSnapshotCwd } from "../provider-snapshot-manager.js";
 import { AgentModelSchema, AgentProviderEnum, AgentStatusEnum, ProviderModeSchema, ProviderSummarySchema, parseDurationString, resolveRequiredProviderModel, sanitizePermissionRequest, serializeSnapshotWithMetadata, toScheduleSummary, waitForAgentWithTimeout, } from "../mcp-shared.js";
 import { sendPromptToAgent, setupFinishNotification } from "../agent-prompt.js";
 import { respondToAgentPermission } from "../permission-response.js";
@@ -1760,7 +1759,6 @@ export function createPaseoToolCatalog(options) {
         },
     }, async ({ provider }) => {
         const models = await providerSnapshotManager.listModels({
-            cwd: resolveSnapshotCwd(),
             provider,
             wait: true,
         });

package/dist/server/server/bootstrap.d.ts

@@ -44,11 +44,12 @@ export type DaemonLifecycleIntent = {
     type: "shutdown";
     clientId: string;
     requestId: string;
+    reason: string;
 } | {
     type: "restart";
     clientId: string;
     requestId: string;
-    reason?: string;
+    reason: string;
 };
 export interface PaseoDaemonConfig {
     listen: string;
@@ -57,6 +58,7 @@ export interface PaseoDaemonConfig {
     corsAllowedOrigins: string[];
     allowedHosts?: HostnamesConfig;
     hostnames?: HostnamesConfig;
+    trustedProxies?: true | string[];
     mcpEnabled?: boolean;
     mcpInjectIntoAgents?: boolean;
     autoArchiveAfterMerge?: boolean;
@@ -77,6 +79,10 @@ export interface PaseoDaemonConfig {
         publicBaseUrl: string | null;
         standaloneListen: string | null;
     };
+    webUi?: {
+        enabled: boolean;
+        distDir: string | null;
+    };
     appBaseUrl?: string;
     auth?: DaemonAuthConfig;
     openai?: PaseoOpenAIConfig;

package/dist/server/server/bootstrap.js

@@ -113,6 +113,7 @@ import { createManagedProcessRegistry, createSystemManagedProcessTable, } from "
 import { terminateWithTreeKill } from "../utils/tree-kill.js";
 import { isHostnameAllowed } from "./hostnames.js";
 import { createRequireBearerMiddleware, isAgentMcpRequestAuthorized, } from "./auth.js";
+import { createWebUiMiddleware } from "./web-ui.js";
 const MAX_MCP_DEBUG_BATCH_ITEMS = 10;
 const REDACTED_LOG_VALUE = "[redacted]";
 const DOWNLOAD_OPEN_FLAGS = process.platform === "win32" ? constants.O_RDONLY : constants.O_RDONLY | constants.O_NOFOLLOW;
@@ -230,6 +231,17 @@ async function reconcileManagedProcessLedger(managedProcesses, logger) {
         logger.info(reapResult, "Managed helper process ledger reconciled");
     }
 }
+function mountWebUi(app, config, logger) {
+    app.use(createWebUiMiddleware({
+        enabled: config.webUi?.enabled ?? false,
+        distDir: config.webUi?.distDir ?? null,
+        label: getHostname(),
+        logger,
+    }));
+}
+function resolveExpressTrustProxySetting(config) {
+    return config.trustedProxies ?? ["loopback"];
+}
 export async function createPaseoDaemon(config, rootLogger) {
     const logger = rootLogger.child({ module: "bootstrap" });
     const bootstrapStart = performance.now();
@@ -279,6 +291,7 @@ export async function createPaseoDaemon(config, rootLogger) {
     const agentMcpAuthToken = randomUUID();
     const listenTarget = parseListenString(config.listen);
     const app = express();
+    app.set("trust proxy", resolveExpressTrustProxySetting(config));
     let boundListenTarget = null;
     let workspaceRegistry = null;
     const terminalManager = createConfiguredTerminalManager({
@@ -363,6 +376,11 @@ export async function createPaseoDaemon(config, rootLogger) {
     });
     // Local, harmless, and token-gated; deliberately skips daemon auth.
     app.post("/api/terminal-activity", express.json(), createTerminalActivityRouteHandler(terminalManager));
+    // Serve the bundled browser web UI when enabled. Mounted after service-proxy
+    // classification and host/CORS handling, but before daemon bearer auth, so
+    // static app files load without the daemon password while API/WebSocket calls
+    // remain protected.
+    mountWebUi(app, config, logger);
     app.use(createRequireBearerMiddleware(config.auth, (context) => {
         logger.warn(context, "Rejected HTTP request with invalid daemon password");
     }));

