@joeyshi12/casper 0.9.7 → 0.10.0

package/dist/server.js

@@ -292,6 +292,7 @@ var init_config = __esm({
       "token",
       "sessionTtlSeconds",
       "kiroBin",
+      "kiroSessionsDir",
       "defaultCwd",
       "maxLiveSessions",
       "defaultAgent",
@@ -325,8 +326,18 @@ var init_config = __esm({
        * or SSH keys.
        */
       fileRoot: path5.resolve(setting("CASPER_FILE_ROOT", "fileRoot", "/")),
-      /** Directory where kiro-cli persists its own session files. */
-      kiroSessionsDir: path5.join(home, ".kiro", "sessions", "cli"),
+      /**
+       * Directory where kiro-cli persists its own session files. Overridable for the
+       * same reason as every other path here: a non-default kiro home, a container,
+       * or a test that must not write into the real one.
+       */
+      kiroSessionsDir: path5.resolve(
+        setting(
+          "CASPER_KIRO_SESSIONS_DIR",
+          "kiroSessionsDir",
+          path5.join(home, ".kiro", "sessions", "cli")
+        )
+      ),
       /** Where casper.db lives. Env-only: it says where data is, and the config
        *  file isn't there. */
       casperDataDir: dataDirPath(),
@@ -1608,8 +1619,10 @@ var init_SessionManager = __esm({
       sessions = /* @__PURE__ */ new Map();
       log;
       store = new SessionStore();
-      constructor(log) {
+      spawnProcess;
+      constructor(log, opts = {}) {
         this.log = log;
+        this.spawnProcess = opts.spawn ?? ((o, l) => new KiroProcess(o, l));
       }
       /**
        * What a session is called, from every read path. The folder is skipped for a workspace of
@@ -1721,7 +1734,7 @@ var init_SessionManager = __esm({
         if (s.spawning) return s.spawning;
         s.spawning = (async () => {
           await this.ensureCapacity();
-          const proc = new KiroProcess(
+          const proc = this.spawnProcess(
             { cwd: s.cwd, agent: s.agentId, model: s.modelId },
             this.log
           );
@@ -1858,61 +1871,58 @@ ${tail}` : err.message;
         await proc.execCommand(s.sessionId, command, args);
         s.lastActivity = Date.now();
       }
-      // -------------------------------------------------------------------------
-      // Listing / detail - never spawns.
-      // -------------------------------------------------------------------------
+      summaryOf(live, persisted, transcript) {
+        const sessionId = live?.sessionId ?? persisted.sessionId;
+        const snap = live?.turnState.get();
+        const cwd = live?.cwd ?? this.store.getCwd(sessionId) ?? persisted.cwd;
+        return {
+          sessionId,
+          title: this.titleOf(sessionId, {
+            // kiro's file is what kiro called it; the live copy is only a cache of it.
+            kiroTitle: persisted?.title || live?.title,
+            firstPrompt: transcript && firstPromptText(transcript),
+            cwd
+          }),
+          cwd,
+          createdAt: persisted?.createdAt ?? live.createdAt,
+          // kiro's file and our own activity move separately.
+          updatedAt: live ? newerOf(persisted?.updatedAt, live.updatedAt) : persisted.updatedAt,
+          liveness: live?.proc ? "live" : "dormant",
+          agentId: live?.agentId ?? persisted?.agentId,
+          modelId: live?.modelId ?? persisted?.modelId,
+          running: live?.running ?? false,
+          // A dormant session's totals live in kiro's file; a live one's snapshot
+          // starts at zero until the first turn reports, so fall back to the file.
+          creditsSpent: snap?.creditsSpent || persisted?.creditsSpent,
+          contextUsagePercentage: snap?.contextUsagePercentage || persisted?.contextUsagePercentage
+        };
+      }
       async listSessions() {
         const persisted = await listPersistedSessions(this.log);
+        const files = new Map(persisted.map((p) => [p.sessionId, p]));
         const byId = /* @__PURE__ */ new Map();
         for (const p of persisted) {
-          byId.set(p.sessionId, {
-            ...p,
-            title: this.titleOf(p.sessionId, {
-              kiroTitle: p.title,
-              cwd: this.store.getCwd(p.sessionId) ?? p.cwd
-            }),
-            cwd: this.store.getCwd(p.sessionId) ?? p.cwd
-          });
+          byId.set(p.sessionId, this.summaryOf(void 0, p));
         }
         for (const s of this.sessions.values()) {
-          const snap = s.turnState.get();
-          const base = byId.get(s.sessionId);
-          if (isGhost(s, base !== void 0)) {
+          if (isGhost(s, files.has(s.sessionId))) {
             this.evict(s.sessionId);
             continue;
           }
-          byId.set(s.sessionId, {
-            sessionId: s.sessionId,
-            title: this.titleOf(s.sessionId, { kiroTitle: base?.title, cwd: s.cwd }),
-            cwd: s.cwd,
-            createdAt: base?.createdAt ?? s.createdAt,
-            updatedAt: newerOf(base?.updatedAt, s.updatedAt),
-            liveness: s.proc ? "live" : "dormant",
-            agentId: s.agentId ?? base?.agentId,
-            modelId: s.modelId ?? base?.modelId,
-            running: s.running,
-            creditsSpent: snap.creditsSpent || base?.creditsSpent,
-            contextUsagePercentage: snap.contextUsagePercentage || base?.contextUsagePercentage
-          });
+          byId.set(s.sessionId, this.summaryOf(s, files.get(s.sessionId)));
         }
         return [...byId.values()].sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
       }
       async getDetail(sessionId) {
-        const transcript = await hydrateTranscript(sessionId);
+        const [transcript, persisted] = await Promise.all([
+          hydrateTranscript(sessionId),
+          readPersistedSession(sessionId)
+        ]);
         const s = this.sessions.get(sessionId);
-        if (s) return this.buildDetail(s, transcript);
-        const persisted = await readPersistedSession(sessionId);
+        if (s) return this.buildDetail(s, transcript, persisted ?? void 0);
         if (!persisted) throw new Error(`Unknown session: ${sessionId}`);
         return {
-          summary: {
-            ...persisted,
-            title: this.titleOf(sessionId, {
-              kiroTitle: persisted.title,
-              firstPrompt: firstPromptText(transcript),
-              cwd: this.store.getCwd(sessionId) ?? persisted.cwd
-            }),
-            cwd: this.store.getCwd(sessionId) ?? persisted.cwd
-          },
+          summary: this.summaryOf(void 0, persisted, transcript),
           modes: [],
           currentModeId: persisted.agentId,
           transcript: transcript.slice(-TRANSCRIPT_PAGE_SIZE),
@@ -1936,26 +1946,10 @@ ${tail}` : err.message;
         const end = Math.max(start, Math.min(start + limit, transcript.length));
         return transcript.slice(start, end);
       }
-      buildDetail(s, transcript) {
+      buildDetail(s, transcript, persisted) {
         const snap = s.turnState.get();
         return {
-          summary: {
-            sessionId: s.sessionId,
-            title: this.titleOf(s.sessionId, {
-              kiroTitle: s.title,
-              firstPrompt: firstPromptText(transcript),
-              cwd: s.cwd
-            }),
-            cwd: s.cwd,
-            createdAt: s.createdAt,
-            updatedAt: s.updatedAt,
-            liveness: s.proc ? "live" : "dormant",
-            agentId: s.agentId,
-            modelId: s.modelId,
-            running: s.running,
-            creditsSpent: snap.creditsSpent,
-            contextUsagePercentage: snap.contextUsagePercentage
-          },
+          summary: this.summaryOf(s, persisted, transcript),
           modes: s.availableModes,
           currentModeId: s.currentModeId,
           // Only the tail is sent on load; replayHead/title use the full transcript.
