@ggui-ai/cli 0.24.0 → 0.26.0

package/README.md

@@ -71,13 +71,13 @@ When the variable is unset, or the module fails shape validation, the CLI falls
 | `ggui whoami`       | Print the authenticated user.                                                                                                  |
 | `ggui keys`         | Manage `ggui_user_*` connector keys (list / create / revoke).                                                                  |
 | `ggui create`       | Create cloud resources tied to this project (`create app` writes `appId` into `ggui.json`).                                    |
-| `ggui gadget`       | Author gadgets for the ggui marketplace (`gadget create <scope/name>` scaffolds a repo).                                       |
-| `ggui blueprint`    | Author UI blueprints for the ggui marketplace (`blueprint create <scope/name>` scaffolds a repo).                              |
+| `ggui gadget`       | Author gadgets for the GGUI marketplace (`gadget create <scope/name>` scaffolds a repo).                                       |
+| `ggui blueprint`    | Author UI blueprints for the GGUI marketplace (`blueprint create <scope/name>` scaffolds a repo).                              |
 | `ggui theme`        | Validate + inspect operator-authored DTCG themes (`theme validate <path>`).                                                    |
 | `ggui export-pool`  | Export this deployment's reusable blueprints as a shareable pool directory; load elsewhere via `ggui serve --seed-pool <dir>`. |
 | `ggui push`         | Compile + bulk-push blueprints to a ggui.ai cloud app (requires `ggui login`).                                                 |
 | `ggui deploy`       | Provision + wire a ggui.ai cloud app for this project (idempotent).                                                            |
-| `ggui provider-key` | Manage provider API keys for a cloud ggui app (`provider-key set --app <appId>`).                                              |
+| `ggui provider-key` | Manage provider API keys for a cloud GGUI app (`provider-key set --app <appId>`).                                              |
 
 Run `ggui --help` for per-command flags.
 

package/dist/cli.js

@@ -26,7 +26,7 @@ import { buildSeedPool } from '@ggui-ai/mcp-server-handlers';
 import { createThemeWriter } from './theme-writer.js';
 import { createThemeFileUploader } from './theme-file-uploader.js';
 import { getPersistentDir } from './paths.js';
-import { createPersistentGguiSessionStore, createPersistentVectorStore, } from './persistent-stores.js';
+import { createPersistentVectorStore, layerPersistentSessionStores, } from './persistent-stores.js';
 import { parseServeFlags, runServe, SERVE_HELP, } from './serve-command.js';
 import { runLoginCommand } from './auth-login.js';
 import { runLogoutCommand } from './auth-logout.js';
@@ -299,8 +299,8 @@ async function runServeCommand(args) {
             // resolved above) — the operator asked for it by name.
             if (!manifestDeclaresRenders && storage.renderStore === undefined) {
                 try {
-                    const renderStore = await createPersistentGguiSessionStore(persistentDir);
-                    storage = { ...storage, renderStore };
+                    // The sessions and their stream buffer, both or neither (ggui#1534).
+                    storage = await layerPersistentSessionStores(storage, persistentDir);
                 }
                 catch (err) {
                     process.stderr.write(`ggui serve: persistent render store unavailable — using in-memory `

package/dist/mcp-backend.d.ts

@@ -1,4 +1,4 @@
-import { type BlueprintProvider, type DiscoveredPrimitiveCatalog, type GadgetDescriptor, type GenerationDeps, type LoadedTheme, type McpServerMount, type McpUiDisplayMode, type OperatorConfig, type ResolvedStorageStores, type ShortCodeIndex, type ThemeWriter } from "@ggui-ai/mcp-server";
+import { type BlueprintProvider, type DiscoveredPrimitiveCatalog, type GadgetDescriptor, type GenerationDeps, type LoadedTheme, type McpServerMount, type McpUiDisplayMode, type OperatorConfig, type ResolvedStorageStores, type ShortCodeIndex, type ThemeFileUploader, type ThemeWriter } from "@ggui-ai/mcp-server";
 import { type BlueprintPool } from "@ggui-ai/mcp-server-handlers/renders";
 import type { ThemeConfig, UiManifest } from "@ggui-ai/project-config";
 import type { UiRegistry } from "@ggui-ai/ui-registry";
@@ -81,6 +81,15 @@ export interface BuildMcpServerBackendOptions {
      * is on disk.
      */
     readonly themeWriter?: ThemeWriter;
+    /**
+     * Theme file uploader for the admin-gated `/ggui/console/theme/upload`
+     * POST, which writes an uploaded theme document next to `ggui.json`.
+     * The route is enabled only when BOTH this and {@link themeWriter} are
+     * present; otherwise it answers 501. The CLI builds it from the same
+     * manifest path via `createThemeFileUploader` (ggui#1579: it was built
+     * and never forwarded, so `ggui serve` never enabled uploads).
+     */
+    readonly themeFileUploader?: ThemeFileUploader;
     /**
      * Live theme getter — when set, supersedes the static `theme`
      * resolution for every `ggui_render` bootstrap envelope. The CLI
@@ -244,8 +253,8 @@ export interface BuildMcpServerBackendOptions {
     /**
      * Server-level MCP instructions preset. Threaded straight through
      * to `createGguiServer({mcpInstructions})`. Falls back to the
-     * `GGUI_MCP_INSTRUCTIONS` env var when absent. Both absent =
-     * `createGguiServer`'s no-preset default (`'aggressive'`).
+     * `GGUI_MCP_INSTRUCTIONS` env var when absent. Both absent = no
+     * instructions are sent (`createGguiServer`'s default is `'off'`).
      *
      * Surface = `--mcp-instructions <preset>` CLI flag or
      * `GGUI_MCP_INSTRUCTIONS` env var (CLI flag wins).

