@midhunxavier/code-flow 0.0.0-stage → 0.1.0-preview.1

package/src/server.js

@@ -0,0 +1,2738 @@
+import { HISTORY_STATUSES } from "./run-status.js";
+import { modelCatalogStore } from "./model-catalog.js";
+import { permissionProviderProblem, createRunPermissions as catalogPermissions } from "./run-permissions.js";
+import { inheritRunEnvironment } from "./run-environment.js";
+import { teamTemplateStore } from "./team-template-store.js";
+import { fillTeamTemplate, validateTeamTemplate } from "./team-templates.js";
+import { antigravityExecution, AGY_NATIVE_LIMITATION, createRunPermissions, narrowerTrust, resolveRunPermissions, permissionRequirements } from "./run-permissions.js";
+import { TeamTerminals, handleTeamTerminals } from "./collab/terminals.js";
+import { HostExecution, handleHostExecution } from "./collab/host-execution.js";
+import { closeCodeIntelligence, codeIntelligenceHealth } from "./code-intelligence.js";
+import { sendAsset } from "./assets.js";
+import { transcriptPage, transcriptPreview, TranscriptCursorError } from "./transcript.js";
+import { createSseWriter, streamHealth } from "./sse-writer.js";
+import { PerformanceMetrics } from "./performance.js";
+import { JourneyStore } from "./journey-store.js";
+import { journeyApi } from "./journey-api.js";
+import { taskIntent, outcomeMetrics, workflowRecommendations } from "./experience.js";
+import { join } from "node:path";
+import { CertificateRenewal } from "./certificate-renewal.js";
+import { loadRemoteCertificate, saveRemoteCertificate, validateRemoteCertificate, certificateHostname } from "./remote-tls.js";
+import { requestTailscaleCertificate } from "./tailscale.js";
+import { ProjectTeams } from "./project-teams.js";
+import { handleProjectTeams } from "./project-teams-api.js";
+import { SshProjects } from "./ssh-projects/manager.js";
+import { readFileSync } from "node:fs";
+import { ProjectFilePolicies, FilePolicyError, assertPolicyExecution, configureFilePolicyResolver, filterPolicyDiff, policyIsRestrictive } from "./filesystem-policy.js";
+import { FilesystemAccess } from "./filesystem-access.js";
+import { createCodeHostsApi } from "./code-hosts-api.js";
+import { FilteredTasks, FilteredTaskError } from "./filtered-tasks.js";
+import { handleFilteredTasksApi } from "./filtered-tasks-api.js";
+import { createServer as createSecureServer } from "node:https";
+import { PhoneSessions } from "./phone-sessions.js";
+import { createServer } from "node:http";
+import { createHash, randomBytes } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { brotliCompress, constants as zlib, gzip } from "node:zlib";
+import {
+  agentAvailability,
+  AGENT_IDS,
+  registerProviderAdapters,
+  replaceAcpAdapters,
+  agentCatalog,
+  adapters,
+  getAdapter,
+  isAgentId,
+  validateAgentSettings
+} from "./adapters/index.js";
+import { listTree, readRepoFile, searchFiles } from "./repo-tree.js";
+import { checkGit, doctor } from "./doctor.js";
+import { readRepoConfig } from "./repo-config.js";
+import { openFolder } from "./serve.js";
+import { LaunchProfiles, LaunchProfileError, readLaunchProfiles } from "./launch-profiles.js";
+import { TeamRerunError } from "./team-reruns.js";
+import { ConventionsStore, ConventionsError } from "./conventions.js";
+import { discoverDependencies } from "./dependency-health.js";
+import { DeferredRunConflictError, sanitizeDeferredRequest } from "./deferred-runs.js";
+import { createDeferredRuns, persistDeferredReceipt, recoverDeferredRuns } from "./deferred-launch.js";
+import { validateContextBudget } from "./context-budget.js";
+import { RetentionPolicyStore, RetentionPolicyConflictError, previewRetention } from "./retention-policy.js";
+import { SharedAccounts, SharedAccountError } from "./shared-accounts.js";
+import { canonicalSharedPath, SharedPathError } from "./shared-access.js";
+import { CollaborationReviews, CollaborationReviewError } from "./collaboration-reviews.js";
+import { handleSharedApi } from "./shared-api.js";
+import { CollabStore, memberActor, ownerActor } from "./collab/store.js";
+import { handleRunnerConnect, handleTeamApi, looksLikeRunnerToken, runnerAllowed, teamRoutePolicy } from "./collab/api.js";
+import { CollabError } from "./collab/model.js";
+import { TeamConnections } from "./collab/connections.js";
+import { handleTeamLinkApi, linkInfo } from "./collab/link-api.js";
+import { userInfo } from "node:os";
+import { RemoteWorkers } from "./remote-workers/client.js";
+import { createCoordinatedApi } from "./coordinated-api.js";
+import { Extensions } from "./extensions.js";
+import { ShellLimitError, Shells } from "./shell.js";
+import { cursorSeq, StreamHub, TopicError } from "./stream.js";
+import { replayEvents } from "./run-log.js";
+import { previewTarget, Previews } from "./preview.js";
+import { SnapshotError, takeSnapshot } from "./snapshot.js";
+import { Integrations } from "./integrations.js";
+import { Notifications } from "./notifications.js";
+import { GithubReviewThreads, ReviewThreadError } from "./github-review-threads.js";
+import { approvals } from "./approvals.js";
+import { validateAgentContainer } from "./agent-container.js";
+import { Notes, NotesConflictError } from "./notes.js";
+import { HttpError, readJson, readLoginJson, send } from "./http.js";
+import { handleWorkspaceApi } from "./workspace-api.js";
+import { TeamPlanEditError } from "./workflow-control.js";
+import { analyzeProjectMemory } from "./memory-analysis.js";
+import { redactExport } from "./privacy.js";
+import { validateVerificationProfile, renderVerificationReport } from "./verification.js";
+import { CODEFLOW_HOME, autoTeamEnabled, envNumber, PORT } from "./config.js";
+import { RunManager, RunConflictError, UntrustedSourceError } from "./engine.js";
+import { detectCheckCommand } from "./checks.js";
+import { findPattern, patterns } from "./patterns/index.js";
+import { listDirectories } from "./fs.js";
+import { git, listBranches, repoRoot, worktreeRoot } from "./git.js";
+import { stat } from "node:fs/promises";
+import { folderSizes, remoteBranches, removeWorktrees } from "./ship.js";
+import { computeStats, rankAgents } from "./stats.js";
+import { acquireLock, writeHealth, writeQueueStats, loadJournal } from "./store.js";
+import { reapOrphanGroups } from "./adapters/process.js";
+import { logError, logInfo, logWarn } from "./log.js";
+import { listIssues, listPullRequests, MERGE_METHODS } from "./github.js";
+import { listSweep, runSweep, sourceKeys } from "./sweeps.js";
+import { parseImproveSettings, IMPROVE_AGENTS } from "./improve-settings.js";
+import { exhausted, resolveAuto } from "./routing.js";
+import { DocsHelp, serveDocs, parseHelpRequest } from "./docs-help.js";
+import { improvePrompt, assertImproveEnvironment, ImproveError, MAX_IMPROVE_CHARS } from "./improve.js";
+import { templates } from "./templates.js";
+import { PrWatcher } from "./watch.js";
+import { Automations, describeSchedule, readWebhook, validateSchedule, previewSchedule } from "./automation.js";
+import { detectTailscale, isTailscaleIPv4 } from "./tailscale.js";
+import { changeRemote, isOwnAddress, lanAddresses, loadRemote, renderRemote, saveRemote, tokenMatches } from "./remote.js";
+import { projectOf, Projects } from "./projects.js";
+import { memoryStore, MemoryConflictError } from "./memory.js";
+import { adapterTeamCapabilities } from "./adapters/team-tools.js";
+import { createAcpAdapter, probeAcp } from "./adapters/acp.js";
+import { AcpConnections, validateAcpConnection } from "./acp-connections.js";
+import { teamToolBridge } from "./team-tools.js";
+import { teamEvaluationStore, buildTeamEvaluation, assessTeamRollout } from "./team-evaluation.js";
+const releaseLock = await acquireLock().catch((err) => {
+  console.error(err.message);
+  process.exit(1);
+});
+const reviewThreads = new GithubReviewThreads();
+process.once("exit", releaseLock);
+const recentCrashes = [];
+process.on("unhandledRejection", (reason) => logError("Unhandled promise rejection", reason));
+process.on("uncaughtException", (err) => {
+  logError("Uncaught exception", err);
+  const now = Date.now();
+  recentCrashes.push(now);
+  while (recentCrashes[0] < now - 6e4) recentCrashes.shift();
+  if (recentCrashes.length >= 10) void stop("too many uncaught exceptions in a minute", 1);
+});
+const reaped = await reapOrphanGroups();
+if (reaped) logInfo(`Stopped ${reaped} process group(s) a previous code-flow left running`);
+const extensions = new Extensions({ register: (providers, workflows) => {
+  const ids = workflows.map((workflow) => workflow.id);
+  if (new Set(ids).size !== ids.length || ids.some((id) => !!findPattern(id))) throw new Error("Workflow IDs must be unique and cannot replace installed patterns");
+  const available = /* @__PURE__ */ new Set([...AGENT_IDS, ...providers.map((provider) => provider.id)]);
+  if (workflows.some((workflow) => workflow.roles.some((role) => role.default.some((id) => !available.has(id))))) throw new Error("Workflow default roles must name registered providers");
+  registerProviderAdapters(providers);
+  patterns.push(...workflows);
+} });
+const projects = new Projects();
+const acpConnections = new AcpConnections((connections) => replaceAcpAdapters(connections.map(createAcpAdapter)));
+let acpChecks = 0;
+const remoteWorkers = new RemoteWorkers();
+await remoteWorkers.load().catch((error) => logError("SSH workers disabled; repair their configuration to enable remote execution", error));
+const manager = new RunManager(findPattern, projects, remoteWorkers);
+const filePolicies = new ProjectFilePolicies();
+const fileAccess = new FilesystemAccess(filePolicies, projects, manager);
+const filteredTasks = new FilteredTasks({
+  authorize: async (project, repo) => {
+    if (!projects.get(project)?.repos.includes(repo)) throw new FilteredTaskError("The project or its explicit repository membership changed", 409);
+    const policies = await fileAccess.forRepo(repo);
+    if (!projects.get(project)?.repos.includes(repo)) throw new FilteredTaskError("The project or its explicit repository membership changed", 409);
+    return policies;
+  },
+  withRepository: (repo, operation) => manager.withIdleRepository(repo, operation, { kind: "filtered task", owner: "filtered-tasks" })
+});
+let filteredTasksReady = false;
+configureFilePolicyResolver((repo) => fileAccess.forRepo(repo), { suppressRepositoryCommands: () => fileAccess.hasRestrictions() });
+manager.setFilesystemPolicyGuard((repo, run) => fileAccess.execution(repo, run));
+let filesystemFeedRevision = 0;
+filePolicies.onChange(() => {
+  filesystemFeedRevision++;
+  void closeCodeIntelligence();
+});
+const policyPreparations = /* @__PURE__ */ new Set();
+function trackPolicyPreparation(operation) {
+  const work = Promise.resolve().then(operation);
+  policyPreparations.add(work);
+  void work.finally(() => policyPreparations.delete(work)).catch(() => void 0);
+  return work;
+}
+const conventions = new ConventionsStore();
+const retentionPolicy = new RetentionPolicyStore();
+const sharedAccounts = new SharedAccounts();
+await sharedAccounts.load().catch((error) => logError("Shared accounts unavailable; owner recovery remains available", error));
+const collaborationReviews = new CollaborationReviews();
+const teamMembers = () => sharedAccounts.available ? sharedAccounts.snapshot().users.map((user) => ({ userId: user.id, username: user.username, displayName: user.displayName, enabled: user.enabled, roles: user.roles })) : [];
+const osUser = (() => {
+  try {
+    return userInfo().username || void 0;
+  } catch {
+    return void 0;
+  }
+})();
+const collab = new CollabStore({ members: teamMembers, projects: () => projects.list().map((project) => ({ id: project.id, name: project.name })), ownerName: () => osUser });
+const teamConnections = new TeamConnections({
+  store: collab,
+  manager,
+  findPattern,
+  projectFor: (repo) => projects.forRepo(repo)?.id,
+  onEvent: (id, event) => teamBroadcast(event, void 0, id)
+});
+const hostExecution = new HostExecution({
+  store: collab,
+  manager,
+  findPattern,
+  members: teamMembers,
+  projectRepos: (id) => projects.get(id)?.repos,
+  resolveRepo: (project, key) => teamConnections.get("local").link.resolveRepo(project, key),
+  availableAgents: async () => (await agentAvailability()).filter((agent) => agent.available).map((agent) => agent.id),
+  enabled: () => !fileAccess.hasRestrictions()
+});
+const resolveQueuedProviders = (request) => trackPolicyPreparation(async () => {
+  const pattern = findPattern(request.pattern);
+  if (!pattern) throw new Error("This pattern no longer exists; cancel and review the saved request");
+  const selection = request.loop?.remoteWorker;
+  const { roles } = await validateRoles(pattern, request.roles, request.repo, selection);
+  const inventory = selection ? (await manager.remoteInventory(selection)).providers : await agentAvailability();
+  return { roles, installed: new Set(inventory.filter((entry) => entry.available).map((entry) => entry.id)) };
+});
+const deferredRuns = createDeferredRuns(manager, { build: buildStartInput, resolveProviders: resolveQueuedProviders });
+const coordinatedApi = createCoordinatedApi({ manager, projects, build: buildStartInput, resolveProviders: resolveQueuedProviders });
+const launchProfiles = new LaunchProfiles(manager.devServers);
+manager.onWorkspaceStop((runId) => launchProfiles.stopMatching(`${runId}/`));
+const integrations = new Integrations();
+const codeHostsApi = createCodeHostsApi({ integrations, manager, projects, build: buildStartInput });
+await integrations.load().catch((error) => logError("External sources disabled: invalid integration configuration", error));
+const notifications = new Notifications();
+const notificationsReady = await notifications.load().then(() => true, (error) => {
+  logError("Notifications disabled: configuration or delivery state cannot be read", error);
+  return false;
+});
+const shells = new Shells();
+const teamTerminals = new TeamTerminals({
+  users: () => sharedAccounts.available ? sharedAccounts.snapshot().users : [],
+  projectRepos: (id) => projects.get(id)?.repos,
+  resolveRepo: (project, key) => teamConnections.get("local").link.resolveRepo(project, key),
+  enabled: () => !fileAccess.hasRestrictions(),
+  changed: (projectId) => collab.hostExecutionChanged(projectId),
+  activity: () => manager.noteActivity()
+});
+sharedAccounts.onChange(() => {
+  void teamTerminals.reap().catch((error) => logError("Team terminal revocation failed", error));
+});
+const notes = new Notes();
+const watcher = new PrWatcher(manager);
+const automations = new Automations(manager, (body, extra) => trackPolicyPreparation(() => startFromBody(body, extra)), (repo, kind) => trackPolicyPreparation(async () => {
+  assertPolicyExecution(await fileAccess.execution(repo), "Automation source discovery");
+  return listSweep(repo, kind, manager.list());
+}));
+const projectTeams = new ProjectTeams({ manager, projects, automations, build: buildStartInput, allowed: async (repo) => assertPolicyExecution(await fileAccess.execution(repo), "Standing project teams") });
+async function pausePolicyBackground() {
+  const results = await Promise.allSettled([watcher.stop(), automations.stop(), projectTeams.stop(), deferredRuns.stop(), coordinatedApi.service.stop(), ...notificationsReady ? [notifications.stop()] : []]);
+  while (policyPreparations.size) await Promise.allSettled([...policyPreparations]);
+  const failure = results.find((result) => result.status === "rejected");
+  if (failure?.status === "rejected") throw failure.reason;
+}
+function startPolicyBackground() {
+  projectTeams.start();
+  watcher.start();
+  automations.start(envNumber("CODEFLOW_SCHEDULER_TICK_MS", 3e4, { min: 100 }));
+  deferredRuns.start();
+  coordinatedApi.service.start();
+  if (notificationsReady) notifications.start();
+}
+let remote;
+let changingRemote = Promise.resolve();
+function changeSavedRemote(patch) {
+  const change = changingRemote.catch(() => void 0).then(async () => {
+    const before = remote;
+    const next = changeRemote(before, patch);
+    if (next.control && (!phoneTls || remoteTlsIssue()) && !insecurePhoneDevelopment && patch.control === true) {
+      throw new HttpError(400, "Full phone control requires HTTPS. Choose Set up secure remote access in Settings \u2192 Remote access.");
+    }
+    if ((!phoneTls || remoteTlsIssue()) && !insecurePhoneDevelopment) next.control = false;
+    await saveRemote(next);
+    remote = next;
+    return before;
+  });
+  changingRemote = change.catch(() => void 0);
+  return change;
+}
+const REMOTE_PORT = envNumber("CODEFLOW_REMOTE_PORT", PORT + 1, { min: 1, max: 65535 });
+const docsDirectory = fileURLToPath(new URL("../public/docs/", import.meta.url));
+const docsHelp = new DocsHelp(docsDirectory, (agent, event) => {
+  if (event.kind === "quota") manager.recordQuota(agent, event.status, event.windows);
+}, (agent, error) => {
+  if (error.kind === "usage_limit") manager.recordLimit(agent, error.resetsAt);
+  if (error.kind === "auth") manager.recordQuota(agent, "signed_out", {});
+});
+const indexHtml = fileURLToPath(new URL("../public/index.html", import.meta.url));
+const HOST = "127.0.0.1";
+const sshProjects = process.env.CODEFLOW_SSH_HOST ? void 0 : new SshProjects({ localProjects: () => projects.list(), canBrowse: () => !fileAccess.hasRestrictions() });
+const tlsConfigured = !!process.env.CODEFLOW_TLS_CERT && !!process.env.CODEFLOW_TLS_KEY;
+if (!!process.env.CODEFLOW_TLS_CERT !== !!process.env.CODEFLOW_TLS_KEY) throw new Error("Configure both CODEFLOW_TLS_CERT and CODEFLOW_TLS_KEY");
+let phoneTls = tlsConfigured ? { cert: readFileSync(process.env.CODEFLOW_TLS_CERT), key: readFileSync(process.env.CODEFLOW_TLS_KEY) } : void 0;
+const insecurePhoneDevelopment = process.env.CODEFLOW_ALLOW_INSECURE_PHONE_CONTROL === "1";
+let phoneProtocol = phoneTls ? "https" : "http";
+const phoneSessions = new PhoneSessions();
+let savedCertificate;
+let tlsLoadError;
+let configuringTls = false;
+const certificateRenewal = new CertificateRenewal(join(CODEFLOW_HOME, "remote-tls-renewal.json"));
+function remoteTlsIssue() {
+  return tlsLoadError || (savedCertificate && savedCertificate.expiresAt <= Date.now() ? "HTTPS certificate expired. Renew or import a certificate in Remote access settings." : void 0);
+}
+const allowedHosts = /* @__PURE__ */ new Set([`${HOST}:${PORT}`, `localhost:${PORT}`]);
+const journeys = new JourneyStore(join(CODEFLOW_HOME, "journeys"));
+const handleJourneys = journeyApi(journeys, manager, [PORT, REMOTE_PORT]);
+const previews = new Previews(
+  () => [`http://localhost:${PORT}`, `http://${HOST}:${PORT}`],
+  () => [PORT, REMOTE_PORT]
+);
+const sshPreviews = new Previews(() => [], () => [PORT, REMOTE_PORT], void 0, false);
+function checkOrigin(req) {
+  if (!allowedHosts.has(req.headers.host ?? "")) throw new HttpError(403, "Bad Host header");
+  const origin = req.headers.origin;
+  if (origin && !allowedHosts.has(origin.replace(/^https?:\/\//, ""))) throw new HttpError(403, "Cross-origin request refused");
+}
+const auth = {
+  token: process.env.CODEFLOW_TOKEN || randomBytes(24).toString("hex"),
+  claimable: !process.env.CODEFLOW_SSH_HOST && sharedAccounts.available && !sharedAccounts.hasUsers
+};
+sharedAccounts.onChange(() => {
+  auth.claimable = false;
+});
+manager.onActivity(() => auth.claimable = false);
+const COOKIE = "codeflow_session";
+const SHARED_COOKIE = `codeflow_shared_${PORT}`;
+const MAX_HEADER_SIZE = 1024 * 1024;
+function mayClaim(req) {
+  const forwarded = ["forwarded", "x-forwarded-for", "x-forwarded-host", "x-real-ip", "cf-connecting-ip", "true-client-ip"].some((h) => req.headers[h] !== void 0);
+  const address = (req.socket.remoteAddress ?? "").replace(/^::ffff:/i, "");
+  return auth.claimable && !forwarded && (address === "::1" || address.startsWith("127."));
+}
+function sharedTransport(req) {
+  const forwarded = ["forwarded", "x-forwarded-for", "x-forwarded-host", "x-real-ip", "cf-connecting-ip", "true-client-ip"].some((header) => req.headers[header] !== void 0);
+  const address = (req.socket.remoteAddress ?? "").replace(/^::ffff:/i, "");
+  return { address, secure: req.socket.encrypted === true, loopback: !forwarded && (address === "::1" || /^127\./.test(address)) };
+}
+function sharedMutation(req) {
+  if (!req.headers.origin || !/^application\/json(?:\s*;|$)/i.test(String(req.headers["content-type"] ?? ""))) throw new HttpError(403, "Shared sign-in and mutations require same-origin JSON requests");
+}
+const clearCookie = (name) => `${name}=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0`;
+function sharedCookie(token, secure) {
+  return `${SHARED_COOKIE}=${token}; HttpOnly; SameSite=Strict; Path=/; Max-Age=43200${secure ? "; Secure" : ""}`;
+}
+function sharedSession(req) {
+  const transport = sharedTransport(req);
+  if (!transport.secure && !transport.loopback) return;
+  for (const token of readCookies(req, SHARED_COOKIE)) {
+    const identity = sharedAccounts.authenticate(token);
+    if (identity) return { token, identity };
+  }
+}
+function memberOf(identity) {
+  return { userId: identity.userId, username: identity.username, displayName: identity.displayName, enabled: true, roles: identity.roles };
+}
+function runnerActor(token) {
+  const credential = collab.authenticateRunner(token);
+  if (!credential) return void 0;
+  const member = teamMembers().find((entry) => entry.userId === credential.userId && entry.enabled);