@@ -2174,6 +2168,20 @@ var init_auth = __esm({
 // server/src/session/models.ts
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+async function configuredDefault() {
+  try {
+    const { stdout } = await execFileAsync(config.kiroBin, [
+      "settings",
+      "chat.defaultModel",
+      "-f",
+      "json"
+    ]);
+    const value = JSON.parse(stdout);
+    return typeof value === "string" && value ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function listModels(log) {
   if (cache) return cache;
   const { stdout } = await execFileAsync(
@@ -2182,6 +2190,8 @@ async function listModels(log) {
     { maxBuffer: 4 * 1024 * 1024 }
   );
   const parsed = JSON.parse(stdout);
+  const configured = await configuredDefault();
+  const preferred = parsed.models.some((m) => m.model_id === configured) ? configured : parsed.default_model;
   cache = parsed.models.map((m, i) => ({
     modelId: m.model_id,
     modelName: m.model_name,
@@ -2189,9 +2199,9 @@ async function listModels(log) {
     contextWindowTokens: m.context_window_tokens,
     rateMultiplier: m.rate_multiplier,
     rateUnit: m.rate_unit,
-    isDefault: m.default_model ?? i === 0
+    isDefault: preferred ? m.model_id === preferred : m.default_model ?? i === 0
   }));
-  log.info({ count: cache.length }, "loaded model list");
+  log.info({ count: cache.length, default: preferred }, "loaded model list");
   return cache;
 }
 async function kiroVersion() {
@@ -2283,13 +2293,242 @@ var init_agents2 = __esm({
   }
 });
 
-// server/src/routes/fs.ts
+// server/src/util/confinedFile.ts
 import fs11 from "node:fs/promises";
-import { createReadStream } from "node:fs";
 import path12 from "node:path";
-function confinedPath(input) {
-  return confineToRoot(config.fileRoot, input) ?? confineToRoot(config.casperDataDir, input);
+async function resolveConfined(input, spec) {
+  let target = null;
+  for (const root of spec.lexical) {
+    target = confineToRoot(root, input);
+    if (target) break;
+  }
+  if (!target) return { ok: false, ...spec.escaped };
+  let real = null;
+  for (const root of spec.real) {
+    real = await realConfineToRoot(root, target);
+    if (real) break;
+  }
+  if (!real) return { ok: false, ...await spec.notFound() };
+  let stat;
+  try {
+    stat = await fs11.stat(real);
+  } catch {
+    return { ok: false, ...await spec.notFound() };
+  }
+  if (spec.require === "file" && !stat.isFile()) {
+    return { ok: false, status: 400, error: "Path is not a file" };
+  }
+  if (spec.require === "directory" && !stat.isDirectory()) {
+    return { ok: false, ...await spec.notFound() };
+  }
+  return { ok: true, real, stat };
+}
+function replyWith(reply, failure) {
+  reply.code(failure.status);
+  return { error: failure.error };
+}
+async function resolveSessionPath(sessions, sessionId, requestedPath, require2) {
+  let cwd;
+  try {
+    cwd = await sessions.getSessionCwd(sessionId);
+  } catch {
+    return { ok: false, status: 404, error: "Session not found" };
+  }
+  const relative = (requestedPath ?? "").replace(/^\/+/, "");
+  if (require2 === "file" && !relative) {
+    return { ok: false, status: 400, error: "path parameter is required" };
+  }
+  const resolved = await resolveConfined(relative, {
+    lexical: [cwd],
+    real: [config.fileRoot],
+    require: require2,
+    escaped: { status: 400, error: "Invalid path" },
+    notFound: require2 === "file" ? () => ({ status: 404, error: "File not found" }) : () => workspaceNotFound(cwd)
+  });
+  return resolved.ok ? { ...resolved, cwd, relative } : resolved;
+}
+async function workspaceNotFound(cwd) {
+  let missing;
+  try {
+    missing = !(await fs11.stat(cwd)).isDirectory();
+  } catch {
+    missing = true;
+  }
+  return missing ? { status: 404, error: `Workspace folder no longer exists: ${cwd}` } : { status: 404, error: "Directory not found" };
+}
+function absoluteRoots() {
+  return [config.fileRoot, config.casperDataDir];
+}
+async function resolveAbsolutePath(input, require2) {
+  const roots = absoluteRoots();
+  return resolveConfined(input, {
+    lexical: roots,
+    real: roots,
+    require: require2,
+    escaped: { status: 403, error: "Path outside allowed root" },
+    notFound: () => ({ status: 404, error: "File not found" })
+  });
+}
+async function classifyDirent(parentReal, entry, realRoots) {
+  const absolute = path12.join(parentReal, entry.name);
+  if (entry.isDirectory()) return { kind: "directory", real: absolute };
+  if (entry.isFile()) return { kind: "file", real: absolute };
+  if (!entry.isSymbolicLink()) return null;
+  for (const root of realRoots) {
+    const real = await realConfineToRoot(root, absolute);
+    if (!real) continue;
+    try {
+      const stat = await fs11.stat(real);
+      if (stat.isDirectory()) return { kind: "directory", real };
+      if (stat.isFile()) return { kind: "file", real };
+    } catch {
+    }
+    return null;
+  }
+  return null;
+}
+var init_confinedFile = __esm({
+  "server/src/util/confinedFile.ts"() {
+    "use strict";
+    init_config();
+    init_paths2();
+  }
+});
+
+// server/src/util/filekind.ts
+import path13 from "node:path";
+function mimeForExt(ext) {
+  return MIME_MAP[ext.toLowerCase()] ?? "application/octet-stream";
+}
+function looksBinary(buf) {
+  if (buf.length === 0) return false;
+  if (buf.length >= 2) {
+    const b0 = buf[0];
+    const b1 = buf[1];
+    if (b0 === 255 && b1 === 254 || b0 === 254 && b1 === 255) return true;
+  }
+  let control = 0;
+  for (let i = 0; i < buf.length; i++) {
+    const b = buf[i];
+    if (b === 0) return true;
+    if (b < 32 && b !== 9 && b !== 10 && b !== 12 && b !== 13) control++;
+  }
+  return control / buf.length > 0.3;
+}
+function classifyKind(name) {
+  const ext = path13.extname(name).toLowerCase();
+  if (ext in IMAGE_EXTS2) return "image";
+  if (TEXT_EXTS.has(ext)) return "text";
+  return "binary";
 }
+var IMAGE_EXTS2, TEXT_EXTS, MIME_MAP;
+var init_filekind = __esm({
+  "server/src/util/filekind.ts"() {
+    "use strict";
+    IMAGE_EXTS2 = {
+      ".png": "image/png",
+      ".jpg": "image/jpeg",
+      ".jpeg": "image/jpeg",
+      ".gif": "image/gif",
+      ".webp": "image/webp",
+      ".svg": "image/svg+xml",
+      ".bmp": "image/bmp",
+      ".ico": "image/x-icon",
+      ".avif": "image/avif"
+    };
+    TEXT_EXTS = /* @__PURE__ */ new Set([
+      ".txt",
+      ".md",
+      ".markdown",
+      ".rst",
+      ".log",
+      ".csv",
+      ".tsv",
+      ".json",
+      ".jsonl",
+      ".yaml",
+      ".yml",
+      ".toml",
+      ".ini",
+      ".env",
+      ".cfg",
+      ".conf",
+      ".xml",
+      ".html",
+      ".htm",
+      ".css",
+      ".scss",
+      ".less",
+      ".js",
+      ".mjs",
+      ".cjs",
+      ".jsx",
+      ".ts",
+      ".tsx",
+      ".vue",