package/dist/mcp-backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-backend.d.ts","sourceRoot":"","sources":["../src/mcp-backend.ts"],"names":[],"mappings":"AA0CA,OAAO,EAQL,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAE/B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAKL,KAAK,aAAa,EAKnB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAMvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IACd;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,IAAI,CAAC;IAClE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAE9C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC/B,CAAC,CAAC;KACJ,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEnD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IACnF;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;QACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAE/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBhE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,GAAG,YAAY,CAkmBtF"}
+{"version":3,"file":"mcp-backend.d.ts","sourceRoot":"","sources":["../src/mcp-backend.ts"],"names":[],"mappings":"AA0CA,OAAO,EAQL,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAE/B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAKL,KAAK,aAAa,EAKnB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAMvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IACd;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,IAAI,CAAC;IAClE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAE9C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC/B,CAAC,CAAC;KACJ,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEnD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IACnF;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;QACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAE/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBhE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,GAAG,YAAY,CA2lBtF"}

package/dist/mcp-backend.js

@@ -219,25 +219,23 @@ export function buildMcpServerBackend(opts) {
         emailSender = fallback.sender;
         emailFromAddress = process.env.GGUI_EMAIL_FROM?.trim() || defaultFromAddress;
     }
-    // Resolve cross-restart HMAC secrets. When the caller declared a
-    // persistent dir, read-or-mint `ws-token-secret.hex` +
-    // `render-signer-secret.hex` (32 bytes / 64 hex chars, 0600). Both
-    // get threaded into `createGguiServer` below so the server stops
-    // minting fresh process-local secrets every boot — the precondition
-    // for any cached `_meta["ai.ggui/render"].wsToken` surviving a
-    // restart. Absent dir = legacy ephemeral behavior.
+    // Resolve the cross-restart HMAC secret. When the caller declared a
+    // persistent dir, read-or-mint `ws-token-secret.hex` (32 bytes / 64 hex
+    // chars, 0600) and thread it into `createGguiServer` below, so the server
+    // stops minting a fresh process-local secret every boot: the precondition
+    // for any cached `_meta["ai.ggui/render"].wsToken` surviving a restart.
+    // Absent dir = ephemeral behavior. (No render-signer secret: the server's
+    // render-signing layer was removed with the /r/ viewer, ggui#1579.)
     let persistedWsTokenSecret;
-    let persistedRenderSignerSecret;
     if (opts.persistentDir !== undefined) {
         persistedWsTokenSecret = readOrMintHexSecret(join(opts.persistentDir, "ws-token-secret.hex"));
-        persistedRenderSignerSecret = readOrMintHexSecret(join(opts.persistentDir, "render-signer-secret.hex"));
     }
     // Resolve withholdResultMeta: CLI flag wins over env var.
     const envWithhold = process.env.GGUI_WITHHOLD_RESULT_META?.trim();
     const resolvedWithhold = opts.withholdResultMeta === true || (opts.withholdResultMeta === undefined && (envWithhold === "1" || envWithhold === "true"));
     // Resolve mcpInstructions: CLI flag wins over env var. Validated
     // env-var values pass through to createGguiServer; invalid values
-    // fall through to the no-preset default with a one-line warning.
+    // fall through to the default (no instructions) with a one-line warning.
     const envInstructions = process.env.GGUI_MCP_INSTRUCTIONS?.trim();
     let resolvedMcpInstructions = opts.mcpInstructions;
     if (resolvedMcpInstructions === undefined && envInstructions) {
@@ -250,7 +248,7 @@ export function buildMcpServerBackend(opts) {
         }
         else {
             // eslint-disable-next-line no-console -- one-shot boot warning
-            console.warn(`[ggui-cli] GGUI_MCP_INSTRUCTIONS='${envInstructions}' not recognized; falling back to default preset.`);
+            console.warn(`[ggui-cli] GGUI_MCP_INSTRUCTIONS='${envInstructions}' not recognized; sending no instructions (the default).`);
         }
     }
     // Per-app metadata store seeded from `ggui.json#theme.preset` (when
@@ -401,16 +399,10 @@ export function buildMcpServerBackend(opts) {
         // Co-binding with `appMetadataStore` mounts `ggui_list_themes` on
         // the agent route.
         themes: () => listThemes(),
-        // Cross-restart HMAC secrets. Present iff the caller declared a
-        // persistent dir. Both threaded so the next restart can verify
-        // tokens minted by the previous run instead of regenerating per
-        // process. render-signer.secret rides on the `renderSigning`
-        // discriminated union (the `false` shape disables the layer
-        // entirely; we always want it on here, so build the object form).
+        // Cross-restart HMAC secret. Present iff the caller declared a
+        // persistent dir, so the next restart verifies tokens the previous run
+        // minted instead of regenerating per process.
         ...(persistedWsTokenSecret !== undefined ? { wsTokenSecret: persistedWsTokenSecret } : {}),
-        ...(persistedRenderSignerSecret !== undefined
-            ? { renderSigning: { secret: persistedRenderSignerSecret } }
-            : {}),
         ...(resolvedMcpInstructions !== undefined ? { mcpInstructions: resolvedMcpInstructions } : {}),
         ...(resolvedWithhold ? { withholdResultMeta: true } : {}),
         // `--multi-user` flips the `/ggui/console/llm-keys` gate from
@@ -425,6 +417,8 @@ export function buildMcpServerBackend(opts) {
         ...(opts.publicBaseUrl ? { publicBaseUrl: opts.publicBaseUrl } : {}),
         ...(rateLimiter ? { rateLimiter } : {}),
         ...(storage.renderStore ? { renderStore: storage.renderStore } : {}),
+        // The live channel's buffer, persistent when the sessions are (ggui#1534).
+        ...(storage.streamBuffer ? { streamBuffer: storage.streamBuffer } : {}),
         // Always pass the materialized vectorStore so the install bridge
         // and the matcher share state. Passing only `storage.vectors`
         // (set when the manifest declares sqlite) would, on an absent
@@ -559,6 +553,7 @@ export function buildMcpServerBackend(opts) {
         // read-only banner + POST returns 501. CLI sets this when
         // `plan.projectRoot` resolved to a manifest path on disk.
         ...(opts.themeWriter ? { themeWriter: opts.themeWriter } : {}),
+        ...(opts.themeFileUploader ? { themeFileUploader: opts.themeFileUploader } : {}),
         // Live-theme wiring — `themeProvider` reads from a shared cell
         // that `onThemeConfigChange` writes to on every console save,
         // so the picker's "Save to ggui.json" reaches the next render's