+  return member && memberActor(member, "runner", credential.runnerId);
+}
+function runnerMutation(req) {
+  const hasBody = Number(req.headers["content-length"] ?? 0) > 0 || req.headers["transfer-encoding"] !== void 0;
+  if (hasBody && !/^application\/(?:json|octet-stream)(?:\s*;|$)/i.test(String(req.headers["content-type"] ?? ""))) throw new HttpError(415, "Runner requests send application/json, or application/octet-stream for a checkpoint bundle");
+}
+async function handleRunnerRequest(req, res, url, parts, token) {
+  const transport = sharedTransport(req);
+  if (!transport.secure && !transport.loopback) throw new HttpError(403, "Runner credentials are accepted over HTTPS or on this computer only");
+  const actor = runnerActor(token);
+  if (!actor) throw new HttpError(401, "This runner credential is not valid; connect this computer again in Settings \u2192 Team");
+  const route = teamRoutePolicy(req.method ?? "GET", parts);
+  if (parts[1] !== "team" || route && !runnerAllowed(route)) throw new HttpError(403, "This credential only reaches the team API");
+  await attempt(() => fileAccess.sharedGate(req));
+  return handleTeamApi(req, res, url, parts, { store: collab, actor, principal: "runner", reauthorize: () => {
+    const current = runnerActor(token);
+    if (!current) throw new HttpError(401, "This runner credential was revoked");
+    return current;
+  }, mutation: runnerMutation });
+}
+function sessionCookie() {
+  return `${COOKIE}=${auth.token}; HttpOnly; SameSite=Strict; Path=/`;
+}
+function readCookies(req, name) {
+  return String(req.headers.cookie ?? "").split(";").map((c) => c.trim()).filter((c) => c.startsWith(`${name}=`)).map((c) => c.slice(name.length + 1)).filter(Boolean);
+}
+function signedIn(req) {
+  const bearer = String(req.headers.authorization ?? "").replace(/^Bearer\s+/i, "");
+  if (bearer && tokenMatches(bearer, auth.token)) return true;
+  return readCookies(req, COOKIE).some((cookie) => tokenMatches(cookie, auth.token));
+}
+const PHONE_COOKIE = `codeflow_phone_${REMOTE_PORT}`;
+const PHONE_COOKIE_DAYS = 30;
+const phoneControl = (s = remote) => s.enabled && s.lan && s.control && !remoteTlsIssue() && (!!phoneTls || insecurePhoneDevelopment);
+function phoneCookie(token) {
+  return `${PHONE_COOKIE}=${token}; HttpOnly; SameSite=Strict; Path=/${phoneTls ? "; Secure" : ""}; Max-Age=${PHONE_COOKIE_DAYS * 86400}`;
+}
+function phoneSignedIn(req) {
+  return phoneControl() && readCookies(req, PHONE_COOKIE).some((cookie) => phoneSessions.valid(cookie, remote.controlToken));
+}
+function checkLanOrigin(req) {
+  const origin = req.headers.origin;
+  if (origin && origin !== `${phoneProtocol}://${req.headers.host}`) throw new HttpError(403, "Cross-origin request refused");
+}
+const lockedPage = (title, body) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>code-flow \u2014 ${title}</title><style>
+:root{--bg:#f8f7f3;--raised:#fdfcf9;--sunken:#f0efe9;--border:#e4e2da;--text:#292a26;--muted:#65675e;--link:#2d6a4b;--shadow:0 2px 6px rgba(34,35,24,.06),0 24px 64px rgba(34,35,24,.16);color-scheme:light}
+@media (prefers-color-scheme:dark){:root{--bg:#161713;--raised:#1e1f1a;--sunken:#121310;--border:#2e3029;--text:#ecebe4;--muted:#9c9d92;--link:#8fe3c4;--shadow:0 2px 6px rgba(0,0,0,.35),0 24px 64px rgba(0,0,0,.55);color-scheme:dark}}
+body{margin:0;padding:0 16px;background:var(--bg);color:var(--text);font:14px/1.55 Inter,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;-webkit-font-smoothing:antialiased}
+main{max-width:480px;margin:12vh auto;padding:24px;background:var(--raised);border:1px solid var(--border);border-radius:16px;box-shadow:var(--shadow)}
+.brand{font-size:15px;font-weight:600;letter-spacing:-.4px;margin:0 0 18px}.brand span{font-weight:400}
+h1{font:400 24px/1.2 Georgia,"Times New Roman",serif;letter-spacing:-.5px;margin:0 0 12px}p{color:var(--muted);margin:8px 0}b{color:var(--text);font-weight:600}a{color:var(--link);font-weight:500}
+code{font:12px ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;color:var(--text);background:var(--sunken);padding:1px 5px;border-radius:6px;overflow-wrap:anywhere}
+</style></head><body><main><div class="brand">code<span>-flow</span></div>${body}</main></body></html>`;
+const LOCKED_PAGE = lockedPage(
+  "sign in",
+  `<h1>Open code-flow from its link</h1>
+<p>This code-flow server is already in use, so it only accepts browsers that open it with its link.</p>
+<p>Find the line <code>Open http://localhost:${PORT}/?token=\u2026</code> where code-flow was started (the terminal, or the preview's server log) and open that link here.</p>
+<p>Restarting code-flow and reloading this page also works, as long as no run has started yet.</p>`
+);
+const PHONE_LOCKED_PAGE = lockedPage(
+  "scan the QR code",
+  `<h1>Scan the QR code again</h1>
+<p>This phone isn't signed in to code-flow. On your computer, open code-flow's <b>Automations</b> page and scan the QR code under <b>Remote access</b>.</p>
+<p>Making a new link, or turning off full control from your phone, signs phones out.</p>`
+);
+const signingInPage = (target) => lockedPage("signing in", `<h1>Signing in\u2026</h1><p><a href="${target}">Open code-flow</a></p><script>location.replace(${JSON.stringify(target)})</script>`);
+const NO_FRAMES = { "x-frame-options": "DENY", "content-security-policy": "frame-ancestors 'none'" };
+let appPage;
+const compressBrotli = promisify(brotliCompress);
+const compressGzip = promisify(gzip);
+async function loadAppPage() {
+  const file = await stat(indexHtml);
+  const version = `${file.mtimeMs}:${file.size}`;
+  if (appPage?.version !== version) {
+    const page = (async () => {
+      const identity = await readFile(indexHtml);
+      const [br, gz] = await Promise.all([
+        // Quality 9 rather than brotli's 11: about as small, and ready in a fraction of the time after a rebuild.
+        compressBrotli(identity, { params: { [zlib.BROTLI_PARAM_QUALITY]: 9, [zlib.BROTLI_PARAM_SIZE_HINT]: identity.length } }),
+        compressGzip(identity, { level: 9 })
+      ]);
+      return { hash: createHash("sha256").update(identity).digest("base64url").slice(0, 32), identity, br, gzip: gz };
+    })();
+    appPage = { version, page };
+    page.catch(() => appPage?.page === page && (appPage = void 0));
+  }
+  return appPage.page;
+}
+function acceptsCoding(req, coding) {
+  let any = false;
+  for (const part of String(req.headers["accept-encoding"] ?? "").split(",")) {
+    const [name, ...params] = part.split(";").map((p) => p.trim().toLowerCase());
+    const q = params.find((p) => p.startsWith("q="));
+    const ok = !q || Number(q.slice(2)) > 0;
+    if (name === coding) return ok;
+    if (name === "*") any = ok;
+  }
+  return any;
+}
+async function sendAppPage(req, res, headers) {
+  const page = await loadAppPage();
+  const coding = acceptsCoding(req, "br") ? "br" : acceptsCoding(req, "gzip") ? "gzip" : void 0;
+  const etag = `"${page.hash}${coding ? `-${coding}` : ""}"`;
+  const common = { ...headers, etag, vary: "Accept-Encoding", "cache-control": "private, no-cache" };
+  const cached = String(req.headers["if-none-match"] ?? "").split(",").some((tag) => tag.trim().replace(/^W\//, "") === etag);
+  if (cached && !headers["set-cookie"]) {
+    res.writeHead(304, common);
+    return res.end();
+  }
+  const body = coding ? page[coding] : page.identity;
+  res.writeHead(200, { ...common, "content-type": "text/html; charset=utf-8", "content-length": body.length, ...coding ? { "content-encoding": coding } : {} });
+  res.end(body);
+}
+async function attempt(fn) {
+  try {
+    return await fn();
+  } catch (err) {
+    throw err instanceof HttpError ? err : new HttpError(err instanceof CollabError || err instanceof TeamPlanEditError || err instanceof TeamRerunError || err instanceof ConventionsError || err instanceof SharedAccountError || err instanceof SharedPathError || err instanceof CollaborationReviewError || err instanceof FilePolicyError ? err.status : err instanceof MemoryConflictError || err instanceof RunConflictError || err instanceof DeferredRunConflictError || err instanceof RetentionPolicyConflictError ? 409 : 400, err.message);
+  }
+}
+async function requestedRepo(url) {
+  return validRepo(url.searchParams.get("repo") ?? "");
+}
+async function validRepo(requested) {
+  if (!requested.startsWith("/")) throw new HttpError(400, "Repository must be an absolute path");
+  return repoRoot(requested).catch(() => {
+    throw new HttpError(400, "Not a git repository");
+  });
+}
+async function requestedFolder(url) {
+  const requested = url.searchParams.get("repo") ?? "";
+  const worktree = requested.startsWith("/") ? await manager.worktreeAt(requested).catch((err) => {
+    throw new HttpError(400, err.message);
+  }) : void 0;
+  return worktree ?? requestedRepo(url);
+}
+function describePattern(p) {
+  const { run: _run, ...rest } = p;
+  return rest;
+}
+function requestedRoles(pattern, input) {
+  const raw = input && typeof input === "object" ? input : {};
+  const requested = {};
+  for (const spec of pattern.roles) {
+    const value = raw[spec.id];
+    const list = (Array.isArray(value) ? value : value ? [value] : []).filter((v) => v === "auto" || isAgentId(v));
+    requested[spec.id] = spec.multiple ? list.slice(0, 6) : list.slice(0, 1);
+  }
+  return requested;
+}
+async function validateRoles(pattern, input, repo, remoteWorker, requestedTrust, policy) {
+  assertPolicyExecution(await fileAccess.execution(repo ?? ""), "Provider selection");
+  const requested = requestedRoles(pattern, input);
+  const inventory = remoteWorker ? (await manager.remoteInventory(remoteWorker)).providers : await agentAvailability();
+  const installed = new Set(inventory.filter((a) => a.available).map((a) => a.id));
+  const runtimeProblems = new Map(await Promise.all([...installed].map(async (id) => [id, !remoteWorker && policy && id === "agy" && policy.antigravityExecution !== "native" ? await getAdapter(id).managedAvailability?.() : void 0])));
+  const trust = requestedTrust ?? (repo ? (await readRepoConfig(repo)).config.trust : void 0);
+  const eligible = new Set([...installed].filter((id) => {
+    if (runtimeProblems.get(id)) return false;
+    if (policy) {
+      try {
+        const runPolicy = createRunPermissions(trust ?? "standard", policy.tools, pattern.id === "solo", policy.required, policy.antigravityExecution);
+        resolveRunPermissions({ policy: runPolicy, provider: id, mode: "write", currentTrust: runPolicy.trust, currentTools: policy.tools, remote: !!remoteWorker, container: policy.container });
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    return ["auto-team", "solo"].includes(pattern.id) ? id === "claude" || id === "codex" : !id.startsWith("acp:") || trust === "full" && !remoteWorker;
+  }));
+  if (pattern.id === "auto-team") {
+    const supplied = input && typeof input === "object" ? input : {};
+    if (!Array.isArray(supplied.coordinator)) requested.coordinator = ["auto"];
+    if (!Array.isArray(supplied.pool)) requested.pool = [...eligible];
+  }
+  const wantsAuto = Object.values(requested).some((list) => list.includes("auto"));
+  const rank = wantsAuto && repo ? rankAgents(manager.list(), repo, { pattern: pattern.id }) : void 0;
+  const resolved = resolveAuto(requested, manager.quotaForWorker(remoteWorker?.workerId), eligible, rank);
+  const roles = {};
+  const needed = /* @__PURE__ */ new Set();
+  for (const spec of pattern.roles) {
+    const list = resolved.roles[spec.id] ?? [];
+    const agents = spec.multiple ? [...new Set(list)] : list.slice(0, 1);
+    if (agents.length === 0 && !spec.optional) throw new HttpError(400, `Pick an agent for "${spec.label}"`);
+    if (pattern.id !== "auto-team" || spec.id !== "pool") agents.forEach((a) => needed.add(a));
+    roles[spec.id] = agents;
+  }
+  if (pattern.id === "auto-team" && !roles.pool?.some((agent) => installed.has(agent))) throw new HttpError(400, "Select at least one available provider for the worker pool");
+  for (const agent of needed) {
+    if (runtimeProblems.get(agent)) throw new HttpError(400, runtimeProblems.get(agent));
+    if (!installed.has(agent)) {
+      throw new HttpError(400, `${getAdapter(agent).displayName} (\`${getAdapter(agent).binary}\`) is not installed or not on PATH`);
+    }
+  }
+  return { roles, notes: resolved.notes };
+}
+let improving = 0;
+const MAX_IMPROVING = 3;
+const improvingControllers = /* @__PURE__ */ new Set();
+async function improveTask(body, res) {
+  if (body.execution !== void 0 && body.execution !== "local" || body.remoteWorker || body.agentContainer || body.loop?.remoteWorker || body.loop?.agentContainer) throw new HttpError(400, "Prompt improvement supports local execution only; remote and container profiles cannot fall back to a host CLI");
+  const text = typeof body.text === "string" ? body.text : "";
+  if (!text.trim()) throw new HttpError(400, "Write a task to improve first");
+  if (text.length > MAX_IMPROVE_CHARS) throw new HttpError(400, `The task is too long to improve (${MAX_IMPROVE_CHARS.toLocaleString("en")} characters at most)`);
+  if (body.mode !== void 0 && body.mode !== "quick" && body.mode !== "repo") throw new HttpError(400, "Choose Quick or Repo for prompt improvement");
+  let preferences;
+  try {
+    preferences = parseImproveSettings(body.settings ?? { agent: body.agent ?? "auto", defaultMode: body.mode ?? "quick", providers: {} });
+  } catch (error) {
+    throw new HttpError(400, error.message);
+  }
+  const stop2 = new AbortController();
+  res.once("close", () => stop2.abort());
+  if (res.destroyed || res.writableEnded) stop2.abort();
+  const request = {
+    text,
+    repo: await validRepo(typeof body.repo === "string" ? body.repo : ""),
+    mode: body.mode === void 0 ? preferences.defaultMode : body.mode === "repo" ? "repo" : "quick",
+    context: Array.isArray(body.context) ? body.context.filter((p) => typeof p === "string" && !!p.trim()).slice(0, 50).map((p) => p.slice(0, 300)) : [],
+    source: body.source && ["issue", "pr", "alert"].includes(body.source.kind) && Number.isInteger(body.source.number) ? { kind: body.source.kind, number: body.source.number, title: typeof body.source.title === "string" ? body.source.title.slice(0, 200) : void 0 } : void 0
+  };
+  if (improving >= MAX_IMPROVING) throw new HttpError(429, "Other tasks are being improved right now. Try again in a moment.");
+  improving++;
+  improvingControllers.add(stop2);
+  try {
+    return await attempt(() => manager.withIdleRepository(request.repo, async () => {
+      await manager.assertExecutionAllowed(request.repo, void 0, "Prompt improvement");
+      stop2.signal.throwIfAborted();
+      const installed = new Set((await agentAvailability()).filter((a) => a.available && IMPROVE_AGENTS.includes(a.id)).map((a) => a.id));
+      stop2.signal.throwIfAborted();
+      const agent = preferences.agent === "auto" ? resolveAuto({ improve: ["auto"] }, manager.quota, installed).roles.improve?.[0] : preferences.agent;
+      if (!agent) throw new HttpError(400, "Install the Claude Code, Codex or Antigravity CLI to improve tasks");
+      if (!installed.has(agent)) throw new HttpError(400, `${getAdapter(agent).displayName} (\`${getAdapter(agent).binary}\`) is not installed or not on PATH`);
+      if (preferences.agent !== "auto") {
+        const unavailable = exhausted(agent, manager.quota);
+        if (unavailable) throw new HttpError(400, `${getAdapter(agent).displayName} ${unavailable}. Choose another Improve agent in Settings or try again later.`);
+      }
+      request.settings = preferences.providers[agent]?.[request.mode];
+      await manager.assertExecutionAllowed(request.repo, void 0, "Prompt improvement");
+      stop2.signal.throwIfAborted();
+      manager.noteActivity();
+      try {
+        const result = await improvePrompt(agent, request, { signal: stop2.signal, onEvent: (event) => {
+          if (event.kind === "quota") manager.recordQuota(agent, event.status, event.windows);
+        } });
+        return send(res, 200, { ...result, agent });
+      } catch (error) {
+        if (!(error instanceof ImproveError)) throw error;
+        if (error.kind === "usage_limit") manager.recordLimit(agent, error.resetsAt);
+        if (error.kind === "auth") manager.recordQuota(agent, "signed_out", {});
+        throw new HttpError(502, error.message);
+      }
+    }, { kind: "prompt improvement", owner: "composer" }));
+  } finally {
+    improving--;
+    improvingControllers.delete(stop2);
+  }
+}
+function sideTurn(input) {
+  const v = input ?? {};
+  const chat = typeof v.chat === "string" ? v.chat : "";
+  if (!/^[a-z0-9-]{1,40}$/.test(chat)) throw new HttpError(400, "A side chat needs an id: up to 40 lowercase letters, digits or dashes");
+  if (v.mode !== "ask" && v.mode !== "change") throw new HttpError(400, 'A side chat is "ask" or "change"');
+  const title = typeof v.title === "string" ? v.title.replace(/\s+/g, " ").trim().slice(0, 80) : "";
+  return { chat, mode: v.mode, title: title || "Side chat" };
+}
+function validateSource(input) {
+  if (!input || typeof input !== "object") return void 0;
+  const raw = input;
+  const number = Number(raw.number);
+  if (raw.kind !== "issue" && raw.kind !== "pr" && raw.kind !== "alert") throw new HttpError(400, "Source must be an issue, a pull request or an alert");
+  if (!Number.isInteger(number) || number < 1) throw new HttpError(400, "Source needs an issue, PR or alert number");
+  if (raw.kind !== "alert") return { kind: raw.kind, number, ciLogs: raw.ciLogs === true };
+  if (raw.tool !== "dependabot" && raw.tool !== "code-scanning") throw new HttpError(400, "An alert comes from Dependabot or code scanning");
+  const numbers = Array.isArray(raw.numbers) ? [...new Set(raw.numbers.map(Number).filter((n) => Number.isInteger(n) && n > 0))].slice(0, 50) : [];
+  return { kind: "alert", tool: raw.tool, number, numbers: numbers.length ? numbers : void 0 };
+}
+const SWEEP_KINDS = ["issues", "dependabot", "alerts"];
+const MAX_SWEEP = 25;
+async function startSweep(body) {
+  const kind = body.kind;
+  if (!SWEEP_KINDS.includes(kind)) throw new HttpError(400, "Unknown kind of sweep");
+  const name = String(body.name ?? "").trim().slice(0, 80) || "Sweep";
+  const base = body.run && typeof body.run === "object" ? body.run : {};
+  const items = [];
+  for (const i of Array.isArray(body.items) ? body.items : []) {
+    const item = { key: String(i?.key ?? "").slice(0, 200), task: String(i?.task ?? "").trim().slice(0, 4e3), source: validateSource(i?.source) };
+    if (!item.key || !item.task || !item.source) throw new HttpError(400, "Every item needs a task and a source");
+    items.push({ ...item, source: item.source });
+  }
+  if (!items.length) throw new HttpError(400, "Pick at least one item");
+  if (items.length > MAX_SWEEP) throw new HttpError(400, `Pick at most ${MAX_SWEEP} items; the rest can go in a later sweep`);
+  const repo = (await buildStartInput({ ...base, task: items[0].task })).repo;
+  const root = await repoRoot(repo);
+  const schedule = body.schedule ? await attempt(async () => validateSchedule(body.schedule)) : void 0;
+  const id = `s-${randomBytes(4).toString("hex")}`;
+  const saved = schedule ? await automations.create({ name, enabled: true, run: { ...automationRun({ ...base, task: templates.find((t) => t.sweep === kind)?.task ?? name }), source: void 0 }, schedule, webhook: false, isolate: false, sweep: { kind, max: Math.min(10, Math.max(1, Number(body.max) || 5)) } }) : void 0;
+  const trigger = { id: saved?.id ?? id, name, via: "sweep" };
+  const outcome = await runSweep({
+    repo: root,
+    items,
+    runs: manager.list(),
+    start: (item) => startFromBody({ ...base, task: item.task, source: item.source }, { trigger })
+  });
+  if (saved) {
+    const started = new Set(outcome.started.map((s) => s.key));
+    await automations.markHandled(saved.id, items.filter((i) => started.has(i.key)).flatMap((i) => sourceKeys(i.source)));
+  }
+  return { sweep: trigger.id, automation: saved?.id, ...outcome };
+}
+function validateRoleSettings(input) {
+  const raw = input && typeof input === "object" ? input : {};
+  const out = {};
+  for (const [role, settings] of Object.entries(raw)) {
+    if (!/^[\w-]{1,40}$/.test(role)) continue;
+    try {
+      const valid = validateAgentSettings(settings);
+      if (Object.keys(valid).length) out[role] = valid;
+    } catch (err) {
+      throw new HttpError(400, `${role}: ${err.message}`);
+    }
+  }
+  return out;
+}
+function validateLoop(input) {
+  const raw = input && typeof input === "object" ? input : {};
+  let remoteWorker;
+  if (raw.remoteWorker !== void 0) {
+    const value = raw.remoteWorker;
+    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((key) => !["workerId", "repoMapping"].includes(key)) || typeof value.workerId !== "string" || typeof value.repoMapping !== "string" || !remoteWorkers.list().some((worker) => worker.id === value.workerId && worker.repoMappings.includes(value.repoMapping))) throw new HttpError(400, "Choose an explicitly registered remote worker and repository mapping");
+    remoteWorker = { workerId: value.workerId, repoMapping: value.repoMapping };
+  }
+  const text = (key) => {
+    const value = typeof raw[key] === "string" ? raw[key].trim() : "";
+    if (value.length > 1e3) throw new HttpError(400, `${key} command is too long`);
+    if (/[\r\n]/.test(value)) throw new HttpError(400, `${key} command must be a single line`);
+    return value || void 0;
+  };
