@getpaseo/server 0.1.91-beta.1 → 0.1.91-beta.2

package/dist/server/server/agent/agent-sdk-types.d.ts

@@ -12,6 +12,11 @@ export interface McpStdioServerConfig {
     command: string;
     args?: string[];
     env?: Record<string, string>;
+    /**
+     * When true, all tools from this server are always included in the prompt
+     * and never deferred behind tool search. Honored by the Claude provider.
+     */
+    alwaysLoad?: boolean;
 }
 /**
  * HTTP-based MCP server.
@@ -20,6 +25,11 @@ export interface McpHttpServerConfig {
     type: "http";
     url: string;
     headers?: Record<string, string>;
+    /**
+     * When true, all tools from this server are always included in the prompt
+     * and never deferred behind tool search. Honored by the Claude provider.
+     */
+    alwaysLoad?: boolean;
 }
 /**
  * SSE-based MCP server (Server-Sent Events over HTTP).
@@ -28,6 +38,11 @@ export interface McpSseServerConfig {
     type: "sse";
     url: string;
     headers?: Record<string, string>;
+    /**
+     * When true, all tools from this server are always included in the prompt
+     * and never deferred behind tool search. Honored by the Claude provider.
+     */
+    alwaysLoad?: boolean;
 }
 /**
  * Canonical MCP server configuration.

package/dist/server/server/agent/provider-registry.js

@@ -292,7 +292,7 @@ function buildResolvedBuiltinProviders(providerOverrides, runtimeSettings, optio
             runtimeSettings: mergedRuntimeSettings,
             profileModels: override?.models ?? [],
             additionalModels: override?.additionalModels ?? [],
-            profileModelsAreAdditive: definition.id === "claude",
+            profileModelsAreAdditive: false,
             enabled: override?.enabled !== false,
             derivedFromProviderId: null,
             createBaseClient: (logger) => factory(logger, mergedRuntimeSettings, {

package/dist/server/server/agent/provider-snapshot-manager.js

@@ -6,6 +6,24 @@ import { withTimeout } from "../../utils/promise-timeout.js";
 import { buildProviderRegistry, shutdownAgentClients, } from "./provider-registry.js";
 import { applyMutableProviderConfigToOverrides } from "../daemon-config-store.js";
 const DEFAULT_REFRESH_TIMEOUT_MS = 30000;
+const REFRESH_TIMEOUT_ENV_VAR = "PASEO_PROVIDER_REFRESH_TIMEOUT_MS";
+// Provider refresh probes can be slow on cold starts (e.g. Copilot's first
+// `copilot --acp` invocation, OpenCode workspace probes with many MCP servers).
+// Allow operators to bump the ceiling via env var without rebuilding.
+function resolveRefreshTimeoutMs(option) {
+    if (typeof option === "number" && Number.isFinite(option) && option > 0) {
+        return option;
+    }
+    const fromEnv = process.env[REFRESH_TIMEOUT_ENV_VAR];
+    if (fromEnv) {
+        // Number() handles scientific notation (e.g. "6e4") which parseInt would silently truncate.
+        const parsed = Number(fromEnv);
+        if (Number.isFinite(parsed) && parsed > 0) {
+            return parsed;
+        }
+    }
+    return DEFAULT_REFRESH_TIMEOUT_MS;
+}
 export class ProviderSnapshotManager {
     constructor(options) {
         this.snapshots = new Map();
@@ -19,7 +37,7 @@ export class ProviderSnapshotManager {
         this.runtimeSettings = options.runtimeSettings;
         this.providerOverrides = options.providerOverrides;
         this.baseProviderOverrides = options.providerOverrides;
-        this.refreshTimeoutMs = options.refreshTimeoutMs ?? DEFAULT_REFRESH_TIMEOUT_MS;
+        this.refreshTimeoutMs = resolveRefreshTimeoutMs(options.refreshTimeoutMs);
         this.providerRegistry = this.buildRegistry();
         this.providerClients = { ...this.extraClients };
     }