package/dist/server/server/config.d.ts

@@ -1,11 +1,13 @@
 import type { PaseoDaemonConfig } from "./bootstrap.js";
 import { type HostnamesConfig } from "./hostnames.js";
+export declare function resolveBundledWebUiDistDir(moduleUrl?: string | URL): string;
 export type CliConfigOverrides = Partial<{
     listen: string;
     relayEnabled: boolean;
     relayUseTls: boolean;
     mcpEnabled: boolean;
     mcpInjectIntoAgents: boolean;
+    webUiEnabled: boolean;
     hostnames: HostnamesConfig;
 }>;
 export declare function loadConfig(paseoHome: string, options?: {

package/dist/server/server/config.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { resolvePaseoNodeEnv } from "./paseo-env.js";
 import { z } from "zod";
 import { expandTilde } from "../utils/path.js";
@@ -11,6 +12,20 @@ import { mergeHostnames, parseHostnamesEnv } from "./hostnames.js";
 const DEFAULT_PORT = 6767;
 const DEFAULT_RELAY_ENDPOINT = "relay.paseo.sh:443";
 const DEFAULT_APP_BASE_URL = "https://app.paseo.sh";
+const DEFAULT_TRUSTED_PROXIES = ["loopback"];
+export function resolveBundledWebUiDistDir(moduleUrl = import.meta.url) {
+    const moduleDir = path.dirname(fileURLToPath(moduleUrl));
+    if (path.basename(moduleDir) === "server" && path.basename(path.dirname(moduleDir)) === "src") {
+        return path.resolve(moduleDir, "..", "..", "dist", "server", "web-ui");
+    }
+    if (path.basename(moduleDir) === "server" &&
+        path.basename(path.dirname(moduleDir)) === "server" &&
+        path.basename(path.dirname(path.dirname(moduleDir))) === "dist") {
+        return path.resolve(moduleDir, "..", "web-ui");
+    }
+    return path.resolve(moduleDir, "web-ui");
+}
+const BUNDLED_WEB_UI_DIST_DIR = resolveBundledWebUiDistDir();
 function parseBooleanEnv(value) {
     if (value === undefined) {
         return undefined;
@@ -137,6 +152,21 @@ function resolveServiceProxyConfig(env, persisted) {
         : null;
     return { publicBaseUrl, standaloneListen };
 }
+function resolveWebUiConfig(paseoHome, env, cli, persisted) {
+    const enabled = cli?.webUiEnabled ??
+        parseBooleanEnv(env.PASEO_WEB_UI_ENABLED) ??
+        persisted.features?.webUi?.enabled ??
+        false;
+    const rawDistDir = env.PASEO_WEB_UI_DIST_DIR ?? persisted.features?.webUi?.distDir;
+    const trimmedDistDir = rawDistDir?.trim();
+    const distDir = trimmedDistDir
+        ? path.resolve(path.isAbsolute(trimmedDistDir) ? trimmedDistDir : paseoHome, trimmedDistDir)
+        : BUNDLED_WEB_UI_DIST_DIR;
+    return {
+        enabled,
+        distDir,
+    };
+}
 function resolveVoiceLlmConfig(env, persisted) {
     const envVoiceLlmProvider = parseOptionalVoiceLlmProvider(env.PASEO_VOICE_LLM_PROVIDER);
     const persistedVoiceLlmProvider = parseOptionalVoiceLlmProvider(persisted.features?.voiceMode?.llm?.provider);
@@ -153,6 +183,28 @@ function resolveCorsAllowedOrigins(env, persisted) {
     const persistedCorsOrigins = persisted.daemon?.cors?.allowedOrigins ?? [];