+  const number = (key, min, max) => {
+    const n = Number(raw[key]);
+    return raw[key] === void 0 || raw[key] === "" || !Number.isFinite(n) ? void 0 : Math.min(max, Math.max(min, n));
+  };
+  return {
+    remoteWorker,
+    check: text("check"),
+    setup: text("setup"),
+    copy: Array.isArray(raw.copy) ? raw.copy.filter((p) => typeof p === "string" && !!p.trim()).slice(0, 50) : void 0,
+    maxMinutes: number("maxMinutes", 1, 720),
+    maxSteps: number("maxSteps", 1, 200),
+    maxInvocations: number("maxInvocations", 1, 200),
+    maxTokens: number("maxTokens", 1, 1e9),
+    maxCostUsd: number("maxCostUsd", 1e-3, 1e6),
+    contextBudget: validateContextBudget(raw.contextBudget),
+    checkTimeoutMin: number("checkTimeoutMin", 1, 120)
+  };
+}
+function validateOptions(pattern, input) {
+  const raw = input && typeof input === "object" ? input : {};
+  const options = {};
+  for (const spec of pattern.options) {
+    const value = raw[spec.id];
+    if (spec.type === "boolean") {
+      options[spec.id] = typeof value === "boolean" ? value : spec.default;
+    } else {
+      const n = typeof value === "number" ? value : Number(value);
+      const fallback = spec.default;
+      const clamped = Number.isFinite(n) ? Math.min(spec.max ?? n, Math.max(spec.min ?? n, Math.round(n))) : fallback;
+      options[spec.id] = clamped;
+    }
+  }
+  return options;
+}
+async function buildStartInput(body) {
+  if (body.deferred !== void 0 || body.teamRerun !== void 0 || body.coordination !== void 0 || body.projectTeam !== void 0 || body.beforeDispatch !== void 0 || body.requireProjectRepo !== void 0) throw new HttpError(400, "Launch identities and selective rerun seeds are assigned by the server");
+  if (body.projectSelection !== void 0 && body.projectSelection !== "explicit") throw new HttpError(400, "Unknown project selection mode");
+  if (body.projectSelection === "explicit" && (!projects.available || typeof body.project !== "string" || !projects.get(body.project))) throw new HttpError(409, "Choose an available project before starting");
+  if (body.templateCatalog !== void 0 || body.teamTemplate !== void 0 || body.permissions !== void 0) throw new HttpError(400, "Template snapshots and run authority are assigned by the server");
+  let teamTemplate;
+  if (body.templateRef) {
+    const ref = body.templateRef;
+    const template = await attempt(() => teamTemplateStore.resolve(String(ref.id), Number(ref.version), typeof body.project === "string" ? body.project : void 0));
+    if (!ref.inputs || typeof ref.inputs !== "object" || Array.isArray(ref.inputs)) throw new HttpError(400, "Supply template inputs");
+    fillTeamTemplate(template, ref.inputs);
+    if (body.pattern !== (template.workflow ?? "auto-team")) throw new HttpError(400, "Selected template does not match the execution mode");
+    teamTemplate = { template, inputs: ref.inputs };
+  }
+  const pattern = findPattern(String(body.pattern ?? "auto-team"));
+  if (!pattern) throw new HttpError(400, "Unknown pattern");
+  let task = String(body.task ?? "").trim();
+  if (teamTemplate) {
+    const filled = fillTeamTemplate(teamTemplate.template, teamTemplate.inputs);
+    task += `
+
+Selected template: ${filled.name} v${filled.version}
+${filled.task}
+${filled.criteria.map((c) => `- ${c}`).join("\n")}`;
+  }
+  const repo = String(body.repo ?? "").trim();
+  if (!task) throw new HttpError(400, "Describe the task");
+  if (!repo.startsWith("/")) throw new HttpError(400, "Repository must be an absolute path");
+  if (body.parentRunId !== void 0 && (typeof body.parentRunId !== "string" || !manager.get(body.parentRunId))) throw new HttpError(409, "The original run is no longer available. Reload before starting a continuation so its source restrictions can be retained.");
+  await attempt(async () => assertPolicyExecution(await fileAccess.execution(repo), "Run preparation"));
+  if (body.projectSelection === "explicit" && !projects.get(body.project)?.repos.includes(await repoRoot(repo))) throw new HttpError(409, "This repository is no longer an explicit member of the selected project");
+  if (body.externalSource !== void 0 || body.externalSourceId !== void 0 && typeof body.externalSourceId !== "string") throw new HttpError(400, "Import the external source through its configured integration first");
+  if (body.externalSourceId !== void 0 && body.externalSourceRef !== void 0) throw new HttpError(400, "Choose one external source reference");
+  if (body.intent !== void 0 && !taskIntent(body.intent)) throw new HttpError(400, "Choose a supported task type");
+  if (body.journeyId !== void 0) {
+    const journey = await attempt(() => journeys.get(String(body.journeyId)));
+    if (journey.repo !== await repoRoot(repo)) throw new HttpError(400, "The scenario belongs to another repository");
+  }
+  const parent = typeof body.parentRunId === "string" ? manager.get(body.parentRunId) : void 0;
+  if (body.parentRunId !== void 0 && !parent) throw new HttpError(400, "Parent run not found; cannot inherit its permissions");
+  const inheritedLoop = inheritRunEnvironment(body.loop ?? {}, parent);
+  const loop = validateLoop(inheritedLoop);
+  if (inheritedLoop.agentContainer) loop.agentContainer = await attempt(async () => validateAgentContainer(inheritedLoop.agentContainer));
+  const requiredPermissions = [.../* @__PURE__ */ new Set([...parent?.permissions?.required ?? [], ...permissionRequirements(body.permissionRequirements)])];
+  const agyExecution = antigravityExecution(body.antigravityExecution, parent?.permissions);
+  const runTrust = parent?.permissions ? narrowerTrust(narrowerTrust(parent.permissions.trust, parent.trust), body.trust ?? parent.trust) : body.trust;
+  const runTools = parent?.permissions ? parent.permissions.toolApprovals && !!parent.approvals.tools && body.approvals?.tools !== false : body.approvals?.tools === true;
+  const { roles, notes: notes2 } = await validateRoles(pattern, body.roles, await repoRoot(repo).catch(() => repo), loop.remoteWorker, runTrust, { required: requiredPermissions, container: !!loop.agentContainer, tools: runTools, antigravityExecution: agyExecution });
+  let externalSource = typeof body.externalSourceId === "string" ? await attempt(async () => integrations.resolveSource(body.externalSourceId)) : void 0;
+  if (body.externalSourceRef) {
+    const ref = body.externalSourceRef;
+    if (typeof ref.integration !== "string" || !["issue", "pr"].includes(ref.kind) || typeof ref.key !== "string") throw new HttpError(400, "Choose a configured external source");
+    externalSource = await attempt(() => integrations.importSource(ref.integration, ref.kind, ref.key));
+  }
+  if (externalSource && body.source) throw new HttpError(400, "Choose one external source for this run");
+  if (body.loop?.verification) loop.verification = await attempt(async () => validateVerificationProfile(body.loop.verification));
+  if (loop.remoteWorker && (body.approvals?.tools || loop.agentContainer)) throw new HttpError(400, "Remote workers use their provisioned isolation profile and cannot wait for native tool approvals");
+  const container = inheritedLoop.container;
+  if (container && typeof container.image === "string" && /^[\w./:@-]{1,200}$/.test(container.image)) {
+    loop.container = { image: container.image, network: container.network !== false };
+  }
+  return {
+    pattern,
+    teamTemplate,
+    task,
+    intent: taskIntent(body.intent),
+    journeyId: typeof body.journeyId === "string" ? body.journeyId : void 0,
+    repo,
+    project: typeof body.project === "string" && body.project ? body.project : void 0,
+    requireProjectRepo: body.projectSelection === "explicit",
+    baseRef: body.baseRef ? String(body.baseRef) : void 0,
+    branchPrefix: body.branchPrefix ? String(body.branchPrefix) : void 0,
+    context: body.context && typeof body.context === "object" ? body.context : void 0,
+    loop,
+    approvals: { plan: typeof body.approvals?.plan === "boolean" ? body.approvals.plan : pattern.id === "auto-team", tools: runTools },
+    parentRunId: body.parentRunId,
+    trust: ["safe", "standard", "trusted", "full"].includes(runTrust) ? runTrust : void 0,
+    permissionRequirements: requiredPermissions,
+    antigravityExecution: agyExecution,
+    roleSettings: validateRoleSettings(body.roleSettings),
+    agentSettings: (() => {
+      try {
+        return validateAgentSettings(body.agentSettings);
+      } catch (err) {
+        throw new HttpError(400, err.message);
+      }
+    })(),
+    source: validateSource(body.source),
+    externalSource,
+    allowUntrusted: body.allowUntrusted === true,
+    routing: notes2,
+    roles,
+    options: validateOptions(pattern, body.options)
+  };
+}
+async function startFromBody(body, extra = {}) {
+  const input = await buildStartInput(body);
+  return attempt(() => manager.start({ ...input, ...extra }).catch((err) => {
+    if (err instanceof UntrustedSourceError) throw Object.assign(new HttpError(409, err.message), { confirm: "allowUntrusted" });
+    throw err;
+  }));
+}
+function automationRun(body) {
+  const keep = ["templateRef", "permissionRequirements", "repo", "project", "projectSelection", "pattern", "task", "roles", "options", "baseRef", "loop", "trust", "agentSettings", "roleSettings", "source"];
+  const run = Object.fromEntries(keep.filter((k) => body[k] !== void 0).map((k) => [k, body[k]]));
+  if (typeof body.externalSourceId === "string") {
+    try {
+      const source = integrations.resolveSource(body.externalSourceId);
+      run.externalSourceRef = { integration: source.integration, kind: source.kind, key: source.key };
+    } catch (error) {
+      throw new HttpError(400, error.message);
+    }
+  } else if (body.externalSourceRef) run.externalSourceRef = body.externalSourceRef;
+  if (Array.isArray(body.context?.paths)) run.context = { paths: body.context.paths.map((p) => ({ path: String(p.path ?? "") })) };
+  return run;
+}
+function describeAutomation(t) {
+  return { ...t, scheduleText: describeSchedule(t.schedule), hookPath: `/hooks/${t.id}` };
+}
+async function handlePublic(req, res, url, parts, via) {
+  if (parts[0] === "hooks" && parts[1] && req.method === "POST") {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+      size += chunk.length;
+      if (size > 1024 * 1024) throw new HttpError(413, "Payload too large");
+      chunks.push(chunk);
+    }
+    const raw = Buffer.concat(chunks);
+    let caller;
+    try {
+      caller = automations.authorize(parts[1], req.headers, raw);
+    } catch (err) {
+      throw new HttpError(err.status ?? 401, err.message);
+    }
+    if (req.headers["x-github-event"] === "ping") return send(res, 200, { ok: true, pong: true }), true;
+    let payload = {};
+    try {
+      payload = raw.length ? JSON.parse(raw.toString("utf8")) : {};
+    } catch {
+      throw new HttpError(400, "Expected a JSON body");
+    }
+    const wanted = readWebhook(req.headers, payload);
+    if (!wanted) return send(res, 200, { ignored: "This event doesn't start a run" }), true;
+    const delivery = typeof req.headers["x-github-delivery"] === "string" ? req.headers["x-github-delivery"].slice(0, 100) : void 0;
+    const accepted = automations.accept(caller.trigger.id, wanted, delivery, caller.signed ? raw : void 0);
+    send(res, "ignored" in accepted ? 200 : 202, "ignored" in accepted ? accepted : { accepted: true, automation: caller.trigger.id });
+    return true;
+  }
+  if (parts[0] === "r" && req.method === "GET") {
+    const token = parts[1] ?? "";
+    if (!remote.enabled) throw new HttpError(404, "Not found");
+    const base = `/r/${token}`;
+    if (via === "lan" && phoneControl() && tokenMatches(token, remote.controlToken)) {
+      if (Date.now() >= (remote.pairingUntil ?? 0)) throw new HttpError(403, "This pairing link expired. Choose New link on this computer to pair a phone.");
+      const paired = await phoneSessions.pair(String(req.headers["user-agent"] ?? "Phone"), remote.controlToken);
+      const run = url.pathname.slice(base.length).match(/^\/run\/([\w-]+)$/)?.[1];
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8", "set-cookie": phoneCookie(paired.token), "cache-control": "no-store", ...NO_FRAMES, "referrer-policy": "no-referrer" });
+      res.end(signingInPage(run ? `/#/run/${run}` : "/"));
+      return true;
+    }
+    if (!tokenMatches(token, remote.token)) throw new HttpError(404, "Not found");
+    if (fileAccess.hasRestrictions()) throw new HttpError(403, "Phone views are unavailable under custom filesystem restrictions");
+    const html = renderRemote(manager, projects.list(), base, url.pathname.slice(base.length));
+    if (!html) throw new HttpError(404, "Not found");
+    res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", ...NO_FRAMES, "referrer-policy": "no-referrer" });
+    res.end(html);
+    return true;
+  }
+  return false;
+}
+function remoteInfo(via = "local") {
+  const phonePath = `/r/${phoneControl() ? remote.controlToken : remote.token}`;
+  const ready = remote.enabled && remote.lan && lanServer?.listening && lanHost === networkHost() && !lanError;
+  const tailscaleHost = phoneTls && tailscaleStatus.dnsName ? tailscaleStatus.dnsName : tailscaleStatus.ip;
+  return {
+    enabled: remote.enabled,
+    lan: remote.lan,
+    transport: remote.transport ?? "lan",
+    tailscale: tailscaleStatus,
+    tailscaleUrl: ready && remote.transport === "tailscale" ? `${phoneProtocol}://${tailscaleHost}:${REMOTE_PORT}${phonePath}` : void 0,
+    control: phoneControl(),
+    secure: !!phoneTls && !remoteTlsIssue(),
+    tls: { editable: via === "local" && !tlsConfigured && !process.env.CODEFLOW_SSH_HOST, source: tlsConfigured ? "environment" : savedCertificate?.source, hostname: savedCertificate?.hostname, expiresAt: savedCertificate?.expiresAt, error: remoteTlsIssue(), renewal: tlsConfigured ? void 0 : certificateRenewal.status(savedCertificate) },
+    insecureDevelopment: insecurePhoneDevelopment,
+    pairingUntil: remote.pairingUntil ?? 0,
+    path: `/r/${remote.token}`,
+    phonePath,
+    local: `http://localhost:${PORT}/r/${remote.token}`,
+    lanUrls: ready && remote.transport !== "tailscale" ? (savedCertificate ? [savedCertificate.hostname] : lanAddresses()).map((ip) => `${phoneProtocol}://${ip.includes(":") ? `[${ip}]` : ip}:${REMOTE_PORT}${phonePath}`) : [],
+    lanError: remote.enabled && remote.lan ? remoteTlsIssue() || (savedCertificate && remote.transport === "tailscale" && tailscaleStatus.state === "connected" && savedCertificate.hostname !== tailscaleStatus.dnsName ? "The HTTPS certificate belongs to a different Tailscale name. Set up secure access again for this computer." : lanError) : void 0
+  };
+}
+let lanServer;
+const lanSockets = /* @__PURE__ */ new Set();
+function closeLanConnections() {
+  for (const socket of lanSockets) socket.destroy();
+}
+let lanHost;
+let lanTls;
+let remoteStopping = false;
+let lanError;
+const LAN_ALLOW_LOCAL = process.env.CODEFLOW_LAN_ALLOW_LOCAL === "1";
+let tailscaleStatus = { state: "unavailable", message: "Tailscale has not been checked yet." };
+let detectingTailscale;
+let detectedTailscaleAt = 0;
+let syncingLan = Promise.resolve();
+async function refreshTailscale(force = false) {
+  if (process.env.CODEFLOW_SSH_HOST) return;
+  if (detectingTailscale) return detectingTailscale;
+  if (!force && Date.now() - detectedTailscaleAt < 5e3) return;
+  detectingTailscale = detectTailscale().then((status) => {
+    tailscaleStatus = status;
+    detectedTailscaleAt = Date.now();
+  }).finally(() => {
+    detectingTailscale = void 0;
+  });
+  return detectingTailscale;
+}
+function networkHost() {
+  if (process.env.CODEFLOW_SSH_HOST || remoteStopping || remoteTlsIssue() || !remote.enabled || !remote.lan) return void 0;
+  if (savedCertificate && remote.transport === "tailscale" && savedCertificate.hostname !== tailscaleStatus.dnsName) return void 0;
+  if (remote.transport === "tailscale") return tailscaleStatus.state === "connected" ? tailscaleStatus.ip : void 0;
+  return "0.0.0.0";
+}
+function syncLanServer(signOut = false) {
+  const change = syncingLan.catch(() => void 0).then(async () => {
+    let host = networkHost();
+    if (lanServer && (host !== lanHost || lanTls !== phoneTls)) {
+      const previous = lanServer;
+      lanServer = void 0;
+      lanHost = void 0;
+      await new Promise((resolve) => {
+        previous.close(() => resolve());
+        previous.closeAllConnections();
+        closeLanConnections();
+      });
+      host = networkHost();
+    }
+    if (!host) {
+      lanError = void 0;
+      return;
+    }
+    if (lanServer) {
+      if (signOut) {
+        lanServer.closeAllConnections();
+        closeLanConnections();
+      }
+      return;
+    }
+    lanError = void 0;
+    const transport = remote.transport ?? "lan";
+    const servingTls = phoneTls;
+    const receive = listener("lan");
+    const handleNetwork = (req, res) => {
+      if (host !== networkHost() || servingTls !== phoneTls || transport !== (remote.transport ?? "lan")) {
+        return send(res, 403, { error: "Remote access changed. Reconnect using the current link." });
+      }
+      receive(req, res);
+    };
+    const server2 = phoneTls ? createSecureServer({ ...phoneTls, maxHeaderSize: MAX_HEADER_SIZE }, handleNetwork) : createServer({ maxHeaderSize: MAX_HEADER_SIZE }, handleNetwork);
+    server2.on("connection", (socket) => {
+      lanSockets.add(socket);
+      socket.once("close", () => lanSockets.delete(socket));
+      const source = (socket.remoteAddress ?? "").replace(/^::ffff:/i, "");
+      if (!LAN_ALLOW_LOCAL && (isOwnAddress(source) || source === host || transport === "tailscale" && !isTailscaleIPv4(source))) socket.destroy();
+    });
+    lanServer = server2;
+    lanHost = host;
+    lanTls = servingTls;
+    await new Promise((resolve) => {
+      server2.once("listening", resolve);
+      server2.on("error", (err) => {
+        lanError = err.code === "EADDRINUSE" ? `Port ${REMOTE_PORT} is already in use by another program. Set CODEFLOW_REMOTE_PORT to a free port, then restart code-flow.` : transport === "tailscale" ? `Codeflow couldn't listen on Tailscale (${host}:${REMOTE_PORT}). Check that Tailscale is connected, then refresh.` : `code-flow couldn't listen on your network (port ${REMOTE_PORT}): ${err.message}`;
+        logError(lanError, err);
+        if (lanServer === server2) {
+          lanServer = void 0;
+          lanHost = void 0;
+        }
+        server2.close();
+        resolve();
+      });
+      server2.listen(REMOTE_PORT, host);
+    });
+  });
+  syncingLan = change;
+  return change;
+}
+async function renewRemoteCertificate() {
+  if (tlsConfigured || process.env.CODEFLOW_SSH_HOST || remoteStopping || configuringTls || !remote.enabled || !remote.lan || remote.transport !== "tailscale") return;
+  const status = certificateRenewal.status(savedCertificate);
+  if (!status || status.running || status.nextAttempt > Date.now()) return;
+  configuringTls = true;
+  try {
+    const change = changingRemote.catch(() => void 0).then(async () => {
+      await certificateRenewal.tick(savedCertificate, async () => {
+        const previous = savedCertificate;
+        if (!previous) throw new Error("Certificate missing");
+        await refreshTailscale(true);
+        if (remoteStopping || tailscaleStatus.state !== "connected" || tailscaleStatus.dnsName !== previous.hostname) throw new Error("Tailscale identity unavailable");
+        const certificate = await requestTailscaleCertificate(previous.hostname);
+        const details = validateRemoteCertificate(certificate);
+        if (remoteStopping || details.hostname !== previous.hostname || details.expiresAt <= previous.expiresAt) throw new Error("Certificate was not extended");
+        await saveRemoteCertificate(certificate);
+        phoneTls = { cert: certificate.cert, key: certificate.key };
+        phoneProtocol = "https";
+        savedCertificate = details;
+        tlsLoadError = void 0;
+        await syncLanServer();
+        return details;
+      });
+    });
+    changingRemote = change;
+    await change;
+  } finally {
+    configuringTls = false;
+  }
+}
+const EPOCH = randomBytes(6).toString("hex");
+const STALL_MS = envNumber("CODEFLOW_SSE_STALL_MS", 3e4, { min: 100 });
+function openStream(res, epoch = EPOCH) {
+  res.writeHead(200, {
+    "content-type": "text/event-stream",
+    "cache-control": "no-cache",
+    connection: "keep-alive"
+  });
+  const writer = createSseWriter(res, { stallMs: STALL_MS, maxBytes: envNumber("CODEFLOW_SSE_BUFFER_BYTES", 8 * 1024 * 1024, { min: 1024 }) });
+  const write = (chunk) => writer.write(chunk);
+  const ping = setInterval(() => write(": ping\n\n"), 15e3);
+  res.on("close", () => {
+    clearInterval(ping);
+  });
+  return { send: (event, seq) => write(`${seq === void 0 ? "" : `id: ${epoch}:${seq}
+`}data: ${JSON.stringify(event)}
+
+`) };
+}
+function lastEventSeq(req, expectedEpoch = EPOCH) {
+  return cursorSeq(String(req.headers["last-event-id"] ?? ""), expectedEpoch);
+}
+const runFeed = { seq: 0, bytes: 0, recent: [], clients: /* @__PURE__ */ new Set() };
+const RUN_FEED_KEEP = 500;
+let runHistoryRevision = 0;
+manager.subscribeAll((run) => {
+  if (run.deleted) runHistoryRevision++;
+  const entry = { seq: ++runFeed.seq, run, bytes: Buffer.byteLength(JSON.stringify(run)) };
+  runFeed.recent.push(entry);
+  runFeed.bytes += entry.bytes;
+  while (runFeed.recent.length > RUN_FEED_KEEP || runFeed.bytes > 32 * 1024 * 1024) runFeed.bytes -= runFeed.recent.shift().bytes;