package/dist/server/server/agent/providers/claude/agent.d.ts

@@ -1,7 +1,7 @@
-import { type AgentDefinition, type SDKMessage } from "@anthropic-ai/claude-agent-sdk";
+import { type AgentDefinition, type McpServerConfig as ClaudeSdkMcpServerConfig, type SDKMessage } from "@anthropic-ai/claude-agent-sdk";
 import type { Logger } from "pino";
 import { type ClaudeQueryFactory } from "./query.js";
-import { type AgentCapabilityFlags, type AgentClient, type AgentCreateSessionOptions, type AgentFeature, type AgentLaunchContext, type AgentMetadata, type AgentModelDefinition, type AgentPersistenceHandle, type AgentSession, type AgentSessionConfig, type AgentTimelineItem, type ListModelsOptions, type ListPersistedAgentsOptions, type PersistedAgentDescriptor } from "../../agent-sdk-types.js";
+import { type AgentCapabilityFlags, type AgentClient, type AgentCreateSessionOptions, type AgentFeature, type AgentLaunchContext, type AgentMetadata, type AgentModelDefinition, type AgentPersistenceHandle, type AgentSession, type AgentSessionConfig, type AgentTimelineItem, type ListModelsOptions, type ListPersistedAgentsOptions, type McpServerConfig, type PersistedAgentDescriptor } from "../../agent-sdk-types.js";
 import { type ProviderRuntimeSettings } from "../../provider-launch-config.js";
 export declare function normalizeClaudeAskUserQuestionUpdatedInput(updatedInput: AgentMetadata | undefined, fallbackInput: AgentMetadata | undefined): AgentMetadata;
 interface EventIdentifiers {
@@ -21,8 +21,10 @@ interface ClaudeAgentClientOptions {
     runtimeSettings?: ProviderRuntimeSettings;
     queryFactory?: ClaudeQueryFactory;
     resolveBinary?: () => Promise<string>;
+    configDir?: string;
 }
 export declare function extractUserMessageText(content: unknown): string | null;
+export declare function toClaudeSdkMcpConfig(config: McpServerConfig): ClaudeSdkMcpServerConfig;
 export declare function readEventIdentifiers(message: SDKMessage): EventIdentifiers;
 export declare class ClaudeAgentClient implements AgentClient {
     readonly provider: "claude";
@@ -32,6 +34,7 @@ export declare class ClaudeAgentClient implements AgentClient {
     private readonly runtimeSettings?;
     private readonly queryFactory?;
     private readonly resolveBinary;
+    private readonly configDir?;
     constructor(options: ClaudeAgentClientOptions);
     createSession(config: AgentSessionConfig, launchContext?: AgentLaunchContext, options?: AgentCreateSessionOptions): Promise<AgentSession>;
     resumeSession(handle: AgentPersistenceHandle, overrides?: Partial<AgentSessionConfig>, launchContext?: AgentLaunchContext): Promise<AgentSession>;

package/dist/server/server/agent/providers/claude/agent.js

@@ -539,7 +539,7 @@ function coerceSessionMetadata(metadata) {
     }
     return result;
 }
-function toClaudeSdkMcpConfig(config) {
+export function toClaudeSdkMcpConfig(config) {
     switch (config.type) {
         case "stdio":
             return {
@@ -547,18 +547,21 @@ function toClaudeSdkMcpConfig(config) {
                 command: config.command,
                 args: config.args,
                 env: config.env,
+                alwaysLoad: config.alwaysLoad,
             };
         case "http":
             return {
                 type: "http",
                 url: config.url,
                 headers: config.headers,
+                alwaysLoad: config.alwaysLoad,
             };
         case "sse":
             return {
                 type: "sse",
                 url: config.url,
                 headers: config.headers,
+                alwaysLoad: config.alwaysLoad,
             };
     }
     throw new Error("Unhandled MCP server config type");
@@ -922,6 +925,7 @@ export class ClaudeAgentClient {
         this.runtimeSettings = options.runtimeSettings;
         this.queryFactory = options.queryFactory;
         this.resolveBinary = options.resolveBinary ?? (() => resolveClaudeBinary(this.runtimeSettings));
+        this.configDir = options.configDir;
     }
     async createSession(config, launchContext, options) {
         const claudeConfig = this.assertConfig(config);
@@ -961,7 +965,7 @@ export class ClaudeAgentClient {
     }
     async listModels(_options) {
         // Claude exposes a global catalog here; cwd/force are intentionally irrelevant.
-        return await getClaudeModelsWithSettings(this.logger);
+        return await getClaudeModelsWithSettings(this.logger, this.configDir);
     }
     async listFeatures(config) {
         const claudeConfig = this.assertConfig(config);