+      ".svelte",
+      ".py",
+      ".rb",
+      ".go",
+      ".rs",
+      ".java",
+      ".kt",
+      ".c",
+      ".h",
+      ".cpp",
+      ".hpp",
+      ".cc",
+      ".cs",
+      ".php",
+      ".swift",
+      ".scala",
+      ".sh",
+      ".bash",
+      ".zsh",
+      ".fish",
+      ".sql",
+      ".graphql",
+      ".proto",
+      ".dockerfile",
+      ".makefile",
+      ".gradle",
+      ".diff",
+      ".patch",
+      ".tex"
+    ]);
+    MIME_MAP = {
+      ...IMAGE_EXTS2,
+      ".txt": "text/plain",
+      ".md": "text/markdown",
+      ".csv": "text/csv",
+      ".json": "application/json",
+      ".xml": "application/xml",
+      ".yaml": "text/yaml",
+      ".yml": "text/yaml",
+      ".html": "text/html",
+      ".css": "text/css",
+      ".js": "application/javascript",
+      ".mjs": "application/javascript",
+      ".ts": "text/typescript",
+      ".tsx": "text/typescript",
+      ".toml": "text/plain",
+      ".pdf": "application/pdf",
+      ".zip": "application/zip",
+      ".tar": "application/x-tar",
+      ".gz": "application/gzip",
+      ".wasm": "application/wasm",
+      ".exe": "application/vnd.microsoft.portable-executable",
+      ".dll": "application/vnd.microsoft.portable-executable",
+      ".so": "application/x-sharedlib",
+      ".bin": "application/octet-stream"
+    };
+  }
+});
+
+// server/src/routes/fs.ts
+import fs12 from "node:fs/promises";
+import { createReadStream } from "node:fs";
+import path14 from "node:path";
 function registerFsRoutes(app) {
   app.get(
     "/api/fs/dirs",
@@ -2297,37 +2536,27 @@ function registerFsRoutes(app) {
       const input = (req.query.path ?? "").trim();
       const base = config.defaultCwd;
       const endsWithSep = input.endsWith("/");
-      const resolved = input ? path12.resolve(base, input) : base;
-      const dir = endsWithSep || !input ? resolved : path12.dirname(resolved);
-      const prefix = endsWithSep || !input ? "" : path12.basename(resolved);
-      const targetKind = await fs11.stat(resolved).then((s) => s.isDirectory() ? "directory" : "file").catch(() => "missing");
-      if (confinedPath(dir) === null) {
-        reply.code(403);
-        return { error: "Path outside allowed root" };
-      }
-      const realDir = await realConfineToRoot(config.fileRoot, dir);
-      if (!realDir) {
+      const resolved = input ? path14.resolve(base, input) : base;
+      const dir = endsWithSep || !input ? resolved : path14.dirname(resolved);
+      const prefix = endsWithSep || !input ? "" : path14.basename(resolved);
+      const targetKind = await fs12.stat(resolved).then((s) => s.isDirectory() ? "directory" : "file").catch(() => "missing");
+      const listing = await resolveAbsolutePath(dir, "directory");
+      if (!listing.ok) {
+        if (listing.status === 403) return replyWith(reply, listing);
         return { dir, entries: [], target: resolved, targetKind };
       }
+      const realDir = listing.real;
       let entries = [];
       try {
-        const dirents = await fs11.readdir(realDir, { withFileTypes: true });
+        const dirents = await fs12.readdir(realDir, { withFileTypes: true });
         const candidates = dirents.filter((d) => !d.name.startsWith("."));
         const checks2 = await Promise.all(
           candidates.map(async (d) => {
-            if (d.isDirectory()) return d.name;
-            if (!d.isSymbolicLink()) return null;
-            const full = path12.join(realDir, d.name);
-            const real = await realConfineToRoot(config.fileRoot, full);
-            if (!real) return null;
-            try {
-              return (await fs11.stat(real)).isDirectory() ? d.name : null;
-            } catch {
-              return null;
-            }
+            const target = await classifyDirent(realDir, d, absoluteRoots());
+            return target?.kind === "directory" ? d.name : null;
           })
         );
-        entries = checks2.filter((name) => name !== null).filter((name) => name.toLowerCase().startsWith(prefix.toLowerCase())).sort((a, b) => a.localeCompare(b)).slice(0, 20).map((name) => path12.join(dir, name));
+        entries = checks2.filter((name) => name !== null).filter((name) => name.toLowerCase().startsWith(prefix.toLowerCase())).sort((a, b) => a.localeCompare(b)).slice(0, 20).map((name) => path14.join(dir, name));
       } catch {
         entries = [];
       }
@@ -2342,72 +2571,43 @@ function registerFsRoutes(app) {
         reply.code(400);
         return { error: "path parameter is required" };
       }
-      if (!path12.isAbsolute(filePath)) {
+      if (!path14.isAbsolute(filePath)) {
         reply.code(400);
         return { error: "path must be absolute" };
       }
-      const resolved = confinedPath(filePath);
-      if (resolved === null) {
-        reply.code(403);
-        return { error: "Path outside allowed root" };
-      }
-      const ext = path12.extname(resolved).toLowerCase();
-      const mime = IMAGE_MIMES[ext];
-      if (!mime) {
+      const ext = path14.extname(filePath).toLowerCase();
+      if (classifyKind(filePath) !== "image") {
         reply.code(400);
         return { error: `Not a supported image type: ${ext}` };
       }
-      const real = await realConfineToRoot(config.fileRoot, resolved);
-      if (!real) {
-        reply.code(404);
-        return { error: "File not found" };
-      }
-      let stat;
-      try {
-        stat = await fs11.stat(real);
-      } catch {
-        reply.code(404);
-        return { error: "File not found" };
-      }
-      if (!stat.isFile()) {
-        reply.code(400);
-        return { error: "Path is not a file" };
-      }
+      const resolvedImage = await resolveAbsolutePath(filePath, "file");
+      if (!resolvedImage.ok) return replyWith(reply, resolvedImage);
+      const { real, stat } = resolvedImage;
       if (stat.size > MAX_IMAGE_BYTES) {
         reply.code(413);
         return { error: "Image too large" };
       }
       const etag = `W/"${stat.size}-${stat.mtimeMs}"`;
-      reply.header("Cache-Control", "private, max-age=3600");
+      reply.header("Cache-Control", "private, no-cache");
       reply.header("ETag", etag);
       reply.header("Last-Modified", stat.mtime.toUTCString());
       if (req.headers["if-none-match"] === etag) {
         reply.code(304);
         return reply.send();
       }
-      reply.header("Content-Type", mime);
+      reply.header("Content-Type", mimeForExt(ext));
       reply.header("Content-Length", stat.size);
       return reply.send(createReadStream(real));
     }
   );
 }
-var IMAGE_MIMES, MAX_IMAGE_BYTES;
+var MAX_IMAGE_BYTES;
 var init_fs = __esm({
   "server/src/routes/fs.ts"() {
     "use strict";
     init_config();
-    init_paths2();
-    IMAGE_MIMES = {
-      ".png": "image/png",