+  for (const client of runFeed.clients) client(entry);
+});
+function streamAllRuns(req, res, limit) {
+  const page = limit === void 0 ? void 0 : fileAccess.page({ limit });
+  const epoch = `${EPOCH}-fs${filesystemFeedRevision}-history${runHistoryRevision}`;
+  const stream = openStream(res, epoch);
+  const after = lastEventSeq(req, epoch);
+  const oldest = runFeed.recent[0]?.seq ?? runFeed.seq + 1;
+  if (after !== void 0 && after >= oldest - 1 && after <= runFeed.seq) {
+    stream.send({ type: "hello", epoch, seq: runFeed.seq, resumed: true });
+    for (const e of runFeed.recent) if (e.seq > after && !fileAccess.restrictedRun(e.run)) stream.send({ type: "run", seq: e.seq, run: e.run }, e.seq);
+  } else {
+    const attention = page ? manager.attentionPage({ limit: 100, predicate: (run) => !fileAccess.restrictedRun(run) }) : void 0;
+    const runs = page ? [...new Map([...page.runs, ...attention.runs].map((run) => [run.id, run])).values()] : fileAccess.list();
+    stream.send({ type: "hello", epoch, seq: runFeed.seq, runs, ...page ? { nextCursor: page.nextCursor, total: page.total, attentionTotal: attention.total, attentionTruncated: attention.truncated, attentionNextCursor: attention.nextCursor } : {} }, runFeed.seq);
+  }
+  const client = (e) => {
+    if (!fileAccess.restrictedRun(e.run)) stream.send({ type: "run", seq: e.seq, run: e.run }, e.seq);
+  };
+  runFeed.clients.add(client);
+  const stopPolicy = filePolicies.onChange(() => res.end());
+  res.on("close", () => {
+    runFeed.clients.delete(client);
+    stopPolicy();
+  });
+}
+const teamFeed = /* @__PURE__ */ new Map();
+function teamBroadcast(frame, seq, id = "local") {
+  for (const deliver of teamFeed.get(id) ?? []) deliver(frame, seq);
+}
+function teamFrame(event) {
+  const frame = { type: "change", seq: event.seq, kind: event.kind };
+  if (event.taskId !== void 0) frame.taskId = event.taskId;
+  if (event.projectId !== void 0) frame.projectId = event.projectId;
+  return frame;
+}
+collab.onChange((event) => {
+  if (event.kind !== "inbox") return teamBroadcast(teamFrame(event), event.seq);
+  if (event.userIds?.includes("owner")) void collab.inbox(ownerActor(collab.ownerName)).then(({ unread }) => teamBroadcast({ type: "inbox", seq: event.seq, unread }, event.seq), () => void 0);
+});
+sharedAccounts.onChange(() => teamBroadcast({ type: "resync" }));
+projects.onChange(() => teamBroadcast({ type: "resync" }));
+const topics = {
+  approvals(_name, _after, deliver) {
+    if (fileAccess.hasRestrictions()) throw new TopicError(403, "Approvals are unavailable under filesystem restrictions");
+    const generation = filesystemFeedRevision;
+    const publish = () => {
+      if (generation === filesystemFeedRevision && !fileAccess.hasRestrictions()) {
+        deliver({ type: "snapshot", records: redactExport(approvals.list().filter((record) => record.status === "pending")) });
+      }
+    };
+    const stop2 = approvals.subscribe(publish);
+    publish();
+    return stop2;
+  },
+  "project-teams"(projectId, _after, deliver) {
+    if (fileAccess.hasRestrictions() || !projects.get(projectId)) throw new TopicError(403, "Standing team scope is unavailable");
+    const generation = filesystemFeedRevision;
+    const publish = () => {
+      if (generation === filesystemFeedRevision && !fileAccess.hasRestrictions() && projects.get(projectId)) deliver({ type: "snapshot", teams: projectTeams.list(projectId), ...projectTeams.configuration() });
+    };
+    const off = projectTeams.store.subscribe(publish);
+    publish();
+    return off;
+  },
+  /**
+   * Every run's status changes, for the sidebar and notifications. A first connection (or one
+   * from before a restart, or that missed too much) starts with the whole list, in step with the
+   * stream; a reconnect gets the snapshots it missed.
+   */
+  runs(_name, after, deliver) {
+    const epoch = `${EPOCH}-fs${filesystemFeedRevision}-history${runHistoryRevision}`;
+    const from = cursorSeq(after, epoch);
+    const oldest = runFeed.recent[0]?.seq ?? runFeed.seq + 1;
+    if (from !== void 0 && from >= oldest - 1 && from <= runFeed.seq) {
+      deliver({ type: "hello", epoch, seq: runFeed.seq, resumed: true });
+      for (const e of runFeed.recent) if (e.seq > from && !fileAccess.restrictedRun(e.run)) deliver({ type: "run", seq: e.seq, run: e.run }, e.seq);
+    } else {
+      const page = fileAccess.page({ limit: 100 });
+      const attention = manager.attentionPage({ limit: 100, predicate: (run) => !fileAccess.restrictedRun(run) });
+      const runs = [...new Map([...page.runs, ...attention.runs].map((run) => [run.id, run])).values()];
+      deliver({ type: "hello", epoch, seq: runFeed.seq, runs, total: page.total, nextCursor: page.nextCursor, attentionTotal: attention.total, attentionTruncated: attention.truncated, attentionNextCursor: attention.nextCursor }, runFeed.seq);
+    }
+    const client = (e) => {
+      if (!fileAccess.restrictedRun(e.run)) deliver({ type: "run", seq: e.seq, run: e.run }, e.seq);
+    };
+    runFeed.clients.add(client);
+    return () => runFeed.clients.delete(client);
+  },
+  async "run-page"(id, after, deliver) {
+    const run = await manager.getAsync(id);
+    if (!run) throw new TopicError(404, "This run no longer exists");
+    if (fileAccess.restrictedRun(run)) throw new TopicError(403, "This run is unavailable under its filesystem policy");
+    const generation = filesystemFeedRevision, epoch = `run-${id}`;
+    let waiting = [], waitingBytes = 0, overflow = false, last = 0;
+    const allowed = () => generation === filesystemFeedRevision && !fileAccess.restrictedRun(run);
+    const send2 = (event) => {
+      if (event.seq > last && allowed()) {
+        last = event.seq;
+        deliver(transcriptPreview(event), event.seq);
+      }
+    };
+    const stop2 = manager.subscribe(id, (event) => {
+      if (!waiting) {
+        send2(event);
+        return;
+      }
+      const preview = transcriptPreview(event);
+      waitingBytes += Buffer.byteLength(JSON.stringify(preview));
+      if (waitingBytes > 2 * 1024 * 1024) {
+        overflow = true;
+        return;
+      }
+      waiting.push(preview);
+    });
+    try {
+      const page = await transcriptPage(id, { after: cursorSeq(after, epoch) });
+      if (!allowed()) throw new TopicError(409, "Filesystem policy changed; reconnect to refresh authorization");
+      if (overflow) throw new TopicError(503, "Run updates exceeded the replay buffer; reconnect to catch up");
+      const current = await manager.getAsync(id);
+      if (!current || !allowed()) throw new TopicError(404, "This run is no longer available");
+      const { steps, ...snapshot } = current;
+      const newest = Math.max(page.latestSeq, waiting.at(-1)?.seq ?? 0);
+      deliver({ type: "hello", epoch, resumed: page.resumed, snapshot: { run: snapshot, steps, seq: newest }, transcript: page, persistence: manager.persistence.get(id) });
+      last = page.latestSeq;
+      const queued = waiting;
+      waiting = void 0;
+      for (const event of queued) send2(event);
+      const stopPersistence = manager.persistence.subscribe(id, (status) => {
+        if (allowed()) deliver({ type: "persistence", status });
+      });
+      return () => {
+        stop2();
+        stopPersistence();
+      };
+    } catch (error) {
+      stop2();
+      throw error;
+    }
+  },
+  /**
+   * A run's events. The hello carries the run as it is now (with its steps), so a window never
+   * depends on the log holding the latest state (an event may have reached it before a crash lost
+   * its best-effort write). Then what it takes to show the run (its latest snapshots, every agent
+   * event and log line; see replayEvents), then live ones. Run event numbers are recovered from
+   * disk, so a cursor is the run's (`run-<id>:<seq>`), not this server start's: a window that
+   * reconnects, even to a restarted server, gets only what it missed. Live events that arrive
+   * while the history is still being read wait for it, so the window never gets an older snapshot
+   * after a newer one.
+   */
+  async run(id, after, deliver) {
+    if (!manager.get(id)) throw new TopicError(404, "This run doesn't exist. It may have been started by another code-flow, or its files were removed.");
+    if (fileAccess.restrictedRun(manager.get(id))) throw new TopicError(403, "This run is unavailable under its filesystem policy");
+    const generation = filesystemFeedRevision;
+    const allowed = () => {
+      const current = manager.get(id);
+      return generation === filesystemFeedRevision && !!current && !fileAccess.restrictedRun(current);
+    };
+    const epoch = `run-${id}`;
+    const requested = cursorSeq(after, epoch);
+    let last = 0;
+    const send2 = (e) => {
+      if (e.seq <= last || !allowed()) return;
+      last = e.seq;
+      deliver(e, e.seq);
+    };
+    let waiting = [];
+    const stop2 = manager.subscribe(id, (e) => waiting ? waiting.push(e) : send2(e));
+    try {
+      const history = await manager.events(id);
+      if (!allowed()) throw new TopicError(409, "Filesystem policy changed; reconnect to refresh authorization");
+      const newest = Math.max(0, history.at(-1)?.seq ?? 0, waiting.at(-1)?.seq ?? 0);
+      const from = requested !== void 0 && requested <= newest ? requested : void 0;
+      last = from ?? 0;
+      const { steps, ...run } = manager.get(id);
+      deliver({ type: "hello", epoch, resumed: from !== void 0, snapshot: { run, steps, seq: newest } });
+      for (const event of replayEvents(history.filter((e) => e.seq > last))) send2(event);
+    } catch (err) {
+      stop2();
+      throw err;
+    } finally {
+      const live = waiting.sort((a, b) => a.seq - b.seq);
+      waiting = void 0;
+      for (const event of live) send2(event);
+    }
+    return stop2;
+  },
+  /** A terminal of the side panel: what it showed so far, then its output as it comes. */
+  shell(id, _after, deliver) {
+    if (fileAccess.hasRestrictions()) throw new TopicError(403, "Terminals are paused under filesystem restrictions");
+    const shell = shells.get(id);
+    if (!shell) throw new TopicError(404, "That terminal is gone (code-flow restarted?)");
+    deliver({ type: "hello", shell, history: shells.history(id) });
+    return shells.subscribe(id, (e) => deliver(e)) ?? (() => {
+    });
+  },
+  /** The team board: hub mode replays the store's ring from the cursor (or asks for a reload), linked mode relays the hub's stream. */
+  team(name, after, deliver) {
+    let entry;
+    try {
+      entry = teamConnections.get(name);
+    } catch (error) {
+      throw new TopicError(404, error.message);
+    }
+    if (entry.link.linked) deliver({ type: "hello", epoch: `link-${entry.id}-${EPOCH}`, seq: 0, linked: true, connection: entry.link.state().connection });
+    else {
+      const page = collab.eventsSince(after);
+      deliver({ type: "hello", epoch: page.epoch, seq: page.seq, linked: false }, page.seq);
+      if (page.resync) deliver({ type: "resync" });
+      for (const event of page.events) if (event.kind !== "inbox") deliver(teamFrame(event), event.seq);
+    }
+    const feed = teamFeed.get(entry.id) ?? /* @__PURE__ */ new Set();
+    teamFeed.set(entry.id, feed);
+    feed.add(deliver);
+    return () => {
+      feed.delete(deliver);
+      if (!feed.size) teamFeed.delete(entry.id);
+    };
+  }
+};
+const hub = new StreamHub(topics);
+const ownerHubStreams = /* @__PURE__ */ new Set();
+let streamSharing = { channelKey: randomBytes(32).toString("hex"), lockId: randomBytes(16).toString("hex") };
+function closeOwnerStreams(rotate = false) {
+  if (rotate) streamSharing = { channelKey: randomBytes(32).toString("hex"), lockId: randomBytes(16).toString("hex") };
+  for (const response of ownerHubStreams) response.end();
+}
+filePolicies.onChange(() => closeOwnerStreams());
+function openHubStream(res, url) {
+  const raw = url.searchParams.get("subs") ?? "[]";
+  if (raw.length > 16384) throw new HttpError(400, "Too many subscriptions");
+  let subs;
+  try {
+    subs = JSON.parse(raw);
+  } catch {
+    throw new HttpError(400, "subs must be JSON");
+  }
+  const stream = openStream(res);
+  ownerHubStreams.add(res);
+  const stopPolicy = filePolicies.onChange(() => res.end());
+  const client = hub.open((message) => stream.send(message), subs);
+  res.on("close", () => {
+    ownerHubStreams.delete(res);
+    stopPolicy();
+    hub.close(client);
+  });
+}
+async function streamTopic(req, res, kind, name = "") {
+  const epoch = kind === "run" ? `run-${name}` : `${EPOCH}-fs${filesystemFeedRevision}-history${runHistoryRevision}`;
+  const after = lastEventSeq(req, epoch);
+  const stream = openStream(res, epoch);
+  let closed = false;
+  const stopPolicy = filePolicies.onChange(() => res.end());
+  res.on("close", () => {
+    closed = true;
+    stopPolicy();
+  });
+  try {
+    const stop2 = await topics[kind](name, after === void 0 ? void 0 : `${epoch}:${after}`, (data, seq) => stream.send(data, kind === "shell" ? void 0 : seq));
+    if (closed) stop2();
+    else res.on("close", stop2);
+  } catch (err) {
+    if (err instanceof TopicError) return res.end();
+    throw err;
+  }
+}
+const performanceMetrics = new PerformanceMetrics();
+async function handle(req, res, via) {
+  performanceMetrics.observe(req, res);
+  if (stopping) throw new HttpError(503, "The backend is stopping");
+  const url = new URL(req.url ?? "/", "http://localhost");
+  let parts = url.pathname.split("/").filter(Boolean);
+  if (parts[0] === "api") parts = await attempt(async () => canonicalSharedPath(req.url ?? "/").parts);
+  if (await handlePublic(req, res, url, parts, via)) return;
+  if (via === "lan") checkLanOrigin(req);
+  else checkOrigin(req);
+  const bearer = String(req.headers.authorization ?? "").replace(/^Bearer\s+/i, "");
+  const explicitOwner = via === "local" && !!bearer && tokenMatches(bearer, auth.token);
+  const runnerBearer = !explicitOwner && looksLikeRunnerToken(bearer);
+  const shared = explicitOwner || runnerBearer ? void 0 : sharedSession(req);
+  const sharedPresent = readCookies(req, SHARED_COOKIE).length > 0;
+  const owner = explicitOwner || !sharedPresent && !runnerBearer && (via === "lan" ? phoneSignedIn(req) : signedIn(req));
+  if (parts.join("/") === "api/auth/login" && req.method === "POST") {
+    sharedMutation(req);
+    const body = await readLoginJson(req);
+    const session = await attempt(() => sharedAccounts.login({ username: body.username, password: body.password, ...sharedTransport(req) }));
+    if (owner) closeOwnerStreams(true);
+    res.setHeader("set-cookie", [sharedCookie(session.token, sharedTransport(req).secure), clearCookie(COOKIE), clearCookie(PHONE_COOKIE)]);
+    return send(res, 200, { user: session.user, expiresAt: session.expiresAt });
+  }
+  if (parts.join("/") === "api/auth/self" && req.method === "GET") return send(res, 200, owner ? { kind: "owner", streamSharing } : shared?.identity ?? { kind: "anonymous" });
+  if (parts.join("/") === "api/auth/logout" && req.method === "POST") {
+    sharedMutation(req);
+    for (const token of readCookies(req, SHARED_COOKIE)) await attempt(() => sharedAccounts.logout(token));
+    auth.claimable = false;
+    if (owner) closeOwnerStreams(true);
+    res.setHeader("set-cookie", [clearCookie(SHARED_COOKIE), clearCookie(COOKIE), clearCookie(PHONE_COOKIE)]);
+    return send(res, 200, { signedOut: true });
+  }
+  if (parts.join("/") === "api/team/runners/connect" && req.method === "POST") return handleRunnerConnect(req, res, { accounts: sharedAccounts, store: collab, transport: sharedTransport(req) });
+  if (req.method === "GET" && url.pathname === "/") {
+    const given = url.searchParams.get("token");
+    if (given) {
+      if (via === "lan") throw new HttpError(403, "Use a phone pairing link or shared-project account on this listener");
+      if (!tokenMatches(given, auth.token)) throw new HttpError(403, "That link is from an earlier code-flow session; use the one printed when it last started");
+      auth.claimable = false;
+      res.writeHead(302, { location: "/", "set-cookie": [sessionCookie(), clearCookie(SHARED_COOKIE)], "cache-control": "no-store", "referrer-policy": "no-referrer" });
+      return res.end();
+    }
+    const sharedLogin = sharedAccounts.available && sharedAccounts.hasUsers && (via === "local" || !!phoneTls);
+    const claim = via === "local" && !owner && !sharedPresent && mayClaim(req);
+    if (!owner && !shared && !claim && !sharedLogin) {
+      res.writeHead(401, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", ...NO_FRAMES });
+      return res.end(via === "lan" ? PHONE_LOCKED_PAGE : LOCKED_PAGE);
+    }
+    if (via === "lan" && owner && !phoneControl()) throw new HttpError(404, "Not found");
+    if (owner || shared || claim) auth.claimable = false;
+    return sendAppPage(req, res, { ...NO_FRAMES, ...claim ? { "set-cookie": sessionCookie() } : {} });
+  }
+  if (parts[0] === "docs" && req.method === "GET") return serveDocs(docsDirectory, url.pathname, res);
+  if (parts[0] === "assets" && parts.length === 2 && req.method === "GET") return sendAsset(fileURLToPath(new URL("../public/assets/", import.meta.url)), parts[1], req, res);
+  if (parts[0] === "computer") {
+    if (via !== "local" || !owner || !sshProjects) throw new HttpError(403, "Use the local owner app to open remote projects");
+    const id = parts[1] ?? "";
+    if (!/^[a-f0-9]{16}$/.test(id)) throw new HttpError(404, "Computer not found");
+    const context = await attempt(() => sshProjects.context(id));
+    if (parts.length === 2 && req.method === "GET") {
+      const prefix = `/computer/${id}`;
+      if (!url.pathname.endsWith("/")) {
+        res.writeHead(302, { location: prefix + "/" });
+        res.end();
+        return;
+      }
+      const html = (await readFile(indexHtml, "utf8")).replace(/<script\b/, `<script>window.__CODEFLOW_WORKSPACE=${JSON.stringify(id)};</script><script`);
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", ...NO_FRAMES });
+      res.end(html);
+      return;
+    }
+    const path = url.pathname.slice(`/computer/${id}`.length) + url.search;
+    if (path === "/api/ssh-context" && req.method === "GET") return send(res, 200, context);
+    if (parts[2] !== "api") throw new HttpError(404, "Unknown remote operation");
+    ownerHubStreams.add(res);
+    res.once("close", () => ownerHubStreams.delete(res));
+    return attempt(() => sshProjects.forward(id, req, res, path, `http://${req.headers.host}`));
+  }
+  if (parts[0] !== "api") throw new HttpError(404, "Not found");
+  if (runnerBearer) return handleRunnerRequest(req, res, url, parts, bearer);
+  if (shared) {
+    await attempt(() => fileAccess.sharedGate(req));
+    if (parts[1] === "team-terminals") return handleTeamTerminals(req, res, parts, teamTerminals, () => {
+      const current = sharedAccounts.authenticate(shared.token, { touch: false });
+      if (!current) throw new HttpError(401, "Your session ended; sign in again");
+      return memberActor(memberOf(current), "browser");
+    }, () => sharedMutation(req));
+    if (parts[1] === "host-execution") return handleHostExecution(req, res, parts, hostExecution, memberActor(memberOf(shared.identity), "browser"), () => sharedMutation(req));
+    if (parts[1] === "team") return handleTeamApi(req, res, url, parts, { store: collab, actor: memberActor(memberOf(shared.identity), "browser"), principal: "browser", reauthorize: () => {
+      const current = sharedAccounts.authenticate(shared.token, { touch: false });
+      if (!current) throw new HttpError(401, "Your session ended; sign in again");
+      return memberActor(memberOf(current), "browser");
+    }, mutation: sharedMutation });
+    if (req.method !== "GET") sharedMutation(req);
+    return attempt(() => handleSharedApi(req, res, url, parts, { accounts: sharedAccounts, token: shared.token, identity: shared.identity, manager, projects, comments: collaborationReviews, canReadFilePolicy: (run) => !fileAccess.restrictedRun(run), onFilePolicyChange: (listener2) => filePolicies.onChange(listener2), patterns: patterns.map(describePattern), templates }));
+  }
+  if (via === "lan" && !phoneControl()) throw new HttpError(404, "Not found");
+  if (!owner) throw Object.assign(new HttpError(401, "Not signed in: use the owner link or sign in to shared projects"), { signIn: true });
+  if (parts.join("/") === "api/ssh-context" && req.method === "GET") return send(res, 200, { kind: process.env.CODEFLOW_SSH_HOST ? "host" : "local" });
+  if (process.env.CODEFLOW_TEAM_HOST && parts.join("/") === "api/team-host-runtime" && req.method === "GET") return send(res, 200, { instance: process.env.CODEFLOW_TEAM_HOST });
+  if (process.env.CODEFLOW_SSH_HOST && parts.join("/") === "api/ssh-runtime" && req.method === "GET") return send(res, 200, { instance: process.env.CODEFLOW_SSH_HOST });
+  if (parts[1] === "projects" && parts[2] && parts[3] === "filesystem-policy") {
+    const project = projects.get(parts[2]);
+    if (!project) throw new HttpError(404, "Project not found");
+    if (parts.length !== 4) throw new HttpError(404, "Unknown filesystem policy operation");
+    if (req.method === "GET") return send(res, 200, await attempt(() => filePolicies.get(project.id)));
+    if (req.method === "PUT") {
+      const body = await readJson(req, 64 * 1024);
+      return send(res, 200, await attempt(() => fileAccess.update(project.id, body, async (commit, next) => {