package/dist/server/server/agent/providers/claude/models.d.ts

@@ -1,7 +1,7 @@
 import type { Logger } from "pino";
 import type { AgentModelDefinition } from "../../agent-sdk-types.js";
 export declare function getClaudeModels(): AgentModelDefinition[];
-export declare function getClaudeModelsWithSettings(logger: Logger): Promise<AgentModelDefinition[]>;
+export declare function getClaudeModelsWithSettings(logger: Logger, configDir?: string): Promise<AgentModelDefinition[]>;
 /**
  * Normalize a runtime model string (from SDK init message) to a known model ID.
  * Handles the `[1m]` suffix that the SDK appends for 1M context sessions.

package/dist/server/server/agent/providers/claude/models.js

@@ -89,9 +89,9 @@ const CLAUDE_SETTINGS_MODEL_ENV_KEYS = [
 export function getClaudeModels() {
     return CLAUDE_MODELS.map((model) => ({ ...model }));
 }
-export async function getClaudeModelsWithSettings(logger) {
+export async function getClaudeModelsWithSettings(logger, configDir) {
     const hardcodedModels = getClaudeModels();
-    const settingsModels = await readClaudeSettingsModels(logger);
+    const settingsModels = await readClaudeSettingsModels(logger, configDir);
     if (settingsModels.length === 0) {
         return hardcodedModels;
     }
@@ -106,8 +106,8 @@ export async function getClaudeModelsWithSettings(logger) {
     }
     return models;
 }
-async function readClaudeSettingsModels(logger) {
-    const settingsPath = path.join(resolveClaudeConfigDir(), "settings.json");
+async function readClaudeSettingsModels(logger, configDir) {
+    const settingsPath = path.join(resolveClaudeConfigDir(configDir), "settings.json");
     let parsed;
     try {
         const rawSettings = await fs.readFile(settingsPath, "utf8");
@@ -136,8 +136,8 @@ async function readClaudeSettingsModels(logger) {
     }
     return models;
 }
-function resolveClaudeConfigDir() {
-    return process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude");
+function resolveClaudeConfigDir(configDir) {
+    return configDir ?? process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude");
 }
 function addSettingsModel(models, value, settingsKey) {
     if (typeof value !== "string") {

package/dist/server/server/auth.js

@@ -84,10 +84,25 @@ export function createRequireBearerMiddleware(auth, onReject) {
         })();
     };
 }
+// Routes that authenticate via their own capability and therefore must not be
+// gated a second time behind the daemon password.
+const BEARER_AUTH_BYPASS_PATHS = new Set([
+    // Unauthenticated liveness probe.
+    "/api/health",
+    // Guarded by a single-use download token (crypto-random UUID, 60s TTL,
+    // consumed on first use) that is only ever issued over the
+    // already-authenticated WebSocket. The token IS the capability for this
+    // route. Requiring the daemon password on top of it breaks browser and
+    // Electron downloads: those trigger the download via an anchor navigation,
+    // which cannot attach an `Authorization` header. The download endpoint still
+    // rejects requests without a valid token (400/403), so dropping the bearer
+    // here does not make the route unauthenticated.
+    "/api/files/download",
+]);
 export function shouldBypassBearerAuth(method, path) {
     if (method === "OPTIONS") {
         return true;
     }
-    return path === "/api/health";
+    return BEARER_AUTH_BYPASS_PATHS.has(path);
 }
 //# sourceMappingURL=auth.js.map