-      ".jpg": "image/jpeg",
-      ".jpeg": "image/jpeg",
-      ".gif": "image/gif",
-      ".webp": "image/webp",
-      ".svg": "image/svg+xml",
-      ".bmp": "image/bmp",
-      ".ico": "image/x-icon",
-      ".avif": "image/avif"
-    };
+    init_confinedFile();
+    init_filekind();
     MAX_IMAGE_BYTES = 20 * 1024 * 1024;
   }
 });
@@ -2521,236 +2721,72 @@ var init_sessions = __esm({
   }
 });
 
-// server/src/util/filekind.ts
-import path13 from "node:path";
-function mimeForExt(ext) {
-  return MIME_MAP[ext.toLowerCase()] ?? "application/octet-stream";
+// server/src/routes/workspace.ts
+import fs13 from "node:fs/promises";
+import { createReadStream as createReadStream2 } from "node:fs";
+import path15 from "node:path";
+function tooLargeForPreview(size, maxBytes) {
+  return {
+    error: `File too large for preview (${(size / 1024 / 1024).toFixed(1)} MB, max ${maxBytes / 1024 / 1024} MB)`
+  };
 }
-function looksBinary(buf) {
-  if (buf.length === 0) return false;
-  if (buf.length >= 2) {
-    const b0 = buf[0];
-    const b1 = buf[1];
-    if (b0 === 255 && b1 === 254 || b0 === 254 && b1 === 255) return true;
-  }
-  let control = 0;
-  for (let i = 0; i < buf.length; i++) {
-    const b = buf[i];
-    if (b === 0) return true;
-    if (b < 32 && b !== 9 && b !== 10 && b !== 12 && b !== 13) control++;
+function hexdump(buf) {
+  const lines = [];
+  for (let off = 0; off < buf.length; off += 16) {
+    const slice = buf.subarray(off, off + 16);
+    const hex = [];
+    let ascii = "";
+    for (let i = 0; i < 16; i++) {
+      if (i < slice.length) {
+        const b = slice[i];
+        hex.push(b.toString(16).padStart(2, "0"));
+        ascii += b >= 32 && b <= 126 ? String.fromCharCode(b) : ".";
+      } else {
+        hex.push("  ");
+      }
+      if (i === 7) hex.push("");
+    }
+    lines.push(`${off.toString(16).padStart(8, "0")}  ${hex.join(" ")}  |${ascii}|`);
   }
-  return control / buf.length > 0.3;
-}
-function classifyKind(name) {
-  const ext = path13.extname(name).toLowerCase();
-  if (ext in IMAGE_EXTS2) return "image";
-  if (TEXT_EXTS.has(ext)) return "text";
-  return "binary";
-}
-var IMAGE_EXTS2, TEXT_EXTS, MIME_MAP;
-var init_filekind = __esm({
-  "server/src/util/filekind.ts"() {
-    "use strict";
-    IMAGE_EXTS2 = {
-      ".png": "image/png",
-      ".jpg": "image/jpeg",
-      ".jpeg": "image/jpeg",
-      ".gif": "image/gif",
-      ".webp": "image/webp",
-      ".svg": "image/svg+xml",
-      ".bmp": "image/bmp",
-      ".ico": "image/x-icon",
-      ".avif": "image/avif"
-    };
-    TEXT_EXTS = /* @__PURE__ */ new Set([
-      ".txt",
-      ".md",
-      ".markdown",
-      ".rst",
-      ".log",
-      ".csv",
-      ".tsv",
-      ".json",
-      ".jsonl",
-      ".yaml",
-      ".yml",
-      ".toml",
-      ".ini",
-      ".env",
-      ".cfg",
-      ".conf",
-      ".xml",
-      ".html",
-      ".htm",
-      ".css",
-      ".scss",
-      ".less",
-      ".js",
-      ".mjs",
-      ".cjs",
-      ".jsx",
-      ".ts",
-      ".tsx",
-      ".vue",
-      ".svelte",
-      ".py",
-      ".rb",
-      ".go",
-      ".rs",
-      ".java",
-      ".kt",
-      ".c",
-      ".h",
-      ".cpp",
-      ".hpp",
-      ".cc",
-      ".cs",
-      ".php",
-      ".swift",
-      ".scala",
-      ".sh",
-      ".bash",
-      ".zsh",
-      ".fish",
-      ".sql",
-      ".graphql",
-      ".proto",
-      ".dockerfile",
-      ".makefile",
-      ".gradle",
-      ".diff",
-      ".patch",
-      ".tex"
-    ]);
-    MIME_MAP = {
-      ...IMAGE_EXTS2,
-      ".txt": "text/plain",
-      ".md": "text/markdown",
-      ".csv": "text/csv",
-      ".json": "application/json",
-      ".xml": "application/xml",
-      ".yaml": "text/yaml",
-      ".yml": "text/yaml",
-      ".html": "text/html",
-      ".css": "text/css",
-      ".js": "application/javascript",
-      ".mjs": "application/javascript",
-      ".ts": "text/typescript",
-      ".tsx": "text/typescript",
-      ".toml": "text/plain",
-      ".pdf": "application/pdf",
-      ".zip": "application/zip",
-      ".tar": "application/x-tar",
-      ".gz": "application/gzip",
-      ".wasm": "application/wasm",
-      ".exe": "application/vnd.microsoft.portable-executable",
-      ".dll": "application/vnd.microsoft.portable-executable",
-      ".so": "application/x-sharedlib",
-      ".bin": "application/octet-stream"
-    };
-  }
-});
-
-// server/src/routes/workspace.ts
-import fs12 from "node:fs/promises";
-import { createReadStream as createReadStream2 } from "node:fs";
-import path14 from "node:path";
-function tooLargeForPreview(size, maxBytes) {
-  return {
-    error: `File too large for preview (${(size / 1024 / 1024).toFixed(1)} MB, max ${maxBytes / 1024 / 1024} MB)`
-  };
-}
-function hexdump(buf) {
-  const lines = [];
-  for (let off = 0; off < buf.length; off += 16) {
-    const slice = buf.subarray(off, off + 16);
-    const hex = [];
-    let ascii = "";
-    for (let i = 0; i < 16; i++) {
-      if (i < slice.length) {
-        const b = slice[i];
-        hex.push(b.toString(16).padStart(2, "0"));
-        ascii += b >= 32 && b <= 126 ? String.fromCharCode(b) : ".";
-      } else {
-        hex.push("  ");
-      }
-      if (i === 7) hex.push("");
-    }
-    lines.push(`${off.toString(16).padStart(8, "0")}  ${hex.join(" ")}  |${ascii}|`);
-  }
-  return lines.join("\n");
+  return lines.join("\n");
 }
 function registerWorkspaceRoutes(app, manager) {
   app.get(
     "/api/sessions/:id/tree",
     async (req, reply) => {
-      let cwd;
-      try {
-        cwd = await manager.getSessionCwd(req.params.id);
-      } catch {
-        reply.code(404);
-        return { error: "Session not found" };
-      }
-      const relative = (req.query.path ?? "").replace(/^\/+/, "");
-      const target = confineToRoot(cwd, relative);
-      if (!target) {
-        reply.code(400);
-        return { error: "Invalid path" };
-      }
-      const workspaceMissing = async () => {
-        try {
-          return !(await fs12.stat(cwd)).isDirectory();
-        } catch {
-          return true;
-        }
-      };
-      const notFound = async () => {
-        reply.code(404);
-        return await workspaceMissing() ? { error: `Workspace folder no longer exists: ${cwd}` } : { error: "Directory not found" };
-      };
-      const realTarget = await realConfineToRoot(config.fileRoot, target);
-      if (!realTarget) {
-        return notFound();
-      }
+      const resolved = await resolveSessionPath(
+        manager,
+        req.params.id,
+        req.query.path,
+        "directory"
+      );
+      if (!resolved.ok) return replyWith(reply, resolved);
+      const { cwd, relative, real: realTarget } = resolved;
       let dirents;
       try {