     return Array.from(new Set([...persistedCorsOrigins, ...envCorsOrigins].filter((s) => s.length > 0)));
 }
+function parseTrustedProxiesEnv(value) {
+    const trimmed = value?.trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    const normalized = trimmed.toLowerCase();
+    if (["1", "true", "yes", "on"].includes(normalized)) {
+        return true;
+    }
+    if (["0", "false", "no", "off"].includes(normalized)) {
+        return [];
+    }
+    return trimmed
+        .split(",")
+        .map((proxy) => proxy.trim())
+        .filter((proxy) => proxy.length > 0);
+}
+function resolveTrustedProxiesConfig(env, persisted) {
+    return (parseTrustedProxiesEnv(env.PASEO_TRUSTED_PROXIES) ??
+        persisted.daemon?.trustedProxies ??
+        DEFAULT_TRUSTED_PROXIES);
+}
 // PASEO_LISTEN can be:
 // - host:port (TCP)
 // - /path/to/socket (Unix socket)
@@ -198,6 +250,7 @@ function resolveStaticLoadConfigSettings(env, cli, persisted) {
             parseHostnamesEnv(env.PASEO_HOSTNAMES ?? env.PASEO_ALLOWED_HOSTS),
             cli?.hostnames,
         ]),
+        trustedProxies: resolveTrustedProxiesConfig(env, persisted),
         appBaseUrl: env.PASEO_APP_BASE_URL ?? persisted.app?.baseUrl ?? DEFAULT_APP_BASE_URL,
     };
 }
@@ -205,7 +258,7 @@ export function loadConfig(paseoHome, options) {
     const env = options?.env ?? process.env;
     const persisted = loadPersistedConfig(paseoHome);
     const listen = resolveListenAddress(env, options?.cli, persisted);
-    const { mcpEnabled, mcpInjectIntoAgents, autoArchiveAfterMerge, appendSystemPrompt, terminalProfiles, hostnames, appBaseUrl, } = resolveStaticLoadConfigSettings(env, options?.cli, persisted);
+    const { mcpEnabled, mcpInjectIntoAgents, autoArchiveAfterMerge, appendSystemPrompt, terminalProfiles, hostnames, trustedProxies, appBaseUrl, } = resolveStaticLoadConfigSettings(env, options?.cli, persisted);
     const relay = resolveRelayConfig({
         env,
         persisted,
@@ -213,6 +266,7 @@ export function loadConfig(paseoHome, options) {
         cliRelayUseTls: options?.cli?.relayUseTls,
     });
     const serviceProxy = resolveServiceProxyConfig(env, persisted);
+    const webUi = resolveWebUiConfig(paseoHome, env, options?.cli, persisted);
     const { openai, speech } = resolveSpeechConfig({
         paseoHome,
         env,
@@ -226,6 +280,7 @@ export function loadConfig(paseoHome, options) {
         worktreesRoot: resolveWorktreesRoot(paseoHome, persisted),
         corsAllowedOrigins: resolveCorsAllowedOrigins(env, persisted),
         hostnames,
+        trustedProxies,
         mcpEnabled,
         mcpInjectIntoAgents,
         autoArchiveAfterMerge,
@@ -243,6 +298,7 @@ export function loadConfig(paseoHome, options) {
         relayUseTls: relay.useTls,
         relayPublicUseTls: relay.publicUseTls,
         serviceProxy,
+        webUi,
         appBaseUrl,
         auth: resolveAuthConfig(env, persisted),
         openai,