+        if (!filteredTasksReady || filteredTasks.active()) throw new FilePolicyError("Finish or explicitly cancel and reconcile filtered tasks before changing policy; unavailable task storage must be repaired first", 409);
+        if (policyIsRestrictive(next) && extensions.list().length) throw new FilePolicyError("Disable configured extensions and restart before applying a restriction. Previously imported trusted JavaScript can retain background host authority, including a bundle rejected after initialization.", 409);
+        if (shells.list().length || teamTerminals.active() || manager.devServers.list().some((service) => service.status === "running")) throw new FilePolicyError("Close terminals and stop development services before changing filesystem policy", 409);
+        try {
+          await manager.withIdleExecution(async () => {
+            await pausePolicyBackground();
+            previews.closeAll();
+            sshPreviews.closeAll();
+            await commit();
+          });
+        } finally {
+          if (!fileAccess.hasRestrictions()) startPolicyBackground();
+        }
+      })));
+    }
+    throw new HttpError(405, "Use GET or PUT for filesystem policy");
+  }
+  if (parts[1] === "filtered-tasks") {
+    await attempt(() => fileAccess.sharedGate(req));
+    if (!filteredTasksReady) throw new HttpError(503, "Filtered task storage is unavailable; repair its private records before execution or policy changes");
+    auth.claimable = false;
+    if (req.method === "POST" && parts.length === 2) manager.noteActivity();
+    if (await handleFilteredTasksApi(req, res, url, parts.slice(1), filteredTasks)) return;
+  }
+  if (parts[1] === "docs-help" && req.method === "POST") parseHelpRequest(await readJson(req, 64 * 1024, { timeoutMs: 1e4 }));
+  if (parts[1] === "improve-prompt") {
+    if (req.method !== "POST" || parts.length !== 2) throw new HttpError(404, "Unknown prompt improvement operation");
+    await attempt(async () => assertImproveEnvironment());
+  }
+  await attempt(() => fileAccess.ownerGate(req, url, parts));
+  if (parts[1] === "docs-help") {
+    if (parts.length !== 2 || via !== "local") throw new HttpError(403, "Use the local owner app for documentation help");
+    manager.noteActivity();
+    return attempt(() => docsHelp.handle(req, res));
+  }
+  if (parts[1] === "ssh-runtime" && process.env.CODEFLOW_SSH_HOST || parts[1] === "team-host-runtime" && process.env.CODEFLOW_TEAM_HOST) {
+    if (parts[2] === "preview" && parts.length === 3 && req.method === "POST") {
+      if (fileAccess.hasRestrictions()) throw new HttpError(409, "Filesystem restrictions pause remote previews");
+      const body = await readJson(req, 8192);
+      const target = previewTarget(String(body.url ?? ""));
+      if (!target || target.port === PORT || target.port === REMOTE_PORT) throw new HttpError(400, "Choose a remote development app's localhost HTTP address");
+      return send(res, 200, await sshPreviews.show(String(body.url)));
+    }
+    if (parts[2] === "stop" && parts.length === 3 && req.method === "POST") {
+      if (manager.list().some((run) => run.status === "running") || manager.busy.agents.running || manager.busy.checks.running || shells.list().some((shell) => shell.status === "running") || teamTerminals.active() || manager.devServers.list().some((service) => service.status === "running")) throw new HttpError(409, "Finish running work and close terminals and development servers before stopping the backend");
+      await attempt(() => manager.withIdleExecution(async () => {
+        await pausePolicyBackground();
+        send(res, 200, { ok: true });
+        void stop("SSH backend stopped from the app");
+      }));
+      return;
+    }
+    throw new HttpError(404, "Unknown SSH runtime operation");
+  }
+  if (parts[1] === "workspace-projects") {
+    if (!sshProjects || via !== "local") throw new HttpError(403, "Connected projects require the local app");
+    if (parts.length === 2 && req.method === "GET") return send(res, 200, { currentComputerId: "local", computers: await attempt(() => sshProjects.projectDirectory()) });
+    throw new HttpError(404, "Unknown connected project operation");
+  }
+  if (parts[1] === "ssh-hosts") {
+    if (!sshProjects || via !== "local") throw new HttpError(403, "Manage SSH connections from the local app");
+    if (fileAccess.hasRestrictions()) throw new HttpError(409, "Filesystem restrictions pause SSH connection management");
+    if (parts.length === 2 && req.method === "GET") return send(res, 200, await attempt(() => sshProjects.list()));
+    if (parts.length === 2 && req.method === "POST") return send(res, 201, await attempt(async () => sshProjects.add(await readJson(req, 8192))));
+    if (parts[3] === "team-server") {
+      if (parts[4] === "status" && parts.length === 5 && req.method === "GET") return send(res, 200, await attempt(() => sshProjects.teamServerStatus(parts[2])));
+      if (parts[4] === "installation" && parts.length === 5 && req.method === "DELETE") return send(res, 200, await attempt(() => sshProjects.removeTeamServer(parts[2])));
+      if (parts[4] === "autostart" && parts.length === 5) {
+        if (req.method === "GET") return send(res, 200, await attempt(() => sshProjects.teamAutostart(parts[2])));
+        if (req.method === "POST") return send(res, 200, await attempt(async () => {
+          const body = await readJson(req, 8192);
+          if (body.action !== "enable" && body.action !== "disable") throw new HttpError(400, "Choose enable or disable for automatic startup");
+          return sshProjects.teamAutostart(parts[2], body.action);
+        }));
+        throw new HttpError(405, "Use GET or POST for automatic startup");
+      }
+      if (parts.length === 4 && req.method === "POST") return send(res, 200, await attempt(async () => sshProjects.setupTeamServer(parts[2], await readJson(req, 8192))));
+      if (parts.length === 4 && req.method === "DELETE") {
+        await attempt(() => sshProjects.stopTeamServer(parts[2]));
+        return send(res, 200, { ok: true });
+      }
+      if (parts[4] === "api") return attempt(() => sshProjects.forwardTeamServer(parts[2], req, res, url.pathname.slice(`/api/ssh-hosts/${parts[2]}/team-server`.length) + url.search, `http://${req.headers.host}`));
+      throw new HttpError(404, "Unknown team server setup operation");
+    }
+    if (parts.length === 3 && req.method === "DELETE") {
+      await attempt(() => sshProjects.remove(parts[2]));
+      return send(res, 200, { ok: true });
+    }
+    if (parts.length === 4 && req.method === "POST") {
+      if (parts[3] === "connect") return send(res, 200, await attempt(() => sshProjects.connect(parts[2])));
+      if (parts[3] === "disconnect") {
+        await attempt(() => sshProjects.disconnect(parts[2]));
+        return send(res, 200, { ok: true });
+      }
+      if (parts[3] === "stop") {
+        await attempt(() => sshProjects.stop(parts[2]));
+        return send(res, 200, { ok: true });
+      }
+    }
+    throw new HttpError(404, "Unknown SSH connection operation");
+  }
+  if (parts[1] === "accounts") {
+    if (!parts[2] && req.method === "GET") return send(res, 200, await attempt(async () => sharedAccounts.snapshot()));
+    const body = await readJson(req);
+    if (body.roles) {
+      for (const id of Object.keys(body.roles)) if (!projects.get(id)) throw new HttpError(400, "Choose existing projects for shared roles");
+    }
+    if (!parts[2] && req.method === "POST") return send(res, 201, await attempt(() => sharedAccounts.create(body)));
+    if (parts.length === 3 && req.method === "PUT") return send(res, 200, await attempt(() => sharedAccounts.update(parts[2], body)));
+    if (parts.length === 4 && parts[3] === "revoke-sessions" && req.method === "POST") return send(res, 200, await attempt(() => sharedAccounts.revokeSessions(parts[2], body)));
+    throw new HttpError(404, "Unknown shared account operation");
+  }
+  if (await codeHostsApi.handle(req, res, parts.slice(1))) return;
+  if (parts[1] === "remote-workers") {
+    if (parts.length === 2 && req.method === "GET") return send(res, 200, remoteWorkers.list());
+    if (parts.length === 4 && parts[3] === "probe" && req.method === "POST") {
+      const body = await readJson(req, 8192);
+      if (typeof body.repoMapping !== "string") throw new HttpError(400, "Choose a registered repository mapping");
+      return send(res, 200, await attempt(() => remoteWorkers.probe(parts[2], { repoMapping: body.repoMapping })));
+    }
+    throw new HttpError(404, "Unknown remote worker operation");
+  }
+  if (parts.join("/") === "api/extensions" && req.method === "GET") return send(res, 200, { api: { major: 1, minor: 0 }, extensions: extensions.list() });
+  if (parts[1] === "acp-connections") {
+    if (req.method === "GET" && parts.length === 2) return send(res, 200, acpConnections.snapshot());
+    if (req.method === "POST" && parts[2] === "check" && parts.length === 3) {
+      const body = await readJson(req);
+      return attempt(async () => {
+        const connection = validateAcpConnection(body.connection);
+        if (acpChecks >= 2) throw new HttpError(429, "Two connection checks are already running. Try again shortly.");
+        acpChecks++;
+        try {
+          return send(res, 200, await probeAcp(connection));
+        } finally {
+          acpChecks--;
+        }
+      });
+    }
+    if (req.method === "POST" && parts.length === 2) {
+      const body = await readJson(req);
+      return send(res, 200, await attempt(() => acpConnections.save(body.revision, body.connection)));
+    }
+    if (req.method === "DELETE" && parts[2] && parts.length === 3) return send(res, 200, await attempt(() => acpConnections.remove(Number(url.searchParams.get("revision")), parts[2])));
+    throw new HttpError(404, "Unknown ACP connection operation");
+  }
+  if (parts[1] === "project-teams") return handleProjectTeams(projectTeams, req, res, parts, url);
+  if (parts[1] === "coordinated-changes") return coordinatedApi.handle(req, res, parts);
+  if (parts[1] === "team-terminals") return handleTeamTerminals(req, res, parts, teamTerminals, () => ownerActor(collab.ownerName), () => sharedMutation(req));
+  if (parts[1] === "host-execution") return handleHostExecution(req, res, parts, hostExecution, ownerActor(collab.ownerName), () => sharedMutation(req));
+  if (parts[1] === "team" || parts[1] === "team-link") {
+    if (parts[1] === "team-link" && via !== "local") throw new HttpError(404, "Not found");
+    return attempt(async () => {
+      if (parts[1] === "team-link" && parts[2] === "connections" && parts.length === 3 && req.method === "GET") return send(res, 200, { connections: teamConnections.inventory() });
+      if (parts[1] === "team-link" && parts[2] === "connect" && parts.length === 3 && req.method === "POST") {
+        const body = await readJson(req, 16 * 1024, { timeoutMs: 1e4 });
+        if (Object.keys(body).some((key) => !["url", "username", "password", "name"].includes(key))) throw new HttpError(400, "Unknown connection field");
+        const entry2 = await teamConnections.connect({ url: body.url, username: body.username, password: body.password, name: body.name });
+        return send(res, 201, { id: entry2.id, ...await linkInfo({ link: entry2.link, runner: entry2.runner, store: collab, manager, findPattern, agents: () => [] }) });
+      }
+      const selection = url.searchParams.get("teamConnection") ?? req.headers["x-codeflow-team"];
+      url.searchParams.delete("teamConnection");
+      if (selection !== void 0 && typeof selection !== "string") throw new HttpError(400, "Choose one team connection");
+      const entry = teamConnections.get(selection);
+      if (parts[1] === "team-link" && parts.length === 2 && req.method === "DELETE") {
+        await teamConnections.disconnect(entry.id);
+        return send(res, 200, { disconnected: true });
+      }
+      return teamConnections.use(entry.id, async () => {
+        if (parts[1] === "team") return entry.link.linked ? entry.link.proxy(req, res, parts, url) : handleTeamApi(req, res, url, parts, { store: collab, actor: ownerActor(collab.ownerName), principal: "owner", mutation: () => {
+        } });
+        const installed = req.method === "POST" && !fileAccess.hasRestrictions() ? (await agentAvailability()).filter((agent) => agent.available).map((agent) => agent.id) : [];
+        return handleTeamLinkApi(req, res, url, parts, { link: entry.link, runner: entry.runner, store: collab, manager, findPattern, agents: () => installed, hubName: collab.ownerName });
+      });
+    });
+  }
+  if (parts[1] === "runs" && parts.length === 6 && parts[3] === "remote-steps" && ["receipt", "cancel"].includes(parts[5]) && req.method === "POST") {
+    return send(res, 200, redactExport(await attempt(() => manager.inspectRemoteStep(parts[2], parts[4], { cancel: parts[5] === "cancel" }))));
+  }
+  if (["readiness", "verification", "workspace", "diagnostics", "v1"].includes(parts[1] ?? "")) {
+    const abort = new AbortController();
+    res.once("close", () => abort.abort());
+    const result = await attempt(() => handleWorkspaceApi(req, url, parts, manager, abort.signal));
+    if (result) return send(res, result.status, result.body);
+  }
+  if (parts[1] === "integrations") {
+    if (req.method === "GET" && !parts[2]) return send(res, 200, integrations.list());
+    if (req.method === "GET" && parts[2] && parts[3] === "items") {
+      const kind = url.searchParams.get("kind");
+      if (kind !== "issue" && kind !== "pr") throw new HttpError(400, "Choose issues or review requests");
+      return send(res, 200, await attempt(() => integrations.items(parts[2], kind, url.searchParams.get("cursor") ?? void 0)));
+    }
+    if (req.method === "POST" && parts[2] && parts[3] === "import") {
+      const body = await readJson(req);
+      if (!["issue", "pr"].includes(body.kind) || typeof body.key !== "string") throw new HttpError(400, "Choose a source item");
+      return send(res, 201, await attempt(() => integrations.importSource(parts[2], body.kind, body.key)));
+    }
+    throw new HttpError(404, "Unknown external source operation");
+  }
+  if (parts[1] === "notifications") {
+    if (!notificationsReady) throw new HttpError(503, "Notifications are disabled until their configuration and storage are repaired");
+    if (req.method === "GET" && !parts[2]) return send(res, 200, notifications.list());
+    if (req.method === "GET" && parts[2] === "deliveries") return send(res, 200, notifications.deliveries());
+    if (req.method === "POST" && parts[2] === "deliveries" && parts[3] && parts[4] === "retry") return send(res, 202, await attempt(() => notifications.retry(parts[3])));
+    if (req.method === "POST" && parts[2] && parts[3] === "test") return send(res, 202, await attempt(() => notifications.test(parts[2])));
+    if (req.method === "POST" && parts[2] && !parts[3]) return send(res, 200, await attempt(async () => notifications.update(parts[2], await readJson(req))));
+    throw new HttpError(404, "Unknown notification operation");
+  }
+  if (parts[1] === "approvals") {
+    if (req.method === "GET") return send(res, 200, redactExport(approvals.list(url.searchParams.get("run") ?? void 0)));
+    if (req.method === "POST" && parts[2]) {
+      const body = await readJson(req);
+      if (body.decision !== "approve" && body.decision !== "decline") throw new HttpError(400, "Choose approve or decline");
+      const request = approvals.list().find((record) => record.id === parts[2]);
+      const run = request ? manager.get(request.runId) : void 0;
+      if (!request || !run || run.status !== "running" || !run.approvals.tools || !run.steps.some((step) => step.id === request.stepId && step.status === "running")) throw new HttpError(409, "This approval is no longer active");
+      if (!approvals.respond(request.id, body.decision, { runId: run.id, stepId: request.stepId })) throw new HttpError(409, "This approval has expired or was already answered");
+      manager.log(run.id, `You ${body.decision === "approve" ? "approved" : "declined"} one ${request.kind} action in ${request.stepId}`);
+      return send(res, 200, { resolved: true });
+    }
+    throw new HttpError(404, "Unknown approval operation");
+  }
+  if (req.method === "GET" && parts[1] === "team-capabilities") return send(res, 200, await Promise.all(AGENT_IDS.map(adapterTeamCapabilities)));
+  if (parts[1] === "team-rollout") {
+    if (req.method === "GET") return send(res, 200, await teamEvaluationStore.rollout(autoTeamEnabled()));
+    if (req.method === "POST") {
+      const body = await readJson(req);
+      await attempt(() => teamEvaluationStore.decide({ stage: body.stage, rationale: body.rationale, evaluationIds: body.evaluationIds }));
+      return send(res, 200, await teamEvaluationStore.rollout(autoTeamEnabled()));
+    }
+  }
+  if (req.method === "GET" && parts[1] === "team-evaluations") {
+    const reports = await teamEvaluationStore.list();
+    return send(res, 200, { reports, assessment: assessTeamRollout(reports), rollout: await teamEvaluationStore.rollout(autoTeamEnabled()) });
+  }
+  if (req.method === "GET" && parts[1] === "agents") return send(res, 200, fileAccess.hasRestrictions() ? Object.values(adapters).map((adapter) => ({ id: adapter.id, displayName: adapter.displayName, binary: adapter.binary, available: false })) : await agentAvailability());
+  if (req.method === "GET" && parts[1] === "events") {
+    const limit = url.searchParams.has("limit") ? Number(url.searchParams.get("limit")) : void 0;
+    if (limit !== void 0 && (!Number.isInteger(limit) || limit < 1 || limit > 100)) throw new HttpError(400, "History page size must be between 1 and 100");
+    return streamAllRuns(req, res, limit);
+  }
+  if (req.method === "GET" && parts[1] === "stream" && !parts[2]) return openHubStream(res, url);
+  if (req.method === "POST" && parts[1] === "stream" && parts[2]) {
+    const body = await readJson(req);
+    if (!hub.update(parts[2], body)) throw new HttpError(404, "That stream has closed; open a new one");
+    return send(res, 200, { ok: true });
+  }
+  if (parts[1] === "team-templates") {
+    const project = url.searchParams.get("project") || void 0;
+    if (project && !projects.list().some((p) => p.id === project)) throw new HttpError(404, "Project not found");
+    if (req.method === "GET" && !parts[2]) return send(res, 200, await attempt(() => teamTemplateStore.list(project, url.searchParams.get("history") === "1")));
+    if (req.method === "POST" && parts[2] === "migrate") return send(res, 200, await attempt(async () => teamTemplateStore.migrate(await readJson(req), project)));
+    if (req.method === "POST" && !parts[2]) {
+      const body = await readJson(req);
+      const template = await attempt(async () => validateTeamTemplate(body.template));
+      if (template.project && !projects.list().some((p) => p.id === template.project)) throw new HttpError(404, "Project not found");
+      if (template.workflow && !findPattern(template.workflow)) throw new HttpError(400, "Unknown template workflow");
+      return send(res, 201, await attempt(() => teamTemplateStore.save(template, body.expectedVersion)));
+    }
+    throw new HttpError(404, "Unknown team template operation");
+  }
+  if (req.method === "GET" && parts[1] === "patterns") return send(res, 200, patterns.map(describePattern));
+  if (req.method === "GET" && parts[1] === "fs") {
+    const listing = await listDirectories(url.searchParams.get("path") ?? void 0, url.searchParams.get("hidden") === "1").catch((err) => {
+      const status = err.code === "ENOENT" ? 404 : err.code === "EACCES" || err.code === "EPERM" ? 403 : 400;
+      throw new HttpError(status, err.code === "ENOENT" ? "Folder not found" : err.message);
+    });
+    return send(res, 200, listing);
+  }
+  if (req.method === "GET" && parts[1] === "branches") {
+    const repo = await requestedRepo(url);
+    return send(res, 200, { repo, worktreeRoot: worktreeRoot(repo), ...await listBranches(repo) });
+  }
+  if (req.method === "GET" && parts[1] === "tree") {
+    const repo = await requestedFolder(url);
+    const listing = await listTree(repo, url.searchParams.get("path") ?? "").catch((err) => {
+      if (err instanceof FilePolicyError) throw new HttpError(err.status, err.message);
+      throw new HttpError(err.code === "ENOENT" ? 404 : 400, err.code === "ENOENT" ? "Folder not found" : err.message);
+    });
+    return send(res, 200, listing);
+  }
+  if (req.method === "GET" && parts[1] === "doctor" && parts[2] === "dependencies") return send(res, 200, await discoverDependencies(manager.quota));
+  if (req.method === "GET" && parts[1] === "doctor" && parts[2] === "git") return send(res, 200, await checkGit());
+  if (req.method === "GET" && parts[1] === "doctor") {
+    const health = await doctor(manager.quota);
+    for (const entry of health) {
+      if (entry.installed && entry.signedIn === false) manager.recordQuota(entry.id, "signed_out", {});
+      else if (entry.signedIn === true && manager.quota[entry.id]?.status === "signed_out") manager.recordQuota(entry.id, "allowed", {});
+    }
+    return send(res, 200, health);
+  }
+  if (req.method === "GET" && parts[1] === "health") {