-        dirents = await fs12.readdir(realTarget, { withFileTypes: true, encoding: "utf8" });
+        dirents = await fs13.readdir(realTarget, { withFileTypes: true, encoding: "utf8" });
       } catch {
-        return notFound();
+        return replyWith(reply, await workspaceNotFound(cwd));
       }
       const entries = [];
       for (const d of dirents) {
-        const name = d.name;
-        const entryRelative = relative ? `${relative}/${name}` : name;
-        const entryAbsolute = path14.join(realTarget, name);
-        let kind = d.isDirectory() ? "directory" : d.isFile() ? "file" : null;
-        let statTarget = entryAbsolute;
-        if (kind === null && d.isSymbolicLink()) {
-          const real = await realConfineToRoot(config.fileRoot, entryAbsolute);
-          if (!real) continue;
-          try {
-            const st = await fs12.stat(real);
-            kind = st.isDirectory() ? "directory" : st.isFile() ? "file" : null;
-            statTarget = real;
-          } catch {
-            continue;
-          }
+        const target = await classifyDirent(realTarget, d, [config.fileRoot]);
+        if (!target) continue;
+        const entryRelative = relative ? `${relative}/${d.name}` : d.name;
+        if (target.kind === "directory") {
+          entries.push({ name: d.name, path: entryRelative, type: "directory" });
+          continue;
         }
-        if (kind === null) continue;
-        if (kind === "directory") {
-          entries.push({ name, path: entryRelative, type: "directory" });
-        } else {
-          try {
-            const stat = await fs12.stat(statTarget);
-            entries.push({
-              name,
-              path: entryRelative,
-              type: "file",
-              size: stat.size,
-              modifiedAt: stat.mtime.toISOString()
-            });
-          } catch {
-          }
+        try {
+          const stat = await fs13.stat(target.real);
+          entries.push({
+            name: d.name,
+            path: entryRelative,
+            type: "file",
+            size: stat.size,
+            modifiedAt: stat.mtime.toISOString()
+          });
+        } catch {
         }
       }
       entries.sort((a, b) => {
@@ -2764,45 +2800,15 @@ function registerWorkspaceRoutes(app, manager) {
   app.get(
     "/api/sessions/:id/download",
     async (req, reply) => {
-      let cwd;
-      try {
-        cwd = await manager.getSessionCwd(req.params.id);
-      } catch {
-        reply.code(404);
-        return { error: "Session not found" };
-      }
-      const relative = (req.query.path ?? "").replace(/^\/+/, "");
-      if (!relative) {
-        reply.code(400);
-        return { error: "path parameter is required" };
-      }
-      const target = confineToRoot(cwd, relative);
-      if (!target) {
-        reply.code(400);
-        return { error: "Invalid path" };
-      }
-      const realTarget = await realConfineToRoot(config.fileRoot, target);
-      if (!realTarget) {
-        reply.code(404);
-        return { error: "File not found" };
-      }
-      let stat;
-      try {
-        stat = await fs12.stat(realTarget);
-      } catch {
-        reply.code(404);
-        return { error: "File not found" };
-      }
-      if (!stat.isFile()) {
-        reply.code(400);
-        return { error: "Path is not a file" };
-      }
+      const resolved = await resolveSessionPath(manager, req.params.id, req.query.path, "file");
+      if (!resolved.ok) return replyWith(reply, resolved);
+      const { real: realTarget, stat } = resolved;
       if (stat.size > MAX_DOWNLOAD_BYTES) {
         reply.code(413);
         return { error: `File too large (${(stat.size / 1024 / 1024).toFixed(1)} MB, max 100 MB)` };
       }
-      const ext = path14.extname(realTarget);
-      const filename = path14.basename(realTarget);
+      const ext = path15.extname(realTarget);
+      const filename = path15.basename(realTarget);
       const asciiName = filename.replace(/[^\w.\-]/g, "_");
       reply.header("Content-Type", mimeForExt(ext));
       reply.header(
@@ -2816,40 +2822,10 @@ function registerWorkspaceRoutes(app, manager) {
   app.get(
     "/api/sessions/:id/preview",
     async (req, reply) => {
-      let cwd;
-      try {
-        cwd = await manager.getSessionCwd(req.params.id);
-      } catch {
-        reply.code(404);
-        return { error: "Session not found" };
-      }
-      const relative = (req.query.path ?? "").replace(/^\/+/, "");
-      if (!relative) {
-        reply.code(400);
-        return { error: "path parameter is required" };
-      }
-      const target = confineToRoot(cwd, relative);
-      if (!target) {
-        reply.code(400);
-        return { error: "Invalid path" };
-      }
-      const realTarget = await realConfineToRoot(config.fileRoot, target);
-      if (!realTarget) {
-        reply.code(404);
-        return { error: "File not found" };
-      }
-      let stat;
-      try {
-        stat = await fs12.stat(realTarget);
-      } catch {
-        reply.code(404);
-        return { error: "File not found" };
-      }
-      if (!stat.isFile()) {
-        reply.code(400);
-        return { error: "Path is not a file" };
-      }
-      const ext = path14.extname(realTarget).toLowerCase();
+      const resolved = await resolveSessionPath(manager, req.params.id, req.query.path, "file");
+      if (!resolved.ok) return replyWith(reply, resolved);
+      const { real: realTarget, stat } = resolved;
+      const ext = path15.extname(realTarget).toLowerCase();
       const mime = mimeForExt(ext);
       const isImage = mime.startsWith("image/");
       const isPdf = mime === "application/pdf";
@@ -2878,7 +2854,7 @@ function registerWorkspaceRoutes(app, manager) {
       }
       if (isImage || isPdf) {
         const etag = `W/"${stat.size}-${stat.mtimeMs}"`;
-        reply.header("Cache-Control", "private, max-age=3600");
+        reply.header("Cache-Control", "private, no-cache");
         reply.header("ETag", etag);
         reply.header("Last-Modified", stat.mtime.toUTCString());
         const ifNoneMatch = req.headers["if-none-match"];
@@ -2894,7 +2870,7 @@ function registerWorkspaceRoutes(app, manager) {
       if (kind === "binary") {
         let fh;
         try {
-          fh = await fs12.open(realTarget, "r");
+          fh = await fs13.open(realTarget, "r");
           const buf = Buffer.alloc(Math.min(HEXDUMP_BYTES, stat.size));
           const { bytesRead } = await fh.read(buf, 0, buf.length, 0);
           const head = buf.subarray(0, bytesRead);
@@ -2933,7 +2909,7 @@ var init_workspace = __esm({
   "server/src/routes/workspace.ts"() {
     "use strict";
     init_config();
-    init_paths2();
+    init_confinedFile();
     init_filekind();
     MAX_DOWNLOAD_BYTES = 100 * 1024 * 1024;