package/dist/server/server/persisted-config.d.ts

@@ -3,6 +3,7 @@ import type { AgentProviderRuntimeSettingsMap } from "./agent/provider-launch-co
 export declare const LogLevelSchema: z.ZodEnum<["trace", "debug", "info", "warn", "error", "fatal"]>;
 export declare const LogFormatSchema: z.ZodEnum<["pretty", "json"]>;
 export declare const PersistedConfigSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
     version: z.ZodOptional<z.ZodLiteral<1>>;
     daemon: z.ZodOptional<z.ZodEffects<z.ZodObject<{
         listen: z.ZodOptional<z.ZodString>;
@@ -957,6 +958,7 @@ export declare const PersistedConfigSchema: z.ZodObject<{
             order?: number | undefined;
         }> | undefined;
     } | undefined;
+    $schema?: string | undefined;
     app?: {
         baseUrl?: string | undefined;
     } | undefined;
@@ -1061,6 +1063,7 @@ export declare const PersistedConfigSchema: z.ZodObject<{
         } | undefined;
         providers?: unknown;
     } | undefined;
+    $schema?: string | undefined;
     app?: {
         baseUrl?: string | undefined;
     } | undefined;

package/dist/server/server/persisted-config.js

@@ -169,6 +169,7 @@ function normalizeAgentProviders(value) {
 }
 export const PersistedConfigSchema = z
     .object({
+    $schema: z.string().optional(),
     // v1 schema marker
     version: z.literal(1).optional(),
     // v1 config layout

package/dist/server/utils/directory-suggestions.js

@@ -12,8 +12,11 @@ const NO_SEGMENT_INDEX = Number.MAX_SAFE_INTEGER;
 const NO_MATCH_OFFSET = Number.MAX_SAFE_INTEGER;
 const NO_FUZZY_SCORE = Number.MAX_SAFE_INTEGER;
 const NO_WORKSPACE_MATCH_TIER = 5;
-const WORKSPACE_IGNORED_DIRECTORY_NAMES = new Set([
+const IGNORED_SUGGESTION_DIRECTORY_NAMES = new Set([
     "node_modules",
+    "venv",
+    "env",
+    "virtualenv",
     "dist",
     "build",
     "target",
@@ -589,7 +592,9 @@ async function listChildDirectories(input) {
         return cached.entries;
     }
     const dirents = await readdir(input.directory, { withFileTypes: true }).catch(() => []);
-    const candidates = dirents.filter((dirent) => !isHiddenDirectoryName(dirent.name) && (dirent.isDirectory() || dirent.isSymbolicLink()));
+    const candidates = dirents.filter((dirent) => !isHiddenDirectoryName(dirent.name) &&
+        !isIgnoredSuggestionDirectoryName(dirent.name) &&
+        (dirent.isDirectory() || dirent.isSymbolicLink()));
     const resolved = await Promise.all(candidates.map(async (dirent) => {
         const candidatePath = path.join(input.directory, dirent.name);
         const absolutePath = await resolveDirectoryCandidate({
@@ -613,7 +618,7 @@ async function listWorkspaceChildEntries(input) {
         return cached.entries;
     }
     const dirents = await readdir(input.directory, { withFileTypes: true }).catch(() => []);
-    const candidates = dirents.filter((dirent) => !isHiddenDirectoryName(dirent.name) && !isIgnoredWorkspaceDirectoryName(dirent.name));
+    const candidates = dirents.filter((dirent) => !isHiddenDirectoryName(dirent.name) && !isIgnoredSuggestionDirectoryName(dirent.name));
     const resolved = await Promise.all(candidates.map(async (dirent) => {
         const candidatePath = path.join(input.directory, dirent.name);
         const entry = await resolveWorkspaceCandidate({
@@ -682,8 +687,8 @@ async function resolveWorkspaceCandidate(input) {
 function isHiddenDirectoryName(name) {
     return name.startsWith(".");
 }
-function isIgnoredWorkspaceDirectoryName(name) {
-    return WORKSPACE_IGNORED_DIRECTORY_NAMES.has(name);
+function isIgnoredSuggestionDirectoryName(name) {
+    return IGNORED_SUGGESTION_DIRECTORY_NAMES.has(name);
 }
 function setDirectoryListCache(cacheKey, entry) {
     directoryListCache.set(cacheKey, entry);