+    return send(res, 200, { busy: manager.busy, activity: manager.inspectRepositoryActivity(), writes: writeHealth, performance: performanceMetrics.snapshot(), disk: writeQueueStats(), delivery: streamHealth, codeIntelligence: codeIntelligenceHealth, storage: manager.inspectStorage(), runs: manager.runningCount, interactiveTerminal: !fileAccess.hasRestrictions() && await shells.interactive(), streams: hub.stats });
+  }
+  if (req.method === "GET" && parts[1] === "experience" && parts.length === 2) {
+    const list = runsIn(url.searchParams.get("project")).filter((run) => !url.searchParams.get("repo") || run.repo === url.searchParams.get("repo"));
+    return send(res, 200, { metrics: outcomeMetrics(list), recommendations: workflowRecommendations(list, url.searchParams.get("repo") ?? "", taskIntent(url.searchParams.get("intent"))) });
+  }
+  if (req.method === "GET" && parts[1] === "stats") {
+    const since = Number(url.searchParams.get("since")) || void 0;
+    const repo = url.searchParams.get("repo") ? await requestedRepo(url) : void 0;
+    return send(res, 200, computeStats(runsIn(url.searchParams.get("project")), { repo, since }));
+  }
+  if (req.method === "POST" && parts[1] === "compare") return send(res, 201, await startComparison(await readJson(req)));
+  if (req.method === "GET" && parts[1] === "disk") {
+    return send(res, 200, await diskUsage(runsIn(url.searchParams.get("project")), url.searchParams.get("repo") ? await requestedRepo(url) : void 0));
+  }
+  if (req.method === "POST" && parts[1] === "cleanup") {
+    const body = await readJson(req);
+    return send(res, 200, await cleanUp(runsIn(body.project), Math.max(0, Number(body.olderThanDays ?? 7)), typeof body.repo === "string" ? body.repo : void 0));
+  }
+  if (parts[1] === "maintenance" && parts[2] === "retention") {
+    if (req.method === "GET" && !parts[3]) return send(res, 200, await attempt(() => retentionPolicy.get()));
+    if (req.method === "POST" && !parts[3]) {
+      const body = await readJson(req);
+      return send(res, 200, await attempt(() => retentionPolicy.set({ days: body.days, keepRunIds: body.keepRunIds, keepMemoryIds: body.keepMemoryIds }, body.expectedRevision)));
+    }
+    if (req.method === "POST" && parts[3] === "preview") return send(res, 200, await attempt(() => previewRetention({ home: CODEFLOW_HOME })));
+    throw new HttpError(404, "Retention deletion is an explicit offline CLI operation");
+  }
+  if (parts[1] === "deferred-runs") {
+    const id = parts[2], action = parts[3];
+    if (!id && req.method === "GET") return send(res, 200, await attempt(() => deferredRuns.list()));
+    if (!id && req.method === "POST") {
+      const body = await readJson(req);
+      const raw = body.run;
+      if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new HttpError(400, "Choose a run configuration to defer");
+      if (raw.teamRerun !== void 0 || raw.deferred !== void 0) throw new HttpError(400, "Server launch identities cannot be queued");
+      if (raw.context?.attachments !== void 0 && (!Array.isArray(raw.context.attachments) || raw.context.attachments.length)) throw new HttpError(400, "Attachments cannot be deferred; remove them before queueing");
+      const request = await attempt(async () => sanitizeDeferredRequest({ ...automationRun(raw), parentRunId: raw.parentRunId, branchPrefix: raw.branchPrefix }));
+      const pattern = findPattern(request.pattern);
+      if (!pattern) throw new HttpError(400, "Unknown pattern");
+      request.repo = await attempt(() => repoRoot(request.repo));
+      if (request.project && !projects.get(request.project)?.repos.includes(request.repo)) throw new HttpError(400, "Choose a repository belonging to this project");
+      if (request.parentRunId && manager.get(request.parentRunId)?.repo !== request.repo) throw new HttpError(400, "Choose an existing parent run in the same repository");
+      for (const spec of pattern.roles) if (!spec.optional && pattern.id !== "auto-team" && !request.roles[spec.id]?.length) throw new HttpError(400, `Pick an agent for "${spec.label}"`);
+      validateLoop(request.loop);
+      request.options = validateOptions(pattern, request.options);
+      return send(res, 201, await attempt(() => deferredRuns.enqueue({ name: body.name, run: request, notBefore: body.notBefore, waitForProviders: body.waitForProviders, maxAttempts: body.maxAttempts, operationId: body.operationId })));
+    }
+    if (id && req.method === "POST") {
+      const body = await readJson(req);
+      if (action === "cancel") return send(res, 200, await attempt(() => deferredRuns.cancel(id, body.expectedRevision)));
+      if (action === "retry") return send(res, 200, await attempt(() => deferredRuns.retry(id, body.expectedRevision, { acknowledgeUnknown: body.acknowledgeUnknown === true })));
+      if (action === "attach") {
+        const job = (await deferredRuns.list()).find((item) => item.id === id), run = typeof body.runId === "string" ? manager.get(body.runId) : void 0;
+        if (!job || !run || run.repo !== job.run.repo || job.run.project && run.project !== job.run.project || run.deferred?.jobId !== job.id || run.deferred.claimId !== job.claimId || run.deferred.attempt !== job.attempts) throw new HttpError(409, "This run does not belong to this exact deferred launch claim");
+        await attempt(() => persistDeferredReceipt(run));
+        return send(res, 200, await attempt(() => deferredRuns.attach(id, body.expectedRevision, run.id)));
+      }
+    }
+    throw new HttpError(404, "Unknown deferred run operation");
+  }
+  if (parts[1] === "projects") {
+    const id = parts[2];
+    if (!id && req.method === "GET") return send(res, 200, projects.list());
+    if (!id && req.method === "POST") {
+      const body = await readJson(req);
+      return send(res, 201, await attempt(() => projects.create({ name: body.name, repos: Array.isArray(body.repos) ? body.repos : [] })));
+    }
+    if (id && !projects.get(id)) throw new HttpError(404, "Project not found");
+    if (id && parts[3] === "summary" && req.method === "GET") {
+      const inventory = projects.list();
+      return send(res, 200, manager.projectReport((run) => projectOf(run, inventory) === id && !fileAccess.restrictedRun(run)));
+    }
+    if (id && parts[3] === "repositories" && parts.length === 4 && req.method === "POST") {
+      const body = await readJson(req);
+      if (typeof body.repo !== "string" || !body.repo.startsWith("/")) throw new HttpError(400, "Choose a repository folder");
+      return send(res, 200, await attempt(async () => (await projects.include(id, await repoRoot(body.repo))).project));
+    }
+    if (id && parts[3] === "conventions") {
+      const project = projects.get(id);
+      if (!parts[4] && req.method === "GET") return send(res, 200, await attempt(() => conventions.get(id)));
+      if (!parts[4] && req.method === "PUT") return send(res, 200, await attempt(async () => conventions.save(id, await readJson(req))));
+      if (parts[4] === "restore-preview" && req.method === "POST") {
+        const body = await readJson(req);
+        return send(res, 200, await attempt(() => conventions.previewRestore(id, body.version)));
+      }
+      if (parts[4] === "restore" && req.method === "POST") return send(res, 200, await attempt(async () => conventions.restore(id, await readJson(req))));
+      if (parts[4] === "publication" && req.method === "GET") {
+        const repo = url.searchParams.get("repo");
+        if (!repo || !project.repos.includes(repo)) throw new HttpError(400, "Choose a repository belonging to this project");
+        return send(res, 200, await attempt(() => conventions.inspectRepository(repo)));
+      }
+      if (parts[4] === "publish" && req.method === "POST") {
+        const body = await readJson(req);
+        if (typeof body.repo !== "string" || !project.repos.includes(body.repo)) throw new HttpError(400, "Choose a repository belonging to this project");
+        return send(res, 200, await attempt(() => manager.withIdleRepository(body.repo, () => conventions.publish(id, body, { repos: project.repos, actor: "user", isIdle: () => manager.isRepositoryIdle(body.repo) }), { kind: "conventions-publication", owner: id })));
+      }
+      throw new HttpError(404, "Unknown conventions operation");
+    }
+    if (id && parts[3] === "memory") {
+      const project = projects.get(id);
+      const requested = url.searchParams.get("repo");
+      if (requested && !project.repos.includes(requested)) throw new HttpError(400, "That repository is not in this project");
+      const repos = requested ? [requested] : project.repos;
+      if (parts[4] === "graph" && !parts[5] && req.method === "GET") {
+        const repo = requested ?? (project.repos.length === 1 ? project.repos[0] : void 0);
+        if (!repo) throw new HttpError(400, "Choose a repository in this project");
+        return send(res, 200, await attempt(() => memoryStore.graph({ repo, projectId: id, scope: "project" }, { kind: "user", repo, projectId: id })));
+      }
+      if (parts[4] === "analysis") {
+        const body = req.method === "POST" ? await readJson(req) : {};
+        const repo = typeof body.repo === "string" ? body.repo : requested ?? (project.repos.length === 1 ? project.repos[0] : void 0);
+        if (!repo || !project.repos.includes(repo)) throw new HttpError(400, "Choose a repository in this project");
+        const entries = await memoryStore.list({ repo, projectId: id, scope: "project" }, { kind: "user", repo, projectId: id });
+        const analysis = await attempt(() => analyzeProjectMemory({ repo, projectId: id, entries }));
+        if (req.method === "GET" && !parts[5]) return send(res, 200, analysis);
+        if (req.method === "POST" && parts[5] === "publish") {
+          if (!Array.isArray(body.expectedSources) || JSON.stringify(body.expectedSources) !== JSON.stringify(analysis.onboarding.sourceRefs)) throw new HttpError(409, "The onboarding sources changed. Review the current summary before publishing");
+          if (!analysis.onboarding.sourceRefs.length) throw new HttpError(400, "There is no current trusted user guidance to publish");
+          return send(res, 201, await attempt(() => memoryStore.propose({ scope: "project", repo, projectId: id, title: analysis.onboarding.title, body: analysis.onboarding.body, tags: ["onboarding-summary"], derivedFrom: analysis.onboarding.sourceRefs, sourceRefs: analysis.onboarding.sourceRefs.map((ref) => `${ref.id}@${ref.revision}`) }, { kind: "user", repo, projectId: id }, { expectedSources: analysis.onboarding.sourceRefs })));
+        }
+        throw new HttpError(404, "Unknown memory analysis operation");
+      }
+      if (req.method === "GET" && !parts[4]) {
+        const entries = (await Promise.all(repos.map((repo) => memoryStore.list({ repo, projectId: id, scope: "project" }, { kind: "user", repo, projectId: id })))).flat();
+        return send(res, 200, entries.sort((a, b) => b.updatedAt - a.updatedAt || a.id.localeCompare(b.id)));
+      }
+      if (req.method === "POST" && parts[4] === "commands" && !parts[5]) {
+        const body = await readJson(req);
+        try {
+          let entry;
+          if (body.op === "create") {
+            const repo = typeof body.repo === "string" ? body.repo : project.repos.length === 1 ? project.repos[0] : "";
+            if (!project.repos.includes(repo)) throw new HttpError(400, "Choose a repository in this project");
+            entry = await memoryStore.propose({
+              scope: "project",
+              repo,
+              projectId: id,
+              title: body.title,
+              body: body.body,
+              paths: body.paths,
+              tags: body.tags,
+              applicability: body.applicability
+            }, { kind: "user", repo, projectId: id });
+          } else {
+            if (!["approve", "update", "delete", "feedback"].includes(body.op)) throw new HttpError(400, "Unknown memory command");
+            if (typeof body.id !== "string" || !Number.isSafeInteger(body.expectedRevision) || body.expectedRevision < 1) throw new HttpError(400, "Memory commands need an entry ID and exact revision");
+            const entries = (await Promise.all(project.repos.map((repo) => memoryStore.list({ repo, projectId: id, scope: "project" }, { kind: "user", repo, projectId: id })))).flat();
+            const existing = entries.find((candidate) => candidate.id === body.id);
+            if (!existing) throw new HttpError(404, "Memory entry not found in this project");
+            const authority = { kind: "user", repo: existing.repo, projectId: id };
+            if (body.op === "approve") entry = await memoryStore.accept(existing.id, body.expectedRevision, authority);
+            else if (body.op === "delete") entry = await memoryStore.remove(existing.id, body.expectedRevision, authority);
+            else if (body.op === "feedback") {
+              if (body.runId !== void 0) {
+                const source = typeof body.runId === "string" ? manager.get(body.runId) : void 0;
+                if (!source || source.repo !== existing.repo || source.project !== id || !source.memoryManifest?.included.some((ref) => ref.id === existing.id && ref.revision === body.expectedRevision)) throw new HttpError(400, "Feedback must refer to memory actually selected by this project's run");
+              }
+              entry = await memoryStore.recordFeedback(existing.id, body.expectedRevision, { rating: body.rating, note: body.note, runId: body.runId }, authority);
+            } else {
+              const patch = {};
+              for (const key of ["title", "body", "paths", "tags", "applicability"]) if (key in body) patch[key] = body[key];
+              entry = await memoryStore.revise(existing.id, body.expectedRevision, patch, authority, { accept: body.accept === true });
+            }
+          }
+          return send(res, body.op === "create" ? 201 : 200, entry);
+        } catch (error) {
+          if (error instanceof HttpError) throw error;
+          if (error instanceof MemoryConflictError) throw new HttpError(409, error.message);
+          const message = error.message;
+          if (/^Memory store cannot be read|^Memory storage limit/.test(message)) throw new HttpError(500, message);
+          throw new HttpError(400, message);
+        }
+      }
+      throw new HttpError(404, "Unknown project memory route");
+    }
+    if (id && req.method === "POST") {
+      const body = await readJson(req);
+      return send(res, 200, await attempt(() => manager.updateProject(id, { name: body.name, repos: Array.isArray(body.repos) ? body.repos : void 0 })));
+    }
+    if (id && req.method === "DELETE") {
+      await manager.removeProject(id);
+      return send(res, 200, { deleted: true });
+    }
+  }
+  if (req.method === "GET" && parts[1] === "templates") return send(res, 200, templates);
+  if (parts[1] === "remote") {
+    if (process.env.CODEFLOW_SSH_HOST && req.method !== "GET") throw new HttpError(403, "Use SSH to reach this backend; phone listeners are unavailable on SSH hosts");
+    if (parts[2] === "tls" && parts.length === 3) {
+      if (via !== "local") throw new HttpError(403, "Configure HTTPS from Codeflow on this computer");
+      if (req.method !== "POST") throw new HttpError(405, "Method not allowed");
+      if (tlsConfigured) throw new HttpError(409, "HTTPS is managed by environment variables. Remove those overrides and restart before managing certificates in Settings.");
+      const body = await readJson(req, 192 * 1024);
+      if (body.mode !== "tailscale" && body.mode !== "import") throw new HttpError(400, "Choose Tailscale or import certificate files");
+      if (configuringTls) throw new HttpError(409, "Secure access setup is already in progress");
+      configuringTls = true;
+      try {
+        const change = changingRemote.catch(() => void 0).then(async () => {
+          let certificate;
+          if (body.mode === "tailscale") {
+            await refreshTailscale(true);
+            if (remote.transport !== "tailscale" || tailscaleStatus.state !== "connected" || !tailscaleStatus.dnsName) throw new HttpError(400, "Choose Tailscale and connect this computer before setting up its certificate");
+            certificate = await attempt(() => requestTailscaleCertificate(tailscaleStatus.dnsName));
+          } else certificate = { source: "import", hostname: await attempt(async () => certificateHostname(body.hostname)), cert: body.cert, key: body.key };
+          const details = await attempt(async () => validateRemoteCertificate(certificate));
+          if (remote.transport === "tailscale" && tailscaleStatus.dnsName && details.hostname !== tailscaleStatus.dnsName) throw new HttpError(400, "Use a certificate for this computer's Tailscale DNS name");
+          const next = changeRemote(remote, { rotate: true, control: false });
+          await saveRemote(next);
+          remote = next;
+          await saveRemoteCertificate(certificate);
+          phoneTls = { cert: certificate.cert, key: certificate.key };
+          phoneProtocol = "https";
+          savedCertificate = details;
+          tlsLoadError = void 0;
+          await syncLanServer(true);
+        });
+        changingRemote = change;
+        await change;
+        return send(res, 200, remoteInfo(via));
+      } finally {
+        configuringTls = false;
+      }
+    }
+    if (parts[2] && parts[2] !== "devices") throw new HttpError(404, "Unknown remote access operation");
+    if (parts[2] === "devices") {
+      if (req.method === "GET") return send(res, 200, phoneSessions.list(remote.controlToken));
+      if (req.method === "DELETE" && parts[3]) return send(res, 200, { revoked: await phoneSessions.revoke(parts[3], remote.controlToken) });
+      throw new HttpError(404, "Unknown paired device operation");
+    }
+    if (req.method === "POST") {
+      const body = await readJson(req);
+      if (body.transport !== void 0 && body.transport !== "lan" && body.transport !== "tailscale") throw new HttpError(400, "Choose Wi-Fi or Tailscale for remote access");
+      const before = await changeSavedRemote({ enabled: body.enabled, lan: body.lan, transport: body.transport, control: body.control, rotate: !!body.rotate }).catch((err) => {
+        if (err instanceof HttpError) throw err;
+        logError("Couldn't save the phone settings", err);
+        throw new HttpError(500, `Couldn't save the phone settings: ${err.message}`);
+      });
+      const signOut = remote.controlToken !== before.controlToken || remote.token !== before.token || phoneControl(before) && !phoneControl();
+      if (remote.transport === "tailscale") await refreshTailscale();
+      if (via === "local") await syncLanServer(signOut);
+      if (via === "lan") res.once("close", () => void syncLanServer(signOut));
+    } else if (req.method === "GET") {
+      await refreshTailscale(url.searchParams.has("refresh"));
+      if (via === "local") await syncLanServer();
+      else res.once("close", () => void syncLanServer());
+    } else throw new HttpError(405, "Method not allowed");
+    return send(res, 200, remoteInfo(via));
+  }
+  if (parts[1] === "automations") {
+    if (parts[2] === "schedule-preview" && req.method === "POST") {
+      const body = await readJson(req);
+      const schedule = await attempt(async () => validateSchedule(body.schedule));
+      if (!schedule) throw new HttpError(400, "Choose a schedule");
+      return send(res, 200, { times: await attempt(async () => previewSchedule(schedule, body.after, body.count)) });
+    }
+    const id = parts[2];
+    if (!id && req.method === "GET") return send(res, 200, automations.list().map(describeAutomation));
+    if (!id && req.method === "POST") {
+      const body = await readJson(req);
+      const name = String(body.name ?? "").trim().slice(0, 80);
+      if (!name) throw new HttpError(400, "Name the automation");
+      const run = automationRun(body.run ?? {});
+      await buildStartInput(run);
+      const schedule = await attempt(async () => validateSchedule(body.schedule));
+      if (!schedule && !body.webhook) throw new HttpError(400, "Give it a schedule, a webhook, or both");
+      const trigger = await automations.create({ name, enabled: body.enabled !== false, run, schedule, webhook: !!body.webhook, isolate: !!body.isolate, image: typeof body.image === "string" ? body.image.trim() || void 0 : void 0 });
+      return send(res, 201, describeAutomation(trigger));
+    }
+    if (id && !automations.get(id)) throw new HttpError(404, "Automation not found");
+    if (id && parts[3] === "events" && req.method === "GET") return send(res, 200, redactExport(automations.events(id)));
+    if (id && parts[3] === "events" && parts[4] && parts[5] === "retry" && req.method === "POST") return send(res, 200, await attempt(() => automations.retryEvent(id, parts[4])));
+    if (id && parts[3] === "preview" && req.method === "POST") {
+      const body = await readJson(req);
+      return send(res, 200, redactExport(await attempt(() => automations.dryRun(id, Object.keys(body).length ? body : void 0))));
+    }
+    if (id && req.method === "DELETE") {
+      await automations.remove(id);
+      return send(res, 200, { deleted: true });
+    }
+    if (id && req.method === "POST" && parts[3] === "run") {
+      const fired = await attempt(() => automations.fire(id, { via: "manual" }));
+      if (fired.skipped) throw new HttpError(409, `Skipped: ${fired.skipped}`);
+      return send(res, 201, { id: fired.run?.id ?? fired.runs?.[0]?.id, ids: fired.runs?.map((r) => r.id) });
+    }
+    if (id && req.method === "POST" && !parts[3]) {