package/dist/server/server/daemon-worker.js

@@ -4,6 +4,7 @@ import { createPaseoDaemon } from "./bootstrap.js";
 import { loadConfig } from "./config.js";
 import { resolvePaseoHome } from "./paseo-home.js";
 import { createRootLogger } from "./logger.js";
+import { getProcessDiagnostics } from "./process-diagnostics.js";
 process.title = "Paseo Daemon";
 function isPidAlive(pid) {
     try {
@@ -60,6 +61,12 @@ function applyCliFlagOverrides(config) {
     if (process.argv.includes("--no-inject-mcp")) {
         config.mcpInjectIntoAgents = false;
     }
+    if (process.argv.includes("--web-ui")) {
+        config.webUi = { ...(config.webUi ?? { distDir: null }), enabled: true };
+    }
+    if (process.argv.includes("--no-web-ui")) {
+        config.webUi = { ...(config.webUi ?? { distDir: null }), enabled: false };
+    }
 }
 async function main() {
     const { paseoHome, logger, config } = bootstrapFromEnvironment();
@@ -77,11 +84,12 @@ async function main() {
         });
     };
     const beginShutdown = (signal, options) => {
+        const reason = options?.reason ?? `worker_received_${signal}`;
         if (!shutdownPromise) {
-            logger.info(`${signal} received, shutting down gracefully...`);
+            logger.info({ signal, reason, ...getProcessDiagnostics() }, `${signal} received, shutting down gracefully...`);
             shutdownPromise = (async () => {
                 const forceExit = setTimeout(() => {
-                    logger.warn("Forcing shutdown - HTTP server didn't close in time");
+                    logger.warn({ signal, reason, ...getProcessDiagnostics() }, "Forcing shutdown - HTTP server didn't close in time");
                     process.exit(1);
                 }, 10000);
                 try {
@@ -103,7 +111,7 @@ async function main() {
             })();
         }
         else {
-            logger.info(`${signal} received while shutdown is already in progress`);
+            logger.info({ signal, reason, ...getProcessDiagnostics() }, `${signal} received while shutdown is already in progress`);
         }
         installExitHook();
     };
@@ -122,11 +130,11 @@ async function main() {
     };
     const handleLifecycleIntent = (intent) => {
         if (intent.type === "shutdown") {
-            logger.warn({ clientId: intent.clientId, requestId: intent.requestId }, "Shutdown requested via websocket");
-            if (sendSupervisorLifecycleMessage({ type: "paseo:shutdown" })) {
+            logger.warn({ clientId: intent.clientId, requestId: intent.requestId, reason: intent.reason }, "Shutdown requested via websocket");
+            if (sendSupervisorLifecycleMessage({ type: "paseo:shutdown", reason: intent.reason })) {
                 return;
             }
-            beginShutdown("shutdown lifecycle intent");
+            beginShutdown("shutdown lifecycle intent", { reason: intent.reason });
             return;
         }
         logger.warn({ clientId: intent.clientId, requestId: intent.requestId, reason: intent.reason }, "Restart requested via websocket");
@@ -136,7 +144,10 @@ async function main() {
         })) {
             return;
         }
-        beginShutdown("restart lifecycle intent", { successExitCode: 0 });
+        beginShutdown("restart lifecycle intent", {
+            reason: intent.reason,
+            successExitCode: 0,
+        });
     };
     const installSupervisorLivenessGuard = () => {
         if (typeof process.send !== "function") {
@@ -152,6 +163,7 @@ async function main() {
             supervisorExitRequested = true;
             writeWorkerLifecycleLog(paseoHome, "Supervisor liveness lost; worker exiting", {
                 reason,
+                ...getProcessDiagnostics(),
                 supervisorPid,
                 currentParentPid: process.ppid,
                 ipcConnected: typeof process.connected === "boolean" ? process.connected : null,