package/dist/server/utils/worktree.d.ts

@@ -128,6 +128,10 @@ export declare class UnknownBranchError extends Error {
         cwd: string;
     });
 }
+export declare class InvalidGitBranchNameError extends Error {
+    readonly branchName: string;
+    constructor(branchName: string);
+}
 export type ReadPaseoConfigResult = {
     ok: true;
     config: PaseoConfig | null;

package/dist/server/utils/worktree.js

@@ -55,6 +55,13 @@ export class UnknownBranchError extends Error {
         this.cwd = params.cwd;
     }
 }
+export class InvalidGitBranchNameError extends Error {
+    constructor(branchName) {
+        super(`Invalid branch name: Git rejected ref name '${branchName}'`);
+        this.name = "InvalidGitBranchNameError";
+        this.branchName = branchName;
+    }
+}
 export function readPaseoConfig(repoRoot) {
     try {
         const json = readPaseoConfigJson(repoRoot);
@@ -898,7 +905,7 @@ async function resolveWorktreeSourcePlan({ cwd, source, desiredSlug, }) {
             };
         }
         case "checkout-branch": {
-            validateWorktreeBranchName(source.branchName);
+            await validateExistingWorktreeBranchName(cwd, source.branchName);
             if (!(await localBranchExists(cwd, source.branchName))) {
                 try {
                     await runGitCommand(["fetch", "origin", `${source.branchName}:${source.branchName}`], {
@@ -921,7 +928,7 @@ async function resolveWorktreeSourcePlan({ cwd, source, desiredSlug, }) {
         }
         case "checkout-github-pr": {
             const localBranchCandidate = source.localBranchName ?? source.headRef;
-            validateWorktreeBranchName(localBranchCandidate);
+            await validateExistingWorktreeBranchName(cwd, localBranchCandidate);
             const localBranchName = await resolveUniqueLocalBranchName(cwd, localBranchCandidate);
             const normalizedBaseRefName = normalizeRequiredBaseBranch(source.baseRefName);
             await runGitCommand([
@@ -966,6 +973,16 @@ function validateWorktreeBranchName(branchName) {
         throw new Error(`Invalid branch name: ${validation.error}`);
     }
 }
+async function validateExistingWorktreeBranchName(cwd, branchName) {
+    const result = await runGitCommand(["check-ref-format", "--branch", branchName], {
+        cwd,
+        timeout: 30000,
+        acceptExitCodes: [0, 1, 128],
+    });
+    if (result.exitCode !== 0) {
+        throw new InvalidGitBranchNameError(branchName);
+    }
+}
 function normalizeRequiredBaseBranch(baseBranch) {
     const normalizedBaseBranch = normalizeBaseRefName(baseBranch);
     if (!normalizedBaseBranch) {

package/dist/src/server/persisted-config.js

@@ -169,6 +169,7 @@ function normalizeAgentProviders(value) {
 }
 export const PersistedConfigSchema = z
     .object({
+    $schema: z.string().optional(),
     // v1 schema marker
     version: z.literal(1).optional(),
     // v1 config layout

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/server",
-  "version": "0.1.91-beta.1",
+  "version": "0.1.91-beta.2",
   "description": "Paseo backend server",
   "files": [
     "dist/server",
@@ -59,10 +59,10 @@
   "dependencies": {
     "@agentclientprotocol/sdk": "^0.17.1",
     "@anthropic-ai/claude-agent-sdk": "^0.2.133",
-    "@getpaseo/client": "0.1.91-beta.1",
-    "@getpaseo/highlight": "0.1.91-beta.1",
-    "@getpaseo/protocol": "0.1.91-beta.1",
-    "@getpaseo/relay": "0.1.91-beta.1",
+    "@getpaseo/client": "0.1.91-beta.2",
+    "@getpaseo/highlight": "0.1.91-beta.2",
+    "@getpaseo/protocol": "0.1.91-beta.2",
+    "@getpaseo/relay": "0.1.91-beta.2",
     "@isaacs/ttlcache": "^2.1.4",
     "@modelcontextprotocol/sdk": "^1.20.1",
     "@opencode-ai/sdk": "1.14.46",