package/dist/paths.d.ts

@@ -56,7 +56,7 @@ export declare function getEmbeddingCacheDir(): string;
 export declare function getCodeCacheDir(): string;
 /**
  * Directory backing the `--persistent` bundle (sessions.sqlite,
- * short-codes.sqlite, bootstrap-secret.hex, render-signer-secret.hex,
+ * short-codes.sqlite, bootstrap-secret.hex,
  * keys.json …). Survives `ggui serve` restarts so claude.ai chat-history
  * revisits can rehydrate the iframe instead of seeing four cascading
  * failures (HMAC + shortCode + render + pairing).

package/dist/paths.js

@@ -91,7 +91,7 @@ export function getCodeCacheDir() {
 }
 /**
  * Directory backing the `--persistent` bundle (sessions.sqlite,
- * short-codes.sqlite, bootstrap-secret.hex, render-signer-secret.hex,
+ * short-codes.sqlite, bootstrap-secret.hex,
  * keys.json …). Survives `ggui serve` restarts so claude.ai chat-history
  * revisits can rehydrate the iframe instead of seeing four cascading
  * failures (HMAC + shortCode + render + pairing).

package/dist/persistent-stores.d.ts

@@ -1,5 +1,31 @@
-import type { GguiSessionStore, VectorStore } from '@ggui-ai/mcp-server-core';
-export declare function createPersistentGguiSessionStore(persistentDir: string): Promise<GguiSessionStore>;
+import type { GguiSessionStore, GguiSessionStreamBuffer, VectorStore } from '@ggui-ai/mcp-server-core';
+import type { ResolvedStorageStores } from '@ggui-ai/mcp-server';
+/** The persistent session store and the live channel's stream buffer, opened together. */
+export interface PersistentSessionStores {
+    readonly renderStore: GguiSessionStore;
+    readonly streamBuffer: GguiSessionStreamBuffer;
+}
+/**
+ * The persistent sessions and, in the same `sessions.sqlite`, the live
+ * channel's stream buffer (ggui#1534), so a session that survives a restart
+ * also keeps its stream `seq`, its epoch and its retained envelopes, and a
+ * reconnect replays what it missed.
+ *
+ * Both or neither, by construction: an in-memory store with a persistent
+ * buffer would keep counters for sessions that no longer exist, and a
+ * persistent store with an in-memory buffer is the gap this closes. If the
+ * buffer cannot open, the store it opened first is closed and the error
+ * propagates.
+ */
+export declare function createPersistentSessionStores(persistentDir: string): Promise<PersistentSessionStores>;
+/**
+ * `ggui serve`'s persistent layer for sessions: when nothing resolved a
+ * render store (no `ggui.json#storage.renders`), add the persistent session
+ * store and its stream buffer, together (ggui#1534). A bundle that already
+ * has a render store is returned untouched. Throws when SQLite is
+ * unavailable; the caller falls back to the in-memory defaults.
+ */
+export declare function layerPersistentSessionStores(storage: ResolvedStorageStores, persistentDir: string): Promise<ResolvedStorageStores>;
 export declare function createPersistentVectorStore(persistentDir: string): Promise<VectorStore>;
 /**
  * Compute the auto-default `keysFile` path. Returns `undefined` when

package/dist/persistent-stores.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"persistent-stores.d.ts","sourceRoot":"","sources":["../src/persistent-stores.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EACV,gBAAgB,EAChB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAElC,wBAAsB,gCAAgC,CACpD,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAQ3B;AAED,wBAAsB,2BAA2B,CAC/C,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE7D"}
+{"version":3,"file":"persistent-stores.d.ts","sourceRoot":"","sources":["../src/persistent-stores.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;CAChD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,6BAA6B,CACjD,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,uBAAuB,CAAC,CAalC;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,qBAAqB,EAC9B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,CAAC,CAIhC;AAED,wBAAsB,2BAA2B,CAC/C,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC,CAQtB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/dist/persistent-stores.js