     HEXDUMP_BYTES = 4096;
@@ -2944,30 +2920,30 @@ var init_workspace = __esm({
 
 // server/src/routes/uploads.ts
 import { createReadStream as createReadStream3, createWriteStream } from "node:fs";
-import fs13 from "node:fs/promises";
-import path15 from "node:path";
+import fs14 from "node:fs/promises";
+import path16 from "node:path";
 import crypto5 from "node:crypto";
 import { execFile as execFile3 } from "node:child_process";
 import { pipeline } from "node:stream/promises";
 function uploadDirFor(sessionId) {
-  return path15.join(config.casperDataDir, "sessions", sessionId, "uploads");
+  return path16.join(config.casperDataDir, "sessions", sessionId, "uploads");
 }
 function sanitizeName(raw) {
-  const base = path15.basename(raw).replace(/[^\w.\- ]/g, "_").trim();
+  const base = path16.basename(raw).replace(/[^\w.\- ]/g, "_").trim();
   if (!base || base === "." || base === "..") return `upload-${Date.now()}`;
   return base.replace(/^\.+/, "") || `upload-${Date.now()}`;
 }
 async function uniquePath(dir, name) {
-  const ext = path15.extname(name);
+  const ext = path16.extname(name);
   const stem = name.slice(0, name.length - ext.length);
   let candidate = name;
   let n = 1;
   while (true) {
     try {
-      await fs13.access(path15.join(dir, candidate));
+      await fs14.access(path16.join(dir, candidate));
       candidate = `${stem} (${n++})${ext}`;
     } catch {
-      return path15.join(dir, candidate);
+      return path16.join(dir, candidate);
     }
   }
 }
@@ -2987,7 +2963,7 @@ function fileType(absPath) {
 async function sampleStrings(absPath, limit = 40) {
   let fh;
   try {
-    fh = await fs13.open(absPath, "r");
+    fh = await fs14.open(absPath, "r");
     const buf = Buffer.alloc(STRINGS_SCAN_BYTES);
     const { bytesRead } = await fh.read(buf, 0, STRINGS_SCAN_BYTES, 0);
     const out = [];
@@ -3025,7 +3001,7 @@ function registerUploadRoutes(app, manager) {
         return { error: "Invalid session id" };
       }
       const uploadDir = uploadDirFor(req.params.id);
-      await fs13.mkdir(uploadDir, { recursive: true, mode: 448 });
+      await fs14.mkdir(uploadDir, { recursive: true, mode: 448 });
       const results = [];
       const parts = req.files();
       for await (const part of parts) {
@@ -3039,17 +3015,17 @@ function registerUploadRoutes(app, manager) {
           return { error: `Failed to store ${name}` };
         }
         if (part.file.truncated) {
-          await fs13.rm(dest, { force: true });
+          await fs14.rm(dest, { force: true });
           reply.code(413);
           return {
             error: `${name} exceeds the max upload size (${Math.round(config.maxUploadBytes / 1024 / 1024)} MB)`
           };
         }
-        const stat = await fs13.stat(dest);
-        const ext = path15.extname(dest);
+        const stat = await fs14.stat(dest);
+        const ext = path16.extname(dest);
         const kind = classifyKind(dest);
         const uploaded = {
-          name: path15.basename(dest),
+          name: path16.basename(dest),
           // Absolute, because the file sits outside the session's workspace: a
           // relative path would resolve against the wrong root for both the agent
           // and the image endpoint.
@@ -3106,97 +3082,8 @@ var init_health = __esm({
   }
 });
 
-// server/src/ws/dispatch.ts
-function send(socket, msg) {
-  if (socket.readyState === socket.OPEN) socket.send(JSON.stringify(msg));
-}
-async function handleClientMessage(socket, manager, sessionId, msg, watchers) {
-  switch (msg.type) {
-    case "ping":
-      send(socket, { type: "pong" });
-      return;
-    case "hello":
-      return;
-    case "watch_paths":
-      await watchers.sync(msg.paths);
-      return;
-    case "prompt":
-      try {
-        await manager.runPrompt(sessionId, msg.content);
-        send(socket, { type: "ack", action: "prompt", ok: true });
-      } catch (err) {
-        send(socket, {
-          type: "ack",
-          action: "prompt",
-          ok: false,
-          error: err.message
-        });
-      }
-      return;
-    case "cancel":
-      try {
-        manager.cancel(sessionId);
-        send(socket, { type: "ack", action: "cancel", ok: true });
-      } catch (err) {
-        send(socket, {
-          type: "ack",
-          action: "cancel",
-          ok: false,
-          error: err.message
-        });
-      }
-      return;
-    case "set_mode":
-      try {
-        await manager.setMode(sessionId, msg.modeId);
-        send(socket, { type: "ack", action: "set_mode", ok: true });
-      } catch (err) {
-        send(socket, {
-          type: "ack",
-          action: "set_mode",
-          ok: false,
-          error: err.message
-        });
-      }
-      return;
-    case "set_model":
-      try {
-        await manager.setModel(sessionId, msg.modelId);
-        send(socket, { type: "ack", action: "set_model", ok: true });
-      } catch (err) {
-        send(socket, {
-          type: "ack",
-          action: "set_model",
-          ok: false,
-          error: err.message
-        });
-      }
-      return;
-    case "exec_command":
-      try {
-        await manager.execCommand(sessionId, msg.command, msg.args);
-        send(socket, { type: "ack", action: "exec_command", ok: true });
-      } catch (err) {
-        send(socket, {
-          type: "ack",
-          action: "exec_command",
-          ok: false,
-          error: err.message
-        });
-      }
-      return;
-    default:
-      send(socket, { type: "error", message: `Unknown message type` });
-  }
-}
-var init_dispatch = __esm({
-  "server/src/ws/dispatch.ts"() {
-    "use strict";
-  }
-});
-
 // server/src/ws/dirWatchers.ts
-import fs14 from "node:fs";
+import fs15 from "node:fs";
 function diffWatchSet(current, next) {
   const have = new Set(current);
   const want = new Set(next.slice(0, MAX_WATCHES));
@@ -3220,7 +3107,7 @@ function createDirWatchers(opts) {
     const target = await opts.resolve(relative);
     if (!target || closed) return;
     try {
-      const watcher = fs14.watch(target, { persistent: false }, () => {
+      const watcher = fs15.watch(target, { persistent: false }, () => {
         const existing = timers.get(relative);
         if (existing) clearTimeout(existing);
         timers.set(
@@ -3262,6 +3149,122 @@ var init_dirWatchers = __esm({
 });
 
 // server/src/ws/gateway.ts
+function send(socket, msg) {
+  if (socket.readyState === socket.OPEN) socket.send(JSON.stringify(msg));
+}
+function handleConnection(socket, manager, sessionId, startCursor) {
+  let cursor = startCursor;
+  let unsubscribe = null;
+  let alive = true;
+  let ready = false;
+  const watchers = createDirWatchers({
+    resolve: async (relative) => {
+      try {