+      const body = await readJson(req);
+      const patch = {};
+      if (typeof body.name === "string" && body.name.trim()) patch.name = body.name.trim().slice(0, 80);
+      if (typeof body.enabled === "boolean") patch.enabled = body.enabled;
+      if (typeof body.webhook === "boolean") patch.webhook = body.webhook;
+      if (typeof body.isolate === "boolean") patch.isolate = body.isolate;
+      if (typeof body.image === "string") patch.image = body.image.trim() || void 0;
+      if ("schedule" in body) patch.schedule = await attempt(async () => validateSchedule(body.schedule));
+      if (body.run) {
+        const run = automationRun(body.run);
+        await buildStartInput(run);
+        patch.run = run;
+      }
+      if (body.rotateToken) patch.rotateToken = true;
+      return send(res, 200, describeAutomation(await automations.update(id, patch)));
+    }
+  }
+  if (req.method === "GET" && parts[1] === "github" && parts[2] === "sweep") {
+    const repo = await requestedRepo(url);
+    const kind = url.searchParams.get("kind");
+    if (!SWEEP_KINDS.includes(kind)) throw new HttpError(400, "Unknown kind of sweep");
+    return send(res, 200, await attempt(() => listSweep(repo, kind, manager.list())));
+  }
+  if (req.method === "POST" && parts[1] === "sweeps") return send(res, 201, await startSweep(await readJson(req)));
+  if (req.method === "GET" && parts[1] === "github" && (parts[2] === "issues" || parts[2] === "prs")) {
+    const repo = await requestedRepo(url);
+    return send(res, 200, await attempt(() => parts[2] === "issues" ? listIssues(repo) : listPullRequests(repo)));
+  }
+  if (req.method === "GET" && parts[1] === "repo-config") {
+    const repo = await requestedRepo(url);
+    return send(res, 200, await readRepoConfig(repo));
+  }
+  if (req.method === "GET" && parts[1] === "check") {
+    const repo = await requestedRepo(url);
+    return send(res, 200, await detectCheckCommand(repo) ?? { command: null });
+  }
+  if (req.method === "GET" && parts[1] === "search") {
+    const repo = await requestedFolder(url);
+    return send(res, 200, await searchFiles(repo, url.searchParams.get("q") ?? ""));
+  }
+  if (req.method === "GET" && parts[1] === "file") {
+    const repo = await requestedFolder(url);
+    const content = await readRepoFile(repo, url.searchParams.get("path") ?? "").catch((err) => {
+      if (err instanceof FilePolicyError) throw new HttpError(err.status, err.message);
+      throw new HttpError(err.code === "ENOENT" ? 404 : 400, err.code === "ENOENT" ? "File not found" : err.message);
+    });
+    return send(res, 200, content);
+  }
+  if (parts[1] === "notes") {
+    if (req.method === "GET" && parts[2] === "search") return send(res, 200, await attempt(() => notes.search(url.searchParams.get("q") ?? "")));
+    if (req.method === "GET" && parts[2] === "all") return send(res, 200, await notes.keys());
+    if (req.method === "GET" && parts[2] === "history") return send(res, 200, await notes.history(url.searchParams.get("key") ?? ""));
+    if (req.method === "POST" && parts[2] === "restore") {
+      const body = await readJson(req);
+      try {
+        return send(res, 200, await notes.restore(String(body.key ?? ""), body.revision, body.expectedRevision));
+      } catch (error) {
+        if (error instanceof NotesConflictError) throw new HttpError(409, error.message);
+        throw error;
+      }
+    }
+    if (req.method === "GET") return send(res, 200, await notes.get(url.searchParams.get("key") ?? ""));
+    if (req.method === "POST") {
+      const body = await readJson(req);
+      if (typeof body.text !== "string") throw new HttpError(400, "Send the note's text");
+      try {
+        return send(res, 200, await notes.set(String(body.key ?? ""), body.text, body.expectedRevision));
+      } catch (error) {
+        if (error instanceof NotesConflictError) return send(res, 409, { error: error.message, current: error.current });
+        throw new HttpError(400, error.message);
+      }
+    }
+  }
+  if (req.method === "GET" && parts[1] === "serve") return send(res, 200, manager.devServers.list());
+  if (await handleJourneys(req, res, url, parts)) return;
+  if (parts[1] === "preview" && req.method === "POST") {
+    const body = await readJson(req);
+    return send(res, 200, await attempt(() => previews.show(String(body.url ?? ""), req.headers.host)));
+  }
+  if (parts[1] === "snapshot" && req.method === "POST") {
+    const body = await readJson(req);
+    const localApp = (url2) => {
+      const target = previewTarget(url2.href);
+      return !!target && target.port !== PORT && target.port !== REMOTE_PORT;
+    };
+    try {
+      return send(res, 200, await takeSnapshot({ url: String(body.url ?? ""), width: Number(body.width), height: body.height === void 0 ? void 0 : Number(body.height), full: body.full === true }, { localApp }));
+    } catch (err) {
+      if (err instanceof SnapshotError) throw new HttpError(err.status, err.message);
+      throw err;
+    }
+  }
+  if (parts[1] === "shell") {
+    const id = parts[2];
+    if (!id && req.method === "GET") return send(res, 200, shells.list());
+    if (!id && req.method === "POST") {
+      const body = await readJson(req);
+      const cwd = String(body.cwd ?? "").trim();
+      if (!cwd.startsWith("/")) throw new HttpError(400, "The folder must be an absolute path");
+      if (!await stat(cwd).then((s) => s.isDirectory(), () => false)) throw new HttpError(404, "Folder not found");
+      if (!await manager.worktreeAt(cwd).then(Boolean, () => false)) {
+        await repoRoot(cwd).catch(() => {
+          throw new HttpError(400, "The terminal opens in a git repository or one of its worktrees");
+        });
+      }
+      manager.noteActivity();
+      try {
+        return send(res, 201, await shells.open(cwd, { pty: body.pty === true, cols: body.cols, rows: body.rows }));
+      } catch (err) {
+        if (err instanceof ShellLimitError) throw new HttpError(409, err.message);
+        throw err;
+      }
+    }
+    if (id && !shells.get(id)) throw new HttpError(404, "That terminal is gone (code-flow restarted?)");
+    if (id && req.method === "GET" && parts[3] === "events") return streamTopic(req, res, "shell", id);
+    if (id && req.method === "GET") return send(res, 200, shells.get(id));
+    if (id && req.method === "POST" && parts[3] === "input") {
+      const body = await readJson(req);
+      const keys = typeof body.binary === "string" ? body.binary : body.data;
+      if (typeof keys === "string" && shells.get(id)?.interactive) {
+        if (keys.length > 1e6) throw new HttpError(413, "That paste is too long");
+        if (!shells.type(id, keys, typeof body.binary === "string" ? "latin1" : "utf8")) throw new HttpError(409, "That shell has exited; open a new one");
+        return send(res, 200, shells.get(id));
+      }
+      if (typeof body.text !== "string" || body.text.length > 2e4) throw new HttpError(400, "Send a command");
+      if (!shells.write(id, body.text)) throw new HttpError(409, "That shell has exited; open a new one");
+      return send(res, 200, shells.get(id));
+    }
+    if (id && req.method === "POST" && parts[3] === "resize") {
+      const body = await readJson(req);
+      const [cols, rows] = [Number(body.cols), Number(body.rows)];
+      if (!Number.isInteger(cols) || !Number.isInteger(rows) || cols < 1 || rows < 1) throw new HttpError(400, "Send the size as whole numbers: cols and rows");
+      if (!shells.get(id)?.interactive) throw new HttpError(409, "Only an interactive terminal has a size");
+      if (!shells.resize(id, cols, rows)) throw new HttpError(409, "That shell has exited; open a new one");
+      return send(res, 200, shells.get(id));
+    }
+    if (id && req.method === "DELETE") return send(res, 200, { closed: shells.close(id) });
+  }
+  if (req.method === "POST" && parts[1] === "improve-prompt" && parts.length === 2) return improveTask(await readJson(req, 256 * 1024), res);
+  if (parts[1] === "model-catalog" && parts.length === 2 && ["GET", "POST"].includes(req.method ?? "")) {
+    const body = req.method === "POST" ? await readJson(req) : { antigravityExecution: url.searchParams.get("antigravityExecution") ?? void 0 };
+    const nativeAgy = antigravityExecution(body.antigravityExecution) === "native";
+    if (Object.keys(body).some((k) => !["allowResearch", "offline", "antigravityExecution"].includes(k)) || [body.allowResearch, body.offline].some((v) => v !== void 0 && typeof v !== "boolean")) throw new HttpError(400, "Invalid catalog refresh options");
+    const settings = await modelCatalogStore.settings(body.allowResearch);
+    const providers = await Promise.all((await agentAvailability()).map(async (a) => ({
+      provider: a.id,
+      available: a.available,
+      blockedReason: a.id === "agy" && nativeAgy ? void 0 : permissionProviderProblem(a.id, catalogPermissions("standard", false, false)) ?? (a.available ? await getAdapter(a.id).managedAvailability?.() : void 0),
+      limitations: a.id === "agy" && nativeAgy ? [AGY_NATIVE_LIMITATION] : getAdapter(a.id).managedLimitations,
+      catalog: await modelCatalogStore.get(a.id, { context: a.id === "agy" && !nativeAgy && process.platform === "darwin" ? { isolatedAgy: true } : void 0, force: req.method === "POST", offline: !a.available || body.offline })
+    })));
+    return send(res, 200, { providers, ...settings, offline: process.env.CODEFLOW_MODEL_NETWORK === "offline" });
+  }
+  if (req.method === "GET" && parts[1] === "models") {
+    const agents = await agentAvailability();
+    const entries = await Promise.all(
+      agents.map(async (a) => {
+        if (!a.available) return [a.id, { error: "not installed" }];
+        return [a.id, await agentCatalog(a.id).catch((err) => ({ error: err.message }))];
+      })
+    );
+    return send(res, 200, Object.fromEntries(entries));
+  }
+  if (parts[1] === "runs") {
+    const runId = parts[2];
+    if (!runId) {
+      if (req.method === "GET") {
+        if (!url.searchParams.has("limit")) return send(res, 200, fileAccess.list());
+        const status = url.searchParams.get("status") ?? "all";
+        const section = url.searchParams.get("section") ?? void 0;
+        if (!HISTORY_STATUSES.includes(status)) throw new HttpError(400, "Invalid history status");
+        if (section && !["waiting", "running", "results"].includes(section)) throw new HttpError(400, "Invalid project history section");
+        const project = url.searchParams.get("project"), inventory = projects.list();
+        return send(res, 200, await attempt(async () => fileAccess.page({
+          limit: Number(url.searchParams.get("limit")),
+          cursor: url.searchParams.get("cursor") ?? void 0,
+          before: url.searchParams.has("before") ? Number(url.searchParams.get("before")) : void 0,
+          query: url.searchParams.get("q") ?? void 0,
+          status: status === "all" ? void 0 : status,
+          section,
+          pattern: url.searchParams.get("pattern") ?? void 0,
+          agent: url.searchParams.get("agent") ?? void 0,
+          repo: url.searchParams.get("repo") ?? void 0,
+          predicate: project ? (run2) => (projectOf(run2, inventory) ?? "none") === project : void 0
+        })));
+      }
+      if (req.method === "POST") {
+        const body = await readJson(req);
+        const run2 = await startFromBody(body);
+        if (run2.project && body.remember === true && !body.parentRunId) {
+          void projects.remember(run2.project, { pattern: run2.pattern, roles: requestedRoles(findPattern(run2.pattern), body.roles), roleSettings: run2.roleSettings, agentSettings: validateAgentSettings(body.agentSettings) });
+        }
+        return send(res, 201, { id: run2.id, project: run2.project });
+      }
+    }
+    const run = runId ? await manager.getAsync(runId) : void 0;
+    if (!run) throw new HttpError(404, "Run not found");
+    if (req.method === "GET" && parts[3] === "transcript" && parts.length === 4) {
+      const abort = new AbortController();
+      res.once("close", () => abort.abort());
+      try {
+        return send(res, 200, await transcriptPage(run.id, { before: url.searchParams.get("before") ?? void 0, step: url.searchParams.get("step") ?? void 0, signal: abort.signal }));
+      } catch (error) {
+        if (error instanceof TranscriptCursorError) throw new HttpError(409, error.message);
+        throw error;
+      }
+    }
+    if (parts[3] === "collaboration" && parts.length === 4) {
+      if (req.method === "GET") return send(res, 200, await attempt(() => collaborationReviews.list(run.id)));
+      if (req.method === "POST") {
+        const body = await readJson(req, 16 * 1024, { timeoutMs: 1e4 });
+        if (typeof body.branch !== "string" || !run.worktrees.some((tree) => tree.branch === body.branch)) throw new HttpError(400, "Choose an owned result branch");
+        return send(res, 201, await attempt(() => collaborationReviews.add(run.id, { branch: body.branch, expectedHead: body.expectedHead, text: body.text }, { id: "owner", name: "Owner" }, async () => (await manager.reviewCoverage(run.id, body.branch)).head)));
+      }
+      throw new HttpError(405, "Use GET or POST for human collaboration comments");
+    }
+    if (parts[3] === "pr-threads" && parts.length === 4 && ["GET", "POST"].includes(req.method ?? "")) {
+      const branch = url.searchParams.get("branch") ?? "", prUrl = branch ? run.prs[branch] : run.source?.kind === "pr" ? run.source.url : Object.values(run.prs).length === 1 ? Object.values(run.prs)[0] : void 0;
+      if (!prUrl) throw new HttpError(400, "Choose a pull request stored on this run");
+      const abort = new AbortController();
+      res.once("close", () => abort.abort());
+      try {
+        if (req.method === "GET") return send(res, 200, await reviewThreads.list(run.repo, prUrl, abort.signal));
+        const body = await readJson(req);
+        if (!body || typeof body !== "object" || Array.isArray(body)) throw new HttpError(400, "Provide a review thread action object");
+        if (body.action === "load") return send(res, 200, await reviewThreads.detail(run.repo, prUrl, { snapshotId: body.snapshotId, threadId: body.threadId }, abort.signal));
+        if (body.action !== "resolve") throw new HttpError(400, "Choose load or an explicit resolve action");
+        return send(res, 200, await reviewThreads.setResolved(run.repo, prUrl, body, abort.signal));
+      } catch (error) {
+        if (error instanceof HttpError) throw error;
+        if (error instanceof ReviewThreadError) throw new HttpError(error.status, error.message);
+        throw new HttpError(502, error.message);
+      }
+    }
+    if (req.method === "GET" && parts.length === 3) return send(res, 200, run);
+    if (req.method === "GET" && parts[3] === "evaluation") {
+      const report = (await teamEvaluationStore.list()).find((item) => item.runId === run.id && item.at === run.endedAt);
+      if (report) return send(res, 200, report);
+      const journal = await loadJournal(run.id, { strict: run.pattern === "auto-team" });
+      const memoryEntries = run.project && projects.get(run.project)?.repos.includes(run.repo) ? await memoryStore.list({ repo: run.repo, projectId: run.project, scope: "project" }, { kind: "user", repo: run.repo, projectId: run.project }) : [];
+      return send(res, 200, buildTeamEvaluation(run, { replay: run.recovery, journal, memoryEntries }));
+    }
+    if (req.method === "GET" && parts[3] === "export") {
+      return send(res, 200, redactExport({ version: 1, exportedAt: Date.now(), run, verificationMarkdown: run.verification ? renderVerificationReport(run.verification) : void 0, events: url.searchParams.get("transcript") === "1" ? await manager.events(run.id) : void 0 }));
+    }
+    if (parts[3] === "review-coverage") {
+      if (req.method === "GET") return send(res, 200, await attempt(() => manager.reviewCoverage(run.id, url.searchParams.get("branch") ?? "")));
+      if (req.method === "POST") {
+        const body = await readJson(req);
+        return send(res, 200, await attempt(() => manager.recordFileReview(run.id, body)));
+      }
+    }
+    if (parts[3] === "outcome" && parts.length === 4 && req.method === "POST") {
+      const body = await readJson(req);
+      return send(res, 200, await attempt(() => manager.recordOutcome(run.id, body)));
+    }
+    if (parts[3] === "human-rework" && req.method === "POST") {
+      const body = await readJson(req);
+      return send(res, 201, await attempt(() => manager.recordHumanRework(run.id, body)));
+    }
+    if (parts[3] === "launch-profiles") {
+      const body = req.method === "POST" ? await readJson(req) : {};
+      const name = typeof body.worktree === "string" ? body.worktree : url.searchParams.get("worktree");
+      const worktree = run.worktrees.find((tree) => tree.name === name);
+      if (!worktree) throw new HttpError(400, "Choose a worktree owned by this run");
+      const key = `${run.id}/${worktree.name}/launch`;
+      if (req.method === "DELETE") return send(res, 200, { stopped: launchProfiles.stop(key) });
+      const config = await readLaunchProfiles(worktree.path);
+      if (req.method === "GET") return send(res, 200, redactExport({ ...config, session: launchProfiles.get(key) ?? null }));
+      if (req.method === "POST") {
+        const profile = config.profiles.find((profile2) => profile2.id === body.profile);
+        if (!profile) throw new HttpError(400, config.error ?? "Choose a configured launch profile");
+        const abort = new AbortController();
+        res.once("close", () => abort.abort());
+        try {
+          manager.noteActivity();
+          return send(res, 201, redactExport(await launchProfiles.start(key, worktree.path, profile, { signal: abort.signal, lockdown: run.lockdown, allowUntrusted: body.allowUntrusted === true })));
+        } catch (error) {
+          if (error instanceof LaunchProfileError) throw Object.assign(new HttpError(error.status, error.message), { confirm: error.confirm });
+          throw new HttpError(400, error.message);
+        }
+      }
+      throw new HttpError(404, "Unknown launch profile operation");
+    }
+    if (req.method === "GET" && parts[3] === "events") return await streamTopic(req, res, "run", run.id);
+    if (req.method === "POST" && parts[3] === "revise-goal") {
+      const body = await readJson(req);
+      const revised = await attempt(() => manager.reviseGoal(run.id, { message: body.message, budget: body.budget === void 0 ? void 0 : { maxSteps: body.budget?.maxSteps, maxInvocations: body.budget?.maxInvocations, maxMinutes: body.budget?.maxMinutes } }));
+      return send(res, 201, { id: revised.id });
+    }
+    if (req.method === "POST" && parts[3] === "rerun-tasks") {
+      const body = await readJson(req);
+      const child = await attempt(() => manager.rerunTeamTasks(run.id, body));
+      return send(res, 201, { id: child.id });
+    }
+    if (req.method === "POST" && parts[3] === "pause") {
+      const body = await readJson(req);
+      return send(res, 200, await attempt(async () => manager.setPaused(run.id, body.paused !== false)));
+    }
+    if (req.method === "POST" && parts[3] === "task-priority" && parts.length === 4) {
+      const body = await readJson(req);
+      return send(res, 200, await attempt(async () => manager.setTaskPriority(run.id, body)));
+    }
+    if (req.method === "POST" && parts[3] === "priority") {
+      const body = await readJson(req);
+      return send(res, 200, await attempt(async () => manager.setPriority(run.id, body.priority)));
+    }
+    if (req.method === "POST" && parts[3] === "provider-chat" && parts.length === 4) {
+      const body = await readJson(req, 64 * 1024);
+      const { roles } = await validateRoles(findPattern("solo"), { agent: [body.agent] }, run.repo, run.loop.remoteWorker, run.trust);
+      const next = await attempt(() => manager.startProviderChat(run.id, { agent: roles.agent[0], settings: body.settings, message: body.message }));
+      return send(res, 201, { id: next.id });
+    }
+    if (req.method === "POST" && parts[3] === "fork") {
+      const body = await readJson(req);
+      const checkpoint = typeof body.commit === "string" ? body.commit : void 0;
+      if (!checkpoint || !/^[a-f0-9]{40,64}$/i.test(checkpoint)) throw new HttpError(400, "Choose an exact checkpoint commit");
+      const owned = await Promise.all(run.worktrees.map(async (tree) => (await git(["merge-base", "--is-ancestor", checkpoint, tree.branch], run.repo)).code === 0));
+      if (!owned.some(Boolean)) throw new HttpError(400, "The checkpoint is not part of this run");
+      const fork = await startFromBody({ repo: run.repo, project: run.project, pattern: run.pattern, task: typeof body.task === "string" ? body.task : run.task, baseRef: checkpoint, parentRunId: run.id, roles: run.roles, options: run.options, loop: run.loop, agentSettings: run.agentSettings, roleSettings: run.roleSettings, trust: run.trust, approvals: run.approvals });
+      return send(res, 201, { id: fork.id });
+    }
+    if (req.method === "POST" && parts[3] === "cancel") return send(res, 200, { cancelled: manager.cancel(run.id) });
+    if (req.method === "POST" && parts[3] === "resume") {
+      await manager.resume(run.id).catch((err) => {
+        throw new HttpError(400, err.message);
+      });
+      return send(res, 200, { resumed: true });
+    }
+    if (req.method === "POST" && parts[3] === "project") {