@@ -16,12 +16,43 @@
  */
 import { mkdirSync } from 'node:fs';
 import { join } from 'node:path';
-export async function createPersistentGguiSessionStore(persistentDir) {
+/**
+ * The persistent sessions and, in the same `sessions.sqlite`, the live
+ * channel's stream buffer (ggui#1534), so a session that survives a restart
+ * also keeps its stream `seq`, its epoch and its retained envelopes, and a
+ * reconnect replays what it missed.
+ *
+ * Both or neither, by construction: an in-memory store with a persistent
+ * buffer would keep counters for sessions that no longer exist, and a
+ * persistent store with an in-memory buffer is the gap this closes. If the
+ * buffer cannot open, the store it opened first is closed and the error
+ * propagates.
+ */
+export async function createPersistentSessionStores(persistentDir) {
     mkdirSync(persistentDir, { recursive: true });
-    const { SqliteGguiSessionStore } = await import('@ggui-ai/mcp-server-core/sqlite');
-    return new SqliteGguiSessionStore({
-        filename: join(persistentDir, 'sessions.sqlite'),
-    });
+    const { SqliteGguiSessionStore, SqliteGguiSessionStreamBuffer } = await import('@ggui-ai/mcp-server-core/sqlite');
+    const filename = join(persistentDir, 'sessions.sqlite');
+    const renderStore = new SqliteGguiSessionStore({ filename });
+    try {
+        return { renderStore, streamBuffer: new SqliteGguiSessionStreamBuffer({ filename }) };
+    }
+    catch (err) {
+        renderStore.close();
+        throw err;
+    }
+}
+/**
+ * `ggui serve`'s persistent layer for sessions: when nothing resolved a
+ * render store (no `ggui.json#storage.renders`), add the persistent session
+ * store and its stream buffer, together (ggui#1534). A bundle that already
+ * has a render store is returned untouched. Throws when SQLite is
+ * unavailable; the caller falls back to the in-memory defaults.
+ */
+export async function layerPersistentSessionStores(storage, persistentDir) {
+    if (storage.renderStore !== undefined)
+        return storage;
+    const { renderStore, streamBuffer } = await createPersistentSessionStores(persistentDir);
+    return { ...storage, renderStore, streamBuffer };
 }
 export async function createPersistentVectorStore(persistentDir) {
     mkdirSync(persistentDir, { recursive: true });