+        return confineToRoot(await manager.getSessionCwd(sessionId), relative);
+      } catch {
+        return null;
+      }
+    },
+    onChange: (path19) => send(socket, { type: "fs_changed", path: path19 })
+  });
+  const forward = (event) => {
+    if (event.seq <= cursor) return;
+    cursor = event.seq;
+    send(socket, { type: "event", event });
+  };
+  const attach = async () => {
+    try {
+      await manager.ensureOpen(sessionId);
+    } catch (err) {
+      send(socket, { type: "error", message: err.message });
+      socket.close(1011, "open failed");
+      return;
+    }
+    const store = manager.getStore(sessionId);
+    if (!store) {
+      send(socket, { type: "error", message: "Session store unavailable" });
+      socket.close(1011, "no store");
+      return;
+    }
+    const { events, gap } = store.getSince(cursor);
+    if (gap) {
+      send(socket, {
+        type: "resync",
+        reason: "cursor older than buffer; refetch full transcript"
+      });
+      cursor = store.head();
+    } else {
+      for (const e of events) forward(e);
+    }
+    send(socket, { type: "replay_complete", head: store.head() });
+    unsubscribe = manager.onEvent(sessionId, forward);
+    ready = true;
+  };
+  void attach();
+  const ack = async (action, run) => {
+    try {
+      await run();
+      send(socket, { type: "ack", action, ok: true });
+    } catch (err) {
+      send(socket, { type: "ack", action, ok: false, error: err.message });
+    }
+  };
+  const handle2 = (msg) => {
+    switch (msg.type) {
+      case "ping":
+        return send(socket, { type: "pong" });
+      case "watch_paths":
+        return watchers.sync(msg.paths);
+      case "prompt":
+        return ack("prompt", () => manager.runPrompt(sessionId, msg.content));
+      case "cancel":
+        return ack("cancel", () => manager.cancel(sessionId));
+      case "set_mode":
+        return ack("set_mode", () => manager.setMode(sessionId, msg.modeId));
+      case "set_model":
+        return ack("set_model", () => manager.setModel(sessionId, msg.modelId));
+      case "exec_command":
+        return ack(
+          "exec_command",
+          () => manager.execCommand(sessionId, msg.command, msg.args)
+        );
+      default:
+        return send(socket, { type: "error", message: "Unknown message type" });
+    }
+  };
+  const heartbeat = setInterval(() => {
+    if (!alive) {
+      socket.terminate();
+      return;
+    }
+    alive = false;
+    try {
+      socket.ping();
+    } catch {
+    }
+  }, HEARTBEAT_MS);
+  heartbeat.unref?.();
+  socket.on("pong", () => {
+    alive = true;
+  });
+  socket.on("message", (raw) => {
+    alive = true;
+    if (!ready) return;
+    let msg;
+    try {
+      msg = JSON.parse(raw.toString());
+    } catch {
+      send(socket, { type: "error", message: "Invalid JSON" });
+      return;
+    }
+    void handle2(msg);
+  });
+  socket.on("close", () => {
+    clearInterval(heartbeat);
+    unsubscribe?.();
+    watchers.close();
+  });
+}
 function registerWsGateway(app, manager) {
   app.get("/ws", { websocket: true }, (socket, req) => {
     const query = req.query;
@@ -3270,92 +3273,17 @@ function registerWsGateway(app, manager) {
       socket.close(1008, "Unauthorized");
       return;
     }
-    const sessionId = query.sessionId;
-    if (!sessionId) {
+    if (!query.sessionId) {
       send(socket, { type: "error", message: "Missing sessionId" });
       socket.close(1008, "Missing sessionId");
       return;
     }
-    let cursor = Number.parseInt(query.cursor ?? "0", 10) || 0;
-    let unsubscribe = null;
-    const watchers = createDirWatchers({
-      resolve: async (relative) => {
-        try {
-          return confineToRoot(await manager.getSessionCwd(sessionId), relative);
-        } catch {
-          return null;
-        }
-      },
-      onChange: (path18) => send(socket, { type: "fs_changed", path: path18 })
-    });
-    let alive = true;
-    let ready = false;
-    const forward = (event) => {
-      if (event.seq <= cursor) return;
-      cursor = event.seq;
-      send(socket, { type: "event", event });
-    };
-    const attach = async () => {
-      try {
-        await manager.ensureOpen(sessionId);
-      } catch (err) {
-        send(socket, { type: "error", message: err.message });
-        socket.close(1011, "open failed");
-        return;
-      }
-      const store = manager.getStore(sessionId);
-      if (!store) {
-        send(socket, { type: "error", message: "Session store unavailable" });
-        socket.close(1011, "no store");
-        return;
-      }
-      const { events, gap } = store.getSince(cursor);
-      if (gap) {
-        send(socket, {
-          type: "resync",
-          reason: "cursor older than buffer; refetch full transcript"
-        });
-        cursor = store.head();
-      } else {
-        for (const e of events) forward(e);
-      }
-      send(socket, { type: "replay_complete", head: store.head() });
-      unsubscribe = manager.onEvent(sessionId, forward);
-      ready = true;
-    };
-    void attach();
-    const heartbeat = setInterval(() => {
-      if (!alive) {
-        socket.terminate();
-        return;
-      }
-      alive = false;
-      try {
-        socket.ping();
-      } catch {
-      }
-    }, HEARTBEAT_MS);
-    heartbeat.unref?.();
-    socket.on("pong", () => {
-      alive = true;
-    });
-    socket.on("message", (raw) => {
-      alive = true;
-      if (!ready) return;
-      let msg;
-      try {
-        msg = JSON.parse(raw.toString());
-      } catch {
-        send(socket, { type: "error", message: "Invalid JSON" });
-        return;
-      }
-      void handleClientMessage(socket, manager, sessionId, msg, watchers);
-    });
-    socket.on("close", () => {
-      clearInterval(heartbeat);
-      unsubscribe?.();
-      watchers.close();
-    });
+    handleConnection(
+      socket,
+      manager,
+      query.sessionId,
+      Number.parseInt(query.cursor ?? "0", 10) || 0
+    );
   });
 }
 var HEARTBEAT_MS;
@@ -3363,7 +3291,6 @@ var init_gateway = __esm({
   "server/src/ws/gateway.ts"() {
     "use strict";
     init_auth();
-    init_dispatch();
     init_dirWatchers();
     init_paths2();
     HEARTBEAT_MS = 2e4;
@@ -3371,7 +3298,7 @@ var init_gateway = __esm({
 });
 
 // server/src/app.ts
-import fs15 from "node:fs";
+import fs16 from "node:fs";
 import Fastify from "fastify";
 import cors from "@fastify/cors";
 import websocket from "@fastify/websocket";
@@ -3409,20 +3336,20 @@ async function buildApp() {
   registerWorkspaceRoutes(app, manager);
   registerUploadRoutes(app, manager);
   registerWsGateway(app, manager);
-  if (fs15.existsSync(config.webDist)) {
+  if (fs16.existsSync(config.webDist)) {
     await app.register(fastifyStatic, {