package/dist/server/server/lifecycle-reasons.d.ts

@@ -0,0 +1,4 @@
+export declare const CLIENT_SHUTDOWN_RPC_REASON = "client_shutdown_rpc";
+export declare const DEFAULT_CLIENT_RESTART_RPC_REASON = "client_restart_rpc";
+export declare function normalizeClientRestartRpcReason(reason: string | undefined): string;
+//# sourceMappingURL=lifecycle-reasons.d.ts.map

package/dist/server/server/lifecycle-reasons.js

@@ -0,0 +1,6 @@
+export const CLIENT_SHUTDOWN_RPC_REASON = "client_shutdown_rpc";
+export const DEFAULT_CLIENT_RESTART_RPC_REASON = "client_restart_rpc";
+export function normalizeClientRestartRpcReason(reason) {
+    return reason?.trim() || DEFAULT_CLIENT_RESTART_RPC_REASON;
+}
+//# sourceMappingURL=lifecycle-reasons.js.map

package/dist/server/server/persisted-config.d.ts

@@ -19,6 +19,7 @@ export declare const PersistedConfigSchema: z.ZodObject<{
         listen: z.ZodOptional<z.ZodString>;
         hostnames: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<true>, z.ZodArray<z.ZodString>]>>;
         allowedHosts: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<true>, z.ZodArray<z.ZodString>]>>;
+        trustedProxies: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<true>, z.ZodArray<z.ZodString>]>>;
         mcp: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodOptional<z.ZodBoolean>;
             injectIntoAgents: z.ZodOptional<z.ZodBoolean>;
@@ -54,6 +55,7 @@ export declare const PersistedConfigSchema: z.ZodObject<{
     }, z.core.$strict>, z.ZodTransform<{
         listen?: string | undefined;
         hostnames?: true | string[] | undefined;
+        trustedProxies?: true | string[] | undefined;
         mcp?: {
             [x: string]: unknown;
             enabled?: boolean | undefined;
@@ -92,6 +94,7 @@ export declare const PersistedConfigSchema: z.ZodObject<{
         listen?: string | undefined;
         hostnames?: true | string[] | undefined;
         allowedHosts?: true | string[] | undefined;
+        trustedProxies?: true | string[] | undefined;
         mcp?: {
             [x: string]: unknown;
             enabled?: boolean | undefined;
@@ -133,11 +136,15 @@ export declare const PersistedConfigSchema: z.ZodObject<{
     providers: z.ZodOptional<z.ZodObject<{
         openai: z.ZodOptional<z.ZodObject<{
             apiKey: z.ZodOptional<z.ZodString>;
-            voice: z.ZodOptional<z.ZodObject<{
+            baseUrl: z.ZodOptional<z.ZodString>;
+            stt: z.ZodOptional<z.ZodObject<{
+                apiKey: z.ZodOptional<z.ZodString>;
+                baseUrl: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            tts: z.ZodOptional<z.ZodObject<{
                 apiKey: z.ZodOptional<z.ZodString>;
                 baseUrl: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
-            baseUrl: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         local: z.ZodOptional<z.ZodObject<{
             modelsDir: z.ZodOptional<z.ZodString>;
@@ -241,6 +248,10 @@ export declare const PersistedConfigSchema: z.ZodObject<{
                 speed: z.ZodOptional<z.ZodNumber>;
             }, z.core.$strict>>;
         }, z.core.$strict>>;
+        webUi: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            distDir: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     log: z.ZodOptional<z.ZodObject<{
         level: z.ZodOptional<z.ZodEnum<{