+      const body = await readJson(req);
+      if (typeof body.project !== "string" || !projects.get(body.project)) throw new HttpError(400, "Pick a project");
+      return send(res, 200, await attempt(() => manager.setProject(run.id, body.project)));
+    }
+    if (req.method === "POST" && parts[3] === "seen") {
+      manager.setSeen(run.id, true);
+      return send(res, 200, { seen: true });
+    }
+    if (req.method === "DELETE" && parts.length === 3) {
+      await attempt(() => manager.deleteRun(run.id));
+      return send(res, 200, { deleted: true });
+    }
+    if (req.method === "POST" && parts[3] === "archive") {
+      const body = await readJson(req);
+      if (body.archived === false) {
+        await attempt(async () => manager.setArchived(run.id, false));
+        return send(res, 200, { archived: false });
+      }
+      const result = await attempt(() => manager.archive(run.id, { cleanup: body.cleanup !== false, deleteBranches: !!body.deleteBranches }));
+      return send(res, 200, { archived: true, ...result });
+    }
+    if (req.method === "GET" && parts[3] === "diff") {
+      const files = await attempt(() => manager.diff(run.id, url.searchParams.get("branch") ?? "", url.searchParams.get("last") === "1"));
+      return send(res, 200, filterPolicyDiff(await fileAccess.forRepo(run.repo, run), files));
+    }
+    if (req.method === "POST" && parts[3] === "followups") {
+      const body = await readJson(req);
+      if (!isAgentId(body.agent)) throw new HttpError(400, "Pick an agent");
+      const side = body.kind === "side" ? sideTurn(body.side) : void 0;
+      await attempt(
+        () => manager.followUp(run.id, {
+          kind: side ? "side" : body.kind === "resolve-conflicts" ? "resolve-conflicts" : body.kind === "reply" ? "reply" : "comments",
+          side,
+          worktree: String(body.worktree ?? ""),
+          agent: body.agent,
+          settings: body.settings,
+          trust: body.trust,
+          tools: body.tools,
+          message: typeof body.message === "string" ? body.message : void 0,
+          mergeFrom: typeof body.mergeFrom === "string" ? body.mergeFrom : void 0,
+          budget: body.budget === void 0 ? void 0 : { maxSteps: body.budget?.maxSteps, maxInvocations: body.budget?.maxInvocations, maxMinutes: body.budget?.maxMinutes },
+          attachments: Array.isArray(body.attachments) ? body.attachments.filter((a) => a && typeof a.data === "string").map((a) => ({ name: String(a.name ?? "file"), data: a.data })) : void 0
+        })
+      );
+      return send(res, 200, { ok: true });
+    }
+    if (parts[3] === "worktrees" && parts[4]) {
+      const wt = run.worktrees.find((w) => w.name === parts[4]);
+      if (!wt) throw new HttpError(404, "Unknown worktree");
+      const key = `${run.id}/${wt.name}`;
+      if (req.method === "POST" && parts[5] === "open") {
+        const body = await readJson(req);
+        const target = body.target === "editor" || body.target === "finder" ? body.target : "terminal";
+        return send(res, 200, { openedWith: await attempt(() => openFolder(wt.path, target)) });
+      }
+      if (parts[5] === "serve" && parts[6] === "ready" && parts.length === 7 && req.method === "GET") return send(res, 200, { ready: await manager.devServers.ready(key), status: manager.devServers.get(key)?.status ?? "missing" });
+      if (parts[5] === "serve") {
+        if (req.method === "GET") return send(res, 200, manager.devServers.get(key) ?? null);
+        if (req.method === "DELETE") return send(res, 200, { stopped: manager.devServers.stop(key) });
+        if (req.method === "POST") {
+          const body = await readJson(req);
+          const command = typeof body.command === "string" && body.command.trim() || run.app?.command;
+          if (!command) throw new HttpError(400, 'Say how to run the app (e.g. "npm run dev"), or add "run" to .codeflow/config.json');
+          if (/[\r\n]/.test(command)) throw new HttpError(400, "The command must be a single line");
+          if (run.lockdown && body.allowUntrusted !== true) {
+            throw Object.assign(new HttpError(409, `${run.lockdown}. Run app starts that code on this machine, outside any sandbox or container.`), { confirm: "allowUntrusted" });
+          }
+          manager.noteActivity();
+          return send(res, 200, await manager.devServers.start(key, wt.path, command, run.app?.port));
+        }
+      }
+    }
+    if (req.method === "POST" && parts[3] === "notes") {
+      const body = await readJson(req);
+      const note = await attempt(async () => typeof body.requestId === "string" ? manager.answerTeamQuestion(run.id, body.requestId, String(body.text ?? "")) : (run.team ? manager.addTeamNote.bind(manager) : manager.addNote.bind(manager))(run.id, String(body.text ?? ""), isAgentId(body.agent) ? body.agent : void 0, typeof body.memberId === "string" ? body.memberId : void 0));
+      return send(res, 200, note);
+    }
+    if (req.method === "POST" && parts[3] === "answer") {
+      const body = await readJson(req);
+      const decision = body.decision;
+      if (decision !== "approve" && decision !== "revise" && decision !== "reject") throw new HttpError(400, "Unknown decision");
+      await attempt(async () => manager.answer(run.id, { decision, note: typeof body.note === "string" ? body.note : void 0 }));
+      return send(res, 200, { ok: true });
+    }
+    if (req.method === "POST" && parts[3] === "team-plan") {
+      const body = await readJson(req);
+      return send(res, 200, { team: await attempt(() => manager.editTeamPlan(run.id, body)) });
+    }
+    if (req.method === "POST" && parts[3] === "merge") {
+      const body = await readJson(req);
+      const outcome = await attempt(
+        () => manager.merge(run.id, { branch: String(body.branch ?? ""), into: String(body.into ?? ""), archiveAfter: !!body.archiveAfter, requireValidation: body.requireValidation === true })
+      );
+      return send(res, 200, outcome);
+    }
+    if (req.method === "POST" && parts[3] === "validate-merge") {
+      const body = await readJson(req);
+      const abort = new AbortController();
+      res.once("close", () => abort.abort());
+      try {
+        return send(res, 200, await manager.validateMerge(run.id, { branch: String(body.branch ?? ""), into: String(body.into ?? ""), allowUntrusted: body.allowUntrusted === true }, abort.signal));
+      } catch (error) {
+        if (error instanceof UntrustedSourceError) throw Object.assign(new HttpError(409, error.message), { confirm: "allowUntrusted" });
+        throw new HttpError(400, error.message);
+      }
+    }
+    if (req.method === "GET" && parts[3] === "pr-merge") {
+      return send(res, 200, await attempt(() => manager.prMergeInfo(run.id, url.searchParams.get("branch") ?? "")));
+    }
+    if (req.method === "POST" && parts[3] === "merge-pr") {
+      const body = await readJson(req);
+      if (!MERGE_METHODS.includes(body.method)) throw new HttpError(400, "Pick how to merge: merge, squash or rebase");
+      const outcome = await attempt(() => manager.mergePr(run.id, { branch: String(body.branch ?? ""), method: body.method, archiveAfter: !!body.archiveAfter }));
+      return send(res, 200, outcome);
+    }
+    if (req.method === "GET" && parts[3] === "pr-targets") {
+      const targets = await attempt(async () => {
+        const { branches } = await remoteBranches(run.repo);
+        return { branches, initial: await manager.pullRequestTarget(run.id) };
+      });
+      return send(res, 200, targets);
+    }
+    if (req.method === "POST" && parts[3] === "pr") {
+      const body = await readJson(req);
+      const prUrl = await attempt(() => manager.pullRequest(run.id, { branch: String(body.branch ?? ""), into: String(body.into ?? "") }));
+      return send(res, 200, { url: prUrl });
+    }
+    if (req.method === "POST" && parts[3] === "triage") {
+      const body = await readJson(req);
+      if (!["approve", "revise", "reject"].includes(body.decision)) throw new HttpError(400, "Unknown decision");
+      await attempt(() => manager.triage(run.id, { decision: body.decision, note: typeof body.note === "string" ? body.note : void 0, openPr: !!body.openPr, pushPr: !!body.pushPr, budget: body.budget === void 0 ? void 0 : { maxSteps: body.budget?.maxSteps, maxInvocations: body.budget?.maxInvocations, maxMinutes: body.budget?.maxMinutes } }));
+      return send(res, 200, { ok: true });
+    }
+    if (req.method === "POST" && parts[3] === "push-pr") {
+      const body = await readJson(req);
+      return send(res, 200, await attempt(() => manager.pushToPr(run.id, { branch: String(body.branch ?? "") })));
+    }
+    if (req.method === "POST" && parts[3] === "post-review") {
+      return send(res, 200, { url: await attempt(() => manager.postReview(run.id)) });
+    }
+    if (req.method === "POST" && parts[3] === "watch") {
+      const body = await readJson(req);
+      const branch = String(body.branch ?? "");
+      if (body.stop) {
+        await attempt(async () => manager.unwatchPr(run.id, branch));
+        return send(res, 200, { watching: false });
+      }
+      if (!isAgentId(body.agent)) throw new HttpError(400, "Pick the agent that fixes problems");
+      const allow = Array.isArray(body.allow) ? body.allow.filter((a) => typeof a === "string").slice(0, 20) : [];
+      const watch = await attempt(async () => manager.watchPr(run.id, { branch, agent: body.agent, maxFixes: Number(body.maxFixes) || void 0, allow }));
+      void watcher.poll();
+      return send(res, 200, watch);
+    }
+  }
+  throw new HttpError(404, "Not found");
+}
+await manager.load();
+await projects.load(manager.list());
+await acpConnections.load().catch((error) => logError("ACP connections unavailable; repair their configuration and restart", error));
+await collab.load();
+await teamConnections.load();
+await fileAccess.all().catch((error) => logError("Filesystem policy is unavailable; protected operations and extension loading remain disabled until the private policy file is repaired", error));
+filteredTasksReady = await filteredTasks.load().then(() => true, (error) => {
+  logError("Filtered tasks unavailable; policy activation remains blocked until task receipts are repaired", error);
+  return false;
+});
+if (!fileAccess.hasRestrictions()) await extensions.load().catch((error) => logError("Extension configuration could not be loaded; built-in workflows remain available", error));
+else logWarn("Extensions deferred: custom filesystem policy cannot isolate trusted plugin initialization; clear the policy and restart to load extensions");
+await codeHostsApi.service.load();
+await automations.load();
+await projectTeams.load().catch((error) => {
+  projectTeams.store.faults.set("storage", error.message);
+  logError("Project teams disabled: their private storage cannot be read", error);
+});
+await deferredRuns.load();
+await coordinatedApi.service.load();
+await coordinatedApi.recover().catch((error) => logError("A coordinated launch requires manual recovery", error));
+await recoverDeferredRuns(deferredRuns, manager).catch((error) => logError("A deferred launch requires manual recovery", error));
+remote = await loadRemote();
+if (!tlsConfigured) {
+  try {
+    const certificate = await loadRemoteCertificate(void 0, true);
+    if (certificate) {
+      savedCertificate = validateRemoteCertificate(certificate, Date.now(), true);
+      phoneTls = { cert: certificate.cert, key: certificate.key };
+      phoneProtocol = "https";
+    }
+  } catch (error) {
+    tlsLoadError = error.message;
+    logWarn(tlsLoadError);
+  }
+}
+await certificateRenewal.load().catch((error) => logWarn(error.message));
+await phoneSessions.load().catch((error) => logError("Phone pairing disabled: session storage cannot be read", error));
+if (notificationsReady) {
+  projectTeams.store.subscribe(() => {
+    for (const team of projectTeams.list()) void notifications.observeProjectTeam(team).catch((error) => logError("Project team notification could not be retained", error));
+  });
+  manager.subscribeAll((run) => {
+    if (!run.deleted) void notifications.observe(run).catch((error) => logError("Notification event could not be retained", error));
+  });
+  approvals.subscribe(() => {
+    for (const request of approvals.list()) {
+      const run = request.status === "pending" ? manager.get(request.runId) : void 0;
+      if (run) void notifications.observe(run, `tool-approval:${request.id}`).catch((error) => logError("Approval notification could not be retained", error));
+    }
+  });
+}
+if (!fileAccess.hasRestrictions()) startPolicyBackground();
+else await pausePolicyBackground();
+teamConnections.start();
+await teamTerminals.load().then(() => teamTerminals.start()).catch((error) => logError("Team terminals disabled: repair their access storage", error));
+await hostExecution.load().then(() => hostExecution.start()).catch((error) => logError("Host execution disabled: repair its queue storage", error));
+const teamPruneTimer = setInterval(() => {
+  if (collab.available) void collab.prune().catch((error) => logError("Team board housekeeping failed", error));
+}, 60 * 6e4);
+teamPruneTimer.unref();
+if (!process.env.CODEFLOW_SSH_HOST) void (async () => {
+  if (remote.transport === "tailscale") await refreshTailscale();
+  await syncLanServer();
+  await renewRemoteCertificate();
+})().catch((error) => logError("Remote access startup failed", error));
+const tailscaleTimer = setInterval(() => {
+  if (!process.env.CODEFLOW_SSH_HOST && remote.enabled && remote.lan) {
+    void (remote.transport === "tailscale" ? refreshTailscale() : Promise.resolve()).then(() => syncLanServer()).catch((err) => logError("Tailscale access refresh failed", err));
+  }
+}, 1e4);
+tailscaleTimer.unref();
+const certificateRenewalTimer = setInterval(() => {
+  void renewRemoteCertificate().catch((error) => logError("Certificate renewal failed", error));
+}, 6e4);
+certificateRenewalTimer.unref();
+function listener(via) {
+  return (req, res) => {
+    handle(req, res, via).catch((err) => {
+      const status = err instanceof HttpError ? err.status : 500;
+      if (status >= 500) logError(`${req.method} ${req.url?.split("?")[0]} failed`, err);
+      if (res.headersSent) return res.end();
+      send(res, status, { error: err.message, confirm: err.confirm, signIn: err.signIn });
+    }).finally(() => fileAccess.end(req));
+  };
+}
+const server = createServer({ maxHeaderSize: MAX_HEADER_SIZE }, listener("local")).listen(PORT, HOST, async () => {
+  const agents = fileAccess.hasRestrictions() ? [] : await trackPolicyPreparation(() => agentAvailability());
+  const runs = manager.list();
+  console.log(`code-flow running at http://localhost:${PORT}  (${runs.length} runs loaded from ${CODEFLOW_HOME})`);
+  console.log(`  Open http://localhost:${PORT}/?token=${auth.token}  (the first browser to open code-flow signs in without it)`);
+  if (process.env.CODEFLOW_LAUNCHER === "1" && process.connected)
+    process.send?.({ type: "codeflow-ready", url: `http://localhost:${PORT}/?token=${auth.token}` });
+  for (const a of agents) console.log(`  ${a.available ? "\u2713" : "\u2717"} ${a.displayName} (${a.binary})`);
+  const gitHealth = await checkGit();
+  if (!gitHealth.ok) {
+    console.log(`  \u2717 ${gitHealth.warning}`);
+    logWarn(gitHealth.warning ?? "git check failed");
+  }
+  const interrupted = runs.filter((r) => r.status === "interrupted").length;
+  if (interrupted) console.log(`  ${interrupted} interrupted run(s) can be resumed from the UI`);
+});
+let listenAttempts = 0;
+server.on("error", (err) => {
+  if (err.code === "EADDRINUSE" && ++listenAttempts <= 40) {
+    if (listenAttempts === 1) console.log(`Port ${PORT} is busy; waiting for it to be released\u2026`);
+    setTimeout(() => server.listen(PORT, HOST), 500);
+    return;
+  }
+  console.error(err.code === "EADDRINUSE" ? `Port ${PORT} is still in use. Is code-flow already running?` : err);
+  process.exit(1);
+});
+async function startComparison(body) {
+  const variants = Array.isArray(body.variants) ? body.variants.slice(0, 6) : [];
+  if (variants.length < 2) throw new HttpError(400, "Add at least two setups to compare");
+  const repeat = Math.min(3, Math.max(1, Math.round(Number(body.repeat) || 1)));
+  if (variants.length * repeat > 9) throw new HttpError(400, "That's more than 9 runs; compare fewer setups or repeat less");
+  const base = body.run && typeof body.run === "object" ? body.run : {};
+  const inputs = await Promise.all(
+    variants.map(async (v, i) => {
+      const label = String(v.label ?? "").trim().slice(0, 40) || `Setup ${i + 1}`;
+      return {
+        label,
+        input: await buildStartInput({ ...base, task: v.task ?? base.task, pattern: v.pattern ?? base.pattern, roles: v.roles ?? base.roles, options: v.options ?? base.options, roleSettings: v.roleSettings ?? base.roleSettings })
+      };
+    })
+  );
+  const group = { id: `g${Date.now().toString(36)}${randomBytes(2).toString("hex")}` };
+  const started = [];
+  for (let n = 1; n <= repeat; n++) {
+    for (const { label, input } of inputs) {
+      const run = await manager.start({ ...input, group: { id: group.id, label: repeat > 1 ? `${label} #${n}` : label } }).catch((err) => {
+        throw new HttpError(400, `${label}: ${err.message}`);
+      });
+      started.push(run.id);
+    }
+  }
+  return { group: group.id, runs: started };
+}
+function runsIn(project) {
+  const all = manager.list();
+  if (typeof project !== "string" || !project) return all;
+  const list = projects.list();
+  return all.filter((r) => (projectOf(r, list) ?? "none") === project);
+}
+async function diskUsage(all, repo) {
+  const runs = all.filter((r) => !repo || r.repo === repo);
+  const sizes = await folderSizes(runs.map((r) => r.worktreeDir));
+  const list = runs.filter((r) => sizes[r.worktreeDir] !== void 0).map((r) => ({ id: r.id, task: r.task.split("\n")[0].slice(0, 100), repo: r.repo, status: r.status, archived: r.archived, endedAt: r.endedAt, bytes: sizes[r.worktreeDir] })).sort((a, b) => b.bytes - a.bytes);
+  return { total: list.reduce((n, r) => n + r.bytes, 0), runs: list };
+}
+async function cleanUp(all, days, repo) {
+  const cutoff = Date.now() - days * 864e5;
+  const done = [];
+  let removed = 0;
+  for (const r of all) {
+    if (repo && r.repo !== repo) continue;
+    if (r.status === "running" || !r.endedAt || r.endedAt > cutoff || !r.seen) continue;
+    if (r.triage?.state === "pending" || Object.values(r.watches).some((w) => ["watching", "fixing", "green"].includes(w.state))) continue;
+    const result = await removeWorktrees(r.repo, r.worktrees, false).catch((err) => ({ removed: [], deletedBranches: [], failed: [err.message] }));
+    if (result.failed.length) manager.log(r.id, `Clean-up couldn't remove everything: ${result.failed.join("; ")}`, "warn");
+    if (!result.removed.length) continue;
+    removed += result.removed.length;
+    done.push(r.id);
+    if (!r.archived) manager.setArchived(r.id, true);
+    manager.log(r.id, `Cleaned up: removed ${result.removed.length} worktree(s); branches kept`);
+  }
+  return { runs: done.length, worktrees: removed };
+}
+let stopping = false;
+async function stop(reason, code = 0) {
+  if (stopping) process.exit(1);
+  stopping = true;
+  performanceMetrics.close();
+  await closeCodeIntelligence();
+  console.log(`
+Stopping code-flow (${reason}): interrupting running runs so they can be resumed\u2026`);
+  logInfo(`Stopping: ${reason}`);
+  let automationsSaved = Promise.resolve();
+  try {
+    server.close();
+    remoteStopping = true;
+    clearInterval(tailscaleTimer);
+    clearInterval(certificateRenewalTimer);
+    clearInterval(teamPruneTimer);
+    lanServer?.close();
+    lanServer?.closeAllConnections();
+    closeLanConnections();
+    watcher.stop();
+    approvals.close();
+    launchProfiles.stopAll();
+    shells.closeAll();
+    previews.closeAll();
+    sshPreviews.closeAll();
+    automationsSaved = automations.stop();
+  } catch {
+  }
+  await teamTerminals.close().catch((err) => logError("Team terminal shutdown failed", err));
+  await sshProjects?.close();
+  await Promise.race([teamConnections.close(), new Promise((resolve) => setTimeout(resolve, 5e3).unref())]).catch((err) => logError("Team runner shutdown failed", err));
+  await hostExecution.close().catch((err) => logError("Host execution shutdown failed", err));
+  await collab.close().catch((err) => logError("Team board shutdown failed", err));
+  await projectTeams.stop().catch((err) => logError("Project team shutdown failed", err));
+  await coordinatedApi.service.stop().catch((err) => logError("Coordinated changes shutdown failed", err));
+  await deferredRuns.stop().catch((err) => logError("Deferred queue shutdown failed", err));
+  docsHelp.close();
+  for (const controller of improvingControllers) controller.abort();
+  await filteredTasks.close().catch((err) => logError("Filtered task shutdown failed; inspect its durable unknown receipt before retrying", err));
+  await manager.shutdown().catch((err) => logError("Shutdown failed", err));
+  await teamToolBridge.close().catch(() => void 0);
+  await automationsSaved;
+  await notifications.stop();
+  process.exit(code);
+}
+for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+  process.on(signal, () => void stop(signal));
+}
+if (process.env.CODEFLOW_LAUNCHER === "1") process.on("disconnect", () => void stop("launcher disconnected"));