       root: config.webDist
     });
     app.addHook("onSend", async (req, reply) => {
-      const path18 = req.url.split("?")[0] ?? "";
-      if (path18 === "/manifest.json" || path18.startsWith("/icons/")) {
+      const path19 = req.url.split("?")[0] ?? "";
+      if (path19 === "/manifest.json" || path19.startsWith("/icons/")) {
         reply.header("cache-control", "public, max-age=300");
       }
     });
     app.setNotFoundHandler((req, reply) => {
-      const path18 = req.url.split("?")[0] ?? "";
-      const looksLikeAsset = path18.startsWith("/assets/") || /\.[a-zA-Z0-9]+$/.test(path18);
-      if (path18.startsWith("/api/") || path18.startsWith("/ws") || looksLikeAsset) {
+      const path19 = req.url.split("?")[0] ?? "";
+      const looksLikeAsset = path19.startsWith("/assets/") || /\.[a-zA-Z0-9]+$/.test(path19);
+      if (path19.startsWith("/api/") || path19.startsWith("/ws") || looksLikeAsset) {
         reply.code(404).send({ error: "Not found" });
         return;
       }
@@ -3496,15 +3423,15 @@ __export(doctor_exports, {
   mcpWiring: () => mcpWiring
 });
 import { execFileSync as execFileSync3 } from "node:child_process";
-import fs16 from "node:fs";
-import path16 from "node:path";
+import fs17 from "node:fs";
+import path17 from "node:path";
 function which(bin) {
-  if (bin.includes("/")) return fs16.existsSync(bin) ? bin : void 0;
-  for (const dir of (process.env.PATH ?? "").split(path16.delimiter)) {
+  if (bin.includes("/")) return fs17.existsSync(bin) ? bin : void 0;
+  for (const dir of (process.env.PATH ?? "").split(path17.delimiter)) {
     if (dir === "") continue;
-    const candidate = path16.join(dir, bin);
+    const candidate = path17.join(dir, bin);
     try {
-      fs16.accessSync(candidate, fs16.constants.X_OK);
+      fs17.accessSync(candidate, fs17.constants.X_OK);
       return candidate;
     } catch {
     }
@@ -3528,7 +3455,7 @@ function mcpWiring(agentJson, resolve) {
     return { ok: false, detail: `${command || "(no command)"} not found - widgets are unavailable` };
   }
   const script = args.find((a) => a.endsWith(".js"));
-  if (script && !fs16.existsSync(script)) {
+  if (script && !fs17.existsSync(script)) {
     return { ok: false, detail: `${script} is gone - delete the agent file and restart to rewrite it` };
   }
   return { ok: true, detail: script ?? `${command} ${args.join(" ")}` };
@@ -3560,7 +3487,7 @@ function checks() {
   const settings = readSettings(config.configFile);
   const hasToken = typeof settings.token === "string" && settings.token !== "";
   out.push(
-    fs16.existsSync(config.configFile) ? {
+    fs17.existsSync(config.configFile) ? {
       ok: hasToken,
       name: "settings",
       detail: hasToken ? `${config.configFile} (token set)` : `${config.configFile} exists but has no token - auth is DISABLED`
@@ -3570,8 +3497,8 @@ function checks() {
       detail: `${config.configFile} not found; a token is generated on first run`
     }
   );
-  if (fs16.existsSync(config.configFile)) {
-    const mode = fs16.statSync(config.configFile).mode & 511;
+  if (fs17.existsSync(config.configFile)) {
+    const mode = fs17.statSync(config.configFile).mode & 511;
     out.push({
       ok: mode === 384,
       name: "settings mode",
@@ -3579,10 +3506,10 @@ function checks() {
     });
   }
   try {
-    fs16.mkdirSync(config.casperDataDir, { recursive: true });
-    fs16.accessSync(config.casperDataDir, fs16.constants.W_OK);
-    const db2 = path16.join(config.casperDataDir, "casper.db");
-    const size = fs16.existsSync(db2) ? `, casper.db ${(fs16.statSync(db2).size / 1024).toFixed(0)} KB` : "";
+    fs17.mkdirSync(config.casperDataDir, { recursive: true });
+    fs17.accessSync(config.casperDataDir, fs17.constants.W_OK);
+    const db2 = path17.join(config.casperDataDir, "casper.db");
+    const size = fs17.existsSync(db2) ? `, casper.db ${(fs17.statSync(db2).size / 1024).toFixed(0)} KB` : "";
     out.push({ ok: true, name: "data dir", detail: `${config.casperDataDir} writable${size}` });
   } catch (err) {
     out.push({
@@ -3593,22 +3520,22 @@ function checks() {
     });
   }
   out.push(
-    fs16.existsSync(config.webDist) ? { ok: true, name: "web app", detail: config.webDist } : {
+    fs17.existsSync(config.webDist) ? { ok: true, name: "web app", detail: config.webDist } : {
       ok: false,
       fatal: true,
       name: "web app",
       detail: `${config.webDist} not found - the package is incomplete or CASPER_WEB_DIST is wrong`
     }
   );
-  const agent = path16.join(config.kiroSessionsDir, "..", "..", "agents", "casper.json");
-  const hasAgent = fs16.existsSync(agent);
+  const agent = path17.join(config.kiroSessionsDir, "..", "..", "agents", "casper.json");
+  const hasAgent = fs17.existsSync(agent);
   out.push({
     ok: hasAgent,
     name: "casper agent",
     detail: hasAgent ? agent : `${agent} missing - it is installed on first run`
   });
   if (hasAgent) {
-    const wiring = mcpWiring(fs16.readFileSync(agent, "utf8"), which);
+    const wiring = mcpWiring(fs17.readFileSync(agent, "utf8"), which);
     out.push({ ok: wiring.ok, name: "casper mcp", detail: wiring.detail });
   }
   return out;
@@ -4072,14 +3999,14 @@ var init_server2 = __esm({
   "server/src/mcp/server.ts"() {
     "use strict";
     init_protocol();
-    VERSION = true ? "0.9.7" : "dev";
+    VERSION = true ? "0.10.0" : "dev";
   }
 });
 
 // server/src/cli/program.ts
-import fs17 from "node:fs";
+import fs18 from "node:fs";
 import os4 from "node:os";
-import path17 from "node:path";
+import path18 from "node:path";
 
 // server/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -7192,9 +7119,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path18) {
-    if (path18 === void 0) return this._executableDir;
-    this._executableDir = path18;
+  executableDir(path19) {
+    if (path19 === void 0) return this._executableDir;
+    this._executableDir = path19;
     return this;
   }
   /**
@@ -7452,7 +7379,7 @@ var program = new Command();
 // server/src/cli/program.ts
 init_paths();
 init_settings();
-var VERSION2 = true ? "0.9.7" : "dev";
+var VERSION2 = true ? "0.10.0" : "dev";
 async function bootstrap() {
   const file = configFilePath();
   const settings = readSettings(file);
@@ -7498,8 +7425,8 @@ async function resetToken(value) {
   updateSettings(file, { token });
   process.stdout.write(`wrote a new token to ${file}
 `);
-  const dbFile = path17.join(dataDirPath(), "casper.db");
-  if (fs17.existsSync(dbFile)) {
+  const dbFile = path18.join(dataDirPath(), "casper.db");
+  if (fs18.existsSync(dbFile)) {
     const { LoginStore: LoginStore2 } = await Promise.resolve().then(() => (init_logins(), logins_exports));
     new LoginStore2().revokeAll();
     process.stdout.write("revoked all device sessions\n");