package/dist/server/server/persisted-config.js

@@ -34,7 +34,7 @@ const LogConfigSchema = z
         .optional(),
 })
     .strict();
-const OpenAiVoiceProviderSchema = z
+const OpenAiSpeechEndpointSchema = z
     .object({
     apiKey: z.string().trim().min(1).optional(),
     baseUrl: z.string().trim().min(1).optional(),
@@ -43,8 +43,9 @@ const OpenAiVoiceProviderSchema = z
 const OpenAiProviderSchema = z
     .object({
     apiKey: z.string().min(1).optional(),
-    voice: OpenAiVoiceProviderSchema.optional(),
     baseUrl: z.string().trim().min(1).optional(),
+    stt: OpenAiSpeechEndpointSchema.optional(),
+    tts: OpenAiSpeechEndpointSchema.optional(),
 })
     .strict();
 const LocalSpeechProviderSchema = z
@@ -126,6 +127,12 @@ const FeatureVoiceModeSchema = z
         .optional(),
 })
     .strict();
+const FeatureWebUiSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    distDir: z.string().min(1).optional(),
+})
+    .strict();
 const StructuredGenerationProviderConfigSchema = z
     .object({
     provider: z.string().min(1),
@@ -187,6 +194,7 @@ export const PersistedConfigSchema = z
         listen: z.string().optional(),
         hostnames: z.union([z.literal(true), z.array(z.string())]).optional(),
         allowedHosts: z.union([z.literal(true), z.array(z.string())]).optional(),
+        trustedProxies: z.union([z.literal(true), z.array(z.string())]).optional(),
         mcp: z
             .object({
             enabled: z.boolean().optional(),
@@ -252,6 +260,7 @@ export const PersistedConfigSchema = z
         .object({
         dictation: FeatureDictationSchema.optional(),
         voiceMode: FeatureVoiceModeSchema.optional(),
+        webUi: FeatureWebUiSchema.optional(),
     })
         .strict()
         .optional(),
@@ -280,7 +289,11 @@ function getConfigPath(paseoHome) {
 function getLogger(logger) {
     return logger?.child({ module: "config" });
 }
-function stripDeprecatedLocalSpeechConfigFields(parsed) {
+// Removed config fields are stripped before parsing so the strict schema does not
+// reject a config written by an older release. The stripped values are discarded,
+// not migrated — there is no back-compat for the removed `providers.openai.voice`
+// block (use `providers.openai.stt` / `providers.openai.tts`).
+function stripRemovedConfigFields(parsed) {
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
         return parsed;
     }
@@ -291,15 +304,21 @@ function stripDeprecatedLocalSpeechConfigFields(parsed) {
     }
     const providersRecord = { ...providers };
     const local = providersRecord.local;
-    if (!local || typeof local !== "object" || Array.isArray(local)) {
-        root.providers = providersRecord;
-        return root;
-    }
-    const localRecord = { ...local };
-    if ("autoDownload" in localRecord) {
+    if (local && typeof local === "object" && !Array.isArray(local)) {
+        const localRecord = { ...local };
         delete localRecord.autoDownload;
+        providersRecord.local = localRecord;
+    }
+    const openai = providersRecord.openai;
+    if (openai && typeof openai === "object" && !Array.isArray(openai)) {
+        const openaiRecord = { ...openai };
+        // COMPAT(openaiVoiceConfig): added 2026-06-30, remove after 2026-12-30.
+        // Drop a `providers.openai.voice` block left by an older release so the strict
+        // schema doesn't reject it. The value is discarded, not migrated — there is no
+        // back-compat; configure `providers.openai.stt` / `providers.openai.tts` instead.
+        delete openaiRecord.voice;
+        providersRecord.openai = openaiRecord;
     }
-    providersRecord.local = localRecord;
     root.providers = providersRecord;
     return root;
 }
@@ -337,7 +356,7 @@ export function loadPersistedConfig(paseoHome, logger) {
             cause: err,
         });
     }
-    const migrated = stripDeprecatedLocalSpeechConfigFields(parsed);
+    const migrated = stripRemovedConfigFields(parsed);
     const result = PersistedConfigSchema.safeParse(migrated);
     if (!result.success) {
         const issues = result.error.issues