package/dist/serve-command.d.ts

@@ -154,10 +154,10 @@ export interface ParsedServeFlags {
      * advisory level for tool-use posture:
      *
      *   - `default`    — gentle "ggui first when UI fits, prose otherwise"
-     *   - `aggressive` — render anything with structure (no-preset default)
+     *   - `aggressive` — render anything with structure
      *   - `always`     — every response renders via ggui_render
      *   - `minimal`    — server identity only, no behavioral nudge
-     *   - `off`        — omit the field entirely
+     *   - `off`        — omit the field entirely (also what an unset flag does)
      *
      * Surface = `--mcp-instructions <preset>` or
      * `GGUI_MCP_INSTRUCTIONS=<preset>` env var (CLI flag wins).
@@ -537,5 +537,5 @@ export interface RunServeOptions {
  * {@link describeServeBanner} / {@link describeAgentStatus}.
  */
 export declare function runServe(opts: RunServeOptions): Promise<number>;
-export declare const SERVE_HELP = "ggui serve \u2014 run the open self-hosted personal-mode app\n\nBoots the @ggui-ai/mcp-server binding with persistent defaults AND\n(by default) supervises your agent alongside it. The current MCP\nhandler surface is the blueprint-read family (search / list_featured\n/ render); more tools come online as @ggui-ai/mcp-server-handlers\ngrows.\n\nFirst-run bundle (all on by default):\n  - Landing page at /          \u2014 operator opens a browser and sees\n                                  server identity + pair-code card.\n  - Render viewer at /r/<code>  \u2014 same-origin viewer for renders\n                                  minted by ggui_render; same-origin\n                                  HTTP-only cookie authenticates the\n                                  live-channel /ws upgrade.\n  - POST /pair + POST /admin/pair/init \u2014 pairing endpoint for MCP\n                                  hosts and third-party clients.\n  - Live-channel /ws            \u2014 live render plane for MCP Apps\n                                  iframes and the console.\n\nEmbedding hosts that want a different shape (no landing page, no\npairing, programmatic control) should compose createGguiServer()\ndirectly in code rather than invoking `ggui serve`.\n\nUsage:\n  ggui serve [options]\n\nOptions:\n  --port <n>             Bind port (default: 6781, 0 = OS-assigned).\n  --host <addr>          Bind host (default: 127.0.0.1).\n  --mcp-only             Run just the MCP server; do not supervise an agent.\n  --dev-allow-all        Accept any non-empty bearer (incl. no bearer) as\n                         builder. Local-dev / tunnel smoke ONLY \u2014 never\n                         expose to the open internet.\n  --public-demo          Public-facing demo posture: same any-bearer auth\n                         as --dev-allow-all, plus per-IP rate limit on\n                         ggui_render (30 generations / 10 min) and a\n                         \"PUBLIC DEMO \u2014 operator pays\" banner. Mutually\n                         exclusive with --dev-allow-all.\n  --multi-user         Multi-user posture: switches the /settings LLM-\n                         keys gate from admin-token to auth-adapter so\n                         each authenticated end-user manages their OWN\n                         key plane (scope = userId/appId). kind:'builder'\n                         identities are rejected at the gate. Strict-auth\n                         only; mutually exclusive with --dev-allow-all\n                         and --public-demo. (Generation-time BYOK still\n                         resolves at the operator 'global' scope \u2014 a\n                         follow-up will thread per-user BYOK through\n                         ggui_render.)\n  --local-cli-login      Generate with the Claude login already on this\n                         machine (the one `claude` uses) when no\n                         ANTHROPIC_API_KEY is set, instead of an API key.\n                         Anthropic routes only; a real key always wins. Your\n                         Claude plan's terms and usage limits apply, and\n                         generation is about 2x slower (2.2x at the median)\n                         than with an API key. For your own use: refused with\n                         --multi-user and --public-demo.\n  --public-base-url <u>  Override the public base URL used to compose\n                         iframe-runtime + shortCode URLs. Set this to a\n                         tunnel URL (https://<random>.trycloudflare.com)\n                         when testing against a remote MCP host so URLs\n                         resolve from the host's perspective. Without\n                         this, URLs derive from --host:--port and only\n                         work from the same machine.\n  --browser-origin <o>   Allow pages at this origin past MCP-wire Origin\n                         validation (repeatable; env GGUI_BROWSER_ORIGINS,\n                         comma-separated). Pages on localhost need no\n                         entry. NOT authentication \u2014 /mcp still requires\n                         a bearer. Non-browser clients are unaffected.\n  --oauth                Mount OAuth 2.1 + PKCE + Dynamic Client\n                         Registration routes (.well-known/oauth-* +\n                         /oauth/{authorize,token,register}). Required\n                         for MCP custom-connector hosts (claude.ai,\n                         ChatGPT) whose Add Connector form has no field\n                         for a pre-shared bearer; OAuth lets them do\n                         a discovery \u2192 DCR \u2192 consent dance ending in\n                         the same paired bearer the strict-auth flow\n                         already mints. Pure-bearer clients (Claude\n                         Desktop with bearer in config) work without it.\n  --admin-token <t>      Pin the admin bearer that gates the console\n                         /keys plane (list / mint / revoke pairings +\n                         /admin-login route). Without this, the server\n                         mints a fresh ggui_admin_* token per boot and\n                         prints it on the banner. Pin a stable value\n                         when you want the bearer to survive restarts\n                         (e.g. paste once into a password manager).\n  --ephemeral            Disable cross-restart persistence. Without\n                         this flag, the HMAC secrets that sign MCP\n                         Apps bootstrap tokens and signed render URLs\n                         are read or minted under .ggui/persistent/\n                         (project-local if a ggui.json was resolved,\n                         else ~/.ggui/persistent/) so cached tokens\n                         survive a server restart. Pass this flag to\n                         keep restarts ephemeral (tests / CI / nuclear-\n                         revoke). Override the dir via GGUI_PERSISTENT_DIR.\n  --seed-pool <dir>      Load a read-only shared blueprint pool from a\n                         directory artifact (repeatable). Blueprints in it\n                         are reused by exact contract match, after your own.\n  --help, -h             Show this help.\n\nAgent runtime:\n  The default boots your agent alongside MCP. The agent's entry file\n  comes from ggui.json:\n\n    { \"agent\": { \"entry\": \"./agent.ts\" } }\n\n  Supported extensions: .js / .mjs / .cjs (node), .ts / .tsx / .mts\n  (node --import=tsx). No ggui.json, or no agent.entry, falls back\n  to MCP-only with a warning. Malformed ggui.json or a bad entry\n  is a hard error.\n\n  Agent crashes after startup are logged; the MCP server keeps\n  running. No auto-restart \u2014 compose that with your own supervisor.\n\nPersistent storage (default-on; opt-out via --ephemeral):\n  By default `ggui serve` writes a small bundle under .ggui/persistent/\n  (project-local if a ggui.json was resolved, else ~/.ggui/persistent/)\n  so cached MCP Apps tokens, signed render URLs, shortCodes, renders,\n  vectors, and paired bearers survive a restart \u2014 claude.ai chat-history\n  revisits keep working.\n\n  Bundle layout:\n\n    .ggui/persistent/\n      \u251C\u2500\u2500 ws-token-secret.hex       (HMAC, 0600)\n      \u251C\u2500\u2500 render-signer-secret.hex  (HMAC, 0600)\n      \u251C\u2500\u2500 short-codes.sqlite        (signed render-URL resolution)\n      \u251C\u2500\u2500 sessions.sqlite            (GguiSessionStore \u2014 renders + event history)\n      \u251C\u2500\u2500 vectors.sqlite            (RAG corpus)\n      \u2514\u2500\u2500 keys.json                 (paired bearers)\n\n  Override the dir with `GGUI_PERSISTENT_DIR`. Pass `--ephemeral` to\n  skip the bundle entirely (tests, CI loops, nuclear-revoke).\n\n  Explicit ggui.json#storage declarations always win \u2014 declare\n  `{ \"renders\": { \"driver\": \"memory\" } }` to opt renders back to\n  in-memory while keeping other surfaces persistent. Custom sqlite\n  paths via ggui.json#storage are honored verbatim:\n\n    {\n      \"storage\": {\n        \"renders\": { \"driver\": \"sqlite\", \"path\": \"./ggui-sessions.sqlite\" },\n        \"vectors\": { \"driver\": \"sqlite\", \"path\": \"./ggui-vectors.sqlite\" },\n        \"threads\": { \"driver\": \"sqlite\", \"path\": \"./ggui-threads.sqlite\" }\n      }\n    }\n\n  Threads: the persistent-chat route family (/threads) is opt-in.\n  Absent `storage.threads` leaves the routes unmounted \u2014 pairs\n  with Portal's self-hosted origins only when declared. Driver\n  semantics:\n    - `driver: \"sqlite\"` \u2014 durable. Threads survive restart.\n      /ggui/health reports `threads.durability: \"durable\"`;\n      Portal hides its non-durable caveat.\n    - `driver: \"memory\"` \u2014 routes mount but data is lost on\n      restart. /ggui/health reports `threads.durability:\n      \"ephemeral\"`; Portal shows its caveat.\n\n  Paths resolve relative to the ggui.json directory. The sqlite\n  driver needs `better-sqlite3` installed in your project.\n\nRecommended setups:\n\n  Local-only smoke (no tunnel, no remote MCP host):\n    ggui serve\n\n  claude.ai custom connector (over a public tunnel):\n    1. Tunnel: cloudflared tunnel --url http://localhost:6781\n    2. ggui serve --oauth \\\n                  --public-base-url https://<tunnel>.trycloudflare.com\n    3. Note PAIR_CODE from boot. Visit the landing page (the public URL\n       above), complete pairing, save the bearer.\n    4. claude.ai \u2192 Settings \u2192 Connectors \u2192 Add custom connector.\n       URL: https://<tunnel>.trycloudflare.com/mcp\n       Client ID / Secret: leave empty (server uses Dynamic Client\n       Registration; no pre-shared secret needed).\n    5. Click Connect \u2192 claude.ai redirects you to a paste-key page.\n       Paste the bearer from step 3. Done.\n\n  Quick local-dev WITHOUT auth (NEVER over a public tunnel):\n    ggui serve --dev-allow-all\n\nCurrent limits:\n  - Strict-auth only: /mcp rejects any bearer that isn't pair-minted.\n    The CLI pre-mints one pairing code on boot (printed as\n    `PAIR_CODE <code>` and shown in the banner + on the landing\n    page). Complete `POST /pair {code, deviceName}` to receive a\n    bearer you can use with MCP. Embed @ggui-ai/mcp-server in your\n    own entrypoint to inject a different AuthAdapter (OIDC, Cognito,\n    etc.) for production.\n  - Single-user: every request scopes to one `builder` app id.\n";
+export declare const SERVE_HELP = "ggui serve \u2014 run the open self-hosted personal-mode app\n\nBoots the @ggui-ai/mcp-server binding with persistent defaults AND\n(by default) supervises your agent alongside it. The current MCP\nhandler surface is the blueprint-read family (search / list_featured\n/ render); more tools come online as @ggui-ai/mcp-server-handlers\ngrows.\n\nFirst-run bundle (all on by default):\n  - Landing page at /          \u2014 operator opens a browser and sees\n                                  server identity + pair-code card.\n  - Render viewer at /r/<code>  \u2014 same-origin viewer for renders\n                                  minted by ggui_render; same-origin\n                                  HTTP-only cookie authenticates the\n                                  live-channel /ws upgrade.\n  - POST /pair + POST /admin/pair/init \u2014 pairing endpoint for MCP\n                                  hosts and third-party clients.\n  - Live-channel /ws            \u2014 live render plane for MCP Apps\n                                  iframes and the console.\n\nEmbedding hosts that want a different shape (no landing page, no\npairing, programmatic control) should compose createGguiServer()\ndirectly in code rather than invoking `ggui serve`.\n\nUsage:\n  ggui serve [options]\n\nOptions:\n  --port <n>             Bind port (default: 6781, 0 = OS-assigned).\n  --host <addr>          Bind host (default: 127.0.0.1).\n  --mcp-only             Run just the MCP server; do not supervise an agent.\n  --dev-allow-all        Accept any non-empty bearer (incl. no bearer) as\n                         builder. Local-dev / tunnel smoke ONLY \u2014 never\n                         expose to the open internet.\n  --public-demo          Public-facing demo posture: same any-bearer auth\n                         as --dev-allow-all, plus per-IP rate limit on\n                         ggui_render (30 generations / 10 min) and a\n                         \"PUBLIC DEMO \u2014 operator pays\" banner. Mutually\n                         exclusive with --dev-allow-all.\n  --multi-user         Multi-user posture: switches the /settings LLM-\n                         keys gate from admin-token to auth-adapter so\n                         each authenticated end-user manages their OWN\n                         key plane (scope = userId/appId). kind:'builder'\n                         identities are rejected at the gate. Strict-auth\n                         only; mutually exclusive with --dev-allow-all\n                         and --public-demo. (Generation-time BYOK still\n                         resolves at the operator 'global' scope \u2014 a\n                         follow-up will thread per-user BYOK through\n                         ggui_render.)\n  --local-cli-login      Generate with the Claude login already on this\n                         machine (the one `claude` uses) when no\n                         ANTHROPIC_API_KEY is set, instead of an API key.\n                         Anthropic routes only; a real key always wins. Your\n                         Claude plan's terms and usage limits apply, and\n                         generation is about 2x slower (2.2x at the median)\n                         than with an API key. For your own use: refused with\n                         --multi-user and --public-demo.\n  --public-base-url <u>  Override the public base URL used to compose\n                         iframe-runtime + shortCode URLs. Set this to a\n                         tunnel URL (https://<random>.trycloudflare.com)\n                         when testing against a remote MCP host so URLs\n                         resolve from the host's perspective. Without\n                         this, URLs derive from --host:--port and only\n                         work from the same machine.\n  --browser-origin <o>   Allow pages at this origin past MCP-wire Origin\n                         validation (repeatable; env GGUI_BROWSER_ORIGINS,\n                         comma-separated). Pages on localhost need no\n                         entry. NOT authentication \u2014 /mcp still requires\n                         a bearer. Non-browser clients are unaffected.\n  --oauth                Mount OAuth 2.1 + PKCE + Dynamic Client\n                         Registration routes (.well-known/oauth-* +\n                         /oauth/{authorize,token,register}). Required\n                         for MCP custom-connector hosts (claude.ai,\n                         ChatGPT) whose Add Connector form has no field\n                         for a pre-shared bearer; OAuth lets them do\n                         a discovery \u2192 DCR \u2192 consent dance ending in\n                         the same paired bearer the strict-auth flow\n                         already mints. Pure-bearer clients (Claude\n                         Desktop with bearer in config) work without it.\n  --admin-token <t>      Pin the admin bearer that gates the console\n                         /keys plane (list / mint / revoke pairings +\n                         /admin-login route). Without this, the server\n                         mints a fresh ggui_admin_* token per boot and\n                         prints it on the banner. Pin a stable value\n                         when you want the bearer to survive restarts\n                         (e.g. paste once into a password manager).\n  --ephemeral            Disable cross-restart persistence. Without\n                         this flag, the HMAC secrets that sign MCP\n                         Apps bootstrap tokens and signed render URLs\n                         are read or minted under .ggui/persistent/\n                         (project-local if a ggui.json was resolved,\n                         else ~/.ggui/persistent/) so cached tokens\n                         survive a server restart. Pass this flag to\n                         keep restarts ephemeral (tests / CI / nuclear-\n                         revoke). Override the dir via GGUI_PERSISTENT_DIR.\n  --seed-pool <dir>      Load a read-only shared blueprint pool from a\n                         directory artifact (repeatable). Blueprints in it\n                         are reused by exact contract match, after your own.\n  --help, -h             Show this help.\n\nAgent runtime:\n  The default boots your agent alongside MCP. The agent's entry file\n  comes from ggui.json:\n\n    { \"agent\": { \"entry\": \"./agent.ts\" } }\n\n  Supported extensions: .js / .mjs / .cjs (node), .ts / .tsx / .mts\n  (node --import=tsx). No ggui.json, or no agent.entry, falls back\n  to MCP-only with a warning. Malformed ggui.json or a bad entry\n  is a hard error.\n\n  Agent crashes after startup are logged; the MCP server keeps\n  running. No auto-restart \u2014 compose that with your own supervisor.\n\nPersistent storage (default-on; opt-out via --ephemeral):\n  By default `ggui serve` writes a small bundle under .ggui/persistent/\n  (project-local if a ggui.json was resolved, else ~/.ggui/persistent/)\n  so cached MCP Apps tokens, shortCodes, renders,\n  vectors, and paired bearers survive a restart \u2014 claude.ai chat-history\n  revisits keep working.\n\n  Bundle layout:\n\n    .ggui/persistent/\n      \u251C\u2500\u2500 ws-token-secret.hex       (HMAC, 0600)\n      \u251C\u2500\u2500 short-codes.sqlite        (signed render-URL resolution)\n      \u251C\u2500\u2500 sessions.sqlite            (GguiSessionStore \u2014 renders + event history)\n      \u251C\u2500\u2500 vectors.sqlite            (RAG corpus)\n      \u2514\u2500\u2500 keys.json                 (paired bearers)\n\n  Override the dir with `GGUI_PERSISTENT_DIR`. Pass `--ephemeral` to\n  skip the bundle entirely (tests, CI loops, nuclear-revoke).\n\n  Explicit ggui.json#storage declarations always win \u2014 declare\n  `{ \"renders\": { \"driver\": \"memory\" } }` to opt renders back to\n  in-memory while keeping other surfaces persistent. Custom sqlite\n  paths via ggui.json#storage are honored verbatim:\n\n    {\n      \"storage\": {\n        \"renders\": { \"driver\": \"sqlite\", \"path\": \"./ggui-sessions.sqlite\" },\n        \"vectors\": { \"driver\": \"sqlite\", \"path\": \"./ggui-vectors.sqlite\" },\n        \"threads\": { \"driver\": \"sqlite\", \"path\": \"./ggui-threads.sqlite\" }\n      }\n    }\n\n  Threads: the persistent-chat route family (/threads) is opt-in.\n  Absent `storage.threads` leaves the routes unmounted \u2014 pairs\n  with Portal's self-hosted origins only when declared. Driver\n  semantics:\n    - `driver: \"sqlite\"` \u2014 durable. Threads survive restart.\n      /ggui/health reports `threads.durability: \"durable\"`;\n      Portal hides its non-durable caveat.\n    - `driver: \"memory\"` \u2014 routes mount but data is lost on\n      restart. /ggui/health reports `threads.durability:\n      \"ephemeral\"`; Portal shows its caveat.\n\n  Paths resolve relative to the ggui.json directory. The sqlite\n  driver needs `better-sqlite3` installed in your project.\n\nRecommended setups:\n\n  Local-only smoke (no tunnel, no remote MCP host):\n    ggui serve\n\n  claude.ai custom connector (over a public tunnel):\n    1. Tunnel: cloudflared tunnel --url http://localhost:6781\n    2. ggui serve --oauth \\\n                  --public-base-url https://<tunnel>.trycloudflare.com\n    3. Note PAIR_CODE from boot. Visit the landing page (the public URL\n       above), complete pairing, save the bearer.\n    4. claude.ai \u2192 Settings \u2192 Connectors \u2192 Add custom connector.\n       URL: https://<tunnel>.trycloudflare.com/mcp\n       Client ID / Secret: leave empty (server uses Dynamic Client\n       Registration; no pre-shared secret needed).\n    5. Click Connect \u2192 claude.ai redirects you to a paste-key page.\n       Paste the bearer from step 3. Done.\n\n  Quick local-dev WITHOUT auth (NEVER over a public tunnel):\n    ggui serve --dev-allow-all\n\nCurrent limits:\n  - Strict-auth only: /mcp rejects any bearer that isn't pair-minted.\n    The CLI pre-mints one pairing code on boot (printed as\n    `PAIR_CODE <code>` and shown in the banner + on the landing\n    page). Complete `POST /pair {code, deviceName}` to receive a\n    bearer you can use with MCP. Embed @ggui-ai/mcp-server in your\n    own entrypoint to inject a different AuthAdapter (OIDC, Cognito,\n    etc.) for production.\n  - Single-user: every request scopes to one `builder` app id.\n";
 //# sourceMappingURL=serve-command.d.ts.map

package/dist/serve-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve-command.d.ts","sourceRoot":"","sources":["../src/serve-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAEjB,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;OAUG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;;;;OASG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1E;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CA+LzE;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,cAAc,GACd,8BAA8B,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACjD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAgItE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAa/D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,yCAAyC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACpD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CACd,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,IAAI,EACnB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GACxB,IAAI,CAAC;CACT;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC;IAC1F,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAyJrE;AAED,eAAO,MAAM,UAAU,gzUA+LtB,CAAC"}
+{"version":3,"file":"serve-command.d.ts","sourceRoot":"","sources":["../src/serve-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAEjB,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;OAUG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;;;;OASG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1E;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CA+LzE;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,cAAc,GACd,8BAA8B,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACjD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAgItE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAa/D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,yCAAyC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACpD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CACd,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,IAAI,EACnB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GACxB,IAAI,CAAC;CACT;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC;IAC1F,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAyJrE;AAED,eAAO,MAAM,UAAU,2tUA8LtB,CAAC"}

package/dist/serve-command.js

@@ -582,7 +582,7 @@ Agent runtime:
 Persistent storage (default-on; opt-out via --ephemeral):
   By default \`ggui serve\` writes a small bundle under .ggui/persistent/
   (project-local if a ggui.json was resolved, else ~/.ggui/persistent/)
-  so cached MCP Apps tokens, signed render URLs, shortCodes, renders,
+  so cached MCP Apps tokens, shortCodes, renders,
   vectors, and paired bearers survive a restart — claude.ai chat-history
   revisits keep working.
 
@@ -590,7 +590,6 @@ Persistent storage (default-on; opt-out via --ephemeral):
 
     .ggui/persistent/
       ├── ws-token-secret.hex       (HMAC, 0600)
-      ├── render-signer-secret.hex  (HMAC, 0600)
       ├── short-codes.sqlite        (signed render-URL resolution)
       ├── sessions.sqlite            (GguiSessionStore — renders + event history)
       ├── vectors.sqlite            (RAG corpus)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/cli",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "The `ggui` CLI — run the ggui protocol locally: dev server, self-hosted MCP server, and gadget / blueprint authoring. End-to-end OSS and self-hosted workflows; no account required.",
   "keywords": [
     "ggui",
@@ -37,22 +37,22 @@
     "@noble/hashes": "^1.6.0",
     "esbuild": "^0.28.2",
     "zod": "^4.3.6",
-    "@ggui-ai/artifact-manifest": "0.24.0",
-    "@ggui-ai/dev-stack": "0.24.0",
-    "@ggui-ai/gadget-signing": "0.24.0",
-    "@ggui-ai/agent-runtime": "0.24.0",
-    "@ggui-ai/design": "0.24.0",
-    "@ggui-ai/mcp-server-core": "0.24.0",
-    "@ggui-ai/mcp-server-handlers": "0.24.0",
-    "@ggui-ai/preview-a2ui": "0.24.0",
-    "@ggui-ai/project-config": "0.24.0",
-    "@ggui-ai/embedding-local": "0.24.0",
-    "@ggui-ai/mcp-server": "0.24.0",
-    "@ggui-ai/protocol": "0.24.0",
-    "@ggui-ai/registry-core": "0.24.0",
-    "@ggui-ai/ui-registry": "0.24.0",
-    "@ggui-ai/ui-gen": "0.24.0",
-    "@ggui-ai/iframe-runtime": "0.24.0"
+    "@ggui-ai/agent-runtime": "0.26.0",
+    "@ggui-ai/design": "0.26.0",
+    "@ggui-ai/dev-stack": "0.26.0",
+    "@ggui-ai/gadget-signing": "0.26.0",
+    "@ggui-ai/embedding-local": "0.26.0",
+    "@ggui-ai/mcp-server": "0.26.0",
+    "@ggui-ai/mcp-server-core": "0.26.0",
+    "@ggui-ai/mcp-server-handlers": "0.26.0",
+    "@ggui-ai/preview-a2ui": "0.26.0",
+    "@ggui-ai/project-config": "0.26.0",
+    "@ggui-ai/protocol": "0.26.0",
+    "@ggui-ai/iframe-runtime": "0.26.0",
+    "@ggui-ai/registry-core": "0.26.0",
+    "@ggui-ai/ui-gen": "0.26.0",
+    "@ggui-ai/artifact-manifest": "0.26.0",
+    "@ggui-ai/ui-registry": "0.26.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",